diff --git a/.agents/skills/wrdn-effect-atom-optimistic/SKILL.md b/.agents/skills/wrdn-effect-atom-optimistic/SKILL.md
index 44b6ef488..5f121ccc2 100644
--- a/.agents/skills/wrdn-effect-atom-optimistic/SKILL.md
+++ b/.agents/skills/wrdn-effect-atom-optimistic/SKILL.md
@@ -41,7 +41,7 @@ When the trace cannot resolve with the files at hand, drop the finding.
 - `useState` for a "busy" / "submitting" boolean used to disable a button while the mutation runs. That is not optimistic state.
 - `setTimeout` / `setInterval` based debouncing or rate-limiting around a mutation. Different concern.
 - Toast / error-message state. UI feedback, not optimistic data.
-- Server-only code (`apps/cloud`, `apps/local`, `packages/core/**`). This skill is React-specific; do not flag backend handlers, plugin storage, or test helpers.
+- Server-only code (`legacy/cloud`, `legacy/local`, `packages/core/**`). This skill is React-specific; do not flag backend handlers, plugin storage, or test helpers.
 - Storybook files, test files, and example-only code. The pattern matters in shipped UI; not in fixtures.
 
 ## Severity ladder
diff --git a/.changeset/README.md b/.changeset/README.md
deleted file mode 100644
index 7c9773cf4..000000000
--- a/.changeset/README.md
+++ /dev/null
@@ -1,24 +0,0 @@
-# Changesets
-
-This repo uses Changesets to drive releases for the published `executor` CLI.
-
-## What to put in a changeset
-
-Only `executor` is managed directly by Changesets.
-
-Release PRs should only mention the published CLI package directly. Changesets
-will still version the fixed release group and dependent public packages as
-needed, and will update each affected package's `CHANGELOG.md`.
-
-Write the changeset body as the package changelog entry you want to appear in
-the Version Packages PR and in the affected package changelogs. Keep broader
-user-facing launch notes in `apps/cli/release-notes/next.md`; those are used for
-the GitHub Release body.
-
-## Beta releases
-
-Use prerelease mode for beta trains:
-
-- `bun run release:beta:start`
-- merge release PRs while prerelease mode is active
-- `bun run release:beta:stop` when you want to return to stable releases
diff --git a/.changeset/config.json b/.changeset/config.json
deleted file mode 100644
index 56e35abe8..000000000
--- a/.changeset/config.json
+++ /dev/null
@@ -1,42 +0,0 @@
-{
-  "$schema": "https://unpkg.com/@changesets/config@3.1.3/schema.json",
-  "changelog": ["@changesets/changelog-github", { "repo": "RhysSullivan/executor" }],
-  "commit": false,
-  "fixed": [
-    [
-      "@executor-js/sdk",
-      "@executor-js/codemode-core",
-      "@executor-js/runtime-quickjs",
-      "@executor-js/execution",
-      "@executor-js/config",
-      "executor",
-      "@executor-js/plugin-file-secrets",
-      "@executor-js/plugin-graphql",
-      "@executor-js/plugin-keychain",
-      "@executor-js/plugin-mcp",
-      "@executor-js/plugin-onepassword",
-      "@executor-js/plugin-openapi",
-      "@executor-js/plugin-example",
-      "@executor-js/plugin-desktop-settings",
-      "@executor-js/desktop"
-    ]
-  ],
-  "linked": [],
-  "access": "public",
-  "baseBranch": "main",
-  "updateInternalDependencies": "patch",
-  "___experimentalUnsafeOptions_WILL_CHANGE_IN_PATCH": {
-    "onlyUpdatePeerDependentsWhenOutOfRange": true
-  },
-  "ignore": [
-    "@executor-js/local",
-    "@executor-js/host-mcp",
-    "@executor-js/ir",
-    "@executor-js/runtime-deno-subprocess",
-    "@executor-js/marketing",
-    "@executor-js/runtime-dynamic-worker",
-    "@executor-js/plugin-workos-vault",
-    "@executor-js/example-promise-sdk",
-    "@executor-js/app"
-  ]
-}
diff --git a/.codex/environments/environment.toml b/.codex/environments/environment.toml
index a068f80ef..85231bc81 100644
--- a/.codex/environments/environment.toml
+++ b/.codex/environments/environment.toml
@@ -67,9 +67,9 @@ icon = "run"
 command = "bun i"
 
 [[actions]]
-name = "Run Local Server"
+name = "Run Legacy Local Server"
 icon = "tool"
 command = '''
-cd apps/local
+cd legacy/local
 bun dev
 '''
diff --git a/.dockerignore b/.dockerignore
index 792e93cda..fb1787aca 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -8,3 +8,6 @@
 **/.next
 **/*.log
 .claude
+secrets
+**/secret.key
+**/master.key
diff --git a/.github/ISSUE_TEMPLATE/desktop-crash.yml b/.github/ISSUE_TEMPLATE/desktop-crash.yml
deleted file mode 100644
index 401f9d7e0..000000000
--- a/.github/ISSUE_TEMPLATE/desktop-crash.yml
+++ /dev/null
@@ -1,69 +0,0 @@
-name: Desktop app crash
-description: The Executor desktop app crashes, won't start, or shows a blank window.
-title: "[desktop] "
-labels: ["desktop", "crash"]
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Before filing, please try the quick fixes in the pinned
-        **[Desktop app crashing? Start here](https://github.com/RhysSullivan/executor/issues?q=is%3Aissue+label%3Acrash-triage)**
-        guide — most crashes are fixed by updating to the latest version.
-        If you're still stuck, the details below help us pin it down fast.
-  - type: input
-    id: version
-    attributes:
-      label: Executor version
-      description: Shown in the About menu (or Settings page). Please update to the latest first if you can.
-      placeholder: "1.5.4"
-    validations:
-      required: true
-  - type: dropdown
-    id: os
-    attributes:
-      label: Operating system
-      options:
-        - macOS (Apple Silicon)
-        - macOS (Intel)
-        - Windows
-        - Linux
-    validations:
-      required: true
-  - type: dropdown
-    id: when
-    attributes:
-      label: When does it crash?
-      options:
-        - On launch — the app never opens
-        - Shortly after launch
-        - While doing something specific (describe below)
-        - Randomly during use
-    validations:
-      required: true
-  - type: textarea
-    id: what-happened
-    attributes:
-      label: What happened
-      description: What were you doing when it crashed? Does it happen every time?
-    validations:
-      required: true
-  - type: textarea
-    id: logs
-    attributes:
-      label: Diagnostics / logs
-      description: |
-        If the app opens far enough to show a menu, open the **Executor** menu → **Export Diagnostics…**
-        (or **Report a Problem…**) and attach the zip — it has everything we need and no secrets.
-
-        Otherwise, attach the log file directly:
-        - macOS: `~/Library/Logs/Executor/main.log`
-        - Windows: `%APPDATA%\Executor\logs\main.log`
-        - Linux: `~/.config/Executor/logs/main.log`
-
-        (Please don't attach anything from `~/.executor` — that's where your data and secrets live.)
-      placeholder: Drag the diagnostics zip or main.log here.
-  - type: input
-    id: run-id
-    attributes:
-      label: Run ID (optional)
-      description: If a crash report was sent, the Run ID from the diagnostics manifest helps us find it.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 937936e3b..5707a2397 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,18 +6,107 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 concurrency:
   group: ci-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
+  rust:
+    name: Rust
+    runs-on: ubuntu-22.04
+    timeout-minutes: 30
+    env:
+      EXECUTOR_WEB_ASSETS_DIR: tests/fixtures/web-assets
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: Install Rust toolchain
+        shell: bash
+        run: |
+          set -euo pipefail
+          rustup toolchain install 1.96.0 \
+            --profile minimal \
+            --component clippy,rustfmt
+          rustup override set 1.96.0
+
+      - name: Cache Cargo
+        uses: Swatinem/rust-cache@401aff9a7a08acb9d27b64936a90db81024cff97 # v2.8.2
+        with:
+          cache-on-failure: false
+          shared-key: rust-1.96.0
+
+      - name: Check formatting
+        run: cargo fmt --all -- --check
+
+      - name: Check all targets and features
+        run: cargo check --locked --all-targets --all-features
+
+      - name: Lint all targets and features
+        run: cargo clippy --locked --all-targets --all-features -- -D warnings
+
+      - name: Set up Bun for emulator-backed Rust tests
+        uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76 # v2.0.2
+        with:
+          bun-version: 1.3.11
+
+      - name: Install locked emulator dependency
+        run: bun install --frozen-lockfile --ignore-scripts
+
+      - name: Verify OAuth test emulator
+        run: test -x e2e/node_modules/.bin/emulate
+
+      - name: Test all targets and features
+        run: cargo test --locked --all-targets --all-features
+
+  web:
+    name: Svelte web
+    runs-on: ubuntu-22.04
+    timeout-minutes: 20
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: Set up Bun
+        uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76 # v2.0.2
+        with:
+          bun-version: 1.3.11
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Check formatting
+        run: bun run format:check
+        working-directory: web
+
+      - name: Lint
+        run: bun run lint
+        working-directory: web
+
+      - name: Typecheck
+        run: bun run typecheck
+        working-directory: web
+
+      - name: Test
+        run: bun run test
+        working-directory: web
+
   format:
     name: Format
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76 # v2.0.2
         with:
           bun-version: 1.3.11
 
@@ -29,9 +118,11 @@ jobs:
     name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76 # v2.0.2
         with:
           bun-version: 1.3.11
 
@@ -43,9 +134,11 @@ jobs:
     name: Typecheck
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76 # v2.0.2
         with:
           bun-version: 1.3.11
 
@@ -57,61 +150,135 @@ jobs:
     name: Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-
-      - uses: oven-sh/setup-bun@v2
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          bun-version: 1.3.11
+          persist-credentials: false
 
-      # apps/cloud's test script invokes `node` directly; undici 8.x (pulled
-      # in by @cloudflare/vitest-pool-workers) calls webidl.markAsUncloneable
-      # which only exists in Node 22.10+. Pin a known-good runtime.
-      - uses: actions/setup-node@v4
+      - uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76 # v2.0.2
         with:
-          node-version: 22
+          bun-version: 1.3.11
 
       - run: bun install --frozen-lockfile
 
       - run: bun run test
 
-  desktop-smoke:
-    name: Desktop smoke build
-    runs-on: ubuntu-latest
+      - name: Test release workflow and Docker contracts
+        run: bun run test:release:static
+
+      - name: Test release archive installer
+        run: bun run test:release:installer
+
+      - name: Test systemd master-key lifecycle
+        run: bun run test:release:systemd
+
+      - name: Check release shell scripts
+        run: bun run test:release:shell
+
+  local-selfhost-e2e:
+    name: Local self-host e2e
+    runs-on: ubuntu-22.04
+    timeout-minutes: 45
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout source
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
-      - uses: oven-sh/setup-bun@v2
+      - name: Set up Bun
+        uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76 # v2.0.2
         with:
           bun-version: 1.3.11
 
-      - run: bun install --frozen-lockfile
+      - name: Install Rust toolchain
+        shell: bash
+        run: |
+          set -euo pipefail
+          rustup toolchain install 1.96.0 --profile minimal
+          rustup override set 1.96.0
+
+      - name: Cache Cargo
+        uses: Swatinem/rust-cache@401aff9a7a08acb9d27b64936a90db81024cff97 # v2.8.2
+        with:
+          cache-on-failure: false
+          shared-key: rust-1.96.0-local-selfhost-e2e
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
 
-      - name: Build web app
-        run: bun run --filter @executor-js/local build
+      - name: Install Chromium
+        run: bun run --cwd e2e playwright install --with-deps chromium
 
-      - name: Build bundled executor
-        env:
-          BUN_TARGET: bun-linux-x64
-        run: bun ./scripts/build-sidecar.ts
-        working-directory: apps/desktop
+      - name: Run local self-host e2e
+        run: bun run test:e2e
 
-      - name: Build Electron main/preload/renderer
-        run: bunx --bun electron-vite build
-        working-directory: apps/desktop
+      - name: Upload e2e artifacts
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: local-selfhost-e2e
+          path: e2e/runs/
+          if-no-files-found: error
+          retention-days: 14
 
   selfhost-docker-smoke:
-    name: Self-host Docker image
-    runs-on: ubuntu-latest
+    name: Rust self-host Docker image
+    runs-on: ubuntu-22.04
+    timeout-minutes: 45
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
 
       - name: Build self-host image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           context: .
-          file: apps/host-selfhost/Dockerfile
+          file: Dockerfile
+          load: true
           push: false
           tags: executor-selfhost:ci
+
+      - name: Smoke test container health and shutdown
+        shell: bash
+        run: |
+          set -euo pipefail
+          docker volume create executor-ci-data >/dev/null
+          docker run --detach \
+            --name executor-ci \
+            --init \
+            --read-only \
+            --cap-drop ALL \
+            --security-opt no-new-privileges \
+            --memory 2g \
+            --pids-limit 512 \
+            --tmpfs /tmp:rw,noexec,nosuid,nodev,size=64m \
+            --mount source=executor-ci-data,target=/var/lib/executor \
+            executor-selfhost:ci >/dev/null
+
+          status="starting"
+          for _ in {1..60}; do
+            status="$(docker inspect --format '{{.State.Health.Status}}' executor-ci)"
+            if [[ "$status" == "healthy" ]]; then
+              break
+            fi
+            if [[ "$(docker inspect --format '{{.State.Status}}' executor-ci)" == "exited" ]]; then
+              break
+            fi
+            sleep 1
+          done
+          if [[ "$status" != "healthy" ]]; then
+            docker logs executor-ci
+            exit 1
+          fi
+
+          docker stop --time 120 executor-ci >/dev/null
+          test "$(docker inspect --format '{{.State.ExitCode}}' executor-ci)" = "0"
+
+      - name: Clean up container smoke test
+        if: always()
+        run: |
+          docker rm --force executor-ci >/dev/null 2>&1 || true
+          docker volume rm --force executor-ci-data >/dev/null 2>&1 || true
diff --git a/.github/workflows/pkg-pr-new.yml b/.github/workflows/pkg-pr-new.yml
deleted file mode 100644
index cb9cf0544..000000000
--- a/.github/workflows/pkg-pr-new.yml
+++ /dev/null
@@ -1,117 +0,0 @@
-name: Publish (pkg.pr.new)
-
-on:
-  pull_request:
-
-permissions:
-  contents: read
-
-jobs:
-  # Per-platform matrix: build the executor binary, tar it, upload to R2.
-  # The wrapper npm package is built later by the `publish` job which just
-  # needs to know which platforms made it this far.
-  build-preview-binary:
-    name: Build preview binary (${{ matrix.target }})
-    # Fork PRs don't receive repo secrets, so the R2 upload step can't
-    # authenticate. Skip the whole preview pipeline (publish `needs:` this
-    # job and cascades to skipped) rather than failing the check.
-    if: github.event.pull_request.head.repo.full_name == github.repository
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - runner: ubuntu-latest
-            target: executor-linux-x64
-          - runner: macos-14
-            target: executor-darwin-arm64
-    runs-on: ${{ matrix.runner }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-
-      - uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: 1.3.11
-
-      - run: bun install --frozen-lockfile
-
-      - name: Build executor preview tarball
-        env:
-          EXECUTOR_PREVIEW_CDN_URL: ${{ vars.EXECUTOR_PREVIEW_CDN_URL }}
-          EXECUTOR_PREVIEW_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
-        run: bun run --filter=executor build:preview:tarball
-
-      - name: Upload preview binary to R2
-        # curl --aws-sigv4 handles large uploads directly against R2's S3
-        # endpoint. Simpler than aws-cli (endpoint validation quirks) or
-        # Bun.s3 (ConnectionRefused on ubuntu-latest for reasons unclear).
-        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
-          R2_ENDPOINT: https://${{ secrets.CLOUDFLARE_ACCOUNT_ID }}.r2.cloudflarestorage.com
-          SHA: ${{ github.event.pull_request.head.sha || github.sha }}
-          TARGET: ${{ matrix.target }}
-        run: |
-          tarball="apps/cli/dist/previews/${TARGET}.tar.gz"
-          echo "Uploading ${TARGET}.tar.gz → r2://executor-previews/$SHA/"
-          curl --fail-with-body --silent --show-error \
-            -X PUT "$R2_ENDPOINT/executor-previews/$SHA/${TARGET}.tar.gz" \
-            --upload-file "$tarball" \
-            --aws-sigv4 "aws:amz:auto:s3" \
-            --user "$AWS_ACCESS_KEY_ID:$AWS_SECRET_ACCESS_KEY"
-
-  publish:
-    name: Publish
-    needs: build-preview-binary
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: write
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-
-      - uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: 1.3.11
-
-      - run: bun install --frozen-lockfile
-
-      - name: Build executor preview wrapper
-        env:
-          EXECUTOR_PREVIEW_CDN_URL: ${{ vars.EXECUTOR_PREVIEW_CDN_URL }}
-          EXECUTOR_PREVIEW_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
-          EXECUTOR_PREVIEW_TARGETS: executor-linux-x64,executor-darwin-arm64
-        run: bun run --filter=executor build:preview:wrapper
-
-      # Apply the same `publishConfig.exports` promotion and `workspace:*`
-      # resolution the real npm release does. Runs `build:packages`
-      # internally. Without this, pkg-pr-new ships unresolved
-      # `workspace:*` references and the dev-time `src/index.ts` exports.
-      - run: bun run release:publish:packages:prepare
-
-      # Explicit list (not `plugins/*`) — must match PUBLIC_PACKAGE_DIRS
-      # in scripts/publish-packages.ts. Globbing would pick up unprepared
-      # private packages that would publish with broken refs.
-      #
-      # No --compact: it requires every package already exist on npm to
-      # generate short URLs. New packages aren't published yet, and
-      # --compact aborts the whole run when it can't resolve them.
-      - run: >
-          npx pkg-pr-new publish --bun
-          './apps/cli/dist/executor'
-          './packages/core/storage-core'
-          './packages/core/sdk'
-          './packages/core/config'
-          './packages/core/execution'
-          './packages/core/cli'
-          './packages/kernel/core'
-          './packages/kernel/runtime-quickjs'
-          './packages/plugins/file-secrets'
-          './packages/plugins/graphql'
-          './packages/plugins/keychain'
-          './packages/plugins/mcp'
-          './packages/plugins/onepassword'
-          './packages/plugins/openapi'
diff --git a/.github/workflows/preview-sweep.yml b/.github/workflows/preview-sweep.yml
index 977ba31c9..b194e238c 100644
--- a/.github/workflows/preview-sweep.yml
+++ b/.github/workflows/preview-sweep.yml
@@ -6,6 +6,7 @@ name: Preview sweep
 # open. A second pass (sweep-e2e) cleans up after the e2e harness on the same
 # account: crashed suite runs leak executor-e2e-* stacks, and synthetic OTP
 # logins permanently occupy Zero Trust seats.
+# The repository variable ENABLE_CLOUDFLARE_PREVIEWS must be exactly "true".
 
 on:
   schedule:
@@ -19,11 +20,14 @@ permissions:
 jobs:
   sweep:
     name: Destroy previews for closed PRs
+    if: vars.ENABLE_CLOUDFLARE_PREVIEWS == 'true'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76 # v2.0.2
         with:
           bun-version: 1.3.11
 
@@ -34,13 +38,13 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
-          for pr in $(bun apps/host-cloudflare/scripts/preview.ts list | jq -r '.[].pr'); do
+          for pr in $(bun legacy/host-cloudflare/scripts/preview.ts list | jq -r '.[].pr'); do
             state="$(gh pr view "$pr" --repo "$GITHUB_REPOSITORY" --json state -q .state 2>/dev/null || echo UNKNOWN)"
             if [ "$state" != "OPEN" ]; then
-              echo "PR #$pr is $state — destroying its preview"
-              bun apps/host-cloudflare/scripts/preview.ts destroy --pr "$pr"
+              echo "PR #$pr is $state, destroying its preview"
+              bun legacy/host-cloudflare/scripts/preview.ts destroy --pr "$pr"
             else
-              echo "PR #$pr is open — keeping its preview"
+              echo "PR #$pr is open, keeping its preview"
             fi
           done
 
@@ -48,4 +52,4 @@ jobs:
         env:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_PREVIEW_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_PREVIEW_ACCOUNT_ID }}
-        run: bun apps/host-cloudflare/scripts/preview.ts sweep-e2e
+        run: bun legacy/host-cloudflare/scripts/preview.ts sweep-e2e
diff --git a/.github/workflows/preview.yml b/.github/workflows/preview.yml
index 3d3bef13f..87e76df4a 100644
--- a/.github/workflows/preview.yml
+++ b/.github/workflows/preview.yml
@@ -3,13 +3,14 @@ name: Preview
 # Per-PR preview deploys of the Cloudflare host to a dedicated preview account.
 # Every same-repo PR gets its own isolated stack (Worker + D1 + Access app)
 # behind Cloudflare Access; it is torn down when the PR closes. Fork PRs are
-# skipped — they must not run with the deploy token.
+# skipped because they must not run with the deploy token. The repository
+# variable ENABLE_CLOUDFLARE_PREVIEWS must also be exactly "true".
 #
 # Required repo configuration:
-#   secret CLOUDFLARE_PREVIEW_API_TOKEN  — scoped token (Workers/D1/R2/Access edit)
-#   var    CLOUDFLARE_PREVIEW_ACCOUNT_ID — the preview Cloudflare account
-#   var    PREVIEW_ACCESS_TEAM_DOMAIN    — Zero Trust team domain
-#   var    PREVIEW_ACCESS_EMAILS         — comma-separated emails allowed through Access
+#   secret CLOUDFLARE_PREVIEW_API_TOKEN: scoped token (Workers/D1/R2/Access edit)
+#   var    CLOUDFLARE_PREVIEW_ACCOUNT_ID: the preview Cloudflare account
+#   var    PREVIEW_ACCESS_TEAM_DOMAIN: Zero Trust team domain
+#   var    PREVIEW_ACCESS_EMAILS: comma-separated emails allowed through Access
 
 on:
   pull_request:
@@ -17,7 +18,6 @@ on:
 
 permissions:
   contents: read
-  pull-requests: write
 
 concurrency:
   group: preview-${{ github.event.pull_request.number }}
@@ -26,12 +26,24 @@ concurrency:
 jobs:
   deploy:
     name: Deploy preview
-    if: github.event.action != 'closed' && github.event.pull_request.head.repo.full_name == github.repository
+    if: vars.ENABLE_CLOUDFLARE_PREVIEWS == 'true' && github.event.action != 'closed' && github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
-      - uses: actions/checkout@v4
+      - id: checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          persist-credentials: false
+
+      - name: Verify preview commit
+        env:
+          EXPECTED_SHA: ${{ github.event.pull_request.head.sha }}
+        run: test "$(git rev-parse HEAD)" = "$EXPECTED_SHA"
 
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76 # v2.0.2
         with:
           bun-version: 1.3.11
 
@@ -39,7 +51,7 @@ jobs:
 
       - name: Deploy
         id: deploy
-        working-directory: apps/host-cloudflare
+        working-directory: legacy/host-cloudflare
         env:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_PREVIEW_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_PREVIEW_ACCOUNT_ID }}
@@ -48,9 +60,10 @@ jobs:
         run: bun scripts/preview.ts deploy --pr ${{ github.event.pull_request.number }}
 
       - name: Comment preview URL
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         env:
           PREVIEW_URL: ${{ steps.deploy.outputs.url }}
+          PREVIEW_SHA: ${{ steps.checkout.outputs.commit }}
         with:
           script: |
             const marker = "<!-- executor-preview -->";
@@ -62,10 +75,10 @@ jobs:
               `|---|---|`,
               `| Console | ${process.env.PREVIEW_URL} |`,
               `| MCP | \`${process.env.PREVIEW_URL}/mcp\` |`,
-              `| Deployed commit | ${context.payload.pull_request.head.sha} |`,
+              `| Deployed commit | ${process.env.PREVIEW_SHA} |`,
               "",
               "Sign-in is Cloudflare Access (one-time PIN to an allowed email). " +
-                "The preview has its own database and encryption key; it is destroyed when this PR closes.",
+                "The preview has its own database and encryption key. It is destroyed when this PR closes.",
             ].join("\n");
             const { data: comments } = await github.rest.issues.listComments({
               ...context.repo,
@@ -81,24 +94,35 @@ jobs:
 
   teardown:
     name: Tear down preview
-    if: github.event.action == 'closed' && github.event.pull_request.head.repo.full_name == github.repository
+    if: vars.ENABLE_CLOUDFLARE_PREVIEWS == 'true' && github.event.action == 'closed' && github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          persist-credentials: false
+
+      - name: Verify preview commit
+        env:
+          EXPECTED_SHA: ${{ github.event.pull_request.head.sha }}
+        run: test "$(git rev-parse HEAD)" = "$EXPECTED_SHA"
 
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76 # v2.0.2
         with:
           bun-version: 1.3.11
 
-      # destroy talks straight to the Cloudflare API — no install needed.
+      # Destroy talks straight to the Cloudflare API, so no install is needed.
       - name: Destroy
         env:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_PREVIEW_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_PREVIEW_ACCOUNT_ID }}
-        run: bun apps/host-cloudflare/scripts/preview.ts destroy --pr ${{ github.event.pull_request.number }}
+        run: bun legacy/host-cloudflare/scripts/preview.ts destroy --pr ${{ github.event.pull_request.number }}
 
       - name: Mark comment as torn down
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           script: |
             const marker = "<!-- executor-preview -->";
@@ -112,6 +136,6 @@ jobs:
               await github.rest.issues.updateComment({
                 ...context.repo,
                 comment_id: existing.id,
-                body: `${marker}\n### Cloudflare preview\n\nTorn down — the PR is closed.`,
+                body: `${marker}\n### Cloudflare preview\n\nTorn down because the PR is closed.`,
               });
             }
diff --git a/.github/workflows/publish-desktop.yml b/.github/workflows/publish-desktop.yml
deleted file mode 100644
index cad7d4a30..000000000
--- a/.github/workflows/publish-desktop.yml
+++ /dev/null
@@ -1,233 +0,0 @@
-name: Publish Desktop App
-run-name: "${{ format('publish desktop {0}', github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name) }}"
-
-# Triggered manually or by publish-executor-package.yml after a CLI release
-# lands. Builds Electron distributables for mac/win/linux with the compiled
-# executor CLI bundled in `resources/executor/`, then attaches them to the GitHub
-# release matching the tag so electron-updater can pick them up.
-
-on:
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: Git tag to publish (e.g. v1.4.1)
-        required: true
-        type: string
-
-permissions:
-  contents: read
-
-concurrency:
-  group: publish-desktop-${{ github.ref }}
-  cancel-in-progress: false
-
-jobs:
-  build:
-    permissions:
-      contents: read
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          # smoke: run the compiled-sidecar smoke test on legs whose target
-          # matches the runner (the mac x64 leg cross-compiles on an arm64
-          # runner, so its binary can't be executed natively there).
-          - os: macos-latest
-            arch: arm64
-            platform: mac
-            bun-target: bun-darwin-arm64
-            smoke: true
-          - os: macos-latest
-            arch: x64
-            platform: mac
-            bun-target: bun-darwin-x64
-            smoke: false
-          - os: ubuntu-latest
-            arch: x64
-            platform: linux
-            bun-target: bun-linux-x64
-            smoke: true
-          - os: windows-latest
-            arch: x64
-            platform: win
-            bun-target: bun-windows-x64
-            smoke: true
-
-    runs-on: ${{ matrix.os }}
-
-    # A healthy leg finishes in ~10 minutes. Without a deadline, a hung step
-    # wedges the whole publish queue: the concurrency group below queues later
-    # runs behind this one without cancelling it (v1.5.7's mac leg sat 4 hours
-    # on a bun install that errored without exiting, holding v1.5.8 pending).
-    timeout-minutes: 45
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: 1.3.11
-
-      - name: Validate release tag
-        env:
-          RAW_RELEASE_TAG: ${{ inputs.tag }}
-        run: bun run scripts/validate-release-ref.ts --tag-env RAW_RELEASE_TAG --write-env RELEASE_TAG
-
-      - name: Checkout release tag
-        env:
-          GH_TOKEN: ${{ secrets.RELEASE_PAT || github.token }}
-        shell: bash
-        run: |
-          auth_remote="https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
-          git fetch --force --tags "$auth_remote" "refs/tags/$RELEASE_TAG:refs/tags/$RELEASE_TAG"
-          git checkout --detach "$RELEASE_TAG"
-
-      - name: Setup Node
-        uses: actions/setup-node@v4
-        with:
-          node-version: 24
-
-      - name: Install dependencies
-        run: bun install --frozen-lockfile
-
-      - name: Build web app
-        run: bun run --filter @executor-js/local build
-
-      - name: Build bundled executor
-        env:
-          BUN_TARGET: ${{ matrix.bun-target }}
-        run: bun ./scripts/build-sidecar.ts
-        working-directory: apps/desktop
-
-      # Gate the release on the compiled binary actually booting. v1.5.0/.1
-      # shipped local-server binaries that died on launch (missing libsql native
-      # binding) — a regression dev mode can't catch because `bun run` resolves
-      # node_modules that `bun build --compile` does not bundle.
-      - name: Smoke test bundled executor
-        if: matrix.smoke
-        run: bun run test:smoke
-        working-directory: apps/desktop
-
-      - name: Build Electron main/preload/renderer
-        env:
-          # Crash-report DSN baked into the main bundle (see the define in
-          # electron.vite.config.ts). Unset (forks, local) → crash reporting
-          # is compiled out and dumps stay local.
-          DESKTOP_SENTRY_DSN: ${{ vars.DESKTOP_SENTRY_DSN }}
-        run: bunx --bun electron-vite build
-        working-directory: apps/desktop
-
-      - name: Stage Apple API key (mac signing + notarization)
-        if: matrix.platform == 'mac' && env.APPLE_API_KEY != ''
-        env:
-          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
-        run: |
-          mkdir -p "${RUNNER_TEMP}/private_keys"
-          printf '%s' "$APPLE_API_KEY" > "${RUNNER_TEMP}/private_keys/AuthKey.p8"
-          echo "APPLE_API_KEY_PATH=${RUNNER_TEMP}/private_keys/AuthKey.p8" >> "$GITHUB_ENV"
-
-      - name: Build desktop distributables
-        env:
-          # electron-builder reads GH_TOKEN for the publish step. We use
-          # --publish never here and attach assets explicitly in the release
-          # job so we don't fight electron-updater's metadata expectations.
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          # Apple signing + notarization. electron-builder picks these up:
-          #   CSC_LINK / CSC_KEY_PASSWORD → import the Developer ID Application
-          #     cert (.p12, base64) into a temp keychain for codesign
-          #   APPLE_API_KEY (file path) / APPLE_API_KEY_ID / APPLE_API_ISSUER
-          #     → notarytool authentication for the notarization upload
-          # When the secrets aren't set (forks, local), electron-builder
-          # silently produces an unsigned build.
-          CSC_LINK: ${{ secrets.CSC_LINK }}
-          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
-          APPLE_API_KEY: ${{ env.APPLE_API_KEY_PATH }}
-          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
-          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
-        run: bunx --bun electron-builder --${{ matrix.platform }} --${{ matrix.arch }} --publish never --config electron-builder.config.ts
-        working-directory: apps/desktop
-
-      # The two mac legs each emit a latest-mac.yml listing only their own
-      # arch. Rename per-arch here; the release job merges them back into the
-      # single latest-mac.yml electron-updater clients fetch. Without this,
-      # merge-multiple in the release job lets one arch clobber the other and
-      # every Mac gets pointed at whichever leg uploaded last.
-      - name: Rename mac update manifest per arch
-        if: matrix.platform == 'mac'
-        shell: bash
-        run: mv apps/desktop/dist/latest-mac.yml "apps/desktop/dist/latest-mac-${{ matrix.arch }}.yml"
-
-      - name: Upload artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: desktop-${{ matrix.platform }}-${{ matrix.arch }}
-          path: |
-            apps/desktop/dist/*.dmg
-            apps/desktop/dist/*.zip
-            apps/desktop/dist/*.exe
-            apps/desktop/dist/*.AppImage
-            apps/desktop/dist/*.deb
-            apps/desktop/dist/*.rpm
-            apps/desktop/dist/latest*.yml
-          if-no-files-found: warn
-
-  release:
-    needs: build
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-
-    steps:
-      - name: Checkout validation script
-        uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: 1.3.11
-
-      - name: Validate release tag
-        env:
-          RAW_RELEASE_TAG: ${{ inputs.tag }}
-        run: bun run scripts/validate-release-ref.ts --tag-env RAW_RELEASE_TAG --write-env RELEASE_TAG
-
-      - name: Download all artifacts
-        uses: actions/download-artifact@v4
-        with:
-          path: artifacts
-          merge-multiple: true
-
-      - name: Merge mac update manifests
-        run: |
-          set -euo pipefail
-          bun scripts/merge-latest-mac-yml.ts \
-            artifacts/latest-mac-x64.yml \
-            artifacts/latest-mac-arm64.yml \
-            artifacts/latest-mac.yml
-          rm artifacts/latest-mac-x64.yml artifacts/latest-mac-arm64.yml
-
-      - name: Upload to GitHub Release
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -euo pipefail
-          while IFS= read -r file; do
-            echo "Uploading: $file"
-            gh release upload "$RELEASE_TAG" "$file" --repo "$GITHUB_REPOSITORY" --clobber
-          done < <(find artifacts -type f \
-            \( -name "*.dmg" -o -name "*.zip" -o -name "*.exe" \
-            -o -name "*.AppImage" -o -name "*.deb" -o -name "*.rpm" \
-            -o -name "latest*.yml" \))
-
-      # Flip draft → published only after every desktop asset is uploaded —
-      # this is the atomic point where the new tag becomes "latest".
-      - name: Promote release (draft → published)
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: gh release edit "$RELEASE_TAG" --draft=false --repo "$GITHUB_REPOSITORY"
diff --git a/.github/workflows/publish-executor-package.yml b/.github/workflows/publish-executor-package.yml
deleted file mode 100644
index 113ed9411..000000000
--- a/.github/workflows/publish-executor-package.yml
+++ /dev/null
@@ -1,89 +0,0 @@
-name: Publish Executor
-run-name: "${{ format('publish executor {0}', github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name) }}"
-
-on:
-  push:
-    tags:
-      - "v*"
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: Git tag to publish
-        required: true
-        type: string
-
-permissions:
-  contents: read
-
-concurrency:
-  group: publish-executor-package-${{ github.ref }}
-  cancel-in-progress: false
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    permissions:
-      actions: write
-      contents: write
-      id-token: write
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: 1.3.11
-
-      - name: Validate release tag
-        env:
-          RAW_RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}
-        run: bun run scripts/validate-release-ref.ts --tag-env RAW_RELEASE_TAG --write-env RELEASE_TAG
-
-      - name: Checkout release tag
-        env:
-          GH_TOKEN: ${{ secrets.RELEASE_PAT || github.token }}
-        run: |
-          auth_remote="https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
-          git fetch --force --tags "$auth_remote" "refs/tags/$RELEASE_TAG:refs/tags/$RELEASE_TAG"
-          git checkout --detach "$RELEASE_TAG"
-
-      - name: Setup Node
-        uses: actions/setup-node@v4
-        with:
-          node-version: 24
-          registry-url: https://registry.npmjs.org
-
-      - name: Update npm for trusted publishing
-        run: |
-          npm install -g npm@latest
-          npm --version
-
-      - name: Install dependencies
-        run: bun install --frozen-lockfile
-
-      - name: Run release checks
-        run: bun run release:check
-
-      - name: Publish package and create release
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          export GITHUB_REF_TYPE=tag
-          export GITHUB_REF_NAME="$RELEASE_TAG"
-          export GITHUB_REF="refs/tags/$RELEASE_TAG"
-          bun run release:publish
-
-      - name: Trigger desktop build
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: gh workflow run publish-desktop.yml -f tag="$RELEASE_TAG"
-
-      - name: Trigger self-host Docker publish
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: gh workflow run publish-selfhost-docker.yml -f tag="$RELEASE_TAG"
diff --git a/.github/workflows/publish-selfhost-docker.yml b/.github/workflows/publish-selfhost-docker.yml
deleted file mode 100644
index ac54fb799..000000000
--- a/.github/workflows/publish-selfhost-docker.yml
+++ /dev/null
@@ -1,107 +0,0 @@
-name: Publish Self-host Docker Image
-run-name: "${{ format('publish self-host docker {0}', inputs.tag) }}"
-
-on:
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: Git tag to publish (e.g. v1.5.0)
-        required: true
-        type: string
-
-permissions:
-  contents: read
-
-concurrency:
-  group: publish-selfhost-docker-${{ inputs.tag }}
-  cancel-in-progress: false
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: 1.3.11
-
-      - name: Validate release tag
-        env:
-          RAW_RELEASE_TAG: ${{ inputs.tag }}
-        run: bun run scripts/validate-release-ref.ts --tag-env RAW_RELEASE_TAG --write-env RELEASE_TAG
-
-      - name: Checkout release tag
-        env:
-          GH_TOKEN: ${{ secrets.RELEASE_PAT || github.token }}
-        run: |
-          auth_remote="https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
-          git fetch --force --tags "$auth_remote" "refs/tags/$RELEASE_TAG:refs/tags/$RELEASE_TAG"
-          git checkout --detach "$RELEASE_TAG"
-
-      - name: Resolve image metadata
-        id: image
-        shell: bash
-        run: |
-          set -euo pipefail
-
-          version="${RELEASE_TAG#v}"
-          owner="$(printf '%s' "$GITHUB_REPOSITORY_OWNER" | tr '[:upper:]' '[:lower:]')"
-          image="ghcr.io/${owner}/executor-selfhost"
-          revision="$(git rev-parse HEAD)"
-
-          if [[ "$version" == *-* ]]; then
-            channel="beta"
-          else
-            channel="latest"
-          fi
-
-          {
-            echo "image=$image"
-            echo "version=$version"
-            echo "channel=$channel"
-            echo "tags<<TAGS"
-            echo "${image}:${RELEASE_TAG}"
-            echo "${image}:${version}"
-            echo "${image}:${channel}"
-            echo "TAGS"
-            echo "labels<<LABELS"
-            echo "org.opencontainers.image.title=Executor self-host"
-            echo "org.opencontainers.image.description=Single-container self-hosted Executor"
-            echo "org.opencontainers.image.source=https://github.com/${GITHUB_REPOSITORY}"
-            echo "org.opencontainers.image.revision=${revision}"
-            echo "org.opencontainers.image.version=${version}"
-            echo "LABELS"
-          } >> "$GITHUB_OUTPUT"
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Log in to GHCR
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Build and push self-host image
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: apps/host-selfhost/Dockerfile
-          platforms: linux/amd64,linux/arm64
-          push: true
-          tags: ${{ steps.image.outputs.tags }}
-          labels: ${{ steps.image.outputs.labels }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c51c05ea2..404e5fc19 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,137 +1,2084 @@
-name: Release
-run-name: prepare release
+name: Release native Executor
+run-name: "${{ format('{0} {1} at {2}', inputs.mode, inputs.tag, inputs.commit_sha) }}"
 
 on:
-  push:
-    branches:
-      - main
+  workflow_dispatch:
+    inputs:
+      mode:
+        description: Build only, or publish and promote the release
+        required: true
+        default: dry-run
+        type: choice
+        options:
+          - dry-run
+          - publish
+      tag:
+        description: Exact v-prefixed Cargo version, for example v0.1.0
+        required: true
+        type: string
+      commit_sha:
+        description: Exact 40-character commit SHA to build
+        required: true
+        type: string
 
 permissions:
   contents: read
 
 concurrency:
-  group: release-${{ github.ref }}
+  group: native-release
   cancel-in-progress: false
 
+env:
+  BUILDKIT_IMAGE: moby/buildkit:v0.30.0@sha256:0168606be2315b7c807a03b3d8aa79beefdb31c98740cebdffdfeebf31190c9f
+  BUILDX_VERSION: v0.34.1
+  BUN_VERSION: 1.3.11
+  EXECUTOR_REPOSITORY: ${{ github.repository }}
+  MACOS_BUILD_CLANG_VERSION: Apple clang version 17.0.0 (clang-1700.0.13.5)
+  MACOS_BUILD_DEVELOPER_DIR: /Applications/Xcode_16.4.app/Contents/Developer
+  MACOS_BUILD_LD_VERSION: "1167.5"
+  MACOS_BUILD_SDK_VERSION: "15.5"
+  MACOS_BUILD_XCODE_BUILD: 16F6
+  MACOS_BUILD_XCODE_VERSION: "16.4"
+  MACOS_FLOOR_CLANG_VERSION: Apple clang version 15.0.0 (clang-1500.3.9.4)
+  MACOS_FLOOR_DEVELOPER_DIR: /Applications/Xcode_15.4.app/Contents/Developer
+  MACOS_FLOOR_LD_VERSION: "1053.12"
+  MACOS_FLOOR_SDK_VERSION: "14.5"
+  MACOS_FLOOR_XCODE_BUILD: 15F31d
+  MACOS_FLOOR_XCODE_VERSION: "15.4"
+  MACOSX_DEPLOYMENT_TARGET: "14.0"
+  RUST_VERSION: 1.96.0
+
 jobs:
-  release:
-    runs-on: ubuntu-latest
+  validate:
+    name: Validate immutable release inputs
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    outputs:
+      channel: ${{ steps.release.outputs.channel }}
+      commit_sha: ${{ steps.release.outputs.commit_sha }}
+      image: ${{ steps.release.outputs.image }}
+      prerelease: ${{ steps.release.outputs.prerelease }}
+      source_date_epoch: ${{ steps.release.outputs.source_date_epoch }}
+      version: ${{ steps.release.outputs.version }}
+    steps:
+      - name: Verify exact native release environment policy
+        if: inputs.mode == 'publish'
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          environment_file="$RUNNER_TEMP/native-release-environment.json"
+          policies_file="$RUNNER_TEMP/native-release-branch-policies.json"
+          gh api \
+            -H "Accept: application/vnd.github+json" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            "repos/$EXECUTOR_REPOSITORY/environments/native-release" \
+            > "$environment_file"
+          gh api \
+            -H "Accept: application/vnd.github+json" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            "repos/$EXECUTOR_REPOSITORY/environments/native-release/deployment-branch-policies?per_page=100" \
+            > "$policies_file"
+
+          python3 - "$environment_file" "$policies_file" <<'PY'
+          import json
+          import pathlib
+          import sys
+
+          environment = json.loads(pathlib.Path(sys.argv[1]).read_text(encoding="utf-8"))
+          policies = json.loads(pathlib.Path(sys.argv[2]).read_text(encoding="utf-8"))
+
+          if environment.get("name") != "native-release":
+              raise SystemExit("native-release environment name does not match")
+          if environment.get("can_admins_bypass") is not False:
+              raise SystemExit("native-release must disable administrator bypass")
+
+          protection_rules = environment.get("protection_rules")
+          if not isinstance(protection_rules, list):
+              raise SystemExit("native-release protection rules are missing")
+          rule_types = sorted(rule.get("type") for rule in protection_rules)
+          if rule_types != ["branch_policy", "required_reviewers"]:
+              raise SystemExit(
+                  "native-release must have only branch_policy and required_reviewers rules"
+              )
+
+          reviewer_rule = next(
+              rule for rule in protection_rules if rule.get("type") == "required_reviewers"
+          )
+          if reviewer_rule.get("prevent_self_review") is not False:
+              raise SystemExit("native-release must set prevent_self_review=false")
+          reviewers = reviewer_rule.get("reviewers")
+          if not isinstance(reviewers, list) or len(reviewers) != 1:
+              raise SystemExit("native-release must have exactly one required reviewer")
+          reviewer = reviewers[0]
+          identity = reviewer.get("reviewer")
+          if (
+              reviewer.get("type") != "User"
+              or not isinstance(identity, dict)
+              or identity.get("login") != "bmdavis419"
+              or identity.get("id") != 45952064
+          ):
+              raise SystemExit("native-release required reviewer must be bmdavis419 (45952064)")
+
+          deployment_policy = environment.get("deployment_branch_policy")
+          if deployment_policy != {
+              "protected_branches": False,
+              "custom_branch_policies": True,
+          }:
+              raise SystemExit("native-release must use custom deployment branch policies only")
+
+          branch_policies = policies.get("branch_policies")
+          if (
+              policies.get("total_count") != 1
+              or not isinstance(branch_policies, list)
+              or len(branch_policies) != 1
+              or branch_policies[0].get("name") != "main"
+              or branch_policies[0].get("type") != "branch"
+          ):
+              raise SystemExit("native-release must allow only the main branch")
+          PY
+
+      - name: Checkout exact commit
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ github.sha }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Bind version, commit, tag, and release state
+        id: release
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          INPUT_COMMIT_SHA: ${{ inputs.commit_sha }}
+          RELEASE_MODE: ${{ inputs.mode }}
+          RELEASE_TAG: ${{ inputs.tag }}
+          RUN_ATTEMPT: ${{ github.run_attempt }}
+          RUN_ID: ${{ github.run_id }}
+          WORKFLOW_REF: ${{ github.ref }}
+          WORKFLOW_SHA: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+
+          if [[ ! "$INPUT_COMMIT_SHA" =~ ^[0-9a-f]{40}$ ]]; then
+            echo "commit_sha must be an exact lowercase 40-character Git commit SHA" >&2
+            exit 1
+          fi
+          if [ "$WORKFLOW_SHA" != "$INPUT_COMMIT_SHA" ]; then
+            echo "Workflow revision $WORKFLOW_SHA does not match requested release commit $INPUT_COMMIT_SHA" >&2
+            exit 1
+          fi
+          if [[ ! "$RUN_ATTEMPT" =~ ^[1-9][0-9]*$ ]]; then
+            echo "Invalid workflow run attempt: $RUN_ATTEMPT" >&2
+            exit 1
+          fi
+
+          actual_sha="$(git rev-parse HEAD)"
+          if [ "$actual_sha" != "$INPUT_COMMIT_SHA" ]; then
+            echo "Checked out $actual_sha, expected $INPUT_COMMIT_SHA" >&2
+            exit 1
+          fi
+
+          git fetch --no-tags origin "+refs/heads/main:refs/remotes/origin/main"
+          if ! git merge-base --is-ancestor "$actual_sha" refs/remotes/origin/main; then
+            echo "Release commit $actual_sha is not on origin/main" >&2
+            exit 1
+          fi
+          if [ "$RUN_ATTEMPT" = 1 ] \
+            && [ "$(git rev-parse refs/remotes/origin/main)" != "$actual_sha" ]; then
+            echo "The first release attempt must use the current origin/main commit" >&2
+            exit 1
+          fi
+
+          version="$(python3 - <<'PY'
+          import pathlib
+          import tomllib
+
+          manifest = tomllib.loads(pathlib.Path("Cargo.toml").read_text(encoding="utf-8"))
+          print(manifest["package"]["version"])
+          PY
+          )"
+          python3 - "$version" <<'PY'
+          import re
+          import sys
+
+          pattern = re.compile(
+              r"^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)"
+              r"(?:-((?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*)"
+              r"(?:\.(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*))*))?"
+              r"(?:\+([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?$"
+          )
+          if pattern.fullmatch(sys.argv[1]) is None:
+              raise SystemExit("Cargo.toml package version is not valid SemVer")
+          PY
+          if [ "$RELEASE_TAG" != "v$version" ]; then
+            echo "Release tag $RELEASE_TAG does not match Cargo.toml version $version" >&2
+            exit 1
+          fi
+          if [[ "$version" == *+* ]]; then
+            echo "Cargo release versions cannot contain build metadata because OCI tags do not support +" >&2
+            exit 1
+          fi
+
+          if git fetch --no-tags origin "refs/tags/$RELEASE_TAG:refs/tags/$RELEASE_TAG"; then
+            tag_sha="$(git rev-parse "$RELEASE_TAG^{commit}")"
+            if [ "$tag_sha" != "$actual_sha" ]; then
+              echo "Release tag $RELEASE_TAG points to $tag_sha, expected $actual_sha" >&2
+              exit 1
+            fi
+          elif [ "$RELEASE_MODE" = "publish" ]; then
+            echo "Publish mode requires existing remote tag $RELEASE_TAG" >&2
+            exit 1
+          else
+            echo "Dry run continues without remote tag $RELEASE_TAG"
+          fi
+          if [ "$RELEASE_MODE" = "publish" ] \
+            && [ "$WORKFLOW_REF" != refs/heads/main ]; then
+            echo "Publish mode must be dispatched from refs/heads/main, got $WORKFLOW_REF" >&2
+            exit 1
+          fi
+
+          if [ "$RELEASE_MODE" = "publish" ] \
+            && gh release view "$RELEASE_TAG" --repo "$EXECUTOR_REPOSITORY" >/dev/null 2>&1; then
+              release_title="$RELEASE_TAG [executor-run:$RUN_ID]"
+              release_state="$RUNNER_TEMP/existing-release.json"
+              gh api "repos/$EXECUTOR_REPOSITORY/releases/tags/$RELEASE_TAG" > "$release_state"
+              actual_title="$(jq -r '.name // ""' "$release_state")"
+              if [ "$actual_title" != "$release_title" ]; then
+                echo "Release $RELEASE_TAG belongs to a different workflow run" >&2
+                exit 1
+              fi
+              python3 - "$release_state" "$RELEASE_TAG" "$actual_sha" "$version" <<'PY'
+          import json
+          import pathlib
+          import sys
+
+          release = json.loads(pathlib.Path(sys.argv[1]).read_text(encoding="utf-8"))
+          expected_prerelease = "-" in sys.argv[4]
+          if (
+              release.get("tag_name") != sys.argv[2]
+              or release.get("target_commitish") != sys.argv[3]
+              or release.get("prerelease") is not expected_prerelease
+              or release.get("draft") not in (True, False)
+          ):
+              raise SystemExit("existing release does not match the validated release state")
+          if release.get("draft") is False and release.get("immutable") is not True:
+              raise SystemExit("published release does not match the immutable rerun state")
+          PY
+
+              run_binding="$RUNNER_TEMP/RELEASE-RUN.json"
+              python3 - "$run_binding" "$EXECUTOR_REPOSITORY" "$RELEASE_TAG" "$actual_sha" "$RUN_ID" <<'PY'
+          import json
+          import pathlib
+          import sys
+
+          binding = {
+              "commit": sys.argv[4],
+              "repository": sys.argv[2],
+              "run_id": sys.argv[5],
+              "tag": sys.argv[3],
+          }
+          pathlib.Path(sys.argv[1]).write_text(
+              json.dumps(binding, sort_keys=True, separators=(",", ":")) + "\n",
+              encoding="utf-8",
+          )
+          PY
+              is_draft="$(jq -r .draft "$release_state")"
+              binding_count="$(
+                jq '[.assets[]? | select(.name == "RELEASE-RUN.json")] | length' \
+                  "$release_state"
+              )"
+              if [ "$binding_count" -eq 1 ]; then
+                binding_download="$RUNNER_TEMP/existing-release-binding"
+                rm -rf "$binding_download"
+                mkdir -p "$binding_download"
+                gh release download "$RELEASE_TAG" \
+                  --repo "$EXECUTOR_REPOSITORY" \
+                  --pattern RELEASE-RUN.json \
+                  --dir "$binding_download"
+                if ! cmp "$run_binding" "$binding_download/RELEASE-RUN.json"; then
+                  echo "Release $RELEASE_TAG belongs to a different workflow run or source" >&2
+                  exit 1
+                fi
+              elif [ "$binding_count" -eq 0 ] && [ "$is_draft" = true ]; then
+                echo "Same-run draft is missing RELEASE-RUN.json; staging will repair it"
+              else
+                echo "Release $RELEASE_TAG must contain exactly one RELEASE-RUN.json asset" >&2
+                exit 1
+              fi
+
+              if [ "$is_draft" != true ]; then
+                echo "Same-run retry will reuse immutable published release $RELEASE_TAG"
+              else
+                echo "Same-run retry will repair and verify draft release $RELEASE_TAG"
+              fi
+          fi
+
+          source_date_epoch="$(git show -s --format=%ct HEAD)"
+          if [[ ! "$source_date_epoch" =~ ^[0-9]+$ ]]; then
+            echo "Could not resolve the release commit timestamp" >&2
+            exit 1
+          fi
+
+          owner="$(printf '%s' "${EXECUTOR_REPOSITORY%%/*}" | tr '[:upper:]' '[:lower:]')"
+          if [[ "$version" == *-* ]]; then
+            channel=beta
+            prerelease=true
+          else
+            channel=latest
+            prerelease=false
+          fi
+
+          {
+            echo "channel=$channel"
+            echo "commit_sha=$actual_sha"
+            echo "image=ghcr.io/${owner}/executor"
+            echo "prerelease=$prerelease"
+            echo "source_date_epoch=$source_date_epoch"
+            echo "version=$version"
+          } >> "$GITHUB_OUTPUT"
+
+  authorize-publish:
+    name: Authorize protected native publication
+    if: inputs.mode == 'publish'
+    needs: validate
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    environment: native-release
     permissions:
-      actions: write
-      contents: write
-      id-token: write
-      pull-requests: write
+      contents: read
+    outputs:
+      registry_username: ${{ steps.token.outputs.registry_username }}
+    steps:
+      - name: Require the environment-scoped release token and capabilities
+        id: token
+        shell: bash
+        env:
+          GH_TOKEN: ${{ secrets.NATIVE_RELEASE_TOKEN }}
+        run: |
+          set -euo pipefail
+          if [ -z "$GH_TOKEN" ]; then
+            echo "native-release must provide the NATIVE_RELEASE_TOKEN secret" >&2
+            exit 1
+          fi
+
+          token_owner="$(gh api user --jq .login)"
+          if [ "$token_owner" != bmdavis419 ]; then
+            echo "NATIVE_RELEASE_TOKEN must belong to bmdavis419, got $token_owner" >&2
+            exit 1
+          fi
+          oauth_scopes="$(
+            gh api --include user \
+              | awk -F ': ' 'tolower($1) == "x-oauth-scopes" { print $2; exit }' \
+              | tr -d '\r'
+          )"
+          python3 - "$oauth_scopes" <<'PY'
+          import sys
+
+          actual_scopes = {scope.strip() for scope in sys.argv[1].split(",") if scope.strip()}
+          expected_scopes = {"public_repo", "write:packages"}
+          if actual_scopes != expected_scopes:
+              raise SystemExit(
+                  "NATIVE_RELEASE_TOKEN must have exactly public_repo and write:packages scopes"
+              )
+          PY
+          if [ "$(gh api "repos/$EXECUTOR_REPOSITORY" --jq .permissions.push)" != true ]; then
+            echo "NATIVE_RELEASE_TOKEN cannot write to $EXECUTOR_REPOSITORY" >&2
+            exit 1
+          fi
+          if [ "$(
+            gh api "repos/$EXECUTOR_REPOSITORY/immutable-releases" --jq .enabled
+          )" != true ]; then
+            echo "Immutable releases must be enabled for $EXECUTOR_REPOSITORY" >&2
+            exit 1
+          fi
+
+          printf '%s' "$GH_TOKEN" \
+            | docker login ghcr.io --username "$token_owner" --password-stdin
+          docker logout ghcr.io
+          echo "registry_username=$token_owner" >> "$GITHUB_OUTPUT"
 
+      - name: Verify exact immutable release tag ruleset
+        shell: bash
+        env:
+          GH_TOKEN: ${{ secrets.NATIVE_RELEASE_TOKEN }}
+        run: |
+          set -euo pipefail
+          summaries="$RUNNER_TEMP/release-tag-rulesets.json"
+          details="$RUNNER_TEMP/release-tag-rulesets.ndjson"
+          gh api \
+            -H "Accept: application/vnd.github+json" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            "repos/$EXECUTOR_REPOSITORY/rulesets?includes_parents=true&per_page=100" \
+            > "$summaries"
+
+          : > "$details"
+          while IFS= read -r ruleset_id; do
+            gh api \
+              -H "Accept: application/vnd.github+json" \
+              -H "X-GitHub-Api-Version: 2022-11-28" \
+              "repos/$EXECUTOR_REPOSITORY/rulesets/$ruleset_id" \
+              >> "$details"
+            printf '\n' >> "$details"
+          done < <(
+            jq -r '.[] | select(.target == "tag" and .enforcement == "active") | .id' \
+              "$summaries"
+          )
+
+          python3 - "$details" <<'PY'
+          import json
+          import pathlib
+          import sys
+
+          rulesets = [
+              json.loads(line)
+              for line in pathlib.Path(sys.argv[1]).read_text(encoding="utf-8").splitlines()
+              if line
+          ]
+          for ruleset in rulesets:
+              ref_name = ruleset.get("conditions", {}).get("ref_name", {})
+              rules = ruleset.get("rules", [])
+              rule_types = sorted(rule.get("type") for rule in rules)
+              update_rules = [rule for rule in rules if rule.get("type") == "update"]
+              if (
+                  ruleset.get("target") == "tag"
+                  and ruleset.get("enforcement") == "active"
+                  and ruleset.get("bypass_actors") == []
+                  and ref_name.get("include") == ["refs/tags/v*"]
+                  and ref_name.get("exclude") == []
+                  and rule_types == ["deletion", "update"]
+                  and len(update_rules) == 1
+                  and update_rules[0].get("parameters")
+                  == {"update_allows_fetch_and_merge": False}
+              ):
+                  break
+          else:
+              raise SystemExit(
+                  "an exact active no-bypass v* tag ruleset must restrict updates and deletions"
+              )
+          PY
+
+  web:
+    name: Build embedded web application once
+    needs: validate
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
+      - name: Checkout exact commit
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          fetch-depth: 0
+          ref: ${{ needs.validate.outputs.commit_sha }}
           persist-credentials: false
 
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
+      - name: Set up Bun
+        uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76 # v2.0.2
+        with:
+          bun-version: ${{ env.BUN_VERSION }}
+
+      - name: Install web dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Build embedded web application
+        env:
+          SOURCE_DATE_EPOCH: ${{ needs.validate.outputs.source_date_epoch }}
+        run: bun run --cwd web build
+
+      - name: Verify canonical web payload
+        shell: bash
+        run: |
+          set -euo pipefail
+          test -f web/build/index.html
+          test -f web/build/THIRD_PARTY_JAVASCRIPT_LICENSES.json
+
+      - name: Upload canonical web payload
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
-          bun-version: 1.3.11
+          name: executor-web-build
+          path: web/build/
+          if-no-files-found: error
+          compression-level: 9
+          overwrite: true
+          retention-days: 14
 
-      - name: Setup Node
-        uses: actions/setup-node@v4
+  notices:
+    name: Generate third-party notices
+    needs: validate
+    runs-on: ubuntu-22.04
+    timeout-minutes: 20
+    steps:
+      - name: Checkout exact commit
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          node-version: 24
-          registry-url: https://registry.npmjs.org
+          ref: ${{ needs.validate.outputs.commit_sha }}
+          persist-credentials: false
 
-      - name: Update npm for trusted publishing
+      - name: Install Rust toolchain
+        shell: bash
         run: |
-          npm install -g npm@latest
-          npm --version
+          set -euo pipefail
+          rustup toolchain install "$RUST_VERSION" --profile minimal
+          rustup override set "$RUST_VERSION"
 
-      - name: Install dependencies
-        run: bun install --frozen-lockfile
+      - name: Generate dependency license inventory
+        shell: bash
+        env:
+          SOURCE_DATE_EPOCH: ${{ needs.validate.outputs.source_date_epoch }}
+        run: |
+          set -euo pipefail
+          cargo install cargo-about --version 0.9.0 --locked --features cli
+          cargo about generate about.hbs > THIRD_PARTY_LICENSES.html
 
-      - name: Create or update release pull request
-        id: changesets
-        uses: changesets/action@v1
+      - name: Upload notices
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
-          version: bun run changeset:version
-          commit: Version Packages
-          title: Version Packages
-          createGithubReleases: false
+          name: executor-license-notices
+          path: THIRD_PARTY_LICENSES.html
+          if-no-files-found: error
+          compression-level: 9
+          overwrite: true
+          retention-days: 14
+
+  macos-service-tests:
+    name: Test macOS service lifecycle on compatibility floor
+    needs: validate
+    runs-on: macos-14
+    timeout-minutes: 45
+    steps:
+      - name: Checkout exact commit
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ needs.validate.outputs.commit_sha }}
+          persist-credentials: false
+
+      - name: Verify pinned compatibility-floor Apple toolchain
+        shell: bash
+        run: |
+          bash scripts/verify-apple-toolchain.sh \
+            "$MACOS_FLOOR_DEVELOPER_DIR" \
+            "$MACOS_FLOOR_XCODE_VERSION" \
+            "$MACOS_FLOOR_XCODE_BUILD" \
+            "$MACOS_FLOOR_SDK_VERSION" \
+            "$MACOS_FLOOR_CLANG_VERSION" \
+            "$MACOS_FLOOR_LD_VERSION"
+
+      - name: Install Rust toolchain
+        shell: bash
+        run: |
+          set -euo pipefail
+          rustup toolchain install "$RUST_VERSION" --profile minimal
+          rustup override set "$RUST_VERSION"
+
+      - name: Test Rust service lifecycle
         env:
-          # PAT (RELEASE_PAT) so the auto-opened Version Packages PR
-          # triggers downstream workflows (pkg-pr-new, CI). PRs authored
-          # by the default GITHUB_TOKEN do not trigger other workflows by
-          # GitHub design. Falls back to GITHUB_TOKEN when the secret is
-          # not set, so the workflow keeps working in forks / before the
-          # secret is configured.
-          GITHUB_TOKEN: ${{ secrets.RELEASE_PAT || secrets.GITHUB_TOKEN }}
+          DEVELOPER_DIR: ${{ env.MACOS_FLOOR_DEVELOPER_DIR }}
+        run: cargo test --locked --lib service::tests
 
-      - name: Smoke test packed @executor-js library packages
-        if: steps.changesets.outputs.hasChangesets == 'false'
-        run: bun run release:smoke:packages
+      - name: Test LaunchAgent safety with isolated fixtures
+        run: bash scripts/test-install-launchd-safety.sh
 
-      - name: Publish @executor-js library packages
-        if: steps.changesets.outputs.hasChangesets == 'false'
-        run: bun run release:publish:packages
+      - name: Test bounded LaunchAgent logging
+        run: bash scripts/test-bounded-log.sh
 
-      - name: Detect release version change
-        if: steps.changesets.outputs.hasChangesets == 'false'
-        id: detect_release
+      - name: Test archive install and uninstall lifecycle
+        run: bash scripts/test-install-release-archive.sh
+
+  build-native:
+    name: Build ${{ matrix.target }}
+    needs:
+      - validate
+      - web
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: ubuntu-22.04
+            platform: linux/amd64
+            target: x86_64-unknown-linux-gnu
+          - runner: ubuntu-22.04-arm
+            platform: linux/arm64
+            target: aarch64-unknown-linux-gnu
+          - runner: macos-15-intel
+            target: x86_64-apple-darwin
+          - runner: macos-15
+            target: aarch64-apple-darwin
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 45
+    steps:
+      - name: Checkout exact commit
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ needs.validate.outputs.commit_sha }}
+          persist-credentials: false
+
+      - name: Download canonical web payload
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: executor-web-build
+          path: web/build
+
+      - name: Verify canonical web payload
+        shell: bash
         run: |
-          before="${{ github.event.before }}"
-          if [ "$before" = "0000000000000000000000000000000000000000" ]; then
-            before="$(git rev-list --max-count=1 HEAD^ 2>/dev/null || true)"
+          set -euo pipefail
+          test -f web/build/index.html
+          test -f web/build/THIRD_PARTY_JAVASCRIPT_LICENSES.json
+
+      - name: Verify pinned release Apple toolchain
+        if: runner.os == 'macOS'
+        shell: bash
+        run: |
+          bash scripts/verify-apple-toolchain.sh \
+            "$MACOS_BUILD_DEVELOPER_DIR" \
+            "$MACOS_BUILD_XCODE_VERSION" \
+            "$MACOS_BUILD_XCODE_BUILD" \
+            "$MACOS_BUILD_SDK_VERSION" \
+            "$MACOS_BUILD_CLANG_VERSION" \
+            "$MACOS_BUILD_LD_VERSION"
+
+      - name: Install Rust toolchain
+        if: runner.os == 'macOS'
+        shell: bash
+        run: |
+          set -euo pipefail
+          rustup toolchain install "$RUST_VERSION" --profile minimal --target "${{ matrix.target }}"
+          rustup override set "$RUST_VERSION"
+
+      - name: Set up pinned Docker Buildx for Linux native build
+        if: runner.os == 'Linux'
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+        with:
+          driver-opts: image=${{ env.BUILDKIT_IMAGE }}
+          version: ${{ env.BUILDX_VERSION }}
+
+      - name: Build Linux release binary in pinned Ubuntu 22.04 toolchain
+        if: runner.os == 'Linux'
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+        env:
+          SOURCE_DATE_EPOCH: ${{ needs.validate.outputs.source_date_epoch }}
+        with:
+          context: .
+          file: Dockerfile.release-native
+          target: artifact
+          platforms: ${{ matrix.platform }}
+          build-args: |
+            RUST_TARGET=${{ matrix.target }}
+            SOURCE_DATE_EPOCH=${{ needs.validate.outputs.source_date_epoch }}
+          build-contexts: |
+            release-web=web/build
+          outputs: type=local,dest=${{ runner.temp }}/pinned-native
+          provenance: false
+          sbom: false
+
+      - name: Stage pinned Linux release binary
+        if: runner.os == 'Linux'
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p "target/${{ matrix.target }}/release"
+          install -m 0755 \
+            "$RUNNER_TEMP/pinned-native/executor" \
+            "target/${{ matrix.target }}/release/executor"
+
+      - name: Build macOS release binary
+        if: runner.os == 'macOS'
+        env:
+          DEVELOPER_DIR: ${{ env.MACOS_BUILD_DEVELOPER_DIR }}
+          SOURCE_DATE_EPOCH: ${{ needs.validate.outputs.source_date_epoch }}
+        run: cargo build --locked --release --target "${{ matrix.target }}"
+
+      - name: Verify macOS 14 deployment target
+        if: runner.os == 'macOS'
+        shell: bash
+        env:
+          DEVELOPER_DIR: ${{ env.MACOS_BUILD_DEVELOPER_DIR }}
+        run: |
+          set -euo pipefail
+          binary="target/${{ matrix.target }}/release/executor"
+          build_info="$(xcrun vtool -show-build "$binary")"
+          printf '%s\n' "$build_info"
+          minos="$(printf '%s\n' "$build_info" | awk '$1 == "minos" { print $2; exit }')"
+          if [ "$minos" != "$MACOSX_DEPLOYMENT_TARGET" ]; then
+            echo "macOS release binary declares minos $minos, expected $MACOSX_DEPLOYMENT_TARGET" >&2
+            exit 1
+          fi
+
+      - name: Verify native binary version
+        shell: bash
+        env:
+          EXPECTED_VERSION: ${{ needs.validate.outputs.version }}
+        run: |
+          set -euo pipefail
+          actual="$(target/${{ matrix.target }}/release/executor --version)"
+          test "$actual" = "executor $EXPECTED_VERSION"
+
+      - name: Verify Linux glibc 2.35 compatibility ceiling
+        if: runner.os == 'Linux'
+        shell: bash
+        run: |
+          set -euo pipefail
+          binary="target/${{ matrix.target }}/release/executor"
+          max_glibc="$(readelf --version-info "$binary" \
+            | grep -oE 'GLIBC_[0-9]+(\.[0-9]+)+' \
+            | sed 's/^GLIBC_//' \
+            | sort -Vu \
+            | tail -n 1)"
+          test -n "$max_glibc"
+          if [ "$(printf '%s\n' "$max_glibc" 2.35 | sort -V | tail -n 1)" != 2.35 ]; then
+            echo "Linux release binary requires GLIBC_$max_glibc, above the 2.35 baseline" >&2
+            exit 1
           fi
 
-          version="$(node -e "console.log(JSON.parse(require('fs').readFileSync('apps/cli/package.json', 'utf8')).version)")"
-          if [ -n "$before" ] && git cat-file -e "$before:apps/cli/package.json" 2>/dev/null; then
-            previous_version="$(git show "$before:apps/cli/package.json" | node -e "let data = ''; process.stdin.setEncoding('utf8'); process.stdin.on('data', (chunk) => { data += chunk; }); process.stdin.on('end', () => { console.log(JSON.parse(data).version ?? ''); });")"
+      - name: Stage native binary artifact
+        shell: bash
+        run: |
+          set -euo pipefail
+          output="$RUNNER_TEMP/native-binary"
+          mkdir -p "$output"
+          install -m 0755 "target/${{ matrix.target }}/release/executor" "$output/executor"
+
+      - name: Upload raw native binary
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: executor-native-${{ matrix.target }}
+          path: ${{ runner.temp }}/native-binary/executor
+          if-no-files-found: error
+          compression-level: 0
+          overwrite: true
+          retention-days: 14
+
+  package-native:
+    name: Package native archives in pinned compressor environment
+    needs:
+      - build-native
+      - notices
+      - validate
+      - web
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+      - name: Checkout exact commit
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ needs.validate.outputs.commit_sha }}
+          persist-credentials: false
+
+      - name: Download raw native binaries
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          path: ${{ runner.temp }}/native-binaries
+          pattern: executor-native-*
+
+      - name: Download third-party notices
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: executor-license-notices
+          path: ${{ runner.temp }}/release-metadata
+
+      - name: Download canonical web payload
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: executor-web-build
+          path: ${{ runner.temp }}/canonical-web
+
+      - name: Stage complete packaging input
+        shell: bash
+        run: |
+          set -euo pipefail
+          input="$RUNNER_TEMP/release-inputs"
+          mkdir -p "$input/native"
+          for target in \
+            aarch64-apple-darwin \
+            aarch64-unknown-linux-gnu \
+            x86_64-apple-darwin \
+            x86_64-unknown-linux-gnu; do
+              source="$RUNNER_TEMP/native-binaries/executor-native-$target/executor"
+              test -s "$source"
+              mkdir "$input/native/$target"
+              install -m 0755 "$source" "$input/native/$target/executor"
+          done
+          install -m 0644 LICENSE "$input/LICENSE"
+          install -m 0644 \
+            "$RUNNER_TEMP/release-metadata/THIRD_PARTY_LICENSES.html" \
+            "$input/THIRD_PARTY_LICENSES.html"
+          install -m 0644 \
+            "$RUNNER_TEMP/canonical-web/THIRD_PARTY_JAVASCRIPT_LICENSES.json" \
+            "$input/THIRD_PARTY_JAVASCRIPT_LICENSES.json"
+
+      - name: Set up pinned Docker Buildx for archive packaging
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+        with:
+          driver-opts: image=${{ env.BUILDKIT_IMAGE }}
+          version: ${{ env.BUILDX_VERSION }}
+
+      - name: Build archives in pinned Python and zlib environment
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+        with:
+          context: .
+          file: Dockerfile.release-package
+          target: artifacts
+          build-args: |
+            BUILDKIT_IMAGE=${{ env.BUILDKIT_IMAGE }}
+            BUILDX_VERSION=${{ env.BUILDX_VERSION }}
+            MACOS_BUILD_CLANG_VERSION=${{ env.MACOS_BUILD_CLANG_VERSION }}
+            MACOS_BUILD_LD_VERSION=${{ env.MACOS_BUILD_LD_VERSION }}
+            MACOS_BUILD_SDK_VERSION=${{ env.MACOS_BUILD_SDK_VERSION }}
+            MACOS_BUILD_XCODE_BUILD=${{ env.MACOS_BUILD_XCODE_BUILD }}
+            MACOS_BUILD_XCODE_VERSION=${{ env.MACOS_BUILD_XCODE_VERSION }}
+            MACOS_FLOOR_CLANG_VERSION=${{ env.MACOS_FLOOR_CLANG_VERSION }}
+            MACOS_FLOOR_LD_VERSION=${{ env.MACOS_FLOOR_LD_VERSION }}
+            MACOS_FLOOR_SDK_VERSION=${{ env.MACOS_FLOOR_SDK_VERSION }}
+            MACOS_FLOOR_XCODE_BUILD=${{ env.MACOS_FLOOR_XCODE_BUILD }}
+            MACOS_FLOOR_XCODE_VERSION=${{ env.MACOS_FLOOR_XCODE_VERSION }}
+            REPRODUCIBILITY_RUN=first
+            SOURCE_DATE_EPOCH=${{ needs.validate.outputs.source_date_epoch }}
+          build-contexts: |
+            release-inputs=${{ runner.temp }}/release-inputs
+          outputs: type=local,dest=${{ runner.temp }}/release-artifacts
+          provenance: false
+          sbom: false
+
+      - name: Repeat pinned archive build
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+        with:
+          context: .
+          file: Dockerfile.release-package
+          target: artifacts
+          build-args: |
+            BUILDKIT_IMAGE=${{ env.BUILDKIT_IMAGE }}
+            BUILDX_VERSION=${{ env.BUILDX_VERSION }}
+            MACOS_BUILD_CLANG_VERSION=${{ env.MACOS_BUILD_CLANG_VERSION }}
+            MACOS_BUILD_LD_VERSION=${{ env.MACOS_BUILD_LD_VERSION }}
+            MACOS_BUILD_SDK_VERSION=${{ env.MACOS_BUILD_SDK_VERSION }}
+            MACOS_BUILD_XCODE_BUILD=${{ env.MACOS_BUILD_XCODE_BUILD }}
+            MACOS_BUILD_XCODE_VERSION=${{ env.MACOS_BUILD_XCODE_VERSION }}
+            MACOS_FLOOR_CLANG_VERSION=${{ env.MACOS_FLOOR_CLANG_VERSION }}
+            MACOS_FLOOR_LD_VERSION=${{ env.MACOS_FLOOR_LD_VERSION }}
+            MACOS_FLOOR_SDK_VERSION=${{ env.MACOS_FLOOR_SDK_VERSION }}
+            MACOS_FLOOR_XCODE_BUILD=${{ env.MACOS_FLOOR_XCODE_BUILD }}
+            MACOS_FLOOR_XCODE_VERSION=${{ env.MACOS_FLOOR_XCODE_VERSION }}
+            REPRODUCIBILITY_RUN=second
+            SOURCE_DATE_EPOCH=${{ needs.validate.outputs.source_date_epoch }}
+          build-contexts: |
+            release-inputs=${{ runner.temp }}/release-inputs
+          outputs: type=local,dest=${{ runner.temp }}/release-artifacts-repeat
+          provenance: false
+          sbom: false
+
+      - name: Verify byte-identical archives and checksums
+        shell: bash
+        run: |
+          set -euo pipefail
+          first="$RUNNER_TEMP/release-artifacts"
+          second="$RUNNER_TEMP/release-artifacts-repeat"
+          cmp "$first/BUILD-TOOLCHAINS.txt" "$second/BUILD-TOOLCHAINS.txt"
+          for target in \
+            aarch64-apple-darwin \
+            aarch64-unknown-linux-gnu \
+            x86_64-apple-darwin \
+            x86_64-unknown-linux-gnu; do
+              archive="executor-${target}.tar.gz"
+              cmp "$first/$archive" "$second/$archive"
+              cmp "$first/$archive.sha256" "$second/$archive.sha256"
+              (cd "$first" && sha256sum --check "$archive.sha256")
+          done
+
+      - name: Upload canonical packaged archives
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: executor-release-archives
+          path: ${{ runner.temp }}/release-artifacts/
+          if-no-files-found: error
+          compression-level: 0
+          overwrite: true
+          retention-days: 14
+
+  smoke-native:
+    name: Smoke packaged ${{ matrix.target }}
+    needs:
+      - package-native
+      - validate
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: ubuntu-22.04
+            target: x86_64-unknown-linux-gnu
+          - runner: ubuntu-22.04-arm
+            target: aarch64-unknown-linux-gnu
+          - runner: macos-15-intel
+            target: x86_64-apple-darwin
+          - runner: macos-14
+            target: aarch64-apple-darwin
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 15
+    steps:
+      - name: Checkout exact commit
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ needs.validate.outputs.commit_sha }}
+          persist-credentials: false
+
+      - name: Download packaged native archive
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: executor-release-archives
+          path: ${{ runner.temp }}/release-archive
+
+      - name: Download canonical web payload
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: executor-web-build
+          path: ${{ runner.temp }}/canonical-web
+
+      - name: Verify and extract packaged native archive
+        shell: bash
+        run: |
+          set -euo pipefail
+          archive="executor-${{ matrix.target }}.tar.gz"
+          input="$RUNNER_TEMP/release-archive"
+          output="$RUNNER_TEMP/packaged-executor"
+          if command -v sha256sum >/dev/null 2>&1; then
+            (cd "$input" && sha256sum --check "$archive.sha256")
           else
-            previous_version=""
+            (cd "$input" && shasum -a 256 --check "$archive.sha256")
+          fi
+          mkdir -p "$output"
+          tar -xzf "$input/$archive" -C "$output"
+          test -x "$output/executor"
+
+      - name: Boot archive and verify first boot, health, and embedded web identity
+        shell: bash
+        run: |
+          set -euo pipefail
+          binary="$RUNNER_TEMP/packaged-executor/executor"
+          data_dir="$RUNNER_TEMP/executor-smoke-data"
+          log_file="$RUNNER_TEMP/executor-smoke.log"
+          port="$(python3 -c 'import socket; sock = socket.socket(); sock.bind(("127.0.0.1", 0)); print(sock.getsockname()[1]); sock.close()')"
+          mkdir -p "$data_dir"
+          chmod 0700 "$data_dir"
+
+          "$binary" server \
+            --bind "127.0.0.1:$port" \
+            --data-dir "$data_dir" \
+            > "$log_file" 2>&1 &
+          server_pid=$!
+          cleanup() {
+            if kill -0 "$server_pid" >/dev/null 2>&1; then
+              kill -TERM "$server_pid" >/dev/null 2>&1 || true
+              wait "$server_pid" || true
+            fi
+            rm -rf "$data_dir"
+          }
+          trap cleanup EXIT
+
+          ready=false
+          for _ in {1..120}; do
+            if curl --fail --silent --show-error "http://127.0.0.1:$port/healthz" >/dev/null 2>&1; then
+              ready=true
+              break
+            fi
+            if ! kill -0 "$server_pid" >/dev/null 2>&1; then
+              break
+            fi
+            sleep 1
+          done
+          if [ "$ready" != true ]; then
+            cat "$log_file" >&2
+            exit 1
           fi
 
-          release_tag="v$version"
-          if [ -n "$previous_version" ] && [ "$previous_version" != "$version" ]; then
-            echo "changed=true" >> "$GITHUB_OUTPUT"
-          elif ! git ls-remote --exit-code --tags origin "refs/tags/$release_tag" >/dev/null 2>&1; then
-            echo "changed=true" >> "$GITHUB_OUTPUT"
+          grep -F 'Complete first-boot setup at:' "$log_file" >/dev/null
+          grep -E "http://127\\.0\\.0\\.1:${port}/setup#token=.+" "$log_file" >/dev/null
+          scripts/smoke-release-server.sh \
+            "http://127.0.0.1:$port" \
+            "$RUNNER_TEMP/canonical-web"
+
+          kill -TERM "$server_pid"
+          wait "$server_pid"
+          trap - EXIT
+          rm -rf "$data_dir"
+
+  checksums:
+    name: Assemble checksum manifest
+    needs:
+      - macos-service-tests
+      - package-native
+      - smoke-native
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - name: Download target artifacts
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: executor-release-archives
+          path: release-artifacts
+
+      - name: Verify archives and assemble manifest
+        shell: bash
+        working-directory: release-artifacts
+        run: |
+          set -euo pipefail
+
+          expected_targets=(
+            aarch64-apple-darwin
+            aarch64-unknown-linux-gnu
+            x86_64-apple-darwin
+            x86_64-unknown-linux-gnu
+          )
+
+          : > SHA256SUMS
+          for target in "${expected_targets[@]}"; do
+            archive="executor-${target}.tar.gz"
+            sidecar="${archive}.sha256"
+            test -f "$archive"
+            test -f "$sidecar"
+            cat "$sidecar" >> SHA256SUMS
+          done
+
+          test "$(find . -maxdepth 1 -name 'executor-*.tar.gz' -type f | wc -l)" -eq 4
+          test -s BUILD-TOOLCHAINS.txt
+          sha256sum BUILD-TOOLCHAINS.txt >> SHA256SUMS
+          sha256sum --check SHA256SUMS
+
+      - name: Upload complete release bundle
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: executor-release-artifacts
+          path: release-artifacts/
+          if-no-files-found: error
+          compression-level: 0
+          overwrite: true
+          retention-days: 14
+
+  stage-release:
+    name: Stage draft GitHub release
+    if: inputs.mode == 'publish'
+    needs:
+      - assemble-container
+      - authorize-publish
+      - checksums
+      - validate
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    environment: native-release
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout exact commit
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ needs.validate.outputs.commit_sha }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Download release bundle
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: executor-release-artifacts
+          path: release-artifacts
+
+      - name: Create or reuse draft and upload exact assets
+        shell: bash
+        env:
+          GH_TOKEN: ${{ secrets.NATIVE_RELEASE_TOKEN }}
+          IMAGE: ${{ needs.validate.outputs.image }}
+          IMAGE_DIGEST: ${{ needs.assemble-container.outputs.digest }}
+          PRERELEASE: ${{ needs.validate.outputs.prerelease }}
+          RELEASE_SHA: ${{ needs.validate.outputs.commit_sha }}
+          RELEASE_TAG: ${{ inputs.tag }}
+          RUN_ID: ${{ github.run_id }}
+        run: |
+          set -euo pipefail
+
+          git fetch --force --no-tags origin \
+            "+refs/tags/$RELEASE_TAG:refs/tags/$RELEASE_TAG"
+          tag_sha="$(git rev-parse "$RELEASE_TAG^{commit}")"
+          if [ "$tag_sha" != "$RELEASE_SHA" ]; then
+            echo "Release tag $RELEASE_TAG moved to $tag_sha, expected $RELEASE_SHA" >&2
+            exit 1
+          fi
+
+          if [[ ! "$IMAGE_DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]; then
+            echo "Invalid assembled container digest: $IMAGE_DIGEST" >&2
+            exit 1
+          fi
+
+          bindings="$RUNNER_TEMP/release-bindings"
+          mkdir -p "$bindings"
+          run_binding="$bindings/RELEASE-RUN.json"
+          image_binding="$bindings/RELEASE-IMAGE.json"
+          python3 - \
+            "$run_binding" \
+            "$image_binding" \
+            "$EXECUTOR_REPOSITORY" \
+            "$RELEASE_TAG" \
+            "$RELEASE_SHA" \
+            "$RUN_ID" \
+            "$IMAGE" \
+            "$IMAGE_DIGEST" <<'PY'
+          import json
+          import pathlib
+          import sys
+
+          run_binding = {
+              "commit": sys.argv[5],
+              "repository": sys.argv[3],
+              "run_id": sys.argv[6],
+              "tag": sys.argv[4],
+          }
+          image_binding = {
+              **run_binding,
+              "digest": sys.argv[8],
+              "image": sys.argv[7],
+          }
+          for path, binding in (
+              (sys.argv[1], run_binding),
+              (sys.argv[2], image_binding),
+          ):
+              pathlib.Path(path).write_text(
+                  json.dumps(binding, sort_keys=True, separators=(",", ":")) + "\n",
+                  encoding="utf-8",
+              )
+          PY
+
+          assets=(
+            "$image_binding"
+            "$run_binding"
+            release-artifacts/BUILD-TOOLCHAINS.txt
+            release-artifacts/executor-aarch64-apple-darwin.tar.gz
+            release-artifacts/executor-aarch64-apple-darwin.tar.gz.sha256
+            release-artifacts/executor-aarch64-unknown-linux-gnu.tar.gz
+            release-artifacts/executor-aarch64-unknown-linux-gnu.tar.gz.sha256
+            release-artifacts/executor-x86_64-apple-darwin.tar.gz
+            release-artifacts/executor-x86_64-apple-darwin.tar.gz.sha256
+            release-artifacts/executor-x86_64-unknown-linux-gnu.tar.gz
+            release-artifacts/executor-x86_64-unknown-linux-gnu.tar.gz.sha256
+            release-artifacts/SHA256SUMS
+          )
+          for asset in "${assets[@]}"; do
+            test -f "$asset"
+          done
+
+          release_title="$RELEASE_TAG [executor-run:$RUN_ID]"
+          published_release=false
+          if gh release view "$RELEASE_TAG" --repo "$EXECUTOR_REPOSITORY" >/dev/null 2>&1; then
+            release_state="$RUNNER_TEMP/staged-release.json"
+            gh api "repos/$EXECUTOR_REPOSITORY/releases/tags/$RELEASE_TAG" > "$release_state"
+            actual_title="$(jq -r '.name // ""' "$release_state")"
+            if [ "$actual_title" != "$release_title" ]; then
+              echo "Release $RELEASE_TAG belongs to a different workflow run" >&2
+              exit 1
+            fi
+            python3 - "$release_state" "$RELEASE_TAG" "$RELEASE_SHA" "$PRERELEASE" <<'PY'
+          import json
+          import pathlib
+          import sys
+
+          release = json.loads(pathlib.Path(sys.argv[1]).read_text(encoding="utf-8"))
+          expected_prerelease = sys.argv[4] == "true"
+          if (
+              release.get("tag_name") != sys.argv[2]
+              or release.get("target_commitish") != sys.argv[3]
+              or release.get("prerelease") is not expected_prerelease
+              or release.get("draft") not in (True, False)
+          ):
+              raise SystemExit("existing release does not match the validated release state")
+          if release.get("draft") is False and release.get("immutable") is not True:
+              raise SystemExit("published release is not immutable")
+          PY
+
+            is_draft="$(jq -r .draft "$release_state")"
+            binding_count="$(
+              jq '[.assets[]? | select(.name == "RELEASE-RUN.json")] | length' \
+                "$release_state"
+            )"
+            if [ "$binding_count" -eq 1 ]; then
+              ownership="$RUNNER_TEMP/existing-release-ownership"
+              rm -rf "$ownership"
+              mkdir -p "$ownership"
+              gh release download "$RELEASE_TAG" \
+                --repo "$EXECUTOR_REPOSITORY" \
+                --pattern RELEASE-RUN.json \
+                --dir "$ownership"
+              if ! cmp "$run_binding" "$ownership/RELEASE-RUN.json"; then
+                echo "Release $RELEASE_TAG belongs to a different workflow run or source" >&2
+                exit 1
+              fi
+            elif [ "$binding_count" -eq 0 ] && [ "$is_draft" = true ]; then
+              echo "Recovering same-run draft created before its binding asset uploaded"
+            else
+              echo "Release $RELEASE_TAG must contain exactly one RELEASE-RUN.json asset" >&2
+              exit 1
+            fi
+
+            if [ "$is_draft" != true ]; then
+              published_release=true
+            fi
           else
-            echo "changed=false" >> "$GITHUB_OUTPUT"
+            args=(
+              release create "$RELEASE_TAG"
+              --repo "$EXECUTOR_REPOSITORY"
+              --title "$release_title"
+              --target "$RELEASE_SHA"
+              --verify-tag
+              --generate-notes
+              --draft
+            )
+            if [ "$PRERELEASE" = true ]; then
+              args+=(--prerelease)
+            fi
+            gh "${args[@]}"
+          fi
+
+          if [ "$published_release" = false ]; then
+            gh release upload "$RELEASE_TAG" \
+              "${assets[@]}" \
+              --repo "$EXECUTOR_REPOSITORY" \
+              --clobber
+          fi
+
+          expected_assets="$(for asset in "${assets[@]}"; do basename "$asset"; done | sort)"
+          remote_assets="$(gh release view "$RELEASE_TAG" --repo "$EXECUTOR_REPOSITORY" --json assets --jq '.assets[].name' | sort)"
+          if [ "$remote_assets" != "$expected_assets" ]; then
+            echo "Release assets do not match the exact native release bundle" >&2
+            diff -u <(printf '%s\n' "$expected_assets") <(printf '%s\n' "$remote_assets") || true
+            exit 1
           fi
 
-          echo "version=$version" >> "$GITHUB_OUTPUT"
+          verified_assets="$RUNNER_TEMP/verified-release-assets"
+          rm -rf "$verified_assets"
+          mkdir -p "$verified_assets"
+          gh release download "$RELEASE_TAG" \
+            --repo "$EXECUTOR_REPOSITORY" \
+            --dir "$verified_assets"
+          for asset in "${assets[@]}"; do
+            cmp "$asset" "$verified_assets/$(basename "$asset")"
+          done
+
+  build-container-dry-run:
+    name: Dry-run container ${{ matrix.platform }}
+    if: inputs.mode == 'dry-run'
+    needs:
+      - checksums
+      - validate
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: ubuntu-22.04
+            artifact: amd64
+            platform: linux/amd64
+            target: x86_64-unknown-linux-gnu
+          - runner: ubuntu-22.04-arm
+            artifact: arm64
+            platform: linux/arm64
+            target: aarch64-unknown-linux-gnu
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 20
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout exact commit
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ needs.validate.outputs.commit_sha }}
+          persist-credentials: false
+
+      - name: Download matching native release artifact
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: executor-release-artifacts
+          path: ${{ runner.temp }}/release-archive
 
-      - name: Validate release tag
-        if: steps.changesets.outputs.hasChangesets == 'false' && steps.detect_release.outputs.changed == 'true'
-        id: validate_release
+      - name: Download canonical web payload
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: executor-web-build
+          path: ${{ runner.temp }}/canonical-web
+
+      - name: Verify and extract native release artifact
+        shell: bash
+        run: |
+          set -euo pipefail
+          archive="executor-${{ matrix.target }}.tar.gz"
+          input="$RUNNER_TEMP/release-archive"
+          output="$RUNNER_TEMP/prebuilt-executor"
+          (cd "$input" && sha256sum --check "$archive.sha256")
+          mkdir -p "$output"
+          tar -xzf "$input/$archive" -C "$output"
+          test -x "$output/executor"
+          test -f "$output/LICENSE"
+          test -f "$output/THIRD_PARTY_LICENSES.html"
+          test -f "$output/THIRD_PARTY_JAVASCRIPT_LICENSES.json"
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+        with:
+          driver-opts: image=${{ env.BUILDKIT_IMAGE }}
+          version: ${{ env.BUILDX_VERSION }}
+
+      - name: Build prebuilt runtime without publishing
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+        env:
+          SOURCE_DATE_EPOCH: ${{ needs.validate.outputs.source_date_epoch }}
+        with:
+          context: .
+          file: Dockerfile
+          target: runtime-prebuilt
+          platforms: ${{ matrix.platform }}
+          build-contexts: |
+            prebuilt-executor=${{ runner.temp }}/prebuilt-executor
+          load: true
+          push: false
+          tags: executor-release-smoke:${{ matrix.artifact }}
+          labels: |
+            org.opencontainers.image.title=Executor
+            org.opencontainers.image.description=Native self-hosted Executor
+            org.opencontainers.image.source=https://github.com/${{ env.EXECUTOR_REPOSITORY }}
+            org.opencontainers.image.revision=${{ needs.validate.outputs.commit_sha }}
+            org.opencontainers.image.version=${{ needs.validate.outputs.version }}
+          provenance: false
+          sbom: false
+
+      - name: Smoke release-only prebuilt image path
+        shell: bash
+        run: |
+          scripts/smoke-release-container.sh \
+            "executor-release-smoke:${{ matrix.artifact }}" \
+            "$RUNNER_TEMP/canonical-web" \
+            "executor-release-smoke-${GITHUB_RUN_ID}-${{ matrix.artifact }}" \
+            "executor-release-smoke-data-${GITHUB_RUN_ID}-${{ matrix.artifact }}"
+
+  publish-container-arch:
+    name: Publish container ${{ matrix.platform }} by digest
+    if: inputs.mode == 'publish'
+    needs:
+      - authorize-publish
+      - checksums
+      - validate
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: ubuntu-22.04
+            platform: linux/amd64
+            target: x86_64-unknown-linux-gnu
+            artifact: amd64
+          - runner: ubuntu-22.04-arm
+            platform: linux/arm64
+            target: aarch64-unknown-linux-gnu
+            artifact: arm64
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 20
+    environment: native-release
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout exact commit
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ needs.validate.outputs.commit_sha }}
+          persist-credentials: false
+
+      - name: Download matching native release artifact
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: executor-release-artifacts
+          path: ${{ runner.temp }}/release-archive
+
+      - name: Verify and extract native release artifact
+        shell: bash
+        run: |
+          set -euo pipefail
+          archive="executor-${{ matrix.target }}.tar.gz"
+          input="$RUNNER_TEMP/release-archive"
+          output="$RUNNER_TEMP/prebuilt-executor"
+          (cd "$input" && sha256sum --check "$archive.sha256")
+          mkdir -p "$output"
+          tar -xzf "$input/$archive" -C "$output"
+          test -x "$output/executor"
+          test -f "$output/LICENSE"
+          test -f "$output/THIRD_PARTY_LICENSES.html"
+          test -f "$output/THIRD_PARTY_JAVASCRIPT_LICENSES.json"
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+        with:
+          driver-opts: image=${{ env.BUILDKIT_IMAGE }}
+          version: ${{ env.BUILDX_VERSION }}
+
+      - name: Log in to GHCR
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        with:
+          registry: ghcr.io
+          username: ${{ needs.authorize-publish.outputs.registry_username }}
+          password: ${{ secrets.NATIVE_RELEASE_TOKEN }}
+
+      - name: Build and push architecture image by digest
+        id: build
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
         env:
-          RELEASE_VERSION: ${{ steps.detect_release.outputs.version }}
-        run: bun run scripts/validate-release-ref.ts --version-env RELEASE_VERSION --output tag
+          SOURCE_DATE_EPOCH: ${{ needs.validate.outputs.source_date_epoch }}
+        with:
+          context: .
+          file: Dockerfile
+          target: runtime-prebuilt
+          platforms: ${{ matrix.platform }}
+          build-contexts: |
+            prebuilt-executor=${{ runner.temp }}/prebuilt-executor
+          outputs: type=image,name=${{ needs.validate.outputs.image }},push-by-digest=true,name-canonical=true,push=true,rewrite-timestamp=true
+          labels: |
+            org.opencontainers.image.title=Executor
+            org.opencontainers.image.description=Native self-hosted Executor
+            org.opencontainers.image.source=https://github.com/${{ env.EXECUTOR_REPOSITORY }}
+            org.opencontainers.image.revision=${{ needs.validate.outputs.commit_sha }}
+            org.opencontainers.image.version=${{ needs.validate.outputs.version }}
+          provenance: false
+          sbom: false
 
-      - name: Create and push release tag
-        if: steps.changesets.outputs.hasChangesets == 'false' && steps.detect_release.outputs.changed == 'true'
+      - name: Export architecture digest
+        shell: bash
         env:
-          GH_TOKEN: ${{ secrets.RELEASE_PAT || github.token }}
-          RELEASE_TAG: ${{ steps.validate_release.outputs.tag }}
+          IMAGE_DIGEST: ${{ steps.build.outputs.digest }}
         run: |
-          auth_remote="https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
-          if git ls-remote --exit-code --tags "$auth_remote" "refs/tags/$RELEASE_TAG" >/dev/null 2>&1; then
-            echo "Tag $RELEASE_TAG already exists."
-            exit 0
+          set -euo pipefail
+          if [[ ! "$IMAGE_DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]; then
+            echo "Invalid architecture image digest: $IMAGE_DIGEST" >&2
+            exit 1
           fi
+          mkdir -p "$RUNNER_TEMP/container-digests"
+          touch "$RUNNER_TEMP/container-digests/${IMAGE_DIGEST#sha256:}"
+
+      - name: Upload architecture digest
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: executor-container-digest-${{ matrix.artifact }}
+          path: ${{ runner.temp }}/container-digests/
+          if-no-files-found: error
+          compression-level: 0
+          overwrite: true
+          retention-days: 1
+
+  assemble-container:
+    name: Assemble multi-platform container manifest
+    if: inputs.mode == 'publish'
+    needs:
+      - authorize-publish
+      - publish-container-arch
+      - validate
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    environment: native-release
+    permissions:
+      contents: read
+    outputs:
+      digest: ${{ steps.manifest.outputs.digest }}
+    steps:
+      - name: Checkout exact commit
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ needs.validate.outputs.commit_sha }}
+          persist-credentials: false
+
+      - name: Download architecture digests
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          path: ${{ runner.temp }}/container-digests
+          pattern: executor-container-digest-*
+          merge-multiple: true
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+        with:
+          driver-opts: image=${{ env.BUILDKIT_IMAGE }}
+          version: ${{ env.BUILDX_VERSION }}
 
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git tag "$RELEASE_TAG"
-          git push "$auth_remote" "$RELEASE_TAG"
+      - name: Log in to GHCR
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        with:
+          registry: ghcr.io
+          username: ${{ needs.authorize-publish.outputs.registry_username }}
+          password: ${{ secrets.NATIVE_RELEASE_TOKEN }}
 
-      - name: Trigger CLI publish
-        if: steps.changesets.outputs.hasChangesets == 'false' && steps.detect_release.outputs.changed == 'true'
+      - name: Assemble and verify staging manifest
+        id: manifest
+        shell: bash
         env:
-          GH_TOKEN: ${{ github.token }}
-          RELEASE_TAG: ${{ steps.validate_release.outputs.tag }}
+          IMAGE: ${{ needs.validate.outputs.image }}
+          VERSION: ${{ needs.validate.outputs.version }}
         run: |
-          gh workflow run publish-executor-package.yml --ref "$RELEASE_TAG" -f tag="$RELEASE_TAG"
+          set -euo pipefail
+          mapfile -t digests < <(find "$RUNNER_TEMP/container-digests" -maxdepth 1 -type f -printf '%f\n' | sort)
+          if [ "${#digests[@]}" -ne 2 ]; then
+            echo "Expected two architecture digests, found ${#digests[@]}" >&2
+            exit 1
+          fi
+
+          sources=()
+          for digest in "${digests[@]}"; do
+            if [[ ! "$digest" =~ ^[0-9a-f]{64}$ ]]; then
+              echo "Invalid architecture digest: $digest" >&2
+              exit 1
+            fi
+            sources+=("$IMAGE@sha256:$digest")
+          done
 
-      # Desktop build downloads CLI binaries from the release, so it must
-      # run after CLI publish completes. Trigger it from the CLI workflow
-      # or manually via: gh workflow run publish-desktop.yml -f tag=vX.Y.Z
+          staging="$IMAGE:staging-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
+          docker buildx imagetools create \
+            --annotation "index:org.opencontainers.image.version=$VERSION" \
+            --tag "$staging" \
+            "${sources[@]}"
+          raw_manifest="$(docker buildx imagetools inspect "$staging" --raw)"
+          python3 scripts/verify-release-index.py \
+            --version "$VERSION" \
+            <<< "$raw_manifest"
+
+          digest="$(docker buildx imagetools inspect "$staging" | awk '$1 == "Digest:" { print $2; exit }')"
+          if [[ ! "$digest" =~ ^sha256:[0-9a-f]{64}$ ]]; then
+            echo "Invalid assembled image digest: $digest" >&2
+            exit 1
+          fi
+          echo "digest=$digest" >> "$GITHUB_OUTPUT"
+
+  smoke-container:
+    name: Smoke published prebuilt container ${{ matrix.platform }}
+    if: inputs.mode == 'publish'
+    needs:
+      - assemble-container
+      - authorize-publish
+      - validate
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: ubuntu-22.04
+            artifact: amd64
+            platform: linux/amd64
+          - runner: ubuntu-22.04-arm
+            artifact: arm64
+            platform: linux/arm64
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 15
+    environment: native-release
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout exact commit
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ needs.validate.outputs.commit_sha }}
+          persist-credentials: false
+
+      - name: Download canonical web payload
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: executor-web-build
+          path: ${{ runner.temp }}/canonical-web
+
+      - name: Log in to GHCR
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        with:
+          registry: ghcr.io
+          username: ${{ needs.authorize-publish.outputs.registry_username }}
+          password: ${{ secrets.NATIVE_RELEASE_TOKEN }}
+
+      - name: Pull and smoke exact assembled digest
+        shell: bash
+        env:
+          IMAGE: ${{ needs.validate.outputs.image }}
+          IMAGE_DIGEST: ${{ needs.assemble-container.outputs.digest }}
+        run: |
+          set -euo pipefail
+          reference="$IMAGE@$IMAGE_DIGEST"
+          docker pull "$reference"
+          scripts/smoke-release-container.sh \
+            "$reference" \
+            "$RUNNER_TEMP/canonical-web" \
+            "executor-published-smoke-${GITHUB_RUN_ID}-${{ matrix.artifact }}" \
+            "executor-published-smoke-data-${GITHUB_RUN_ID}-${{ matrix.artifact }}"
+
+      - name: Verify exact digest is anonymously pullable
+        shell: bash
+        env:
+          IMAGE: ${{ needs.validate.outputs.image }}
+          IMAGE_DIGEST: ${{ needs.assemble-container.outputs.digest }}
+        run: |
+          set -euo pipefail
+          anonymous_config="$RUNNER_TEMP/anonymous-docker-config"
+          mkdir -p "$anonymous_config"
+          DOCKER_CONFIG="$anonymous_config" docker pull "$IMAGE@$IMAGE_DIGEST"
+
+  promote:
+    name: Promote release
+    if: inputs.mode == 'publish'
+    needs:
+      - assemble-container
+      - authorize-publish
+      - smoke-container
+      - stage-release
+      - validate
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    environment: native-release
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout exact commit
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ needs.validate.outputs.commit_sha }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Download release bundle for final verification
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: executor-release-artifacts
+          path: release-artifacts
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+        with:
+          driver-opts: image=${{ env.BUILDKIT_IMAGE }}
+          version: ${{ env.BUILDX_VERSION }}
+
+      - name: Log in to GHCR
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        with:
+          registry: ghcr.io
+          username: ${{ needs.authorize-publish.outputs.registry_username }}
+          password: ${{ secrets.NATIVE_RELEASE_TOKEN }}
+
+      - name: Revalidate remote release tag before promotion
+        shell: bash
+        env:
+          RELEASE_SHA: ${{ needs.validate.outputs.commit_sha }}
+          RELEASE_TAG: ${{ inputs.tag }}
+        run: |
+          set -euo pipefail
+          git fetch --force --no-tags origin \
+            "+refs/tags/$RELEASE_TAG:refs/tags/$RELEASE_TAG"
+          tag_sha="$(git rev-parse "$RELEASE_TAG^{commit}")"
+          if [ "$tag_sha" != "$RELEASE_SHA" ]; then
+            echo "Release tag $RELEASE_TAG moved to $tag_sha, expected $RELEASE_SHA" >&2
+            exit 1
+          fi
+
+      - name: Assign immutable tags and verify channel eligibility
+        shell: bash
+        env:
+          CHANNEL: ${{ needs.validate.outputs.channel }}
+          GH_TOKEN: ${{ secrets.NATIVE_RELEASE_TOKEN }}
+          IMAGE: ${{ needs.validate.outputs.image }}
+          IMAGE_DIGEST: ${{ needs.assemble-container.outputs.digest }}
+          RELEASE_SHA: ${{ needs.validate.outputs.commit_sha }}
+          RELEASE_TAG: ${{ inputs.tag }}
+          VERSION: ${{ needs.validate.outputs.version }}
+        run: |
+          set -euo pipefail
+          if [[ ! "$IMAGE_DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]; then
+            echo "Invalid container digest: $IMAGE_DIGEST" >&2
+            exit 1
+          fi
+
+          inspect_digest() {
+            local reference="$1"
+            local error_file="$RUNNER_TEMP/imagetools-inspect-error"
+            local output digest
+            : > "$error_file"
+            if output="$(docker buildx imagetools inspect "$reference" 2>"$error_file")"; then
+              digest="$(awk '$1 == "Digest:" { print $2; exit }' <<< "$output")"
+              if [[ ! "$digest" =~ ^sha256:[0-9a-f]{64}$ ]]; then
+                echo "Could not resolve a valid digest for $reference" >&2
+                return 2
+              fi
+              printf '%s\n' "$digest"
+              return 0
+            fi
+            if grep -Eqi 'manifest unknown|not found|404' "$error_file"; then
+              return 1
+            fi
+            cat "$error_file" >&2
+            return 2
+          }
+
+          release_history="$RUNNER_TEMP/published-releases.json"
+          gh api --paginate --slurp \
+            "repos/$EXECUTOR_REPOSITORY/releases?per_page=100" \
+            > "$release_history"
+          history_relation="$(
+            python3 scripts/check-release-channel-order.py \
+              --channel "$CHANNEL" \
+              --history-file "$release_history" \
+              --candidate "$VERSION"
+          )"
+          echo "Published release history permits $history_relation candidate $VERSION"
+
+          channel_reference="$IMAGE:$CHANNEL"
+          if current_channel_digest="$(inspect_digest "$channel_reference")"; then
+            channel_manifest="$(docker buildx imagetools inspect "$channel_reference" --raw)"
+            current_channel_version="$(
+              jq -r '.annotations["org.opencontainers.image.version"] // ""' \
+                <<< "$channel_manifest"
+            )"
+            if [ -z "$current_channel_version" ]; then
+              echo "Existing channel $channel_reference has no release version annotation" >&2
+              exit 1
+            fi
+            relation="$(
+              python3 scripts/check-release-channel-order.py \
+                --channel "$CHANNEL" \
+                --current "$current_channel_version" \
+                --candidate "$VERSION"
+            )"
+            if [ "$relation" = equal ]; then
+              if [ "$current_channel_digest" != "$IMAGE_DIGEST" ]; then
+                echo "Channel $channel_reference already has version $VERSION at a different digest" >&2
+                exit 1
+              fi
+              echo "Channel $channel_reference already points to the expected digest"
+            fi
+          else
+            rc=$?
+            if [ "$rc" -ne 1 ]; then
+              exit "$rc"
+            fi
+            echo "Channel $channel_reference does not exist yet"
+          fi
+
+          immutable_tags=("$RELEASE_TAG" "$VERSION" "sha-$RELEASE_SHA")
+          missing_tags=()
+          for tag in "${immutable_tags[@]}"; do
+            reference="$IMAGE:$tag"
+            if existing="$(inspect_digest "$reference")"; then
+              if [ "$existing" != "$IMAGE_DIGEST" ]; then
+                echo "Immutable tag $reference already points to $existing, expected $IMAGE_DIGEST" >&2
+                exit 1
+              fi
+              echo "Immutable tag $reference already points to the expected digest"
+            else
+              status=$?
+              if [ "$status" -ne 1 ]; then
+                exit "$status"
+              fi
+              missing_tags+=("$tag")
+            fi
+          done
+
+          for tag in "${missing_tags[@]}"; do
+            docker buildx imagetools create \
+              --tag "$IMAGE:$tag" \
+              "$IMAGE@$IMAGE_DIGEST"
+          done
+
+          for tag in "${immutable_tags[@]}"; do
+            actual="$(inspect_digest "$IMAGE:$tag")"
+            if [ "$actual" != "$IMAGE_DIGEST" ]; then
+              echo "Immutable tag $IMAGE:$tag resolved to $actual after assignment" >&2
+              exit 1
+            fi
+          done
+
+      - name: Verify release ownership and image binding before publication
+        shell: bash
+        env:
+          GH_TOKEN: ${{ secrets.NATIVE_RELEASE_TOKEN }}
+          IMAGE: ${{ needs.validate.outputs.image }}
+          IMAGE_DIGEST: ${{ needs.assemble-container.outputs.digest }}
+          RELEASE_SHA: ${{ needs.validate.outputs.commit_sha }}
+          RELEASE_TAG: ${{ inputs.tag }}
+          RUN_ID: ${{ github.run_id }}
+        run: |
+          set -euo pipefail
+          if [[ ! "$IMAGE_DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]; then
+            echo "Invalid assembled container digest: $IMAGE_DIGEST" >&2
+            exit 1
+          fi
+
+          release_title="$RELEASE_TAG [executor-run:$RUN_ID]"
+          release_state="$RUNNER_TEMP/pre-publication-release.json"
+          gh api "repos/$EXECUTOR_REPOSITORY/releases/tags/$RELEASE_TAG" > "$release_state"
+          python3 - \
+            "$release_state" \
+            "$RELEASE_TAG" \
+            "$RELEASE_SHA" \
+            "$release_title" <<'PY'
+          import json
+          import pathlib
+          import sys
+
+          release = json.loads(pathlib.Path(sys.argv[1]).read_text(encoding="utf-8"))
+          if (
+              release.get("tag_name") != sys.argv[2]
+              or release.get("target_commitish") != sys.argv[3]
+              or release.get("name") != sys.argv[4]
+              or release.get("draft") not in (True, False)
+          ):
+              raise SystemExit("release ownership does not match this workflow run")
+          if release.get("draft") is False and release.get("immutable") is not True:
+              raise SystemExit("published release is not immutable")
+          PY
+
+          bindings="$RUNNER_TEMP/final-release-bindings"
+          mkdir -p "$bindings"
+          run_binding="$bindings/RELEASE-RUN.json"
+          image_binding="$bindings/RELEASE-IMAGE.json"
+          python3 - \
+            "$run_binding" \
+            "$image_binding" \
+            "$EXECUTOR_REPOSITORY" \
+            "$RELEASE_TAG" \
+            "$RELEASE_SHA" \
+            "$RUN_ID" \
+            "$IMAGE" \
+            "$IMAGE_DIGEST" <<'PY'
+          import json
+          import pathlib
+          import sys
+
+          run_binding = {
+              "commit": sys.argv[5],
+              "repository": sys.argv[3],
+              "run_id": sys.argv[6],
+              "tag": sys.argv[4],
+          }
+          image_binding = {
+              **run_binding,
+              "digest": sys.argv[8],
+              "image": sys.argv[7],
+          }
+          for path, binding in (
+              (sys.argv[1], run_binding),
+              (sys.argv[2], image_binding),
+          ):
+              pathlib.Path(path).write_text(
+                  json.dumps(binding, sort_keys=True, separators=(",", ":")) + "\n",
+                  encoding="utf-8",
+              )
+          PY
+
+          assets=(
+            "$image_binding"
+            "$run_binding"
+            release-artifacts/BUILD-TOOLCHAINS.txt
+            release-artifacts/executor-aarch64-apple-darwin.tar.gz
+            release-artifacts/executor-aarch64-apple-darwin.tar.gz.sha256
+            release-artifacts/executor-aarch64-unknown-linux-gnu.tar.gz
+            release-artifacts/executor-aarch64-unknown-linux-gnu.tar.gz.sha256
+            release-artifacts/executor-x86_64-apple-darwin.tar.gz
+            release-artifacts/executor-x86_64-apple-darwin.tar.gz.sha256
+            release-artifacts/executor-x86_64-unknown-linux-gnu.tar.gz
+            release-artifacts/executor-x86_64-unknown-linux-gnu.tar.gz.sha256
+            release-artifacts/SHA256SUMS
+          )
+          for asset in "${assets[@]}"; do
+            test -f "$asset"
+          done
+
+          expected_assets="$(for asset in "${assets[@]}"; do basename "$asset"; done | sort)"
+          remote_assets="$(gh release view "$RELEASE_TAG" --repo "$EXECUTOR_REPOSITORY" --json assets --jq '.assets[].name' | sort)"
+          if [ "$remote_assets" != "$expected_assets" ]; then
+            echo "Release assets do not match the exact pre-publication bundle" >&2
+            diff -u <(printf '%s\n' "$expected_assets") <(printf '%s\n' "$remote_assets") || true
+            exit 1
+          fi
+
+          verified_assets="$RUNNER_TEMP/final-verified-release-assets"
+          rm -rf "$verified_assets"
+          mkdir -p "$verified_assets"
+          gh release download "$RELEASE_TAG" \
+            --repo "$EXECUTOR_REPOSITORY" \
+            --dir "$verified_assets"
+          for asset in "${assets[@]}"; do
+            cmp "$asset" "$verified_assets/$(basename "$asset")"
+          done
+
+      - name: Publish GitHub release
+        shell: bash
+        env:
+          GH_TOKEN: ${{ secrets.NATIVE_RELEASE_TOKEN }}
+          PRERELEASE: ${{ needs.validate.outputs.prerelease }}
+          RELEASE_TAG: ${{ inputs.tag }}
+        run: |
+          set -euo pipefail
+          is_draft="$(
+            gh release view "$RELEASE_TAG" \
+              --repo "$EXECUTOR_REPOSITORY" \
+              --json isDraft \
+              --jq .isDraft
+          )"
+          if [ "$is_draft" = true ]; then
+            args=(release edit "$RELEASE_TAG" --repo "$EXECUTOR_REPOSITORY" --draft=false)
+            if [ "$PRERELEASE" = true ]; then
+              args+=(--prerelease)
+            else
+              args+=(--latest)
+            fi
+            gh "${args[@]}"
+          else
+            actual_prerelease="$(
+              gh release view "$RELEASE_TAG" \
+                --repo "$EXECUTOR_REPOSITORY" \
+                --json isPrerelease \
+                --jq .isPrerelease
+            )"
+            if [ "$actual_prerelease" != "$PRERELEASE" ]; then
+              echo "Published release $RELEASE_TAG has unexpected prerelease state" >&2
+              exit 1
+            fi
+            echo "GitHub release $RELEASE_TAG is already published"
+          fi
+
+      - name: Verify published GitHub release is immutable
+        shell: bash
+        env:
+          GH_TOKEN: ${{ secrets.NATIVE_RELEASE_TOKEN }}
+          PRERELEASE: ${{ needs.validate.outputs.prerelease }}
+          RELEASE_SHA: ${{ needs.validate.outputs.commit_sha }}
+          RELEASE_TAG: ${{ inputs.tag }}
+          RUN_ID: ${{ github.run_id }}
+        run: |
+          set -euo pipefail
+          release_state="$RUNNER_TEMP/published-release.json"
+          gh api "repos/$EXECUTOR_REPOSITORY/releases/tags/$RELEASE_TAG" > "$release_state"
+          release_title="$RELEASE_TAG [executor-run:$RUN_ID]"
+          python3 - \
+            "$release_state" \
+            "$RELEASE_TAG" \
+            "$RELEASE_SHA" \
+            "$PRERELEASE" \
+            "$release_title" <<'PY'
+          import json
+          import pathlib
+          import sys
+
+          release = json.loads(pathlib.Path(sys.argv[1]).read_text(encoding="utf-8"))
+          if (
+              release.get("tag_name") != sys.argv[2]
+              or release.get("target_commitish") != sys.argv[3]
+              or release.get("draft") is not False
+              or release.get("prerelease") is not (sys.argv[4] == "true")
+              or release.get("name") != sys.argv[5]
+              or release.get("immutable") is not True
+          ):
+              raise SystemExit("published GitHub release is not the expected immutable release")
+          PY
+
+          verified=false
+          verification_error="$RUNNER_TEMP/release-attestation-error"
+          verification_output="$RUNNER_TEMP/release-attestation.json"
+          for attempt in {1..24}; do
+            if gh release verify "$RELEASE_TAG" \
+              --repo "$EXECUTOR_REPOSITORY" \
+              --format json \
+              > "$verification_output" \
+              2> "$verification_error"; then
+                cat "$verification_output"
+                verified=true
+                break
+            fi
+            if [ "$attempt" -lt 24 ]; then
+              sleep 5
+            fi
+          done
+          if [ "$verified" != true ]; then
+            cat "$verification_error" >&2
+            echo "GitHub release attestation was not available after bounded retries" >&2
+            exit 1
+          fi
+
+      - name: Move mutable channel after GitHub release publication
+        shell: bash
+        env:
+          CHANNEL: ${{ needs.validate.outputs.channel }}
+          GH_TOKEN: ${{ secrets.NATIVE_RELEASE_TOKEN }}
+          IMAGE: ${{ needs.validate.outputs.image }}
+          IMAGE_DIGEST: ${{ needs.assemble-container.outputs.digest }}
+          RELEASE_TAG: ${{ inputs.tag }}
+          VERSION: ${{ needs.validate.outputs.version }}
+        run: |
+          set -euo pipefail
+          test "$(
+            gh release view "$RELEASE_TAG" \
+              --repo "$EXECUTOR_REPOSITORY" \
+              --json isDraft \
+              --jq .isDraft
+          )" = false
+          if [[ ! "$IMAGE_DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]; then
+            echo "Invalid container digest: $IMAGE_DIGEST" >&2
+            exit 1
+          fi
+
+          inspect_digest() {
+            local reference="$1"
+            local error_file="$RUNNER_TEMP/imagetools-inspect-error"
+            local output digest
+            : > "$error_file"
+            if output="$(docker buildx imagetools inspect "$reference" 2>"$error_file")"; then
+              digest="$(awk '$1 == "Digest:" { print $2; exit }' <<< "$output")"
+              if [[ ! "$digest" =~ ^sha256:[0-9a-f]{64}$ ]]; then
+                echo "Could not resolve a valid digest for $reference" >&2
+                return 2
+              fi
+              printf '%s\n' "$digest"
+              return 0
+            fi
+            if grep -Eqi 'manifest unknown|not found|404' "$error_file"; then
+              return 1
+            fi
+            cat "$error_file" >&2
+            return 2
+          }
+
+          release_history="$RUNNER_TEMP/published-releases-after-promotion.json"
+          gh api --paginate --slurp \
+            "repos/$EXECUTOR_REPOSITORY/releases?per_page=100" \
+            > "$release_history"
+          python3 scripts/check-release-channel-order.py \
+            --channel "$CHANNEL" \
+            --history-file "$release_history" \
+            --candidate "$VERSION"
+
+          channel_reference="$IMAGE:$CHANNEL"
+          move_channel=true
+          if current_channel_digest="$(inspect_digest "$channel_reference")"; then
+            channel_manifest="$(docker buildx imagetools inspect "$channel_reference" --raw)"
+            current_channel_version="$(
+              jq -r '.annotations["org.opencontainers.image.version"] // ""' \
+                <<< "$channel_manifest"
+            )"
+            if [ -z "$current_channel_version" ]; then
+              echo "Existing channel $channel_reference has no release version annotation" >&2
+              exit 1
+            fi
+            relation="$(
+              python3 scripts/check-release-channel-order.py \
+                --channel "$CHANNEL" \
+                --current "$current_channel_version" \
+                --candidate "$VERSION"
+            )"
+            if [ "$relation" = equal ]; then
+              if [ "$current_channel_digest" != "$IMAGE_DIGEST" ]; then
+                echo "Channel $channel_reference already has version $VERSION at a different digest" >&2
+                exit 1
+              fi
+              move_channel=false
+            fi
+          else
+            status=$?
+            if [ "$status" -ne 1 ]; then
+              exit "$status"
+            fi
+          fi
+
+          if [ "$move_channel" = true ]; then
+            docker buildx imagetools create \
+              --tag "$channel_reference" \
+              "$IMAGE@$IMAGE_DIGEST"
+          fi
+          channel_digest="$(inspect_digest "$channel_reference")"
+          if [ "$channel_digest" != "$IMAGE_DIGEST" ]; then
+            echo "Channel tag $channel_reference resolved to $channel_digest" >&2
+            exit 1
+          fi
diff --git a/.gitignore b/.gitignore
index 4c3f79186..7d6eadfbc 100644
--- a/.gitignore
+++ b/.gitignore
@@ -16,7 +16,7 @@ coverage
 *.lcov
 
 # logs
-logs
+/logs/
 _.log
 report.[0-9]_.[0-9]_.[0-9]_.[0-9]_.json
 
@@ -53,18 +53,18 @@ executor.har
 secret.key
 
 # desktop app build artifacts
-apps/desktop/resources/
+legacy/desktop/resources/
 
 # cloud local dev database
 .pglite
-apps/cloud/.dev-db/
-apps/cloud/.e2e-db/
+legacy/cloud/.dev-db/
+legacy/cloud/.e2e-db/
 
 # e2e suite: generated run artifacts + throwaway target state (the * also
 # covers ad-hoc variants like .e2e-stub-db-manual from debugging boots)
 e2e/runs/
-apps/cloud/.e2e-stub-db*/
-apps/host-selfhost/.e2e-data*/
+legacy/cloud/.e2e-stub-db*/
+legacy/host-selfhost/.e2e-data*/
 
 # playwright e2e artifacts
 test-results/
@@ -115,3 +115,8 @@ scratch/
 # Throwaway UX prototype (not part of the app)
 ux-demo/
 
+
+
+# Added by cargo
+
+/target
diff --git a/.oxfmtrc.json b/.oxfmtrc.json
index d92df54ec..20ace484d 100644
--- a/.oxfmtrc.json
+++ b/.oxfmtrc.json
@@ -5,6 +5,7 @@
     ".reference",
     ".turbo",
     "dist",
+    "legacy",
     "vendor",
     "e2e/runs",
     "node_modules",
@@ -12,7 +13,6 @@
     "bun.lock",
     "*.tsbuildinfo",
     "executor-*.tgz",
-    "**/routeTree.gen.ts",
-    "apps/cloud/src/services/executor-schema.ts"
+    "**/routeTree.gen.ts"
   ]
 }
diff --git a/.oxlintrc.jsonc b/.oxlintrc.jsonc
index 53839c4bb..9c9841171 100644
--- a/.oxlintrc.jsonc
+++ b/.oxlintrc.jsonc
@@ -59,10 +59,11 @@
   "overrides": [
     {
       "files": [
-        "apps/cli/src/**/*.{ts,tsx}",
-        "apps/desktop/src/main.ts",
+        "legacy/cli/src/**/*.{ts,tsx}",
+        "legacy/desktop/src/main/**/*.{ts,tsx}",
         "scripts/**/*.{ts,js}",
         "apps/*/scripts/**/*.{ts,js}",
+        "legacy/*/scripts/**/*.{ts,js}",
         "packages/kernel/runtime-*/src/**/*.{ts,tsx,js,mjs}",
       ],
       "rules": {
@@ -153,6 +154,7 @@
     "vendor/",
     "emulators/",
     "e2e/runs/",
+    "legacy/",
     "node_modules/",
     "packages/core/fumadb/",
     "packages/core/sdk/src/vendor/json-schema-to-typescript/",
diff --git a/.skills/cli-release/SKILL.md b/.skills/cli-release/SKILL.md
index 11fb4234c..d5263e88c 100644
--- a/.skills/cli-release/SKILL.md
+++ b/.skills/cli-release/SKILL.md
@@ -1,133 +1,65 @@
 ---
 name: cli-release
-description: Runbook for releasing the `executor` CLI package (stable and beta). Covers scope of what ships with the CLI, user-facing changelog conventions, Changesets + Version Packages PR flow, beta train entry/exit, and owner preferences. Use when the user asks to cut a release, prepare release notes, enter/exit a beta train, or write changesets for the CLI.
+description: Runbook for the supported native Executor release. Covers Cargo versioning, immutable release inputs, dry runs, protected authorization, and owner-gated publishing.
 ---
 
-# Executor CLI release runbook
+# Executor release runbook
 
-## Authoritative doc
+## Authoritative document
 
-`RELEASING.md` at repo root is the source of truth. This skill encodes the owner's preferences on top of it.
+`RELEASING.md` at the repository root is the source of truth. The supported
+native Rust product, published by `.github/workflows/release.yml`, is the only
+release surface.
 
-## What the `executor` CLI actually ships
+Do not infer another release path from archived source or historical tags.
 
-The CLI binary bundles:
+## Native product release
 
-- `apps/cli/**` — CLI source + daemon
-- `apps/local/**` — the web UI (embedded as a virtual module via `apps/cli/src/build.ts:178`) + drizzle migrations (`build.ts:205`)
-- `packages/**` — `core`, `kernel`, `hosts/mcp`, `runtime-quickjs`, and every plugin under `packages/plugins/**`
+`Cargo.toml` is the only native product version source. The manual
+`.github/workflows/release.yml` workflow is the only entrypoint allowed to
+publish native archives, the root container image, or the primary GitHub
+release.
 
-Does **not** ship in the CLI:
+The workflow requires:
 
-- `apps/cloud/**` (Cloudflare Workers deployment)
-- `apps/marketing/**`, `apps/desktop/**`
-- `examples/**`, `tests/**`
+- `mode`: `dry-run` or `publish`
+- `tag`: exact `v<Cargo.toml version>`
+- `commit_sha`: exact lowercase 40-character commit on `origin/main`
 
-**Implication for changelogs**: when asked "what changed since the last release", scope is `git log v<last>..HEAD -- apps/cli apps/local packages`, not just `apps/cli`. Skipping `apps/local` and `packages` misses the bulk of product changes (Connections UI, OAuth plugins, SDK scope, OTEL, etc.).
+Always run dry-run mode first. Publish mode additionally requires the remote tag
+to point at the exact supplied commit, the protected `native-release`
+environment, and its scoped `NATIVE_RELEASE_TOKEN` secret.
 
-## Versioning preferences
-
-- Prior convention in this repo uses **`patch`** bumps for feature-heavy releases (see `.changeset/executor-1.4.6-beta.md` for precedent). Don't push back on patch unless there are genuine SemVer-breaking API changes to a library consumer surface.
-- Breaking CLI UX changes (removed flags, changed argv shape) have historically still been `patch` bumps. Follow the owner's call — ask, don't assume `minor`.
-- Normal release/patch PRs must add a `.changeset/*.md` file with frontmatter like `"executor": patch`. Do **not** directly bump `apps/cli/package.json` or `bun.lock` in a feature/fix PR.
-- Only the Changesets-generated `Version Packages` PR should move `apps/cli/package.json`. If a normal PR directly changes that version, merging it to `main` can make `.github/workflows/release.yml` tag the commit and dispatch `publish-executor-package.yml`, causing an immediate CLI publish.
-- `@executor-js/*` library packages have their own publish path.
-
-## Release notes: standard Changesets flow — the changeset body IS the changelog
-
-As of v1.5.0 this repo uses the canonical Changesets pipeline. The old
-`apps/cli/release-notes/next.md` rolling file is gone — do not recreate it.
-
-### How it's wired
-
-- Every user-visible PR adds a `.changeset/*.md`; its **body** is the
-  user-facing changelog entry.
-- `changeset version` (run by `changesets/action@v1` when building the
-  Version Packages PR) compiles changeset bodies into each bumped
-  package's `CHANGELOG.md` using `@changesets/changelog-github`
-  (configured in `.changeset/config.json`), which prefixes each entry
-  with the PR link and credits the author automatically.
-- `apps/cli/src/release.ts` (`changelogSectionForVersion`) extracts the
-  released version's `## <version>` section from `apps/cli/CHANGELOG.md`
-  and uses it as the GitHub Release body. Missing section → falls back to
-  `--generate-notes`.
-- Per-package `CHANGELOG.md` seed files are still required for every
-  workspace package (`bun run lint:changelog-stubs --fix` creates them);
-  `changesets/action@v1` crashes with `ENOENT` on missing files.
-- `@changesets/changelog-github` needs `GITHUB_TOKEN` during
-  `changeset version`. CI provides it; locally:
-  `GITHUB_TOKEN=$(gh auth token) bun run changeset:version`.
-
-### Writing changeset bodies
-
-- Lead with user-visible behavior, not implementation. One sentence for a
-  typical fix; a short paragraph for a feature.
-- Big releases: a changeset body can be a full markdown section — use
-  **bold sub-headings** + bullets, never `#`/`##` headings (they end up
-  nested inside a changelog list item).
-- Breaking changes: include the before/after surface in the body.
-- Don't duplicate content across changesets — every changeset in the
-  release lands in the same version section.
-- Attribution is automatic via changelog-github; don't hand-write
-  `Thanks @...` lines.
-
-### When drafting a release-spanning changeset from `git log`
-
-- Look at `git diff v<last>..HEAD -- README.md` first — best single view of user-facing changes.
-- Read commits in bulk (`git log --oneline v<last>..HEAD -- apps/cli apps/local packages`), bucket by theme, then write prose.
-- Merged PRs without changesets still ship in the release — their content
-  ships regardless; only the changelog text is driven by changesets. If
-  something important landed without a changeset, fold its story into a
-  release-summary changeset.
-
-## Beta release flow
+```sh
+git fetch origin main
+sha="$(git rev-parse origin/main)"
+version="$(git show "$sha:Cargo.toml" | python3 -c 'import sys,tomllib; print(tomllib.load(sys.stdin.buffer)["package"]["version"])')"
+tag="v$version"
 
+gh workflow run release.yml --ref main \
+  -f mode=dry-run \
+  -f tag="$tag" \
+  -f commit_sha="$sha"
 ```
-git checkout -b rs/beta-v<next>-start
-bun run release:beta:start                 # creates .changeset/pre.json
-# write .changeset/executor-<next>-beta.md (frontmatter + user-facing body)
-git add ... && git commit                  # ONLY when owner says commit
-git push -u origin rs/beta-v<next>-start
-# Open PR -> merge -> release.yml opens "Version Packages (beta)" PR -> merge to publish
-```
-
-- Published under npm dist-tag `beta`.
-- Users install: `npm i -g executor@beta`.
-- Exit the train with `bun run release:beta:stop` when going back to stable.
-
-## Stable release flow
-
-Identical to beta except skip `release:beta:start`/`stop`. Changesets produce a normal `Version Packages` PR; merging publishes under `latest`.
-
-## Owner preferences (hard rules)
 
-- **Never commit until the owner explicitly says so.** Set everything up in the working tree, run `git status`, and stop.
-- **No AI / Claude / Anthropic / Co-Authored-By trailers** in commits, commit messages, PRs, or any generated file. This is in `CLAUDE.md` — do not violate.
-- **Branch naming**: `rs/<short-topic>` for Rhys's branches. Beta-start branch: `rs/beta-v<version>-start`.
-- **Remote**: `origin` = `https://github.com/RhysSullivan/executor.git`. If another remote appears (e.g. a fork remote), ask whether to remove it.
-- **Dirty working tree**: if there are uncommitted changes when starting a release, ask whether to include them, stash them, or commit separately first. Don't sweep them into the release commit silently.
-- **Don't estimate time** — code is cheap to write. Focus on what to do, not how long it takes.
-- **Fact-check scope claims** before publishing. If release notes say "does not affect X", verify by reading the diff.
-
-## Common commands
-
-```
-bun run changeset                          # interactive; or write .changeset/*.md directly
-bun run lint:changelog-stubs --fix         # seed missing per-package CHANGELOG.md files
-bun run release:beta:start                 # enter prerelease
-bun run release:beta:stop                  # exit prerelease
-bun run release:publish:dry-run            # build full CLI payload without publishing
-bun run release:publish:packages:dry-run   # pack @executor-js/* without publishing
-bun run release:check                      # invoked by publish workflow
-```
+Create and push the tag only after the dry run succeeds, then dispatch the same
+workflow with `mode=publish`. Follow the exact tag verification sequence in
+`RELEASING.md`.
 
-## What the workflow does after merge to `main`
+## Retired package release paths
 
-1. `.github/workflows/release.yml` opens/updates a `Version Packages` PR.
-2. Merging that PR:
-   - Publishes every `@executor-js/*` library that's not yet on npm (via `scripts/publish-packages.ts`).
-   - If `apps/cli/package.json` bumped, tags the commit and dispatches `publish-executor-package.yml`, which runs `release:check`, does a full dry-run build, publishes the CLI to npm, and creates/updates the GitHub Release with binary assets.
+The TypeScript workspaces are private implementation packages used by the
+active product and its retained source. This fork does not publish them to npm.
+The old npm workflows, publisher scripts, and Changesets release machinery are
+retired. Do not recreate a package release path from archived source or
+upstream package metadata.
 
-## Fallback behavior
+## Owner rules
 
-If something is unclear (bump level, whether to include in-flight work, whether to push), **ask the owner**. A release is a high-blast-radius action; one clarifying question is cheaper than a rogue publish.
+- Never commit, push, tag, dispatch publish mode, or publish without explicit
+  owner approval.
+- Never add AI assistant attribution or co-author trailers.
+- Preserve unrelated dirty worktree changes.
+- Verify version, tag, commit, workflow inputs, and remote state before
+  describing a release as ready.
+- Ask one question when release scope or publish authority is unclear.
diff --git a/.skills/warden-security-review/SKILL.md b/.skills/warden-security-review/SKILL.md
index 83555b865..f403c9bcb 100644
--- a/.skills/warden-security-review/SKILL.md
+++ b/.skills/warden-security-review/SKILL.md
@@ -23,6 +23,13 @@ npm exec --yes --package=@sentry/warden -- warden --help
 
 The repo has a `warden.toml` that uses remote skills from `getsentry/warden-skills`.
 
+Before scanning, verify that every configured target resolves to at least one
+non-ignored file:
+
+```bash
+bun run lint:warden-targets
+```
+
 Reference skills are mirrored under `.reference/warden-skills` when needed. `.reference/` is gitignored.
 
 ## Local Outputs
@@ -42,22 +49,29 @@ Warden may not treat bare directories as recursive targets. Prefer explicit quot
 
 ## Recommended Scans
 
-Authz on cloud/API surfaces:
+Authz on the active Rust API and OAuth surfaces plus archived opt-in API
+surfaces:
 
 ```bash
 npm exec --yes --package=@sentry/warden -- \
-  warden "apps/cloud/src/auth/**/*.ts" "apps/cloud/src/api/**/*.ts" \
-  "apps/cloud/src/routes/**/*.tsx" "packages/core/api/src/**/*.ts" \
+  warden "src/api.rs" "src/api/**/*.rs" "src/oauth/**/*.rs" \
+  "legacy/cloud/src/auth/**/*.ts" "legacy/cloud/src/api/**/*.ts" \
+  "legacy/cloud/src/routes/**/*.tsx" "packages/core/api/src/**/*.ts" \
   --skill wrdn-authz --fail-on off --report-on low --min-confidence low \
   --parallel 2 --log -o .warden-runs/authz.jsonl
 ```
 
 Code execution on sink-bearing runtime/plugin files:
 
+The archived local runtime remains in scope because explicit legacy development
+and test commands can still execute it. No release workflow publishes it. Its
+server code lives directly under `legacy/local/src`, not a `src/server`
+subdirectory.
+
 ```bash
 rg -l "\b(exec|spawn|execFile|fork|subprocess|Deno\.Command|new Function|eval\(|vm\.|QuickJS|quickjs|Worker\(|import\(|compile|instantiate|runIn|shell|command|child_process)\b" \
-  apps/local/src/server apps/cli/src packages/core/execution/src packages/core/sdk/src packages/kernel packages/plugins \
-  -g "*.ts" -g "*.tsx" -g "!*.test.ts" -g "!*.spec.ts" -g "!*.e2e.ts" -g "!**/dist/**" -g "!**/node_modules/**" \
+  src legacy/local/src legacy/cli/src packages/core/execution/src packages/core/sdk/src packages/kernel packages/plugins \
+  -g "*.rs" -g "*.ts" -g "*.tsx" -g "!*.test.ts" -g "!*.spec.ts" -g "!*.e2e.ts" -g "!**/dist/**" -g "!**/node_modules/**" \
   > .warden-runs/code-execution-targets.txt
 
 npm exec --yes --package=@sentry/warden -- \
@@ -69,15 +83,12 @@ npm exec --yes --package=@sentry/warden -- \
 Data exfiltration on backend/API/storage/plugin SDK surfaces:
 
 ```bash
-find apps/cloud/src/api apps/cloud/src/auth apps/local/src/server \
-  packages/core/api/src packages/core/storage-core/src packages/core/storage-file/src \
-  packages/core/storage-postgres/src packages/core/storage-drizzle/src \
-  packages/plugins/mcp/src packages/plugins/openapi/src packages/plugins/graphql/src \
-  packages/plugins/google-discovery/src packages/plugins/oauth2/src \
-  packages/plugins/onepassword/src packages/plugins/workos-vault/src \
-  packages/plugins/file-secrets/src packages/plugins/keychain/src \
-  -type f \( -name "*.ts" -o -name "*.tsx" \) |
-  rg -v '(\.test\.|\.spec\.|\.e2e\.|dist/|node_modules/|embedded-migrations\.gen\.ts|/react/)' \
+find src/api src/catalog src/invocation src/mcp src/oauth src/protocols src/runtime \
+  src/api.rs src/database.rs src/outbound.rs src/request_logs.rs \
+  legacy/cloud/src/api legacy/cloud/src/auth legacy/cloud/src/routes legacy/local/src \
+  packages/core/api/src packages/plugins packages/react/src/api \
+  -type f \( -name "*.rs" -o -name "*.ts" -o -name "*.tsx" \) |
+  rg -v '(\.test\.|\.spec\.|\.e2e\.|dist/|node_modules/|embedded-migrations\.gen\.ts)' \
   > .warden-runs/exfil-targets-focused.txt
 
 npm exec --yes --package=@sentry/warden -- \
@@ -109,12 +120,9 @@ For each candidate:
 - Determine what data returns to the caller: raw body, parsed fields, typed error message, timing/status oracle, or no observable data.
 - State confidence and deployment caveats.
 
-## Current Known Findings
-
-As of the Warden pass on 2026-04-29:
-
-- Real: authenticated SSRF in plugin/source setup URL fetching for OpenAPI, Google Discovery, GraphQL, and MCP remote endpoints.
-- Real: mutable third-party GitHub Actions refs in publish/release workflows, especially `oven-sh/setup-bun@v2` and `changesets/action@v1`.
-- Clean in that pass: authz scan on cloud auth/API/core API surfaces; code-execution scan on narrowed CLI/runtime/kernel/plugin sink files.
+## Result freshness
 
-Do not claim the whole codebase is secure from those clean runs. They are scoped scanner results.
+Do not carry old findings or clean claims forward without rerunning the current
+targets. Report the exact commit, skill, target list, confidence threshold, and
+output artifact for every result. A clean scoped pass is not evidence that the
+whole codebase is secure.
diff --git a/AGENTS.md b/AGENTS.md
index 1c0dd1661..c9c7a8788 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -115,10 +115,16 @@ before using it.
 - `packages/plugins/*`: protocol and provider plugins. Plugin-specific
   runtime, React, API, and testing helpers should live with the owning plugin.
 - `packages/react`: shared React UI and atom/client integration.
+- `packages/app`: shared React application shell and Vite composition.
 - `packages/hosts/mcp`: MCP host surface for exposing Executor through MCP.
 - `packages/kernel/*`: execution runtimes and code execution substrate.
-- `apps/local`, `apps/cloud`, `apps/cli`, and `apps/desktop`: product entry
-  points that compose the packages.
+- `packages/core/execution` and `packages/core/cli`: shared execution and
+  configuration tooling retained for package compatibility.
+- `src` and `web`: the active local/self-hosted Rust and Svelte product.
+- `legacy/cli` and `legacy/local`: archived TypeScript compatibility entry
+  points.
+- `legacy/cloud`, `legacy/desktop`, `legacy/host-cloudflare`, and
+  `legacy/host-selfhost`: archived deployment entry points.
 
 ## Other
 
diff --git a/Cargo.lock b/Cargo.lock
new file mode 100644
index 000000000..9b0d766c4
--- /dev/null
+++ b/Cargo.lock
@@ -0,0 +1,4028 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "adler2"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
+
+[[package]]
+name = "aead"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
+dependencies = [
+ "crypto-common",
+ "generic-array",
+]
+
+[[package]]
+name = "ahash"
+version = "0.8.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
+dependencies = [
+ "cfg-if",
+ "getrandom 0.3.4",
+ "once_cell",
+ "serde",
+ "version_check",
+ "zerocopy",
+]
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "allocator-api2"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
+
+[[package]]
+name = "android_system_properties"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "anstream"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d"
+dependencies = [
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is_terminal_polyfill",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
+
+[[package]]
+name = "anstyle-parse"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52ce7f38b242319f7cabaa6813055467063ecdc9d355bbb4ce0c68908cd8130e"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "3.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
+dependencies = [
+ "anstyle",
+ "once_cell_polyfill",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.102"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
+
+[[package]]
+name = "argon2"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c3610892ee6e0cbce8ae2700349fcf8f98adb0dbfbee85aec3c9179d29cc072"
+dependencies = [
+ "base64ct",
+ "blake2",
+ "cpufeatures",
+ "password-hash",
+]
+
+[[package]]
+name = "async-lock"
+version = "3.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "290f7f2596bd5b78a9fec8088ccd89180d7f9f55b94b0576823bbbdc72ee8311"
+dependencies = [
+ "event-listener",
+ "event-listener-strategy",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "async-trait"
+version = "0.1.89"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "atoi"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f28d99ec8bfea296261ca1af174f24225171fea9664ba9003cbebee704810528"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
+[[package]]
+name = "autocfg"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
+
+[[package]]
+name = "axum"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "31b698c5f9a010f6573133b09e0de5408834d0c82f8d7475a89fc1867a71cd90"
+dependencies = [
+ "axum-core",
+ "bytes",
+ "form_urlencoded",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "itoa",
+ "matchit",
+ "memchr",
+ "mime",
+ "percent-encoding",
+ "pin-project-lite",
+ "serde_core",
+ "serde_json",
+ "serde_path_to_error",
+ "serde_urlencoded",
+ "sync_wrapper",
+ "tokio",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "axum-core"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08c78f31d7b1291f7ee735c1c6780ccde7785daae9a9206026862dab7d8792d1"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "http-body-util",
+ "mime",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "base64-simd"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "339abbe78e73178762e23bea9dfd08e697eb3f3301cd4be981c0f78ba5859195"
+dependencies = [
+ "outref",
+ "vsimd",
+]
+
+[[package]]
+name = "base64ct"
+version = "1.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
+
+[[package]]
+name = "bit-set"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08807e080ed7f9d5433fa9b275196cfc35414f66a0c79d864dc51a0d825231a3"
+dependencies = [
+ "bit-vec",
+]
+
+[[package]]
+name = "bit-vec"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7"
+
+[[package]]
+name = "bitflags"
+version = "2.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4388bee8683e3d04af747c73422af53102d2bd24d9eadb6cbc100baef4b43f8"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "blake2"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46502ad458c9a52b69d4d4d32775c788b7a1b85e8bc9d482d92250fc0e3f8efe"
+dependencies = [
+ "digest",
+]
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "borrow-or-share"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc0b364ead1874514c8c2855ab558056ebfeb775653e7ae45ff72f28f8f3166c"
+
+[[package]]
+name = "bumpalo"
+version = "3.20.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
+
+[[package]]
+name = "bytecount"
+version = "0.6.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "175812e0be2bccb6abe50bb8d566126198344f707e304f45c648fd8f2cc0365e"
+
+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
+[[package]]
+name = "bytes"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ae3f5d315924270530207e2a68396c3cc547f6dca3fbdca317cfb1a51edb593"
+
+[[package]]
+name = "castaway"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dec551ab6e7578819132c713a93c022a05d60159dc86e7a7050223577484c55a"
+dependencies = [
+ "rustversion",
+]
+
+[[package]]
+name = "cc"
+version = "1.2.65"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e228eec9be7c17ccb640b59b36a5cd805ea2a564a4c5e162c2f659fea30d3b96"
+dependencies = [
+ "find-msvc-tools",
+ "shlex",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "cfg_aliases"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
+
+[[package]]
+name = "chacha20"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3613f74bd2eac03dad61bd53dbe620703d4371614fe0bc3b9f04dd36fe4e818"
+dependencies = [
+ "cfg-if",
+ "cipher",
+ "cpufeatures",
+]
+
+[[package]]
+name = "chacha20poly1305"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10cd79432192d1c0f4e1a0fef9527696cc039165d729fb41b3f4f4f354c2dc35"
+dependencies = [
+ "aead",
+ "chacha20",
+ "cipher",
+ "poly1305",
+ "zeroize",
+]
+
+[[package]]
+name = "chrono"
+version = "0.4.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1aa79e62e7697b8e29b513a68abacf485adcd1fe8284a4316c5ae868e6633327"
+dependencies = [
+ "iana-time-zone",
+ "num-traits",
+ "serde",
+ "windows-link",
+]
+
+[[package]]
+name = "cipher"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
+dependencies = [
+ "crypto-common",
+ "inout",
+ "zeroize",
+]
+
+[[package]]
+name = "clap"
+version = "4.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ddb117e43bbf7dacf0a4190fef4d345b9bad68dfc649cb349e7d17d28428e51"
+dependencies = [
+ "clap_builder",
+ "clap_derive",
+]
+
+[[package]]
+name = "clap_builder"
+version = "4.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "clap_lex",
+ "strsim",
+]
+
+[[package]]
+name = "clap_derive"
+version = "4.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2ce8604710f6733aa641a2b3731eaa1e8b3d9973d5e3565da11800813f997a9"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "clap_lex"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
+
+[[package]]
+name = "cobs"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fa961b519f0b462e3a3b4a34b64d119eeaca1d59af726fe450bbba07a9fc0a1"
+dependencies = [
+ "thiserror",
+]
+
+[[package]]
+name = "colorchoice"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
+
+[[package]]
+name = "compact_str"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9dfdd1c2274d9aa354115b09dc9a901d6c5576818cdf70d14cae2bdb47df00ab"
+dependencies = [
+ "castaway",
+ "cfg-if",
+ "itoa",
+ "rustversion",
+ "ryu",
+ "static_assertions",
+]
+
+[[package]]
+name = "concurrent-queue"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "const-oid"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
+
+[[package]]
+name = "cow-utils"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "417bef24afe1460300965a25ff4a24b8b45ad011948302ec221e8a0a81eb2c79"
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crc"
+version = "3.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5eb8a2a1cd12ab0d987a5d5e825195d372001a4094a0376319d5a0ad71c1ba0d"
+dependencies = [
+ "crc-catalog",
+]
+
+[[package]]
+name = "crc-catalog"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "217698eaf96b4a3f0bc4f3662aaa55bdf913cd54d7204591faa790070c6d0853"
+
+[[package]]
+name = "crc32fast"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9481c1c90cbf2ac953f07c8d4a58aa3945c425b7185c9154d67a65e4230da511"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "crossbeam-queue"
+version = "0.3.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f58bbc28f91df819d0aa2a2c00cd19754769c2fad90579b3592b1c9ba7a3115"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
+
+[[package]]
+name = "crypto-common"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+dependencies = [
+ "generic-array",
+ "rand_core 0.6.4",
+ "typenum",
+]
+
+[[package]]
+name = "data-encoding"
+version = "2.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4ae5f15dda3c708c0ade84bfee31ccab44a3da4f88015ed22f63732abe300c8"
+
+[[package]]
+name = "der"
+version = "0.7.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
+dependencies = [
+ "const-oid",
+ "pem-rfc7468",
+ "zeroize",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "const-oid",
+ "crypto-common",
+ "subtle",
+]
+
+[[package]]
+name = "directories"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "16f5094c54661b38d03bd7e50df373292118db60b585c08a411c6d840017fe7d"
+dependencies = [
+ "dirs-sys",
+]
+
+[[package]]
+name = "dirs-sys"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e01a3366d27ee9890022452ee61b2b63a67e6f13f58900b651ff5665f0bb1fab"
+dependencies = [
+ "libc",
+ "option-ext",
+ "redox_users",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ac70aa55017e108007fbaf5aa0f54b021c98f92ff8af59d42eda9da96e3dd4f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "dotenvy"
+version = "0.15.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1aaf95b3e5c8f23aa320147307562d361db0ae0d51242340f558153b4eb2439b"
+
+[[package]]
+name = "dragonbox_ecma"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd8e701084c37e7ef62d3f9e453b618130cbc0ef3573847785952a3ac3f746bf"
+
+[[package]]
+name = "either"
+version = "1.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91622ff5e7162018101f2fea40d6ebf4a78bbe5a49736a2020649edf9693679e"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "email_address"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e079f19b08ca6239f47f8ba8509c11cf3ea30095831f7fed61441475edd8c449"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "embedded-io"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef1a6892d9eef45c8fa6b9e0086428a2cca8491aca8f787c534a3d6d0bcb3ced"
+
+[[package]]
+name = "embedded-io"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "edd0f118536f44f5ccd48bcb8b111bdc3de888b58c74639dfb034a357d0f206d"
+
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "etcetera"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "136d1b5283a1ab77bd9257427ffd09d8667ced0570b6f938942bc7568ed5b943"
+dependencies = [
+ "cfg-if",
+ "home",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "event-listener"
+version = "5.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13b66accf52311f30a0db42147dadea9850cb48cd070028831ae5f5d4b856ab"
+dependencies = [
+ "concurrent-queue",
+ "parking",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "event-listener-strategy"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8be9f3dfaaffdae2972880079a491a1a8bb7cbed0b8dd7a347f668b4150a3b93"
+dependencies = [
+ "event-listener",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "executor"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "argon2",
+ "async-trait",
+ "axum",
+ "base64",
+ "chacha20poly1305",
+ "clap",
+ "directories",
+ "hkdf",
+ "hmac",
+ "http-body-util",
+ "ipnet",
+ "jsonschema",
+ "libc",
+ "oxc",
+ "percent-encoding",
+ "rand 0.8.6",
+ "reqwest",
+ "rmcp",
+ "rquickjs",
+ "serde",
+ "serde_json",
+ "serde_yaml",
+ "sha2",
+ "sqlx",
+ "subtle",
+ "tempfile",
+ "thiserror",
+ "tokio",
+ "tower",
+ "tracing",
+ "tracing-subscriber",
+ "url",
+ "uuid",
+]
+
+[[package]]
+name = "fancy-regex"
+version = "0.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1e1dacd0d2082dfcf1351c4bdd566bbe89a2b263235a2b50058f1e130a47277"
+dependencies = [
+ "bit-set",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "fastrand"
+version = "2.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6"
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
+
+[[package]]
+name = "flate2"
+version = "1.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide",
+]
+
+[[package]]
+name = "fluent-uri"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc74ac4d8359ae70623506d512209619e5cf8f347124910440dbc221714b328e"
+dependencies = [
+ "borrow-or-share",
+ "ref-cast",
+ "serde",
+]
+
+[[package]]
+name = "flume"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da0e4dd2a88388a1f4ccc7c9ce104604dab68d9f408dc34cd45823d5a9069095"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+ "spin",
+]
+
+[[package]]
+name = "foldhash"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
+
+[[package]]
+name = "foldhash"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "fraction"
+version = "0.15.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e076045bb43dac435333ed5f04caf35c7463631d0dae2deb2638d94dd0a5b872"
+dependencies = [
+ "lazy_static",
+ "num",
+]
+
+[[package]]
+name = "futures"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b147ee9d1f6d097cef9ce628cd2ee62288d963e16fb287bd9286455b241382d"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-io",
+ "futures-sink",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-channel"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d"
+
+[[package]]
+name = "futures-executor"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf29c38818342a3b26b5b923639e7b1f4a61fc5e76102d4b1981c6dc7a7579d"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-intrusive"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d930c203dd0b6ff06e0201a4a2fe9149b43c684fd4420555b26d21b1a02956f"
+dependencies = [
+ "futures-core",
+ "lock_api",
+ "parking_lot",
+]
+
+[[package]]
+name = "futures-io"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cecba35d7ad927e23624b22ad55235f2239cfa44fd10428eecbeba6d6a717718"
+
+[[package]]
+name = "futures-macro"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e835b70203e41293343137df5c0664546da5745f82ec9b84d40be8336958447b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "futures-sink"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c39754e157331b013978ec91992bde1ac089843443c49cbc7f46150b0fad0893"
+
+[[package]]
+name = "futures-task"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"
+
+[[package]]
+name = "futures-util"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-macro",
+ "futures-sink",
+ "futures-task",
+ "memchr",
+ "pin-project-lite",
+ "slab",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "wasi",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "r-efi 5.3.0",
+ "wasip2",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 6.0.0",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.15.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
+dependencies = [
+ "allocator-api2",
+ "equivalent",
+ "foldhash 0.1.5",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
+dependencies = [
+ "allocator-api2",
+ "equivalent",
+ "foldhash 0.2.0",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+dependencies = [
+ "allocator-api2",
+ "equivalent",
+ "foldhash 0.2.0",
+]
+
+[[package]]
+name = "hashlink"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7382cf6263419f2d8df38c55d7da83da5c18aef87fc7a7fc1fb1e344edfe14c1"
+dependencies = [
+ "hashbrown 0.15.5",
+]
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
+[[package]]
+name = "hkdf"
+version = "0.12.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7"
+dependencies = [
+ "hmac",
+]
+
+[[package]]
+name = "hmac"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
+dependencies = [
+ "digest",
+]
+
+[[package]]
+name = "hmac-sha1-compact"
+version = "1.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b0b3ba31f6dc772cc8221ce81dbbbd64fa1e668255a6737d95eeace59b5a8823"
+
+[[package]]
+name = "home"
+version = "0.5.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc627f471c528ff0c4a49e1d5e60450c8f6461dd6d10ba9dcd3a61d3dff7728d"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "http"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6970f50e31d6fc17d3fa27329444bfa74e196cf62e95052a3f6fee181dba6425"
+dependencies = [
+ "bytes",
+ "itoa",
+]
+
+[[package]]
+name = "http-body"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
+dependencies = [
+ "bytes",
+ "http",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "httparse"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+
+[[package]]
+name = "httpdate"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
+
+[[package]]
+name = "hyper"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "55281c53a1894c864990125767da440a4e630446785086f52523b20033b74498"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "http",
+ "http-body",
+ "httparse",
+ "httpdate",
+ "itoa",
+ "pin-project-lite",
+ "smallvec",
+ "tokio",
+ "want",
+]
+
+[[package]]
+name = "hyper-rustls"
+version = "0.27.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
+dependencies = [
+ "http",
+ "hyper",
+ "hyper-util",
+ "rustls",
+ "tokio",
+ "tokio-rustls",
+ "tower-service",
+ "webpki-roots 1.0.8",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
+dependencies = [
+ "base64",
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "http",
+ "http-body",
+ "hyper",
+ "ipnet",
+ "libc",
+ "percent-encoding",
+ "pin-project-lite",
+ "socket2",
+ "tokio",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "iana-time-zone"
+version = "0.1.65"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e31bc9ad994ba00e440a8aa5c9ef0ec67d5cb5e5cb0cc7f8b744a35b389cc470"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys",
+ "iana-time-zone-haiku",
+ "js-sys",
+ "log",
+ "wasm-bindgen",
+ "windows-core",
+]
+
+[[package]]
+name = "iana-time-zone-haiku"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "icu_collections"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c"
+dependencies = [
+ "displaydoc",
+ "potential_utf",
+ "utf8_iter",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_core"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4"
+dependencies = [
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38"
+
+[[package]]
+name = "icu_properties"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de"
+dependencies = [
+ "icu_collections",
+ "icu_locale_core",
+ "icu_properties_data",
+ "icu_provider",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14"
+
+[[package]]
+name = "icu_provider"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421"
+dependencies = [
+ "displaydoc",
+ "icu_locale_core",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "idna"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
+dependencies = [
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
+dependencies = [
+ "equivalent",
+ "hashbrown 0.17.1",
+]
+
+[[package]]
+name = "inout"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "ipnet"
+version = "2.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
+
+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
+
+[[package]]
+name = "itertools"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b192c782037fadd9cfa75548310488aabdbf3d2da73885b31bd0abd03351285"
+dependencies = [
+ "either",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "js-sys"
+version = "0.3.102"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "03d04c30968dffe80775bd4d7fb676131cd04a1fb46d2686dbffbaec2d9dfd31"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "json-escape-simd"
+version = "3.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35e770254dd7802184595b1d30da2a15cb72569e2aca2b177aef8d22eac8a693"
+
+[[package]]
+name = "jsonschema"
+version = "0.46.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8374249b1bdce1c1773a09fa294347e19e4bfeb86d845c2d8ebaf8a8dbf11233"
+dependencies = [
+ "ahash",
+ "bytecount",
+ "data-encoding",
+ "email_address",
+ "fancy-regex",
+ "fraction",
+ "getrandom 0.3.4",
+ "idna",
+ "itoa",
+ "num-cmp",
+ "num-traits",
+ "percent-encoding",
+ "referencing",
+ "regex",
+ "regex-syntax",
+ "serde",
+ "serde_json",
+ "unicode-general-category",
+ "uuid-simd",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+dependencies = [
+ "spin",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.186"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
+
+[[package]]
+name = "libm"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
+
+[[package]]
+name = "libredox"
+version = "0.1.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f02ab6bace2054fb888a3c16f990117b579d14a3088e472d63c6011fa185c9d3"
+dependencies = [
+ "bitflags",
+ "libc",
+ "plain",
+ "redox_syscall 0.8.1",
+]
+
+[[package]]
+name = "libsqlite3-sys"
+version = "0.30.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e99fb7a497b1e3339bc746195567ed8d3e24945ecd636e3619d20b9de9e9149"
+dependencies = [
+ "cc",
+ "pkg-config",
+ "vcpkg",
+]
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
+
+[[package]]
+name = "litemap"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
+
+[[package]]
+name = "lock_api"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "224399e74b87b5f3557511d98dff8b14089b3dadafcab6bb93eab67d3aace965"
+dependencies = [
+ "scopeguard",
+]
+
+[[package]]
+name = "log"
+version = "0.4.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
+
+[[package]]
+name = "lru-slab"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
+
+[[package]]
+name = "matchers"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1525a2a28c7f4fa0fc98bb91ae755d1e2d1505079e05539e35bc876b5d65ae9"
+dependencies = [
+ "regex-automata",
+]
+
+[[package]]
+name = "matchit"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3"
+
+[[package]]
+name = "md-5"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d89e7ee0cfbedfc4da3340218492196241d89eefb6dab27de5df917a6d2e78cf"
+dependencies = [
+ "cfg-if",
+ "digest",
+]
+
+[[package]]
+name = "memchr"
+version = "2.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88904434abc2901f197fe8cc55f0445e7ded921dba5911dad2e2b39b48e663c4"
+
+[[package]]
+name = "micromap"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2a86d3146ed3995b5913c414f6664344b9617457320782e64f0bb44afd49d74"
+
+[[package]]
+name = "mime"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
+
+[[package]]
+name = "miniz_oxide"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
+dependencies = [
+ "adler2",
+ "simd-adler32",
+]
+
+[[package]]
+name = "mio"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02bd0af71c67b473010cbbc60715ee815645a4dc942899111f494b4b737d6fda"
+dependencies = [
+ "libc",
+ "wasi",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "nonmax"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "610a5acd306ec67f907abe5567859a3c693fb9886eb1f012ab8f2a47bef3db51"
+
+[[package]]
+name = "nu-ansi-term"
+version = "0.50.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "num"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35bd024e8b2ff75562e5f34e7f4905839deb4b22955ef5e73d2fea1b9813cb23"
+dependencies = [
+ "num-bigint",
+ "num-complex",
+ "num-integer",
+ "num-iter",
+ "num-rational",
+ "num-traits",
+]
+
+[[package]]
+name = "num-bigint"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5e44f723f1133c9deac646763579fdb3ac745e418f2a7af9cd0c431da1f20b9"
+dependencies = [
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-bigint-dig"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e661dda6640fad38e827a6d4a310ff4763082116fe217f279885c97f511bb0b7"
+dependencies = [
+ "lazy_static",
+ "libm",
+ "num-integer",
+ "num-iter",
+ "num-traits",
+ "rand 0.8.6",
+ "smallvec",
+ "zeroize",
+]
+
+[[package]]
+name = "num-cmp"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63335b2e2c34fae2fb0aa2cecfd9f0832a1e24b3b32ecec612c3426d46dc8aaa"
+
+[[package]]
+name = "num-complex"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73f88a1307638156682bada9d7604135552957b7818057dcef22705b4d509495"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-integer"
+version = "0.1.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-iter"
+version = "0.1.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1429034a0490724d0075ebb2bc9e875d6503c3cf69e235a8941aa757d83ef5bf"
+dependencies = [
+ "autocfg",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-rational"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f83d14da390562dca69fc84082e73e548e1ad308d24accdedd2720017cb37824"
+dependencies = [
+ "num-bigint",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+ "libm",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "once_cell_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
+
+[[package]]
+name = "opaque-debug"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
+
+[[package]]
+name = "option-ext"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04744f49eae99ab78e0d5c0b603ab218f515ea8cfe5a456d7629ad883a3b6e7d"
+
+[[package]]
+name = "outref"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a80800c0488c3a21695ea981a54918fbb37abf04f4d0720c453632255e2ff0e"
+
+[[package]]
+name = "owo-colors"
+version = "4.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d211803b9b6b570f68772237e415a029d5a50c65d382910b879fb19d3271f94d"
+
+[[package]]
+name = "oxc"
+version = "0.137.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c837e177cfe9e45dc8b474b16565046b673e5e2e8c2a2aece798ff9a1e104602"
+dependencies = [
+ "oxc_allocator",
+ "oxc_ast",
+ "oxc_ast_visit",
+ "oxc_codegen",
+ "oxc_diagnostics",
+ "oxc_parser",
+ "oxc_semantic",
+ "oxc_span",
+ "oxc_syntax",
+ "oxc_transformer",
+ "oxc_transformer_plugins",
+]
+
+[[package]]
+name = "oxc-browserslist"
+version = "3.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b87743c2f6963036971ca587539cd9235693d953dc018a734014241afb20d5b"
+dependencies = [
+ "flate2",
+ "postcard",
+ "rustc-hash",
+ "serde",
+ "thiserror",
+]
+
+[[package]]
+name = "oxc-miette"
+version = "3.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b776084bf11ad750806cb63f9ed2606a12ab374cf458f36a7731eba1f5d753fc"
+dependencies = [
+ "cfg-if",
+ "owo-colors",
+ "oxc-miette-derive",
+ "textwrap",
+ "thiserror",
+ "unicode-segmentation",
+ "unicode-width",
+]
+
+[[package]]
+name = "oxc-miette-derive"
+version = "3.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "66e0bafc397eee2f94c5bf89bb5a82ba6d522d1b79e2924c8169f053febb433f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "oxc_allocator"
+version = "0.137.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b34ec71e68e73a0ed7d929e58ab2bb4f58752dea944c08f14ccc3b8272c77946"
+dependencies = [
+ "allocator-api2",
+ "hashbrown 0.17.1",
+ "oxc_data_structures",
+ "rustc-hash",
+]
+
+[[package]]
+name = "oxc_ast"
+version = "0.137.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa406c62bb247767a6a051be6ac3be7db6c4f818129ccae570da6ee9eb96ead0"
+dependencies = [
+ "bitflags",
+ "oxc_allocator",
+ "oxc_ast_macros",
+ "oxc_data_structures",
+ "oxc_diagnostics",
+ "oxc_estree",
+ "oxc_regular_expression",
+ "oxc_span",
+ "oxc_str",
+ "oxc_syntax",
+]
+
+[[package]]
+name = "oxc_ast_macros"
+version = "0.137.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3706e193b659865e03155a44e443f0447abf6789f9a3eb436ae10e557afab899"
+dependencies = [
+ "phf",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "oxc_ast_visit"
+version = "0.137.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5353724c6c835bfd37ed59db65ccd506b7721598bcbe4750eda165754d105463"
+dependencies = [
+ "oxc_allocator",
+ "oxc_ast",
+ "oxc_span",
+ "oxc_syntax",
+]
+
+[[package]]
+name = "oxc_codegen"
+version = "0.137.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d57d63987a27e8e67bc40518a4133b96ad2c0475f4735b8110e577a25680a09e"
+dependencies = [
+ "bitflags",
+ "cow-utils",
+ "dragonbox_ecma",
+ "itoa",
+ "oxc_allocator",
+ "oxc_ast",
+ "oxc_data_structures",
+ "oxc_index",
+ "oxc_semantic",
+ "oxc_sourcemap",
+ "oxc_span",
+ "oxc_str",
+ "oxc_syntax",
+ "rustc-hash",
+]
+
+[[package]]
+name = "oxc_compat"
+version = "0.137.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95a25f516a7f4c05f66da375d07b29a87fe0e6037c79374f409153cb9496f3e0"
+dependencies = [
+ "cow-utils",
+ "oxc-browserslist",
+ "oxc_syntax",
+ "rustc-hash",
+ "serde",
+]
+
+[[package]]
+name = "oxc_data_structures"
+version = "0.137.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fde9ca13ef89018fb4c18502cefb9668baac6066905d27a914c29fb5fae1c8ac"
+dependencies = [
+ "ropey",
+]
+
+[[package]]
+name = "oxc_diagnostics"
+version = "0.137.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2cbafa6cc3c38d72e35cd9337a38a4558e9fee4521fa5cabe321b90519e80aa"
+dependencies = [
+ "cow-utils",
+ "oxc-miette",
+ "percent-encoding",
+]
+
+[[package]]
+name = "oxc_ecmascript"
+version = "0.137.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f55408e4f458ec4b9cd842f67364e9395b28bdf2201c7755ed04d6707c1084ea"
+dependencies = [
+ "cow-utils",
+ "num-bigint",
+ "num-traits",
+ "oxc_allocator",
+ "oxc_ast",
+ "oxc_regular_expression",
+ "oxc_span",
+ "oxc_syntax",
+]
+
+[[package]]
+name = "oxc_estree"
+version = "0.137.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b6c062d52b9ff15d118b87679bdd0a05c43599c1d55fd1cab280da1cc822858"
+
+[[package]]
+name = "oxc_index"
+version = "5.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "191884bee6c3744909a51acc7d78d4ae370d817b25875b10642f632327b6296e"
+dependencies = [
+ "nonmax",
+ "serde",
+]
+
+[[package]]
+name = "oxc_parser"
+version = "0.137.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6efc796fc0c65a2a6bd40984b65b1052b5550b017af303f02b08794e304c14c8"
+dependencies = [
+ "bitflags",
+ "cow-utils",
+ "memchr",
+ "num-bigint",
+ "num-traits",
+ "oxc_allocator",
+ "oxc_ast",
+ "oxc_data_structures",
+ "oxc_diagnostics",
+ "oxc_ecmascript",
+ "oxc_regular_expression",
+ "oxc_span",
+ "oxc_str",
+ "oxc_syntax",
+ "rustc-hash",
+ "seq-macro",
+]
+
+[[package]]
+name = "oxc_regular_expression"
+version = "0.137.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e533f1345534dceaee6c2c7102e5f3d2e7466269199eca9abeb871e02a7496a4"
+dependencies = [
+ "bitflags",
+ "oxc_allocator",
+ "oxc_ast_macros",
+ "oxc_diagnostics",
+ "oxc_span",
+ "oxc_str",
+ "phf",
+ "rustc-hash",
+ "unicode-id-start",
+]
+
+[[package]]
+name = "oxc_semantic"
+version = "0.137.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de31d2015099e33ecdc23ad59730b768a141a0b2941d43970a26ba50de003e10"
+dependencies = [
+ "itertools",
+ "memchr",
+ "oxc_allocator",
+ "oxc_ast",
+ "oxc_ast_visit",
+ "oxc_data_structures",
+ "oxc_diagnostics",
+ "oxc_ecmascript",
+ "oxc_index",
+ "oxc_span",
+ "oxc_str",
+ "oxc_syntax",
+ "rustc-hash",
+ "self_cell",
+ "smallvec",
+]
+
+[[package]]
+name = "oxc_sourcemap"
+version = "8.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ac6db7d8c33f46a0b9ebb702c077364abcd6b64c3a3a97bb86b9f5b3554833c"
+dependencies = [
+ "base64-simd",
+ "json-escape-simd",
+ "rustc-hash",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "oxc_span"
+version = "0.137.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a5245fa99a7c9405d57e2d9666afc9fd01ac644e37aff1cb3e1cedd50c17915"
+dependencies = [
+ "compact_str",
+ "oxc-miette",
+ "oxc_allocator",
+ "oxc_ast_macros",
+ "oxc_estree",
+ "oxc_str",
+]
+
+[[package]]
+name = "oxc_str"
+version = "0.137.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53c61444d5681ce805fbbb5dc0498d980685a4c6a82dd57c2e17ff948041c1fb"
+dependencies = [
+ "compact_str",
+ "hashbrown 0.17.1",
+ "oxc_allocator",
+ "oxc_estree",
+]
+
+[[package]]
+name = "oxc_syntax"
+version = "0.137.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "296b94ecc1235a2b5ea2a47412d4bc573b7a25a93132a1a2f49c617d85b58995"
+dependencies = [
+ "bitflags",
+ "cow-utils",
+ "dragonbox_ecma",
+ "nonmax",
+ "oxc_allocator",
+ "oxc_ast_macros",
+ "oxc_estree",
+ "oxc_index",
+ "oxc_span",
+ "oxc_str",
+ "phf",
+ "unicode-id-start",
+]
+
+[[package]]
+name = "oxc_transformer"
+version = "0.137.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "494dcdb3e8c8dcb50e2ce3ba238030c9116a8b47b54f55c0f0211d68ae66b183"
+dependencies = [
+ "base64",
+ "compact_str",
+ "hmac-sha1-compact",
+ "indexmap",
+ "itoa",
+ "memchr",
+ "oxc_allocator",
+ "oxc_ast",
+ "oxc_ast_visit",
+ "oxc_compat",
+ "oxc_data_structures",
+ "oxc_diagnostics",
+ "oxc_ecmascript",
+ "oxc_regular_expression",
+ "oxc_semantic",
+ "oxc_span",
+ "oxc_str",
+ "oxc_syntax",
+ "oxc_traverse",
+ "rustc-hash",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "oxc_transformer_plugins"
+version = "0.137.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6ce80c16ee776e23a0bcb472153db9ec66c59b709fcdb63f43f7623cdfadce7"
+dependencies = [
+ "cow-utils",
+ "itoa",
+ "oxc_allocator",
+ "oxc_ast",
+ "oxc_ast_visit",
+ "oxc_diagnostics",
+ "oxc_ecmascript",
+ "oxc_parser",
+ "oxc_semantic",
+ "oxc_span",
+ "oxc_str",
+ "oxc_syntax",
+ "oxc_transformer",
+ "oxc_traverse",
+ "rustc-hash",
+]
+
+[[package]]
+name = "oxc_traverse"
+version = "0.137.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da52a3734ef3ad4c10ebb6f4e768f63ea1597677d53785e3ceb26d9735f5c1f8"
+dependencies = [
+ "itoa",
+ "oxc_allocator",
+ "oxc_ast",
+ "oxc_ast_visit",
+ "oxc_data_structures",
+ "oxc_ecmascript",
+ "oxc_semantic",
+ "oxc_span",
+ "oxc_str",
+ "oxc_syntax",
+ "rustc-hash",
+]
+
+[[package]]
+name = "parking"
+version = "2.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f38d5652c16fde515bb1ecef450ab0f6a219d619a7274976324d5e377f7dceba"
+
+[[package]]
+name = "parking_lot"
+version = "0.12.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a"
+dependencies = [
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.9.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall 0.5.18",
+ "smallvec",
+ "windows-link",
+]
+
+[[package]]
+name = "password-hash"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "346f04948ba92c43e8469c1ee6736c7563d71012b17d40745260fe106aac2166"
+dependencies = [
+ "base64ct",
+ "rand_core 0.6.4",
+ "subtle",
+]
+
+[[package]]
+name = "pem-rfc7468"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88b39c9bfcfc231068454382784bb460aae594343fb030d46e9f50a645418412"
+dependencies = [
+ "base64ct",
+]
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+
+[[package]]
+name = "phf"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1562dc717473dbaa4c1f85a36410e03c047b2e7df7f45ee938fbef64ae7fadf"
+dependencies = [
+ "phf_macros",
+ "phf_shared",
+ "serde",
+]
+
+[[package]]
+name = "phf_generator"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "135ace3a761e564ec88c03a77317a7c6b80bb7f7135ef2544dbe054243b89737"
+dependencies = [
+ "fastrand",
+ "phf_shared",
+]
+
+[[package]]
+name = "phf_macros"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "812f032b54b1e759ccd5f8b6677695d5268c588701effba24601f6932f8269ef"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "phf_shared"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e57fef6bc5981e38c2ce2d63bfa546861309f875b8a75f092d1d54ae2d64f266"
+dependencies = [
+ "siphasher",
+]
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
+
+[[package]]
+name = "pkcs1"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8ffb9f10fa047879315e6625af03c164b16962a5368d724ed16323b68ace47f"
+dependencies = [
+ "der",
+ "pkcs8",
+ "spki",
+]
+
+[[package]]
+name = "pkcs8"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
+dependencies = [
+ "der",
+ "spki",
+]
+
+[[package]]
+name = "pkg-config"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
+
+[[package]]
+name = "plain"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
+
+[[package]]
+name = "poly1305"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8159bd90725d2df49889a078b54f4f79e87f1f8a8444194cdca81d38f5393abf"
+dependencies = [
+ "cpufeatures",
+ "opaque-debug",
+ "universal-hash",
+]
+
+[[package]]
+name = "postcard"
+version = "1.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6764c3b5dd454e283a30e6dfe78e9b31096d9e32036b5d1eaac7a6119ccb9a24"
+dependencies = [
+ "cobs",
+ "embedded-io 0.4.0",
+ "embedded-io 0.6.1",
+ "serde",
+]
+
+[[package]]
+name = "potential_utf"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564"
+dependencies = [
+ "zerovec",
+]
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
+dependencies = [
+ "zerocopy",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quinn"
+version = "0.11.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c1a41e437b6bbd489372cd4971de128e85c855f56c57f283d20ff016cf7c0a8"
+dependencies = [
+ "bytes",
+ "cfg_aliases",
+ "pin-project-lite",
+ "quinn-proto",
+ "quinn-udp",
+ "rustc-hash",
+ "rustls",
+ "socket2",
+ "thiserror",
+ "tokio",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-proto"
+version = "0.11.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fcb935c5bec503c2f0e306bdd3e58bb9029dcb14fa8d9ac76e3a5256ac0763e"
+dependencies = [
+ "bytes",
+ "getrandom 0.3.4",
+ "lru-slab",
+ "rand 0.9.4",
+ "ring",
+ "rustc-hash",
+ "rustls",
+ "rustls-pki-types",
+ "slab",
+ "thiserror",
+ "tinyvec",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-udp"
+version = "0.5.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "addec6a0dcad8a8d96a771f815f0eaf55f9d1805756410b39f5fa81332574cbd"
+dependencies = [
+ "cfg_aliases",
+ "libc",
+ "once_cell",
+ "socket2",
+ "tracing",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dfbc457d0c7a0759a614551b11a6409e5951f6c7537be1f1b7682b9ae9230368"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "rand"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ca0ecfa931c29007047d1bc58e623ab12e5590e8c7cc53200d5202b69266d8a"
+dependencies = [
+ "libc",
+ "rand_chacha 0.3.1",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea"
+dependencies = [
+ "rand_chacha 0.9.0",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom 0.2.17",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
+dependencies = [
+ "getrandom 0.3.4",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.5.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b44b894f2a6e36457d665d1e08c3866add6ed5e70050c1b4ba8a8ddedb02ce7"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "redox_users"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4e608c6638b9c18977b00b475ac1f28d14e84b27d8d42f70e0bf1e3dec127ac"
+dependencies = [
+ "getrandom 0.2.17",
+ "libredox",
+ "thiserror",
+]
+
+[[package]]
+name = "ref-cast"
+version = "1.0.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f354300ae66f76f1c85c5f84693f0ce81d747e2c3f21a45fef496d89c960bf7d"
+dependencies = [
+ "ref-cast-impl",
+]
+
+[[package]]
+name = "ref-cast-impl"
+version = "1.0.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7186006dcb21920990093f30e3dea63b7d6e977bf1256be20c3563a5db070da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "referencing"
+version = "0.46.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "65a910f9d63351f9c9d7dc3053d02b214ea3a005917140c70087d7b59cbc5bb1"
+dependencies = [
+ "ahash",
+ "fluent-uri",
+ "getrandom 0.3.4",
+ "hashbrown 0.16.1",
+ "itoa",
+ "micromap",
+ "parking_lot",
+ "percent-encoding",
+ "serde_json",
+]
+
+[[package]]
+name = "regex"
+version = "1.12.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1292b7759ae1cb9ec195452d1390a074f0cd8541ab7a5a8c31cd6db45d4a6ba"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
+
+[[package]]
+name = "relative-path"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bca40a312222d8ba74837cb474edef44b37f561da5f773981007a10bbaa992b0"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "reqwest"
+version = "0.12.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
+dependencies = [
+ "base64",
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-rustls",
+ "hyper-util",
+ "js-sys",
+ "log",
+ "percent-encoding",
+ "pin-project-lite",
+ "quinn",
+ "rustls",
+ "rustls-pki-types",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "sync_wrapper",
+ "tokio",
+ "tokio-rustls",
+ "tower",
+ "tower-http",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+ "webpki-roots 1.0.8",
+]
+
+[[package]]
+name = "ring"
+version = "0.17.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom 0.2.17",
+ "libc",
+ "untrusted",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "rmcp"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d1f571c72940a19d9532fe52dbea8bc9912bf1d766c2970bb824056b86f3f59"
+dependencies = [
+ "async-trait",
+ "chrono",
+ "futures",
+ "pin-project-lite",
+ "serde",
+ "serde_json",
+ "thiserror",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
+[[package]]
+name = "ropey"
+version = "1.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93411e420bcd1a75ddd1dc3caf18c23155eda2c090631a85af21ba19e97093b5"
+dependencies = [
+ "smallvec",
+ "str_indices",
+]
+
+[[package]]
+name = "rquickjs"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0688f8b0192998cca685adefdfad3483da295fa40a0ec406b4c14ecd729e858"
+dependencies = [
+ "rquickjs-core",
+]
+
+[[package]]
+name = "rquickjs-core"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2fee8c5383f0cfda3b980a80ca4520e726e09b593c59562f579daa51b6c20411"
+dependencies = [
+ "async-lock",
+ "hashbrown 0.17.1",
+ "relative-path",
+ "rquickjs-sys",
+]
+
+[[package]]
+name = "rquickjs-sys"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "698077537c286a169de8693b216672bcef148bf2e2e112ebf50758c68e9afa09"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "rsa"
+version = "0.9.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8573f03f5883dcaebdfcf4725caa1ecb9c15b2ef50c43a07b816e06799bb12d"
+dependencies = [
+ "const-oid",
+ "digest",
+ "num-bigint-dig",
+ "num-integer",
+ "num-traits",
+ "pkcs1",
+ "pkcs8",
+ "rand_core 0.6.4",
+ "signature",
+ "spki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustc-hash"
+version = "2.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94300abf3f1ae2e2b8ffb7b58043de3d399c73fa6f4b73826402a5c457614dbe"
+
+[[package]]
+name = "rustix"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
+dependencies = [
+ "bitflags",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rustls"
+version = "0.23.41"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b92b125634d9b795e7beca796cc790df15a7fb38323bf3196fda83292d06b1f"
+dependencies = [
+ "once_cell",
+ "ring",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.14.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30a7197ae7eb376e574fe940d068c30fe0462554a3ddbe4eca7838e049c937a9"
+dependencies = [
+ "web-time",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-webpki"
+version = "0.103.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
+dependencies = [
+ "ring",
+ "rustls-pki-types",
+ "untrusted",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
+
+[[package]]
+name = "ryu"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
+
+[[package]]
+name = "scopeguard"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+
+[[package]]
+name = "self_cell"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b12e76d157a900eb52e81bc6e9f3069344290341720e9178cde2407113ac8d89"
+
+[[package]]
+name = "seq-macro"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bc711410fbe7399f390ca1c3b60ad0f53f80e95c5eb935e52268a0e2cd49acc"
+
+[[package]]
+name = "serde"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.150"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8014e44b4736ed0538adeecded0fce2a272f22dc9578a7eb6b2d9993c74cfb9"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "serde_path_to_error"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10a9ff822e371bb5403e391ecd83e182e0e77ba7f6fe0160b795797109d1b457"
+dependencies = [
+ "itoa",
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "serde_urlencoded"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
+dependencies = [
+ "form_urlencoded",
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "serde_yaml"
+version = "0.9.34+deprecated"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a8b1a1a2ebf674015cc02edccce75287f1a0130d394307b36743c2f5d504b47"
+dependencies = [
+ "indexmap",
+ "itoa",
+ "ryu",
+ "serde",
+ "unsafe-libyaml",
+]
+
+[[package]]
+name = "sha1"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "sharded-slab"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f40ca3c46823713e0d4209592e8d6e826aa57e928f09752619fc696c499637f6"
+dependencies = [
+ "lazy_static",
+]
+
+[[package]]
+name = "shlex"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
+
+[[package]]
+name = "signal-hook-registry"
+version = "1.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4db69cba1110affc0e9f7bcd48bbf87b3f4fc7c61fc9155afd4c469eb3d6c1b"
+dependencies = [
+ "errno",
+ "libc",
+]
+
+[[package]]
+name = "signature"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
+dependencies = [
+ "digest",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "simd-adler32"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "703d5c7ef118737c72f1af64ad2f6f8c5e1921f818cdcb97b8fe6fc69bf66214"
+
+[[package]]
+name = "siphasher"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ee5873ec9cce0195efcb7a4e9507a04cd49aec9c83d0389df45b1ef7ba2e649"
+
+[[package]]
+name = "slab"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
+
+[[package]]
+name = "smallvec"
+version = "1.15.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "smawk"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8e2fb0f499abb4d162f2bedad68f5ef91a1682b5a03596ddb67efd37768d100"
+
+[[package]]
+name = "socket2"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52d1cfed4120b4d927bf7c0f86d2087a4a7d6027c906d9f9d525a80573b9be51"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "spin"
+version = "0.9.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
+dependencies = [
+ "lock_api",
+]
+
+[[package]]
+name = "spki"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
+dependencies = [
+ "base64ct",
+ "der",
+]
+
+[[package]]
+name = "sqlx"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fefb893899429669dcdd979aff487bd78f4064e5e7907e4269081e0ef7d97dc"
+dependencies = [
+ "sqlx-core",
+ "sqlx-macros",
+ "sqlx-mysql",
+ "sqlx-postgres",
+ "sqlx-sqlite",
+]
+
+[[package]]
+name = "sqlx-core"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee6798b1838b6a0f69c007c133b8df5866302197e404e8b6ee8ed3e3a5e68dc6"
+dependencies = [
+ "base64",
+ "bytes",
+ "crc",
+ "crossbeam-queue",
+ "either",
+ "event-listener",
+ "futures-core",
+ "futures-intrusive",
+ "futures-io",
+ "futures-util",
+ "hashbrown 0.15.5",
+ "hashlink",
+ "indexmap",
+ "log",
+ "memchr",
+ "once_cell",
+ "percent-encoding",
+ "rustls",
+ "serde",
+ "serde_json",
+ "sha2",
+ "smallvec",
+ "thiserror",
+ "tokio",
+ "tokio-stream",
+ "tracing",
+ "url",
+ "webpki-roots 0.26.11",
+]
+
+[[package]]
+name = "sqlx-macros"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2d452988ccaacfbf5e0bdbc348fb91d7c8af5bee192173ac3636b5fb6e6715d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "sqlx-core",
+ "sqlx-macros-core",
+ "syn",
+]
+
+[[package]]
+name = "sqlx-macros-core"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19a9c1841124ac5a61741f96e1d9e2ec77424bf323962dd894bdb93f37d5219b"
+dependencies = [
+ "dotenvy",
+ "either",
+ "heck",
+ "hex",
+ "once_cell",
+ "proc-macro2",
+ "quote",
+ "serde",
+ "serde_json",
+ "sha2",
+ "sqlx-core",
+ "sqlx-sqlite",
+ "syn",
+ "tokio",
+ "url",
+]
+
+[[package]]
+name = "sqlx-mysql"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa003f0038df784eb8fecbbac13affe3da23b45194bd57dba231c8f48199c526"
+dependencies = [
+ "atoi",
+ "base64",
+ "bitflags",
+ "byteorder",
+ "bytes",
+ "crc",
+ "digest",
+ "dotenvy",
+ "either",
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-util",
+ "generic-array",
+ "hex",
+ "hkdf",
+ "hmac",
+ "itoa",
+ "log",
+ "md-5",
+ "memchr",
+ "once_cell",
+ "percent-encoding",
+ "rand 0.8.6",
+ "rsa",
+ "sha1",
+ "sha2",
+ "smallvec",
+ "sqlx-core",
+ "stringprep",
+ "thiserror",
+ "tracing",
+ "whoami",
+]
+
+[[package]]
+name = "sqlx-postgres"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db58fcd5a53cf07c184b154801ff91347e4c30d17a3562a635ff028ad5deda46"
+dependencies = [
+ "atoi",
+ "base64",
+ "bitflags",
+ "byteorder",
+ "crc",
+ "dotenvy",
+ "etcetera",
+ "futures-channel",
+ "futures-core",
+ "futures-util",
+ "hex",
+ "hkdf",
+ "hmac",
+ "home",
+ "itoa",
+ "log",
+ "md-5",
+ "memchr",
+ "once_cell",
+ "rand 0.8.6",
+ "serde",
+ "serde_json",
+ "sha2",
+ "smallvec",
+ "sqlx-core",
+ "stringprep",
+ "thiserror",
+ "tracing",
+ "whoami",
+]
+
+[[package]]
+name = "sqlx-sqlite"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2d12fe70b2c1b4401038055f90f151b78208de1f9f89a7dbfd41587a10c3eea"
+dependencies = [
+ "atoi",
+ "flume",
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-intrusive",
+ "futures-util",
+ "libsqlite3-sys",
+ "log",
+ "percent-encoding",
+ "serde",
+ "serde_urlencoded",
+ "sqlx-core",
+ "thiserror",
+ "tracing",
+ "url",
+]
+
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
+
+[[package]]
+name = "static_assertions"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
+
+[[package]]
+name = "str_indices"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d08889ec5408683408db66ad89e0e1f93dff55c73a4ccc71c427d5b277ee47e6"
+
+[[package]]
+name = "stringprep"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b4df3d392d81bd458a8a621b8bffbd2302a12ffe288a9d931670948749463b1"
+dependencies = [
+ "unicode-bidi",
+ "unicode-normalization",
+ "unicode-properties",
+]
+
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
+[[package]]
+name = "syn"
+version = "2.0.118"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b9ae57f904213ebb649ce6895b8a66c66f0203b9319718f69a5612a065b1422"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "sync_wrapper"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
+dependencies = [
+ "futures-core",
+]
+
+[[package]]
+name = "synstructure"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tempfile"
+version = "3.27.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
+dependencies = [
+ "fastrand",
+ "getrandom 0.4.3",
+ "once_cell",
+ "rustix",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "textwrap"
+version = "0.16.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c13547615a44dc9c452a8a534638acdf07120d4b6847c8178705da06306a3057"
+dependencies = [
+ "smawk",
+ "unicode-linebreak",
+ "unicode-width",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "thread_local"
+version = "1.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f60246a4944f24f6e018aa17cdeffb7818b76356965d03b07d6a9886e8962185"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "tinystr"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d"
+dependencies = [
+ "displaydoc",
+ "zerovec",
+]
+
+[[package]]
+name = "tinyvec"
+version = "1.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e61e67053d25a4e82c844e8424039d9745781b3fc4f32b8d55ed50f5f667ef3"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+
+[[package]]
+name = "tokio"
+version = "1.52.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fc7f01b389ac15039e4dc9531aa973a135d7a4135281b12d7c1bc79fd57fffe"
+dependencies = [
+ "bytes",
+ "libc",
+ "mio",
+ "pin-project-lite",
+ "signal-hook-registry",
+ "socket2",
+ "tokio-macros",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "tokio-macros"
+version = "2.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "385a6cb71ab9ab790c5fe8d67f1645e6c450a7ce006a33de03daa956cf70a496"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tokio-rustls"
+version = "0.26.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
+dependencies = [
+ "rustls",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-stream"
+version = "0.1.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32da49809aab5c3bc678af03902d4ccddea2a87d028d86392a4b1560c6906c70"
+dependencies = [
+ "futures-core",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-util"
+version = "0.7.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ae9cec805b01e8fc3fd2fe289f89149a9b66dd16786abd8b19cfa7b48cb0098"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "futures-sink",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "tower"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tokio",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tower-http"
+version = "0.6.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
+dependencies = [
+ "bitflags",
+ "bytes",
+ "futures-util",
+ "http",
+ "http-body",
+ "pin-project-lite",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "url",
+]
+
+[[package]]
+name = "tower-layer"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
+
+[[package]]
+name = "tower-service"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
+
+[[package]]
+name = "tracing"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
+dependencies = [
+ "log",
+ "pin-project-lite",
+ "tracing-attributes",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-attributes"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
+dependencies = [
+ "once_cell",
+ "valuable",
+]
+
+[[package]]
+name = "tracing-log"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee855f1f400bd0e5c02d150ae5de3840039a3f54b025156404e34c23c03f47c3"
+dependencies = [
+ "log",
+ "once_cell",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-subscriber"
+version = "0.3.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb7f578e5945fb242538965c2d0b04418d38ec25c79d160cd279bf0731c8d319"
+dependencies = [
+ "matchers",
+ "nu-ansi-term",
+ "once_cell",
+ "regex-automata",
+ "sharded-slab",
+ "smallvec",
+ "thread_local",
+ "tracing",
+ "tracing-core",
+ "tracing-log",
+]
+
+[[package]]
+name = "try-lock"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
+
+[[package]]
+name = "typenum"
+version = "1.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
+
+[[package]]
+name = "unicode-bidi"
+version = "0.3.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c1cb5db39152898a79168971543b1cb5020dff7fe43c8dc468b0885f5e29df5"
+
+[[package]]
+name = "unicode-general-category"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b993bddc193ae5bd0d623b49ec06ac3e9312875fdae725a975c51db1cc1677f"
+
+[[package]]
+name = "unicode-id-start"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81b79ad29b5e19de4260020f8919b443b2ef0277d242ce532ec7b7a2cc8b6007"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "unicode-linebreak"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b09c83c3c29d37506a3e260c08c03743a6bb66a9cd432c6934ab501a190571f"
+
+[[package]]
+name = "unicode-normalization"
+version = "0.1.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5fd4f6878c9cb28d874b009da9e8d183b5abc80117c40bbd187a1fde336be6e8"
+dependencies = [
+ "tinyvec",
+]
+
+[[package]]
+name = "unicode-properties"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7df058c713841ad818f1dc5d3fd88063241cc61f49f5fbea4b951e8cf5a8d71d"
+
+[[package]]
+name = "unicode-segmentation"
+version = "1.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6f5d3c3b1bf09027a88a6bc961fc00497d651009560b5463668dc81b0fa87a8"
+
+[[package]]
+name = "unicode-width"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
+
+[[package]]
+name = "universal-hash"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea"
+dependencies = [
+ "crypto-common",
+ "subtle",
+]
+
+[[package]]
+name = "unsafe-libyaml"
+version = "0.2.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "673aac59facbab8a9007c7f6108d11f63b603f7cabff99fabf650fea5c32b861"
+
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
+name = "url"
+version = "2.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+ "serde",
+]
+
+[[package]]
+name = "utf8_iter"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+
+[[package]]
+name = "utf8parse"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
+
+[[package]]
+name = "uuid"
+version = "1.23.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "144d6b123cef80b301b8f72a9e2ca4370ddec21950d0a103dd22c437006d2db7"
+dependencies = [
+ "getrandom 0.4.3",
+ "js-sys",
+ "serde_core",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "uuid-simd"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23b082222b4f6619906941c17eb2297fff4c2fb96cb60164170522942a200bd8"
+dependencies = [
+ "outref",
+ "vsimd",
+]
+
+[[package]]
+name = "valuable"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
+
+[[package]]
+name = "vcpkg"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "vsimd"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c3082ca00d5a5ef149bb8b555a72ae84c9c59f7250f013ac822ac2e49b19c64"
+
+[[package]]
+name = "want"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
+dependencies = [
+ "try-lock",
+]
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "wasip2"
+version = "1.0.4+wasi-0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b67efb37e106e55ce722a510d6b5f9c17f083e5fc79afc2badeb12cc313d9487"
+dependencies = [
+ "wit-bindgen",
+]
+
+[[package]]
+name = "wasite"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8dad83b4f25e74f184f64c43b150b91efe7647395b42289f38e50566d82855b"
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.125"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ddb3f79143bced6de84270411622a2699cee572fc0875aeaf1e7867cf9fca1a"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "rustversion",
+ "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-futures"
+version = "0.4.75"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "503b14d284f2c8dac03b819967e155ea753f573586193b2b2c95990cb5d69280"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.125"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e21a184b13fb19e157296e2c46056aec9092264fab83e4ba59e68c61b323c3d"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.125"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fecefd9c35bd935a20fc3fc344b5f29138961e4f47fb03297d88f2587afb5ebd"
+dependencies = [
+ "bumpalo",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.125"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23939e44bb9a5d7576fa2b563dc2e136628f1224e88a8deed09e04858b77871f"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "web-sys"
+version = "0.3.102"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6430a72df5eb332242960fe84b3002a241163998241eb596d4f739b9757061d"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "web-time"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "webpki-roots"
+version = "0.26.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9"
+dependencies = [
+ "webpki-roots 1.0.8",
+]
+
+[[package]]
+name = "webpki-roots"
+version = "1.0.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf85cb06032201fa7c6f829d7db5a7e5aa45bcc0655327713065f6f0576731bf"
+dependencies = [
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "whoami"
+version = "1.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d4a4db5077702ca3015d3d02d74974948aba2ad9e12ab7df718ee64ccd7e97d"
+dependencies = [
+ "libredox",
+ "wasite",
+]
+
+[[package]]
+name = "windows-core"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
+dependencies = [
+ "windows-implement",
+ "windows-interface",
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
+[[package]]
+name = "windows-implement"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "windows-interface"
+version = "0.59.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-result"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
+dependencies = [
+ "windows-targets 0.48.5",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
+dependencies = [
+ "windows_aarch64_gnullvm 0.48.5",
+ "windows_aarch64_msvc 0.48.5",
+ "windows_i686_gnu 0.48.5",
+ "windows_i686_msvc 0.48.5",
+ "windows_x86_64_gnu 0.48.5",
+ "windows_x86_64_gnullvm 0.48.5",
+ "windows_x86_64_msvc 0.48.5",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm 0.52.6",
+ "windows_aarch64_msvc 0.52.6",
+ "windows_i686_gnu 0.52.6",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc 0.52.6",
+ "windows_x86_64_gnu 0.52.6",
+ "windows_x86_64_gnullvm 0.52.6",
+ "windows_x86_64_msvc 0.52.6",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "wit-bindgen"
+version = "0.57.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
+
+[[package]]
+name = "writeable"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
+
+[[package]]
+name = "yoke"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5"
+dependencies = [
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.8.52"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce1022995ff5ff5d841ad7d994facc23098cd40152f2c1d11cd607c6f530653f"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.8.52"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ae7f38b72ec2a254e2b87ef277cf2cd4fb97cbebf944faa6f33354da0867930"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "zerofrom"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
+[[package]]
+name = "zeroize"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
+
+[[package]]
+name = "zerotrie"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+]
+
+[[package]]
+name = "zerovec"
+version = "0.11.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239"
+dependencies = [
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "zmij"
+version = "1.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
diff --git a/Cargo.toml b/Cargo.toml
new file mode 100644
index 000000000..c033263c7
--- /dev/null
+++ b/Cargo.toml
@@ -0,0 +1,70 @@
+[package]
+name = "executor"
+version = "0.1.0"
+edition = "2024"
+rust-version = "1.96"
+license = "MIT"
+build = "build.rs"
+
+[dependencies]
+anyhow = "1"
+argon2 = "0.5"
+async-trait = "0.1"
+axum = "0.8"
+base64 = "0.22"
+chacha20poly1305 = "0.10"
+clap = { version = "4", features = ["derive", "env"] }
+directories = "6"
+hkdf = "0.12"
+hmac = "0.12"
+ipnet = "2.12.0"
+jsonschema = { version = "0.46.6", default-features = false }
+libc = "0.2"
+oxc = { version = "=0.137.0", default-features = false, features = [
+  "semantic",
+  "transformer",
+  "codegen",
+  "ast_visit",
+] }
+percent-encoding = "2"
+rand = "0.8.5"
+reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "json"] }
+rmcp = { version = "=1.8.0", default-features = false }
+rquickjs = { version = "=0.12.0", default-features = false, features = ["std", "futures"] }
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+serde_yaml = "0.9"
+sha2 = "0.10"
+sqlx = { version = "0.8", default-features = false, features = [
+  "runtime-tokio-rustls",
+  "sqlite",
+  "migrate",
+  "macros",
+] }
+subtle = "2"
+thiserror = "2"
+tokio = { version = "1", features = [
+  "macros",
+  "rt-multi-thread",
+  "net",
+  "signal",
+  "time",
+  "fs",
+  "sync",
+  "process",
+  "io-util",
+  "io-std",
+] }
+tracing = "0.1"
+tracing-subscriber = { version = "0.3", features = ["env-filter"] }
+url = "2"
+uuid = { version = "1", features = ["v4", "serde"] }
+
+[dev-dependencies]
+http-body-util = "0.1"
+tempfile = "3"
+tower = { version = "0.5", features = ["util"] }
+
+[build-dependencies]
+base64 = "0.22"
+sha2 = "0.10"
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 000000000..6b1d975b8
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,125 @@
+# syntax=docker/dockerfile:1.7@sha256:a57df69d0ea827fb7266491f2813635de6f17269be881f696fbfdf2d83dda33e
+
+ARG SOURCE_DATE_EPOCH
+
+FROM oven/bun:1.3.11@sha256:0733e50325078969732ebe3b15ce4c4be5082f18c4ac1a0f0ca4839c2e4e42a7 AS web-builder
+
+ARG TARGETARCH
+
+WORKDIR /build
+
+COPY package.json bun.lock ./
+COPY patches ./patches
+COPY apps ./apps
+COPY e2e ./e2e
+COPY examples ./examples
+COPY legacy ./legacy
+COPY packages ./packages
+COPY web/package.json ./web/package.json
+
+RUN --mount=type=cache,id=executor-bun-${TARGETARCH},target=/root/.bun/install/cache,sharing=locked \
+    bun install --frozen-lockfile --ignore-scripts --filter @executor-js/web
+
+COPY web ./web
+RUN bun run --cwd web build
+
+
+FROM rust:1.96-bookworm@sha256:6d19f49541d185805745b8baa781b1fd482118c81a3154510ee18dcce985d005 AS rust-builder
+
+ARG TARGETARCH
+
+WORKDIR /build
+
+COPY Cargo.toml Cargo.lock build.rs LICENSE about.toml about.hbs ./
+COPY migrations ./migrations
+COPY packaging/launchd/bounded-log.sh ./packaging/launchd/bounded-log.sh
+COPY packaging/launchd/dev.executor.gateway.plist ./packaging/launchd/dev.executor.gateway.plist
+COPY packaging/systemd/executor.env.example ./packaging/systemd/executor.env.example
+COPY packaging/systemd/executor.service ./packaging/systemd/executor.service
+COPY scripts/install-launchd.sh ./scripts/install-launchd.sh
+COPY scripts/install-systemd.sh ./scripts/install-systemd.sh
+COPY scripts/lib/install-systemd-master-key.sh ./scripts/lib/install-systemd-master-key.sh
+COPY src ./src
+COPY --from=web-builder /build/web/build ./web/build
+
+RUN --mount=type=cache,id=executor-cargo-registry-${TARGETARCH},target=/usr/local/cargo/registry,sharing=locked \
+    --mount=type=cache,id=executor-cargo-target-${TARGETARCH},target=/build/target,sharing=locked \
+    cargo install cargo-about --version 0.9.0 --locked --features cli && \
+    cargo about generate about.hbs > THIRD_PARTY_LICENSES.html && \
+    cargo build --locked --release && \
+    cp target/release/executor /usr/local/bin/executor
+
+
+FROM debian:bookworm-20260623-slim@sha256:60eac759739651111db372c07be67863818726f754804b8707c90979bda511df AS runtime-base
+
+ARG SOURCE_DATE_EPOCH
+ARG DEBIAN_SNAPSHOT=20260623T000000Z
+ARG EXECUTOR_UID=10001
+ARG EXECUTOR_GID=10001
+
+RUN printf '%s\n' \
+      'Types: deb' \
+      "URIs: http://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT}" \
+      'Suites: bookworm bookworm-updates' \
+      'Components: main' \
+      'Check-Valid-Until: no' \
+      '' \
+      'Types: deb' \
+      "URIs: http://snapshot.debian.org/archive/debian-security/${DEBIAN_SNAPSHOT}" \
+      'Suites: bookworm-security' \
+      'Components: main' \
+      'Check-Valid-Until: no' \
+      > /etc/apt/sources.list.d/debian.sources && \
+    apt-get update && \
+    apt-get install --yes --no-install-recommends ca-certificates curl && \
+    rm -rf \
+      /var/cache/ldconfig/aux-cache \
+      /var/lib/apt/lists/* \
+      /var/log/apt/* \
+      /var/log/dpkg.log && \
+    groupadd --gid "${EXECUTOR_GID}" executor && \
+    useradd --uid "${EXECUTOR_UID}" --gid executor --no-create-home \
+      --home-dir /var/lib/executor --shell /usr/sbin/nologin executor && \
+    chage --lastday \
+      "$(date --utc --date="@${SOURCE_DATE_EPOCH:-0}" +%Y-%m-%d)" \
+      executor && \
+    install --directory --owner executor --group executor --mode 0700 \
+      /var/lib/executor && \
+    install --directory --owner root --group executor --mode 0750 \
+      /etc/executor
+
+ENV EXECUTOR_DATA_DIR=/var/lib/executor \
+    EXECUTOR_PUBLIC_ORIGIN=http://127.0.0.1:4788 \
+    RUST_LOG=executor=info
+
+USER executor:executor
+WORKDIR /var/lib/executor
+
+EXPOSE 4788
+VOLUME ["/var/lib/executor"]
+STOPSIGNAL SIGTERM
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+  CMD ["curl", "--fail", "--silent", "--show-error", "http://127.0.0.1:4788/healthz"]
+
+ENTRYPOINT ["/usr/local/bin/executor"]
+CMD ["server", "--bind", "0.0.0.0:4788", "--allow-unsafe-http-non-loopback"]
+
+
+# Release automation supplies the extracted Linux archive as the named
+# prebuilt-executor context. This target never compiles web or Rust code.
+FROM runtime-base AS runtime-prebuilt
+
+COPY --from=prebuilt-executor --chmod=0755 /executor /usr/local/bin/executor
+COPY --from=prebuilt-executor --chmod=0644 /LICENSE /usr/share/licenses/executor/LICENSE
+COPY --from=prebuilt-executor --chmod=0644 /THIRD_PARTY_LICENSES.html /usr/share/licenses/executor/THIRD_PARTY_LICENSES.html
+COPY --from=prebuilt-executor --chmod=0644 /THIRD_PARTY_JAVASCRIPT_LICENSES.json /usr/share/licenses/executor/THIRD_PARTY_JAVASCRIPT_LICENSES.json
+
+
+# Keep the default target self-contained for local and CI builds.
+FROM runtime-base AS runtime
+
+COPY --from=rust-builder /usr/local/bin/executor /usr/local/bin/executor
+COPY --from=rust-builder /build/LICENSE /usr/share/licenses/executor/LICENSE
+COPY --from=rust-builder /build/THIRD_PARTY_LICENSES.html /usr/share/licenses/executor/THIRD_PARTY_LICENSES.html
+COPY --from=rust-builder /build/web/build/THIRD_PARTY_JAVASCRIPT_LICENSES.json /usr/share/licenses/executor/THIRD_PARTY_JAVASCRIPT_LICENSES.json
diff --git a/Dockerfile.dockerignore b/Dockerfile.dockerignore
new file mode 100644
index 000000000..d314f70d4
--- /dev/null
+++ b/Dockerfile.dockerignore
@@ -0,0 +1,69 @@
+**
+
+!Dockerfile
+!Cargo.toml
+!Cargo.lock
+!build.rs
+!package.json
+!bun.lock
+!LICENSE
+!about.toml
+!about.hbs
+
+# Bun validates the complete workspace graph during a frozen filtered install.
+# Keep these roots manifest-only so application source changes do not invalidate
+# the dependency layer.
+!apps
+apps/**
+!apps/*/package.json
+
+!e2e
+e2e/**
+!e2e/package.json
+
+!examples
+examples/**
+!examples/*/package.json
+
+!legacy
+legacy/**
+!legacy/*/package.json
+
+!packages
+packages/**
+!packages/*/*/package.json
+!packages/app/package.json
+!packages/react/package.json
+
+!migrations
+!migrations/**
+!packaging
+packaging/**
+!packaging/launchd
+!packaging/launchd/bounded-log.sh
+!packaging/launchd/dev.executor.gateway.plist
+!packaging/systemd
+!packaging/systemd/executor.env.example
+!packaging/systemd/executor.service
+!patches
+!patches/**
+!scripts
+scripts/**
+!scripts/install-launchd.sh
+!scripts/install-systemd.sh
+!scripts/package-release-archive.py
+!scripts/lib
+!scripts/lib/install-systemd-master-key.sh
+!src
+!src/**
+!web
+!web/**
+
+web/build
+web/.svelte-kit
+web/node_modules
+web/**/.env*
+web/**/*.key
+web/**/*.pem
+web/**/*.db*
+web/**/*secret*
diff --git a/Dockerfile.release-native b/Dockerfile.release-native
new file mode 100644
index 000000000..f1a81320f
--- /dev/null
+++ b/Dockerfile.release-native
@@ -0,0 +1,79 @@
+# syntax=docker/dockerfile:1.7@sha256:a57df69d0ea827fb7266491f2813635de6f17269be881f696fbfdf2d83dda33e
+
+ARG SOURCE_DATE_EPOCH
+
+FROM ubuntu:22.04@sha256:4f838adc7181d9039ac795a7d0aba05a9bd9ecd480d294483169c5def983b64d AS builder
+
+ARG RUST_TARGET
+ARG RUST_VERSION=1.96.0
+ARG SOURCE_DATE_EPOCH
+ARG TARGETARCH
+ARG UBUNTU_SNAPSHOT=20260623T000000Z
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN sed -i -E \
+      "s|^deb |deb [snapshot=${UBUNTU_SNAPSHOT}] |" \
+      /etc/apt/sources.list && \
+    apt-get -o Acquire::Check-Valid-Until=false update && \
+    apt-get -o APT::Get::Always-Include-Phased-Updates=true install \
+      --yes --no-install-recommends \
+      build-essential \
+      ca-certificates \
+      curl \
+      pkg-config \
+      xz-utils && \
+    rm -rf \
+      /var/cache/ldconfig/aux-cache \
+      /var/lib/apt/lists/* \
+      /var/log/apt/* \
+      /var/log/dpkg.log
+
+RUN case "$TARGETARCH" in \
+      amd64) \
+        expected_target=x86_64-unknown-linux-gnu; \
+        checksum=c295047583a56238ea06b43f849f4b877fa12bfd4c7103f8d9a74c94c9c4e108 \
+        ;; \
+      arm64) \
+        expected_target=aarch64-unknown-linux-gnu; \
+        checksum=371eadcca97062219cbd8593628eb5d2802bc370515d085fedce1b56b2baed57 \
+        ;; \
+      *) \
+        echo "Unsupported release architecture: $TARGETARCH" >&2; \
+        exit 1 \
+        ;; \
+    esac && \
+    test "$RUST_TARGET" = "$expected_target" && \
+    archive="rust-${RUST_VERSION}-${RUST_TARGET}.tar.xz" && \
+    curl --fail --location --proto '=https' --proto-redir '=https' --tlsv1.2 \
+      --max-filesize 268435456 \
+      --output "/tmp/$archive" \
+      "https://static.rust-lang.org/dist/$archive" && \
+    printf '%s  %s\n' "$checksum" "/tmp/$archive" | sha256sum --check - && \
+    tar -xJf "/tmp/$archive" -C /tmp && \
+    "/tmp/rust-${RUST_VERSION}-${RUST_TARGET}/install.sh" \
+      --prefix=/usr/local \
+      --disable-ldconfig && \
+    rm -rf "/tmp/$archive" "/tmp/rust-${RUST_VERSION}-${RUST_TARGET}"
+
+WORKDIR /build
+
+COPY Cargo.toml Cargo.lock build.rs ./
+COPY migrations ./migrations
+COPY packaging/launchd/bounded-log.sh ./packaging/launchd/bounded-log.sh
+COPY packaging/launchd/dev.executor.gateway.plist ./packaging/launchd/dev.executor.gateway.plist
+COPY packaging/systemd/executor.env.example ./packaging/systemd/executor.env.example
+COPY packaging/systemd/executor.service ./packaging/systemd/executor.service
+COPY scripts/install-launchd.sh ./scripts/install-launchd.sh
+COPY scripts/install-systemd.sh ./scripts/install-systemd.sh
+COPY scripts/lib/install-systemd-master-key.sh ./scripts/lib/install-systemd-master-key.sh
+COPY src ./src
+COPY --from=release-web / ./web/build
+
+RUN cargo build --locked --release --target "$RUST_TARGET"
+
+FROM scratch AS artifact
+
+ARG RUST_TARGET
+
+COPY --from=builder "/build/target/${RUST_TARGET}/release/executor" /executor
diff --git a/Dockerfile.release-package b/Dockerfile.release-package
new file mode 100644
index 000000000..3a897fa55
--- /dev/null
+++ b/Dockerfile.release-package
@@ -0,0 +1,83 @@
+# syntax=docker/dockerfile:1.7@sha256:a57df69d0ea827fb7266491f2813635de6f17269be881f696fbfdf2d83dda33e
+
+FROM ubuntu:22.04@sha256:4f838adc7181d9039ac795a7d0aba05a9bd9ecd480d294483169c5def983b64d AS packager
+
+ARG SOURCE_DATE_EPOCH
+ARG BUILDKIT_IMAGE
+ARG BUILDX_VERSION
+ARG MACOS_BUILD_CLANG_VERSION
+ARG MACOS_BUILD_LD_VERSION
+ARG MACOS_BUILD_SDK_VERSION
+ARG MACOS_BUILD_XCODE_BUILD
+ARG MACOS_BUILD_XCODE_VERSION
+ARG MACOS_FLOOR_CLANG_VERSION
+ARG MACOS_FLOOR_LD_VERSION
+ARG MACOS_FLOOR_SDK_VERSION
+ARG MACOS_FLOOR_XCODE_BUILD
+ARG MACOS_FLOOR_XCODE_VERSION
+ARG REPRODUCIBILITY_RUN
+ARG UBUNTU_SNAPSHOT=20260623T000000Z
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN sed -i -E \
+      "s|^deb |deb [snapshot=${UBUNTU_SNAPSHOT}] |" \
+      /etc/apt/sources.list && \
+    apt-get -o Acquire::Check-Valid-Until=false update && \
+    apt-get -o APT::Get::Always-Include-Phased-Updates=true install \
+      --yes --no-install-recommends \
+      python3-minimal && \
+    rm -rf \
+      /var/cache/ldconfig/aux-cache \
+      /var/lib/apt/lists/* \
+      /var/log/apt/* \
+      /var/log/dpkg.log
+
+COPY scripts/package-release-archive.py /usr/local/bin/package-release-archive.py
+COPY --from=release-inputs / /release-inputs
+
+RUN set -eux; \
+    test -n "$SOURCE_DATE_EPOCH"; \
+    test -n "$REPRODUCIBILITY_RUN"; \
+    mkdir -p /output /staging; \
+    { \
+      printf 'buildx=%s\n' "$BUILDX_VERSION"; \
+      printf 'buildkit=%s\n' "$BUILDKIT_IMAGE"; \
+      printf 'macos-release-xcode=%s (%s)\n' "$MACOS_BUILD_XCODE_VERSION" "$MACOS_BUILD_XCODE_BUILD"; \
+      printf 'macos-release-sdk=%s\n' "$MACOS_BUILD_SDK_VERSION"; \
+      printf 'macos-release-clang=%s\n' "$MACOS_BUILD_CLANG_VERSION"; \
+      printf 'macos-release-ld=%s\n' "$MACOS_BUILD_LD_VERSION"; \
+      printf 'macos-floor-xcode=%s (%s)\n' "$MACOS_FLOOR_XCODE_VERSION" "$MACOS_FLOOR_XCODE_BUILD"; \
+      printf 'macos-floor-sdk=%s\n' "$MACOS_FLOOR_SDK_VERSION"; \
+      printf 'macos-floor-clang=%s\n' "$MACOS_FLOOR_CLANG_VERSION"; \
+      printf 'macos-floor-ld=%s\n' "$MACOS_FLOOR_LD_VERSION"; \
+      printf 'ubuntu-packager=22.04@sha256:4f838adc7181d9039ac795a7d0aba05a9bd9ecd480d294483169c5def983b64d\n'; \
+      printf 'ubuntu-snapshot=%s\n' "$UBUNTU_SNAPSHOT"; \
+      python3 -c 'import sys, zlib; print(f"python={sys.version.split()[0]}"); print(f"zlib-build={zlib.ZLIB_VERSION}"); print(f"zlib-runtime={zlib.ZLIB_RUNTIME_VERSION}")'; \
+    } > /output/BUILD-TOOLCHAINS.txt; \
+    for target in \
+      aarch64-apple-darwin \
+      aarch64-unknown-linux-gnu \
+      x86_64-apple-darwin \
+      x86_64-unknown-linux-gnu; do \
+        stage="/staging/$target"; \
+        archive="executor-${target}.tar.gz"; \
+        mkdir "$stage"; \
+        install -m 0755 "/release-inputs/native/$target/executor" "$stage/executor"; \
+        install -m 0644 /release-inputs/LICENSE "$stage/LICENSE"; \
+        install -m 0644 \
+          /release-inputs/THIRD_PARTY_LICENSES.html \
+          "$stage/THIRD_PARTY_LICENSES.html"; \
+        install -m 0644 \
+          /release-inputs/THIRD_PARTY_JAVASCRIPT_LICENSES.json \
+          "$stage/THIRD_PARTY_JAVASCRIPT_LICENSES.json"; \
+        python3 /usr/local/bin/package-release-archive.py \
+          --source "$stage" \
+          --output "/output/$archive" \
+          --epoch "$SOURCE_DATE_EPOCH"; \
+        (cd /output && sha256sum "$archive" > "$archive.sha256"); \
+    done
+
+FROM scratch AS artifacts
+
+COPY --from=packager /output/ /
diff --git a/README.md b/README.md
index 5eabe62c6..75ef7229b 100644
--- a/README.md
+++ b/README.md
@@ -1,184 +1,191 @@
-# executor
+# Executor
 
-[https://github.com/user-attachments/assets/11225f83-e848-42ba-99b2-a993bcc88dad](https://github.com/user-attachments/assets/11225f83-e848-42ba-99b2-a993bcc88dad)
+Executor is a single-user, self-hosted tool gateway for AI agents. One Rust
+binary serves the Svelte dashboard, stores state in SQLite, exposes an MCP
+endpoint, and runs concurrent TypeScript tool workflows in isolated QuickJS
+workers.
 
-The integration layer for AI agents. One catalog for every tool, shared across every agent you use.
+The active product supports:
 
-[Ask DeepWiki](https://deepwiki.com/RhysSullivan/executor)
+- OpenAPI, GraphQL, and MCP sources
+- API key, bearer, basic, manual OAuth token, and managed OAuth credentials
+- one global tool catalog with Enabled, Ask, and Disabled modes
+- interactive approval for sensitive calls
+- a stateful Streamable HTTP MCP endpoint and a local stdio bridge
+- native Linux and macOS binaries, plus Docker
 
-## Quick start
+Windows is not a release target. The previous TypeScript CLI, local app,
+hosted deployments, managed cloud, and Electron products are archived in
+[`legacy/`](legacy/README.md).
 
-```bash
-npm install -g executor
-executor install
-executor web
-```
-
-This installs the local background service and opens the web UI. From there, add your first source and start using tools.
+`Cargo.toml` is the native product version source. Published releases provide
+four checksum-verified Linux and macOS archives plus the multi-platform
+`ghcr.io/<repository-owner>/executor` image. See [installation](docs/install.md)
+and [release operations](RELEASING.md).
 
-### Use as an MCP server
+## Try it from this checkout
 
-Point any MCP-compatible agent (Cursor, Claude Code, OpenCode, etc.) at Executor to share your tool catalog, auth, and policies across all of them.
+The production binary embeds the dashboard, so the web build must run before
+the release Cargo build. From the repository root:
 
-```bash
+```sh
+bun run bootstrap
+bun run --cwd web build
+cargo build --locked --release
 
-executor mcp
+mkdir -p .executor-local/data
+chmod 0700 .executor-local/data
+./target/release/executor server --data-dir "$PWD/.executor-local/data"
 ```
 
-Example `mcp.json` for Claude Code / Cursor:
-
-```json
-{
-  "mcpServers": {
-    "executor": {
-      "command": "executor",
-      "args": ["mcp"]
-    }
-  }
-}
-```
+This checkout expects Bun 1.3.x and Rust 1.96 or newer. The release workflow
+currently pins Bun 1.3.11 and Rust 1.96.0.
 
-### Use with Pi
+Executor listens at `http://127.0.0.1:4788` by default. Open the one-time
+`/setup#token=...` URL printed by the server and create the only administrator
+account with a password of at least 12 characters. The dashboard then signs in
+with those credentials. Open **API tokens** and create a token for your client.
+The token secret is shown once.
 
-[Pi](https://pi.dev) does not include a built-in MCP client. To use Executor from Pi, install the community bridge:
+On WSL2, paste the setup URL into the Windows browser. You can also open the
+dashboard from the WSL shell after setup:
 
-```bash
-pi install git:github.com/gvkhosla/pi-executor-mcp@v0.2.0
+```sh
+/mnt/c/windows/explorer.exe http://127.0.0.1:4788
 ```
 
-Reload Pi, then verify the bridge:
+State is under `.executor-local/data` in this example. Stop the server before
+copying that directory for backup, and keep `executor.db`, its WAL files, and
+`master.key` together.
 
-```text
-/reload
-/executor-status
-```
-
-After that, ask Pi to search, inspect, and call tools through Executor.
-
-## Add a source
-
-If you can represent it with a JSON schema, it can be an integration. Executor has first-party support for OpenAPI, GraphQL, MCP, and Google Discovery — but the plugin system is open to any source type.
-
-### Via the web UI
+## Connect sources
 
-Run `executor web`, go to **Add Source**, paste a URL, and Executor will detect the type, index the tools, and handle auth.
+Open **Sources**, choose a connector, and follow the preview or connection
+flow:
 
-### Via the CLI
+- OpenAPI accepts a URL or pasted OpenAPI 3.0/3.1 JSON or YAML.
+- GraphQL connects to an introspection-enabled endpoint.
+- MCP Streamable HTTP connects to a remote or local HTTP MCP endpoint.
+- MCP stdio selects only a machine-admin-approved command template.
 
-```bash
-executor call executor openapi addSource '{
-  "spec": "https://petstore3.swagger.io/api/v3/openapi.json",
-  "namespace": "petstore",
-  "baseUrl": "https://petstore3.swagger.io/api/v3"
-}'
-```
-
-Use `baseUrl` when the OpenAPI document has relative `servers` entries (for example `"/api/v3"`).
+After import, review each source under **Tools**. GraphQL queries start Enabled,
+mutations start Ask, and deprecated operations start Disabled. MCP tools are
+Enabled only when the upstream explicitly marks them read-only and not
+destructive. Other MCP tools start Ask.
 
-## Use tools
+See [source and OAuth setup](docs/sources.md) and the detailed
+[MCP contract](docs/mcp.md).
 
-Agents discover and call tools through a typed TypeScript runtime:
+## Use the CLI
 
-```ts
-// discover by intent
-const matches = await tools.discover({ query: "github issues", limit: 5 });
+Client commands talk to an already-running Executor server. They never open a
+second copy of the database.
 
-// inspect the schema
-const detail = await tools.describe.tool({
-  path: matches.bestPath,
-  includeSchemas: true,
-});
+```sh
+./target/release/executor --version
+export EXECUTOR_API_TOKEN='token-shown-by-the-dashboard'
 
-// call with type safety
-const issues = await tools.github.issues.list({
-  owner: "vercel",
-  repo: "next.js",
-});
+./target/release/executor tools sources
+./target/release/executor tools search 'create issue'
+./target/release/executor tools describe source_slug.tool_name
+./target/release/executor call source_slug.tool_name '{"input":"value"}'
 ```
 
-Use tools via the CLI:
+Use `--base-url` or `EXECUTOR_BASE_URL` for another instance. Remote instances
+must use HTTPS unless you deliberately pass `--allow-insecure-http` on a
+separately authenticated and encrypted tunnel. A private LAN alone does not
+protect the bearer token. See the [CLI guide](docs/cli.md).
 
-```bash
-executor tools search "send email"
-executor call --help
-executor call github --help
-executor call github issues --help
-executor call cloudflare --help --match dns --limit 20
-executor call github issues create '{"owner":"octocat","repo":"Hello-World","title":"Hi"}'
-executor call gmail send '{"to":"alice@example.com","subject":"Hi"}'
-```
+## Use Executor as an MCP server
 
-`executor call`, `executor resume`, and `executor tools ...` commands auto-start a local daemon if needed.
-If the default port is busy, the CLI will pick an available local port and track it automatically.
+For clients that support Streamable HTTP, use the instance origin plus `/mcp`
+and send the dashboard API token as a bearer token. Client configuration
+schemas differ, so treat this as a schematic shape and adapt it to the selected
+client's MCP documentation:
 
-If an execution pauses for auth or approval, resume it:
-
-```bash
-executor resume --execution-id exec_123
-```
-
-## CLI reference
-
-```bash
-executor install                    # install/start the durable background service
-executor web                        # open the running web UI
-executor web --foreground           # start a temporary foreground runtime + web UI
-executor daemon run                 # start persistent local daemon in background
-executor daemon status              # show daemon status
-executor daemon stop                # stop daemon
-executor daemon restart             # restart daemon
-executor mcp                        # start MCP endpoint
-executor call <path...> '{"k":"v"}' # invoke a tool by path segments
-executor call <path...> --help      # browse namespaces/resources/methods
-executor call <path...> --help --match "<text>" --limit <n> # narrow huge namespaces
-executor resume --execution-id <id> # resume paused execution
-executor tools search "<query>"     # search tools by intent
-executor tools sources              # list configured sources + tool counts
-executor tools describe <path>      # show tool TypeScript/JSON schema
+```json
+{
+  "mcpServers": {
+    "executor": {
+      "type": "http",
+      "url": "http://127.0.0.1:4788/mcp",
+      "headers": {
+        "Authorization": "Bearer <EXECUTOR_API_TOKEN>"
+      }
+    }
+  }
+}
 ```
 
-## Developing locally
+For a client that launches only stdio MCP servers, the common shape is:
 
-```bash
-bun install
-bun dev
+```json
+{
+  "mcpServers": {
+    "executor": {
+      "command": "/absolute/path/to/executor",
+      "args": ["mcp"],
+      "env": {
+        "EXECUTOR_API_TOKEN": "<EXECUTOR_API_TOKEN>"
+      }
+    }
+  }
+}
 ```
 
-The dev server starts at `http://127.0.0.1:4788`.
+The bridge connects to `http://127.0.0.1:4788` by default. Set
+`EXECUTOR_BASE_URL` when the server uses another origin.
 
-### Tests
+## Install and operate
 
-```bash
-bun run test       # unit + integration suites
-bun run test:e2e   # full-stack e2e: boots the cloud and self-host apps and drives them
-```
-
-The browser e2e scenarios need Playwright's Chromium once per machine:
-`bunx playwright install chromium`.
-
-## Community
+- [Native install and first boot](docs/install.md)
+- [Docker Compose](docs/docker.md)
+- [Linux systemd](docs/systemd.md)
+- [macOS launchd](docs/launchd.md)
+- [Runtime and sandbox boundary](docs/runtime.md)
+- [Architecture and security contracts](docs/architecture.md)
 
-Join the Discord: [https://discord.gg/eF29HBHwM6](https://discord.gg/eF29HBHwM6)
+For a reverse proxy or managed OAuth, set `EXECUTOR_PUBLIC_ORIGIN` to the exact
+HTTPS origin used in the browser before starting Executor. Callback URLs are
+connection-specific and are displayed in the source's Managed OAuth panel.
 
-## Learn more
+## Develop and verify
 
-Visit [executor.sh](https://executor.sh) to learn more.
+`bun run bootstrap` installs workspace dependencies, prepares the retained
+TypeScript packages, and installs Playwright Chromium.
 
-## Attribution
+A debug Rust server does not require production web assets:
 
-- Thank you to [Crystian](https://www.linkedin.com/in/crystian/) for providing the npm package name `executor`.
+```sh
+mkdir -p .executor-debug
+chmod 0700 .executor-debug
+cargo run -- server --data-dir "$PWD/.executor-debug"
+```
 
-## References
+Debug builds intentionally embed a small fixture page. That path is suitable
+for API, CLI, and MCP work, not dashboard acceptance. Use the release build
+sequence above when you need the real embedded Svelte application.
+
+The broad merge gates are:
+
+```sh
+bun run format:check
+bun run lint
+bun run typecheck
+bun run test
+cargo fmt --check
+cargo clippy --all-targets --all-features -- -D warnings
+cargo test --all-targets --all-features
+bun run test:e2e
+```
 
-As part of my coding process, I give my agent access to references to other codebases to understand patterns and how other people have implemented systems.
+The e2e command builds the Svelte assets and a local debug Rust binary before
+driving the real first-boot, source, tool-mode, approval, log, token, and OAuth
+journeys in Chromium.
 
-A non exhaustive list of references are:
+See [`RUNNING.md`](RUNNING.md) for the current repository workflow and e2e
+status. Default commands exclude all archived application packages.
 
-- [Better Auth](https://github.com/better-auth/better-auth) - Storage adapter reference
-- [Effect](https://github.com/Effect-TS/effect) - General code patterns
-- [OpenCode](https://github.com/anomalyco/opencode) - Plugin system reference
-- [OpenClaw](https://github.com/openclaw/openclaw) - Plugin system reference
-- [Emdash](https://github.com/emdash-cms/emdash) - Plugin system reference
-- [Pi](https://github.com/badlogic/pi-mono) - Plugin system reference
+## License
 
-It's encouraged also that you can use this codebase as a reference to understand how it's implemented
+MIT
diff --git a/RELEASING.md b/RELEASING.md
index 7285fa719..8f16ab133 100644
--- a/RELEASING.md
+++ b/RELEASING.md
@@ -1,108 +1,243 @@
 # Releasing
 
-This repo uses Changesets for version orchestration and three publish paths:
-the CLI (`executor` npm package plus its platform packages), the
-`@executor-js/*` library packages (`core`, `sdk`, and the public plugins), and
-the self-host Docker image.
-
-## Normal release flow
-
-1. Add a changeset in the PR that should ship:
-   - `bun run changeset`
-2. Merge that PR to `main`.
-3. `.github/workflows/release.yml` opens or updates a `Version Packages` PR.
-4. Merge the `Version Packages` PR.
-5. The release workflow then does two things in parallel:
-   - Publishes every `@executor-js/*` library package whose current version
-     is not already on npm, via `bun run release:publish:packages`
-     (see `scripts/publish-packages.ts`).
-   - If `apps/cli/package.json` bumped, tags the commit and dispatches
-     `.github/workflows/publish-executor-package.yml`, which:
-     - runs `bun run release:check`
-     - performs a full dry-run release build before publish
-     - publishes the CLI npm package under the correct dist-tag
-     - creates or updates the GitHub release with build artifacts
-     - dispatches `.github/workflows/publish-desktop.yml`
-     - dispatches `.github/workflows/publish-selfhost-docker.yml`
-6. The self-host Docker workflow publishes `ghcr.io/rhyssullivan/executor-selfhost`
-   for `linux/amd64` and `linux/arm64`:
-   - stable releases get `vX.Y.Z`, `X.Y.Z`, and `latest`
-   - prereleases get `vX.Y.Z-...`, `X.Y.Z-...`, and `beta`
-
-## Beta releases
-
-Enter prerelease mode before starting a beta train:
-
-- `bun run release:beta:start`
-
-That commits `.changeset/pre.json` into the repo and causes future release PRs to produce versions like `1.5.0-beta.0`, `1.5.0-beta.1`, and so on.
-
-When the beta train is done:
-
-- `bun run release:beta:stop`
-
-Stable versions publish to npm under `latest`.
-Beta versions publish to npm under `beta`.
-
-## Local dry run
-
-To build the full CLI release payload without publishing to npm or GitHub:
-
-- `bun run release:publish:dry-run`
-
-That produces:
-
-- platform archives in `apps/cli/dist`
-- the packed wrapper tarball in `apps/cli/dist/release`
-
-To pack the `@executor-js/*` library packages without publishing:
-
-- `bun run release:publish:packages:dry-run`
-
-To validate the self-host Dockerfile locally without publishing:
-
-- `docker build -f apps/host-selfhost/Dockerfile -t executor-selfhost:local .`
-
-## Release notes
-
-Release notes follow the standard Changesets flow: **the changeset body
-IS the changelog entry.** Write the user-facing summary in the
-`.changeset/*.md` you add with your PR; `changeset version` compiles
-every changeset into the bumped packages' `CHANGELOG.md` files (via
-`@changesets/changelog-github`, which links the PR and credits the
-author), and `apps/cli/src/release.ts` uses the released version's
-section of `apps/cli/CHANGELOG.md` as the GitHub Release body. If the
-section is missing it falls back to `gh release create
---generate-notes`.
-
-There is no separate release-notes file to remember to update — if your
-change deserves a mention, its changeset body is the mention.
-
-### Authoring rules
-
-Write changeset bodies for users, not for the diff:
-
-- Lead with the user-visible behavior, not the implementation.
-- A typical fix is one sentence. A feature can be a short paragraph.
-- For a large release, a changeset body can be a full markdown section
-  (bold sub-headings + bullets). Avoid `#`/`##` headings inside bodies —
-  they end up nested inside a changelog list item.
-- For breaking changes, include the before/after surface in the body.
-
-Contributor attribution is automatic: `@changesets/changelog-github`
-prefixes each entry with the PR link and the author's handle.
-
-## Notes
-
-- Changesets owns the published CLI version via `apps/cli/package.json`.
-- Only the Version Packages PR should change `apps/cli/package.json`; the rest of the workspace is not version-synced for release PRs.
-- Per-package `CHANGELOG.md` files are seeded for every workspace package
-  (`bun run lint:changelog-stubs --fix`). `changeset version` inserts
-  generated sections after the H1, and the `changesets/action@v1` GitHub
-  Action reads each bumped package's `CHANGELOG.md` to build the Version
-  Packages PR description (it crashes with `ENOENT` if any are missing).
-- `@changesets/changelog-github` needs a `GITHUB_TOKEN` when running
-  `changeset version` (it resolves PR numbers and authors). CI provides
-  one; locally use `GITHUB_TOKEN=$(gh auth token) bun run changeset:version`.
-- The publish workflow supports either npm trusted publishing or an `NPM_TOKEN` secret.
-- Re-running the publish workflow for the same tag is safe for packages that are already on npm; existing versions are skipped.
+`Cargo.toml` is the only version source for the native Executor product. The
+manual `Release native Executor` workflow is the only entrypoint that may
+publish native archives, the root Docker image, or the primary GitHub release.
+It derives `EXECUTOR_REPOSITORY` from the repository running the workflow. The
+supported installer currently defaults to `davis7dotsh/executor-fork-testing`
+and accepts the same variable as an explicit fork override.
+
+## Prepare the release commit
+
+1. Change `[package].version` in `Cargo.toml`.
+2. Run `cargo check --locked`. If Cargo reports that the lockfile needs an
+   update, run `cargo check` once, review the `Cargo.lock` change, then rerun
+   `cargo check --locked`.
+3. Verify `cargo run -- --version` prints `executor <version>`.
+4. Merge the release commit to `main` and record its full SHA.
+
+Release tags must be exactly `v<Cargo.toml version>`. The commit must be on
+`origin/main`, and publish mode requires the existing remote tag to resolve to
+the exact 40-character SHA supplied to the workflow. Release versions cannot
+contain SemVer build metadata (`+...`) because OCI image tags do not support
+that character.
+
+The `ghcr.io/<repository-owner>/executor` container package must be public
+before promotion. On the first publish attempt, GHCR may create it as private.
+If the anonymous-pull gate fails, open the package settings, change visibility
+to public, then rerun the workflow with the same tag and commit. The GitHub
+release remains a draft until that gate passes.
+
+Before publishing, configure these repository controls. The workflow reads
+them through GitHub's REST API and fails closed if they drift:
+
+- Create a `native-release` environment with only a required-reviewers rule
+  and a branch-policy rule. Set `prevent_self_review=false`, make the sole
+  reviewer the GitHub user `bmdavis419` (user ID `45952064`), and configure a
+  custom deployment branch policy whose sole entry is the `main` branch.
+  Disable administrator bypass so every publish requires approval.
+- Create an active tag ruleset for exactly `refs/tags/v*`, with no exclusions
+  or bypass actors. Enable both restrict updates and restrict deletions. Do not
+  allow fetch-and-merge updates, and do not add any other rule. Do not restrict
+  creations, because the release tag must be created before dispatch.
+- Enable immutable releases in the repository release settings.
+- Add a `NATIVE_RELEASE_TOKEN` secret only to the `native-release` environment.
+  It must be a classic personal access token owned by `bmdavis419`, with the
+  exact scopes `public_repo` and `write:packages`, and no others. The same
+  account login is used as the GHCR username. Create it from the
+  [prefilled exact-scope form](https://github.com/settings/tokens/new?scopes=public_repo,write:packages)
+  because selecting `write:packages` manually can auto-select the broader
+  `repo` scope. Before saving, verify that only `public_repo` and
+  `write:packages` are selected. Do not add this token as a repository or
+  organization secret.
+
+Every native job that publishes or reads a protected release credential uses
+the `native-release` environment. A dedicated preflight checks
+that the secret is present, belongs to the expected account, has both classic
+PAT scopes and no extras, can push to the repository, can authenticate to GHCR, and sees
+immutable releases enabled. All GitHub release and GHCR writes use that token.
+The exact no-bypass ruleset check runs only after protected-environment approval
+because the public read token does not expose bypass actors. The job-scoped
+`GITHUB_TOKEN` remains read-only. Require a fresh protected-environment approval
+on reruns.
+
+## Dry run
+
+Use dry-run mode before creating the tag. It performs the four native builds,
+archive packaging, checksum assembly, version smoke tests, and the root
+multi-platform Docker build. It does not publish an image, create a GitHub
+release, or move a release channel.
+
+```sh
+git fetch origin main
+sha="$(git rev-parse origin/main)"
+version="$(git show "$sha:Cargo.toml" | python3 -c 'import sys,tomllib; print(tomllib.load(sys.stdin.buffer)["package"]["version"])')"
+tag="v$version"
+
+gh workflow run release.yml --ref main \
+  -f mode=dry-run \
+  -f tag="$tag" \
+  -f commit_sha="$sha"
+```
+
+The workflow run revision and `commit_sha` must be identical. If `main` moves
+between resolving `sha` and dispatching the workflow, the run fails closed.
+Resolve the new `origin/main` SHA and dispatch again.
+
+Inspect the run and download the `executor-release-artifacts` workflow artifact
+if desired. Dry runs are safe for forks because all publishing steps are
+skipped.
+
+## Publish
+
+After a successful dry run, create the tag at the same commit and push only
+that tag:
+
+```sh
+git tag -a "$tag" "$sha" -m "Release $tag"
+git push origin "refs/tags/$tag"
+
+test "$(git rev-parse "$tag^{commit}")" = "$sha"
+test "$(git ls-remote origin "refs/tags/$tag^{}" | cut -f1)" = "$sha" || \
+  test "$(git ls-remote origin "refs/tags/$tag" | cut -f1)" = "$sha"
+
+gh workflow run release.yml --ref main \
+  -f mode=publish \
+  -f tag="$tag" \
+  -f commit_sha="$sha"
+```
+
+Publish mode must be dispatched from `main`. On the first attempt, `main`, the
+workflow definition, workflow source revision, checked-out source, input
+commit, and release tag must all resolve to the same commit. A later attempt of
+that same run may continue after `main` advances, but the original commit must
+remain an ancestor of `main` and the remote tag must still resolve to it. Do
+not dispatch a new run with the older SHA. Rerun the complete original run so
+GitHub preserves its workflow run ID, source SHA, protected authorization, and
+every release check:
+
+```sh
+run_id=<failed-run-database-id>
+gh run rerun "$run_id"
+gh run watch "$run_id" --exit-status
+```
+
+Publish mode performs these gated stages:
+
+1. Verify the exact protected-environment policy, immutable tag ruleset,
+   workflow revision, Cargo version, full commit SHA, `main` ancestry, and
+   remote tag are bound to one commit.
+2. Build the Svelte payload once, then build and smoke-test four native
+   archives against that identical payload with their preserved installer
+   names. Linux binaries use a digest-pinned Ubuntu 22.04 build image and
+   checksummed Rust 1.96 toolchain archives. Both macOS binaries declare a
+   macOS 14.0 minimum, which the workflow verifies from their Mach-O metadata.
+   Release compilation selects Xcode 16.4 build 16F6, macOS SDK 15.5, Apple
+   clang 17.0.0 (clang-1700.0.13.5), and ld 1167.5 by exact path and version.
+   The macOS 14 compatibility-floor service tests select Xcode 15.4 build
+   15F31d, macOS SDK 14.5, Apple clang 15.0.0 (clang-1500.3.9.4), and ld
+   1053.12. The ARM64 archive is booted on macOS 14, while the x86-64 archive
+   is booted on the available standard Intel macOS 15 runner.
+3. Package all four raw binaries in one digest-pinned Ubuntu snapshot with one
+   fixed Python and zlib implementation. Build the archives twice and require
+   byte-identical archives and sidecars before assembling `SHA256SUMS`.
+4. Extract the two Linux release archives into the root `Dockerfile`'s
+   `runtime-prebuilt` target, push each architecture by digest, and assemble a
+   run-scoped multi-platform staging manifest. The runtime base and apt
+   snapshot are pinned, and image timestamps use the release commit time so a
+   retry produces the same digest. Build orchestration and manifest creation
+   use the exact Buildx v0.34.1 client and digest-pinned BuildKit v0.30.0 daemon.
+5. Create the draft with an atomic `[executor-run:<run_id>]` title marker, then
+   upload the complete exact asset set. `RELEASE-RUN.json` binds the repository,
+   tag, commit, and workflow run ID. `RELEASE-IMAGE.json` additionally binds the
+   exact assembled OCI image name and digest.
+6. Boot both published architectures by exact assembled digest, then verify
+   first boot, health, every byte of the canonical embedded web payload, and
+   anonymous pull access.
+7. Re-fetch the remote release tag and assign the immutable release, version,
+   and commit image tags.
+8. Recompute and byte-compare the run binding, image binding, and every release
+   asset, then publish the draft GitHub release. Publication creates GitHub's
+   automatic immutable release attestation. Require the release API to report
+   the exact release as immutable, and retry bounded attestation verification
+   until it succeeds.
+9. Only after the GitHub release is public, move the mutable `latest` or
+   `beta` channel to the verified image digest.
+
+Stable versions move the Docker `latest` channel. Prerelease versions move the
+`beta` channel. The image is `ghcr.io/<repository-owner>/executor` and receives
+immutable `vX.Y.Z`, `X.Y.Z`, and `sha-<commit>` tags plus the channel tag.
+
+The workflow may reuse only a release whose title contains the exact current
+workflow run ID. If release creation succeeded before its binding asset upload,
+that atomic title marker lets the same run recover the partial draft. Every
+same-run draft retry uploads the complete asset list with clobber semantics,
+then downloads and byte-compares the final exact set. An already-published
+immutable release is compare-only and must contain a byte-identical
+`RELEASE-RUN.json`, `RELEASE-IMAGE.json`, and complete rebuilt bundle. A new run
+refuses to reuse either release state. Before the workflow
+assigns any immutable release, version, or commit image tag, it verifies that
+an existing tag already has the expected digest or fails closed. Only `latest`
+or `beta` may move to another digest, and neither moves until the GitHub release
+is public. The remote `v*` tag is force-refetched and compared with the validated
+commit immediately before draft-release mutation and again immediately before
+promotion. All native release runs share one
+serialized concurrency group. Promotion reads the current channel manifest's
+version annotation and refuses to move a channel to an older SemVer. A retry at
+the same version succeeds only when the channel already has the exact assembled
+digest. Published GitHub release history is checked too, so removing a channel
+tag cannot bypass the version floor. A channel without a valid version
+annotation fails closed.
+
+## Release archives
+
+The primary GitHub release contains:
+
+- `executor-x86_64-unknown-linux-gnu.tar.gz`
+- `executor-aarch64-unknown-linux-gnu.tar.gz`
+- `executor-x86_64-apple-darwin.tar.gz`
+- `executor-aarch64-apple-darwin.tar.gz`
+- one `.sha256` sidecar for each archive
+- `RELEASE-RUN.json`, binding the release to its repository, tag, commit, and
+  workflow run ID
+- `RELEASE-IMAGE.json`, binding that same source to the exact OCI image and
+  digest
+- `BUILD-TOOLCHAINS.txt`, recording the asserted build and packaging toolchains
+- `SHA256SUMS`
+
+Each archive contains `executor`, `LICENSE`, `THIRD_PARTY_LICENSES.html`, and
+`THIRD_PARTY_JAVASCRIPT_LICENSES.json`.
+
+After downloading an archive, verify both GitHub's release attestation and the
+specific local asset before checking the checksum manifest:
+
+```sh
+gh release verify "$tag" --repo davis7dotsh/executor-fork-testing
+gh release verify-asset "$tag" "executor-${target}.tar.gz" \
+  --repo davis7dotsh/executor-fork-testing
+sha256sum --check "executor-${target}.tar.gz.sha256"
+```
+
+The release installer fixture exercises archive verification, serialized
+concurrent install and uninstall, stale-lock recovery with PID-reuse defense,
+live-owner identity lookup failure, hostile and swapped install-path ancestors,
+durability ordering, interrupted rollback, resumable partial uninstall,
+Python-free installation, and locked cross-root PATH updates. Its injected
+durability log must show owned-file changes before manifest publication or
+deletion, and manifest changes before recovery retirement.
+
+The macOS command-line archives are not Developer ID signed or notarized. The
+supported path is the checksum-verifying curl installer, or a `gh` download
+followed by the attestation and checksum verification above. GitHub records the
+attestation automatically when the immutable release is published.
+Browser-downloaded
+quarantined binaries and app-style Gatekeeper distribution are not release
+claims until a signing identity and notarization workflow are configured. Both
+macOS architectures require macOS 14 Sonoma or newer.
+
+## Legacy desktop compatibility
+
+The desktop publishing workflow is retired. Historical tags predate the
+`legacy/desktop` move and cannot be built honestly with current-tree paths. The
+archived source remains available for local archaeology, but no release
+workflow claims to produce supported desktop artifacts.
diff --git a/RUNNING.md b/RUNNING.md
index 55c1c6fba..c8ae4459f 100644
--- a/RUNNING.md
+++ b/RUNNING.md
@@ -1,125 +1,219 @@
-# RUNNING.md — how things run today
-
-> **This document may be out of date.** It describes how things run today,
-> not how they must run. Trust it as a starting point; if you hit weirdness,
-> the implementation has probably moved and this file is why. Verify against
-> the code, then update this file when you notice drift. The principles in
-> [AGENTS.md](AGENTS.md) are the stable contract; everything below is
-> implementation detail that churns.
-
-## Fresh checkout / worktree setup
-
-`bun run bootstrap` from the repo root — idempotent: `bun install` (whose
-prepare hook builds `@executor-js/vite-plugin` and `packages/react`, the
-artifacts dev servers fail without) plus Playwright chromium. A fresh
-worktree that skips it dies with "Failed to resolve entry for package
-'@executor-js/vite-plugin'".
-
-Our two upstream forks — `@executor-js/emulate` (service emulators) and
-`@executor-js/mcporter` (headless MCP client) — are consumed purely as
-published npm packages; nothing in this repo references them by path. There
-are no `vendor/` submodules. Each fork is its own standalone repo
-(`github.com/UsefulSoftwareCo/emulate`, `github.com/UsefulSoftwareCo/mcporter`):
-develop on its `main`, publish a bump, then bump the dependency here. The
-`emulate` skill covers the emulator publish/deploy loop.
-
-## Dev servers
-
-- Everything except desktop/cloud: `bun run dev` (turbo, from root)
-- One app: `bun run dev` from its `apps/<name>` directory
-- Self-host boots standalone with just env vars — see
-  `e2e/setup/selfhost.globalsetup.ts` for the canonical recipe (data dir,
-  bootstrap admin email/password, base URL, `EXECUTOR_ALLOW_LOCAL_NETWORK`)
-- Cloud needs WorkOS + Autumn; for a no-.env boot, point it at emulators —
-  see `e2e/setup/cloud.globalsetup.ts` for the canonical recipe (the real
-  SDKs against emulated services, PGlite dev DB)
-
-The e2e globalsetup files are the source of truth for "how do I boot a
-working instance of X" — read them before inventing a boot path.
-
-## E2E: running, viewing, sharing
-
-`e2e/AGENTS.md` covers writing scenarios. Operationally:
-
-- `cd e2e && bun run test` boots dev servers and runs everything;
-  `--project cloud|selfhost` narrows. `E2E_CLOUD_URL`/`E2E_SELFHOST_URL`
-  attach to an already-running server instead of booting.
-- Runs land in `e2e/runs/<target>/<scenario-slug>/` — `result.json`, step
-  screenshots, `session.mp4` + `trace.zip` for browser scenarios, and the
-  scenario source as `test.ts`.
-- `cd e2e && bun run serve` builds the viewer and serves the scenario ×
-  target matrix over HTTP, bound to all interfaces (reachable over the
-  tailnet). It prefers port 8901 but walks forward to the next free port if
-  that's taken (so concurrent worktrees, or a leaked previous viewer, never
-  wedge each other) — read the printed `e2e viewer → …` URL for the actual
-  port. `PORT=…` pins a port explicitly and fails loudly if it's busy. The
-  built SPA is port- and mount-agnostic (relative assets + hash routing), so
-  whatever port it lands on just works. Individual runs are at
-  `#/<target>/<slug>` hash routes — when handing results to the user, link
-  those directly, not the bare matrix.
-- `bun e2e/scripts/pr-media.ts e2e/runs/<target>/<slug>` converts a run's
-  recording to a gif, uploads it to the `e2e-media` branch, and prints
-  PR-ready markdown.
-
-E2E dev-server ports are derived and CLAIMED per checkout (`cd e2e && bun
-run ports` prints this checkout's block; see `e2e/src/ports.ts`) — each
-checkout hashes its repo root to a preferred block, atomically locks it,
-and walks to the next free block if squatted, so concurrent worktrees never
-collide or attach to each other's servers. `E2E_*_PORT` env vars pin ports
-explicitly. If a boot reports a squatted port, an old dev server leaked —
-`bun run reap` (repo root) lists and kills orphaned stacks.
-
-## The dev CLI: live instances, interactively
-
-`cd e2e && bun run cli` — the same primitives scenarios use, as commands.
-Boot a target, mint identities, make typed API calls, drive MCP, read the
-emulator ledger — develop interactively, then crystallize the journey into
-a scenario.
+# Running the Rust and Svelte rewrite
+
+This file describes the active local and self-hosted product. The archived
+TypeScript application entry points are under `legacy/` and are not part of
+the default workflow.
+
+## Fresh checkout
+
+From the repository root:
+
+```sh
+bun run bootstrap
+```
+
+Bootstrap runs the workspace install and prepare hooks, then installs
+Playwright Chromium. It is safe to rerun. The workspace currently declares Bun
+1.3.11 and the native release workflow uses Rust 1.96.0.
+
+`Cargo.toml` is the only native product version source. Confirm the active
+checkout before packaging with:
+
+```sh
+cargo run -- --version
+```
+
+## Production-like local run
+
+The real Svelte dashboard is compiled first and embedded in the Rust release
+binary:
+
+```sh
+bun run --cwd web build
+cargo build --locked --release
+
+mkdir -p .executor-local/data
+chmod 0700 .executor-local/data
+./target/release/executor server --data-dir "$PWD/.executor-local/data"
+```
+
+Open the setup URL printed by the process. The dashboard creates the
+administrator and immediately signs in with those credentials. Add a source,
+review its tool modes, and create an API token under `/tokens`.
+
+The server binds to `127.0.0.1:4788` unless `--bind` changes it. Keep plaintext
+HTTP on loopback. For another browser-facing hostname, terminate TLS at a
+reverse proxy and set the exact external origin with `--public-origin` or
+`EXECUTOR_PUBLIC_ORIGIN`.
+
+On this WSL2 machine, the Windows browser can reach the loopback server. Open
+it with:
+
+```sh
+/mnt/c/windows/explorer.exe http://127.0.0.1:4788
+```
+
+Use a worktree-specific data directory, as shown above, so concurrent checkouts
+never share SQLite or the instance master key. One process lock protects each
+data directory.
+
+## Debug server without a web build
+
+Normal debug compilation does not require `web/build`:
+
+```sh
+mkdir -p .executor-debug
+chmod 0700 .executor-debug
+cargo run -- server --data-dir "$PWD/.executor-debug"
+```
+
+Debug builds embed the deterministic fixture under `tests/fixtures/web-assets`.
+This is useful for Rust API, CLI, MCP, and lifecycle work. It is not a visual
+dashboard development server. Use the production-like sequence when the real
+Svelte application must be present.
+
+`EXECUTOR_WEB_ASSETS_DIR` is a compile-time packaging override for focused
+asset tests. It is not a runtime static-directory setting.
+
+## Client smoke test
+
+Create a dashboard API token, then use the same binary as a client:
+
+```sh
+export EXECUTOR_API_TOKEN='token-shown-once-by-the-dashboard'
+
+./target/release/executor tools sources
+./target/release/executor tools search 'health check'
+./target/release/executor tools describe source_slug.tool_name
+./target/release/executor call source_slug.tool_name '{}'
+```
+
+The server never auto-starts for client commands. `call`, `tools`, and `mcp`
+require a running server and an API token. `open` only opens the clean dashboard
+URL and uses the administrator login cookie in the browser.
+
+## Managed OAuth callbacks
+
+Set the final browser-facing origin before creating an OAuth connection:
 
 ```sh
-bun run cli up selfhost --share   # boot, reachable over the tailnet, stays up
-bun run cli up cloud --share      # emulated WorkOS+Autumn, tailscale-HTTPS fronted
-bun run cli status                # what's running, URLs, creds
-bun run cli identity selfhost     # fresh identity (headers / cookies / creds)
-bun run cli api selfhost tools.list
-bun run cli mcp selfhost call execute '{"code":"return 1+1;"}'
-bun run cli ledger cloud workos   # what hit the emulator
-bun run cli down selfhost         # tear down (also removes tailscale serves)
+./target/release/executor server \
+  --data-dir "$PWD/.executor-local/data" \
+  --public-origin https://executor.example.com
+```
+
+After importing an eligible OpenAPI, GraphQL, or HTTP MCP source, open its
+**Managed OAuth** panel. Save the provider discovery and client configuration,
+copy the exact displayed callback URL into the provider, then select **Connect
+OAuth**. Every connection has its own callback path:
+
+```text
+/api/v1/oauth/callback/<connection-id>
 ```
 
-Instances persist until `down` — `up --share` IS the "touch it" handoff
-artifact, and the seeding direction too: boot, drive the product into a
-state (API/MCP/UI), hand across the URL. State files in `e2e/.dev/` mark
-deliberate long-lived instances (vs leaks); attach scenarios to a running
-instance with `E2E_<TARGET>_URL`.
-
-Why cloud `--share` is more involved (encoded in the CLI, kept here for
-when you hit it manually): the cloud app sets `secure: true` auth cookies,
-so login breaks over plain http from any non-localhost origin ("Invalid
-login state"). Both the app AND the WorkOS emulator get fronted with
-`tailscale serve` HTTPS, the emulator advertises its public URL on both
-sides (its `baseUrl` and the app's `WORKOS_API_URL` — the browser-facing
-authorize URL derives from the latter), and Vite must allow the public
-hostname (`__VITE_ADDITIONAL_SERVER_ALLOWED_HOSTS`).
-
-## Environment gotchas (learned the hard way)
-
-- The shell is fish, and the working directory resets between Bash calls.
-  Use absolute paths rooted at THIS worktree; don't rely on a prior `cd`.
-- Don't write probe scripts to `/tmp` — they can't resolve workspace
-  packages (`effect`, `playwright`, …). Put scratch scripts under the repo
-  root (`scratch/` is gitignored) so bun resolves the workspace.
-- A fresh worktree's Vite dep-optimizer cache can serve PRE-REBASE code
-  (symptom: behavior matching old code only in dev servers, while unit
-  tests pass). Kill the server, clear `node_modules/.vite` /
-  `.tanstack`-adjacent caches, reboot.
-- The real Tailscale CLI on this machine is
-  `/opt/homebrew/opt/tailscale/bin/tailscale`; `/usr/local/bin/tailscale`
-  is a broken shim pointing at a deleted app. The tailnet IP is on the
-  `utun` interface (100.x.y.z) if the CLI fails.
-- `bun.lock` conflicts on rebase: take either side, re-run `bun install`,
-  never hand-merge.
-- Long-lived demo servers you left up for the user look like leaks to
-  cleanup tooling — `e2e/.dev/<target>.json` marks deliberate instances;
-  check it before reaping, and `bun run cli down <target>` is the clean
-  teardown.
+The supported managed flow is OAuth 2 authorization code with PKCE. OpenID
+Connect and the `openid` scope are not supported. See
+[`docs/sources.md`](docs/sources.md).
+
+## Verification
+
+Use the narrowest relevant command while iterating. For a merge-ready change,
+run the complete active-product gates:
+
+```sh
+bun run format:check
+bun run lint
+bun run typecheck
+bun run test
+
+bun run --cwd web format:check
+bun run --cwd web lint
+bun run --cwd web check
+bun run --cwd web test
+
+cargo fmt --check
+cargo check --all-targets --all-features
+cargo clippy --all-targets --all-features -- -D warnings
+cargo test --all-targets --all-features
+```
+
+Use `vitest run ...` or a package script that delegates to Vitest for focused
+TypeScript tests. Never use `bun test`.
+
+## Browser e2e
+
+`bun run test:e2e` builds the Svelte distribution, embeds it in the debug Rust
+binary, and runs only the active `local-selfhost` browser project. The harness
+boots two fresh loopback instances: one prepared single-admin instance for the
+main journeys and one untouched instance for the first-boot setup journey.
+Both use temporary private data directories that are removed during teardown.
+
+The throwaway main-instance credentials are:
+
+```text
+username: admin
+password: executor-e2e-admin-password
+```
+
+The archived cloud browser suite remains an explicit opt-in:
+
+```sh
+bun run legacy:test:e2e:cloud
+```
+
+Runs land under `e2e/runs/local-selfhost/<scenario>/`. View them with
+`cd e2e && bun run serve`, then open the exact URL and port printed by the
+viewer. Credential-entry journeys deliberately omit traces and video so setup
+secrets, passwords, and one-time API tokens never become artifacts.
+
+## Service and container runs
+
+The release binary embeds its hardened systemd and launchd installation assets.
+On Linux, system service changes require root:
+
+```sh
+sudo "$(command -v executor)" service install
+executor service status
+sudo executor service restart
+sudo executor service stop
+sudo executor service start
+sudo executor service remove
+```
+
+On macOS, run the same commands without `sudo`. The LaunchAgent belongs to the
+logged-in user. `service install --no-start` writes the managed files while
+leaving the service stopped. `service status` prints exactly `active` or
+`inactive`; inactive exits with status 3.
+
+These commands mutate real operating-system service state. Do not use them for
+ordinary development checkouts or tests. Use the maintained operator guides
+for paths, permissions, backup requirements, and removal behavior:
+
+- [`docs/docker.md`](docs/docker.md)
+- [`docs/systemd.md`](docs/systemd.md)
+- [`docs/launchd.md`](docs/launchd.md)
+- [`docs/install.md`](docs/install.md)
+
+## Legacy opt-ins
+
+Default dev, test, lint, typecheck, and format paths exclude all six archived
+application packages. Work on them only through the explicit scripts:
+
+```sh
+bun run legacy:dev
+bun run legacy:dev:cli -- --help
+bun run legacy:test
+bun run legacy:typecheck
+bun run legacy:typecheck:slow
+bun run legacy:test:e2e:cloud
+bun run legacy:test:e2e:desktop
+```
+
+See [`legacy/README.md`](legacy/README.md) for the boundary.
+
+Publishing is also opt-in. `release.yml` is the sole native product release
+entrypoint and requires explicit dry-run or publish mode, a semver tag, and an
+exact full commit SHA. The separate TypeScript workflow publishes only
+explicitly confirmed `@executor-js/*` library versions under immutable
+compatibility tags. Legacy CLI and desktop publishing are retired. See
+[`RELEASING.md`](RELEASING.md) for the checked release sequence.
diff --git a/about.hbs b/about.hbs
new file mode 100644
index 000000000..31f8092d2
--- /dev/null
+++ b/about.hbs
@@ -0,0 +1,27 @@
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>Executor third-party licenses</title>
+  </head>
+  <body>
+    <h1>Executor third-party licenses</h1>
+    <ul>
+      {{#each overview}}
+        <li><a href="#{{id}}">{{name}}</a> ({{count}})</li>
+      {{/each}}
+    </ul>
+    {{#each licenses}}
+      <section id="{{id}}">
+        <h2>{{name}}</h2>
+        <p>Used by:</p>
+        <ul>
+          {{#each used_by}}
+            <li>{{crate.name}} {{crate.version}}</li>
+          {{/each}}
+        </ul>
+        <pre>{{text}}</pre>
+      </section>
+    {{/each}}
+  </body>
+</html>
\ No newline at end of file
diff --git a/about.toml b/about.toml
new file mode 100644
index 000000000..a50618dc2
--- /dev/null
+++ b/about.toml
@@ -0,0 +1,32 @@
+accepted = [
+  "0BSD",
+  "Apache-2.0",
+  "Apache-2.0 WITH LLVM-exception",
+  "BSD-2-Clause",
+  "BSD-3-Clause",
+  "BSL-1.0",
+  "CC0-1.0",
+  "CDLA-Permissive-2.0",
+  "ISC",
+  "MIT",
+  "MIT-0",
+  "MPL-2.0",
+  "OpenSSL",
+  "Unicode-3.0",
+  "Unicode-DFS-2016",
+  "Unlicense",
+  "Zlib",
+]
+
+targets = [
+  "aarch64-apple-darwin",
+  "aarch64-unknown-linux-gnu",
+  "x86_64-apple-darwin",
+  "x86_64-unknown-linux-gnu",
+]
+
+ignore-build-dependencies = false
+ignore-dev-dependencies = true
+filter-noassertion = true
+no-clearly-defined = true
+workarounds = ["ring", "rustls"]
diff --git a/apps/cli/src/release.ts b/apps/cli/src/release.ts
deleted file mode 100644
index 4471fe56f..000000000
--- a/apps/cli/src/release.ts
+++ /dev/null
@@ -1,305 +0,0 @@
-import { existsSync } from "node:fs";
-import { mkdir, readdir, readFile, rename, rm } from "node:fs/promises";
-import { dirname, join, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-
-type ReleaseChannel = "latest" | "beta";
-
-type ReleaseCliOptions = {
-  readonly dryRun: boolean;
-};
-
-type CommandInput = {
-  readonly command: string;
-  readonly args: ReadonlyArray<string>;
-  readonly cwd: string;
-  readonly captureOutput?: boolean;
-};
-
-type CommandOutput = {
-  readonly stdout: string;
-  readonly stderr: string;
-};
-
-const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), "../../..");
-const cliRoot = resolve(repoRoot, "apps/cli");
-const distDir = resolve(cliRoot, "dist");
-const releaseDir = resolve(distDir, "release");
-const wrapperDir = resolve(distDir, "executor");
-const versionPackagePath = resolve(cliRoot, "package.json");
-const semverPattern =
-  /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*))*))?(?:\+([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?$/;
-
-const parseArgs = (argv: ReadonlyArray<string>): ReleaseCliOptions => {
-  let dryRun = false;
-
-  for (const arg of argv) {
-    if (arg === "--dry-run") {
-      dryRun = true;
-      continue;
-    }
-
-    throw new Error(`Unknown argument: ${arg}`);
-  }
-
-  return { dryRun };
-};
-
-const runCommand = async (input: CommandInput): Promise<CommandOutput> => {
-  const proc = Bun.spawn([input.command, ...input.args], {
-    cwd: input.cwd,
-    env: process.env,
-    stdio: input.captureOutput ? ["ignore", "pipe", "pipe"] : ["ignore", "inherit", "inherit"],
-  });
-
-  const exitCode = await proc.exited;
-  const stdout = input.captureOutput && proc.stdout ? await new Response(proc.stdout).text() : "";
-  const stderr = input.captureOutput && proc.stderr ? await new Response(proc.stderr).text() : "";
-
-  if (exitCode !== 0) {
-    throw new Error(
-      [
-        `${input.command} ${input.args.join(" ")} exited with code ${exitCode}`,
-        stdout.trim().length > 0 ? `stdout:\n${stdout.trim()}` : null,
-        stderr.trim().length > 0 ? `stderr:\n${stderr.trim()}` : null,
-      ]
-        .filter((part) => part !== null)
-        .join("\n\n"),
-    );
-  }
-
-  return {
-    stdout: stdout.trim(),
-    stderr: stderr.trim(),
-  };
-};
-
-const readVersion = async (): Promise<string> => {
-  const pkg = (await Bun.file(versionPackagePath).json()) as { version?: string };
-  const version = pkg.version?.trim();
-
-  if (!version) {
-    throw new Error(`Missing version in ${versionPackagePath}`);
-  }
-
-  return version;
-};
-
-const validateVersion = (version: string): void => {
-  if (!semverPattern.test(version)) {
-    throw new Error(`${versionPackagePath} version is not valid semver: ${version}`);
-  }
-};
-
-const resolveChannel = (version: string): ReleaseChannel =>
-  version.includes("-") ? "beta" : "latest";
-
-const resolveTagFromEnvironment = (): string | undefined => {
-  const refName = process.env.GITHUB_REF_NAME?.trim();
-  if (process.env.GITHUB_REF_TYPE === "tag" && refName) {
-    return refName;
-  }
-
-  const ref = process.env.GITHUB_REF?.trim();
-  if (ref?.startsWith("refs/tags/")) {
-    return ref.slice("refs/tags/".length);
-  }
-
-  return undefined;
-};
-
-const resolveGitHubRepository = (): string => {
-  const repository = process.env.GH_REPO?.trim() || process.env.GITHUB_REPOSITORY?.trim();
-  if (!repository) {
-    throw new Error("Set GH_REPO or GITHUB_REPOSITORY before creating a GitHub release.");
-  }
-
-  return repository;
-};
-
-const packWrapperPackage = async (): Promise<string> => {
-  if (!existsSync(wrapperDir)) {
-    throw new Error(`Wrapper package directory not found: ${wrapperDir}`);
-  }
-
-  await mkdir(releaseDir, { recursive: true });
-
-  const before = new Set((await readdir(wrapperDir)).filter((entry) => entry.endsWith(".tgz")));
-  await runCommand({
-    command: "bun",
-    args: ["pm", "pack"],
-    cwd: wrapperDir,
-  });
-
-  const after = (await readdir(wrapperDir)).filter((entry) => entry.endsWith(".tgz"));
-  const archiveName = after.find((entry) => !before.has(entry)) ?? after[0];
-
-  if (!archiveName) {
-    throw new Error(`bun pm pack did not create a .tgz archive in ${wrapperDir}`);
-  }
-
-  const sourcePath = join(wrapperDir, archiveName);
-  const destinationPath = join(releaseDir, archiveName);
-
-  await rm(destinationPath, { force: true });
-  await rename(sourcePath, destinationPath);
-
-  return destinationPath;
-};
-
-const collectReleaseAssetPaths = async (
-  wrapperArchivePath: string,
-): Promise<ReadonlyArray<string>> => {
-  const assetNames = (await readdir(distDir))
-    .filter((entry) => /^executor-.*\.(?:tar\.gz|zip)$/.test(entry))
-    .sort();
-
-  return [wrapperArchivePath, ...assetNames.map((entry) => join(distDir, entry))];
-};
-
-const githubReleaseExists = async (tag: string, repository: string): Promise<boolean> => {
-  const proc = Bun.spawn(["gh", "release", "view", tag, "--repo", repository], {
-    cwd: repoRoot,
-    env: process.env,
-    stdio: ["ignore", "ignore", "ignore"],
-  });
-
-  return (await proc.exited) === 0;
-};
-
-/** The CHANGELOG section Changesets generated for `version` (compiled from
- *  `.changeset/*.md` bodies at Version Packages time) — the GitHub Release
- *  body. Returns null when the section is missing so the caller can fall back
- *  to GitHub's auto-generated notes. */
-const changelogSectionForVersion = async (version: string): Promise<string | null> => {
-  const changelogPath = resolve(cliRoot, "CHANGELOG.md");
-  if (!existsSync(changelogPath)) return null;
-  const lines = (await readFile(changelogPath, "utf8")).split("\n");
-  const start = lines.findIndex((line) => line.trim() === `## ${version}`);
-  if (start === -1) return null;
-  let end = lines.length;
-  for (let i = start + 1; i < lines.length; i += 1) {
-    if (/^## /.test(lines[i] ?? "")) {
-      end = i;
-      break;
-    }
-  }
-  const body = lines
-    .slice(start + 1, end)
-    .join("\n")
-    .trim();
-  return body.length > 0 ? body : null;
-};
-
-const syncGitHubRelease = async (input: {
-  readonly tag: string;
-  readonly channel: ReleaseChannel;
-  readonly assetPaths: ReadonlyArray<string>;
-}): Promise<void> => {
-  if (!process.env.GH_TOKEN?.trim()) {
-    throw new Error("GH_TOKEN is required to create or update a GitHub release.");
-  }
-
-  const repository = resolveGitHubRepository();
-
-  if (await githubReleaseExists(input.tag, repository)) {
-    await runCommand({
-      command: "gh",
-      args: [
-        "release",
-        "upload",
-        input.tag,
-        ...input.assetPaths,
-        "--repo",
-        repository,
-        "--clobber",
-      ],
-      cwd: repoRoot,
-    });
-    return;
-  }
-
-  const notes = await changelogSectionForVersion(input.tag.replace(/^v/, ""));
-
-  // Draft until publish-desktop.yml finishes uploading installers and flips
-  // it; otherwise /releases/latest/download/<desktop-asset> 404s during the
-  // ~15-20 min desktop build window.
-  const args = [
-    "release",
-    "create",
-    input.tag,
-    ...input.assetPaths,
-    "--repo",
-    repository,
-    "--title",
-    input.tag,
-    ...(notes ? ["--notes", notes] : ["--generate-notes"]),
-    "--verify-tag",
-    "--draft",
-  ];
-
-  if (input.channel === "beta") {
-    args.push("--prerelease");
-  }
-
-  await runCommand({
-    command: "gh",
-    args,
-    cwd: repoRoot,
-  });
-};
-
-const main = async () => {
-  const options = parseArgs(process.argv.slice(2));
-  const version = await readVersion();
-  const tag = `v${version}`;
-  const refTag = resolveTagFromEnvironment();
-  const channel = resolveChannel(version);
-
-  validateVersion(version);
-
-  if (refTag && refTag !== tag) {
-    throw new Error(`GitHub tag ${refTag} does not match ${versionPackagePath} version ${version}`);
-  }
-
-  await rm(releaseDir, { recursive: true, force: true });
-  await mkdir(releaseDir, { recursive: true });
-
-  await runCommand({
-    command: "bun",
-    args: ["run", "src/build.ts", "binary"],
-    cwd: cliRoot,
-  });
-
-  await runCommand({
-    command: "bun",
-    args: ["run", "src/build.ts", "release-assets"],
-    cwd: cliRoot,
-  });
-
-  const wrapperArchivePath = await packWrapperPackage();
-  const assetPaths = await collectReleaseAssetPaths(wrapperArchivePath);
-
-  console.log(`Prepared executor@${version} for ${channel}`);
-  for (const assetPath of assetPaths) {
-    console.log(`- ${assetPath}`);
-  }
-
-  if (options.dryRun) {
-    return;
-  }
-
-  await syncGitHubRelease({
-    tag,
-    channel,
-    assetPaths,
-  });
-
-  await runCommand({
-    command: "bun",
-    args: ["run", "src/build.ts", "publish", channel],
-    cwd: cliRoot,
-  });
-};
-
-await main();
diff --git a/apps/docs/README.md b/apps/docs/README.md
index 1999936d8..7b30dad46 100644
--- a/apps/docs/README.md
+++ b/apps/docs/README.md
@@ -18,14 +18,13 @@ server hot-reloads.
 
 ## How it's served
 
-Mintlify hosts the built site at `executor.mintlify.dev`. The Executor Cloud
-worker reverse-proxies it onto the first-party origin at `executor.sh/docs`
-(see `apps/cloud/src/edge/docs.ts`), so the public docs live at
-`executor.sh/docs` instead of a `*.mintlify.dev` subdomain.
+Mintlify builds and hosts the site at `executor.mintlify.dev`. The canonical
+public URL is `executor.sh/docs`, configured through the Mintlify project and
+the production domain's external routing settings.
 
 Mintlify is configured to host under the `/docs` subpath (Settings → Domain
-setup → **Host at /docs**), so it serves `/docs/*` paths that the proxy
-forwards unchanged. A config change like that only takes effect on the next
-build, so push a commit to `apps/docs` to redeploy.
+setup → **Host at /docs**). The docs deployment is independent of archived code
+under `legacy/`; no supported Executor runtime serves or proxies this site. A
+Mintlify config change takes effect on the next docs build.
 
 To deploy from this directory, point the Mintlify GitHub app at `apps/docs`.
diff --git a/apps/docs/cli.mdx b/apps/docs/cli.mdx
new file mode 100644
index 000000000..ea8c16805
--- /dev/null
+++ b/apps/docs/cli.mdx
@@ -0,0 +1,44 @@
+---
+title: Rust CLI
+description: "Use the supported executor binary as a client for an already-running self-hosted server."
+---
+
+The `executor` binary contains both the self-hosted server and its command-line
+client. Client commands connect to a running server. They do not open the SQLite
+database or start another server.
+
+## Connect
+
+The default server is `http://127.0.0.1:4788`. Create an API token in the
+dashboard, then provide it through the environment:
+
+```bash
+export EXECUTOR_API_TOKEN='token-shown-by-the-dashboard'
+executor tools sources
+executor tools search 'create issue'
+```
+
+Use `--base-url` or `EXECUTOR_BASE_URL` for another instance. Remote instances
+must use HTTPS unless a separately authenticated and encrypted tunnel protects
+the complete path and you explicitly pass `--allow-insecure-http`.
+
+## Inspect and call tools
+
+```bash
+executor tools describe github.issues_create
+executor call github.issues_create '{"owner":"acme","repo":"app","title":"Bug"}'
+```
+
+Use `--json` for machine-readable output. An Ask-mode call prints and opens the
+dashboard approval URL, then waits for the administrator's decision.
+
+## MCP stdio bridge
+
+For an MCP client that launches only stdio servers, configure it to run:
+
+```bash
+executor mcp
+```
+
+The bridge forwards MCP JSON-RPC to the running authenticated `/mcp` endpoint.
+It requires `EXECUTOR_API_TOKEN` and honors `EXECUTOR_BASE_URL`.
diff --git a/apps/docs/concepts/connections.mdx b/apps/docs/concepts/connections.mdx
index 81757241e..113556a2c 100644
--- a/apps/docs/concepts/connections.mdx
+++ b/apps/docs/concepts/connections.mdx
@@ -1,11 +1,14 @@
 ---
-title: Connections
-description: "A connection is a configured instance of an integration. One integration can have many connections."
+title: "Legacy concept: connections"
+description: "The supported product stores authentication directly on each source."
 ---
 
-A **connection** is a configured instance of an [integration](/concepts/integrations).
-A single integration can have many connections: the same API authenticated for two
-different accounts, say.
+<Warning>
+  This page preserves an old term for incoming links. The active self-hosted product does not create
+  account connections beneath a source.
+</Warning>
 
-A connection doesn't have to be authenticated: public APIs and public MCP servers can be
-connected with no credentials. Executor runs tool calls in a sandbox, so the agent can never access the credentials.
+<Card title="Read about Credentials and OAuth" href="/concepts/credentials" horizontal>
+  Configure at most one encrypted static credential profile per source, with Managed OAuth available
+  for eligible sources.
+</Card>
diff --git a/apps/docs/concepts/credentials.mdx b/apps/docs/concepts/credentials.mdx
new file mode 100644
index 000000000..f44822d71
--- /dev/null
+++ b/apps/docs/concepts/credentials.mdx
@@ -0,0 +1,28 @@
+---
+title: Credentials and OAuth
+description: "Configure one encrypted static credential profile per source, with Managed OAuth for eligible sources."
+---
+
+Each [source](/concepts/sources) has at most one active static credential
+profile. For a public upstream, leave it unauthenticated. Otherwise configure
+the profile with the fields required by that source:
+
+- API key
+- Bearer token
+- Basic username and password
+- Manual OAuth access token
+
+Saving a replacement profile replaces the previous static secret
+configuration. Clearing it removes the source's static credentials. Executor
+encrypts stored secrets with the instance master key, resolves them only when
+dispatching a request, and never exposes them to the agent or JavaScript
+sandbox.
+
+Eligible OpenAPI, GraphQL, and HTTP MCP sources can also use **Managed OAuth**.
+Configure the provider and client on the source, register the exact callback
+URL shown by Executor, then select **Connect OAuth**. Access and refresh tokens
+remain encrypted on the instance. When a source supports both forms, its
+static profile takes precedence until you clear it.
+
+The signed-in administrator manages credentials. Dashboard-issued API tokens
+can discover and call tools, but cannot read or change source secrets.
diff --git a/apps/docs/concepts/integrations.mdx b/apps/docs/concepts/integrations.mdx
index 4d15343ee..cb443fd48 100644
--- a/apps/docs/concepts/integrations.mdx
+++ b/apps/docs/concepts/integrations.mdx
@@ -1,18 +1,13 @@
 ---
-title: Integrations
-description: "An integration is something Executor connects to, defined by an MCP server, an OpenAPI spec, or a GraphQL endpoint."
+title: "Legacy concept: integrations"
+description: "The supported product now calls each configured upstream a source."
 ---
 
-An **integration** is something Executor can connect to. Each integration is defined by
-a source that describes the available tools:
+<Warning>
+  This page preserves an old term for incoming links. The active self-hosted product calls each
+  configured upstream a **source**.
+</Warning>
 
-- an **MCP server**
-- an **OpenAPI** specification
-- a **GraphQL** endpoint
-
-The integration describes the catalog of tools; on its own it isn't a live, authenticated
-connection. To actually call tools, you create a [connection](/concepts/connections).
-
-<Card title="Add your first integration →" href="/local/cli" horizontal>
-  See the CLI page for adding an integration from the web UI or the CLI.
+<Card title="Read about Sources" href="/concepts/sources" horizontal>
+  Configure an MCP, OpenAPI, or GraphQL source and review its imported tools.
 </Card>
diff --git a/apps/docs/concepts/policies.mdx b/apps/docs/concepts/policies.mdx
index 85318b611..4e1159c1b 100644
--- a/apps/docs/concepts/policies.mdx
+++ b/apps/docs/concepts/policies.mdx
@@ -1,14 +1,13 @@
 ---
-title: Policies
-description: "Policies control whether each tool is always allowed, requires approval, or is blocked."
+title: "Legacy concept: policies"
+description: "The supported product controls tools with explicit tool modes."
 ---
 
-A **policy** controls what an agent can do with each tool:
+<Warning>
+  This page preserves an old term for incoming links. The active self-hosted product uses
+  **Inherit**, **Enabled**, **Ask**, and **Disabled** tool modes.
+</Warning>
 
-- **Allow**: the tool runs without interruption.
-- **Require approval**: the call pauses until a human approves it.
-- **Block**: the tool can't be called.
-
-Policies start from a sensible default derived from the integration's spec. For example,
-read-only `GET` operations on an OpenAPI spec are allowed by default, while writes can be
-set to require approval. You can tune the policy for any tool at any time.
+<Card title="Read about Tool modes" href="/concepts/tool-modes" horizontal>
+  Review the global tool set and choose when calls run, wait for approval, or remain unavailable.
+</Card>
diff --git a/apps/docs/concepts/sources.mdx b/apps/docs/concepts/sources.mdx
new file mode 100644
index 000000000..161b3930e
--- /dev/null
+++ b/apps/docs/concepts/sources.mdx
@@ -0,0 +1,24 @@
+---
+title: Sources
+description: "A source connects one MCP server, OpenAPI specification, or GraphQL API to Executor's global tool catalog."
+---
+
+A **source** is one configured upstream that contributes tools to Executor's
+global catalog:
+
+- an MCP server over Streamable HTTP
+- a trusted local MCP stdio template approved by the machine administrator
+- an OpenAPI 3.0 or 3.1 specification
+- an introspection-enabled GraphQL API
+
+The source owns its endpoint or process template, imported tool identities,
+refresh history, default tool mode, and at most one encrypted static credential
+profile. Eligible sources can also use Managed OAuth. Add a second source when
+you intentionally need a second upstream.
+
+After adding or refreshing a source, open **Tools** to review every imported
+tool before giving an agent access.
+
+<Card title="Run Executor and add your first source" href="/self-hosting" horizontal>
+  Install the supported self-hosted server, then add a source from its dashboard.
+</Card>
diff --git a/apps/docs/concepts/tool-modes.mdx b/apps/docs/concepts/tool-modes.mdx
new file mode 100644
index 000000000..5eec4e20a
--- /dev/null
+++ b/apps/docs/concepts/tool-modes.mdx
@@ -0,0 +1,23 @@
+---
+title: Tool modes
+description: "Use Inherit, Enabled, Ask, and Disabled to control the one global tool catalog."
+---
+
+Every imported tool has one effective mode:
+
+- **Inherit**: follow the source default, then the tool's built-in default.
+- **Enabled**: advertise the tool and run calls immediately.
+- **Ask**: advertise the tool, but pause each call for one administrator decision.
+- **Disabled**: hide the tool from gateway clients and reject calls.
+
+Source defaults let you change a group of tools together. A tool override takes
+priority over the source default, while **Inherit** returns that tool to the
+source and built-in behavior. Broad Enabled or Disabled changes require an
+explicit confirmation in the dashboard.
+
+Ask approvals are exact and single-use. Executor shows a structural, redacted
+argument preview, and a stale tool, source, credential, or mode revision cannot
+reuse an earlier decision.
+
+All dashboard-issued API tokens use the same global tool set. Per-token tool
+catalogs are not part of the current single-user product.
diff --git a/apps/docs/docs.json b/apps/docs/docs.json
index 3a0e19ade..8e1024e7c 100644
--- a/apps/docs/docs.json
+++ b/apps/docs/docs.json
@@ -25,19 +25,19 @@
     "groups": [
       {
         "group": "Get started",
-        "pages": ["index", "mcp-proxy"]
+        "pages": ["index"]
       },
       {
-        "group": "Local",
-        "pages": ["local/cli", "local/desktop"]
+        "group": "Run Executor",
+        "pages": ["self-hosting", "hosted/docker", "cli", "mcp-proxy"]
       },
       {
-        "group": "Hosted",
-        "pages": ["hosted/cloud", "hosted/docker", "hosted/cloudflare"]
+        "group": "Concepts",
+        "pages": ["concepts/sources", "concepts/credentials", "concepts/tool-modes"]
       },
       {
-        "group": "Concepts",
-        "pages": ["concepts/integrations", "concepts/connections", "concepts/policies"]
+        "group": "Legacy archive",
+        "pages": ["local/cli", "local/desktop", "hosted/cloud", "hosted/cloudflare"]
       }
     ]
   },
@@ -45,18 +45,18 @@
     "links": [
       {
         "label": "GitHub",
-        "href": "https://github.com/RhysSullivan/executor"
+        "href": "https://github.com/davis7dotsh/executor-fork-testing"
       }
     ],
     "primary": {
       "type": "button",
-      "label": "Open Executor",
-      "href": "https://executor.sh"
+      "label": "Install Executor",
+      "href": "/self-hosting"
     }
   },
   "footer": {
     "socials": {
-      "github": "https://github.com/RhysSullivan/executor"
+      "github": "https://github.com/davis7dotsh/executor-fork-testing"
     }
   }
 }
diff --git a/apps/docs/hosted/cloud.mdx b/apps/docs/hosted/cloud.mdx
index 15a6df662..8346f8e67 100644
--- a/apps/docs/hosted/cloud.mdx
+++ b/apps/docs/hosted/cloud.mdx
@@ -1,14 +1,14 @@
 ---
-title: Executor Cloud
-description: "Use hosted Executor Cloud: no setup, with a free tier."
+title: "Legacy: managed cloud"
+description: "Archived reference for the previous managed Executor Cloud service."
 ---
 
-Executor Cloud is the hosted version: the same catalog, auth, and policies, run for
-you. There is nothing to install or keep running, and a free tier lets you start
-right away.
+<Warning>
+  Executor Cloud is archived and is not offered as the supported product. Run Executor on your own
+  Linux or macOS host with the [native binary](/self-hosting) or use the supported [Docker
+  image](/hosted/docker).
+</Warning>
 
-Sign in at [executor.sh](https://executor.sh), then add your first
-[integration](/concepts/integrations), create a [connection](/concepts/connections),
-and point your agents at the hosted [MCP endpoint](/mcp-proxy). It is the easiest way
-to share one tool catalog across every agent you use, including cloud agents like
-ChatGPT.
+This page is retained only to identify links and configurations that refer to
+the previous managed deployment. Do not use `executor.sh` as a hosted MCP
+endpoint.
diff --git a/apps/docs/hosted/cloudflare.mdx b/apps/docs/hosted/cloudflare.mdx
index 285642d16..30aa79704 100644
--- a/apps/docs/hosted/cloudflare.mdx
+++ b/apps/docs/hosted/cloudflare.mdx
@@ -1,9 +1,15 @@
 ---
-title: Self Hosted Cloudflare
-description: "Run Executor as a single Cloudflare Worker in your own account, with Cloudflare Access for auth and D1 for storage."
+title: "Legacy: Cloudflare Worker"
+description: "Archived reference for the previous TypeScript Cloudflare Worker deployment."
 ---
 
-Executor runs as a single Cloudflare Worker. Authentication is handled entirely by
+<Warning>
+  This TypeScript Cloudflare Worker deployment is archived. It is not the supported self-hosted
+  product and does not ship the current Rust and Svelte application. Use [native
+  self-hosting](/self-hosting) or [Docker](/hosted/docker).
+</Warning>
+
+The archived deployment runs as a single Cloudflare Worker. Authentication is handled entirely by
 [Cloudflare Access](https://developers.cloudflare.com/cloudflare-one/policies/access/)
 (there is no separate app login), storage is [D1](https://developers.cloudflare.com/d1/),
 tool code runs in QuickJS inside the Worker, and the web console, API, and MCP
@@ -15,12 +21,12 @@ and you manage members and credentials in Cloudflare Access rather than in the a
 ## Prerequisites
 
 - A Cloudflare account with Workers and Zero Trust (Access) enabled.
-- The [Executor repo](https://github.com/RhysSullivan/executor) checked out, with
+- The [Executor repo](https://github.com/davis7dotsh/executor-fork-testing) checked out, with
   dependencies installed (`bun install`).
 
 ## Deploy
 
-From `apps/host-cloudflare`:
+From `legacy/host-cloudflare`:
 
 ```bash
 bunx wrangler login
diff --git a/apps/docs/hosted/docker.mdx b/apps/docs/hosted/docker.mdx
index c286aa7f1..913d7636c 100644
--- a/apps/docs/hosted/docker.mdx
+++ b/apps/docs/hosted/docker.mdx
@@ -1,95 +1,55 @@
 ---
-title: Self Hosted Docker
-description: "Run the whole Executor server in one Docker container over a SQLite file: API, MCP, auth, code execution, and the web UI."
+title: Docker self-hosting
+description: "Run the supported Executor Rust server and embedded Svelte dashboard in the published Linux container."
 ---
 
-The self-hosted image is the entire Executor server in a single container: the
-typed API, the MCP server, authentication, QuickJS code execution, and the web
-console, all in one process over a libSQL (SQLite) file. There is no external
-database, worker, or proxy to run.
+The supported Docker image contains the same Rust binary and embedded Svelte
+dashboard as the native release. It supports Linux `amd64` and `arm64`.
 
-## Run it
+## Run the published image
 
-Using the published image:
+Pin a release version for repeatable deployments. Replace `v0.1.0` with the
+version you intend to run:
 
 ```bash
-docker run -d \
-  --name executor-selfhost \
-  -p 17888:17888 \
-  -v executor-data:/data \
-  ghcr.io/rhyssullivan/executor-selfhost:latest
+docker run --detach \
+  --name executor \
+  --publish 127.0.0.1:4788:4788 \
+  --volume executor-data:/var/lib/executor \
+  ghcr.io/davis7dotsh/executor:v0.1.0
 ```
 
-Or build from a clone of the [repo](https://github.com/RhysSullivan/executor),
-from `apps/host-selfhost`:
+Open `http://127.0.0.1:4788`. On first boot, `docker logs executor` contains the
+one-time setup URL. Create the administrator, then create an API token under
+**API tokens**.
 
-```bash
-docker compose up -d --build
-```
+The `executor-data` volume contains SQLite state, WAL files when present, and
+the generated `master.key`. Stop the container before backing up the complete
+volume. The database and key are one recovery unit.
 
-No configuration is required. Open [http://localhost:17888](http://localhost:17888);
-the first person to create an account becomes the owner. After that, people join
-through single-use invite links you mint from the **Admin** page, and open signup
-is closed.
+## Build from a checkout
 
-## Storage
-
-Everything that must persist (the SQLite database and the generated encryption
-keys) lives in the data directory, mounted at **`/data`** in the container. Always
-mount a volume there so it survives restarts and upgrades:
+The root Compose file builds the supported root `Dockerfile`:
 
 ```bash
--v executor-data:/data     # named volume (what compose uses)
-# or a host path:
--v /srv/executor:/data
+docker compose up --detach --build
+docker compose logs executor
 ```
 
-Back it up by snapshotting that volume (or copying `/data`, primarily `data.db`).
-`EXECUTOR_DATA_DIR` (default `/data`) sets the directory, and `EXECUTOR_DB_PATH`
-(default `<data dir>/data.db`) sets the database file.
-
-## Environment variables
+Compose publishes the service only on host loopback and mounts the
+`executor-data` volume at `/var/lib/executor`.
 
-Everything is optional: a bare run boots a working instance. The defaults below are
-the container defaults.
+## HTTPS reverse proxy
 
-| Variable                            | Default                         | Purpose                                                                                         |
-| ----------------------------------- | ------------------------------- | ----------------------------------------------------------------------------------------------- |
-| `PORT`                              | `17888`                         | HTTP port the server listens on.                                                                |
-| `EXECUTOR_HOST`                     | `0.0.0.0`                       | Bind address. The image binds all interfaces.                                                   |
-| `EXECUTOR_DATA_DIR`                 | `/data`                         | Directory holding the database and generated keys.                                              |
-| `EXECUTOR_DB_PATH`                  | `<data dir>/data.db`            | SQLite database file.                                                                           |
-| `EXECUTOR_WEB_BASE_URL`             | auto (`http://localhost:17888`) | Public URL browsers use. Required behind a domain or TLS (see below).                           |
-| `BETTER_AUTH_SECRET`                | generated, persisted in `/data` | Session secret (32+ chars). Rotating it signs everyone out.                                     |
-| `EXECUTOR_SECRET_KEY`               | generated, persisted in `/data` | Master key encrypting stored secrets. Set it to manage it yourself.                             |
-| `EXECUTOR_BOOTSTRAP_ADMIN_EMAIL`    | unset                           | Pre-create the admin headlessly (with the password below); skips browser first-run.             |
-| `EXECUTOR_BOOTSTRAP_ADMIN_PASSWORD` | unset                           | Password for the bootstrap admin.                                                               |
-| `EXECUTOR_BOOTSTRAP_ADMIN_NAME`     | `Admin`                         | Display name for the bootstrap admin.                                                           |
-| `EXECUTOR_ORG_NAME`                 | `Default`                       | Display name of the single org every user joins.                                                |
-| `EXECUTOR_ORG_SLUG`                 | `default`                       | URL slug for that org.                                                                          |
-| `EXECUTOR_ALLOW_LOCAL_NETWORK`      | `false`                         | Allow sandboxed code to reach loopback / private addresses. Keep off unless you trust the code. |
-
-## Behind a domain or TLS
-
-<Warning>
-  Set `EXECUTOR_WEB_BASE_URL` to the exact public URL you load in the browser (scheme, host, and
-  port). If it does not match, browser logins are rejected with an invalid-origin error.
-</Warning>
+Leave the container port bound to host loopback. Set the exact browser-facing
+origin and terminate TLS in a reverse proxy on the same host:
 
 ```bash
-docker run -d \
-  -p 17888:17888 \
-  -v executor-data:/data \
-  -e EXECUTOR_WEB_BASE_URL=https://executor.example.com \
-  ghcr.io/rhyssullivan/executor-selfhost:latest
+EXECUTOR_PUBLIC_ORIGIN=https://executor.example.com docker compose up --detach
 ```
 
-For a headless deploy (CI or infra-as-code), set `EXECUTOR_BOOTSTRAP_ADMIN_EMAIL`
-and `EXECUTOR_BOOTSTRAP_ADMIN_PASSWORD` to create the admin without the browser
-setup screen.
-
-## Connect an agent
+Do not expose the raw plaintext port to an untrusted network. A private LAN
+alone does not protect dashboard sessions or MCP Bearer tokens.
 
-The server exposes a streamable-HTTP MCP endpoint at `/mcp`. Point your client at
-`http://localhost:17888/mcp` (or your public URL). See [MCP Proxy](/mcp-proxy) for
-how that endpoint exposes your integrations.
+The MCP endpoint is `/mcp`. See [MCP endpoint](/mcp-proxy) for client
+configuration.
diff --git a/apps/docs/index.mdx b/apps/docs/index.mdx
index 0b019f4fa..231ae5233 100644
--- a/apps/docs/index.mdx
+++ b/apps/docs/index.mdx
@@ -1,64 +1,65 @@
 ---
 title: Introduction
-description: "Executor is the open-source integration layer for AI agents: one catalog for every tool, shared across every agent you use."
+description: "Executor is a single-user, self-hosted tool gateway for AI agents, delivered as one Rust binary with an embedded Svelte dashboard."
 ---
 
-Configure every integration once (MCP servers, OpenAPI specs, GraphQL
-endpoints) with authentication and per-tool [policies](/concepts/policies),
-then use that same catalog from any MCP-compatible agent.
+Executor is a single-user, self-hosted tool gateway for AI agents. One Rust
+binary serves the Svelte dashboard, stores state in SQLite, exposes an MCP
+endpoint, and runs TypeScript tool workflows in isolated QuickJS workers.
+
+Add OpenAPI, GraphQL, and MCP [sources](/concepts/sources), configure each
+source's [credential profile or Managed OAuth](/concepts/credentials), and
+review its [tool modes](/concepts/tool-modes). Any MCP-compatible agent can then
+use the same global catalog.
 
 ## Get started
 
-Choose how to run Executor:
+Choose one supported deployment:
+
+- **[Native Linux or macOS](/self-hosting)**: install the release archive and run
+  the `executor` binary.
+- **[Docker](/hosted/docker)**: run the same Rust server and embedded dashboard in
+  the published Linux container.
 
-- **[CLI](/local/cli)**: a background service on your machine, from the terminal
-- **[Desktop app](/local/desktop)**: the same runtime, as a desktop app
-- **[Executor Cloud](/hosted/cloud)**: hosted, with a free tier; nothing to run yourself
-- **Self-host**: your own infrastructure, via [Docker](/hosted/docker) or [Cloudflare](/hosted/cloudflare)
+Windows is not a native release target. The previous npm CLI, Electron desktop
+app, managed cloud service, and Cloudflare Worker are retained only in the
+**Legacy archive** section of these docs.
 
 ## Set up with your agent
 
 Prefer to let your coding agent do the setup? Copy this prompt and paste it into
 Claude, Cursor, or any MCP-capable agent. It will help you pick the right form
-of Executor, install it, connect over MCP, and get your first integration
+of Executor, install it, connect over MCP, and get your first source
 working.
 
 ```text Setup prompt
-Help me set up Executor and get my first connection working.
-
-Executor is an open source integration layer for AI agents: one place to configure every integration (MCP servers, OpenAPI specs, GraphQL APIs) and connect to them over MCP.
-
-Start by helping me pick the right form to run it in. Chat with me about it rather than jumping straight to a yes/no question, and recommend one. If I just want the fastest path, suggest Executor Cloud (free tier, nothing to install). All forms expose the same functionality, just packaged differently:
+Help me set up Executor and get my first source working.
 
-Local (everything stays on my machine):
-- Desktop app: a native app for Mac, Windows, and Linux. Best for a regular desktop environment.
-- CLI (`executor`): best for a headless or server environment.
-Both run a local HTTP server as a background service that any MCP client can connect to.
+Executor is an open source gateway for sources and tools. It turns MCP servers, OpenAPI specifications, and GraphQL APIs into one global tool catalog exposed through one MCP endpoint.
 
-Hosted (use it from multiple agents, including cloud ones, with nothing running locally):
-- Executor Cloud: hosted, generous free tier, sign in and start immediately.
-- Self-hosted: a Docker image or a Cloudflare Worker.
+Executor is a single-user, self-hosted tool gateway. The supported product is one Rust binary with an embedded Svelte dashboard and SQLite state. It is available as native Linux and macOS archives, or as a Linux Docker image. Windows is not a native release target. Do not install the archived npm CLI, Electron desktop app, managed cloud service, or Cloudflare Worker.
 
-How to think about it:
-- Want all your data on your own machine? Go local: the desktop app for a regular environment, the CLI for a headless one.
-- Want to use it from multiple agents (including cloud agents like ChatGPT), or not run anything locally? Go hosted: Executor Cloud is the fastest start; the self-hosted Docker or Cloudflare versions give you full control.
+Help me choose between the native release and Docker:
+- Native: best for a Linux or macOS machine where I want a normal executable and local service management.
+- Docker: best when I already operate containers or need a Linux container deployment.
 
 Terms you'll come across:
-- Integration: anything you add (an MCP server, an OpenAPI spec, a GraphQL API).
-- Connection: one configured instance of an integration. An integration can have many connections, and a connection doesn't have to be authenticated.
-- Policy: whether each tool is always allowed, requires approval, or is blocked. Policies start from a sensible default derived from the imported spec (for example, GET requests on an OpenAPI spec are allowed by default).
+- Source: one configured MCP server, OpenAPI specification, or GraphQL API. A source owns its imported tools and at most one encrypted static credential profile. Eligible sources can also use Managed OAuth.
+- Credential profile: the source-owned API key, bearer token, basic credentials, or manual OAuth token. Saving a replacement profile replaces the old one.
+- Tool mode: Inherit follows the source and built-in defaults. Enabled runs immediately, Ask waits for the administrator, and Disabled is unavailable to gateway clients.
 
 Once you know which form I want:
-1. Walk me through installing it.
-2. Connect Executor to you over MCP. Most MCP clients only load servers at startup, so after adding it I may need to restart the client or open a new chat before the Executor tools appear. Tell me if that's needed and wait for me to do it before continuing.
-3. Once the tools are available, help me add my first integration and get one tool working end to end.
+1. Follow https://executor.sh/docs/self-hosting or https://executor.sh/docs/hosted/docker.
+2. Start the server, open its one-time setup URL, create the administrator, and create an API token in the dashboard.
+3. Connect to the Streamable HTTP MCP endpoint at the instance origin plus `/mcp`, using the API token as a Bearer token. If the client supports only stdio, configure it to launch `executor mcp` with `EXECUTOR_API_TOKEN` set.
+4. Help me add my first source, review its tool modes, and get one tool working end to end.
 
 Docs: https://executor.sh/docs
-Source (and the place to start if something breaks): https://github.com/RhysSullivan/executor
+Source (and the place to start if something breaks): https://github.com/davis7dotsh/executor-fork-testing
 ```
 
 ## Concepts
 
-- **[Integrations](/concepts/integrations)**: what Executor connects to
-- **[Connections](/concepts/connections)**: configured instances of an integration
-- **[Policies](/concepts/policies)**: what each tool is allowed to do
+- **[Sources](/concepts/sources)**: OpenAPI, GraphQL, MCP HTTP, and trusted MCP stdio upstreams
+- **[Credentials and OAuth](/concepts/credentials)**: source-owned authentication
+- **[Tool modes](/concepts/tool-modes)**: Inherit, Enabled, Ask, and Disabled behavior
diff --git a/apps/docs/local/cli.mdx b/apps/docs/local/cli.mdx
index 062357432..2c2627272 100644
--- a/apps/docs/local/cli.mdx
+++ b/apps/docs/local/cli.mdx
@@ -1,111 +1,41 @@
 ---
-title: CLI
-description: "Run Executor as a local background service and drive it from the command line."
+title: "Legacy: npm CLI"
+description: "Archived reference for the previous TypeScript npm CLI. It is not the supported Executor product."
 ---
 
-The CLI runs a small HTTP runtime on your machine: a durable background service
-that any MCP-compatible agent can connect to. Your integrations, credentials, and
-policies stay local.
-
-## Install
-
-Requires Node.js 20 or newer.
-
-<CodeGroup>
-
-```bash npm
-npm install -g executor
-```
-
-```bash pnpm
-pnpm add -g executor
-```
-
-```bash bun
-bun add -g executor
-```
-
-```bash yarn
-yarn global add executor
-```
-
-</CodeGroup>
-
-## Start the service
-
-Install the durable background service, then open the web UI:
-
-```bash
-executor install   # install/start the durable background service
-executor web        # open the web UI at http://127.0.0.1:17888
-```
-
-`executor install` registers Executor so it keeps running across restarts. For a
-throwaway foreground runtime instead, run `executor web --foreground`.
-
-## Connect an agent
-
-Add Executor to any MCP client (Claude Code, Cursor, OpenCode) with `npx add-mcp`.
-It detects the client and writes its config for you. Connect over HTTP or through
-the CLI:
-
-<Tabs>
-  <Tab title="HTTP">
-    Executor serves a streamable-HTTP MCP endpoint at `http://127.0.0.1:17888/mcp`:
-
-    ```bash
-    npx add-mcp http://127.0.0.1:17888/mcp --transport http --name executor
-    ```
-
-    The **Connect** card in the web UI shows this command with your exact URL
-    (and port, if it differs) already filled in.
-
-  </Tab>
-  <Tab title="CLI (stdio)">
-    With the `executor` CLI on your PATH, the client launches `executor mcp`
-    directly (no URL needed):
-
-    ```bash
-    npx add-mcp "executor mcp" --name executor
-    ```
-
-  </Tab>
-</Tabs>
-
-## Add an integration
-
-From the web UI, click **Add Source** and paste an OpenAPI, GraphQL, or MCP URL.
-Executor detects the type, indexes the tools, and handles auth. Or add one from the
-CLI:
-
-```bash
-executor call executor openapi addSource '{
-  "spec": "https://petstore3.swagger.io/api/v3/openapi.json",
-  "namespace": "petstore",
-  "baseUrl": "https://petstore3.swagger.io/api/v3"
-}'
-```
-
-Use `baseUrl` when the OpenAPI document has relative `servers` entries (e.g. `"/api/v3"`).
-
-Confirm it's live:
-
-```bash
-executor tools sources   # lists configured integrations + tool counts
-```
-
-## Call tools
-
-```bash
-executor tools search "send email"      # find tools by intent
-executor call github issues --help      # browse a namespace
-executor call github issues create '{"owner":"octocat","repo":"Hello-World","title":"Hi"}'
-```
-
-`executor call`, `executor resume`, and `executor tools …` auto-start the local
-daemon if it isn't already running. If an execution pauses for auth or approval,
-resume it:
-
-```bash
-executor resume --execution-id exec_123
-```
+<Warning>
+  The TypeScript npm CLI is retired and unsupported. Historical registry artifacts may still
+  resolve, but they are no longer updated. Do not use them for a new installation. Install the
+  current Rust binary through [native self-hosting](/self-hosting), then use its [Rust CLI](/cli).
+</Warning>
+
+This page preserves context for repositories and old configuration files that
+mention the previous npm-distributed CLI. It is an archive, not an installation
+or operations guide.
+
+## What the archived CLI did
+
+The TypeScript CLI previously installed a local daemon, opened a React web UI,
+configured MCP clients with a helper package, and auto-started the daemon for
+some commands. It used the earlier integrations, connections, and policies
+model. Those commands, package releases, and background-service workflows are
+not part of the supported product.
+
+Existing references to the old package should be treated as migration clues
+only. Do not install a cached package or reuse its daemon and web commands for a
+new Executor instance.
+
+## Use the supported product
+
+1. Install and start the current single-user Rust server through [native
+   self-hosting](/self-hosting), or use the supported [Docker image](/hosted/docker).
+2. Open the one-time setup URL, create the administrator, and issue an API token
+   from the dashboard.
+3. Use the current [Rust CLI](/cli) to search and call tools, or connect an agent
+   through the authenticated [MCP endpoint](/mcp-proxy).
+4. Recreate old upstream configuration as OpenAPI, GraphQL, MCP HTTP, or trusted
+   MCP stdio [sources](/concepts/sources). Configure credentials on each source
+   and review its [tool modes](/concepts/tool-modes).
+
+The current Rust CLI does not auto-start the server or reuse the archived local
+daemon. Follow the linked supported guides for exact commands and ports.
diff --git a/apps/docs/local/desktop.mdx b/apps/docs/local/desktop.mdx
index b8a8a822c..2334bb3a2 100644
--- a/apps/docs/local/desktop.mdx
+++ b/apps/docs/local/desktop.mdx
@@ -1,9 +1,14 @@
 ---
-title: Desktop app
-description: "Run Executor locally with a native desktop app: a graphical console that runs alongside the CLI."
+title: "Legacy: Electron desktop app"
+description: "Archived reference for the previous Electron desktop application."
 ---
 
-The desktop app is Executor running locally with a graphical console in a native
+<Warning>
+  The Electron desktop application is archived and is not a supported release target. Use the
+  current [native Rust binary](/self-hosting), which serves its Svelte dashboard in the browser.
+</Warning>
+
+The archived desktop app is Executor running locally with a graphical console in a native
 window. It's a companion to the [CLI](/local/cli), not a replacement: both drive the
 same local background service, so you can use them at the same time.
 
diff --git a/apps/docs/mcp-proxy.mdx b/apps/docs/mcp-proxy.mdx
index c142f31b3..6810f7367 100644
--- a/apps/docs/mcp-proxy.mdx
+++ b/apps/docs/mcp-proxy.mdx
@@ -1,58 +1,71 @@
 ---
-title: MCP Proxy
-description: "Executor is one MCP endpoint in front of all your integrations: connect once, and every agent gets the same catalog with shared auth and policies."
+title: MCP endpoint
+description: "Connect an MCP client to the supported self-hosted Executor server over Streamable HTTP or the local stdio bridge."
 ---
 
-Executor sits between your agents and your tools as a single MCP endpoint. Your
-agents connect to Executor; Executor connects out to your integrations and
-re-exposes them as one catalog. Every tool call passes through the proxy, which is
-where auth and policy live.
-
-## Why proxy through Executor
-
-- **One endpoint, every agent.** Point Claude Code, Cursor, ChatGPT, or your own
-  SDK at the same Executor endpoint instead of configuring each tool in each client.
-- **Credentials stay out of the agent.** A [connection](/concepts/connections)'s
-  credentials are stored by Executor and attached to the upstream call. The agent
-  runs in a sandbox and never sees them.
-- **Per-tool policies.** Every call is governed by a [policy](/concepts/policies):
-  allow, require approval, or block.
-- **Mix [integration types](/concepts/integrations).** Upstream MCP servers, OpenAPI
-  specs, and GraphQL endpoints all show up in the same catalog.
-
-## How it works
-
-```mermaid
-flowchart LR
-  A[Your agents] -->|MCP| E[Executor]
-  E -->|MCP| M[Upstream MCP servers]
-  E -->|HTTP| O[OpenAPI APIs]
-  E -->|HTTP| G[GraphQL endpoints]
+Executor sits between your agents and your tools as one authenticated MCP
+endpoint. Agents connect to Executor, while Executor connects to OpenAPI,
+GraphQL, and upstream MCP sources. Tool modes, approval, credentials, and
+invocation logs stay under the self-hosted instance's control.
+
+## Streamable HTTP
+
+The endpoint is the instance origin plus `/mcp`, such as
+`http://127.0.0.1:4788/mcp`. Create an API token in the dashboard and send it as
+a Bearer token on every MCP request:
+
+```text
+Authorization: Bearer <EXECUTOR_API_TOKEN>
 ```
 
-Agents speak MCP to Executor. For each tool call, Executor picks the right
-integration, attaches that connection's credentials to the upstream request,
-enforces the tool's policy, and returns the result. The agent only ever talks to
-Executor, and the credentials never reach it.
+MCP client configuration schemas differ, but the common shape is:
 
-## Proxy an upstream MCP server
+```json
+{
+  "mcpServers": {
+    "executor": {
+      "type": "http",
+      "url": "http://127.0.0.1:4788/mcp",
+      "headers": {
+        "Authorization": "Bearer <EXECUTOR_API_TOKEN>"
+      }
+    }
+  }
+}
+```
 
-Add an MCP server as an [integration](/concepts/integrations) and its tools join
-your catalog alongside everything else. Create a [connection](/concepts/connections)
-to it (with credentials if it needs them), and it becomes reachable through your one
-Executor endpoint, governed by the same policies as the rest of your tools.
+Use HTTPS for a remote origin. A private LAN alone does not protect a reusable
+Bearer token.
 
-This is the core of the proxy: your agents keep talking to a single endpoint while
-you add, swap, or remove upstream servers behind it, with no client-side change.
+## Local stdio bridge
+
+If a client launches only stdio MCP servers, configure it to run the same
+supported binary in bridge mode:
+
+```json
+{
+  "mcpServers": {
+    "executor": {
+      "command": "/absolute/path/to/executor",
+      "args": ["mcp"],
+      "env": {
+        "EXECUTOR_API_TOKEN": "<EXECUTOR_API_TOKEN>"
+      }
+    }
+  }
+}
+```
 
-## Connect your agents
+The bridge connects to `http://127.0.0.1:4788` by default. Set
+`EXECUTOR_BASE_URL` when the server uses another origin. The server must already
+be running.
 
-Agents connect to Executor's MCP endpoint. The exact command depends on how you run
-Executor:
+## What clients see
 
-- **Local:** see [CLI](/local/cli) for `executor mcp` and the `add-mcp` command.
-- **Hosted:** see [Executor Cloud](/hosted/cloud), or self-host on
-  [Docker](/hosted/docker) or [Cloudflare](/hosted/cloudflare).
+Enabled and Ask tools from every configured source appear in the instance's
+global catalog. Disabled tools are not advertised. Ask calls pause for the
+administrator's decision, and credentials are resolved by Executor instead of
+being exposed to the MCP client.
 
-Once a client is connected, every integration you add to Executor appears in that
-agent automatically.
+Start with [native self-hosting](/self-hosting), [Docker](/hosted/docker), or the
+[Rust CLI](/cli).
diff --git a/apps/docs/self-hosting.mdx b/apps/docs/self-hosting.mdx
new file mode 100644
index 000000000..0c69f103f
--- /dev/null
+++ b/apps/docs/self-hosting.mdx
@@ -0,0 +1,68 @@
+---
+title: Native self-hosting
+description: "Install and run the supported Executor Rust binary on Linux or macOS."
+---
+
+Executor ships as one native binary with the Svelte dashboard embedded. Native
+releases support Linux and macOS on x86-64 and ARM64. Windows is not a native
+release target.
+
+## Install a release
+
+The installer downloads the matching archive, verifies its checksum, and places
+`executor` under `$HOME/.executor/bin` by default:
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/davis7dotsh/executor-fork-testing/main/scripts/install.sh | bash
+```
+
+To install a release published by another fork, set the same repository
+override used by the installer:
+
+```bash
+export EXECUTOR_REPOSITORY=owner/repository
+curl -fsSL "https://raw.githubusercontent.com/$EXECUTOR_REPOSITORY/main/scripts/install.sh" | bash
+```
+
+Start a new shell, source its configuration file, or invoke
+`$HOME/.executor/bin/executor` directly until the updated `PATH` is active.
+The installer serializes install, recovery, and uninstall under a private lock,
+and uses stock `sync` durability barriers before publishing or retiring its
+ownership state. Custom install paths cannot contain symbolic-link or writable
+ancestor components. PATH edits use the same portable shell implementation on
+Linux and macOS, with no Python runtime dependency.
+
+## First boot
+
+Choose a private data directory and start the server:
+
+```bash
+mkdir -p "$HOME/.executor-data"
+chmod 0700 "$HOME/.executor-data"
+executor server --data-dir "$HOME/.executor-data"
+```
+
+Executor binds to `127.0.0.1:4788` by default. Open the one-time setup URL
+printed by the server, create the administrator, then create an API token under
+**API tokens**. Token secrets are shown once.
+
+The data directory contains the SQLite database, WAL files when present, and
+`master.key`. Stop Executor before backing up the complete directory, and keep
+the database and key together.
+
+## Expose another origin
+
+Keep plain HTTP on loopback. When a reverse proxy exposes Executor through
+HTTPS, set the exact browser-facing origin before starting the server:
+
+```bash
+executor server \
+  --data-dir "$HOME/.executor-data" \
+  --public-origin https://executor.example.com
+```
+
+The public origin does not secure Executor's own listener. Keep that listener on
+loopback or otherwise isolate it so clients reach it only through the TLS proxy.
+
+Next, use the [Rust CLI](/cli) or connect an agent through the
+[MCP endpoint](/mcp-proxy).
diff --git a/apps/marketing/astro.config.mjs b/apps/marketing/astro.config.mjs
index 877af5b81..aa31603ba 100644
--- a/apps/marketing/astro.config.mjs
+++ b/apps/marketing/astro.config.mjs
@@ -9,7 +9,7 @@ import react from "@astrojs/react";
 import cloudflare from "@astrojs/cloudflare";
 
 // Single source of truth for public build-time vars: wrangler.toml `[vars]`.
-// Mirrors apps/cloud, which reads its wrangler.jsonc vars the same way. The
+// Mirrors legacy/cloud, which reads its wrangler.jsonc vars the same way. The
 // PUBLIC_ ones are inlined into the client bundle via Vite `define`, so the
 // browser PostHog SDK gets the key at build time; they also remain runtime
 // Worker bindings.
diff --git a/apps/marketing/package.json b/apps/marketing/package.json
index 6b3592652..74cf3cc8f 100644
--- a/apps/marketing/package.json
+++ b/apps/marketing/package.json
@@ -1,6 +1,7 @@
 {
   "name": "@executor-js/marketing",
   "version": "0.0.5",
+  "private": true,
   "type": "module",
   "scripts": {
     "dev": "bun run dev:proxy && bun run dev:vite",
diff --git a/apps/marketing/src/components/LegalLayout.astro b/apps/marketing/src/components/LegalLayout.astro
index b51755d22..255e3f57f 100644
--- a/apps/marketing/src/components/LegalLayout.astro
+++ b/apps/marketing/src/components/LegalLayout.astro
@@ -58,7 +58,7 @@ const { title, description, lastUpdated } = Astro.props;
         <a href="/privacy" class="text-ink-faint transition-colors hover:text-ink">Privacy</a>
         <a href="/terms" class="text-ink-faint transition-colors hover:text-ink">Terms</a>
         <a
-          href="https://github.com/RhysSullivan/executor"
+          href="https://github.com/davis7dotsh/executor-fork-testing"
           class="text-ink-faint transition-colors hover:text-ink"
         >
           GitHub
diff --git a/apps/marketing/src/layouts/Layout.astro b/apps/marketing/src/layouts/Layout.astro
index f7fd865e4..4a9cfd3ec 100644
--- a/apps/marketing/src/layouts/Layout.astro
+++ b/apps/marketing/src/layouts/Layout.astro
@@ -7,8 +7,8 @@ interface Props {
 }
 
 const {
-  title = 'Executor — The gateway to connect your agent to everything',
-  description = 'One place every agent plugs into every tool you already use. Wire it up once, bring the whole team.'
+  title = 'Executor: the self-hosted tool gateway for AI agents',
+  description = 'One Rust binary, one Svelte dashboard, and one MCP endpoint for the tools you run on your own infrastructure.'
 } = Astro.props
 
 const ogImage = new URL('/og-image.png', Astro.site ?? Astro.url).toString()
diff --git a/apps/marketing/src/pages/index.astro b/apps/marketing/src/pages/index.astro
index 4e977a998..ff4103be9 100644
--- a/apps/marketing/src/pages/index.astro
+++ b/apps/marketing/src/pages/index.astro
@@ -1,50 +1,40 @@
 ---
 import Layout from "../layouts/Layout.astro";
 import { AnimatedBeamDemo } from "../components/animated-beam-demo";
-import { ContextBloatDemo } from "../components/context-bloat-demo";
-import { SelfHostContactModal } from "../components/self-host-contact-modal";
 // Imported so Vite emits it as a hashed build asset (served from /_astro/...);
 // the deploy pipeline does not pick up newly added /public files.
 import ycBackedBy from "../assets/yc-backed-by.svg?url";
 
-const GH = "https://github.com/RhysSullivan/executor";
+const GH = "https://github.com/davis7dotsh/executor-fork-testing";
 
 // Copied to the clipboard by the "Set up with your agent" hero CTA. A visitor
 // pastes it into their coding agent (Claude, Cursor, ...) and the agent picks
 // the right form of Executor, installs it, connects over MCP, and gets a first
-// connection working. Keep in sync with the docs "Set up with your agent"
+// source working. Keep in sync with the docs "Set up with your agent"
 // section (apps/docs/index.mdx).
-const setupPrompt = `Help me set up Executor and get my first connection working.
+const setupPrompt = `Help me set up Executor and get my first source working.
 
-Executor is an open source integration layer for AI agents: one place to configure every integration (MCP servers, OpenAPI specs, GraphQL APIs) and connect to them over MCP.
+Executor is an open source gateway for sources and tools. It turns MCP servers, OpenAPI specifications, and GraphQL APIs into one global tool catalog exposed through one MCP endpoint.
 
-Start by helping me pick the right form to run it in. Chat with me about it rather than jumping straight to a yes/no question, and recommend one. If I just want the fastest path, suggest Executor Cloud (free tier, nothing to install). All forms expose the same functionality, just packaged differently:
+Executor is a single-user, self-hosted tool gateway. The supported product is one Rust binary with an embedded Svelte dashboard and SQLite state. It is available as native Linux and macOS archives, or as a Linux Docker image. Windows is not a native release target. Do not install the archived npm CLI, Electron desktop app, managed cloud service, or Cloudflare Worker.
 
-Local (everything stays on my machine):
-- Desktop app: a native app for Mac, Windows, and Linux. Best for a regular desktop environment.
-- CLI (\`executor\`): best for a headless or server environment.
-Both run a local HTTP server as a background service that any MCP client can connect to.
-
-Hosted (use it from multiple agents, including cloud ones, with nothing running locally):
-- Executor Cloud: hosted, generous free tier, sign in and start immediately.
-- Self-hosted: a Docker image or a Cloudflare Worker.
-
-How to think about it:
-- Want all your data on your own machine? Go local: the desktop app for a regular environment, the CLI for a headless one.
-- Want to use it from multiple agents (including cloud agents like ChatGPT), or not run anything locally? Go hosted: Executor Cloud is the fastest start; the self-hosted Docker or Cloudflare versions give you full control.
+Help me choose between the native release and Docker:
+- Native: best for a Linux or macOS machine where I want a normal executable and local service management.
+- Docker: best when I already operate containers or need a Linux container deployment.
 
 Terms you'll come across:
-- Integration: anything you add (an MCP server, an OpenAPI spec, a GraphQL API).
-- Connection: one configured instance of an integration. An integration can have many connections, and a connection doesn't have to be authenticated.
-- Policy: whether each tool is always allowed, requires approval, or is blocked. Policies start from a sensible default derived from the imported spec (for example, GET requests on an OpenAPI spec are allowed by default).
+- Source: one configured MCP server, OpenAPI specification, or GraphQL API. A source owns its imported tools and at most one encrypted static credential profile. Eligible sources can also use Managed OAuth.
+- Credential profile: the source-owned API key, bearer token, basic credentials, or manual OAuth token. Saving a replacement profile replaces the old one.
+- Tool mode: Inherit follows the source and built-in defaults. Enabled runs immediately, Ask waits for the administrator, and Disabled is unavailable to gateway clients.
 
 Once you know which form I want:
-1. Walk me through installing it.
-2. Connect Executor to you over MCP. Most MCP clients only load servers at startup, so after adding it I may need to restart the client or open a new chat before the Executor tools appear. Tell me if that's needed and wait for me to do it before continuing.
-3. Once the tools are available, help me add my first integration and get one tool working end to end.
+1. Follow https://executor.sh/docs/self-hosting or https://executor.sh/docs/hosted/docker.
+2. Start the server, open its one-time setup URL, create the administrator, and create an API token in the dashboard.
+3. Connect to the Streamable HTTP MCP endpoint at the instance origin plus \`/mcp\`, using the API token as a Bearer token. If the client supports only stdio, configure it to launch \`executor mcp\` with \`EXECUTOR_API_TOKEN\` set.
+4. Help me add my first source, review its tool modes, and get one tool working end to end.
 
 Docs: https://executor.sh/docs
-Source (and the place to start if something breaks): https://github.com/RhysSullivan/executor`;
+Source (and the place to start if something breaks): https://github.com/davis7dotsh/executor-fork-testing`;
 ---
 
 <Layout>
@@ -73,11 +63,6 @@ Source (and the place to start if something breaks): https://github.com/RhysSull
             >
           </a>
           <div class="flex items-center gap-5">
-            <a
-              href="#pricing"
-              class="text-[14px] font-medium text-ink-2 hover:text-ink transition-colors hidden sm:inline"
-              >Pricing</a
-            >
             <a
               href="https://executor.sh/docs"
               class="text-[14px] font-medium text-ink-2 hover:text-ink transition-colors hidden sm:inline"
@@ -134,8 +119,8 @@ Source (and the place to start if something breaks): https://github.com/RhysSull
 
               {/* For humans: sign up or run it yourself */}
               <div class="audience-pane" data-audience-pane="humans" role="tabpanel" hidden>
-                <a href="#install" class="btn-primary btn-primary--hero">Run locally →</a>
-                <a href="/cloud" class="btn-secondary">Try Cloud</a>
+                <a href="#install" class="btn-primary btn-primary--hero">Install Executor →</a>
+                <a href={GH} class="btn-secondary">View source</a>
               </div>
 
               {/* For agents: hand setup to a coding agent, or read the docs */}
@@ -194,31 +179,51 @@ Source (and the place to start if something breaks): https://github.com/RhysSull
             class="text-[clamp(1.5rem,3.4vw,2.2rem)] font-medium tracking-[-0.02em] leading-[1.28] text-ink text-balance"
           >
             Wiring tools to agents is fiddly, per-client, and easy to get wrong.
-            Executor makes every tool, from any protocol, look the
-            <span class="serif-italic">same</span>: one name, one input
-            schema, one output schema, so any agent can call any of them
-            the same way.
+            Executor makes every MCP, OpenAPI, and GraphQL tool look the
+            <span class="serif-italic">same</span>: one name, one input schema,
+            one output schema, so any agent can call any of them the same way.
           </p>
         </div>
       </section>
 
-      {/* ─── NO CONTEXT BLOAT (interactive) ─── */}
+      {/* ─── ONE GATEWAY ─── */}
       <section class="py-20 sm:py-28 border-t border-rule">
         <div class="reveal max-w-[1100px] mx-auto px-6 sm:px-10">
           <div class="text-center max-w-2xl mx-auto mb-12">
-            <div class="eyebrow mb-4">Context efficiency</div>
+            <div class="eyebrow mb-4">One catalog</div>
             <h2 class="section-title mx-auto max-w-[20ch] mb-5">
-              Thousands of tools, no <span class="serif-italic">bloat</span>.
+              Connect once, then decide what can <span class="serif-italic">run</span>.
             </h2>
             <p class="section-sub mx-auto max-w-[58ch]">
-              Connect everything you use and Executor still shows the model a
-              single tool. It searches your catalog and loads a tool's schema
-              only when the code actually calls it, so the prompt never
-              balloons.
+              Every supported client reaches the same catalog through one MCP
+              endpoint. Add sources in the dashboard, review their tools, and
+              keep tool-mode decisions with the server you operate.
             </p>
           </div>
 
-          <ContextBloatDemo client:load />
+          <div class="grid md:grid-cols-2 gap-6 max-w-[900px] mx-auto">
+            <div class="surface-card path-card p-8">
+              <div class="eyebrow mb-3">Stable endpoint</div>
+              <h3 class="text-[22px] font-semibold tracking-[-0.01em] text-ink mb-3">
+                One MCP address for every source
+              </h3>
+              <p class="text-[14.5px] leading-[1.6] text-ink-2 text-pretty">
+                Agents authenticate to the instance at <code>/mcp</code>. OpenAPI,
+                GraphQL, and upstream MCP tools all join the same global catalog.
+              </p>
+            </div>
+            <div class="surface-card path-card p-8">
+              <div class="eyebrow mb-3">Human control</div>
+              <h3 class="text-[22px] font-semibold tracking-[-0.01em] text-ink mb-3">
+                Inherit, Enabled, Ask, or Disabled
+              </h3>
+              <p class="text-[14.5px] leading-[1.6] text-ink-2 text-pretty">
+                Inherit follows source and built-in defaults. Enabled tools can
+                run, Ask tools pause for your decision, and Disabled tools stay
+                out of the advertised catalog.
+              </p>
+            </div>
+          </div>
         </div>
       </section>
 
@@ -246,13 +251,12 @@ Source (and the place to start if something breaks): https://github.com/RhysSull
               >
               <h3>One tool shape</h3>
               <p>
-                MCP, OpenAPI, GraphQL, or a custom integration. Under the hood
-                they all become a tool name, an input schema, and an output
-                schema.
+                MCP, OpenAPI, and GraphQL sources all become tool names, input
+                schemas, and output schemas in one catalog.
               </p>
             </div>
 
-            {/* Code-mode */}
+            {/* One supported runtime */}
             <div class="cap-card">
               <span class="cap-icon"
                 ><svg viewBox="0 0 24 24" fill="none" stroke="currentColor"
@@ -264,27 +268,26 @@ Source (and the place to start if something breaks): https://github.com/RhysSull
                     y2="19"></line></svg
                 ></span
               >
-              <h3>Call it any way</h3>
+              <h3>One binary, every surface</h3>
               <p>
-                Today it is a code-mode MCP. It could just as well be the
-                Executor CLI, a one-off script, a gen-UI dashboard, or a reusable
-                workflow. Same tools, every surface.
+                The Rust binary serves the Svelte dashboard, MCP endpoint, and
+                command-line client. Every surface uses the same SQLite-backed
+                catalog and tool-mode decisions.
               </p>
             </div>
 
-            {/* Trace every call (coming soon) */}
-            <div class="cap-card cap-card--soon">
-              <span class="cap-soon-badge">Coming soon</span>
+            {/* Review every call */}
+            <div class="cap-card">
               <span class="cap-icon"
                 ><svg viewBox="0 0 24 24" fill="none" stroke="currentColor"
                   stroke-width="1.7" stroke-linecap="round" stroke-linejoin="round"
                   ><path d="M3 12h4l3 8 4-16 3 8h4"></path></svg
                 ></span
               >
-              <h3>Trace every call</h3>
+              <h3>Review every call</h3>
               <p class="mb-1">
-                One place to see every run and tool call. Audit any
-                decision after the fact.
+                Inspect runs and tool calls from the dashboard. See inputs,
+                results, failures, and approval decisions after the fact.
               </p>
               <div class="cap-visual trace">
                 <div class="trace-row is-root">
@@ -318,7 +321,7 @@ Source (and the place to start if something breaks): https://github.com/RhysSull
               </div>
             </div>
 
-            {/* Teams */}
+            {/* Self-hosted control */}
             <div class="cap-card">
               <span class="cap-icon"
                 ><svg viewBox="0 0 24 24" fill="none" stroke="currentColor"
@@ -329,10 +332,11 @@ Source (and the place to start if something breaks): https://github.com/RhysSull
                   ></path></svg
                 ></span
               >
-              <h3>Set up once, whole team has it</h3>
+              <h3>Your gateway, under your control</h3>
               <p>
-                Per-user credentials and shared ones. No onboarding ritual, no
-                toggling MCPs on and off mid-task.
+                Run one single-user instance on your own Linux or macOS host, or
+                in Docker. State and credentials stay with the server you
+                operate.
               </p>
             </div>
 
@@ -348,8 +352,9 @@ Source (and the place to start if something breaks): https://github.com/RhysSull
               <h3>Destructive actions pull you back in</h3>
               <p>
                 Executor keeps the semantics it imported: GET vs DELETE for
-                OpenAPI, destructiveHint for MCP, mutations for GraphQL. Agents
-                auto-run the safe stuff and ask before the rest.
+                OpenAPI, destructiveHint for MCP, and mutations for GraphQL.
+                Review those defaults as Enabled, Ask, or Disabled before an
+                agent calls them.
               </p>
             </div>
 
@@ -409,85 +414,58 @@ Source (and the place to start if something breaks): https://github.com/RhysSull
             <span class="plus-mark" style="bottom:-7px;left:-7px"></span>
             <span class="plus-mark" style="bottom:-7px;right:-7px"></span>
 
-            {/* Cloud (recommended: fastest start) */}
+            {/* Native Linux and macOS */}
             <div
               class="surface-card path-card beam-card p-8 flex flex-col"
               style="border-color: rgba(99,91,255,0.25)"
             >
               <h3 class="text-[22px] font-semibold tracking-[-0.01em] text-ink mb-3">
-                Cloud
+                Native
               </h3>
-              <span class="path-chip mb-4 self-start">executor.sh/cloud</span>
-              <p class="text-[14.5px] leading-[1.55] text-ink-2 mb-3 text-pretty flex-1">
-                Hosted Executor. Auth, sync, policies, and your whole team online
-                in five minutes. Free tier to start.
+              <span class="path-chip mb-4 self-start">Linux · macOS</span>
+              <p class="text-[14.5px] leading-[1.55] text-ink-2 mb-6 text-pretty flex-1">
+                Install one checksum-verified Rust binary with the Svelte
+                dashboard embedded. Releases support x86-64 and ARM64.
               </p>
-              <a href="/cloud" class="btn-primary self-start">Try Cloud →</a>
+              <a href="https://executor.sh/docs/self-hosting" class="btn-primary self-start"
+                >Install the binary →</a
+              >
               <p class="mt-3 min-h-[1.25rem] text-[13px] leading-[1.5] text-ink-3">
-                <SelfHostContactModal client:load variant="inline" />
+                Windows is not a native release target.
               </p>
             </div>
 
-            {/* Desktop (native app, local) */}
+            {/* Docker */}
             <div class="surface-card path-card p-8 flex flex-col">
               <h3 class="text-[22px] font-semibold tracking-[-0.01em] text-ink mb-3">
-                Desktop
+                Docker
               </h3>
-              <span class="path-chip mb-4 self-start">Mac · Windows · Linux</span>
+              <span class="path-chip mb-4 self-start">linux/amd64 · linux/arm64</span>
               <p class="text-[14.5px] leading-[1.55] text-ink-2 mb-6 text-pretty flex-1">
-                A native app that runs entirely on your machine. Your
-                integrations, credentials, and sessions never leave the device.
-                MIT licensed.
+                Run the same Rust server and embedded dashboard in the published
+                Linux image, with SQLite state in a persistent volume.
               </p>
-              <div class="flex flex-col gap-3 self-stretch" data-download>
-                <a
-                  data-os="mac-arm64"
-                  href={`${GH}/releases/latest/download/executor-desktop-mac-arm64.dmg`}
-                  class="btn-primary self-start"
-                  >Download for Mac</a
-                >
-                <a
-                  data-os="mac-x64"
-                  href={`${GH}/releases/latest/download/executor-desktop-mac-x64.dmg`}
-                  class="btn-primary self-start"
-                  >Download for Mac (Intel)</a
-                >
-                <a
-                  data-os="win-x64"
-                  href={`${GH}/releases/latest/download/executor-desktop-win-x64.exe`}
-                  class="btn-primary self-start"
-                  >Download for Windows</a
-                >
-                <a
-                  data-os="linux-x64"
-                  href={`${GH}/releases/latest/download/executor-desktop-linux-x86_64.AppImage`}
-                  class="btn-primary self-start"
-                  >Download for Linux</a
-                >
-                <details class="download-other hidden min-h-[1.25rem]" data-download-other>
-                  <summary>Other platforms ▾</summary>
-                  <div class="download-other-list" data-download-other-list></div>
-                </details>
-              </div>
+              <a href="https://executor.sh/docs/hosted/docker" class="btn-primary self-start"
+                >Run with Docker →</a
+              >
             </div>
 
-            {/* CLI (headless / servers) */}
+            {/* Source */}
             <div class="surface-card path-card p-8 flex flex-col">
               <h3 class="text-[22px] font-semibold tracking-[-0.01em] text-ink mb-3">
-                CLI
+                Build from source
               </h3>
-              <span class="path-chip mb-4 self-start">npm i -g executor</span>
+              <span class="path-chip mb-4 self-start">Rust · Svelte · MIT</span>
               <p class="text-[14.5px] leading-[1.55] text-ink-2 mb-6 text-pretty flex-1">
-                Run Executor as a background service and drive it from your
-                terminal. Best for headless and server environments. MIT
-                licensed.
+                Inspect the implementation, build the embedded dashboard and
+                release binary, or adapt the self-hosted runtime for your own
+                environment.
               </p>
-              <a href="https://executor.sh/docs" class="btn-primary self-start"
-                >Read the docs →</a
-              >
+              <a href={GH} class="btn-primary self-start">View on GitHub →</a>
               <p class="mt-3 min-h-[1.25rem] text-[13px] leading-[1.5] text-ink-3">
-                <a href={GH} class="hover:text-ink-2 transition-colors"
-                  >View source →</a
+                <a
+                  href="https://executor.sh/docs/cli"
+                  class="hover:text-ink-2 transition-colors">Use the Rust CLI →</a
                 >
               </p>
             </div>
@@ -550,9 +528,9 @@ Source (and the place to start if something breaks): https://github.com/RhysSull
                 >
               </summary>
               <div class="faq-body">
-                Any MCP client (Claude Code, Cursor, Codex, and others), the
-                Executor CLI, or a native client you drop in. Because tools share
-                one shape, the calling surface is interchangeable.
+                Any Streamable HTTP MCP client can connect to the server with a
+                dashboard-issued API token. The same Rust binary also provides a
+                command-line client and an MCP stdio bridge.
               </div>
             </details>
 
@@ -569,8 +547,8 @@ Source (and the place to start if something breaks): https://github.com/RhysSull
               <div class="faq-body">
                 Executor preserves the semantics of whatever it imported: GET vs
                 DELETE for OpenAPI, destructiveHint for MCP, and mutations for
-                GraphQL. That tells the agent what it can run on its own and what
-                should pull you back into the loop.
+                GraphQL. Those defaults become explicit Inherit, Enabled, Ask,
+                or Disabled modes that you can review in the dashboard.
               </div>
             </details>
 
@@ -585,146 +563,15 @@ Source (and the place to start if something breaks): https://github.com/RhysSull
                 >
               </summary>
               <div class="faq-body">
-                Yes. Executor is MIT licensed and built on the SDK we publish to
-                npm. Run the desktop app locally, self-host the server, or use
-                the hosted cloud. Same code paths, different deployment.
+                Yes. Executor is MIT licensed and self-hosted. Run the supported
+                Rust binary on Linux or macOS, or run the same server and
+                embedded Svelte dashboard through Docker.
               </div>
             </details>
           </div>
         </div>
       </section>
 
-      {/* ─── PRICING ─── */}
-      <section id="pricing" class="py-20 sm:py-28 border-t border-rule">
-        <div class="reveal max-w-[1100px] mx-auto px-6 sm:px-10">
-          <div class="mb-14 mx-auto text-center max-w-2xl">
-            <div class="eyebrow mb-4">Pricing</div>
-            <h2 class="section-title mx-auto max-w-[20ch]">
-              Start free, pay as you <span class="serif-italic">run</span>.
-            </h2>
-          </div>
-
-          <div class="grid md:grid-cols-3 gap-6 max-w-[1000px] mx-auto items-stretch">
-            {/* Free */}
-            <div class="surface-card path-card p-8 flex flex-col">
-              <div class="flex items-center gap-2 mb-4">
-                <span class="font-mono text-[11px] uppercase tracking-[0.18em] text-ink-3"
-                  >Get started</span
-                >
-              </div>
-              <h3 class="text-[22px] font-semibold tracking-[-0.01em] text-ink mb-1">
-                Free
-              </h3>
-              <p class="text-[14px] text-ink-3 mb-5">For small teams getting started</p>
-              <div class="flex items-baseline gap-1.5 mb-6">
-                <span
-                  class="text-[40px] leading-none font-semibold tracking-[-0.02em] text-ink tabular-nums"
-                  >$0</span
-                >
-                <span class="text-[13.5px] text-ink-3">/ month</span>
-              </div>
-              <a href="/cloud" class="btn-primary self-start mb-7">Start free →</a>
-              <ul class="check-list">
-                {[
-                  "Up to 3 members",
-                  "10,000 included executions per month",
-                  "$0.20 per 1,000 additional executions",
-                  "Unlimited integrations",
-                ].map((f) => (
-                  <li>
-                    <svg viewBox="0 0 24 24" fill="none" stroke="currentColor"
-                      stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
-                      ><path d="M20 6 9 17l-5-5"></path></svg
-                    >{f}
-                  </li>
-                ))}
-              </ul>
-            </div>
-
-            {/* Team */}
-            <div
-              class="surface-card path-card beam-card p-8 flex flex-col"
-              style="border-color: rgba(99,91,255,0.25)"
-            >
-              <div class="flex items-center gap-2 mb-4">
-                <span
-                  class="font-mono text-[11px] uppercase tracking-[0.18em]"
-                  style="color: var(--color-accent)">Recommended</span
-                >
-              </div>
-              <h3 class="text-[22px] font-semibold tracking-[-0.01em] text-ink mb-1">
-                Team
-              </h3>
-              <p class="text-[14px] text-ink-3 mb-5">For growing organizations</p>
-              <div class="flex items-baseline gap-1.5 mb-6">
-                <span
-                  class="text-[40px] leading-none font-semibold tracking-[-0.02em] text-ink tabular-nums"
-                  >$150</span
-                >
-                <span class="text-[13.5px] text-ink-3">/ org / month</span>
-              </div>
-              <a href="/cloud" class="btn-primary self-start mb-7">Start Team →</a>
-              <ul class="check-list">
-                {[
-                  "Unlimited members",
-                  "250,000 included executions per month",
-                  "5 minute execution timeout",
-                  "Join by team domain",
-                  "$0.20 per 1,000 additional executions",
-                ].map((f) => (
-                  <li>
-                    <svg viewBox="0 0 24 24" fill="none" stroke="currentColor"
-                      stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
-                      ><path d="M20 6 9 17l-5-5"></path></svg
-                    >{f}
-                  </li>
-                ))}
-              </ul>
-            </div>
-
-            {/* Enterprise */}
-            <div class="surface-card path-card p-8 flex flex-col">
-              <div class="flex items-center gap-2 mb-4">
-                <span class="font-mono text-[11px] uppercase tracking-[0.18em] text-ink-3"
-                  >Custom needs</span
-                >
-              </div>
-              <h3 class="text-[22px] font-semibold tracking-[-0.01em] text-ink mb-1">
-                Enterprise
-              </h3>
-              <p class="text-[14px] text-ink-3 mb-5">For orgs with custom needs</p>
-              <div class="flex items-baseline gap-1.5 mb-6">
-                <span
-                  class="text-[40px] leading-none font-semibold tracking-[-0.02em] text-ink tabular-nums"
-                  >Custom</span
-                >
-              </div>
-              <a
-                href="mailto:rhys@executor.sh?subject=Executor%20Enterprise%20inquiry"
-                class="btn-primary self-start mb-7">Contact us →</a
-              >
-              <p class="text-[12.5px] font-medium text-ink mb-2.5">Everything in Team, plus</p>
-              <ul class="check-list">
-                {[
-                  "Self-hosted or dedicated cloud deployment support",
-                  "SSO / SAML & SCIM provisioning",
-                  "Audit logs for every tool call",
-                  "Dedicated support & onboarding",
-                  "Security reviews, DPA & SOC 2 on request",
-                ].map((f) => (
-                  <li>
-                    <svg viewBox="0 0 24 24" fill="none" stroke="currentColor"
-                      stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
-                      ><path d="M20 6 9 17l-5-5"></path></svg
-                    >{f}
-                  </li>
-                ))}
-              </ul>
-            </div>
-          </div>
-        </div>
-      </section>
-
       {/* ─── FINAL CTA ─── */}
       <section class="cta-band py-20 sm:py-24">
         <div class="reveal max-w-[760px] mx-auto px-6 sm:px-10 text-center">
@@ -741,13 +588,6 @@ Source (and the place to start if something breaks): https://github.com/RhysSull
               >Star on GitHub →</a
             >
           </div>
-          <p class="mt-5 text-[13.5px] text-ink-3">
-            or <a
-              href="/cloud"
-              class="underline underline-offset-2 hover:text-ink-2 transition-colors"
-              >try Executor Cloud →</a
-            >
-          </p>
         </div>
       </section>
 
@@ -860,85 +700,6 @@ Source (and the place to start if something breaks): https://github.com/RhysSull
   }
 </script>
 
-<script>
-  // ── Auto-detect download platform ──────────────────────────────────
-  // Shows ONE primary button matching the visitor's OS in the Desktop
-  // card; tucks the others behind an "Other platforms" popover. No-JS /
-  // unrecognised UA: all four buttons visible (still functional, just
-  // less polished).
-  type DownloadOs = "mac-arm64" | "mac-x64" | "win-x64" | "linux-x64";
-
-  type UserAgentData = {
-    readonly platform: string;
-    readonly getHighEntropyValues?: (
-      hints: ReadonlyArray<string>,
-    ) => Promise<{ readonly architecture?: string; readonly bitness?: string }>;
-  };
-
-  const detectOs = async (): Promise<DownloadOs | null> => {
-    const navAny = navigator as Navigator & {
-      readonly userAgentData?: UserAgentData;
-    };
-    const uad = navAny.userAgentData;
-    const platformRaw =
-      uad?.platform ?? navigator.platform ?? navigator.userAgent ?? "";
-    const platform = platformRaw.toLowerCase();
-    const ua = navigator.userAgent.toLowerCase();
-
-    if (platform.includes("win") || ua.includes("windows")) return "win-x64";
-    if (platform.includes("linux") || ua.includes("linux")) return "linux-x64";
-    if (platform.includes("mac") || ua.includes("mac")) {
-      // Apple Silicon vs Intel: ask client hints first, then fall back to
-      // a heuristic. Most modern Macs are arm64.
-      if (uad?.getHighEntropyValues) {
-        try {
-          const hints = await uad.getHighEntropyValues([
-            "architecture",
-            "bitness",
-          ]);
-          if (hints.architecture === "arm") return "mac-arm64";
-          if (hints.architecture === "x86") return "mac-x64";
-        } catch {}
-      }
-      return "mac-arm64";
-    }
-    return null;
-  };
-
-  void (async () => {
-    const root = document.querySelector<HTMLElement>("[data-download]");
-    if (!root) return;
-    const buttons = Array.from(
-      root.querySelectorAll<HTMLAnchorElement>("a[data-os]"),
-    );
-    const other = root.querySelector<HTMLDetailsElement>(
-      "[data-download-other]",
-    );
-    const otherList = root.querySelector<HTMLDivElement>(
-      "[data-download-other-list]",
-    );
-    if (buttons.length === 0 || !other || !otherList) return;
-
-    const detected = await detectOs();
-    if (!detected) return;
-
-    for (const btn of buttons) {
-      const os = btn.dataset.os as DownloadOs | undefined;
-      if (os && os !== detected) {
-        btn.classList.add("hidden");
-        const clone = btn.cloneNode(true) as HTMLAnchorElement;
-        clone.classList.remove(
-          "btn-primary",
-          "btn-primary--hero",
-          "hidden",
-        );
-        otherList.appendChild(clone);
-      }
-    }
-    other.classList.remove("hidden");
-  })();
-</script>
-
 <script>
   // ── Scroll reveals ─────────────────────────────────────────────────
   // Sections fade + rise into view as they enter the viewport. The
diff --git a/apps/marketing/src/pages/privacy.astro b/apps/marketing/src/pages/privacy.astro
index 49e5b0446..b4976ffda 100644
--- a/apps/marketing/src/pages/privacy.astro
+++ b/apps/marketing/src/pages/privacy.astro
@@ -5,212 +5,67 @@ import LegalLayout from "../components/LegalLayout.astro";
 
 <LegalLayout
   title="Privacy Policy"
-  description="How Executor collects, uses, stores, and shares information across the hosted service, website, and app."
-  lastUpdated="April 14, 2026"
+  description="How the self-hosted Executor application handles data."
+  lastUpdated="June 24, 2026"
 >
   <p>
-    This Privacy Policy explains how Executor, a product operated by Useful Software Company
-    (&quot;Executor,&quot; &quot;we,&quot; &quot;our,&quot; or &quot;us&quot;), handles information when you use our website, hosted cloud
-    service, desktop application, command-line tools, and related APIs and support channels (collectively, the
-    &quot;Services&quot;).
+    Executor is open-source, self-hosted software. The active project does not
+    provide an Executor-hosted cloud account, shared workspace, subscription,
+    billing service, or desktop telemetry service.
   </p>
 
+  <h2>Data stored by Executor</h2>
   <p>
-    Executor offers both local-first software and hosted cloud features. If you use the local desktop or CLI product
-    without connecting to Executor Cloud, much of your configuration may remain on your device. If you use Executor
-    Cloud, we process and store the information described below so we can authenticate users, manage organizations,
-    connect integrations, enforce policies, meter usage, and operate the service.
+    Your Executor server stores its application data in the data directory on
+    the machine you operate. This may include the administrator account,
+    sessions, hashed API tokens, source configuration, encrypted credentials,
+    OAuth grants, tool policies, approval records, and request logs.
   </p>
-
-  <p>
-    For purposes of this Privacy Policy, the business responsible for the Services is Useful Software Company, 2261
-    Market Street, San Francisco, CA 94114.
-  </p>
-
-  <h2>1. Information We Collect</h2>
-  <h3>Account and profile information</h3>
-  <p>
-    When you sign in, we receive account information from our authentication provider, including your name, email
-    address, avatar or profile picture URL, account ID, session identifiers, and organization membership information.
-  </p>
-
-  <h3>Workspace and service configuration</h3>
-  <p>We collect and store information needed to provide the Services, such as:</p>
-  <ul>
-    <li>organization and workspace names;</li>
-    <li>membership and role information;</li>
-    <li>source and integration metadata;</li>
-    <li>tool catalogs, schemas, policies, and related configuration;</li>
-    <li>secret metadata and connection settings; and</li>
-    <li>billing plan, membership, and execution-usage records.</li>
-  </ul>
-
-  <h3>Credentials, secrets, and connected-service data</h3>
   <p>
-    If you connect third-party tools or APIs, you may provide API keys, OAuth tokens, secrets, endpoint URLs, and
-    related configuration. We process that information to authenticate requests and operate your configured
-    integrations. We may also process content that passes through those integrations when you instruct Executor to make
-    a call, run code, or execute a workflow.
+    The dashboard and API use this information to authenticate requests,
+    connect the sources you configure, enforce tool policy, and show local
+    operational history. Executor does not operate a central service that
+    receives a copy of this data.
   </p>
 
-  <h3>Website inputs and support communications</h3>
+  <h2>Connections you configure</h2>
   <p>
-    If you submit a URL to our website&apos;s API detection tool, contact us by email, or otherwise communicate with us,
-    we collect the information you provide in order to respond and improve the Services.
+    Executor sends requests to MCP servers, OpenAPI endpoints, GraphQL
+    endpoints, and OAuth providers only when required by sources and actions
+    you configure. Those services receive the request information needed to
+    perform the action and apply their own privacy policies. Review an
+    upstream service before connecting credentials or invoking its tools.
   </p>
 
-  <h3>Usage, device, and diagnostic information</h3>
+  <h2>Logs, backups, and access</h2>
   <p>
-    We automatically collect technical information such as IP address, browser and device data, request metadata,
-    session cookies, product interactions, operational logs, crash reports, traces, and other diagnostics needed to
-    secure, maintain, and improve the Services.
+    The machine operator controls server access, log retention, backups,
+    network exposure, and deletion of the Executor data directory. Anyone with
+    administrator or filesystem access to that machine may be able to access
+    application data. Protect the host, the master key, generated API tokens,
+    and backups accordingly.
   </p>
 
-  <h3>Payment and subscription information</h3>
+  <h2>Website data</h2>
   <p>
-    If you subscribe to a paid plan, we and our billing providers process subscription status, plan selections, usage
-    counters, invoices, and limited payment-related metadata. Our payment partners, not Executor, generally handle full
-    payment card details.
+    This repository does not define a shared analytics or account backend for
+    the project website. A person or platform that hosts a copy of the site
+    may process ordinary web-server information under its own policy.
   </p>
 
-  <h2>2. How We Use Information</h2>
-  <p>We use the information we collect to:</p>
-  <ul>
-    <li>provide, operate, secure, and support the Services;</li>
-    <li>authenticate users and maintain sessions;</li>
-    <li>create and manage organizations, memberships, and permissions;</li>
-    <li>connect to third-party integrations and execute user-requested actions;</li>
-    <li>store and retrieve tool catalogs, policies, secrets, and workspace settings;</li>
-    <li>meter usage, manage subscriptions, and administer billing;</li>
-    <li>monitor performance, debug issues, prevent abuse, and investigate incidents;</li>
-    <li>communicate with you about the Services, updates, and support requests; and</li>
-    <li>comply with legal obligations and enforce our agreements.</li>
-  </ul>
-
-  <h2>3. Legal Bases for Processing</h2>
+  <h2>Legacy products</h2>
   <p>
-    If data protection laws such as the GDPR or UK GDPR apply, we generally process personal data because it is
-    necessary to perform our contract with you, because we have legitimate interests in operating and securing the
-    Services, because we must comply with legal obligations, or because you have given consent where consent is
-    required.
+    Previous cloud and desktop implementations are retained only as archived
+    source under <code>legacy/</code>. They are not active product offerings
+    covered by this self-hosted privacy description.
   </p>
 
-  <h2>4. How We Share Information</h2>
-  <p>We may share information in the following circumstances:</p>
-  <ul>
-    <li>with service providers that help us run the Services, including hosting, authentication, billing, logging, analytics, error monitoring, and customer-support vendors;</li>
-    <li>with third-party integrations, APIs, and tools when you direct Executor to connect to or act on those services;</li>
-    <li>with your organization administrators and authorized teammates, consistent with your workspace permissions;</li>
-    <li>in connection with a merger, financing, acquisition, reorganization, or sale of assets; and</li>
-    <li>when required to comply with law, protect rights or safety, investigate misuse, or enforce our terms.</li>
-  </ul>
-
-  <p>
-    Based on our current hosted implementation, our processors or infrastructure providers may include WorkOS
-    (authentication, organization management, and vault-backed secret workflows), Autumn (billing and subscription
-    tooling), Axiom (operational telemetry when enabled), Sentry (error monitoring when enabled), and cloud hosting and
-    database providers such as Cloudflare and PlanetScale. Our providers may change over time as the
-    Services evolve.
-  </p>
-
-  <h2>5. Cookies and Similar Technologies</h2>
-  <p>
-    We use cookies and similar technologies for essential functions such as authentication, session continuity, and
-    security. For example, Executor Cloud currently uses an HTTP-only session cookie to keep users signed in. We may
-    also use cookies or comparable storage for preference, security, performance, or diagnostic purposes.
-  </p>
-
-  <h2>6. Data Retention</h2>
-  <p>
-    We retain information for as long as reasonably necessary to provide the Services, maintain your account and
-    organization, meet contractual commitments, resolve disputes, enforce agreements, and comply with legal obligations.
-    Retention periods vary based on the type of information, the sensitivity of the data, and whether the information
-    is needed for security, billing, tax, audit, or backup purposes.
-  </p>
-
-  <p>
-    Some data may remain in backups or logs for a limited period after deletion. Session cookies may persist until they
-    expire or are cleared. If you need deletion assistance, contact us using the information below.
-  </p>
-
-  <h2>7. Security</h2>
-  <p>
-    We use reasonable administrative, technical, and organizational safeguards designed to protect information from
-    unauthorized access, loss, misuse, and alteration. Those measures include access controls, secret-management
-    workflows, encrypted transport, and monitoring. No method of transmission or storage is completely secure, so we
-    cannot guarantee absolute security.
-  </p>
-
-  <h2>8. International Data Transfers</h2>
-  <p>
-    We and our service providers may process information in countries other than your own. Where required, we use
-    appropriate safeguards for cross-border transfers.
-  </p>
-
-  <h2>9. Your Choices and Rights</h2>
-  <p>
-    Depending on where you live, you may have rights to access, correct, delete, export, or limit certain processing
-    of your personal information, or to object to processing. You may also have the right to appeal a denial of your
-    request.
-  </p>
-
-  <p>
-    You can also manage certain information directly in the product, such as organizations, memberships, sources,
-    secrets, policies, and integrations. To exercise privacy rights or request account deletion, email
-    <a href="mailto:rhys@executor.sh">rhys@executor.sh</a>.
-  </p>
-
-  <p>
-    We do not sell personal information for money, and we do not use personal information for cross-context behavioral
-    advertising as part of the current product implementation.
-  </p>
-
-  <h2>10. California Privacy Notice</h2>
-  <p>
-    If you are a California resident, this section supplements the rest of this Privacy Policy. Depending on our
-    obligations under California law, we may collect the following categories of personal information: identifiers;
-    customer records; commercial or billing information; internet or network activity; geolocation inferred from IP
-    address; professional or employment-related information you choose to provide; and sensitive personal information
-    such as account credentials or authentication data.
-  </p>
-
-  <p>
-    We collect this information from you, your devices, your organization, our service providers, and third-party
-    integrations you connect. We use it for the business and commercial purposes described in this Privacy Policy,
-    including account administration, workspace management, service delivery, security, debugging, analytics, and
-    billing.
-  </p>
-
-  <p>
-    California residents may have rights to know, access, correct, or delete certain personal information and to limit
-    certain uses of sensitive personal information, subject to exceptions. To submit a request, contact
-    <a href="mailto:rhys@executor.sh">rhys@executor.sh</a>.
-  </p>
-  <p>
-    The Services are not directed to children under 13, and we do not knowingly collect personal information from
-    children under 13. If you believe a child has provided personal information to us, contact us so we can take
-    appropriate action.
-  </p>
-
-  <h2>11. Changes to This Policy</h2>
-  <p>
-    We may update this Privacy Policy from time to time. If we make material changes, we will post the updated version
-    here and revise the &quot;Last updated&quot; date above. Your continued use of the Services after an update becomes effective
-    means the updated policy will apply going forward.
-  </p>
-
-  <h2>12. Contact</h2>
-  <p>
-    Questions or requests about this Privacy Policy can be sent to Useful Software Company at
-    <a href="mailto:rhys@executor.sh">rhys@executor.sh</a>.
-  </p>
+  <h2>Questions</h2>
   <p>
-    Useful Software Company
-    <br />
-    Attn: Rhys Sullivan
-    <br />
-    2261 Market Street
-    <br />
-    San Francisco, CA 94114
+    For questions about this project, open an issue in the
+    <a href="https://github.com/davis7dotsh/executor-fork-testing/issues"
+      >project repository</a
+    >. For data handled by a particular deployment, contact that deployment's
+    operator.
   </p>
 </LegalLayout>
diff --git a/apps/marketing/src/pages/terms.astro b/apps/marketing/src/pages/terms.astro
index 49a9b23e3..31aadb5fc 100644
--- a/apps/marketing/src/pages/terms.astro
+++ b/apps/marketing/src/pages/terms.astro
@@ -4,207 +4,61 @@ import LegalLayout from "../components/LegalLayout.astro";
 ---
 
 <LegalLayout
-  title="Terms of Service"
-  description="The rules for using Executor Cloud, the website, and related hosted products and services."
-  lastUpdated="April 14, 2026"
+  title="Terms"
+  description="Terms that apply to the self-hosted Executor project."
+  lastUpdated="June 24, 2026"
 >
   <p>
-    These Terms of Service (&quot;Terms&quot;) form a binding agreement between you and Useful Software Company, which operates
-    Executor (&quot;Executor,&quot; &quot;we,&quot; &quot;our,&quot; or &quot;us&quot;), and govern your access to and use of our website, hosted cloud
-    service, APIs, desktop and command-line software, and related services (collectively, the &quot;Services&quot;).
+    Executor is open-source, self-hosted software. The active project does not
+    offer a hosted cloud account, paid subscription, organization service, or
+    managed desktop product. Your right to copy, modify, and distribute the
+    software is governed by the license included in this repository.
   </p>
 
+  <h2>Your deployment</h2>
   <p>
-    If you use the Services on behalf of a company, organization, or other entity, you represent that you have
-    authority to bind that entity to these Terms. In that case, &quot;you&quot; means both you and that entity.
+    You are responsible for installing and operating Executor, controlling
+    access to its administrator account and API tokens, securing its host and
+    data directory, configuring retention and backups, and complying with laws
+    and policies that apply to your use.
   </p>
 
+  <h2>Tool execution</h2>
   <p>
-    For purposes of these Terms, Executor is operated by Useful Software Company, 2261 Market Street, San Francisco, CA 94114.
+    Executor can invoke external tools and APIs. Those calls may read, write,
+    delete, communicate, incur charges, or otherwise change third-party
+    systems. Review source configuration, credentials, tool modes, and
+    interactive approval rules before granting access. You are responsible for
+    actions performed through your deployment.
   </p>
 
-  <h2>1. Eligibility and Accounts</h2>
+  <h2>Third-party services</h2>
   <p>
-    You must be legally able to enter into these Terms to use the Services. You are responsible for maintaining the
-    confidentiality of your account credentials, for all activity under your account, and for ensuring that your
-    account information is accurate and current.
+    MCP servers, OpenAPI services, GraphQL services, OAuth providers, package
+    registries, and other systems connected to Executor are operated under
+    their own terms and policies. This project does not control or guarantee
+    those services.
   </p>
 
+  <h2>No hosted-service commitment</h2>
   <p>
-    Executor Cloud currently relies on third-party authentication and organization management providers. We may deny,
-    suspend, or terminate access if we reasonably believe your account is being used in violation of these Terms, in a
-    way that creates security risk, or in a way that could harm Executor, other users, or third parties.
+    Repository documentation, examples, release artifacts, and project
+    websites do not create a service-level agreement or a commitment to host,
+    monitor, back up, or support your deployment. The software is provided
+    under the warranty and liability terms in its license.
   </p>
 
-  <h2>2. The Services</h2>
+  <h2>Legacy products</h2>
   <p>
-    Executor provides infrastructure for connecting tools, APIs, credentials, and policies so users and organizations
-    can discover integrations and execute actions through agent workflows. Features may vary between local software,
-    hosted cloud products, free plans, paid plans, beta offerings, and enterprise deployments.
+    Previous cloud and desktop implementations under <code>legacy/</code> are
+    archived for reference. They are not active hosted or supported products.
   </p>
 
+  <h2>Questions</h2>
   <p>
-    We may modify, improve, add, or remove features from time to time. We may also impose or change limits on storage,
-    organization membership counts, execution volume, session duration, integration access, or other usage thresholds.
-  </p>
-
-  <h2>3. Your Content and Responsibilities</h2>
-  <p>
-    You retain ownership of the prompts, code, text, credentials, secrets, integration settings, API specifications,
-    tool configurations, metadata, and other data you submit to the Services (&quot;Customer Content&quot;).
-  </p>
-
-  <p>
-    You are solely responsible for Customer Content and for the actions taken through your account or organization. You
-    represent and warrant that:
-  </p>
-  <ul>
-    <li>you have all rights, permissions, and authority needed to provide Customer Content and connect third-party services;</li>
-    <li>your use of the Services and connected integrations will comply with applicable law, third-party terms, and internal policies;</li>
-    <li>you will not use the Services to infringe, misappropriate, or violate the rights of others; and</li>
-    <li>you understand that tool executions may trigger real external actions, including reads, writes, deletions, billing events, communications, or changes in third-party systems.</li>
-  </ul>
-
-  <h2>4. Acceptable Use</h2>
-  <p>You may not:</p>
-  <ul>
-    <li>use the Services for unlawful, fraudulent, deceptive, or abusive activity;</li>
-    <li>attempt to bypass security controls, access data you are not authorized to access, or interfere with the Services;</li>
-    <li>upload malware, perform denial-of-service activity, or use the Services to compromise systems or credentials;</li>
-    <li>use the Services to violate export controls, sanctions, privacy laws, intellectual-property rights, or contractual restrictions;</li>
-    <li>resell, sublicense, or commercially exploit the Services except as expressly authorized by us in writing; or</li>
-    <li>reverse engineer or copy the Services except to the extent such restrictions are prohibited by applicable law.</li>
-  </ul>
-
-  <h2>5. Third-Party Services</h2>
-  <p>
-    The Services are designed to connect with third-party APIs, software, models, billing vendors, authentication
-    providers, and other services. Those third-party services are not controlled by Executor, and we are not
-    responsible for their availability, security, accuracy, acts, omissions, or terms. Your use of third-party
-    services is governed by the applicable third-party terms and privacy policies.
-  </p>
-
-  <h2>6. Subscriptions, Billing, and Auto-Renewal</h2>
-  <p>
-    Some parts of the Services are offered on a free basis, while others require a paid subscription or usage-based
-    charges. Paid plans may include organization-level pricing, included member limits, included execution allowances,
-    overage charges, prepaid top-up packages, or similar billing mechanics described in the product at the time of
-    purchase.
-  </p>
-
-  <p>
-    Unless otherwise stated, paid subscriptions renew automatically for the same billing interval until canceled. You
-    authorize us and our billing providers to charge the payment method on file for recurring fees, taxes, overages,
-    add-ons, and other amounts due. You are responsible for keeping billing information accurate and current.
-  </p>
-
-  <p>
-    We may change pricing or packaging on a prospective basis. If payment cannot be completed, if charges are reversed,
-    or if amounts remain overdue, we may suspend or terminate access to paid features. Fees are non-refundable except
-    where required by law or expressly stated otherwise.
-  </p>
-
-  <h2>7. Intellectual Property</h2>
-  <p>
-    Executor and its licensors own all right, title, and interest in the Services, including the software, user
-    interface, branding, documentation, and all related intellectual-property rights, excluding Customer Content and
-    third-party materials.
-  </p>
-
-  <p>
-    Subject to these Terms, we grant you a limited, non-exclusive, non-transferable, revocable right to use the
-    Services for your internal business or personal use. If you provide feedback, suggestions, or ideas about the
-    Services, we may use them without restriction or compensation.
-  </p>
-
-  <h2>8. Beta Features</h2>
-  <p>
-    We may designate certain features as alpha, beta, preview, or early access. Those features may be incomplete, may
-    change materially, may not be supported, and may be subject to additional terms. We may suspend or discontinue beta
-    features at any time.
-  </p>
-
-  <h2>9. Suspension and Termination</h2>
-  <p>
-    You may stop using the Services at any time. We may suspend or terminate your access immediately if you violate
-    these Terms, create legal or security risk, fail to pay amounts due, or if continued service is impractical or no
-    longer commercially feasible.
-  </p>
-
-  <p>
-    Upon termination, your right to use the Services ends immediately. Sections that by their nature should survive
-    termination will survive, including payment obligations, intellectual-property provisions, disclaimers, liability
-    limitations, indemnity, dispute terms, and any licenses you granted to us under these Terms.
-  </p>
-
-  <h2>10. Disclaimer of Warranties</h2>
-  <p>
-    THE SERVICES ARE PROVIDED &quot;AS IS&quot; AND &quot;AS AVAILABLE.&quot; TO THE MAXIMUM EXTENT PERMITTED BY LAW, EXECUTOR DISCLAIMS ALL
-    WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY,
-    FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, AND QUIET ENJOYMENT. WE DO NOT WARRANT THAT THE SERVICES
-    WILL BE UNINTERRUPTED, ERROR-FREE, SECURE, OR FREE OF HARMFUL COMPONENTS, OR THAT ANY OUTPUT, TOOL EXECUTION, OR
-    THIRD-PARTY ACTION WILL BE ACCURATE, COMPLETE, OR SUITABLE FOR YOUR USE CASE.
-  </p>
-
-  <h2>11. Limitation of Liability</h2>
-  <p>
-    TO THE MAXIMUM EXTENT PERMITTED BY LAW, EXECUTOR AND ITS AFFILIATES, LICENSORS, SERVICE PROVIDERS, AND PERSONNEL
-    WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR ANY
-    LOSS OF PROFITS, REVENUE, GOODWILL, DATA, OR BUSINESS INTERRUPTION, ARISING OUT OF OR RELATED TO THE SERVICES OR
-    THESE TERMS, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
-  </p>
-
-  <p>
-    TO THE MAXIMUM EXTENT PERMITTED BY LAW, EXECUTOR&apos;S TOTAL LIABILITY FOR ALL CLAIMS ARISING OUT OF OR RELATED TO THE
-    SERVICES OR THESE TERMS WILL NOT EXCEED THE GREATER OF ONE HUNDRED U.S. DOLLARS (US$100) OR THE AMOUNTS YOU PAID TO
-    EXECUTOR FOR THE SERVICES GIVING RISE TO THE CLAIM DURING THE TWELVE MONTHS BEFORE THE CLAIM AROSE.
-  </p>
-
-  <h2>12. Indemnification</h2>
-  <p>
-    You will defend, indemnify, and hold harmless Executor and its affiliates, officers, directors, employees, and
-    agents from and against any claims, liabilities, damages, judgments, losses, costs, and expenses (including
-    reasonable attorneys&apos; fees) arising out of or related to your Customer Content, your use of the Services, your
-    connected integrations, or your violation of these Terms or applicable law.
-  </p>
-
-  <h2>13. Governing Law and Venue</h2>
-  <p>
-    These Terms are governed by the laws of the State of California, excluding its conflict-of-laws rules. Any dispute
-    arising out of or relating to these Terms or the Services will be brought exclusively in the state or federal courts
-    located in San Francisco County, California, and each party consents to the personal jurisdiction and venue of those
-    courts, except where applicable law requires otherwise.
-  </p>
-
-  <h2>14. Changes to These Terms</h2>
-  <p>
-    We may update these Terms from time to time. If we make material changes, we will post the revised Terms here and
-    update the &quot;Last updated&quot; date above. By continuing to use the Services after the updated Terms become effective,
-    you agree to the revised Terms.
-  </p>
-
-  <h2>15. General</h2>
-  <p>
-    These Terms, together with any order form, enterprise agreement, or other written terms that expressly reference
-    them, are the entire agreement between you and Executor regarding the Services and supersede any prior or
-    contemporaneous understandings on that subject. If any provision of these Terms is held unenforceable, the remaining
-    provisions will remain in effect. Our failure to enforce a provision is not a waiver of our right to do so later.
-    You may not assign these Terms without our prior written consent. We may assign these Terms in connection with a
-    merger, acquisition, corporate reorganization, or sale of assets.
-  </p>
-
-  <h2>16. Contact</h2>
-  <p>
-    Questions about these Terms can be sent to Useful Software Company at
-    <a href="mailto:rhys@executor.sh">rhys@executor.sh</a>.
-  </p>
-  <p>
-    Useful Software Company
-    <br />
-    Attn: Rhys Sullivan
-    <br />
-    2261 Market Street
-    <br />
-    San Francisco, CA 94114
+    Project questions and bug reports may be filed in the
+    <a href="https://github.com/davis7dotsh/executor-fork-testing/issues"
+      >project repository</a
+    >.
   </p>
 </LegalLayout>
diff --git a/apps/marketing/wrangler.toml b/apps/marketing/wrangler.toml
index ace9027ce..03fbb06b6 100644
--- a/apps/marketing/wrangler.toml
+++ b/apps/marketing/wrangler.toml
@@ -4,7 +4,7 @@ compatibility_flags = ["nodejs_compat"]
 
 # Public build-time vars, the single source of truth. astro.config.mjs reads the
 # PUBLIC_ ones from here and inlines them into the client bundle (same approach
-# apps/cloud uses with its wrangler.jsonc vars). phc_ is a public PostHog project
+# legacy/cloud uses with its wrangler.jsonc vars). phc_ is a public PostHog project
 # key, shipped in client JS by design, so it belongs in committed config.
 [vars]
 PUBLIC_POSTHOG_KEY = "phc_nNLrNMALpRsfrEkZovUkfMxYbcJvHnsJHeoSPavprgLL"
diff --git a/build.rs b/build.rs
new file mode 100644
index 000000000..12f583c5a
--- /dev/null
+++ b/build.rs
@@ -0,0 +1,299 @@
+use std::{
+    collections::{BTreeSet, HashSet},
+    env, fs,
+    path::{Component, Path, PathBuf},
+};
+
+use base64::{Engine as _, engine::general_purpose::STANDARD};
+use sha2::{Digest, Sha256};
+
+const WEB_DISTRIBUTION_DIRECTORY: &str = "web/build";
+const DEVELOPMENT_FIXTURE_DIRECTORY: &str = "tests/fixtures/web-assets";
+const MAX_ASSET_COUNT: usize = 4_096;
+const MAX_ASSET_BYTES: u64 = 16 * 1024 * 1024;
+const MAX_TOTAL_ASSET_BYTES: u64 = 128 * 1024 * 1024;
+const MAX_INLINE_SCRIPT_HASHES: usize = 256;
+
+fn main() {
+    println!("cargo:rerun-if-changed={WEB_DISTRIBUTION_DIRECTORY}");
+    println!("cargo:rerun-if-changed={DEVELOPMENT_FIXTURE_DIRECTORY}");
+    println!("cargo:rerun-if-env-changed=PROFILE");
+    println!("cargo:rerun-if-env-changed=EXECUTOR_WEB_ASSETS_DIR");
+
+    let profile = env::var("PROFILE").unwrap_or_default();
+    let override_directory = env::var_os("EXECUTOR_WEB_ASSETS_DIR").map(PathBuf::from);
+    let production_assets = profile != "debug" || override_directory.is_some();
+    let source = if let Some(source) = override_directory.as_deref() {
+        println!("cargo:rerun-if-changed={}", source.display());
+        source
+    } else if production_assets {
+        let source = Path::new(WEB_DISTRIBUTION_DIRECTORY);
+        if !source.join("index.html").is_file() {
+            panic!(
+                "production packaging requires {WEB_DISTRIBUTION_DIRECTORY}/index.html; run the web asset packaging step before compiling the production binary"
+            );
+        }
+        source
+    } else {
+        Path::new(DEVELOPMENT_FIXTURE_DIRECTORY)
+    };
+
+    let output = PathBuf::from(env::var_os("OUT_DIR").expect("Cargo provides OUT_DIR"));
+    let copied_assets = output.join("embedded-web-assets");
+    let _ = fs::remove_dir_all(&copied_assets);
+    fs::create_dir_all(&copied_assets).expect("embedded web asset output directory is created");
+
+    let mut relative_paths = Vec::new();
+    collect_files(source, source, &mut relative_paths);
+    relative_paths.sort();
+    if relative_paths.len() > MAX_ASSET_COUNT {
+        panic!(
+            "web asset distribution contains {} files; the maximum is {MAX_ASSET_COUNT}",
+            relative_paths.len()
+        );
+    }
+    if !relative_paths.iter().any(|path| path == "index.html") {
+        panic!("embedded web assets must include index.html");
+    }
+    let mut normalized_paths = HashSet::with_capacity(relative_paths.len());
+    for path in &relative_paths {
+        if !normalized_paths.insert(path.to_ascii_lowercase()) {
+            panic!("web assets contain duplicate case-insensitive paths: {path}");
+        }
+    }
+    if production_assets
+        && !relative_paths.iter().any(|path| {
+            path.starts_with("_app/immutable/")
+                && matches!(
+                    Path::new(path).extension().and_then(|value| value.to_str()),
+                    Some("js" | "mjs" | "css")
+                )
+        })
+    {
+        panic!(
+            "release web assets must contain at least one JavaScript or CSS file below _app/immutable"
+        );
+    }
+
+    let mut generated = format!(
+        "static EMBEDDED_WEB_ASSETS: [EmbeddedAsset; {}] = [\n",
+        relative_paths.len()
+    );
+    let mut total_bytes = 0_u64;
+    let mut content_security_policy = None;
+    for relative_path in relative_paths {
+        let asset_path = source.join(&relative_path);
+        let content = fs::read(&asset_path)
+            .unwrap_or_else(|error| panic!("could not read {}: {error}", asset_path.display()));
+        let asset_bytes = content.len() as u64;
+        if asset_bytes > MAX_ASSET_BYTES {
+            panic!(
+                "web asset {relative_path} is {asset_bytes} bytes; the per-file maximum is {MAX_ASSET_BYTES}"
+            );
+        }
+        total_bytes = total_bytes
+            .checked_add(asset_bytes)
+            .filter(|bytes| *bytes <= MAX_TOTAL_ASSET_BYTES)
+            .unwrap_or_else(|| {
+                panic!(
+                    "web asset distribution exceeds the {MAX_TOTAL_ASSET_BYTES}-byte aggregate maximum"
+                )
+            });
+        let destination = copied_assets.join(&relative_path);
+        if let Some(parent) = destination.parent() {
+            fs::create_dir_all(parent).expect("embedded web asset parent directory is created");
+        }
+        fs::write(&destination, &content).expect("web asset is copied into Cargo output");
+        if relative_path == "index.html" {
+            content_security_policy = Some(index_content_security_policy(&content));
+        }
+        let etag = format!("\"{:x}\"", Sha256::digest(&content));
+        generated.push_str("    EmbeddedAsset { path: ");
+        generated.push_str(&format!("{relative_path:?}"));
+        generated.push_str(", content: include_bytes!(concat!(env!(\"OUT_DIR\"), ");
+        generated.push_str(&format!(
+            "{:?}",
+            format!("/embedded-web-assets/{relative_path}")
+        ));
+        generated.push_str(")), etag: ");
+        generated.push_str(&format!("{etag:?}"));
+        generated.push_str(" },\n");
+    }
+    generated.push_str("];\n");
+    let content_security_policy =
+        content_security_policy.expect("embedded web assets include index.html");
+    let generated =
+        format!("static EMBEDDED_WEB_CSP: &str = {content_security_policy:?};\n{generated}");
+    fs::write(output.join("embedded_web_assets.rs"), generated)
+        .expect("embedded web asset manifest is written");
+}
+
+fn index_content_security_policy(index: &[u8]) -> String {
+    let hashes = inline_script_hashes(index);
+    let mut script_source = String::from("script-src 'self'");
+    for hash in hashes {
+        script_source.push_str(" 'sha256-");
+        script_source.push_str(&hash);
+        script_source.push('\'');
+    }
+    format!(
+        "default-src 'none'; base-uri 'none'; connect-src 'self'; font-src 'self'; form-action 'self'; frame-ancestors 'none'; img-src 'self' data:; manifest-src 'self'; object-src 'none'; {script_source}; style-src 'self' 'unsafe-inline'; worker-src 'self'"
+    )
+}
+
+fn inline_script_hashes(index: &[u8]) -> BTreeSet<String> {
+    const OPEN: &[u8] = b"<script";
+    const CLOSE: &[u8] = b"</script";
+
+    let mut hashes = BTreeSet::new();
+    let mut cursor = 0;
+    loop {
+        let next_open = find_ascii_tag(index, OPEN, cursor);
+        let next_close = find_ascii_tag(index, CLOSE, cursor);
+        match (next_open, next_close) {
+            (None, None) => break,
+            (None, Some(_)) => panic!("index.html contains a closing script tag without an opener"),
+            (Some(open), Some(close)) if close < open => {
+                panic!("index.html contains a closing script tag without an opener")
+            }
+            (Some(open), _) => {
+                let open_end = index[open + OPEN.len()..]
+                    .iter()
+                    .position(|byte| *byte == b'>')
+                    .map(|offset| open + OPEN.len() + offset)
+                    .unwrap_or_else(|| panic!("index.html contains an unclosed script opener"));
+                let body_start = open_end + 1;
+                let close = find_ascii_tag(index, CLOSE, body_start)
+                    .unwrap_or_else(|| panic!("index.html contains an unclosed script body"));
+                let close_end = index[close + CLOSE.len()..]
+                    .iter()
+                    .position(|byte| *byte == b'>')
+                    .map(|offset| close + CLOSE.len() + offset)
+                    .unwrap_or_else(|| panic!("index.html contains an unclosed script closer"));
+                if !index[close + CLOSE.len()..close_end]
+                    .iter()
+                    .all(|byte| byte.is_ascii_whitespace())
+                {
+                    panic!("index.html contains a malformed closing script tag");
+                }
+
+                hashes.insert(STANDARD.encode(Sha256::digest(&index[body_start..close])));
+                if hashes.len() > MAX_INLINE_SCRIPT_HASHES {
+                    panic!(
+                        "index.html contains more than {MAX_INLINE_SCRIPT_HASHES} distinct script bodies"
+                    );
+                }
+                cursor = close_end + 1;
+            }
+        }
+    }
+    hashes
+}
+
+fn find_ascii_tag(input: &[u8], tag: &[u8], start: usize) -> Option<usize> {
+    if tag.len() > input.len() {
+        return None;
+    }
+    (start..=input.len() - tag.len()).find(|position| {
+        input[*position..*position + tag.len()].eq_ignore_ascii_case(tag)
+            && input
+                .get(*position + tag.len())
+                .is_none_or(|byte| byte.is_ascii_whitespace() || matches!(*byte, b'>' | b'/'))
+    })
+}
+
+fn collect_files(root: &Path, directory: &Path, files: &mut Vec<String>) {
+    let mut entries = fs::read_dir(directory)
+        .unwrap_or_else(|error| panic!("could not read {}: {error}", directory.display()))
+        .collect::<Result<Vec<_>, _>>()
+        .unwrap_or_else(|error| panic!("could not enumerate {}: {error}", directory.display()));
+    entries.sort_by_key(|entry| entry.file_name());
+
+    for entry in entries {
+        let file_type = entry.file_type().unwrap_or_else(|error| {
+            panic!("could not inspect {}: {error}", entry.path().display())
+        });
+        if file_type.is_symlink() {
+            panic!(
+                "web assets cannot contain symbolic links: {}",
+                entry.path().display()
+            );
+        }
+        if file_type.is_dir() {
+            collect_files(root, &entry.path(), files);
+        } else if file_type.is_file() {
+            let entry_path = entry.path();
+            let relative_path = entry_path
+                .strip_prefix(root)
+                .expect("asset remains below its root");
+            validate_asset_path(relative_path);
+            files.push(
+                relative_path
+                    .to_str()
+                    .unwrap_or_else(|| {
+                        panic!("web asset path is not UTF-8: {}", entry_path.display())
+                    })
+                    .replace('\\', "/"),
+            );
+        }
+    }
+}
+
+fn validate_asset_path(path: &Path) {
+    for component in path.components() {
+        if !matches!(component, Component::Normal(_)) {
+            panic!(
+                "web asset path contains an unsafe component: {}",
+                path.display()
+            );
+        }
+        let component = component
+            .as_os_str()
+            .to_str()
+            .unwrap_or_else(|| panic!("web asset path is not UTF-8: {}", path.display()));
+        if component.starts_with('.')
+            || component.contains('\\')
+            || component.contains('%')
+            || component.chars().any(char::is_control)
+        {
+            panic!(
+                "web asset path contains a hidden or unsafe component: {}",
+                path.display()
+            );
+        }
+    }
+
+    let extension = path.extension().and_then(|extension| extension.to_str());
+    let allowed = matches!(
+        extension,
+        Some(
+            "html"
+                | "css"
+                | "js"
+                | "mjs"
+                | "json"
+                | "svg"
+                | "png"
+                | "jpg"
+                | "jpeg"
+                | "gif"
+                | "webp"
+                | "avif"
+                | "ico"
+                | "woff"
+                | "woff2"
+                | "ttf"
+                | "otf"
+                | "txt"
+                | "xml"
+                | "webmanifest"
+                | "wasm"
+        )
+    );
+    if !allowed {
+        panic!(
+            "web asset has an unsupported extension (source maps and secret/config files are not embedded): {}",
+            path.display()
+        );
+    }
+}
diff --git a/bun.lock b/bun.lock
index 45eda1c58..a462b61a6 100644
--- a/bun.lock
+++ b/bun.lock
@@ -5,19 +5,17 @@
     "": {
       "name": "executor-workspace",
       "devDependencies": {
-        "@changesets/changelog-github": "^0.7.0",
-        "@changesets/cli": "^2.30.0",
         "@effect/language-service": "^0.85.1",
         "@effect/tsgo": "^0.5.2",
         "@effect/vitest": "catalog:",
         "@typescript/native-preview": "^7.0.0-dev.20260410.1",
-        "@vitest/expect": "catalog:",
-        "@vitest/mocker": "catalog:",
-        "@vitest/pretty-format": "catalog:",
-        "@vitest/runner": "catalog:",
-        "@vitest/snapshot": "catalog:",
-        "@vitest/spy": "catalog:",
-        "@vitest/utils": "catalog:",
+        "@vitest/expect": "4.1.9",
+        "@vitest/mocker": "4.1.9",
+        "@vitest/pretty-format": "4.1.9",
+        "@vitest/runner": "4.1.9",
+        "@vitest/snapshot": "4.1.9",
+        "@vitest/spy": "4.1.9",
+        "@vitest/utils": "4.1.9",
         "atmn": "^1.1.8",
         "effect": "catalog:",
         "knip": "^6.3.0",
@@ -25,10 +23,118 @@
         "oxlint": "^1.56.0",
         "turbo": "^2.5.6",
         "typescript": "^5.9.3",
+        "vitest": "4.1.9",
+      },
+    },
+    "apps/marketing": {
+      "name": "@executor-js/marketing",
+      "version": "0.0.5",
+      "dependencies": {
+        "@astrojs/cloudflare": "^13.0.0",
+        "@astrojs/react": "^5.0.4",
+        "@executor-js/react": "workspace:*",
+        "@tailwindcss/vite": "^4.2.2",
+        "astro": "^6.1.3",
+        "clsx": "^2.1.1",
+        "motion": "^12.38.0",
+        "posthog-js": "^1.372.5",
+        "react": "^19.2.5",
+        "react-dom": "^19.2.5",
+        "react-tweet": "^3.3.0",
+        "tailwind-merge": "^3.5.0",
+        "tailwindcss": "^4.2.2",
+      },
+      "devDependencies": {
+        "@rhyssul/portless": "^0.13.0",
+        "@types/react": "^19.2.14",
+        "@types/react-dom": "^19.2.3",
+        "wrangler": "^4.0.0",
+      },
+    },
+    "e2e": {
+      "name": "@executor-js/e2e",
+      "version": "0.0.17",
+      "dependencies": {
+        "@executor-js/api": "workspace:*",
+        "@executor-js/emulate": "^0.7.5",
+        "@executor-js/mcporter": "^0.11.4",
+        "@executor-js/plugin-graphql": "workspace:*",
+        "@executor-js/plugin-mcp": "workspace:*",
+        "@executor-js/plugin-microsoft": "workspace:*",
+        "@executor-js/plugin-openapi": "workspace:*",
+        "@executor-js/plugin-toolkits": "workspace:*",
+        "@executor-js/sdk": "workspace:*",
+        "@kitlangton/terminal-control": "^0.3.0",
+        "@modelcontextprotocol/sdk": "^1.29.0",
+        "asciinema-player": "^3.15.1",
+        "effect": "catalog:",
+        "monaco-editor": "^0.55.1",
+        "playwright": "^1.60.0",
+        "react": "catalog:",
+        "react-dom": "catalog:",
+      },
+      "devDependencies": {
+        "@effect/vitest": "catalog:",
+        "@executor-js/motel": "0.2.5-executor.1",
+        "@types/node": "^25.9.2",
+        "@types/react": "catalog:",
+        "@types/react-dom": "catalog:",
+        "@vitejs/plugin-react": "catalog:",
+        "graphql": "^16.12.0",
+        "iron-webcrypto": "^2.0.0",
+        "typescript": "catalog:",
+        "vite": "catalog:",
         "vitest": "catalog:",
       },
     },
-    "apps/cli": {
+    "examples/all-plugins": {
+      "name": "@executor-js/example-all-plugins",
+      "version": "0.0.38",
+      "dependencies": {
+        "@executor-js/plugin-file-secrets": "workspace:*",
+        "@executor-js/plugin-google": "workspace:*",
+        "@executor-js/plugin-graphql": "workspace:*",
+        "@executor-js/plugin-keychain": "workspace:*",
+        "@executor-js/plugin-mcp": "workspace:*",
+        "@executor-js/plugin-onepassword": "workspace:*",
+        "@executor-js/plugin-openapi": "workspace:*",
+        "@executor-js/plugin-workos-vault": "workspace:*",
+        "@executor-js/sdk": "workspace:*",
+        "effect": "catalog:",
+      },
+      "devDependencies": {
+        "@types/node": "catalog:",
+        "typescript": "latest",
+      },
+    },
+    "examples/docs-sdk-quickstart": {
+      "name": "@executor-js/example-docs-sdk-quickstart",
+      "version": "0.0.23",
+      "dependencies": {
+        "@executor-js/plugin-openapi": "workspace:*",
+        "@executor-js/sdk": "workspace:*",
+        "effect": "catalog:",
+      },
+      "devDependencies": {
+        "@types/node": "catalog:",
+        "typescript": "catalog:",
+      },
+    },
+    "examples/promise-sdk": {
+      "name": "@executor-js/example-promise-sdk",
+      "version": "0.0.2",
+      "dependencies": {
+        "@executor-js/plugin-graphql": "workspace:*",
+        "@executor-js/plugin-mcp": "workspace:*",
+        "@executor-js/plugin-openapi": "workspace:*",
+        "@executor-js/sdk": "workspace:*",
+      },
+      "devDependencies": {
+        "@types/node": "catalog:",
+        "typescript": "latest",
+      },
+    },
+    "legacy/cli": {
       "name": "executor",
       "version": "1.5.20",
       "bin": {
@@ -53,7 +159,7 @@
         "vitest": "catalog:",
       },
     },
-    "apps/cloud": {
+    "legacy/cloud": {
       "name": "@executor-js/cloud",
       "version": "1.4.38",
       "dependencies": {
@@ -125,7 +231,7 @@
         "wrangler": "^4.81.0",
       },
     },
-    "apps/desktop": {
+    "legacy/desktop": {
       "name": "@executor-js/desktop",
       "version": "1.5.20",
       "dependencies": {
@@ -165,7 +271,7 @@
         "vitest": "catalog:",
       },
     },
-    "apps/host-cloudflare": {
+    "legacy/host-cloudflare": {
       "name": "@executor-js/host-cloudflare",
       "dependencies": {
         "@effect/atom-react": "catalog:",
@@ -212,7 +318,7 @@
         "wrangler": "^4.95.0",
       },
     },
-    "apps/host-selfhost": {
+    "legacy/host-selfhost": {
       "name": "@executor-js/host-selfhost",
       "version": "0.0.19",
       "dependencies": {
@@ -260,7 +366,7 @@
         "vitest": "catalog:",
       },
     },
-    "apps/local": {
+    "legacy/local": {
       "name": "@executor-js/local",
       "version": "1.4.4",
       "dependencies": {
@@ -314,114 +420,6 @@
         "vitest": "catalog:",
       },
     },
-    "apps/marketing": {
-      "name": "@executor-js/marketing",
-      "version": "0.0.5",
-      "dependencies": {
-        "@astrojs/cloudflare": "^13.0.0",
-        "@astrojs/react": "^5.0.4",
-        "@executor-js/react": "workspace:*",
-        "@tailwindcss/vite": "^4.2.2",
-        "astro": "^6.1.3",
-        "clsx": "^2.1.1",
-        "motion": "^12.38.0",
-        "posthog-js": "^1.372.5",
-        "react": "^19.2.5",
-        "react-dom": "^19.2.5",
-        "react-tweet": "^3.3.0",
-        "tailwind-merge": "^3.5.0",
-        "tailwindcss": "^4.2.2",
-      },
-      "devDependencies": {
-        "@rhyssul/portless": "^0.13.0",
-        "@types/react": "^19.2.14",
-        "@types/react-dom": "^19.2.3",
-        "wrangler": "^4.0.0",
-      },
-    },
-    "e2e": {
-      "name": "@executor-js/e2e",
-      "version": "0.0.17",
-      "dependencies": {
-        "@executor-js/api": "workspace:*",
-        "@executor-js/emulate": "^0.7.5",
-        "@executor-js/mcporter": "^0.11.4",
-        "@executor-js/plugin-graphql": "workspace:*",
-        "@executor-js/plugin-mcp": "workspace:*",
-        "@executor-js/plugin-microsoft": "workspace:*",
-        "@executor-js/plugin-openapi": "workspace:*",
-        "@executor-js/plugin-toolkits": "workspace:*",
-        "@executor-js/sdk": "workspace:*",
-        "@kitlangton/terminal-control": "^0.3.0",
-        "@modelcontextprotocol/sdk": "^1.29.0",
-        "asciinema-player": "^3.15.1",
-        "effect": "catalog:",
-        "monaco-editor": "^0.55.1",
-        "playwright": "^1.60.0",
-        "react": "catalog:",
-        "react-dom": "catalog:",
-      },
-      "devDependencies": {
-        "@effect/vitest": "catalog:",
-        "@executor-js/motel": "0.2.5-executor.1",
-        "@types/node": "^25.9.2",
-        "@types/react": "catalog:",
-        "@types/react-dom": "catalog:",
-        "@vitejs/plugin-react": "catalog:",
-        "graphql": "^16.12.0",
-        "iron-webcrypto": "^2.0.0",
-        "typescript": "catalog:",
-        "vite": "catalog:",
-        "vitest": "catalog:",
-      },
-    },
-    "examples/all-plugins": {
-      "name": "@executor-js/example-all-plugins",
-      "version": "0.0.38",
-      "dependencies": {
-        "@executor-js/plugin-file-secrets": "workspace:*",
-        "@executor-js/plugin-google": "workspace:*",
-        "@executor-js/plugin-graphql": "workspace:*",
-        "@executor-js/plugin-keychain": "workspace:*",
-        "@executor-js/plugin-mcp": "workspace:*",
-        "@executor-js/plugin-onepassword": "workspace:*",
-        "@executor-js/plugin-openapi": "workspace:*",
-        "@executor-js/plugin-workos-vault": "workspace:*",
-        "@executor-js/sdk": "workspace:*",
-        "effect": "catalog:",
-      },
-      "devDependencies": {
-        "@types/node": "catalog:",
-        "typescript": "latest",
-      },
-    },
-    "examples/docs-sdk-quickstart": {
-      "name": "@executor-js/example-docs-sdk-quickstart",
-      "version": "0.0.23",
-      "dependencies": {
-        "@executor-js/plugin-openapi": "workspace:*",
-        "@executor-js/sdk": "workspace:*",
-        "effect": "catalog:",
-      },
-      "devDependencies": {
-        "@types/node": "catalog:",
-        "typescript": "catalog:",
-      },
-    },
-    "examples/promise-sdk": {
-      "name": "@executor-js/example-promise-sdk",
-      "version": "0.0.2",
-      "dependencies": {
-        "@executor-js/plugin-graphql": "workspace:*",
-        "@executor-js/plugin-mcp": "workspace:*",
-        "@executor-js/plugin-openapi": "workspace:*",
-        "@executor-js/sdk": "workspace:*",
-      },
-      "devDependencies": {
-        "@types/node": "catalog:",
-        "typescript": "latest",
-      },
-    },
     "packages/app": {
       "name": "@executor-js/app",
       "version": "1.4.4",
@@ -1210,6 +1208,27 @@
         "vite": "catalog:",
       },
     },
+    "web": {
+      "name": "@executor-js/web",
+      "version": "0.1.0",
+      "devDependencies": {
+        "@effect/vitest": "4.0.0-beta.59",
+        "@sveltejs/adapter-static": "^3.0.10",
+        "@sveltejs/kit": "^2.67.0",
+        "@sveltejs/vite-plugin-svelte": "^7.1.2",
+        "@testing-library/svelte": "^5.4.2",
+        "effect": "4.0.0-beta.59",
+        "jsdom": "^29.1.1",
+        "oxlint": "^1.71.0",
+        "prettier": "^3.8.4",
+        "prettier-plugin-svelte": "^4.1.1",
+        "svelte": "^5.56.4",
+        "svelte-check": "^4.7.0",
+        "typescript": "^6.0.3",
+        "vite": "^8.1.0",
+        "vitest": "^4.1.9",
+      },
+    },
   },
   "patchedDependencies": {
     "libsql@0.5.29": "patches/libsql@0.5.29.patch",
@@ -1288,6 +1307,14 @@
 
     "@apidevtools/json-schema-ref-parser": ["@apidevtools/json-schema-ref-parser@11.9.3", "", { "dependencies": { "@jsdevtools/ono": "^7.1.3", "@types/json-schema": "^7.0.15", "js-yaml": "^4.1.0" } }, "sha512-60vepv88RwcJtSHrD6MjIL6Ta3SOYbgfnkHb+ppAVK+o9mXprRtulx7VlRl3lN3bbvysAfCS7WMVfhUYemB0IQ=="],
 
+    "@asamuzakjp/css-color": ["@asamuzakjp/css-color@5.1.11", "", { "dependencies": { "@asamuzakjp/generational-cache": "^1.0.1", "@csstools/css-calc": "^3.2.0", "@csstools/css-color-parser": "^4.1.0", "@csstools/css-parser-algorithms": "^4.0.0", "@csstools/css-tokenizer": "^4.0.0" } }, "sha512-KVw6qIiCTUQhByfTd78h2yD1/00waTmm9uy/R7Ck/ctUyAPj+AEDLkQIdJW0T8+qGgj3j5bpNKK7Q3G+LedJWg=="],
+
+    "@asamuzakjp/dom-selector": ["@asamuzakjp/dom-selector@7.1.1", "", { "dependencies": { "@asamuzakjp/generational-cache": "^1.0.1", "@asamuzakjp/nwsapi": "^2.3.9", "bidi-js": "^1.0.3", "css-tree": "^3.2.1", "is-potential-custom-element-name": "^1.0.1" } }, "sha512-67RZDnYRc8H/8MLDgQCDE//zoqVFwajkepHZgmXrbwybzXOEwOWGPYGmALYl9J2DOLfFPPs6kKCqmbzV895hTQ=="],
+
+    "@asamuzakjp/generational-cache": ["@asamuzakjp/generational-cache@1.0.1", "", {}, "sha512-wajfB8KqzMCN2KGNFdLkReeHncd0AslUSrvHVvvYWuU8ghncRJoA50kT3zP9MVL0+9g4/67H+cdvBskj9THPzg=="],
+
+    "@asamuzakjp/nwsapi": ["@asamuzakjp/nwsapi@2.3.9", "", {}, "sha512-n8GuYSrI9bF7FFZ/SjhwevlHc8xaVlb/7HmHelnc/PZXBD2ZR49NnN9sMMuDdEGPeeRQ5d0hqlSlEpgCX3Wl0Q=="],
+
     "@astrojs/cloudflare": ["@astrojs/cloudflare@13.1.10", "", { "dependencies": { "@astrojs/internal-helpers": "0.8.0", "@astrojs/underscore-redirects": "1.0.3", "@cloudflare/vite-plugin": "^1.25.6", "piccolore": "^0.1.3", "tinyglobby": "^0.2.15", "vite": "^7.3.1" }, "peerDependencies": { "astro": "^6.0.0", "wrangler": "^4.61.1" } }, "sha512-Ogl8p4MifPMHbpHKJL78eqEL+I3wbHrYmo83P/FkKZQ9VzzKi2A1RjnbaiiPAwrA8xQOqIUo4zlN7+Mse0aJAQ=="],
 
     "@astrojs/compiler": ["@astrojs/compiler@3.0.1", "", {}, "sha512-z97oYbdebO5aoWzuJ/8q5hLK232+17KcLZ7cJ8BCWk6+qNzVxn/gftC0KzMBUTD8WAaBkPpNSQK6PXLnNrZ0CA=="],
@@ -1416,48 +1443,12 @@
 
     "@braintree/sanitize-url": ["@braintree/sanitize-url@7.1.2", "", {}, "sha512-jigsZK+sMF/cuiB7sERuo9V7N9jx+dhmHHnQyDSVdpZwVutaBu7WvNYqMDLSgFgfB30n452TP3vjDAvFC973mA=="],
 
+    "@bramus/specificity": ["@bramus/specificity@2.4.2", "", { "dependencies": { "css-tree": "^3.0.0" }, "bin": { "specificity": "bin/cli.js" } }, "sha512-ctxtJ/eA+t+6q2++vj5j7FYX3nRu311q1wfYH3xjlLOsczhlhxAg2FWNUXhpGvAw3BWo1xBcvOV6/YLc2r5FJw=="],
+
     "@capsizecss/unpack": ["@capsizecss/unpack@4.0.0", "", { "dependencies": { "fontkitten": "^1.0.0" } }, "sha512-VERIM64vtTP1C4mxQ5thVT9fK0apjPFobqybMtA1UdUujWka24ERHbRHFGmpbbhp73MhV+KSsHQH9C6uOTdEQA=="],
 
     "@cfworker/json-schema": ["@cfworker/json-schema@4.1.1", "", {}, "sha512-gAmrUZSGtKc3AiBL71iNWxDsyUC5uMaKKGdvzYsBoTW/xi42JQHl7eKV2OYzCUqvc+D2RCcf7EXY2iCyFIk6og=="],
 
-    "@changesets/apply-release-plan": ["@changesets/apply-release-plan@7.1.0", "", { "dependencies": { "@changesets/config": "^3.1.3", "@changesets/get-version-range-type": "^0.4.0", "@changesets/git": "^3.0.4", "@changesets/should-skip-package": "^0.1.2", "@changesets/types": "^6.1.0", "@manypkg/get-packages": "^1.1.3", "detect-indent": "^6.0.0", "fs-extra": "^7.0.1", "lodash.startcase": "^4.4.0", "outdent": "^0.5.0", "prettier": "^2.7.1", "resolve-from": "^5.0.0", "semver": "^7.5.3" } }, "sha512-yq8ML3YS7koKQ/9bk1PqO0HMzApIFNwjlwCnwFEXMzNe8NpzeeYYKCmnhWJGkN8g7E51MnWaSbqRcTcdIxUgnQ=="],
-
-    "@changesets/assemble-release-plan": ["@changesets/assemble-release-plan@6.0.9", "", { "dependencies": { "@changesets/errors": "^0.2.0", "@changesets/get-dependents-graph": "^2.1.3", "@changesets/should-skip-package": "^0.1.2", "@changesets/types": "^6.1.0", "@manypkg/get-packages": "^1.1.3", "semver": "^7.5.3" } }, "sha512-tPgeeqCHIwNo8sypKlS3gOPmsS3wP0zHt67JDuL20P4QcXiw/O4Hl7oXiuLnP9yg+rXLQ2sScdV1Kkzde61iSQ=="],
-
-    "@changesets/changelog-git": ["@changesets/changelog-git@0.2.1", "", { "dependencies": { "@changesets/types": "^6.1.0" } }, "sha512-x/xEleCFLH28c3bQeQIyeZf8lFXyDFVn1SgcBiR2Tw/r4IAWlk1fzxCEZ6NxQAjF2Nwtczoen3OA2qR+UawQ8Q=="],
-
-    "@changesets/changelog-github": ["@changesets/changelog-github@0.7.0", "", { "dependencies": { "@changesets/get-github-info": "^0.8.0", "@changesets/types": "^6.1.0", "dotenv": "^8.1.0" } }, "sha512-rBsbRvc4TVn+FvFnOVM3LxlFJfTXXCp8gfVJ+0BubxWNSVnLuAzowi5j+IEraLLP52w8AAs9QfKbPS3MMiXQJA=="],
-
-    "@changesets/cli": ["@changesets/cli@2.30.0", "", { "dependencies": { "@changesets/apply-release-plan": "^7.1.0", "@changesets/assemble-release-plan": "^6.0.9", "@changesets/changelog-git": "^0.2.1", "@changesets/config": "^3.1.3", "@changesets/errors": "^0.2.0", "@changesets/get-dependents-graph": "^2.1.3", "@changesets/get-release-plan": "^4.0.15", "@changesets/git": "^3.0.4", "@changesets/logger": "^0.1.1", "@changesets/pre": "^2.0.2", "@changesets/read": "^0.6.7", "@changesets/should-skip-package": "^0.1.2", "@changesets/types": "^6.1.0", "@changesets/write": "^0.4.0", "@inquirer/external-editor": "^1.0.2", "@manypkg/get-packages": "^1.1.3", "ansi-colors": "^4.1.3", "enquirer": "^2.4.1", "fs-extra": "^7.0.1", "mri": "^1.2.0", "package-manager-detector": "^0.2.0", "picocolors": "^1.1.0", "resolve-from": "^5.0.0", "semver": "^7.5.3", "spawndamnit": "^3.0.1", "term-size": "^2.1.0" }, "bin": { "changeset": "bin.js" } }, "sha512-5D3Nk2JPqMI1wK25pEymeWRSlSMdo5QOGlyfrKg0AOufrUcjEE3RQgaCpHoBiM31CSNrtSgdJ0U6zL1rLDDfBA=="],
-
-    "@changesets/config": ["@changesets/config@3.1.3", "", { "dependencies": { "@changesets/errors": "^0.2.0", "@changesets/get-dependents-graph": "^2.1.3", "@changesets/logger": "^0.1.1", "@changesets/should-skip-package": "^0.1.2", "@changesets/types": "^6.1.0", "@manypkg/get-packages": "^1.1.3", "fs-extra": "^7.0.1", "micromatch": "^4.0.8" } }, "sha512-vnXjcey8YgBn2L1OPWd3ORs0bGC4LoYcK/ubpgvzNVr53JXV5GiTVj7fWdMRsoKUH7hhhMAQnsJUqLr21EncNw=="],
-
-    "@changesets/errors": ["@changesets/errors@0.2.0", "", { "dependencies": { "extendable-error": "^0.1.5" } }, "sha512-6BLOQUscTpZeGljvyQXlWOItQyU71kCdGz7Pi8H8zdw6BI0g3m43iL4xKUVPWtG+qrrL9DTjpdn8eYuCQSRpow=="],
-
-    "@changesets/get-dependents-graph": ["@changesets/get-dependents-graph@2.1.3", "", { "dependencies": { "@changesets/types": "^6.1.0", "@manypkg/get-packages": "^1.1.3", "picocolors": "^1.1.0", "semver": "^7.5.3" } }, "sha512-gphr+v0mv2I3Oxt19VdWRRUxq3sseyUpX9DaHpTUmLj92Y10AGy+XOtV+kbM6L/fDcpx7/ISDFK6T8A/P3lOdQ=="],
-
-    "@changesets/get-github-info": ["@changesets/get-github-info@0.8.0", "", { "dependencies": { "dataloader": "^1.4.0", "node-fetch": "^2.5.0" } }, "sha512-cRnC+xdF0JIik7coko3iUP9qbnfi1iJQ3sAa6dE+Tx3+ET8bjFEm63PA4WEohgjYcmsOikPHWzPsMWWiZmntOQ=="],
-
-    "@changesets/get-release-plan": ["@changesets/get-release-plan@4.0.15", "", { "dependencies": { "@changesets/assemble-release-plan": "^6.0.9", "@changesets/config": "^3.1.3", "@changesets/pre": "^2.0.2", "@changesets/read": "^0.6.7", "@changesets/types": "^6.1.0", "@manypkg/get-packages": "^1.1.3" } }, "sha512-Q04ZaRPuEVZtA+auOYgFaVQQSA98dXiVe/yFaZfY7hoSmQICHGvP0TF4u3EDNHWmmCS4ekA/XSpKlSM2PyTS2g=="],
-
-    "@changesets/get-version-range-type": ["@changesets/get-version-range-type@0.4.0", "", {}, "sha512-hwawtob9DryoGTpixy1D3ZXbGgJu1Rhr+ySH2PvTLHvkZuQ7sRT4oQwMh0hbqZH1weAooedEjRsbrWcGLCeyVQ=="],
-
-    "@changesets/git": ["@changesets/git@3.0.4", "", { "dependencies": { "@changesets/errors": "^0.2.0", "@manypkg/get-packages": "^1.1.3", "is-subdir": "^1.1.1", "micromatch": "^4.0.8", "spawndamnit": "^3.0.1" } }, "sha512-BXANzRFkX+XcC1q/d27NKvlJ1yf7PSAgi8JG6dt8EfbHFHi4neau7mufcSca5zRhwOL8j9s6EqsxmT+s+/E6Sw=="],
-
-    "@changesets/logger": ["@changesets/logger@0.1.1", "", { "dependencies": { "picocolors": "^1.1.0" } }, "sha512-OQtR36ZlnuTxKqoW4Sv6x5YIhOmClRd5pWsjZsddYxpWs517R0HkyiefQPIytCVh4ZcC5x9XaG8KTdd5iRQUfg=="],
-
-    "@changesets/parse": ["@changesets/parse@0.4.3", "", { "dependencies": { "@changesets/types": "^6.1.0", "js-yaml": "^4.1.1" } }, "sha512-ZDmNc53+dXdWEv7fqIUSgRQOLYoUom5Z40gmLgmATmYR9NbL6FJJHwakcCpzaeCy+1D0m0n7mT4jj2B/MQPl7A=="],
-
-    "@changesets/pre": ["@changesets/pre@2.0.2", "", { "dependencies": { "@changesets/errors": "^0.2.0", "@changesets/types": "^6.1.0", "@manypkg/get-packages": "^1.1.3", "fs-extra": "^7.0.1" } }, "sha512-HaL/gEyFVvkf9KFg6484wR9s0qjAXlZ8qWPDkTyKF6+zqjBe/I2mygg3MbpZ++hdi0ToqNUF8cjj7fBy0dg8Ug=="],
-
-    "@changesets/read": ["@changesets/read@0.6.7", "", { "dependencies": { "@changesets/git": "^3.0.4", "@changesets/logger": "^0.1.1", "@changesets/parse": "^0.4.3", "@changesets/types": "^6.1.0", "fs-extra": "^7.0.1", "p-filter": "^2.1.0", "picocolors": "^1.1.0" } }, "sha512-D1G4AUYGrBEk8vj8MGwf75k9GpN6XL3wg8i42P2jZZwFLXnlr2Pn7r9yuQNbaMCarP7ZQWNJbV6XLeysAIMhTA=="],
-
-    "@changesets/should-skip-package": ["@changesets/should-skip-package@0.1.2", "", { "dependencies": { "@changesets/types": "^6.1.0", "@manypkg/get-packages": "^1.1.3" } }, "sha512-qAK/WrqWLNCP22UDdBTMPH5f41elVDlsNyat180A33dWxuUDyNpg6fPi/FyTZwRriVjg0L8gnjJn2F9XAoF0qw=="],
-
-    "@changesets/types": ["@changesets/types@6.1.0", "", {}, "sha512-rKQcJ+o1nKNgeoYRHKOS07tAMNd3YSN0uHaJOZYjBAgxfV7TUE7JE+z4BzZdQwb5hKaYbayKN5KrYV7ODb2rAA=="],
-
-    "@changesets/write": ["@changesets/write@0.4.0", "", { "dependencies": { "@changesets/types": "^6.1.0", "fs-extra": "^7.0.1", "human-id": "^4.1.1", "prettier": "^2.7.1" } }, "sha512-CdTLvIOPiCNuH71pyDu3rA+Q0n65cmAbXnwWH84rKGiFumFzkmHNT8KHTMEchcxN+Kl8I54xGUhJ7l3E7X396Q=="],
-
     "@chevrotain/cst-dts-gen": ["@chevrotain/cst-dts-gen@12.0.0", "", { "dependencies": { "@chevrotain/gast": "12.0.0", "@chevrotain/types": "12.0.0" } }, "sha512-fSL4KXjTl7cDgf0B5Rip9Q05BOrYvkJV/RrBTE/bKDN096E4hN/ySpcBK5B24T76dlQ2i32Zc3PAE27jFnFrKg=="],
 
     "@chevrotain/gast": ["@chevrotain/gast@12.0.0", "", { "dependencies": { "@chevrotain/types": "12.0.0" } }, "sha512-1ne/m3XsIT8aEdrvT33so0GUC+wkctpUPK6zU9IlOyJLUbR0rg4G7ZiApiJbggpgPir9ERy3FRjT6T7lpgetnQ=="],
@@ -1494,6 +1485,18 @@
 
     "@cspotcode/source-map-support": ["@cspotcode/source-map-support@0.8.1", "", { "dependencies": { "@jridgewell/trace-mapping": "0.3.9" } }, "sha512-IchNf6dN4tHoMFIn/7OE8LWZ19Y6q/67Bmf6vnGREv8RSbBVb9LPJxEcnwrcwX6ixSvaiGoomAUvu4YSxXrVgw=="],
 
+    "@csstools/color-helpers": ["@csstools/color-helpers@6.0.2", "", {}, "sha512-LMGQLS9EuADloEFkcTBR3BwV/CGHV7zyDxVRtVDTwdI2Ca4it0CCVTT9wCkxSgokjE5Ho41hEPgb8OEUwoXr6Q=="],
+
+    "@csstools/css-calc": ["@csstools/css-calc@3.2.1", "", { "peerDependencies": { "@csstools/css-parser-algorithms": "^4.0.0", "@csstools/css-tokenizer": "^4.0.0" } }, "sha512-DtdHlgXh5ZkA43cwBcAm+huzgJiwx3ZTWVjBs94kwz2xKqSimDA3lBgCjphYgwgVUMWatSM0pDd8TILB1yrVVg=="],
+
+    "@csstools/css-color-parser": ["@csstools/css-color-parser@4.1.8", "", { "dependencies": { "@csstools/color-helpers": "^6.0.2", "@csstools/css-calc": "^3.2.1" }, "peerDependencies": { "@csstools/css-parser-algorithms": "^4.0.0", "@csstools/css-tokenizer": "^4.0.0" } }, "sha512-3chWb7PRLijpJpPIKkDxdu6IBeO5MrFACND57On0j8OPpc0wZibcGc3xAHrSEbOx/KDRyMHoIxGn0w1PhXMYHw=="],
+
+    "@csstools/css-parser-algorithms": ["@csstools/css-parser-algorithms@4.0.0", "", { "peerDependencies": { "@csstools/css-tokenizer": "^4.0.0" } }, "sha512-+B87qS7fIG3L5h3qwJ/IFbjoVoOe/bpOdh9hAjXbvx0o8ImEmUsGXN0inFOnk2ChCFgqkkGFQ+TpM5rbhkKe4w=="],
+
+    "@csstools/css-syntax-patches-for-csstree": ["@csstools/css-syntax-patches-for-csstree@1.1.5", "", { "peerDependencies": { "css-tree": "^3.2.1" }, "optionalPeers": ["css-tree"] }, "sha512-oNjBvzLq2GPZtJphCjLqXow/cHySHSgtxvKZb7OqSZ/xHgw6NWNhfad+6AB9cLeVm6eA9d/qMll3JdEHjy6M+A=="],
+
+    "@csstools/css-tokenizer": ["@csstools/css-tokenizer@4.0.0", "", {}, "sha512-QxULHAm7cNu72w97JUNCBFODFaXpbDg+dP8b/oWFAZ2MTRppA3U00Y2L1HqaS4J6yBqxwa/Y3nMBaxVKbB/NsA=="],
+
     "@date-fns/tz": ["@date-fns/tz@1.4.1", "", {}, "sha512-P5LUNhtbj6YfI3iJjw5EL9eUAG6OitD0W3fWQcpQjDRc/QIsL0tRNuO1PcDvPccWL1fSTXXdE1ds+l95DV/OFA=="],
 
     "@develar/schema-utils": ["@develar/schema-utils@2.6.5", "", { "dependencies": { "ajv": "^6.12.0", "ajv-keywords": "^3.4.1" } }, "sha512-0cp4PsWQ/9avqTVMCtZ+GirikIA36ikvjtHweU4/j8yLtgObI0+JUPhYFScgwlteveGB1rt3Cm8UhN04XayDig=="],
@@ -1562,11 +1565,11 @@
 
     "@electron/windows-sign": ["@electron/windows-sign@1.2.2", "", { "dependencies": { "cross-dirname": "^0.1.0", "debug": "^4.3.4", "fs-extra": "^11.1.1", "minimist": "^1.2.8", "postject": "^1.0.0-alpha.6" }, "bin": { "electron-windows-sign": "bin/electron-windows-sign.js" } }, "sha512-dfZeox66AvdPtb2lD8OsIIQh12Tp0GNCRUDfBHIKGpbmopZto2/A8nSpYYLoedPIHpqkeblZ/k8OV0Gy7PYuyQ=="],
 
-    "@emnapi/core": ["@emnapi/core@1.9.2", "", { "dependencies": { "@emnapi/wasi-threads": "1.2.1", "tslib": "^2.4.0" } }, "sha512-UC+ZhH3XtczQYfOlu3lNEkdW/p4dsJ1r/bP7H8+rhao3TTTMO1ATq/4DdIi23XuGoFY+Cz0JmCbdVl0hz9jZcA=="],
+    "@emnapi/core": ["@emnapi/core@1.11.1", "", { "dependencies": { "@emnapi/wasi-threads": "1.2.2", "tslib": "^2.4.0" } }, "sha512-RSvbQmHzdKzNsLYa/wHrbc3KN4sYLKAdPZxqiM2HATqv/SBk2/ENSHpvXGaLOMcsAyz0poEGqkmmKYG3OWiJEQ=="],
 
-    "@emnapi/runtime": ["@emnapi/runtime@1.9.2", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-3U4+MIWHImeyu1wnmVygh5WlgfYDtyf0k8AbLhMFxOipihf6nrWC4syIm/SwEeec0mNSafiiNnMJwbza/Is6Lw=="],
+    "@emnapi/runtime": ["@emnapi/runtime@1.11.1", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-vgj7R3y3Wgx24IQaGPA/R6YFXLHVMOZ0uVEyIQPaWs+rd1AzfEMXlAC22FYwO1XkKR6NPsq7mUandH8oIRdZFw=="],
 
-    "@emnapi/wasi-threads": ["@emnapi/wasi-threads@1.2.1", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-uTII7OYF+/Mes/MrcIOYp5yOtSMLBWSIoLPpcgwipoiKbli6k322tcoFsxoIIxPDqW01SQGAgko4EzZi2BNv2w=="],
+    "@emnapi/wasi-threads": ["@emnapi/wasi-threads@1.2.2", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-c95qOXkHdydNKhscBTebqEC1CVAZpyqOfVfBzQ1qgzyl3gfeldUjIggDbIZgDKsHLgnsM+igH7TJ/eAasaVuMA=="],
 
     "@emoji-mart/data": ["@emoji-mart/data@1.2.1", "", {}, "sha512-no2pQMWiBy6gpBEiqGeU77/bFejDqUTRY7KX+0+iur13op3bqUsXdnwoZs6Xb1zbv0gAj5VvS1PWoUUckSr5Dw=="],
 
@@ -1666,7 +1669,7 @@
 
     "@executor-js/cli": ["@executor-js/cli@workspace:packages/core/cli"],
 
-    "@executor-js/cloud": ["@executor-js/cloud@workspace:apps/cloud"],
+    "@executor-js/cloud": ["@executor-js/cloud@workspace:legacy/cloud"],
 
     "@executor-js/cloudflare": ["@executor-js/cloudflare@workspace:packages/hosts/cloudflare"],
 
@@ -1674,7 +1677,7 @@
 
     "@executor-js/config": ["@executor-js/config@workspace:packages/core/config"],
 
-    "@executor-js/desktop": ["@executor-js/desktop@workspace:apps/desktop"],
+    "@executor-js/desktop": ["@executor-js/desktop@workspace:legacy/desktop"],
 
     "@executor-js/e2e": ["@executor-js/e2e@workspace:e2e"],
 
@@ -1690,17 +1693,17 @@
 
     "@executor-js/fumadb": ["@executor-js/fumadb@workspace:packages/core/fumadb"],
 
-    "@executor-js/host-cloudflare": ["@executor-js/host-cloudflare@workspace:apps/host-cloudflare"],
+    "@executor-js/host-cloudflare": ["@executor-js/host-cloudflare@workspace:legacy/host-cloudflare"],
 
     "@executor-js/host-mcp": ["@executor-js/host-mcp@workspace:packages/hosts/mcp"],
 
-    "@executor-js/host-selfhost": ["@executor-js/host-selfhost@workspace:apps/host-selfhost"],
+    "@executor-js/host-selfhost": ["@executor-js/host-selfhost@workspace:legacy/host-selfhost"],
 
     "@executor-js/integrations-registry": ["@executor-js/integrations-registry@workspace:packages/core/integrations-registry"],
 
     "@executor-js/ir": ["@executor-js/ir@workspace:packages/kernel/ir"],
 
-    "@executor-js/local": ["@executor-js/local@workspace:apps/local"],
+    "@executor-js/local": ["@executor-js/local@workspace:legacy/local"],
 
     "@executor-js/marketing": ["@executor-js/marketing@workspace:apps/marketing"],
 
@@ -1748,6 +1751,10 @@
 
     "@executor-js/vite-plugin": ["@executor-js/vite-plugin@workspace:packages/core/vite-plugin"],
 
+    "@executor-js/web": ["@executor-js/web@workspace:web"],
+
+    "@exodus/bytes": ["@exodus/bytes@1.15.1", "", { "peerDependencies": { "@noble/hashes": "^1.8.0 || ^2.0.0" }, "optionalPeers": ["@noble/hashes"] }, "sha512-S6mL0yNB/Abt9Ei4tq8gDhcczc4S3+vQ4ra7vxnAf+YHC02srtqxKKZghx2Dq6p0e66THKwR6r8N6P95wEty7Q=="],
+
     "@fastify/busboy": ["@fastify/busboy@3.2.0", "", {}, "sha512-m9FVDXU3GT2ITSe0UaMA5rU3QkfC/UXtCU8y0gSN/GugTqtVldOBWIB5V6V3sbmenVZUIpU6f+mPEO2+m5iTaA=="],
 
     "@fastify/otel": ["@fastify/otel@0.18.0", "", { "dependencies": { "@opentelemetry/core": "^2.0.0", "@opentelemetry/instrumentation": "^0.212.0", "@opentelemetry/semantic-conventions": "^1.28.0", "minimatch": "^10.2.4" }, "peerDependencies": { "@opentelemetry/api": "^1.9.0" } }, "sha512-3TASCATfw+ctICSb4ymrv7iCm0qJ0N9CarB+CZ7zIJ7KqNbwI5JjyDL1/sxoC0ccTO1Zyd1iQ+oqncPg5FJXaA=="],
@@ -2018,10 +2025,6 @@
 
     "@malept/flatpak-bundler": ["@malept/flatpak-bundler@0.4.0", "", { "dependencies": { "debug": "^4.1.1", "fs-extra": "^9.0.0", "lodash": "^4.17.15", "tmp-promise": "^3.0.2" } }, "sha512-9QOtNffcOF/c1seMCDnjckb3R9WHcG34tky+FHpNKKCW0wc/scYLwMtO+ptyGUfMW0/b/n4qRiALlaFHc9Oj7Q=="],
 
-    "@manypkg/find-root": ["@manypkg/find-root@1.1.0", "", { "dependencies": { "@babel/runtime": "^7.5.5", "@types/node": "^12.7.1", "find-up": "^4.1.0", "fs-extra": "^8.1.0" } }, "sha512-mki5uBvhHzO8kYYix/WRy2WX8S3B5wdVSc9D6KcU5lQNglP2yt58/VfLuAK49glRXChosY8ap2oJ1qgma3GUVA=="],
-
-    "@manypkg/get-packages": ["@manypkg/get-packages@1.1.3", "", { "dependencies": { "@babel/runtime": "^7.5.5", "@changesets/types": "^4.0.1", "@manypkg/find-root": "^1.1.0", "fs-extra": "^8.1.0", "globby": "^11.0.0", "read-yaml-file": "^1.1.0" } }, "sha512-fo+QhuU3qE/2TQMQmbVMqaQ6EWbMhi4ABWP+O4AM1NqPBuy0OrApV5LO6BrrgnhtAHS2NH6RrVk9OL181tTi8A=="],
-
     "@mdx-js/mdx": ["@mdx-js/mdx@3.1.1", "", { "dependencies": { "@types/estree": "^1.0.0", "@types/estree-jsx": "^1.0.0", "@types/hast": "^3.0.0", "@types/mdx": "^2.0.0", "acorn": "^8.0.0", "collapse-white-space": "^2.0.0", "devlop": "^1.0.0", "estree-util-is-identifier-name": "^3.0.0", "estree-util-scope": "^1.0.0", "estree-walker": "^3.0.0", "hast-util-to-jsx-runtime": "^2.0.0", "markdown-extensions": "^2.0.0", "recma-build-jsx": "^1.0.0", "recma-jsx": "^1.0.0", "recma-stringify": "^1.0.0", "rehype-recma": "^1.0.0", "remark-mdx": "^3.0.0", "remark-parse": "^11.0.0", "remark-rehype": "^11.0.0", "source-map": "^0.7.0", "unified": "^11.0.0", "unist-util-position-from-estree": "^2.0.0", "unist-util-stringify-position": "^4.0.0", "unist-util-visit": "^5.0.0", "vfile": "^6.0.0" } }, "sha512-f6ZO2ifpwAQIpzGWaBQT2TXxPv6z3RBzQKpVftEWN78Vl/YweF1uwussDx8ECAXVtr3Rs89fKyG9YlzUs9DyGQ=="],
 
     "@mdx-js/react": ["@mdx-js/react@3.1.1", "", { "dependencies": { "@types/mdx": "^2.0.0" }, "peerDependencies": { "@types/react": ">=16", "react": ">=16" } }, "sha512-f++rKLQgUVYDAtECQ6fn/is15GkEH9+nZPM3MS0RcxVqoTfawHvDlSCH7JbMhAM6uJ32v3eXLvLmLvjGu7PTQw=="],
@@ -2388,6 +2391,8 @@
 
     "@pkgjs/parseargs": ["@pkgjs/parseargs@0.11.0", "", {}, "sha512-+1VkjdD0QBLPodGrJUeqarH8VAIvQODIbwh9XpP5Syisf7YoQgsJKPNFoqqLQlu+VQ/tVSshMR6loPMn8U+dPg=="],
 
+    "@polka/url": ["@polka/url@1.0.0-next.29", "", {}, "sha512-wwQAWhWSuHaag8c4q/KN/vCoeOJYshAIvMQwD4GpSb3OiZklFfvAgmj0VCBBImRpuF/aFgIRzllXlVX93Jevww=="],
+
     "@poppinss/colors": ["@poppinss/colors@4.1.6", "", { "dependencies": { "kleur": "^4.1.5" } }, "sha512-H9xkIdFswbS8n1d6vmRd8+c10t2Qe+rZITbbDHHkQixH5+2x1FDGmi/0K+WgWiqQFKPSlIYB7jlH6Kpfn6Fleg=="],
 
     "@poppinss/dumper": ["@poppinss/dumper@0.6.5", "", { "dependencies": { "@poppinss/colors": "^4.1.5", "@sindresorhus/is": "^7.0.2", "supports-color": "^10.0.0" } }, "sha512-NBdYIb90J7LfOI32dOewKI1r7wnkiH6m920puQ3qHUeZkxNkQiFnXVWoE6YtFSv6QOiPPf7ys6i+HWWecDz7sw=="],
@@ -2636,35 +2641,35 @@
 
     "@rhyssul/portless": ["@rhyssul/portless@0.13.3", "", { "os": [ "linux", "win32", "darwin", ], "bin": { "portless": "dist/cli.js" } }, "sha512-oPvwXJIIkRg2i1CUEUsz8sAdFSf0Fzzv+NmaacAsi6ZZTHxDOofbO6fGInVnbESIFOu4k8a/rXOZRF0aqLAUgw=="],
 
-    "@rolldown/binding-android-arm64": ["@rolldown/binding-android-arm64@1.0.0-rc.15", "", { "os": "android", "cpu": "arm64" }, "sha512-YYe6aWruPZDtHNpwu7+qAHEMbQ/yRl6atqb/AhznLTnD3UY99Q1jE7ihLSahNWkF4EqRPVC4SiR4O0UkLK02tA=="],
+    "@rolldown/binding-android-arm64": ["@rolldown/binding-android-arm64@1.1.2", "", { "os": "android", "cpu": "arm64" }, "sha512-2cZ+7xRS+DBcuJBJKnfzsbleumJhBqSlJVpuzHC0nTqfd3QQ7Vx2/x5YR/D7cBamKSeWplwo82Fn9lqYUDEMfA=="],
 
-    "@rolldown/binding-darwin-arm64": ["@rolldown/binding-darwin-arm64@1.0.0-rc.15", "", { "os": "darwin", "cpu": "arm64" }, "sha512-oArR/ig8wNTPYsXL+Mzhs0oxhxfuHRfG7Ikw7jXsw8mYOtk71W0OkF2VEVh699pdmzjPQsTjlD1JIOoHkLP1Fg=="],
+    "@rolldown/binding-darwin-arm64": ["@rolldown/binding-darwin-arm64@1.1.2", "", { "os": "darwin", "cpu": "arm64" }, "sha512-RkPMJnygxsgOYdkfqgpwY0/Fzm8d0VQe6HGU2/B00Xa9eqdLbrII+DOKAodbJAn3ZL1AJxGHkZRPYazgGY6Ljw=="],
 
-    "@rolldown/binding-darwin-x64": ["@rolldown/binding-darwin-x64@1.0.0-rc.15", "", { "os": "darwin", "cpu": "x64" }, "sha512-YzeVqOqjPYvUbJSWJ4EDL8ahbmsIXQpgL3JVipmN+MX0XnXMeWomLN3Fb+nwCmP/jfyqte5I3XRSm7OfQrbyxw=="],
+    "@rolldown/binding-darwin-x64": ["@rolldown/binding-darwin-x64@1.1.2", "", { "os": "darwin", "cpu": "x64" }, "sha512-Uiczh6vFhwyfd7WNe7Q7mCA4KxAiLdz7jPE/WGizfRpIieoyFuNVMmM8HqZ9HwudTkY6/AeMQwlNJ9NJijguWw=="],
 
-    "@rolldown/binding-freebsd-x64": ["@rolldown/binding-freebsd-x64@1.0.0-rc.15", "", { "os": "freebsd", "cpu": "x64" }, "sha512-9Erhx956jeQ0nNTyif1+QWAXDRD38ZNjr//bSHrt6wDwB+QkAfl2q6Mn1k6OBPerznjRmbM10lgRb1Pli4xZPw=="],
+    "@rolldown/binding-freebsd-x64": ["@rolldown/binding-freebsd-x64@1.1.2", "", { "os": "freebsd", "cpu": "x64" }, "sha512-+TpdtTRgHiJFjCVFbw311SuLk3KfytPOQQn+VlAEv+gBxYPtL7E6JS9e/tk+8CwxhIZvemJKo4rTKgfWNsKkkA=="],
 
-    "@rolldown/binding-linux-arm-gnueabihf": ["@rolldown/binding-linux-arm-gnueabihf@1.0.0-rc.15", "", { "os": "linux", "cpu": "arm" }, "sha512-cVwk0w8QbZJGTnP/AHQBs5yNwmpgGYStL88t4UIaqcvYJWBfS0s3oqVLZPwsPU6M0zlW4GqjP0Zq5MnAGwFeGA=="],
+    "@rolldown/binding-linux-arm-gnueabihf": ["@rolldown/binding-linux-arm-gnueabihf@1.1.2", "", { "os": "linux", "cpu": "arm" }, "sha512-4lv1/tkmi7ueIVHnyreaOeUpiZP26BH9rRy6hoYfR9310A2B9nUEVRDvBx69vx64Nr3eTPPRkyciqJJs+j9Jmw=="],
 
-    "@rolldown/binding-linux-arm64-gnu": ["@rolldown/binding-linux-arm64-gnu@1.0.0-rc.15", "", { "os": "linux", "cpu": "arm64" }, "sha512-eBZ/u8iAK9SoHGanqe/jrPnY0JvBN6iXbVOsbO38mbz+ZJsaobExAm1Iu+rxa4S1l2FjG0qEZn4Rc6X8n+9M+w=="],
+    "@rolldown/binding-linux-arm64-gnu": ["@rolldown/binding-linux-arm64-gnu@1.1.2", "", { "os": "linux", "cpu": "arm64" }, "sha512-gBSUVO0eaWgw1JMjK3gB8BMlX2Mk148s2lTiVT3e9vjVxbl7UDfMWWY8CfIaaqiXuM9fVTMxIpUz6CAo/B6Vlw=="],
 
-    "@rolldown/binding-linux-arm64-musl": ["@rolldown/binding-linux-arm64-musl@1.0.0-rc.15", "", { "os": "linux", "cpu": "arm64" }, "sha512-ZvRYMGrAklV9PEkgt4LQM6MjQX2P58HPAuecwYObY2DhS2t35R0I810bKi0wmaYORt6m/2Sm+Z+nFgb0WhXNcQ=="],
+    "@rolldown/binding-linux-arm64-musl": ["@rolldown/binding-linux-arm64-musl@1.1.2", "", { "os": "linux", "cpu": "arm64" }, "sha512-LjQP/iZLBu8o8PjIfk4x3At0/mT6h282pvz8Z5LAyhGbu/kDezyO7ea62rF5uoqmgnIYqbN/MqJ3Si3Aymi7xQ=="],
 
-    "@rolldown/binding-linux-ppc64-gnu": ["@rolldown/binding-linux-ppc64-gnu@1.0.0-rc.15", "", { "os": "linux", "cpu": "ppc64" }, "sha512-VDpgGBzgfg5hLg+uBpCLoFG5kVvEyafmfxGUV0UHLcL5irxAK7PKNeC2MwClgk6ZAiNhmo9FLhRYgvMmedLtnQ=="],
+    "@rolldown/binding-linux-ppc64-gnu": ["@rolldown/binding-linux-ppc64-gnu@1.1.2", "", { "os": "linux", "cpu": "ppc64" }, "sha512-X/7bVLWelEsbyWDUSXt7zVsTniLLPIY2n1rH58qr78l9i7MNbbxBWD8gI2vRfBWf4NUXJCUuQnfZDsp32LqsfQ=="],
 
-    "@rolldown/binding-linux-s390x-gnu": ["@rolldown/binding-linux-s390x-gnu@1.0.0-rc.15", "", { "os": "linux", "cpu": "s390x" }, "sha512-y1uXY3qQWCzcPgRJATPSOUP4tCemh4uBdY7e3EZbVwCJTY3gLJWnQABgeUetvED+bt1FQ01OeZwvhLS2bpNrAQ=="],
+    "@rolldown/binding-linux-s390x-gnu": ["@rolldown/binding-linux-s390x-gnu@1.1.2", "", { "os": "linux", "cpu": "s390x" }, "sha512-gb6dYKW/1KDorGXyy48glEBJs/sxVSC5pcVrox/pFGV4mvwSFeg2sK5L2tRkVsVlh7kueqOgg4GEcuipJcGuKg=="],
 
-    "@rolldown/binding-linux-x64-gnu": ["@rolldown/binding-linux-x64-gnu@1.0.0-rc.15", "", { "os": "linux", "cpu": "x64" }, "sha512-023bTPBod7J3Y/4fzAN6QtpkSABR0rigtrwaP+qSEabUh5zf6ELr9Nc7GujaROuPY3uwdSIXWrvhn1KxOvurWA=="],
+    "@rolldown/binding-linux-x64-gnu": ["@rolldown/binding-linux-x64-gnu@1.1.2", "", { "os": "linux", "cpu": "x64" }, "sha512-JY4w85pU3iAiJVMh5nuk4/Mh9GjMsupe8MrIN53rwxAZW64GKrWeJBuN6SxQg9QTU5uB1cxyhDzW8jqRn1EABw=="],
 
-    "@rolldown/binding-linux-x64-musl": ["@rolldown/binding-linux-x64-musl@1.0.0-rc.15", "", { "os": "linux", "cpu": "x64" }, "sha512-witB2O0/hU4CgfOOKUoeFgQ4GktPi1eEbAhaLAIpgD6+ZnhcPkUtPsoKKHRzmOoWPZue46IThdSgdo4XneOLYw=="],
+    "@rolldown/binding-linux-x64-musl": ["@rolldown/binding-linux-x64-musl@1.1.2", "", { "os": "linux", "cpu": "x64" }, "sha512-xvpA7o5KCYLB0Rwscmuylb1/zHHSUx4g4xilm4prC5jP76pEUlzBmMbgpbh7bVDbId4NcfT96gN5i6mE6UDaiw=="],
 
-    "@rolldown/binding-openharmony-arm64": ["@rolldown/binding-openharmony-arm64@1.0.0-rc.15", "", { "os": "none", "cpu": "arm64" }, "sha512-UCL68NJ0Ud5zRipXZE9dF5PmirzJE4E4BCIOOssEnM7wLDsxjc6Qb0sGDxTNRTP53I6MZpygyCpY8Aa8sPfKPg=="],
+    "@rolldown/binding-openharmony-arm64": ["@rolldown/binding-openharmony-arm64@1.1.2", "", { "os": "none", "cpu": "arm64" }, "sha512-p/ts6KBLjuk49Bp21XH77poQGt02iNz7ChgHep7tudPOaLinR/De/RHdxF8w8Yj4r/bF/bqXwH6PZrB2sA+Nvw=="],
 
-    "@rolldown/binding-wasm32-wasi": ["@rolldown/binding-wasm32-wasi@1.0.0-rc.15", "", { "dependencies": { "@emnapi/core": "1.9.2", "@emnapi/runtime": "1.9.2", "@napi-rs/wasm-runtime": "^1.1.3" }, "cpu": "none" }, "sha512-ApLruZq/ig+nhaE7OJm4lDjayUnOHVUa77zGeqnqZ9pn0ovdVbbNPerVibLXDmWeUZXjIYIT8V3xkT58Rm9u5Q=="],
+    "@rolldown/binding-wasm32-wasi": ["@rolldown/binding-wasm32-wasi@1.1.2", "", { "dependencies": { "@emnapi/core": "1.11.1", "@emnapi/runtime": "1.11.1", "@napi-rs/wasm-runtime": "^1.1.5" }, "cpu": "none" }, "sha512-VMu/wmrZ9hJzYlRhbw7jK5PODlugyKZ5mOdX78+lS8OvuFkWNQdz1pFLrI2p3P0pjXOmUZ7B48o5VnMH9QOGtg=="],
 
-    "@rolldown/binding-win32-arm64-msvc": ["@rolldown/binding-win32-arm64-msvc@1.0.0-rc.15", "", { "os": "win32", "cpu": "arm64" }, "sha512-KmoUoU7HnN+Si5YWJigfTws1jz1bKBYDQKdbLspz0UaqjjFkddHsqorgiW1mxcAj88lYUE6NC/zJNwT+SloqtA=="],
+    "@rolldown/binding-win32-arm64-msvc": ["@rolldown/binding-win32-arm64-msvc@1.1.2", "", { "os": "win32", "cpu": "arm64" }, "sha512-xtUJqs8qEkuSviS0n1tsohaPuz3a1SPhZywOji4Oo+sgrJs8daEDMZ0QtqL0OS7dx8PoVpg2J/ZZycPY5I2+Zg=="],
 
-    "@rolldown/binding-win32-x64-msvc": ["@rolldown/binding-win32-x64-msvc@1.0.0-rc.15", "", { "os": "win32", "cpu": "x64" }, "sha512-3P2A8L+x75qavWLe/Dll3EYBJLQmtkJN8rfh+U/eR3MqMgL/h98PhYI+JFfXuDPgPeCB7iZAKiqii5vqOvnA0g=="],
+    "@rolldown/binding-win32-x64-msvc": ["@rolldown/binding-win32-x64-msvc@1.1.2", "", { "os": "win32", "cpu": "x64" }, "sha512-85YiLQqjUKgSO/Zjnf9e0XIn5Ymrh1fLDWBeAkZqpuBR/3R8TpfoHXuyblqyQrftSSgWO9qpcHN8mkyKsLraoA=="],
 
     "@rolldown/plugin-babel": ["@rolldown/plugin-babel@0.2.3", "", { "dependencies": { "picomatch": "^4.0.4" }, "peerDependencies": { "@babel/core": "^7.29.0 || ^8.0.0-rc.1", "@babel/plugin-transform-runtime": "^7.29.0 || ^8.0.0-rc.1", "@babel/runtime": "^7.27.0 || ^8.0.0-rc.1", "rolldown": "^1.0.0-rc.5", "vite": "^8.0.0" }, "optionalPeers": ["@babel/plugin-transform-runtime", "@babel/runtime", "vite"] }, "sha512-+zEk16yGlz1F9STiRr6uG9hmIXb6nprjLczV/htGptYuLoCuxb+itZ03RKCEeOhBpDDd1NU7qF6x1VLMUp62bw=="],
 
@@ -2792,6 +2797,16 @@
 
     "@stitches/react": ["@stitches/react@1.2.8", "", { "peerDependencies": { "react": ">= 16.3.0" } }, "sha512-9g9dWI4gsSVe8bNLlb+lMkBYsnIKCZTmvqvDG+Avnn69XfmHZKiaMrx7cgTaddq7aTPPmXiTsbFcUy0xgI4+wA=="],
 
+    "@sveltejs/acorn-typescript": ["@sveltejs/acorn-typescript@1.0.10", "", { "peerDependencies": { "acorn": "^8.9.0" } }, "sha512-4WfKk68eTih+MiJD4fSbxN7E8kVBmTMPWHUPYjvl2N0rMs53YLTT8/YjKU5Dtnz5LqDjl7LEw4U7lXR2W3J5WA=="],
+
+    "@sveltejs/adapter-static": ["@sveltejs/adapter-static@3.0.10", "", { "peerDependencies": { "@sveltejs/kit": "^2.0.0" } }, "sha512-7D9lYFWJmB7zxZyTE/qxjksvMqzMuYrrsyh1f4AlZqeZeACPRySjbC3aFiY55wb1tWUaKOQG9PVbm74JcN2Iew=="],
+
+    "@sveltejs/kit": ["@sveltejs/kit@2.67.0", "", { "dependencies": { "@standard-schema/spec": "^1.0.0", "@sveltejs/acorn-typescript": "^1.0.9", "@types/cookie": "^0.6.0", "acorn": "^8.16.0", "cookie": "^0.6.0", "devalue": "^5.8.1", "esm-env": "^1.2.2", "kleur": "^4.1.5", "magic-string": "^0.30.5", "mrmime": "^2.0.0", "set-cookie-parser": "^3.0.0", "sirv": "^3.0.0" }, "peerDependencies": { "@opentelemetry/api": "^1.0.0", "@sveltejs/vite-plugin-svelte": "^3.0.0 || ^4.0.0-next.1 || ^5.0.0 || ^6.0.0-next.0 || ^7.0.0", "svelte": "^4.0.0 || ^5.0.0-next.0", "typescript": "^5.3.3 || ^6.0.0", "vite": "^5.0.3 || ^6.0.0 || ^7.0.0-beta.0 || ^8.0.0" }, "optionalPeers": ["@opentelemetry/api", "typescript"], "bin": { "svelte-kit": "svelte-kit.js" } }, "sha512-JXHbsDwRes1Wgyof3q5ApzzpbCWvinKXMQCiV67TFO6xlZPYLoK0fq3xQMqSicDMgCtFGqLkrQXkseOcASdZ8A=="],
+
+    "@sveltejs/load-config": ["@sveltejs/load-config@0.2.0", "", {}, "sha512-1LgZ/qUqSoq+QorD83lk2hka79Px0wXNW2q5V1nZlxGhQgw1jrsIbVz5YiCeucVLo4XvFLjXukUaQjIiqowkcg=="],
+
+    "@sveltejs/vite-plugin-svelte": ["@sveltejs/vite-plugin-svelte@7.1.2", "", { "dependencies": { "deepmerge": "^4.3.1", "magic-string": "^0.30.21", "obug": "^2.1.0", "vitefu": "^1.1.2" }, "peerDependencies": { "svelte": "^5.46.4", "vite": "^8.0.0-beta.7 || ^8.0.0" } }, "sha512-DrUBA2UXRfDmUX/ZTiEopd3X40yavsJF1FX2RygcuIScHL7o5YX1fMvoYnDhjeJQC4weCOklirpNWlcb2NiSeA=="],
+
     "@swc/helpers": ["@swc/helpers@0.5.21", "", { "dependencies": { "tslib": "^2.8.0" } }, "sha512-jI/VAmtdjB/RnI8GTnokyX7Ug8c+g+ffD6QRLa6XQewtnGyukKkKSk3wLTM3b5cjt1jNh9x0jfVlagdN2gDKQg=="],
 
     "@szmarczak/http-timer": ["@szmarczak/http-timer@4.0.6", "", { "dependencies": { "defer-to-connect": "^2.0.0" } }, "sha512-4BAffykYOgO+5nzBWYwE3W90sBgLJoUPRWWcL8wlyiM8IB8ipJz3UMJ9KXQd1RKQXpKp8Tutn80HZtWsu2u76w=="],
@@ -2870,6 +2885,12 @@
 
     "@tanstack/virtual-file-routes": ["@tanstack/virtual-file-routes@1.162.0", "", {}, "sha512-uhOeFyxLcU41HzvrxsGpiWdcMbScY1EDgbZ5K7DVRMYInbLYWAC0EA/kx9wXAoSM8q82bUG2hRl8+EAjE6XAbA=="],
 
+    "@testing-library/dom": ["@testing-library/dom@10.4.1", "", { "dependencies": { "@babel/code-frame": "^7.10.4", "@babel/runtime": "^7.12.5", "@types/aria-query": "^5.0.1", "aria-query": "5.3.0", "dom-accessibility-api": "^0.5.9", "lz-string": "^1.5.0", "picocolors": "1.1.1", "pretty-format": "^27.0.2" } }, "sha512-o4PXJQidqJl82ckFaXUeoAW+XysPLauYI43Abki5hABd853iMhitooc6znOnczgbTYmEP6U6/y1ZyKAIsvMKGg=="],
+
+    "@testing-library/svelte": ["@testing-library/svelte@5.4.2", "", { "dependencies": { "@testing-library/dom": "9.x.x || 10.x.x", "@testing-library/svelte-core": "1.1.3" }, "peerDependencies": { "svelte": "^3 || ^4 || ^5 || ^5.0.0-next.0", "vite": "*", "vitest": "*" }, "optionalPeers": ["vite", "vitest"] }, "sha512-4o31E4HGo5BU5KwPkulNRocEden+7Tt9JYm9uhln5ajF7DULeyFA46BBWVfKJ8Ms9B3JmOFPTIiVamH7n3KpuQ=="],
+
+    "@testing-library/svelte-core": ["@testing-library/svelte-core@1.1.3", "", { "peerDependencies": { "svelte": "^3 || ^4 || ^5 || ^5.0.0-next.0" } }, "sha512-KkMAvXeWorxN2Yn0kdC1lfoAItxpoj4uOWzxK5leDrNxonLvS5nwBFvztrroyTszQ0Wf/EU6iLT8JhY5qcn22g=="],
+
     "@tokenizer/token": ["@tokenizer/token@0.3.0", "", {}, "sha512-OvjF+z51L3ov0OyAU0duzsYuvO01PH7x4t6DJx+guahgTnBHkhJdG7soQeTSFLWN3efnHyibZ4Z8l2EuWwJN3A=="],
 
     "@turbo/darwin-64": ["@turbo/darwin-64@2.9.6", "", { "os": "darwin", "cpu": "x64" }, "sha512-X/56SnVXIQZBLKwniGTwEQTGmtE5brSACnKMBWpY3YafuxVYefrC2acamfjgxP7BG5w3I+6jf0UrLoSzgPcSJg=="],
@@ -2886,6 +2907,8 @@
 
     "@tybys/wasm-util": ["@tybys/wasm-util@0.10.1", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-9tTaPJLSiejZKx+Bmog4uSubteqTvFrVrURwkmHixBo0G4seD0zUxp98E1DzUBJxLQ3NPwXrGKDiVjwx/DpPsg=="],
 
+    "@types/aria-query": ["@types/aria-query@5.0.4", "", {}, "sha512-rfT93uj5s0PRL7EzccGMs3brplhcrghnDoV26NqKhCAS1hVo+WdNsPvE/yb6ilfr5hi2MEk6d5EWJTKdxg8jVw=="],
+
     "@types/babel__core": ["@types/babel__core@7.20.5", "", { "dependencies": { "@babel/parser": "^7.20.7", "@babel/types": "^7.20.7", "@types/babel__generator": "*", "@types/babel__template": "*", "@types/babel__traverse": "*" } }, "sha512-qoQprZvz5wQFJwMDqeseRXWv3rqMvhgpbXFfVyWhbx9X47POIA6i/+dXefEmZKoAgOaTdaIgNSMqMIU61yRyzA=="],
 
     "@types/babel__generator": ["@types/babel__generator@7.27.0", "", { "dependencies": { "@babel/types": "^7.0.0" } }, "sha512-ufFd2Xi92OAVPYsy+P4n7/U7e68fex0+Ee8gSG9KX7eo084CWiQ4sdxktvdl0bOPupXtVJPY19zk6EwWqUQ8lg=="],
@@ -2902,6 +2925,8 @@
 
     "@types/connect": ["@types/connect@3.4.38", "", { "dependencies": { "@types/node": "*" } }, "sha512-K6uROf1LD88uDQqJCktA4yzL1YYAK6NgfsI0v/mTgyPKWsX1CnJ0XPSDhViejru1GcRkLWb8RlzFYJRqGUbaug=="],
 
+    "@types/cookie": ["@types/cookie@0.6.0", "", {}, "sha512-4Kh9a6B2bQciAhf7FSuMRRkUWecJgJu9nPnx3yzpsfXX/c50REIqpHY4C82bXP90qrLtXtkDxTZosYO3UpOwlA=="],
+
     "@types/d3": ["@types/d3@7.4.3", "", { "dependencies": { "@types/d3-array": "*", "@types/d3-axis": "*", "@types/d3-brush": "*", "@types/d3-chord": "*", "@types/d3-color": "*", "@types/d3-contour": "*", "@types/d3-delaunay": "*", "@types/d3-dispatch": "*", "@types/d3-drag": "*", "@types/d3-dsv": "*", "@types/d3-ease": "*", "@types/d3-fetch": "*", "@types/d3-force": "*", "@types/d3-format": "*", "@types/d3-geo": "*", "@types/d3-hierarchy": "*", "@types/d3-interpolate": "*", "@types/d3-path": "*", "@types/d3-polygon": "*", "@types/d3-quadtree": "*", "@types/d3-random": "*", "@types/d3-scale": "*", "@types/d3-scale-chromatic": "*", "@types/d3-selection": "*", "@types/d3-shape": "*", "@types/d3-time": "*", "@types/d3-time-format": "*", "@types/d3-timer": "*", "@types/d3-transition": "*", "@types/d3-zoom": "*" } }, "sha512-lZXZ9ckh5R8uiFVt8ogUNf+pIrK4EsWrx2Np75WvF/eTpJ0FMHNhjXk8CKEx/+gpHbNQyJWehbFaTvqmHWB3ww=="],
 
     "@types/d3-array": ["@types/d3-array@3.2.2", "", {}, "sha512-hOLWVbm7uRza0BYXpIIW5pxfrKe0W+D5lrFiAEYR+pb6w3N2SwSMaJbXdUfSEv+dT4MfHBLtn5js0LAWaO6otw=="],
@@ -3066,19 +3091,19 @@
 
     "@vitejs/plugin-react": ["@vitejs/plugin-react@6.0.1", "", { "dependencies": { "@rolldown/pluginutils": "1.0.0-rc.7" }, "peerDependencies": { "@rolldown/plugin-babel": "^0.1.7 || ^0.2.0", "babel-plugin-react-compiler": "^1.0.0", "vite": "^8.0.0" }, "optionalPeers": ["@rolldown/plugin-babel", "babel-plugin-react-compiler"] }, "sha512-l9X/E3cDb+xY3SWzlG1MOGt2usfEHGMNIaegaUGFsLkb3RCn/k8/TOXBcab+OndDI4TBtktT8/9BwwW8Vi9KUQ=="],
 
-    "@vitest/expect": ["@vitest/expect@4.1.5", "", { "dependencies": { "@standard-schema/spec": "^1.1.0", "@types/chai": "^5.2.2", "@vitest/spy": "4.1.5", "@vitest/utils": "4.1.5", "chai": "^6.2.2", "tinyrainbow": "^3.1.0" } }, "sha512-PWBaRY5JoKuRnHlUHfpV/KohFylaDZTupcXN1H9vYryNLOnitSw60Mw9IAE2r67NbwwzBw/Cc/8q9BK3kIX8Kw=="],
+    "@vitest/expect": ["@vitest/expect@4.1.9", "", { "dependencies": { "@standard-schema/spec": "^1.1.0", "@types/chai": "^5.2.2", "@vitest/spy": "4.1.9", "@vitest/utils": "4.1.9", "chai": "^6.2.2", "tinyrainbow": "^3.1.0" } }, "sha512-vl/rYsUKcBr3SnQn166+XR5ZQcgMx3DQhFWdfli/cWpLnLUmbxZvyrJZotLFUryib+LtArYMSTJ5RbQ57ZqrlA=="],
 
-    "@vitest/mocker": ["@vitest/mocker@4.1.5", "", { "dependencies": { "@vitest/spy": "4.1.5", "estree-walker": "^3.0.3", "magic-string": "^0.30.21" }, "peerDependencies": { "msw": "^2.4.9", "vite": "^6.0.0 || ^7.0.0 || ^8.0.0" }, "optionalPeers": ["msw", "vite"] }, "sha512-/x2EmFC4mT4NNzqvC3fmesuV97w5FC903KPmey4gsnJiMQ3Be1IlDKVaDaG8iqaLFHqJ2FVEkxZk5VmeLjIItw=="],
+    "@vitest/mocker": ["@vitest/mocker@4.1.9", "", { "dependencies": { "@vitest/spy": "4.1.9", "estree-walker": "^3.0.3", "magic-string": "^0.30.21" }, "peerDependencies": { "msw": "^2.4.9", "vite": "^6.0.0 || ^7.0.0 || ^8.0.0" }, "optionalPeers": ["msw", "vite"] }, "sha512-EVkXzBjrPGM+cK8/ANWgBrkUCfJfb38/EfTSO8h7pWvKkyPkpWxvR7BkD2MyItMF62C97zAEoqdpUixwR/e+Rw=="],
 
-    "@vitest/pretty-format": ["@vitest/pretty-format@4.1.5", "", { "dependencies": { "tinyrainbow": "^3.1.0" } }, "sha512-7I3q6l5qr03dVfMX2wCo9FxwSJbPdwKjy2uu/YPpU3wfHvIL4QHwVRp57OfGrDFeUJ8/8QdfBKIV12FTtLn00g=="],
+    "@vitest/pretty-format": ["@vitest/pretty-format@4.1.9", "", { "dependencies": { "tinyrainbow": "^3.1.0" } }, "sha512-s0iufns3iIFitdgm+YR7g1whCAaGtXz459VS9/PqyKDEEFgYIhsHOQmXgIgDuYCt7DeQmiZT0Qe2OA2p4ZPu5A=="],
 
-    "@vitest/runner": ["@vitest/runner@4.1.5", "", { "dependencies": { "@vitest/utils": "4.1.5", "pathe": "^2.0.3" } }, "sha512-2D+o7Pr82IEO46YPpoA/YU0neeyr6FTerQb5Ro7BUnBuv6NQtT/kmVnczngiMEBhzgqz2UZYl5gArejsyERDSQ=="],
+    "@vitest/runner": ["@vitest/runner@4.1.9", "", { "dependencies": { "@vitest/utils": "4.1.9", "pathe": "^2.0.3" } }, "sha512-KXLMDtc7oe70+3mJfGrPUWPesswH+3sTxAMAMl8DG7I8IUQT4XW718dY5ID3vPUcmlu27CcKfY4P3h3I29SLJg=="],
 
-    "@vitest/snapshot": ["@vitest/snapshot@4.1.5", "", { "dependencies": { "@vitest/pretty-format": "4.1.5", "@vitest/utils": "4.1.5", "magic-string": "^0.30.21", "pathe": "^2.0.3" } }, "sha512-zypXEt4KH/XgKGPUz4eC2AvErYx0My5hfL8oDb1HzGFpEk1P62bxSohdyOmvz+d9UJwanI68MKwr2EquOaOgMQ=="],
+    "@vitest/snapshot": ["@vitest/snapshot@4.1.9", "", { "dependencies": { "@vitest/pretty-format": "4.1.9", "@vitest/utils": "4.1.9", "magic-string": "^0.30.21", "pathe": "^2.0.3" } }, "sha512-Jc7RKGNBo8Z28WYIm0Niej4xdSPByRf6mU58VpHQkd6Zh05rlnA+twjbK5HyeIGHxrzsc3mJgS43uM0CZKzaIA=="],
 
-    "@vitest/spy": ["@vitest/spy@4.1.5", "", {}, "sha512-2lNOsh6+R2Idnf1TCZqSwYlKN2E/iDlD8sgU59kYVl+OMDmvldO1VDk39smRfpUNwYpNRVn3w4YfuC7KfbBnkQ=="],
+    "@vitest/spy": ["@vitest/spy@4.1.9", "", {}, "sha512-fHpsS6mIi+PiEW+vcRVOMkX1oSaPKne3VOclSFICPcGOmfKgXPU5iAah+wcNcj2xPrCCmfq99IDGf+EojhhvhA=="],
 
-    "@vitest/utils": ["@vitest/utils@4.1.5", "", { "dependencies": { "@vitest/pretty-format": "4.1.5", "convert-source-map": "^2.0.0", "tinyrainbow": "^3.1.0" } }, "sha512-76wdkrmfXfqGjueGgnb45ITPyUi1ycZ4IHgC2bhPDUfWHklY/q3MdLOAB+TF1e6xfl8NxNY0ZYaPCFNWSsw3Ug=="],
+    "@vitest/utils": ["@vitest/utils@4.1.9", "", { "dependencies": { "@vitest/pretty-format": "4.1.9", "convert-source-map": "^2.0.0", "tinyrainbow": "^3.1.0" } }, "sha512-A51o8ymO5PpqlWNnBP9ZHPXDIpuMtTLlGSjN7la4US+LJzoUMyhwjA5QXlm39JexgwHKW4Xjs8Z2d3dLCXOeuA=="],
 
     "@webgpu/types": ["@webgpu/types@0.1.70", "", {}, "sha512-LFiNHHKMvmAEvwVew3JLJmTdShhbdwRFSImUshGhE2mGE8ybQzIo63l5uRp+YKnNx+8Qno8Kf6gN+DKMreIJCA=="],
 
@@ -3126,11 +3151,9 @@
 
     "ajv-keywords": ["ajv-keywords@3.5.2", "", { "peerDependencies": { "ajv": "^6.9.1" } }, "sha512-5p6WTN0DdTGVQk6VjcEju19IgaHudalcfabD7yhDGeA6bcQnmL+CpveLJq/3hvfwd1aof6L386Ougkx6RfyMIQ=="],
 
-    "ansi-colors": ["ansi-colors@4.1.3", "", {}, "sha512-/6w/C21Pm1A7aZitlI5Ni/2J6FFQN8i1Cvz3kHABAAbw93v/NlvKdVOqz7CCWz/3iv/JplRSEEZ83XION15ovw=="],
-
     "ansi-escapes": ["ansi-escapes@7.3.0", "", { "dependencies": { "environment": "^1.0.0" } }, "sha512-BvU8nYgGQBxcmMuEeUEmNTvrMVjJNSH7RgW24vXexN4Ven6qCvy4TntnvlnwnMLTVlcRQQdbRY8NKnaIoeWDNg=="],
 
-    "ansi-regex": ["ansi-regex@5.0.1", "", {}, "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ=="],
+    "ansi-regex": ["ansi-regex@6.2.2", "", {}, "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg=="],
 
     "ansi-styles": ["ansi-styles@6.2.3", "", {}, "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg=="],
 
@@ -3162,8 +3185,6 @@
 
     "array-iterate": ["array-iterate@2.0.1", "", {}, "sha512-I1jXZMjAgCMmxT4qxXfPXa6SthSoE8h6gkSI9BGGNv8mP8G/v0blc+qFnZu6K42vTOiuME596QaLO0TP3Lk0xg=="],
 
-    "array-union": ["array-union@2.1.0", "", {}, "sha512-HGyxoOTYUyCM6stUe6EJgnd4EoewAI7zMdfqO+kGjnlZmBDz/cR5pf8r/cR4Wq60sL/p0IkcjUEEPwS3GFrIyw=="],
-
     "asciinema-player": ["asciinema-player@3.15.1", "", { "dependencies": { "@babel/runtime": "^7.21.0", "solid-js": "^1.3.0", "solid-transition-group": "^0.2.3" } }, "sha512-agVYeNlPxthLyAb92l9AS7ypW0uhesqOuQzyR58Q4Sj+MvesQztZBgx86lHqNJkB8rQ6EP0LeA9czGytQUBpYw=="],
 
     "assert-plus": ["assert-plus@1.0.0", "", {}, "sha512-NfJ4UzBCcQGLDlQq7nHxH+tv3kyZ0hHQqF5BO6J7tNJeP5do1llPr8dZ8zHonfhAu0PHAdMkSo+8o0wxg9lZWw=="],
@@ -3220,10 +3241,10 @@
 
     "better-call": ["better-call@1.3.5", "", { "dependencies": { "@better-auth/utils": "^0.4.0", "@better-fetch/fetch": "^1.1.21", "rou3": "^0.7.12", "set-cookie-parser": "^3.0.1" }, "peerDependencies": { "zod": "^4.0.0" }, "optionalPeers": ["zod"] }, "sha512-kOFJkBP7utAQLEYrobZm3vkTH8mXq5GNgvjc5/XEST1ilVHaxXUXfeDeFlqoETMtyqS4+3/h4ONX2i++ebZrvA=="],
 
-    "better-path-resolve": ["better-path-resolve@1.0.0", "", { "dependencies": { "is-windows": "^1.0.0" } }, "sha512-pbnl5XzGBdrFU/wT4jqmJVPn2B6UHPBOhzMQkY/SPUPB6QtUXtmBHBIwCbXJol93mOpGMnQyP/+BB19q04xj7g=="],
-
     "better-sqlite3": ["better-sqlite3@12.10.0", "", { "dependencies": { "bindings": "^1.5.0", "prebuild-install": "^7.1.1" } }, "sha512-CyzaZRQKyHkB2ZInfTTl2nvT33EbDpjkLEbE8/Zck3Ll6O0qqvuGdrJ45HgtH+HykRg88ITY3AdreBGN70aBSQ=="],
 
+    "bidi-js": ["bidi-js@1.0.3", "", { "dependencies": { "require-from-string": "^2.0.2" } }, "sha512-RKshQI1R3YQ+n9YJz2QQ147P66ELpa1FQEg20Dk8oW9t2KgLbpDLLp9aGZ7y8WHSshDknG0bknqGw5/tyCs5tw=="],
+
     "bignumber.js": ["bignumber.js@9.3.1", "", {}, "sha512-Ko0uX15oIUS7wJ3Rb30Fs6SkVbLmPBAKdlm7q9+ak9bbIeFf0MwuBsQV6z7+X768/cHsfg+WlysDWJcmthjsjQ=="],
 
     "binary-extensions": ["binary-extensions@2.3.0", "", {}, "sha512-Ceh+7ox5qe7LJuLHoY0feh3pHuUDHAcRUeyL2VYghZwfpkNIy/+8Ocg0a3UuSoYzavmylwuLWQOf3hl0jjMMIw=="],
@@ -3520,7 +3541,7 @@
 
     "data-uri-to-buffer": ["data-uri-to-buffer@4.0.1", "", {}, "sha512-0R9ikRb668HB7QDxT1vkpuUBtqc53YyAwMwGeUFKRojY/NWKvdZ+9UYtRfGmhqNbRkTSVpMbmyhXipFFv2cb/A=="],
 
-    "dataloader": ["dataloader@1.4.0", "", {}, "sha512-68s5jYdlvasItOJnCuI2Q9s4q98g0pCyL3HrcKJu8KNugUl8ahgmZYg38ysLTgQjjXX3H8CJLkAvWrclWfcalw=="],
+    "data-urls": ["data-urls@7.0.0", "", { "dependencies": { "whatwg-mimetype": "^5.0.0", "whatwg-url": "^16.0.0" } }, "sha512-23XHcCF+coGYevirZceTVD7NdJOqVn+49IHyxgszm+JIiHLoB2TkmPtsYkNWT1pvRSGkc35L6NHs0yHkN2SumA=="],
 
     "date-fns": ["date-fns@4.1.0", "", {}, "sha512-Ukq0owbQXxa/U3EGtsdVBkR1w7KOQ5gIBqdH2hkvknzZPYvBxb/aa6E8L7tmjFtkwZBu3UXBbjIgPo/Ez4xaNg=="],
 
@@ -3532,6 +3553,8 @@
 
     "debug": ["debug@4.4.3", "", { "dependencies": { "ms": "^2.1.3" } }, "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA=="],
 
+    "decimal.js": ["decimal.js@10.6.0", "", {}, "sha512-YpgQiITW3JXGntzdUmyUR1V812Hn8T1YVXhCu+wO3OpS4eU9l4YdD3qjyiKdV6mvV29zapkMeD390UVEf2lkUg=="],
+
     "decimal.js-light": ["decimal.js-light@2.5.1", "", {}, "sha512-qIMFpTMZmny+MMIitAB6D7iVPEorVw6YQRWkvarTkT4tBeSLLiHzcwj6q0MmYSFCiVpiqPJTJEYIrpcPzVEIvg=="],
 
     "decode-named-character-reference": ["decode-named-character-reference@1.3.0", "", { "dependencies": { "character-entities": "^2.0.0" } }, "sha512-GtpQYB283KrPp6nRw50q3U9/VfOutZOe103qlN7BPP6Ad27xYnOIWv4lPzo8HCAL+mMZofJ9KEy30fq6MfaK6Q=="],
@@ -3544,6 +3567,8 @@
 
     "deep-extend": ["deep-extend@0.6.0", "", {}, "sha512-LOHxIOaPYdHlJRtCQfDIVZtfw/ufM8+rVj649RIHzcm/vGwQRXFt6OPqIFWsm2XEMrNIEtWR64sY1LEKD2vAOA=="],
 
+    "deepmerge": ["deepmerge@4.3.1", "", {}, "sha512-3sUqbMEc77XqpdNO7FRyRog+eW3ph+GYCbj+rK+uYyRMuwsVy0rMiVtPn+QJlKFvWP/1PYpapqYn0Me2knFn+A=="],
+
     "default-browser": ["default-browser@5.5.0", "", { "dependencies": { "bundle-name": "^4.1.0", "default-browser-id": "^5.0.0" } }, "sha512-H9LMLr5zwIbSxrmvikGuI/5KGhZ8E2zH3stkMgM5LpOWDutGM2JZaj460Udnf1a+946zc7YBgrqEWwbk7zHvGw=="],
 
     "default-browser-id": ["default-browser-id@5.0.1", "", {}, "sha512-x1VCxdX4t+8wVfd1so/9w+vQ4vx7lKd2Qp5tDRutErwmR85OgmfX7RlLRMWafRMY7hbEiXIbudNrjOAPa/hL8Q=="],
@@ -3572,8 +3597,6 @@
 
     "destr": ["destr@2.0.5", "", {}, "sha512-ugFTXCtDZunbzasqBxrK93Ik/DRYsO6S/fedkWEMKqt04xZ4csmnmwGDBAb07QWNaGMAmnTIemsYZCksjATwsA=="],
 
-    "detect-indent": ["detect-indent@6.1.0", "", {}, "sha512-reYkTUJAZb9gUuZ2RvVCNhVHdg62RHnJ7WJl8ftMi4diZ6NWlciOzQN88pUhSELEwflJht4oQDv0F0BMlwaYtA=="],
-
     "detect-libc": ["detect-libc@2.1.2", "", {}, "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ=="],
 
     "detect-node": ["detect-node@2.1.0", "", {}, "sha512-T0NIuQpnTvFDATNuHN5roPwSBG83rFsuO+MXXH9/3N1eFbn4wcPjttvjMLEPWJ0RGUYgQE7cGgS3tNxbqCGM7g=="],
@@ -3588,14 +3611,14 @@
 
     "dir-compare": ["dir-compare@4.2.0", "", { "dependencies": { "minimatch": "^3.0.5", "p-limit": "^3.1.0 " } }, "sha512-2xMCmOoMrdQIPHdsTawECdNPwlVFB9zGcz3kuhmBO6U3oU+UQjsue0i8ayLKpgBcm+hcXPMVSGUN9d+pvJ6+VQ=="],
 
-    "dir-glob": ["dir-glob@3.0.1", "", { "dependencies": { "path-type": "^4.0.0" } }, "sha512-WkrWp9GR4KXfKGYzOLmTuGVi1UWFfws377n9cc55/tb6DuqyF6pcQ5AbiHEshaDpY9v6oaSr2XCDidGmMwdzIA=="],
-
     "dlv": ["dlv@1.1.3", "", {}, "sha512-+HlytyjlPKnIG8XuRG8WvmBP8xs8P71y+SKKS6ZXWoEgLuePxtDoUEiH7WkdePWrQ5JBpE6aoVqfZfJUQkjXwA=="],
 
     "dmg-builder": ["dmg-builder@26.8.1", "", { "dependencies": { "app-builder-lib": "26.8.1", "builder-util": "26.8.1", "fs-extra": "^10.1.0", "iconv-lite": "^0.6.2", "js-yaml": "^4.1.0" }, "optionalDependencies": { "dmg-license": "^1.0.11" } }, "sha512-glMJgnTreo8CFINujtAhCgN96QAqApDMZ8Vl1r8f0QT8QprvC1UCltV4CcWj20YoIyLZx6IUskaJZ0NV8fokcg=="],
 
     "dmg-license": ["dmg-license@1.0.11", "", { "dependencies": { "@types/plist": "^3.0.1", "@types/verror": "^1.10.3", "ajv": "^6.10.0", "crc": "^3.8.0", "iconv-corefoundation": "^1.1.7", "plist": "^3.0.4", "smart-buffer": "^4.0.2", "verror": "^1.10.0" }, "os": "darwin", "bin": { "dmg-license": "bin/dmg-license.js" } }, "sha512-ZdzmqwKmECOWJpqefloC5OJy1+WZBBse5+MR88z9g9Zn4VY+WYUkAyojmhzJckH5YbbZGcYIuGAkY5/Ys5OM2Q=="],
 
+    "dom-accessibility-api": ["dom-accessibility-api@0.5.16", "", {}, "sha512-X7BJ2yElsnOJ30pZF4uIIDfBEVgF4XEBxL9Bxhy6dnrm5hkzqmsWHGTiHqRiITNhMyFLyAiWndIJP7Z1NTteDg=="],
+
     "dom-serializer": ["dom-serializer@2.0.0", "", { "dependencies": { "domelementtype": "^2.3.0", "domhandler": "^5.0.2", "entities": "^4.2.0" } }, "sha512-wIkAryiqt/nV5EQKqQpo3SToSOV9J0DnbJqwK7Wv/Trc92zIAYZ4FlMu+JPFW1DfGFt81ZTCGgDEabffXeLyJg=="],
 
     "domelementtype": ["domelementtype@2.3.0", "", {}, "sha512-OLETBj6w0OsagBwdXnPdN0cnMfF9opN69co+7ZrbfPGrdpPVNBUj02spi6B1N7wChLQiPn4CSH/zJvXw56gmHw=="],
@@ -3608,7 +3631,7 @@
 
     "dot-prop": ["dot-prop@9.0.0", "", { "dependencies": { "type-fest": "^4.18.2" } }, "sha512-1gxPBJpI/pcjQhKgIU91II6Wkay+dLcN3M6rf2uwP8hRur3HtQXjVrdAK3sjC0piaEuxzMwjXChcETiJl47lAQ=="],
 
-    "dotenv": ["dotenv@8.6.0", "", {}, "sha512-IrPdXQsk2BbzvCBGBOTmmSH5SodmqZNt4ERAZDmW4CT+tL8VtvinqywuANaFu4bOMWki16nqf0e4oC0QIaDr/g=="],
+    "dotenv": ["dotenv@17.4.2", "", {}, "sha512-nI4U3TottKAcAD9LLud4Cb7b2QztQMUEfHbvhTH09bqXTxnSie8WnjPALV/WMCrJZ6UV/qHJ6L03OqO3LcdYZw=="],
 
     "dotenv-expand": ["dotenv-expand@11.0.7", "", { "dependencies": { "dotenv": "^16.4.5" } }, "sha512-zIHwmZPRshsCdpMDyVsqGmgyP0yT8GAgXUnkdAoJisxvf33k7yO6OuoKmcTGuXPWSsm8Oh88nZicRLA9Y0rUeA=="],
 
@@ -3670,9 +3693,7 @@
 
     "enhanced-resolve": ["enhanced-resolve@5.20.1", "", { "dependencies": { "graceful-fs": "^4.2.4", "tapable": "^2.3.0" } }, "sha512-Qohcme7V1inbAfvjItgw0EaxVX5q2rdVEZHRBrEQdRZTssLDGsL8Lwrznl8oQ/6kuTJONLaDcGjkNP247XEhcA=="],
 
-    "enquirer": ["enquirer@2.4.1", "", { "dependencies": { "ansi-colors": "^4.1.1", "strip-ansi": "^6.0.1" } }, "sha512-rRqJg/6gd538VHvR3PSrdRBb/1Vy2YfzHqzvbhGIQpDRKIa4FgV/54b5Q1xYSxOOwKvjXweS26E0Q+nAMwp2pQ=="],
-
-    "entities": ["entities@4.5.0", "", {}, "sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw=="],
+    "entities": ["entities@8.0.0", "", {}, "sha512-zwfzJecQ/Uej6tusMqwAqU/6KL2XaB2VZ2Jg54Je6ahNBGNH6Ek6g3jjNCF0fG9EWQKGZNddNjU5F1ZQn/sBnA=="],
 
     "env-paths": ["env-paths@3.0.0", "", {}, "sha512-dtJUTepzMW3Lm/NPxRf3wP4642UWhjL2sQxc+ym2YMj1m/H2zDNQOlezafzkHwn6sMstjHTwG6iQQsctDW/b1A=="],
 
@@ -3714,7 +3735,9 @@
 
     "escape-string-regexp": ["escape-string-regexp@2.0.0", "", {}, "sha512-UpzcLCXolUWcNu5HtVMHYdXJjArjsF9C0aNnquZYY4uW/Vu0miy5YoWvbV345HauVvcAUnpRuhMMcqTcGOY2+w=="],
 
-    "esprima": ["esprima@4.0.1", "", { "bin": { "esparse": "./bin/esparse.js", "esvalidate": "./bin/esvalidate.js" } }, "sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A=="],
+    "esm-env": ["esm-env@1.2.2", "", {}, "sha512-Epxrv+Nr/CaL4ZcFGPJIYLWFom+YeV1DqMLHJoEd9SYRxNbaFruBwfEX/kkHUJf55j2+TUbmDcmuilbP1TmXHA=="],
+
+    "esrap": ["esrap@2.2.12", "", { "dependencies": { "@jridgewell/sourcemap-codec": "^1.4.15" }, "peerDependencies": { "@typescript-eslint/types": "^8.2.0" }, "optionalPeers": ["@typescript-eslint/types"] }, "sha512-On0QbLyaiAkVC4eXtgnXK9Kh2opit+3rcUSOc45DqJ2s/X2eXAHsGOKRSJ6IDagQEW5vPyivANfXUiqgXC67Rw=="],
 
     "estree-util-attach-comments": ["estree-util-attach-comments@3.0.0", "", { "dependencies": { "@types/estree": "^1.0.0" } }, "sha512-cKUwm/HUcTDsYh/9FgnuFqpfquUbwIqwKM26BVCGDPVgvaCl/nDCCjUfiLlx6lsEZ3Z4RFxNbOQ60pkaEwFxGw=="],
 
@@ -3746,7 +3769,7 @@
 
     "execa": ["execa@9.6.1", "", { "dependencies": { "@sindresorhus/merge-streams": "^4.0.0", "cross-spawn": "^7.0.6", "figures": "^6.1.0", "get-stream": "^9.0.0", "human-signals": "^8.0.1", "is-plain-obj": "^4.1.0", "is-stream": "^4.0.1", "npm-run-path": "^6.0.0", "pretty-ms": "^9.2.0", "signal-exit": "^4.1.0", "strip-final-newline": "^4.0.0", "yoctocolors": "^2.1.1" } }, "sha512-9Be3ZoN4LmYR90tUoVu2te2BsbzHfhJyfEiAVfz7N5/zv+jduIfLrV2xdQXOHbaD6KgpGdO9PRPM1Y4Q9QkPkA=="],
 
-    "executor": ["executor@workspace:apps/cli"],
+    "executor": ["executor@workspace:legacy/cli"],
 
     "exif-parser": ["exif-parser@0.1.12", "", {}, "sha512-c2bQfLNbMzLPmzQuOr8fy0csy84WmwnER81W88DzTp9CYNPJ6yzOj2EZAh9pywYpqHnshVLHQJ8WzldAyfY+Iw=="],
 
@@ -3766,8 +3789,6 @@
 
     "extend-shallow": ["extend-shallow@2.0.1", "", { "dependencies": { "is-extendable": "^0.1.0" } }, "sha512-zCnTtlxNoAiDc3gqY2aYAWFx7XWWiasuF2K8Me5WbN8otHKTUKBwjPtNpRs/rbUZm7KxWAaNj7P1a/p52GbVug=="],
 
-    "extendable-error": ["extendable-error@0.1.7", "", {}, "sha512-UOiS2in6/Q0FK0R0q6UY9vYpQ21mr/Qn1KOnte7vsACuNJf514WvCCUHSRCPcgjPT2bAhNIJdlE6bVap1GKmeg=="],
-
     "extract-zip": ["extract-zip@2.0.1", "", { "dependencies": { "debug": "^4.1.1", "get-stream": "^5.1.0", "yauzl": "^2.10.0" }, "optionalDependencies": { "@types/yauzl": "^2.9.1" }, "bin": { "extract-zip": "cli.js" } }, "sha512-GDhU9ntwuKyGXdZBUgTIe+vXnWj0fppUEtMDL0+idd5Sta8TGpHssn/eusA9mrPr9qNDym6SxAYZjNvCn/9RBg=="],
 
     "extsprintf": ["extsprintf@1.4.1", "", {}, "sha512-Wrk35e8ydCKDj/ArClo1VrPVmN8zph5V4AtHwIuHhvMXsKf73UT3BOD+azBIW+3wOJ4FhEH7zyaJCFvChjYvMA=="],
@@ -3820,8 +3841,6 @@
 
     "find-root": ["find-root@1.1.0", "", {}, "sha512-NKfW6bec6GfKc0SGx1e07QZY9PE99u0Bft/0rzSD5k3sO/vwkVUpDUKVm5Gpp5Ue3YfShPFTX2070tDs5kB9Ng=="],
 
-    "find-up": ["find-up@4.1.0", "", { "dependencies": { "locate-path": "^5.0.0", "path-exists": "^4.0.0" } }, "sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw=="],
-
     "fix-dts-default-cjs-exports": ["fix-dts-default-cjs-exports@1.0.1", "", { "dependencies": { "magic-string": "^0.30.17", "mlly": "^1.7.4", "rollup": "^4.34.8" } }, "sha512-pVIECanWFC61Hzl2+oOCtoJ3F17kglZC/6N94eRWycFgBH35hHx0Li604ZIzhseh97mf2p0cv7vVrOZGoqhlEg=="],
 
     "flattie": ["flattie@1.1.1", "", {}, "sha512-9UbaD6XdAL97+k/n+N7JwX46K/M6Zc6KcFYskrYL8wbBV/Uyk0CTAMY0VT+qiK5PM7AIc9aTWYtq65U7T+aCNQ=="],
@@ -3856,7 +3875,7 @@
 
     "fs-constants": ["fs-constants@1.0.0", "", {}, "sha512-y6OAwoSIf7FyjMIv94u+b5rdheZEjzR63GTyZJm5qh4Bi+2YgwLCcI/fPFZkL5PSixOt6ZNKm+w+Hfp/Bciwow=="],
 
-    "fs-extra": ["fs-extra@7.0.1", "", { "dependencies": { "graceful-fs": "^4.1.2", "jsonfile": "^4.0.0", "universalify": "^0.1.0" } }, "sha512-YJDaCJZEnBmcbw13fvdAM9AwNOJwOzrE4pqMqBq5nFiEqXUqHwlK4B+3pUw6JNvfSPtX05xFHtYy/1ni01eGCw=="],
+    "fs-extra": ["fs-extra@10.1.0", "", { "dependencies": { "graceful-fs": "^4.2.0", "jsonfile": "^6.0.1", "universalify": "^2.0.0" } }, "sha512-oRXApq54ETRj4eMiFzGnHWGy+zo5raudjuxN0b8H7s/RU2oW0Wvsx9O0ACRN/kRq9E8Vu/ReskGB5o3ji+FzHQ=="],
 
     "fs.realpath": ["fs.realpath@1.0.0", "", {}, "sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw=="],
 
@@ -3898,8 +3917,6 @@
 
     "globalthis": ["globalthis@1.0.4", "", { "dependencies": { "define-properties": "^1.2.1", "gopd": "^1.0.1" } }, "sha512-DpLKbNU4WylpxJykQujfCcwYWiV/Jhm50Goo0wrVILAv5jOr9d+H+UR3PhSCD2rCCEIg0uc+G+muBTwD54JhDQ=="],
 
-    "globby": ["globby@11.1.0", "", { "dependencies": { "array-union": "^2.1.0", "dir-glob": "^3.0.1", "fast-glob": "^3.2.9", "ignore": "^5.2.0", "merge2": "^1.4.1", "slash": "^3.0.0" } }, "sha512-jhIXaOzy1sb8IyocaruWSn1TjmnBVs8Ayhcy83rmxNJ8q2uWKCAj3CnJY+KpGSXCueAPc0i05kVvVKtP1t9S3g=="],
-
     "gopd": ["gopd@1.2.0", "", {}, "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg=="],
 
     "got": ["got@11.8.6", "", { "dependencies": { "@sindresorhus/is": "^4.0.0", "@szmarczak/http-timer": "^4.0.5", "@types/cacheable-request": "^6.0.1", "@types/responselike": "^1.0.0", "cacheable-lookup": "^5.0.3", "cacheable-request": "^7.0.2", "decompress-response": "^6.0.0", "http2-wrapper": "^1.0.0-beta.5.2", "lowercase-keys": "^2.0.0", "p-cancelable": "^2.0.0", "responselike": "^2.0.0" } }, "sha512-6tfZ91bOr7bOXnK7PRDCGBLa1H4U080YHNaAQ2KsMGlLEzRbk44nsZF2E1IeRc3vtJHPVbKCYgdFbaGO2ljd8g=="],
@@ -3962,6 +3979,8 @@
 
     "hosted-git-info": ["hosted-git-info@4.1.0", "", { "dependencies": { "lru-cache": "^6.0.0" } }, "sha512-kyCuEOWjJqZuDbRHzL8V93NzQhwIB71oFWSyzVo+KPZI+pnQPPxucdkrOZvkLRnrf5URsQM+IJ09Dw29cRALIA=="],
 
+    "html-encoding-sniffer": ["html-encoding-sniffer@6.0.0", "", { "dependencies": { "@exodus/bytes": "^1.6.0" } }, "sha512-CV9TW3Y3f8/wT0BRFc1/KAVQ3TUHiXmaAb6VW9vtiMFf7SLoMd1PdAc4W3KFOFETBJUb90KatHqlsZMWV+R9Gg=="],
+
     "html-escaper": ["html-escaper@3.0.3", "", {}, "sha512-RuMffC89BOWQoY0WKGpIhn5gX3iI54O6nRA0yC124NYVtzjmFWBIiFd8M0x+ZdX0P9R4lADg1mgP8C7PxGOWuQ=="],
 
     "html-url-attributes": ["html-url-attributes@3.0.1", "", {}, "sha512-ol6UPyBWqsrO6EJySPz2O7ZSr856WDrEzM5zMqp+FJJLGMW35cLYmmZnl0vztAZxRUoNZJFTCohfjuIJ8I4QBQ=="],
@@ -3980,8 +3999,6 @@
 
     "https-proxy-agent": ["https-proxy-agent@7.0.6", "", { "dependencies": { "agent-base": "^7.1.2", "debug": "4" } }, "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw=="],
 
-    "human-id": ["human-id@4.1.3", "", { "bin": { "human-id": "dist/cli.js" } }, "sha512-tsYlhAYpjCKa//8rXZ9DqKEawhPoSytweBC2eNvcaDK+57RZLHGqNs3PZTQO6yekLFSuvA6AlnAfrw1uBvtb+Q=="],
-
     "human-signals": ["human-signals@8.0.1", "", {}, "sha512-eKCa6bwnJhvxj14kZk5NCPc6Hb6BdsU9DZcOnmQKSnO1VKrfV0zCvtttPZUsBvjmNDn8rpcJfpwSYnHBjc95MQ=="],
 
     "iconv-corefoundation": ["iconv-corefoundation@1.1.7", "", { "dependencies": { "cli-truncate": "^2.1.0", "node-addon-api": "^1.6.3" }, "os": "darwin" }, "sha512-T10qvkw0zz4wnm560lOEg0PovVqUXuOFhhHAkixw8/sycy7TJt7v/RrkEKEQnAw2viPSJu6iAkErxnzR0g8PpQ=="],
@@ -4094,11 +4111,13 @@
 
     "is-plain-object": ["is-plain-object@2.0.4", "", { "dependencies": { "isobject": "^3.0.1" } }, "sha512-h5PpgXkWitc38BBMYawTYMWJHFZJVnBquFE57xFpjB8pJFiF6gZ+bU+WyI/yqXiFR5mdLsgYNaPe8uao6Uv9Og=="],
 
+    "is-potential-custom-element-name": ["is-potential-custom-element-name@1.0.1", "", {}, "sha512-bCYeRA2rVibKZd+s2625gGnGF/t7DSqDs4dP7CrLA1m7jKWz6pps0LpYLJN8Q64HtmPKJ1hrN3nzPNKFEKOUiQ=="],
+
     "is-promise": ["is-promise@4.0.0", "", {}, "sha512-hvpoI6korhJMnej285dSg6nu1+e6uxs7zG3BYAm5byqDsgJNWwxzM6z6iZiAgQR4TJ30JmBTOwqZUw3WlyH3AQ=="],
 
-    "is-stream": ["is-stream@4.0.1", "", {}, "sha512-Dnz92NInDqYckGEUJv689RbRiTSEHCQ7wOVeALbkOz999YpqT46yMRIGtSNl2iCL1waAZSx40+h59NV/EwzV/A=="],
+    "is-reference": ["is-reference@3.0.3", "", { "dependencies": { "@types/estree": "^1.0.6" } }, "sha512-ixkJoqQvAP88E6wLydLGGqCJsrFUnqoH6HnaczB8XmDH1oaWU+xxdptvikTgaEhtZ53Ky6YXiBuUI2WXLMCwjw=="],
 
-    "is-subdir": ["is-subdir@1.2.0", "", { "dependencies": { "better-path-resolve": "1.0.0" } }, "sha512-2AT6j+gXe/1ueqbW6fLZJiIw3F8iXGJtt0yDrZaBhAZEG1raiTxKWU+IPqMCzQAXOUCKdA4UDMgacKH25XG2Cw=="],
+    "is-stream": ["is-stream@4.0.1", "", {}, "sha512-Dnz92NInDqYckGEUJv689RbRiTSEHCQ7wOVeALbkOz999YpqT46yMRIGtSNl2iCL1waAZSx40+h59NV/EwzV/A=="],
 
     "is-typed-array": ["is-typed-array@1.1.15", "", { "dependencies": { "which-typed-array": "^1.1.16" } }, "sha512-p3EcsicXjit7SaskXHs1hA91QxgTw46Fv6EFKKGS5DRFLD8yKnohjF3hxoju94b/OcMZoQukzpPpBE9uLVKzgQ=="],
 
@@ -4106,8 +4125,6 @@
 
     "is-wayland": ["is-wayland@0.1.0", "", {}, "sha512-QkbMsWkIfkrzOPxenwye0h56iAXirZYHG9eHVPb22fO9y+wPbaX/CHacOWBa/I++4ohTcByimhM1/nyCsH8KNA=="],
 
-    "is-windows": ["is-windows@1.0.2", "", {}, "sha512-eXK1UInq2bPmjyX6e3VHIzMLobc4J94i4AWn+Hpq3OU5KkrRC96OAcR3PRJ/pGu6m8TRnBHP9dkXQVsT/COVIA=="],
-
     "is-wsl": ["is-wsl@3.1.1", "", { "dependencies": { "is-inside-container": "^1.0.0" } }, "sha512-e6rvdUCiQCAuumZslxRJWR/Doq4VpPR82kqclvcS0efgt430SlGIk05vdCN58+VrzgtIcfNODjozVielycD4Sw=="],
 
     "is64bit": ["is64bit@2.0.0", "", { "dependencies": { "system-architecture": "^0.1.0" } }, "sha512-jv+8jaWCl0g2lSBkNSVXdzfBA0npK1HGC2KtWM9FumFRoGS94g3NbCCLVnCYHLjp4GrW2KZeeSTMo5ddtznmGw=="],
@@ -4144,6 +4161,8 @@
 
     "js-yaml": ["js-yaml@4.1.1", "", { "dependencies": { "argparse": "^2.0.1" }, "bin": { "js-yaml": "bin/js-yaml.js" } }, "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA=="],
 
+    "jsdom": ["jsdom@29.1.1", "", { "dependencies": { "@asamuzakjp/css-color": "^5.1.11", "@asamuzakjp/dom-selector": "^7.1.1", "@bramus/specificity": "^2.4.2", "@csstools/css-syntax-patches-for-csstree": "^1.1.3", "@exodus/bytes": "^1.15.0", "css-tree": "^3.2.1", "data-urls": "^7.0.0", "decimal.js": "^10.6.0", "html-encoding-sniffer": "^6.0.0", "is-potential-custom-element-name": "^1.0.1", "lru-cache": "^11.3.5", "parse5": "^8.0.1", "saxes": "^6.0.0", "symbol-tree": "^3.2.4", "tough-cookie": "^6.0.1", "undici": "^7.25.0", "w3c-xmlserializer": "^5.0.0", "webidl-conversions": "^8.0.1", "whatwg-mimetype": "^5.0.0", "whatwg-url": "^16.0.1", "xml-name-validator": "^5.0.0" }, "peerDependencies": { "canvas": "^3.0.0" }, "optionalPeers": ["canvas"] }, "sha512-ECi4Fi2f7BdJtUKTflYRTiaMxIB0O6zfR1fX0GXpUrf6flp8QIYn1UT20YQqdSOfk2dfkCwS8LAFoJDEppNK5Q=="],
+
     "jsesc": ["jsesc@3.1.0", "", { "bin": { "jsesc": "bin/jsesc" } }, "sha512-/sM3dO2FOzXjKQhJuo0Q173wf2KOo8t4I8vHy6lF9poUp7bKT0/NHE8fPX23PwfhnykfqnC2xRxOnVw5XuGIaA=="],
 
     "json-buffer": ["json-buffer@3.0.1", "", {}, "sha512-4bV5BfR2mqfQTJm+V5tPPdf+ZpuhiIvTuAB5g8kcrXOZpTT/QwwVRWBywX1ozr6lEuPdbHxwaJlm9G6mI2sfSQ=="],
@@ -4182,7 +4201,7 @@
 
     "kind-of": ["kind-of@3.2.2", "", { "dependencies": { "is-buffer": "^1.1.5" } }, "sha512-NOW9QQXMoZGg/oqnVNoNTTIFEIid1627WCffUBJEdMxYApq7mNE7CpzucIPc+ZQg25Phej7IJSmX3hO+oblOtQ=="],
 
-    "kleur": ["kleur@3.0.3", "", {}, "sha512-eTIzlVOSUR+JxdDFepEYcBMtZ9Qqdef+rnzWdRZuMbOywu5tO2w2N7rqjoANZ5k9vywhL6Br1VRjUIgTQx4E8w=="],
+    "kleur": ["kleur@4.1.5", "", {}, "sha512-o+NO+8WrRiQEE4/7nwRJhN1HWpVmJm511pBHUxPLtp0BUISzlBplORYSmTclCnJvQq2tKu/sgl3xVpkc7ZWuQQ=="],
 
     "knip": ["knip@6.4.1", "", { "dependencies": { "@nodelib/fs.walk": "^1.2.3", "fast-glob": "^3.3.3", "formatly": "^0.3.0", "get-tsconfig": "4.13.7", "jiti": "^2.6.0", "minimist": "^1.2.8", "oxc-parser": "^0.121.0", "oxc-resolver": "^11.19.1", "picocolors": "^1.1.1", "picomatch": "^4.0.1", "smol-toml": "^1.6.1", "strip-json-comments": "5.0.3", "unbash": "^2.2.0", "yaml": "^2.8.2", "zod": "^4.1.11" }, "bin": { "knip": "bin/knip.js", "knip-bun": "bin/knip-bun.js" } }, "sha512-Ry+ywmDFSZvKp/jx7LxMgsZWRTs931alV84e60lh0Stf6kSRYqSIUTkviyyDFRcSO3yY1Kpbi83OirN+4lA2Xw=="],
 
@@ -4238,7 +4257,7 @@
 
     "load-tsconfig": ["load-tsconfig@0.2.5", "", {}, "sha512-IXO6OCs9yg8tMKzfPZ1YmheJbZCiEsnBdcB03l0OcfK9prKnJb96siuHCr5Fl37/yo9DnKU+TLpxzTUspw9shg=="],
 
-    "locate-path": ["locate-path@5.0.0", "", { "dependencies": { "p-locate": "^4.1.0" } }, "sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g=="],
+    "locate-character": ["locate-character@3.0.0", "", {}, "sha512-SW13ws7BjaeJ6p7Q6CO2nchbYEc3X3J6WrmTTDto7yMPqVSZTUyY5Tjbid+Ab8gLnATtygYtiDIJGQRRn2ZOiA=="],
 
     "lodash": ["lodash@4.18.1", "", {}, "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q=="],
 
@@ -4268,8 +4287,6 @@
 
     "lodash.once": ["lodash.once@4.1.1", "", {}, "sha512-Sb487aTOCr9drQVL8pIxOzVhafOjZN9UU54hiN8PU3uAiSV7lx1yYNpbNmex2PK6dSJoNTSJUUswT651yww3Mg=="],
 
-    "lodash.startcase": ["lodash.startcase@4.4.0", "", {}, "sha512-+WKqsK294HMSc2jEbNgpHpd0JfIBhp7rEV4aqXWqFr6AlXov+SlcgB1Fv01y2kGe3Gc8nMW7VA0SrGuSkRfIEg=="],
-
     "log-symbols": ["log-symbols@7.0.1", "", { "dependencies": { "is-unicode-supported": "^2.0.0", "yoctocolors": "^2.1.1" } }, "sha512-ja1E3yCr9i/0hmBVaM0bfwDjnGy8I/s6PP4DFp+yP+a+mrHO4Rm7DtmnqROTUkHIkqffC84YY7AeqX6oFk0WFg=="],
 
     "long": ["long@5.3.2", "", {}, "sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA=="],
@@ -4288,6 +4305,8 @@
 
     "lucide-react": ["lucide-react@1.8.0", "", { "peerDependencies": { "react": "^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0" } }, "sha512-WuvlsjngSk7TnTBJ1hsCy3ql9V9VOdcPkd3PKcSmM34vJD8KG6molxz7m7zbYFgICwsanQWmJ13JlYs4Zp7Arw=="],
 
+    "lz-string": ["lz-string@1.5.0", "", { "bin": { "lz-string": "bin/bin.js" } }, "sha512-h5bgJWpxJNswbU7qCrV0tIKQCaS3blPDrqKWx+QxzuzL1zGUzij9XCWLrSLsJPu5t+eWA/ycetzYAO5IOMcWAQ=="],
+
     "macos-version": ["macos-version@6.0.0", "", { "dependencies": { "semver": "^7.3.5" } }, "sha512-O2S8voA+pMfCHhBn/TIYDXzJ1qNHpPDU32oFxglKnVdJABiYYITt45oLkV9yhwA3E2FDwn3tQqUFrTsr1p3sBQ=="],
 
     "magic-string": ["magic-string@0.30.21", "", { "dependencies": { "@jridgewell/sourcemap-codec": "^1.5.5" } }, "sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ=="],
@@ -4512,7 +4531,7 @@
 
     "node-domexception": ["node-domexception@1.0.0", "", {}, "sha512-/jKZoMpw0F8GRwl4/eLROPA3cfcXtLApP0QzLmUT/HuPCZWyB7IY9ZrMeKw2O/nFIqPQB3PVM9aYm0F312AXDQ=="],
 
-    "node-fetch": ["node-fetch@2.7.0", "", { "dependencies": { "whatwg-url": "^5.0.0" }, "peerDependencies": { "encoding": "^0.1.0" }, "optionalPeers": ["encoding"] }, "sha512-c4FRfUm/dbcWZ7U+1Wq0AwCyFL+3nt2bEw05wfxSz+DWpWsitgmSgYmy2dQdWyKC1694ELPqMs/YzUSNozLt8A=="],
+    "node-fetch": ["node-fetch@3.3.2", "", { "dependencies": { "data-uri-to-buffer": "^4.0.0", "fetch-blob": "^3.1.4", "formdata-polyfill": "^4.0.10" } }, "sha512-dRB78srN/l6gqWulah9SrxeYnxeddIG30+GOqK/9OlLVyLg3HPnr6SqOWTWOXKRwC2eGYCkZ59NNuSgvSrpgOA=="],
 
     "node-fetch-native": ["node-fetch-native@1.6.7", "", {}, "sha512-g9yhqoedzIUm0nTnTqAQvueMPVOuIY16bqgAJJC8XOOubYFNwz6IER9qs0Gq2Xd0+CecCKFjtdDTMA4u4xG06Q=="],
 
@@ -4572,8 +4591,6 @@
 
     "ora": ["ora@9.4.0", "", { "dependencies": { "chalk": "^5.6.2", "cli-cursor": "^5.0.0", "cli-spinners": "^3.2.0", "is-interactive": "^2.0.0", "is-unicode-supported": "^2.1.0", "log-symbols": "^7.0.1", "stdin-discarder": "^0.3.2", "string-width": "^8.1.0" } }, "sha512-84cglkRILFxdtA8hAvLNdMrtBpPNBTrQ9/ulg0FA7xLMnD6mifv+enAIeRmvtv+WgdCE+LPGOfQmtJRrVaIVhQ=="],
 
-    "outdent": ["outdent@0.5.0", "", {}, "sha512-/jHxFIzoMXdqPzTaCpFzAAWhpkSjZPF4Vsn6jAfNpmbH/ymsmd7Qc6VE9BGn0L6YMj6uwpQLxCECpus4ukKS9Q=="],
-
     "oxc-parser": ["oxc-parser@0.121.0", "", { "dependencies": { "@oxc-project/types": "^0.121.0" }, "optionalDependencies": { "@oxc-parser/binding-android-arm-eabi": "0.121.0", "@oxc-parser/binding-android-arm64": "0.121.0", "@oxc-parser/binding-darwin-arm64": "0.121.0", "@oxc-parser/binding-darwin-x64": "0.121.0", "@oxc-parser/binding-freebsd-x64": "0.121.0", "@oxc-parser/binding-linux-arm-gnueabihf": "0.121.0", "@oxc-parser/binding-linux-arm-musleabihf": "0.121.0", "@oxc-parser/binding-linux-arm64-gnu": "0.121.0", "@oxc-parser/binding-linux-arm64-musl": "0.121.0", "@oxc-parser/binding-linux-ppc64-gnu": "0.121.0", "@oxc-parser/binding-linux-riscv64-gnu": "0.121.0", "@oxc-parser/binding-linux-riscv64-musl": "0.121.0", "@oxc-parser/binding-linux-s390x-gnu": "0.121.0", "@oxc-parser/binding-linux-x64-gnu": "0.121.0", "@oxc-parser/binding-linux-x64-musl": "0.121.0", "@oxc-parser/binding-openharmony-arm64": "0.121.0", "@oxc-parser/binding-wasm32-wasi": "0.121.0", "@oxc-parser/binding-win32-arm64-msvc": "0.121.0", "@oxc-parser/binding-win32-ia32-msvc": "0.121.0", "@oxc-parser/binding-win32-x64-msvc": "0.121.0" } }, "sha512-ek9o58+SCv6AV7nchiAcUJy1DNE2CC5WRdBcO0mF+W4oRjNQfPO7b3pLjTHSFECpHkKGOZSQxx3hk8viIL5YCg=="],
 
     "oxc-resolver": ["oxc-resolver@11.19.1", "", { "optionalDependencies": { "@oxc-resolver/binding-android-arm-eabi": "11.19.1", "@oxc-resolver/binding-android-arm64": "11.19.1", "@oxc-resolver/binding-darwin-arm64": "11.19.1", "@oxc-resolver/binding-darwin-x64": "11.19.1", "@oxc-resolver/binding-freebsd-x64": "11.19.1", "@oxc-resolver/binding-linux-arm-gnueabihf": "11.19.1", "@oxc-resolver/binding-linux-arm-musleabihf": "11.19.1", "@oxc-resolver/binding-linux-arm64-gnu": "11.19.1", "@oxc-resolver/binding-linux-arm64-musl": "11.19.1", "@oxc-resolver/binding-linux-ppc64-gnu": "11.19.1", "@oxc-resolver/binding-linux-riscv64-gnu": "11.19.1", "@oxc-resolver/binding-linux-riscv64-musl": "11.19.1", "@oxc-resolver/binding-linux-s390x-gnu": "11.19.1", "@oxc-resolver/binding-linux-x64-gnu": "11.19.1", "@oxc-resolver/binding-linux-x64-musl": "11.19.1", "@oxc-resolver/binding-openharmony-arm64": "11.19.1", "@oxc-resolver/binding-wasm32-wasi": "11.19.1", "@oxc-resolver/binding-win32-arm64-msvc": "11.19.1", "@oxc-resolver/binding-win32-ia32-msvc": "11.19.1", "@oxc-resolver/binding-win32-x64-msvc": "11.19.1" } }, "sha512-qE/CIg/spwrTBFt5aKmwe3ifeDdLfA2NESN30E42X/lII5ClF8V7Wt6WIJhcGZjp0/Q+nQ+9vgxGk//xZNX2hg=="],
@@ -4584,23 +4601,15 @@
 
     "p-cancelable": ["p-cancelable@2.1.1", "", {}, "sha512-BZOr3nRQHOntUjTrH8+Lh54smKHoHyur8We1V8DSMVrl5A2malOOwuJRnKRDjSnkoeBh4at6BwEnb5I7Jl31wg=="],
 
-    "p-filter": ["p-filter@2.1.0", "", { "dependencies": { "p-map": "^2.0.0" } }, "sha512-ZBxxZ5sL2HghephhpGAQdoskxplTwr7ICaehZwLIlfL6acuVgZPm8yBNuRAFBGEqtD/hmUeq9eqLg2ys9Xr/yw=="],
-
     "p-limit": ["p-limit@7.3.0", "", { "dependencies": { "yocto-queue": "^1.2.1" } }, "sha512-7cIXg/Z0M5WZRblrsOla88S4wAK+zOQQWeBYfV3qJuJXMr+LnbYjaadrFaS0JILfEDPVqHyKnZ1Z/1d6J9VVUw=="],
 
-    "p-locate": ["p-locate@4.1.0", "", { "dependencies": { "p-limit": "^2.2.0" } }, "sha512-R79ZZ/0wAxKGu3oYMlz8jy/kbhsNrS7SKZ7PxEHBgJ5+F2mtFW2fK2cOtBh1cHYkQsbzFV7I+EoRKe6Yt0oK7A=="],
-
-    "p-map": ["p-map@2.1.0", "", {}, "sha512-y3b8Kpd8OAN444hxfBbFfj1FY/RjtTd8tzYwhUqNYXx0fXx2iX4maP4Qr6qhIKbQXI02wTLAda4fYUbDagTUFw=="],
-
     "p-queue": ["p-queue@9.1.2", "", { "dependencies": { "eventemitter3": "^5.0.1", "p-timeout": "^7.0.0" } }, "sha512-ktsDOALzTYTWWF1PbkNVg2rOt+HaOaMWJMUnt7T3qf5tvZ1L8dBW3tObzprBcXNMKkwj+yFSLqHso0x+UFcJXw=="],
 
     "p-timeout": ["p-timeout@7.0.1", "", {}, "sha512-AxTM2wDGORHGEkPCt8yqxOTMgpfbEHqF51f/5fJCmwFC3C/zNcGT63SymH2ttOAaiIws2zVg4+izQCjrakcwHg=="],
 
-    "p-try": ["p-try@2.2.0", "", {}, "sha512-R4nPAVTAU0B9D35/Gk3uJf/7XYbQcyohSKdvAxIRSNghFl4e71hVoGnBNQz9cWaXxO2I10KTC+3jMdvvoKw6dQ=="],
-
     "package-json-from-dist": ["package-json-from-dist@1.0.1", "", {}, "sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw=="],
 
-    "package-manager-detector": ["package-manager-detector@0.2.11", "", { "dependencies": { "quansync": "^0.2.7" } }, "sha512-BEnLolu+yuz22S56CU1SUKq3XC3PkwD5wv4ikR4MfGvnRVcmzXR9DwSlW2fEamyTPyXHomBJRzgapeuBvRNzJQ=="],
+    "package-manager-detector": ["package-manager-detector@1.6.0", "", {}, "sha512-61A5ThoTiDG/C8s8UMZwSorAGwMJ0ERVGj2OjoW5pAalsNOg15+iQiPzrLJ4jhZ1HJzmC2PIHT2oEiH3R5fzNA=="],
 
     "pako": ["pako@1.0.11", "", {}, "sha512-4hLB8Py4zZce5s4yd9XzopqwVv/yGNhV1Bl8NTmCq1763HeK2+EwVTv+leGeL13Dnh2wfbqowVPXCIO0z4taYw=="],
 
@@ -4620,7 +4629,7 @@
 
     "parse-ms": ["parse-ms@4.0.0", "", {}, "sha512-TXfryirbmq34y8QBwgqCVLi+8oA3oWx2eAnSn62ITyEhEYaWRlVZ2DvMM9eZbMs/RfxPu/PK/aBLyGj4IrqMHw=="],
 
-    "parse5": ["parse5@7.3.0", "", { "dependencies": { "entities": "^6.0.0" } }, "sha512-IInvU7fabl34qmi9gY8XOVxhYyMyuH2xUNpb2q8/Y+7552KlejkRvqvD19nMoUW/uQGGbqNpA6Tufu5FL5BZgw=="],
+    "parse5": ["parse5@8.0.1", "", { "dependencies": { "entities": "^8.0.0" } }, "sha512-z1e/HMG90obSGeidlli3hj7cbocou0/wa5HacvI3ASx34PecNjNQeaHNo5WIZpWofN9kgkqV1q5YvXe3F0FoPw=="],
 
     "parse5-htmlparser2-tree-adapter": ["parse5-htmlparser2-tree-adapter@7.1.0", "", { "dependencies": { "domhandler": "^5.0.3", "parse5": "^7.0.0" } }, "sha512-ruw5xyKs6lrpo9x9rCZqZZnIUntICjQAd0Wsmp396Ul9lN/h+ifgVV1x1gZHi8euej6wTfpqX8j+BFQxF0NS/g=="],
 
@@ -4636,8 +4645,6 @@
 
     "path-data-parser": ["path-data-parser@0.1.0", "", {}, "sha512-NOnmBpt5Y2RWbuv0LMzsayp3lVylAHLPUTut412ZA3l+C4uw4ZVkQbjShYCQ8TCpUMdPapr4YjUqLYD6v68j+w=="],
 
-    "path-exists": ["path-exists@4.0.0", "", {}, "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w=="],
-
     "path-is-absolute": ["path-is-absolute@1.0.1", "", {}, "sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg=="],
 
     "path-key": ["path-key@3.1.1", "", {}, "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q=="],
@@ -4680,8 +4687,6 @@
 
     "picomatch": ["picomatch@4.0.4", "", {}, "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A=="],
 
-    "pify": ["pify@4.0.1", "", {}, "sha512-uB80kBFb/tfd68bVleG9T5GGsGPjJrLAUpR5PZIrhBnIaRTQRjqdJSsIKkOP6OAIFbj7GOrcudc5pNjZ+geV2g=="],
-
     "pirates": ["pirates@4.0.7", "", {}, "sha512-TfySrs/5nm8fQJDcBDuUng3VOUKsd7S+zqvbOTiGXHfxX4wK31ard+hoNuvkicM/2YFzlpDgABOevKSsB4G/FA=="],
 
     "pixelmatch": ["pixelmatch@5.3.0", "", { "dependencies": { "pngjs": "^6.0.0" }, "bin": { "pixelmatch": "bin/pixelmatch" } }, "sha512-o8mkY4E/+LNUf6LzX96ht6k6CEDi65k9G2rjMtBe9Oo+VPKSvl+0GKHuH/AlG+GA5LPG/i5hrekkxUc3s2HU+Q=="],
@@ -4708,7 +4713,7 @@
 
     "possible-typed-array-names": ["possible-typed-array-names@1.1.0", "", {}, "sha512-/+5VFTchJDoVj3bhoqi6UeymcD00DAwb1nJwamzPvHEszJ4FpF6SNNbUbOS8yI56qHzdV8eK0qEfOSiodkTdxg=="],
 
-    "postcss": ["postcss@8.5.10", "", { "dependencies": { "nanoid": "^3.3.11", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" } }, "sha512-pMMHxBOZKFU6HgAZ4eyGnwXF/EvPGGqUr0MnZ5+99485wwW41kW91A4LOGxSHhgugZmSChL5AlElNdwlNgcnLQ=="],
+    "postcss": ["postcss@8.5.15", "", { "dependencies": { "nanoid": "^3.3.12", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" } }, "sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A=="],
 
     "postcss-load-config": ["postcss-load-config@6.0.1", "", { "dependencies": { "lilconfig": "^3.1.1" }, "peerDependencies": { "jiti": ">=1.21.0", "postcss": ">=8.0.9", "tsx": "^4.8.1", "yaml": "^2.4.2" }, "optionalPeers": ["jiti", "postcss", "tsx", "yaml"] }, "sha512-oPtTM4oerL+UXmx+93ytZVN82RrlY/wPUV8IeDxFrzIjXOLF1pN+EmKPLbubvKHT2HC20xXsCAH2Z+CKV6Oz/g=="],
 
@@ -4732,7 +4737,11 @@
 
     "prebuild-install": ["prebuild-install@7.1.3", "", { "dependencies": { "detect-libc": "^2.0.0", "expand-template": "^2.0.3", "github-from-package": "0.0.0", "minimist": "^1.2.3", "mkdirp-classic": "^0.5.3", "napi-build-utils": "^2.0.0", "node-abi": "^3.3.0", "pump": "^3.0.0", "rc": "^1.2.7", "simple-get": "^4.0.0", "tar-fs": "^2.0.0", "tunnel-agent": "^0.6.0" }, "bin": { "prebuild-install": "bin.js" } }, "sha512-8Mf2cbV7x1cXPUILADGI3wuhfqWvtiLA1iclTDbFRZkgRQS0NqsPZphna9V+HyTEadheuPmjaJMsbzKQFOzLug=="],
 
-    "prettier": ["prettier@3.8.3", "", { "bin": { "prettier": "bin/prettier.cjs" } }, "sha512-7igPTM53cGHMW8xWuVTydi2KO233VFiTNyF5hLJqpilHfmn8C8gPf+PS7dUT64YcXFbiMGZxS9pCSxL/Dxm/Jw=="],
+    "prettier": ["prettier@3.8.4", "", { "bin": { "prettier": "bin/prettier.cjs" } }, "sha512-N2MylSdi48+5N/6S5j+maeHbUSIzzZ5uOcX5Hm4QpV8Dkb1HFjfAKTKX6yNPJQD9AhcT3ifHNB66tWTTJDi11Q=="],
+
+    "prettier-plugin-svelte": ["prettier-plugin-svelte@4.1.1", "", { "peerDependencies": { "prettier": "^3.0.0", "svelte": "^5.0.0" } }, "sha512-wXvbXMjSvb4C9ENWTHXyd+ihakKCsJ6rJhLP6/8HFNj4GkZr48jqL9PoKsl2sk7SyCZRTnJ7O2TTowUpOxP/KA=="],
+
+    "pretty-format": ["pretty-format@27.5.1", "", { "dependencies": { "ansi-regex": "^5.0.1", "ansi-styles": "^5.0.0", "react-is": "^17.0.1" } }, "sha512-Qb1gy5OrP5+zDf2Bvnzdl3jsTf1qXVMazbvCoKhtKqVs4/YK4ozX4gKQJJVyNe+cajNPn0KoC0MC3FUmaHWEmQ=="],
 
     "pretty-ms": ["pretty-ms@9.3.0", "", { "dependencies": { "parse-ms": "^4.0.0" } }, "sha512-gjVS5hOP+M3wMm5nmNOucbIrqudzs9v/57bWRHQWLYklXqoXKrVfYW2W9+glfGsqtPgpiz5WwyEEB+ksXIx3gQ=="],
 
@@ -4770,8 +4779,6 @@
 
     "qs": ["qs@6.15.1", "", { "dependencies": { "side-channel": "^1.1.0" } }, "sha512-6YHEFRL9mfgcAvql/XhwTvf5jKcOiiupt2FiJxHkiX1z4j7WL8J/jRHYLluORvc1XxB5rV20KoeK00gVJamspg=="],
 
-    "quansync": ["quansync@0.2.11", "", {}, "sha512-AifT7QEbW9Nri4tAwR5M/uzpBuqfZf+zwaEM/QkzEjj7NBuFD2rBuy0K3dE+8wltbezDV7JMA0WfnCPYRSYbXA=="],
-
     "query-selector-shadow-dom": ["query-selector-shadow-dom@1.0.1", "", {}, "sha512-lT5yCqEBgfoMYpf3F2xQRK7zEr1rhIIZuceDK6+xRkJQ4NMbHTwXqk4NkwDwQMNqXgG9r9fyHnzwNVs6zV5KRw=="],
 
     "query-string": ["query-string@9.3.1", "", { "dependencies": { "decode-uri-component": "^0.4.1", "filter-obj": "^5.1.0", "split-on-first": "^3.0.0" } }, "sha512-5fBfMOcDi5SA9qj5jZhWAcTtDfKF5WFdd2uD9nVNlbxVv1baq65aALy6qofpNEGELHvisjjasxQp7BlM9gvMzw=="],
@@ -4872,8 +4879,6 @@
 
     "read-binary-file-arch": ["read-binary-file-arch@1.0.6", "", { "dependencies": { "debug": "^4.3.4" }, "bin": { "read-binary-file-arch": "cli.js" } }, "sha512-BNg9EN3DD3GsDXX7Aa8O4p92sryjkmzYYgmgTAc6CA4uGLEDzFfxOxugu21akOxpcXHiEgsYkC6nPsQvLLLmEg=="],
 
-    "read-yaml-file": ["read-yaml-file@1.1.0", "", { "dependencies": { "graceful-fs": "^4.1.5", "js-yaml": "^3.6.1", "pify": "^4.0.1", "strip-bom": "^3.0.0" } }, "sha512-VIMnQi/Z4HT2Fxuwg5KrY174U1VdUIASQVWXXyqtNRtxSr9IYkn1rsI6Tb6HsrHCmB7gVpNwX6JxPTHcH6IoTA=="],
-
     "readable-stream": ["readable-stream@3.6.2", "", { "dependencies": { "inherits": "^2.0.3", "string_decoder": "^1.1.1", "util-deprecate": "^1.0.1" } }, "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA=="],
 
     "readable-web-to-node-stream": ["readable-web-to-node-stream@3.0.4", "", { "dependencies": { "readable-stream": "^4.7.0" } }, "sha512-9nX56alTf5bwXQ3ZDipHJhusu9NTQJ/CVPtb/XHAJCXihZeitfJvIRS4GqQ/mfIoOE3IelHMrpayVrosdHBuLw=="],
@@ -4988,7 +4993,7 @@
 
     "robust-predicates": ["robust-predicates@3.0.3", "", {}, "sha512-NS3levdsRIUOmiJ8FZWCP7LG3QpJyrs/TE0Zpf1yvZu8cAJJ6QMW92H1c7kWpdIHo8RvmLxN/o2JXTKHp74lUA=="],
 
-    "rolldown": ["rolldown@1.0.0-rc.15", "", { "dependencies": { "@oxc-project/types": "=0.124.0", "@rolldown/pluginutils": "1.0.0-rc.15" }, "optionalDependencies": { "@rolldown/binding-android-arm64": "1.0.0-rc.15", "@rolldown/binding-darwin-arm64": "1.0.0-rc.15", "@rolldown/binding-darwin-x64": "1.0.0-rc.15", "@rolldown/binding-freebsd-x64": "1.0.0-rc.15", "@rolldown/binding-linux-arm-gnueabihf": "1.0.0-rc.15", "@rolldown/binding-linux-arm64-gnu": "1.0.0-rc.15", "@rolldown/binding-linux-arm64-musl": "1.0.0-rc.15", "@rolldown/binding-linux-ppc64-gnu": "1.0.0-rc.15", "@rolldown/binding-linux-s390x-gnu": "1.0.0-rc.15", "@rolldown/binding-linux-x64-gnu": "1.0.0-rc.15", "@rolldown/binding-linux-x64-musl": "1.0.0-rc.15", "@rolldown/binding-openharmony-arm64": "1.0.0-rc.15", "@rolldown/binding-wasm32-wasi": "1.0.0-rc.15", "@rolldown/binding-win32-arm64-msvc": "1.0.0-rc.15", "@rolldown/binding-win32-x64-msvc": "1.0.0-rc.15" }, "bin": { "rolldown": "bin/cli.mjs" } }, "sha512-Ff31guA5zT6WjnGp0SXw76X6hzGRk/OQq2hE+1lcDe+lJdHSgnSX6nK3erbONHyCbpSj9a9E+uX/OvytZoWp2g=="],
+    "rolldown": ["rolldown@1.1.2", "", { "dependencies": { "@oxc-project/types": "=0.137.0", "@rolldown/pluginutils": "^1.0.0" }, "optionalDependencies": { "@rolldown/binding-android-arm64": "1.1.2", "@rolldown/binding-darwin-arm64": "1.1.2", "@rolldown/binding-darwin-x64": "1.1.2", "@rolldown/binding-freebsd-x64": "1.1.2", "@rolldown/binding-linux-arm-gnueabihf": "1.1.2", "@rolldown/binding-linux-arm64-gnu": "1.1.2", "@rolldown/binding-linux-arm64-musl": "1.1.2", "@rolldown/binding-linux-ppc64-gnu": "1.1.2", "@rolldown/binding-linux-s390x-gnu": "1.1.2", "@rolldown/binding-linux-x64-gnu": "1.1.2", "@rolldown/binding-linux-x64-musl": "1.1.2", "@rolldown/binding-openharmony-arm64": "1.1.2", "@rolldown/binding-wasm32-wasi": "1.1.2", "@rolldown/binding-win32-arm64-msvc": "1.1.2", "@rolldown/binding-win32-x64-msvc": "1.1.2" }, "bin": { "rolldown": "./bin/cli.mjs" } }, "sha512-x0CrQQqCXWGeI8dTvFfN/Dnv3yMKT9hv5jFjlOreKAx9wqLq9wz7VvLLHyaAXC90/CpggTu9SisSbsJJTPSjNQ=="],
 
     "rollup": ["rollup@4.60.1", "", { "dependencies": { "@types/estree": "1.0.8" }, "optionalDependencies": { "@rollup/rollup-android-arm-eabi": "4.60.1", "@rollup/rollup-android-arm64": "4.60.1", "@rollup/rollup-darwin-arm64": "4.60.1", "@rollup/rollup-darwin-x64": "4.60.1", "@rollup/rollup-freebsd-arm64": "4.60.1", "@rollup/rollup-freebsd-x64": "4.60.1", "@rollup/rollup-linux-arm-gnueabihf": "4.60.1", "@rollup/rollup-linux-arm-musleabihf": "4.60.1", "@rollup/rollup-linux-arm64-gnu": "4.60.1", "@rollup/rollup-linux-arm64-musl": "4.60.1", "@rollup/rollup-linux-loong64-gnu": "4.60.1", "@rollup/rollup-linux-loong64-musl": "4.60.1", "@rollup/rollup-linux-ppc64-gnu": "4.60.1", "@rollup/rollup-linux-ppc64-musl": "4.60.1", "@rollup/rollup-linux-riscv64-gnu": "4.60.1", "@rollup/rollup-linux-riscv64-musl": "4.60.1", "@rollup/rollup-linux-s390x-gnu": "4.60.1", "@rollup/rollup-linux-x64-gnu": "4.60.1", "@rollup/rollup-linux-x64-musl": "4.60.1", "@rollup/rollup-openbsd-x64": "4.60.1", "@rollup/rollup-openharmony-arm64": "4.60.1", "@rollup/rollup-win32-arm64-msvc": "4.60.1", "@rollup/rollup-win32-ia32-msvc": "4.60.1", "@rollup/rollup-win32-x64-gnu": "4.60.1", "@rollup/rollup-win32-x64-msvc": "4.60.1", "fsevents": "~2.3.2" }, "bin": { "rollup": "dist/bin/rollup" } }, "sha512-VmtB2rFU/GroZ4oL8+ZqXgSA38O6GR8KSIvWmEFv63pQ0G6KaBH9s07PO8XTXP4vI+3UJUEypOfjkGfmSBBR0w=="],
 
@@ -5018,6 +5023,8 @@
 
     "rxjs": ["rxjs@7.8.2", "", { "dependencies": { "tslib": "^2.1.0" } }, "sha512-dhKf903U/PQZY6boNNtAGdWbG85WAbjT/1xYoZIC7FAY0yWapOBQVsVrDl58W86//e1VpMNBtRV4MaXfdMySFA=="],
 
+    "sade": ["sade@1.8.1", "", { "dependencies": { "mri": "^1.1.0" } }, "sha512-xal3CZX1Xlo/k4ApwCFrHVACi9fBqJ7V+mwhBsuf/1IOKbBy098Fex+Wa/5QMubw09pSZ/u8EY8PWgevJsXp1A=="],
+
     "safe-buffer": ["safe-buffer@5.2.1", "", {}, "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ=="],
 
     "safer-buffer": ["safer-buffer@2.1.2", "", {}, "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg=="],
@@ -5026,6 +5033,8 @@
 
     "sax": ["sax@1.6.0", "", {}, "sha512-6R3J5M4AcbtLUdZmRv2SygeVaM7IhrLXu9BmnOGmmACak8fiUtOsYNWUS4uK7upbmHIBbLBeFeI//477BKLBzA=="],
 
+    "saxes": ["saxes@6.0.0", "", { "dependencies": { "xmlchars": "^2.2.0" } }, "sha512-xAg7SOnEhrm5zI3puOOKyy1OMcMlIJZYNJY7xLBwSze0UjhPLnWfj2GF2EpT0jmzaJKIWKHLsaSSajf35bcYnA=="],
+
     "scheduler": ["scheduler@0.27.0", "", {}, "sha512-eNv+WrVbKu1f3vbYJT/xtiF5syA5HPIMtf9IgY/nKg0sWqzAUEvqY/xm7OcZc/qafLx/iO9FgOmeSAp4v5ti/Q=="],
 
     "screenfull": ["screenfull@5.2.0", "", {}, "sha512-9BakfsO2aUQN2K9Fdbj87RJIEZ82Q9IGim7FqM5OsebfoFC6ZHXgDq/KvniuLTPdeM8wY2o6Dj3WQ7KeQCj3cA=="],
@@ -5078,7 +5087,7 @@
 
     "siginfo": ["siginfo@2.0.0", "", {}, "sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g=="],
 
-    "signal-exit": ["signal-exit@4.1.0", "", {}, "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw=="],
+    "signal-exit": ["signal-exit@3.0.7", "", {}, "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ=="],
 
     "simple-concat": ["simple-concat@1.0.1", "", {}, "sha512-cSFtAPtRhljv69IK0hTVZQ+OfE9nePi/rtJmw5UjHeVyVroEqJXP1sFztKUy1qU+xvz3u/sfYJLa947b7nAN2Q=="],
 
@@ -5088,9 +5097,9 @@
 
     "simple-xml-to-json": ["simple-xml-to-json@1.2.7", "", {}, "sha512-mz9VXphOxQWX3eQ/uXCtm6upltoN0DLx8Zb5T4TFC4FHB7S9FDPGre8CfLWqPWQQH/GrQYd2AXhhVM5LDpYx6Q=="],
 
-    "sisteransi": ["sisteransi@1.0.5", "", {}, "sha512-bLGGlR1QxBcynn2d5YmDX4MGjlZvy2MRBDRNHLJ8VI6l6+9FUiyTFNJ0IveOSP0bcXgVDPRcfGqA0pjaqUpfVg=="],
+    "sirv": ["sirv@3.0.2", "", { "dependencies": { "@polka/url": "^1.0.0-next.24", "mrmime": "^2.0.0", "totalist": "^3.0.0" } }, "sha512-2wcC/oGxHis/BoHkkPwldgiPSYcpZK3JU28WoMVv55yHJgcZ8rlXvuG9iZggz+sU1d4bRgIGASwyWqjxu3FM0g=="],
 
-    "slash": ["slash@3.0.0", "", {}, "sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q=="],
+    "sisteransi": ["sisteransi@1.0.5", "", {}, "sha512-bLGGlR1QxBcynn2d5YmDX4MGjlZvy2MRBDRNHLJ8VI6l6+9FUiyTFNJ0IveOSP0bcXgVDPRcfGqA0pjaqUpfVg=="],
 
     "slice-ansi": ["slice-ansi@8.0.0", "", { "dependencies": { "ansi-styles": "^6.2.3", "is-fullwidth-code-point": "^5.1.0" } }, "sha512-stxByr12oeeOyY2BlviTNQlYV5xOj47GirPr4yA1hE9JCtxfQN0+tVbkxwCtYDQWhEKWFHsEK48ORg5jrouCAg=="],
 
@@ -5112,8 +5121,6 @@
 
     "space-separated-tokens": ["space-separated-tokens@2.0.2", "", {}, "sha512-PEGlAwrG8yXGXRjW32fGbg66JAlOAwbObuqVoJpv/mRgoWDQfgH1wDPvtzWyUSNAXBGSk8h755YDbbcEy3SH2Q=="],
 
-    "spawndamnit": ["spawndamnit@3.0.1", "", { "dependencies": { "cross-spawn": "^7.0.5", "signal-exit": "^4.0.1" } }, "sha512-MmnduQUuHCoFckZoWnXsTg7JaiLBJrKFj9UI2MbRPGaJeVpsLcVBu6P/IGZovziM/YBsellCmsprgNA+w0CzVg=="],
-
     "split-on-first": ["split-on-first@3.0.0", "", {}, "sha512-qxQJTx2ryR0Dw0ITYyekNQWpz6f8dGd7vffGNflQQ3Iqj9NJ6qiZ7ELpZsJ/QBhIVAiDfXdag3+Gp8RvWa62AA=="],
 
     "split-string": ["split-string@3.1.0", "", { "dependencies": { "extend-shallow": "^3.0.0" } }, "sha512-NzNVhJDYpwceVVii8/Hu6DKfD2G+NrQHlS/V/qgv763EYudVwEcMQNxd2lh+0VrUByXN/oJkl5grOhYWvQUYiw=="],
@@ -5154,12 +5161,10 @@
 
     "stringify-entities": ["stringify-entities@4.0.4", "", { "dependencies": { "character-entities-html4": "^2.0.0", "character-entities-legacy": "^3.0.0" } }, "sha512-IwfBptatlO+QCJUo19AqvrPNqlVMpW9YEL2LIVY+Rpv2qsjCGxaDLNRgeGsQWJhfItebuJhsGSLjaBbNSQ+ieg=="],
 
-    "strip-ansi": ["strip-ansi@6.0.1", "", { "dependencies": { "ansi-regex": "^5.0.1" } }, "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A=="],
+    "strip-ansi": ["strip-ansi@7.1.2", "", { "dependencies": { "ansi-regex": "^6.0.1" } }, "sha512-gmBGslpoQJtgnMAvOVqGZpEz9dyoKTCzy2nfz/n8aIFhN/jCE/rCmcxabB6jOOHV+0WNnylOxaxBQPSvcWklhA=="],
 
     "strip-ansi-cjs": ["strip-ansi@6.0.1", "", { "dependencies": { "ansi-regex": "^5.0.1" } }, "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A=="],
 
-    "strip-bom": ["strip-bom@3.0.0", "", {}, "sha512-vavAMRXOgBVNF6nyEEmL3DBK19iRpDcoIwW+swQ+CbGiu7lju6t+JklA1MHweoWtadgt4ISVUsXLyDq34ddcwA=="],
-
     "strip-final-newline": ["strip-final-newline@4.0.0", "", {}, "sha512-aulFJcD6YK8V1G7iRB5tigAP4TsHBZZrOV8pjV++zdUwmeV8uzbY7yn6h9MswN62adStNZFuCIx4haBnRuMDaw=="],
 
     "strip-json-comments": ["strip-json-comments@5.0.3", "", {}, "sha512-1tB5mhVo7U+ETBKNf92xT4hrQa3pm0MZ0PQvuDnWgAAGHDsfp4lPSpiS6psrSiet87wyGPh9ft6wmhOMQ0hDiw=="],
@@ -5186,10 +5191,16 @@
 
     "supports-preserve-symlinks-flag": ["supports-preserve-symlinks-flag@1.0.0", "", {}, "sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w=="],
 
+    "svelte": ["svelte@5.56.4", "", { "dependencies": { "@jridgewell/remapping": "^2.3.4", "@jridgewell/sourcemap-codec": "^1.5.0", "@sveltejs/acorn-typescript": "^1.0.10", "@types/estree": "^1.0.5", "@types/trusted-types": "^2.0.7", "acorn": "^8.12.1", "aria-query": "5.3.1", "axobject-query": "^4.1.0", "clsx": "^2.1.1", "devalue": "^5.8.1", "esm-env": "^1.2.1", "esrap": "^2.2.12", "is-reference": "^3.0.3", "locate-character": "^3.0.0", "magic-string": "^0.30.11", "zimmerframe": "^1.1.2" } }, "sha512-/d0QHehmRuJW8gVz395MTkPcPozxzdjBMBE8oEYGz8O3b9KTMzzQ9ZHJQLuFKOHOPQbU6kx/X4iid/EBBzH7iw=="],
+
+    "svelte-check": ["svelte-check@4.7.0", "", { "dependencies": { "@jridgewell/trace-mapping": "^0.3.25", "@sveltejs/load-config": "^0.2.0", "chokidar": "^4.0.1", "fdir": "^6.2.0", "picocolors": "^1.0.0", "sade": "^1.7.4" }, "peerDependencies": { "svelte": "^4.0.0 || ^5.0.0-next.0", "typescript": ">=5.0.0" }, "bin": { "svelte-check": "bin/svelte-check" } }, "sha512-XChCqdDg29UWOWai2I1s2Ss003piZ9mae2y2KXwoOX01W75mg7/fwLLnx9Yruk9asHkxHPDdSfEfsJh5tr9JvQ=="],
+
     "svgo": ["svgo@4.0.1", "", { "dependencies": { "commander": "^11.1.0", "css-select": "^5.1.0", "css-tree": "^3.0.1", "css-what": "^6.1.0", "csso": "^5.0.5", "picocolors": "^1.1.1", "sax": "^1.5.0" }, "bin": "./bin/svgo.js" }, "sha512-XDpWUOPC6FEibaLzjfe0ucaV0YrOjYotGJO1WpF0Zd+n6ZGEQUsSugaoLq9QkEZtAfQIxT42UChcssDVPP3+/w=="],
 
     "swr": ["swr@2.4.1", "", { "dependencies": { "dequal": "^2.0.3", "use-sync-external-store": "^1.6.0" }, "peerDependencies": { "react": "^16.11.0 || ^17.0.0 || ^18.0.0 || ^19.0.0" } }, "sha512-2CC6CiKQtEwaEeNiqWTAw9PGykW8SR5zZX8MZk6TeAvEAnVS7Visz8WzphqgtQ8v2xz/4Q5K+j+SeMaKXeeQIA=="],
 
+    "symbol-tree": ["symbol-tree@3.2.4", "", {}, "sha512-9QNk5KwDF+Bvz+PyObkmSYjI5ksVUYtjW7AU22r2NKcfLJcXp96hkDWU3+XndOsUb+AQ9QhfzfCT2O+CNWT5Tw=="],
+
     "system-architecture": ["system-architecture@0.1.0", "", {}, "sha512-ulAk51I9UVUyJgxlv9M6lFot2WP3e7t8Kz9+IS6D4rVba1tR9kON+Ey69f+1R4Q8cd45Lod6a4IcJIxnzGc/zA=="],
 
     "tabbable": ["tabbable@6.4.0", "", {}, "sha512-05PUHKSNE8ou2dwIxTngl4EzcnsCDZGJ/iCLtDflR/SHB/ny14rXc+qU5P4mG9JkusiV7EivzY9Mhm55AzAvCg=="],
@@ -5212,8 +5223,6 @@
 
     "temp-file": ["temp-file@3.4.0", "", { "dependencies": { "async-exit-hook": "^2.0.1", "fs-extra": "^10.0.0" } }, "sha512-C5tjlC/HCtVUOi3KWVokd4vHVViOmGjtLwIh4MuzPo/nMYTV/p1urt3RnMz2IWXDdKEGJH3k5+KPxtqRsUYGtg=="],
 
-    "term-size": ["term-size@2.2.1", "", {}, "sha512-wK0Ri4fOGjv/XPy8SBHZChl8CM7uMc5VML7SqiQ0zG7+J5Vr+RMQDoHa2CNT6KHUnTGIXH34UDMkPzAUyapBZg=="],
-
     "terminal-size": ["terminal-size@4.0.1", "", {}, "sha512-avMLDQpUI9I5XFrklECw1ZEUPJhqzcwSWsyyI8blhRLT+8N1jLJWLWWYQpB2q2xthq8xDvjZPISVh53T/+CLYQ=="],
 
     "thenify": ["thenify@3.3.1", "", { "dependencies": { "any-promise": "^1.0.0" } }, "sha512-RVZSIV5IG10Hk3enotrhvz0T9em6cyHBLkH/YAZuKqd8hRkKhSfCGIcP2KUY0EPxndzANBmNllzWPwak+bheSw=="],
@@ -5240,7 +5249,7 @@
 
     "tinyexec": ["tinyexec@1.1.1", "", {}, "sha512-VKS/ZaQhhkKFMANmAOhhXVoIfBXblQxGX1myCQ2faQrfmobMftXeJPcZGp0gS07ocvGJWDLZGyOZDadDBqYIJg=="],
 
-    "tinyglobby": ["tinyglobby@0.2.16", "", { "dependencies": { "fdir": "^6.5.0", "picomatch": "^4.0.4" } }, "sha512-pn99VhoACYR8nFHhxqix+uvsbXineAasWm5ojXoN8xEwK5Kd3/TrhNn1wByuD52UxWRLy8pu+kRMniEi6Eq9Zg=="],
+    "tinyglobby": ["tinyglobby@0.2.17", "", { "dependencies": { "fdir": "^6.5.0", "picomatch": "^4.0.4" } }, "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g=="],
 
     "tinypool": ["tinypool@2.1.0", "", {}, "sha512-Pugqs6M0m7Lv1I7FtxN4aoyToKg1C4tu+/381vH35y8oENM/Ai7f7C4StcoK4/+BSw9ebcS8jRiVrORFKCALLw=="],
 
@@ -5268,7 +5277,11 @@
 
     "toml": ["toml@4.1.1", "", {}, "sha512-EBJnVBr3dTXdA89WVFoAIPUqkBjxPMwRqsfuo1r240tKFHXv3zgca4+NJib/h6TyvGF7vOawz0jGuryJCdNHrw=="],
 
-    "tr46": ["tr46@0.0.3", "", {}, "sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw=="],
+    "totalist": ["totalist@3.0.1", "", {}, "sha512-sf4i37nQ2LBx4m3wB74y+ubopq6W/dIzXg0FDGjsYnZHVa1Da8FH853wlL2gtUhg+xJXjfk3kUZS3BRoQeoQBQ=="],
+
+    "tough-cookie": ["tough-cookie@6.0.1", "", { "dependencies": { "tldts": "^7.0.5" } }, "sha512-LktZQb3IeoUWB9lqR5EWTHgW/VTITCXg4D21M+lvybRVdylLrRMnqaIONLVb5mav8vM19m44HIcGq4qASeu2Qw=="],
+
+    "tr46": ["tr46@6.0.0", "", { "dependencies": { "punycode": "^2.3.1" } }, "sha512-bLVMLPtstlZ4iMQHpFHTR7GAGj2jxi8Dg0s2h2MafAE4uSWF98FC/3MomU51iQAMf8/qDUbKWf5GxuvvVcXEhw=="],
 
     "tree-kill": ["tree-kill@1.2.2", "", { "bin": { "tree-kill": "cli.js" } }, "sha512-L0Orpi8qGpRG//Nd+H90vFB+3iHnue1zSSGmNOOCh1GLJ7rUKVwV2HvijphGQS2UmhUZewS9VgvxYIdgr+fG1A=="],
 
@@ -5350,7 +5363,7 @@
 
     "unist-util-visit-parents": ["unist-util-visit-parents@6.0.2", "", { "dependencies": { "@types/unist": "^3.0.0", "unist-util-is": "^6.0.0" } }, "sha512-goh1s1TBrqSqukSc8wrjwWhL0hiJxgA8m4kFxGlQ+8FYQ3C/m11FcTs4YYem7V664AhHVvgoQLk890Ssdsr2IQ=="],
 
-    "universalify": ["universalify@0.1.2", "", {}, "sha512-rBJeI5CXAlmy1pV+617WB9J63U6XcazHHF2f2dbJix4XzpUF0RS3Zbj0FGIOCAva5P/d/GBOYaACQ1w+0azUkg=="],
+    "universalify": ["universalify@2.0.1", "", {}, "sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw=="],
 
     "unpipe": ["unpipe@1.0.0", "", {}, "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ=="],
 
@@ -5400,11 +5413,11 @@
 
     "virtua": ["virtua@0.49.1", "", { "peerDependencies": { "react": ">=16.14.0", "react-dom": ">=16.14.0", "solid-js": ">=1.0", "svelte": ">=5.0", "vue": ">=3.2" }, "optionalPeers": ["react", "react-dom", "solid-js", "svelte", "vue"] }, "sha512-6f79msqg3jzNFdqJiS0FSzhRN1EHlDhR7EvW7emp6z5qQ22VdsReiDHflkpMEMhoAyUuYr69nwT0aagiM7NrUg=="],
 
-    "vite": ["vite@8.0.8", "", { "dependencies": { "lightningcss": "^1.32.0", "picomatch": "^4.0.4", "postcss": "^8.5.8", "rolldown": "1.0.0-rc.15", "tinyglobby": "^0.2.15" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "peerDependencies": { "@types/node": "^20.19.0 || >=22.12.0", "@vitejs/devtools": "^0.1.0", "esbuild": "^0.27.0 || ^0.28.0", "jiti": ">=1.21.0", "less": "^4.0.0", "sass": "^1.70.0", "sass-embedded": "^1.70.0", "stylus": ">=0.54.8", "sugarss": "^5.0.0", "terser": "^5.16.0", "tsx": "^4.8.1", "yaml": "^2.4.2" }, "optionalPeers": ["@types/node", "@vitejs/devtools", "esbuild", "jiti", "less", "sass", "sass-embedded", "stylus", "sugarss", "terser", "tsx", "yaml"], "bin": { "vite": "bin/vite.js" } }, "sha512-dbU7/iLVa8KZALJyLOBOQ88nOXtNG8vxKuOT4I2mD+Ya70KPceF4IAmDsmU0h1Qsn5bPrvsY9HJstCRh3hG6Uw=="],
+    "vite": ["vite@8.1.0", "", { "dependencies": { "lightningcss": "^1.32.0", "picomatch": "^4.0.4", "postcss": "^8.5.15", "rolldown": "~1.1.2", "tinyglobby": "^0.2.17" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "peerDependencies": { "@types/node": "^20.19.0 || >=22.12.0", "@vitejs/devtools": "^0.3.0", "esbuild": "^0.27.0 || ^0.28.0", "jiti": ">=1.21.0", "less": "^4.0.0", "sass": "^1.70.0", "sass-embedded": "^1.70.0", "stylus": ">=0.54.8", "sugarss": "^5.0.0", "terser": "^5.16.0", "tsx": "^4.8.1", "yaml": "^2.4.2" }, "optionalPeers": ["@types/node", "@vitejs/devtools", "esbuild", "jiti", "less", "sass", "sass-embedded", "stylus", "sugarss", "terser", "tsx", "yaml"], "bin": { "vite": "bin/vite.js" } }, "sha512-BuJcQK/56NQTWDGn4ABea3q4SSBdNPWwNZKTkkUpcMPnLoquSYH8llRtSUIgoL1KSCpHt5eghLShn50mH36y7Q=="],
 
     "vitefu": ["vitefu@1.1.3", "", { "peerDependencies": { "vite": "^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0" }, "optionalPeers": ["vite"] }, "sha512-ub4okH7Z5KLjb6hDyjqrGXqWtWvoYdU3IGm/NorpgHncKoLTCfRIbvlhBm7r0YstIaQRYlp4yEbFqDcKSzXSSg=="],
 
-    "vitest": ["vitest@4.1.5", "", { "dependencies": { "@vitest/expect": "4.1.5", "@vitest/mocker": "4.1.5", "@vitest/pretty-format": "4.1.5", "@vitest/runner": "4.1.5", "@vitest/snapshot": "4.1.5", "@vitest/spy": "4.1.5", "@vitest/utils": "4.1.5", "es-module-lexer": "^2.0.0", "expect-type": "^1.3.0", "magic-string": "^0.30.21", "obug": "^2.1.1", "pathe": "^2.0.3", "picomatch": "^4.0.3", "std-env": "^4.0.0-rc.1", "tinybench": "^2.9.0", "tinyexec": "^1.0.2", "tinyglobby": "^0.2.15", "tinyrainbow": "^3.1.0", "vite": "^6.0.0 || ^7.0.0 || ^8.0.0", "why-is-node-running": "^2.3.0" }, "peerDependencies": { "@edge-runtime/vm": "*", "@opentelemetry/api": "^1.9.0", "@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0", "@vitest/browser-playwright": "4.1.5", "@vitest/browser-preview": "4.1.5", "@vitest/browser-webdriverio": "4.1.5", "@vitest/coverage-istanbul": "4.1.5", "@vitest/coverage-v8": "4.1.5", "@vitest/ui": "4.1.5", "happy-dom": "*", "jsdom": "*" }, "optionalPeers": ["@edge-runtime/vm", "@opentelemetry/api", "@types/node", "@vitest/browser-playwright", "@vitest/browser-preview", "@vitest/browser-webdriverio", "@vitest/coverage-istanbul", "@vitest/coverage-v8", "@vitest/ui", "happy-dom", "jsdom"], "bin": { "vitest": "vitest.mjs" } }, "sha512-9Xx1v3/ih3m9hN+SbfkUyy0JAs72ap3r7joc87XL6jwF0jGg6mFBvQ1SrwaX+h8BlkX6Hz9shdd1uo6AF+ZGpg=="],
+    "vitest": ["vitest@4.1.9", "", { "dependencies": { "@vitest/expect": "4.1.9", "@vitest/mocker": "4.1.9", "@vitest/pretty-format": "4.1.9", "@vitest/runner": "4.1.9", "@vitest/snapshot": "4.1.9", "@vitest/spy": "4.1.9", "@vitest/utils": "4.1.9", "es-module-lexer": "^2.0.0", "expect-type": "^1.3.0", "magic-string": "^0.30.21", "obug": "^2.1.1", "pathe": "^2.0.3", "picomatch": "^4.0.3", "std-env": "^4.0.0-rc.1", "tinybench": "^2.9.0", "tinyexec": "^1.0.2", "tinyglobby": "^0.2.15", "tinyrainbow": "^3.1.0", "vite": "^6.0.0 || ^7.0.0 || ^8.0.0", "why-is-node-running": "^2.3.0" }, "peerDependencies": { "@edge-runtime/vm": "*", "@opentelemetry/api": "^1.9.0", "@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0", "@vitest/browser-playwright": "4.1.9", "@vitest/browser-preview": "4.1.9", "@vitest/browser-webdriverio": "4.1.9", "@vitest/coverage-istanbul": "4.1.9", "@vitest/coverage-v8": "4.1.9", "@vitest/ui": "4.1.9", "happy-dom": "*", "jsdom": "*" }, "optionalPeers": ["@edge-runtime/vm", "@opentelemetry/api", "@types/node", "@vitest/browser-playwright", "@vitest/browser-preview", "@vitest/browser-webdriverio", "@vitest/coverage-istanbul", "@vitest/coverage-v8", "@vitest/ui", "happy-dom", "jsdom"], "bin": { "vitest": "./vitest.mjs" } }, "sha512-nE3/LEyc0z87uHYLZebqCUOaJr2hdtuPp7BQ4BosVFnfltxgAvMG08NyrSGlPpOUWvR27c5flSmYFTNr78L9GQ=="],
 
     "vscode-jsonrpc": ["vscode-jsonrpc@8.2.0", "", {}, "sha512-C+r0eKJUIfiDIfwJhria30+TYWPtuHJXHtI7J0YlOmKAo7ogxP20T0zxB7HZQIFhIyvoBPwWskjxrvAtfjyZfA=="],
 
@@ -5418,6 +5431,8 @@
 
     "vscode-uri": ["vscode-uri@3.1.0", "", {}, "sha512-/BpdSx+yCQGnCvecbyXdxHDkuk55/G3xwnC0GqY4gmQ3j+A+g8kzzgB4Nk/SINjqn6+waqw3EgbVF2QKExkRxQ=="],
 
+    "w3c-xmlserializer": ["w3c-xmlserializer@5.0.0", "", { "dependencies": { "xml-name-validator": "^5.0.0" } }, "sha512-o8qghlI8NZHU1lLPrpi2+Uq7abh4GGPpYANlalzWxyWteJOCsr/P+oPBA49TOLu5FTZO4d3F9MnWJfiMo4BkmA=="],
+
     "walk-up-path": ["walk-up-path@4.0.0", "", {}, "sha512-3hu+tD8YzSLGuFYtPRb48vdhKMi0KQV5sn+uWr8+7dMEq/2G/dtLrdDinkLjqq5TIbIBjYJ4Ax/n3YiaW7QM8A=="],
 
     "web-namespaces": ["web-namespaces@2.0.1", "", {}, "sha512-bKr1DkiNa2krS7qxNtdrtHAmzuYGFQLiQ13TsorsdT6ULTkPLKuu5+GsFpDlg6JFjUTwX2DyhMPG2be8uPrqsQ=="],
@@ -5428,15 +5443,15 @@
 
     "web-vitals": ["web-vitals@5.2.0", "", {}, "sha512-i2z98bEmaCqSDiHEDu+gHl/dmR4Q+TxFmG3/13KkMO+o8UxQzCqWaDRCiLgEa41nlO4VpXSI0ASa1xWmO9sBlA=="],
 
-    "webidl-conversions": ["webidl-conversions@3.0.1", "", {}, "sha512-2JAn3z8AR6rjK8Sm8orRC0h/bcl/DqL7tRPdGZ4I1CjdF+EaMLmYxBHyXuKL849eucPFhvBoxMsflfOb8kxaeQ=="],
+    "webidl-conversions": ["webidl-conversions@8.0.1", "", {}, "sha512-BMhLD/Sw+GbJC21C/UgyaZX41nPt8bUTg+jWyDeg7e7YN4xOM05YPSIXceACnXVtqyEw/LMClUQMtMZ+PGGpqQ=="],
 
     "webpack-virtual-modules": ["webpack-virtual-modules@0.6.2", "", {}, "sha512-66/V2i5hQanC51vBQKPH4aI8NMAcBW59FVBs+rC7eGHupMyfn34q7rZIE+ETlJ+XTevqfUhVVBgSUNSW2flEUQ=="],
 
     "whatwg-encoding": ["whatwg-encoding@3.1.1", "", { "dependencies": { "iconv-lite": "0.6.3" } }, "sha512-6qN4hJdMwfYBtE3YBTTHhoeuUrDBPZmbQaxWAqSALV/MeEnR5z1xd8UKud2RAkFoPkmB+hli1TZSnyi84xz1vQ=="],
 
-    "whatwg-mimetype": ["whatwg-mimetype@4.0.0", "", {}, "sha512-QaKxh0eNIi2mE9p2vEdzfagOKHCcj1pJ56EEHGQOVxp8r9/iszLUUV7v89x9O1p/T+NlTM5W7jW6+cz4Fq1YVg=="],
+    "whatwg-mimetype": ["whatwg-mimetype@5.0.0", "", {}, "sha512-sXcNcHOC51uPGF0P/D4NVtrkjSU2fNsm9iog4ZvZJsL3rjoDAzXZhkm2MWt1y+PUdggKAYVoMAIYcs78wJ51Cw=="],
 
-    "whatwg-url": ["whatwg-url@5.0.0", "", { "dependencies": { "tr46": "~0.0.3", "webidl-conversions": "^3.0.0" } }, "sha512-saE57nupxk6v3HY35+jzBwYa0rKSy0XR8JSxZPwgLr7ys0IBzhGviA1/TUGJLmSVqs8pb9AnvICXEuOHLprYTw=="],
+    "whatwg-url": ["whatwg-url@16.0.1", "", { "dependencies": { "@exodus/bytes": "^1.11.0", "tr46": "^6.0.0", "webidl-conversions": "^8.0.1" } }, "sha512-1to4zXBxmXHV3IiSSEInrreIlu02vUOvrhxJJH5vcxYTBDAx51cqZiKdyTxlecdKNSjj8EcxGBxNf6Vg+945gw=="],
 
     "when-exit": ["when-exit@2.1.5", "", {}, "sha512-VGkKJ564kzt6Ms1dbgPP/yuIoQCrsFAnRbptpC5wOEsDaNsbCB2bnfnaA8i/vRs5tjUSEOtIuvl9/MyVsvQZCg=="],
 
@@ -5466,6 +5481,8 @@
 
     "wsl-utils": ["wsl-utils@0.1.0", "", { "dependencies": { "is-wsl": "^3.1.0" } }, "sha512-h3Fbisa2nKGPxCpm89Hk33lBLsnaGBvctQopaBSOW/uIs6FTe1ATyAnKFJrzVs9vpGdsTe73WF3V4lIsk4Gacw=="],
 
+    "xml-name-validator": ["xml-name-validator@5.0.0", "", {}, "sha512-EvGK8EJ3DhaHfbRlETOWAS5pO9MZITeauHKJyb8wyajUfQUenkIg2MvLDTZ4T/TgIcm3HU0TFBgWWboAZ30UHg=="],
+
     "xml-parse-from-string": ["xml-parse-from-string@1.0.1", "", {}, "sha512-ErcKwJTF54uRzzNMXq2X5sMIy88zJvfN2DmdoQvy7PAFJ+tPRU6ydWuOKNMyfmOjdyBQTFREi60s0Y0SyI0G0g=="],
 
     "xml2js": ["xml2js@0.5.0", "", { "dependencies": { "sax": ">=0.6.0", "xmlbuilder": "~11.0.0" } }, "sha512-drPFnkQJik/O+uPKpqSgr22mpuFHqKdbS835iAQrUC73L2F5WkboIRd63ai/2Yg6I1jzifPFKH2NTK+cfglkIA=="],
@@ -5474,6 +5491,8 @@
 
     "xmlbuilder2": ["xmlbuilder2@4.0.3", "", { "dependencies": { "@oozcitak/dom": "^2.0.2", "@oozcitak/infra": "^2.0.2", "@oozcitak/util": "^10.0.0", "js-yaml": "^4.1.1" } }, "sha512-bx8Q1STctnNaaDymWnkfQLKofs0mGNN7rLLapJlGuV3VlvegD7Ls4ggMjE3aUSWItCCzU0PEv45lI87iSigiCA=="],
 
+    "xmlchars": ["xmlchars@2.2.0", "", {}, "sha512-JZnDKK8B0RCDw84FNdDAIpZK+JuJw+s7Lz8nksI7SIuU3UXJJslUthsi+uWBUYOwPFwW7W7PRLRfUKpxjtjFCw=="],
+
     "xtend": ["xtend@4.0.2", "", {}, "sha512-LKYU1iAXJXUgAXn9URjiu+MWhyUXHsvfp7mcuYm9dSUKK0/CjtrUwFAxD82/mCWbtLsGjFIad0wIsod4zrTAEQ=="],
 
     "xxhash-wasm": ["xxhash-wasm@1.1.0", "", {}, "sha512-147y/6YNh+tlp6nd/2pWq38i9h6mz/EuQ6njIrmW8D1BS5nCqs0P6DG+m6zTGnNz5I+uhZ0SHxBs9BsPrwcKDA=="],
@@ -5506,6 +5525,8 @@
 
     "youch-core": ["youch-core@0.3.3", "", { "dependencies": { "@poppinss/exception": "^1.2.2", "error-stack-parser-es": "^1.0.5" } }, "sha512-ho7XuGjLaJ2hWHoK8yFnsUGy2Y5uDpqSTq1FkHLK4/oqKtyUU1AFbOOxY4IpC9f0fTLjwYbslUz0Po5BpD1wrA=="],
 
+    "zimmerframe": ["zimmerframe@1.1.4", "", {}, "sha512-B58NGBEoc8Y9MWWCQGl/gq9xBCe4IiKM0a2x7GZdQKOW5Exr8S1W24J6OgM1njK8xCRGvAJIL/MxXHf6SkmQKQ=="],
+
     "zod": ["zod@4.3.6", "", {}, "sha512-rftlrkhHZOcjDwkGlnUtZZkvaPHCsDATp4pGpuOOMDaTdDDXF91wuVDJoWoPsKX/3YPQ5fHuF3STjcYyKr+Qhg=="],
 
     "zod-to-json-schema": ["zod-to-json-schema@3.25.2", "", { "peerDependencies": { "zod": "^3.25.28 || ^4" } }, "sha512-O/PgfnpT1xKSDeQYSCfRI5Gy3hPf91mKVDuYLUHZJMiDFptvP41MSnWofm8dnCm0256ZNfZIM7DSzuSMAFnjHA=="],
@@ -5514,7 +5535,7 @@
 
     "zwitch": ["zwitch@2.0.4", "", {}, "sha512-bXE4cR/kVZhKZX/RjPEflHaKVhUVl85noU3v6b8apfQEc1x4A+zBxjZ4lN8LqGd6WZ3dl98pY4o717VFmoPp+A=="],
 
-    "@antfu/install-pkg/package-manager-detector": ["package-manager-detector@1.6.0", "", {}, "sha512-61A5ThoTiDG/C8s8UMZwSorAGwMJ0ERVGj2OjoW5pAalsNOg15+iQiPzrLJ4jhZ1HJzmC2PIHT2oEiH3R5fzNA=="],
+    "@astrojs/cloudflare/tinyglobby": ["tinyglobby@0.2.16", "", { "dependencies": { "fdir": "^6.5.0", "picomatch": "^4.0.4" } }, "sha512-pn99VhoACYR8nFHhxqix+uvsbXineAasWm5ojXoN8xEwK5Kd3/TrhNn1wByuD52UxWRLy8pu+kRMniEi6Eq9Zg=="],
 
     "@astrojs/cloudflare/vite": ["vite@7.3.2", "", { "dependencies": { "esbuild": "^0.27.0", "fdir": "^6.5.0", "picomatch": "^4.0.3", "postcss": "^8.5.6", "rollup": "^4.43.0", "tinyglobby": "^0.2.15" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "peerDependencies": { "@types/node": "^20.19.0 || >=22.12.0", "jiti": ">=1.21.0", "less": "^4.0.0", "lightningcss": "^1.21.0", "sass": "^1.70.0", "sass-embedded": "^1.70.0", "stylus": ">=0.54.8", "sugarss": "^5.0.0", "terser": "^5.16.0", "tsx": "^4.8.1", "yaml": "^2.4.2" }, "optionalPeers": ["@types/node", "jiti", "less", "lightningcss", "sass", "sass-embedded", "stylus", "sugarss", "terser", "tsx", "yaml"], "bin": { "vite": "bin/vite.js" } }, "sha512-Bby3NOsna2jsjfLVOHKes8sGwgl4TT0E6vvpYgnAYDIF/tie7MRaFthmKuHx1NSXjiTueXH3do80FMQgvEktRg=="],
 
@@ -5536,10 +5557,6 @@
 
     "@better-auth/core/jose": ["jose@6.2.2", "", {}, "sha512-d7kPDd34KO/YnzaDOlikGpOurfF0ByC2sEV4cANCtdqLlTfBlw2p14O/5d/zv40gJPbIQxfES3nSx1/oYNyuZQ=="],
 
-    "@changesets/apply-release-plan/prettier": ["prettier@2.8.8", "", { "bin": { "prettier": "bin-prettier.js" } }, "sha512-tdN8qQGvNjw4CHbY+XXk0JgCXn9QiF21a55rBe5LJAU+kDyC4WQn4+awm2Xfk2lQMk5fKup9XgzTZtGkjBdP9Q=="],
-
-    "@changesets/write/prettier": ["prettier@2.8.8", "", { "bin": { "prettier": "bin-prettier.js" } }, "sha512-tdN8qQGvNjw4CHbY+XXk0JgCXn9QiF21a55rBe5LJAU+kDyC4WQn4+awm2Xfk2lQMk5fKup9XgzTZtGkjBdP9Q=="],
-
     "@cloudflare/vite-plugin/@cloudflare/unenv-preset": ["@cloudflare/unenv-preset@2.16.0", "", { "peerDependencies": { "unenv": "2.0.0-rc.24", "workerd": "1.20260301.1 || ~1.20260302.1 || ~1.20260303.1 || ~1.20260304.1 || >1.20260305.0 <2.0.0-0" }, "optionalPeers": ["workerd"] }, "sha512-8ovsRpwzPoEqPUzoErAYVv8l3FMZNeBVQfJTvtzP4AgLSRGZISRfuChFxHWUQd3n6cnrwkuTGxT+2cGo8EsyYg=="],
 
     "@cloudflare/vite-plugin/miniflare": ["miniflare@4.20260415.0", "", { "dependencies": { "@cspotcode/source-map-support": "0.8.1", "sharp": "^0.34.5", "undici": "7.24.8", "workerd": "1.20260415.1", "ws": "8.18.0", "youch": "4.1.0-beta.10" }, "bin": { "miniflare": "bootstrap.js" } }, "sha512-JoExRWN4YBI2luA5BoSMFEgi8rQWXUGzo3mtE+58VXCLV3jj/Xnk5Yeqs/IXWz8Es5GJIaq6BtsixDvAxXSIng=="],
@@ -5576,8 +5593,6 @@
 
     "@electron/notarize/fs-extra": ["fs-extra@9.1.0", "", { "dependencies": { "at-least-node": "^1.0.0", "graceful-fs": "^4.2.0", "jsonfile": "^6.0.1", "universalify": "^2.0.0" } }, "sha512-hcg3ZmepS30/7BSFqRvoo3DOMQu7IjqxO5nCDt+zM9XWjb33Wg7ziNT+Qvqbuc3+gWpzO02JubVyk2G4Zvo1OQ=="],
 
-    "@electron/osx-sign/fs-extra": ["fs-extra@10.1.0", "", { "dependencies": { "graceful-fs": "^4.2.0", "jsonfile": "^6.0.1", "universalify": "^2.0.0" } }, "sha512-oRXApq54ETRj4eMiFzGnHWGy+zo5raudjuxN0b8H7s/RU2oW0Wvsx9O0ACRN/kRq9E8Vu/ReskGB5o3ji+FzHQ=="],
-
     "@electron/osx-sign/isbinaryfile": ["isbinaryfile@4.0.10", "", {}, "sha512-iHrqe5shvBUcFbmZq9zOQHBoeOhZJu6RQGrDpBgenUm/Am+F3JM2MgQj+rK3Z601fzrL5gLZWtAPH2OBaSVcyw=="],
 
     "@electron/rebuild/node-abi": ["node-abi@4.31.0", "", { "dependencies": { "semver": "^7.6.3" } }, "sha512-Erq5w/t3syw3s4sDsUaX4QttIdBPsGKTT1DTRsCkTonGggczhlDKm/wDX3o+HPJpQ41EjXCbcmXf0tgr5YZJXw=="],
@@ -5626,6 +5641,10 @@
 
     "@executor-js/motel/@opentelemetry/sdk-trace-base": ["@opentelemetry/sdk-trace-base@2.6.1", "", { "dependencies": { "@opentelemetry/core": "2.6.1", "@opentelemetry/resources": "2.6.1", "@opentelemetry/semantic-conventions": "^1.29.0" }, "peerDependencies": { "@opentelemetry/api": ">=1.3.0 <1.10.0" } }, "sha512-r86ut4T1e8vNwB35CqCcKd45yzqH6/6Wzvpk2/cZB8PsPLlZFTvrh8yfOS3CYZYcUmAx4hHTZJ8AO8Dj8nrdhw=="],
 
+    "@executor-js/web/oxlint": ["oxlint@1.71.0", "", { "optionalDependencies": { "@oxlint/binding-android-arm-eabi": "1.71.0", "@oxlint/binding-android-arm64": "1.71.0", "@oxlint/binding-darwin-arm64": "1.71.0", "@oxlint/binding-darwin-x64": "1.71.0", "@oxlint/binding-freebsd-x64": "1.71.0", "@oxlint/binding-linux-arm-gnueabihf": "1.71.0", "@oxlint/binding-linux-arm-musleabihf": "1.71.0", "@oxlint/binding-linux-arm64-gnu": "1.71.0", "@oxlint/binding-linux-arm64-musl": "1.71.0", "@oxlint/binding-linux-ppc64-gnu": "1.71.0", "@oxlint/binding-linux-riscv64-gnu": "1.71.0", "@oxlint/binding-linux-riscv64-musl": "1.71.0", "@oxlint/binding-linux-s390x-gnu": "1.71.0", "@oxlint/binding-linux-x64-gnu": "1.71.0", "@oxlint/binding-linux-x64-musl": "1.71.0", "@oxlint/binding-openharmony-arm64": "1.71.0", "@oxlint/binding-win32-arm64-msvc": "1.71.0", "@oxlint/binding-win32-ia32-msvc": "1.71.0", "@oxlint/binding-win32-x64-msvc": "1.71.0" }, "peerDependencies": { "oxlint-tsgolint": ">=0.22.1", "vite-plus": "*" }, "optionalPeers": ["oxlint-tsgolint", "vite-plus"], "bin": { "oxlint": "bin/oxlint" } }, "sha512-U1m1X+C0vDj7DC1e13IoZULzEcPczE7UOMTs8VlZGHUEIUaSTZKo5qkPsQEfzpgnQ29Pea/w3Xntk62UCecxZw=="],
+
+    "@executor-js/web/typescript": ["typescript@6.0.3", "", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-y2TvuxSZPDyQakkFRPZHKFm+KKVqIisdg9/CZwm9ftvKXLP8NRWj38/ODjNbr43SsoXqNuAisEf1GdCxqWcdBw=="],
+
     "@fastify/otel/@opentelemetry/core": ["@opentelemetry/core@2.8.0", "", { "dependencies": { "@opentelemetry/semantic-conventions": "^1.29.0" }, "peerDependencies": { "@opentelemetry/api": ">=1.0.0 <1.10.0" } }, "sha512-hd1Lfh8p545nNz+jq1Ejfz+Mn1hyLuxYn1YzTfFNrxr8urEWMNQLPf1Th8kjOH+HxwawCrtgBp8JpBUR4ZSgww=="],
 
     "@fastify/otel/@opentelemetry/instrumentation": ["@opentelemetry/instrumentation@0.212.0", "", { "dependencies": { "@opentelemetry/api-logs": "0.212.0", "import-in-the-middle": "^2.0.6", "require-in-the-middle": "^8.0.0" }, "peerDependencies": { "@opentelemetry/api": "^1.3.0" } }, "sha512-IyXmpNnifNouMOe0I/gX7ENfv2ZCNdYTF0FpCsoBcpbIHzk81Ww9rQTYTnvghszCg7qGrIhNvWC8dhEifgX9Jg=="],
@@ -5636,6 +5655,10 @@
 
     "@graphql-tools/schema/@graphql-tools/utils": ["@graphql-tools/utils@11.1.0", "", { "dependencies": { "@graphql-typed-document-node/core": "^3.1.1", "@whatwg-node/promise-helpers": "^1.0.0", "cross-inspect": "1.0.1", "tslib": "^2.4.0" }, "peerDependencies": { "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" } }, "sha512-PtFVG4r8Z2LEBSaPYQMusBiB3o6kjLVJyjCLbnWem/SpSuM21v6LTmgpkXfYU1qpBV2UGsFyuEnSJInl8fR1Ag=="],
 
+    "@img/sharp-wasm32/@emnapi/runtime": ["@emnapi/runtime@1.9.2", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-3U4+MIWHImeyu1wnmVygh5WlgfYDtyf0k8AbLhMFxOipihf6nrWC4syIm/SwEeec0mNSafiiNnMJwbza/Is6Lw=="],
+
+    "@inquirer/core/signal-exit": ["signal-exit@4.1.0", "", {}, "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw=="],
+
     "@inquirer/core/wrap-ansi": ["wrap-ansi@6.2.0", "", { "dependencies": { "ansi-styles": "^4.0.0", "string-width": "^4.1.0", "strip-ansi": "^6.0.0" } }, "sha512-r6lPcBGxZXlIcymEu7InxDMhdW0KDxpLgoFLcguasxCaJ/SOIZwINatK9KY/tf+ZrlywOKU0UDj3ATXUBfxJXA=="],
 
     "@isaacs/cliui/string-width": ["string-width@5.1.2", "", { "dependencies": { "eastasianwidth": "^0.2.0", "emoji-regex": "^9.2.2", "strip-ansi": "^7.0.1" } }, "sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA=="],
@@ -5704,14 +5727,6 @@
 
     "@malept/flatpak-bundler/fs-extra": ["fs-extra@9.1.0", "", { "dependencies": { "at-least-node": "^1.0.0", "graceful-fs": "^4.2.0", "jsonfile": "^6.0.1", "universalify": "^2.0.0" } }, "sha512-hcg3ZmepS30/7BSFqRvoo3DOMQu7IjqxO5nCDt+zM9XWjb33Wg7ziNT+Qvqbuc3+gWpzO02JubVyk2G4Zvo1OQ=="],
 
-    "@manypkg/find-root/@types/node": ["@types/node@12.20.55", "", {}, "sha512-J8xLz7q2OFulZ2cyGTLE1TbbZcjpno7FaN6zdJNrgAdrJ+DZzh/uFR6YrTb4C+nXakvud8Q4+rbhoIWlYQbUFQ=="],
-
-    "@manypkg/find-root/fs-extra": ["fs-extra@8.1.0", "", { "dependencies": { "graceful-fs": "^4.2.0", "jsonfile": "^4.0.0", "universalify": "^0.1.0" } }, "sha512-yhlQgA6mnOJUKOsRUFsgJdQCvkKhcz8tlZG5HBQfReYZy46OwLcY+Zia0mtdHsOo9y/hP+CxMN0TU9QxoOtG4g=="],
-
-    "@manypkg/get-packages/@changesets/types": ["@changesets/types@4.1.0", "", {}, "sha512-LDQvVDv5Kb50ny2s25Fhm3d9QSZimsoUGBsUioj6MC3qbMUCuC8GPIvk/M6IvXx3lYhAs0lwWUQLb+VIEUCECw=="],
-
-    "@manypkg/get-packages/fs-extra": ["fs-extra@8.1.0", "", { "dependencies": { "graceful-fs": "^4.2.0", "jsonfile": "^4.0.0", "universalify": "^0.1.0" } }, "sha512-yhlQgA6mnOJUKOsRUFsgJdQCvkKhcz8tlZG5HBQfReYZy46OwLcY+Zia0mtdHsOo9y/hP+CxMN0TU9QxoOtG4g=="],
-
     "@modelcontextprotocol/sdk/jose": ["jose@6.2.2", "", {}, "sha512-d7kPDd34KO/YnzaDOlikGpOurfF0ByC2sEV4cANCtdqLlTfBlw2p14O/5d/zv40gJPbIQxfES3nSx1/oYNyuZQ=="],
 
     "@opentelemetry/exporter-logs-otlp-proto/@opentelemetry/resources": ["@opentelemetry/resources@2.6.1", "", { "dependencies": { "@opentelemetry/core": "2.6.1", "@opentelemetry/semantic-conventions": "^1.29.0" }, "peerDependencies": { "@opentelemetry/api": ">=1.3.0 <1.10.0" } }, "sha512-lID/vxSuKWXM55XhAKNoYXu9Cutoq5hFdkbTdI/zDKQktXzcWBVhNsOkiZFTMU9UtEWuGRNe0HUgmsFldIdxVA=="],
@@ -5804,8 +5819,6 @@
 
     "@opentui/core/string-width": ["string-width@7.2.0", "", { "dependencies": { "emoji-regex": "^10.3.0", "get-east-asian-width": "^1.0.0", "strip-ansi": "^7.1.0" } }, "sha512-tsaTIkKW9b4N+AEj+SVA+WhJzV7/zMhcSu78mLKWSk7cXMOSHsBKFWUs0fWwq8QyK3MgJBQRX6Gbi4kYbdvGkQ=="],
 
-    "@opentui/core/strip-ansi": ["strip-ansi@7.1.2", "", { "dependencies": { "ansi-regex": "^6.0.1" } }, "sha512-gmBGslpoQJtgnMAvOVqGZpEz9dyoKTCzy2nfz/n8aIFhN/jCE/rCmcxabB6jOOHV+0WNnylOxaxBQPSvcWklhA=="],
-
     "@opentui/react/react-reconciler": ["react-reconciler@0.32.0", "", { "dependencies": { "scheduler": "^0.26.0" }, "peerDependencies": { "react": "^19.1.0" } }, "sha512-2NPMOzgTlG0ZWdIf3qG+dcbLSoAc/uLfOwckc3ofy5sSK0pLJqnQLpUFxvGcN2rlXSjnVtGeeFLNimCQEj5gOQ=="],
 
     "@oslojs/jwt/@oslojs/encoding": ["@oslojs/encoding@0.4.1", "", {}, "sha512-hkjo6MuIK/kQR5CrGNdAPZhS01ZCXuWDRJ187zh6qqF2+yMHZpD9fAYpX8q2bOO6Ryhl3XpCT6kUX76N8hhm4Q=="],
@@ -5816,8 +5829,6 @@
 
     "@pierre/diffs/shiki": ["shiki@3.23.0", "", { "dependencies": { "@shikijs/core": "3.23.0", "@shikijs/engine-javascript": "3.23.0", "@shikijs/engine-oniguruma": "3.23.0", "@shikijs/langs": "3.23.0", "@shikijs/themes": "3.23.0", "@shikijs/types": "3.23.0", "@shikijs/vscode-textmate": "^10.0.2", "@types/hast": "^3.0.4" } }, "sha512-55Dj73uq9ZXL5zyeRPzHQsK7Nbyt6Y10k5s7OjuFZGMhpp4r/rsLBH0o/0fstIzX1Lep9VxefWljK/SKCzygIA=="],
 
-    "@poppinss/colors/kleur": ["kleur@4.1.5", "", {}, "sha512-o+NO+8WrRiQEE4/7nwRJhN1HWpVmJm511pBHUxPLtp0BUISzlBplORYSmTclCnJvQq2tKu/sgl3xVpkc7ZWuQQ=="],
-
     "@poppinss/dumper/@sindresorhus/is": ["@sindresorhus/is@7.2.0", "", {}, "sha512-P1Cz1dWaFfR4IR+U13mqqiGsLFf1KbayybWwdd2vfctdV6hDpUkgCY0nKOLLTMSoRd/jJNjtbqzf13K8DCCXQw=="],
 
     "@poppinss/dumper/supports-color": ["supports-color@10.2.2", "", {}, "sha512-SS+jx45GF1QjgEXQx4NJZV9ImqmO2NPz5FNsIHrsDjh2YsHnawpan7SNQ1o8NuhrbHZy9AZhIoCUiCeaW/C80g=="],
@@ -5920,6 +5931,8 @@
 
     "@reduxjs/toolkit/immer": ["immer@11.1.4", "", {}, "sha512-XREFCPo6ksxVzP4E0ekD5aMdf8WMwmdNaz6vuvxgI40UaEiu6q3p8X52aU6GdyvLY3XXX/8R7JOTXStz/nBbRw=="],
 
+    "@rolldown/binding-wasm32-wasi/@napi-rs/wasm-runtime": ["@napi-rs/wasm-runtime@1.1.5", "", { "dependencies": { "@tybys/wasm-util": "^0.10.2" }, "peerDependencies": { "@emnapi/core": "^1.7.1", "@emnapi/runtime": "^1.7.1" } }, "sha512-AWPoBRJ9tsnVhor4sjO7rkni+7p+2IAEFj6cx06UgP10jkQHqay/36uRV/bFkgrh18D9vb4cr8Q0Pthskgzy+Q=="],
+
     "@rollup/pluginutils/estree-walker": ["estree-walker@2.0.2", "", {}, "sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w=="],
 
     "@sentry/cloudflare/@sentry/core": ["@sentry/core@10.48.0", "", {}, "sha512-h8F+fXVwYC9ro5ZaO8V+v3vqc0awlXHGblEAuVxSGgh4IV/oFX+QVzXeDTTrFOFS6v/Vn5vAyu240eJrJAS6/g=="],
@@ -5936,6 +5949,10 @@
 
     "@sentry/react/@sentry/core": ["@sentry/core@10.48.0", "", {}, "sha512-h8F+fXVwYC9ro5ZaO8V+v3vqc0awlXHGblEAuVxSGgh4IV/oFX+QVzXeDTTrFOFS6v/Vn5vAyu240eJrJAS6/g=="],
 
+    "@sveltejs/kit/cookie": ["cookie@0.6.0", "", {}, "sha512-U71cyTamuh1CRNCfpGY6to28lxvNwPG4Guz/EVjgf3Jmzv0vlDp1atT9eS5dDjMYHucpHbWns6Lwf3BKz6svdw=="],
+
+    "@sveltejs/kit/devalue": ["devalue@5.8.1", "", {}, "sha512-4CXDYRBGqN+57wVJkuXBYmpAVUSg3L6JAQa/DFqm238G73E1wuyc/JhGQJzN7vUf/CMphYau2zXbfWzDR5aTEw=="],
+
     "@tailwindcss/node/jiti": ["jiti@2.6.1", "", { "bin": { "jiti": "lib/jiti-cli.mjs" } }, "sha512-ekilCSN1jwRvIbgeg/57YFh8qQDNbwDb9xT/qu2DAHbFFZUicIl4ygVaAvzveMhMVr3LnpSKTNnwt8PoOfmKhQ=="],
 
     "@tailwindcss/oxide-wasm32-wasi/@emnapi/core": ["@emnapi/core@1.9.2", "", { "dependencies": { "@emnapi/wasi-threads": "1.2.1", "tslib": "^2.4.0" }, "bundled": true }, "sha512-UC+ZhH3XtczQYfOlu3lNEkdW/p4dsJ1r/bP7H8+rhao3TTTMO1ATq/4DdIi23XuGoFY+Cz0JmCbdVl0hz9jZcA=="],
@@ -5956,6 +5973,8 @@
 
     "@tanstack/router-generator/@tanstack/router-utils": ["@tanstack/router-utils@1.162.2", "", { "dependencies": { "@babel/generator": "^7.28.5", "@babel/parser": "^7.28.5", "@babel/types": "^7.28.5", "ansis": "^4.1.0", "babel-dead-code-elimination": "^1.0.12", "diff": "^8.0.2", "pathe": "^2.0.3", "tinyglobby": "^0.2.15" } }, "sha512-hTWqJtqIFFdvuCl8WXNyrodp2L9zo2G37xKRrcVmVRWpAB2h+U1LuRAfS4tsFTiWOIoE/B+WDVFB8JpoEdw6jQ=="],
 
+    "@tanstack/router-generator/prettier": ["prettier@3.8.3", "", { "bin": { "prettier": "bin/prettier.cjs" } }, "sha512-7igPTM53cGHMW8xWuVTydi2KO233VFiTNyF5hLJqpilHfmn8C8gPf+PS7dUT64YcXFbiMGZxS9pCSxL/Dxm/Jw=="],
+
     "@tanstack/router-generator/zod": ["zod@4.4.3", "", {}, "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ=="],
 
     "@tanstack/router-plugin/@tanstack/router-generator": ["@tanstack/router-generator@1.166.32", "", { "dependencies": { "@babel/types": "^7.28.5", "@tanstack/router-core": "1.168.15", "@tanstack/router-utils": "1.161.6", "@tanstack/virtual-file-routes": "1.161.7", "magic-string": "^0.30.21", "prettier": "^3.5.0", "tsx": "^4.19.2", "zod": "^3.24.2" } }, "sha512-VuusKwEXcgKq+myq1JQfZogY8scTXIIeFls50dJ/UXgCXWp5n14iFreYNlg41wURcak2oA3M+t2TVfD0xUUD6g=="],
@@ -5964,14 +5983,20 @@
 
     "@tanstack/router-plugin/zod": ["zod@3.25.76", "", {}, "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ=="],
 
+    "@tanstack/router-utils/tinyglobby": ["tinyglobby@0.2.16", "", { "dependencies": { "fdir": "^6.5.0", "picomatch": "^4.0.4" } }, "sha512-pn99VhoACYR8nFHhxqix+uvsbXineAasWm5ojXoN8xEwK5Kd3/TrhNn1wByuD52UxWRLy8pu+kRMniEi6Eq9Zg=="],
+
     "@tanstack/start-plugin-core/@babel/code-frame": ["@babel/code-frame@7.27.1", "", { "dependencies": { "@babel/helper-validator-identifier": "^7.27.1", "js-tokens": "^4.0.0", "picocolors": "^1.1.1" } }, "sha512-cjQ7ZlQ0Mv3b47hABuTevyTuYN4i+loJKGeV9flcCgIK37cCXRh+L1bd3iBHlynerhQ7BhCkn2BPbQUL+rGqFg=="],
 
     "@tanstack/start-plugin-core/@rolldown/pluginutils": ["@rolldown/pluginutils@1.0.0-beta.40", "", {}, "sha512-s3GeJKSQOwBlzdUrj4ISjJj5SfSh+aqn0wjOar4Bx95iV1ETI7F6S/5hLcfAxZ9kXDcyrAkxPlqmd1ZITttf+w=="],
 
     "@tanstack/start-plugin-core/@tanstack/router-generator": ["@tanstack/router-generator@1.166.32", "", { "dependencies": { "@babel/types": "^7.28.5", "@tanstack/router-core": "1.168.15", "@tanstack/router-utils": "1.161.6", "@tanstack/virtual-file-routes": "1.161.7", "magic-string": "^0.30.21", "prettier": "^3.5.0", "tsx": "^4.19.2", "zod": "^3.24.2" } }, "sha512-VuusKwEXcgKq+myq1JQfZogY8scTXIIeFls50dJ/UXgCXWp5n14iFreYNlg41wURcak2oA3M+t2TVfD0xUUD6g=="],
 
+    "@tanstack/start-plugin-core/tinyglobby": ["tinyglobby@0.2.16", "", { "dependencies": { "fdir": "^6.5.0", "picomatch": "^4.0.4" } }, "sha512-pn99VhoACYR8nFHhxqix+uvsbXineAasWm5ojXoN8xEwK5Kd3/TrhNn1wByuD52UxWRLy8pu+kRMniEi6Eq9Zg=="],
+
     "@tanstack/start-plugin-core/zod": ["zod@3.25.76", "", {}, "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ=="],
 
+    "@testing-library/dom/aria-query": ["aria-query@5.3.0", "", { "dependencies": { "dequal": "^2.0.3" } }, "sha512-b0P0sZPKtyu8HkeRAfCq0IfURZK+SuwMjY1UXGBU27wpAiTwQAIlq56IbIO+ytk/JjS1fMR14ee5WBBfKi5J6A=="],
+
     "@types/better-sqlite3/@types/node": ["@types/node@25.6.0", "", { "dependencies": { "undici-types": "~7.19.0" } }, "sha512-+qIYRKdNYJwY3vRCZMdJbPLJAtGjQBudzZzdzwQYkEPQd+PJGixUL5QfvCLDaULoLv+RhT3LDkwEfKaAkgSmNQ=="],
 
     "@types/cacheable-request/@types/node": ["@types/node@25.6.0", "", { "dependencies": { "undici-types": "~7.19.0" } }, "sha512-+qIYRKdNYJwY3vRCZMdJbPLJAtGjQBudzZzdzwQYkEPQd+PJGixUL5QfvCLDaULoLv+RhT3LDkwEfKaAkgSmNQ=="],
@@ -5988,6 +6013,8 @@
 
     "@types/plist/@types/node": ["@types/node@25.6.0", "", { "dependencies": { "undici-types": "~7.19.0" } }, "sha512-+qIYRKdNYJwY3vRCZMdJbPLJAtGjQBudzZzdzwQYkEPQd+PJGixUL5QfvCLDaULoLv+RhT3LDkwEfKaAkgSmNQ=="],
 
+    "@types/prettier/prettier": ["prettier@3.8.3", "", { "bin": { "prettier": "bin/prettier.cjs" } }, "sha512-7igPTM53cGHMW8xWuVTydi2KO233VFiTNyF5hLJqpilHfmn8C8gPf+PS7dUT64YcXFbiMGZxS9pCSxL/Dxm/Jw=="],
+
     "@types/responselike/@types/node": ["@types/node@25.6.0", "", { "dependencies": { "undici-types": "~7.19.0" } }, "sha512-+qIYRKdNYJwY3vRCZMdJbPLJAtGjQBudzZzdzwQYkEPQd+PJGixUL5QfvCLDaULoLv+RhT3LDkwEfKaAkgSmNQ=="],
 
     "@types/tedious/@types/node": ["@types/node@25.9.2", "", { "dependencies": { "undici-types": ">=7.24.0 <7.24.7" } }, "sha512-G05zqtJhcDLb8uslf5EjCxXg9G1KQxiV8OS0R26IC//Eoyitzqe8z37I7cqvnZlrlSfgocQRfSn/AHBZJJFyGw=="],
@@ -6010,24 +6037,22 @@
 
     "app-builder-lib/dotenv": ["dotenv@16.6.1", "", {}, "sha512-uBq4egWHTcTt33a72vpSG0z3HnPuIl6NqYcTrKEg2azoEyl2hpW0zqlxysq2pK9HlDIHyHyakeYaYnSAwd8bow=="],
 
-    "app-builder-lib/fs-extra": ["fs-extra@10.1.0", "", { "dependencies": { "graceful-fs": "^4.2.0", "jsonfile": "^6.0.1", "universalify": "^2.0.0" } }, "sha512-oRXApq54ETRj4eMiFzGnHWGy+zo5raudjuxN0b8H7s/RU2oW0Wvsx9O0ACRN/kRq9E8Vu/ReskGB5o3ji+FzHQ=="],
-
     "app-builder-lib/jiti": ["jiti@2.6.1", "", { "bin": { "jiti": "lib/jiti-cli.mjs" } }, "sha512-ekilCSN1jwRvIbgeg/57YFh8qQDNbwDb9xT/qu2DAHbFFZUicIl4ygVaAvzveMhMVr3LnpSKTNnwt8PoOfmKhQ=="],
 
     "app-builder-lib/which": ["which@5.0.0", "", { "dependencies": { "isexe": "^3.1.1" }, "bin": { "node-which": "bin/which.js" } }, "sha512-JEdGzHwwkrbWoGOlIHqQ5gtprKGOenpDHpxE9zVR1bWbOtYRyPPHMe9FaP6x61CmNaTThSkb0DAJte5jD+DmzQ=="],
 
     "astro/@clack/prompts": ["@clack/prompts@1.2.0", "", { "dependencies": { "@clack/core": "1.2.0", "fast-string-width": "^1.1.0", "fast-wrap-ansi": "^0.1.3", "sisteransi": "^1.0.5" } }, "sha512-4jmztR9fMqPMjz6H/UZXj0zEmE43ha1euENwkckKKel4XpSfokExPo5AiVStdHSAlHekz4d0CA/r45Ok1E4D3w=="],
 
-    "astro/package-manager-detector": ["package-manager-detector@1.6.0", "", {}, "sha512-61A5ThoTiDG/C8s8UMZwSorAGwMJ0ERVGj2OjoW5pAalsNOg15+iQiPzrLJ4jhZ1HJzmC2PIHT2oEiH3R5fzNA=="],
+    "astro/tinyglobby": ["tinyglobby@0.2.16", "", { "dependencies": { "fdir": "^6.5.0", "picomatch": "^4.0.4" } }, "sha512-pn99VhoACYR8nFHhxqix+uvsbXineAasWm5ojXoN8xEwK5Kd3/TrhNn1wByuD52UxWRLy8pu+kRMniEi6Eq9Zg=="],
 
     "astro/vite": ["vite@7.3.2", "", { "dependencies": { "esbuild": "^0.27.0", "fdir": "^6.5.0", "picomatch": "^4.0.3", "postcss": "^8.5.6", "rollup": "^4.43.0", "tinyglobby": "^0.2.15" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "peerDependencies": { "@types/node": "^20.19.0 || >=22.12.0", "jiti": ">=1.21.0", "less": "^4.0.0", "lightningcss": "^1.21.0", "sass": "^1.70.0", "sass-embedded": "^1.70.0", "stylus": ">=0.54.8", "sugarss": "^5.0.0", "terser": "^5.16.0", "tsx": "^4.8.1", "yaml": "^2.4.2" }, "optionalPeers": ["@types/node", "jiti", "less", "lightningcss", "sass", "sass-embedded", "stylus", "sugarss", "terser", "tsx", "yaml"], "bin": { "vite": "bin/vite.js" } }, "sha512-Bby3NOsna2jsjfLVOHKes8sGwgl4TT0E6vvpYgnAYDIF/tie7MRaFthmKuHx1NSXjiTueXH3do80FMQgvEktRg=="],
 
     "atmn/commander": ["commander@14.0.3", "", {}, "sha512-H+y0Jo/T1RZ9qPP4Eh1pkcQcLRglraJaSLoyOtHxu6AapkjWVCy2Sit1QQ4x3Dng8qDlSsZEet7g5Pq06MvTgw=="],
 
-    "atmn/dotenv": ["dotenv@17.4.2", "", {}, "sha512-nI4U3TottKAcAD9LLud4Cb7b2QztQMUEfHbvhTH09bqXTxnSie8WnjPALV/WMCrJZ6UV/qHJ6L03OqO3LcdYZw=="],
-
     "atmn/jiti": ["jiti@2.6.1", "", { "bin": { "jiti": "lib/jiti-cli.mjs" } }, "sha512-ekilCSN1jwRvIbgeg/57YFh8qQDNbwDb9xT/qu2DAHbFFZUicIl4ygVaAvzveMhMVr3LnpSKTNnwt8PoOfmKhQ=="],
 
+    "atmn/prettier": ["prettier@3.8.3", "", { "bin": { "prettier": "bin/prettier.cjs" } }, "sha512-7igPTM53cGHMW8xWuVTydi2KO233VFiTNyF5hLJqpilHfmn8C8gPf+PS7dUT64YcXFbiMGZxS9pCSxL/Dxm/Jw=="],
+
     "better-auth/jose": ["jose@6.2.2", "", {}, "sha512-d7kPDd34KO/YnzaDOlikGpOurfF0ByC2sEV4cANCtdqLlTfBlw2p14O/5d/zv40gJPbIQxfES3nSx1/oYNyuZQ=="],
 
     "better-call/rou3": ["rou3@0.7.12", "", {}, "sha512-iFE4hLDuloSWcD7mjdCDhx2bKcIsYbtOTpfH5MHHLSKMOUyjqQXTeZVa289uuwEGEKFoE/BAPbhaU4B774nceg=="],
@@ -6036,14 +6061,18 @@
 
     "builder-util/chalk": ["chalk@4.1.2", "", { "dependencies": { "ansi-styles": "^4.1.0", "supports-color": "^7.1.0" } }, "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA=="],
 
-    "builder-util/fs-extra": ["fs-extra@10.1.0", "", { "dependencies": { "graceful-fs": "^4.2.0", "jsonfile": "^6.0.1", "universalify": "^2.0.0" } }, "sha512-oRXApq54ETRj4eMiFzGnHWGy+zo5raudjuxN0b8H7s/RU2oW0Wvsx9O0ACRN/kRq9E8Vu/ReskGB5o3ji+FzHQ=="],
-
     "bun-types/@types/node": ["@types/node@25.6.0", "", { "dependencies": { "undici-types": "~7.19.0" } }, "sha512-+qIYRKdNYJwY3vRCZMdJbPLJAtGjQBudzZzdzwQYkEPQd+PJGixUL5QfvCLDaULoLv+RhT3LDkwEfKaAkgSmNQ=="],
 
+    "cheerio/parse5": ["parse5@7.3.0", "", { "dependencies": { "entities": "^6.0.0" } }, "sha512-IInvU7fabl34qmi9gY8XOVxhYyMyuH2xUNpb2q8/Y+7552KlejkRvqvD19nMoUW/uQGGbqNpA6Tufu5FL5BZgw=="],
+
     "cheerio/undici": ["undici@7.25.0", "", {}, "sha512-xXnp4kTyor2Zq+J1FfPI6Eq3ew5h6Vl0F/8d9XU5zZQf1tX9s2Su1/3PiMmUANFULpmksxkClamIZcaUqryHsQ=="],
 
+    "cheerio/whatwg-mimetype": ["whatwg-mimetype@4.0.0", "", {}, "sha512-QaKxh0eNIi2mE9p2vEdzfagOKHCcj1pJ56EEHGQOVxp8r9/iszLUUV7v89x9O1p/T+NlTM5W7jW6+cz4Fq1YVg=="],
+
     "cliui/string-width": ["string-width@4.2.3", "", { "dependencies": { "emoji-regex": "^8.0.0", "is-fullwidth-code-point": "^3.0.0", "strip-ansi": "^6.0.1" } }, "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g=="],
 
+    "cliui/strip-ansi": ["strip-ansi@6.0.1", "", { "dependencies": { "ansi-regex": "^5.0.1" } }, "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A=="],
+
     "cliui/wrap-ansi": ["wrap-ansi@7.0.0", "", { "dependencies": { "ansi-styles": "^4.0.0", "string-width": "^4.1.0", "strip-ansi": "^6.0.0" } }, "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q=="],
 
     "clone-response/mimic-response": ["mimic-response@1.0.1", "", {}, "sha512-j5EctnkH7amfV/q5Hgmoal1g2QHFJRraOtmx0JpIqkxhBhI/lJSl1nMpQ45hVarwNETOoWEimndZ4QK0RHxuxQ=="],
@@ -6072,49 +6101,49 @@
 
     "dir-compare/p-limit": ["p-limit@3.1.0", "", { "dependencies": { "yocto-queue": "^0.1.0" } }, "sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ=="],
 
-    "dmg-builder/fs-extra": ["fs-extra@10.1.0", "", { "dependencies": { "graceful-fs": "^4.2.0", "jsonfile": "^6.0.1", "universalify": "^2.0.0" } }, "sha512-oRXApq54ETRj4eMiFzGnHWGy+zo5raudjuxN0b8H7s/RU2oW0Wvsx9O0ACRN/kRq9E8Vu/ReskGB5o3ji+FzHQ=="],
-
     "dmg-builder/iconv-lite": ["iconv-lite@0.6.3", "", { "dependencies": { "safer-buffer": ">= 2.1.2 < 3.0.0" } }, "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw=="],
 
     "dmg-license/ajv": ["ajv@6.15.0", "", { "dependencies": { "fast-deep-equal": "^3.1.1", "fast-json-stable-stringify": "^2.0.0", "json-schema-traverse": "^0.4.1", "uri-js": "^4.2.2" } }, "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw=="],
 
+    "dom-serializer/entities": ["entities@4.5.0", "", {}, "sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw=="],
+
     "dotenv-expand/dotenv": ["dotenv@16.6.1", "", {}, "sha512-uBq4egWHTcTt33a72vpSG0z3HnPuIl6NqYcTrKEg2azoEyl2hpW0zqlxysq2pK9HlDIHyHyakeYaYnSAwd8bow=="],
 
     "drizzle-kit/esbuild": ["esbuild@0.25.12", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.25.12", "@esbuild/android-arm": "0.25.12", "@esbuild/android-arm64": "0.25.12", "@esbuild/android-x64": "0.25.12", "@esbuild/darwin-arm64": "0.25.12", "@esbuild/darwin-x64": "0.25.12", "@esbuild/freebsd-arm64": "0.25.12", "@esbuild/freebsd-x64": "0.25.12", "@esbuild/linux-arm": "0.25.12", "@esbuild/linux-arm64": "0.25.12", "@esbuild/linux-ia32": "0.25.12", "@esbuild/linux-loong64": "0.25.12", "@esbuild/linux-mips64el": "0.25.12", "@esbuild/linux-ppc64": "0.25.12", "@esbuild/linux-riscv64": "0.25.12", "@esbuild/linux-s390x": "0.25.12", "@esbuild/linux-x64": "0.25.12", "@esbuild/netbsd-arm64": "0.25.12", "@esbuild/netbsd-x64": "0.25.12", "@esbuild/openbsd-arm64": "0.25.12", "@esbuild/openbsd-x64": "0.25.12", "@esbuild/openharmony-arm64": "0.25.12", "@esbuild/sunos-x64": "0.25.12", "@esbuild/win32-arm64": "0.25.12", "@esbuild/win32-ia32": "0.25.12", "@esbuild/win32-x64": "0.25.12" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg=="],
 
     "electron-builder/chalk": ["chalk@4.1.2", "", { "dependencies": { "ansi-styles": "^4.1.0", "supports-color": "^7.1.0" } }, "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA=="],
 
-    "electron-builder/fs-extra": ["fs-extra@10.1.0", "", { "dependencies": { "graceful-fs": "^4.2.0", "jsonfile": "^6.0.1", "universalify": "^2.0.0" } }, "sha512-oRXApq54ETRj4eMiFzGnHWGy+zo5raudjuxN0b8H7s/RU2oW0Wvsx9O0ACRN/kRq9E8Vu/ReskGB5o3ji+FzHQ=="],
-
     "electron-publish/chalk": ["chalk@4.1.2", "", { "dependencies": { "ansi-styles": "^4.1.0", "supports-color": "^7.1.0" } }, "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA=="],
 
-    "electron-publish/fs-extra": ["fs-extra@10.1.0", "", { "dependencies": { "graceful-fs": "^4.2.0", "jsonfile": "^6.0.1", "universalify": "^2.0.0" } }, "sha512-oRXApq54ETRj4eMiFzGnHWGy+zo5raudjuxN0b8H7s/RU2oW0Wvsx9O0ACRN/kRq9E8Vu/ReskGB5o3ji+FzHQ=="],
-
     "electron-publish/mime": ["mime@2.6.0", "", { "bin": { "mime": "cli.js" } }, "sha512-USPkMeET31rOMiarsBNIHZKLGgvKc/LrjofAnBlOttf5ajRvqiRA8QsenbcooctK6d6Ts6aqZXBA+XbkKthiQg=="],
 
     "electron-store/conf": ["conf@14.0.0", "", { "dependencies": { "ajv": "^8.17.1", "ajv-formats": "^3.0.1", "atomically": "^2.0.3", "debounce-fn": "^6.0.0", "dot-prop": "^9.0.0", "env-paths": "^3.0.0", "json-schema-typed": "^8.0.1", "semver": "^7.7.2", "uint8array-extras": "^1.4.0" } }, "sha512-L6BuueHTRuJHQvQVc6YXYZRtN5vJUtOdCTLn0tRYYV5azfbAFcPghB5zEE40mVrV6w7slMTqUfkDomutIK14fw=="],
 
-    "electron-updater/fs-extra": ["fs-extra@10.1.0", "", { "dependencies": { "graceful-fs": "^4.2.0", "jsonfile": "^6.0.1", "universalify": "^2.0.0" } }, "sha512-oRXApq54ETRj4eMiFzGnHWGy+zo5raudjuxN0b8H7s/RU2oW0Wvsx9O0ACRN/kRq9E8Vu/ReskGB5o3ji+FzHQ=="],
-
     "electron-vite/esbuild": ["esbuild@0.25.12", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.25.12", "@esbuild/android-arm": "0.25.12", "@esbuild/android-arm64": "0.25.12", "@esbuild/android-x64": "0.25.12", "@esbuild/darwin-arm64": "0.25.12", "@esbuild/darwin-x64": "0.25.12", "@esbuild/freebsd-arm64": "0.25.12", "@esbuild/freebsd-x64": "0.25.12", "@esbuild/linux-arm": "0.25.12", "@esbuild/linux-arm64": "0.25.12", "@esbuild/linux-ia32": "0.25.12", "@esbuild/linux-loong64": "0.25.12", "@esbuild/linux-mips64el": "0.25.12", "@esbuild/linux-ppc64": "0.25.12", "@esbuild/linux-riscv64": "0.25.12", "@esbuild/linux-s390x": "0.25.12", "@esbuild/linux-x64": "0.25.12", "@esbuild/netbsd-arm64": "0.25.12", "@esbuild/netbsd-x64": "0.25.12", "@esbuild/openbsd-arm64": "0.25.12", "@esbuild/openbsd-x64": "0.25.12", "@esbuild/openharmony-arm64": "0.25.12", "@esbuild/sunos-x64": "0.25.12", "@esbuild/win32-arm64": "0.25.12", "@esbuild/win32-ia32": "0.25.12", "@esbuild/win32-x64": "0.25.12" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg=="],
 
     "electron-vite/vite": ["vite@7.3.2", "", { "dependencies": { "esbuild": "^0.27.0", "fdir": "^6.5.0", "picomatch": "^4.0.3", "postcss": "^8.5.6", "rollup": "^4.43.0", "tinyglobby": "^0.2.15" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "peerDependencies": { "@types/node": "^20.19.0 || >=22.12.0", "jiti": ">=1.21.0", "less": "^4.0.0", "lightningcss": "^1.21.0", "sass": "^1.70.0", "sass-embedded": "^1.70.0", "stylus": ">=0.54.8", "sugarss": "^5.0.0", "terser": "^5.16.0", "tsx": "^4.8.1", "yaml": "^2.4.2" }, "optionalPeers": ["@types/node", "jiti", "less", "lightningcss", "sass", "sass-embedded", "stylus", "sugarss", "terser", "tsx", "yaml"], "bin": { "vite": "bin/vite.js" } }, "sha512-Bby3NOsna2jsjfLVOHKes8sGwgl4TT0E6vvpYgnAYDIF/tie7MRaFthmKuHx1NSXjiTueXH3do80FMQgvEktRg=="],
 
+    "electron-winstaller/fs-extra": ["fs-extra@7.0.1", "", { "dependencies": { "graceful-fs": "^4.1.2", "jsonfile": "^4.0.0", "universalify": "^0.1.0" } }, "sha512-YJDaCJZEnBmcbw13fvdAM9AwNOJwOzrE4pqMqBq5nFiEqXUqHwlK4B+3pUw6JNvfSPtX05xFHtYy/1ni01eGCw=="],
+
     "encoding-sniffer/iconv-lite": ["iconv-lite@0.6.3", "", { "dependencies": { "safer-buffer": ">= 2.1.2 < 3.0.0" } }, "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw=="],
 
     "execa/get-stream": ["get-stream@9.0.1", "", { "dependencies": { "@sec-ant/readable-stream": "^0.4.1", "is-stream": "^4.0.1" } }, "sha512-kVCxPF3vQM/N0B1PmoqVUqgHP+EeVjmZSQn+1oCRPxd2P21P2F19lIgbR3HBosbB1PUhOAoctJnfEn2GbN2eZA=="],
 
+    "execa/signal-exit": ["signal-exit@4.1.0", "", {}, "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw=="],
+
     "express/cookie": ["cookie@0.7.2", "", {}, "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w=="],
 
     "extend-shallow/is-extendable": ["is-extendable@0.1.1", "", {}, "sha512-5BMULNob1vgFX6EjQw5izWDxrecWK9AM72rugNr0TFldMOi0fj6Jk+zeKIt0xGj4cEfQIJth4w3OKWOJ4f+AFw=="],
 
     "filelist/minimatch": ["minimatch@5.1.9", "", { "dependencies": { "brace-expansion": "^2.0.1" } }, "sha512-7o1wEA2RyMP7Iu7GNba9vc0RWWGACJOCZBJX2GJWip0ikV+wcOsgVuY9uE8CPiyQhkGFSlhuSkZPavN7u1c2Fw=="],
 
+    "foreground-child/signal-exit": ["signal-exit@4.1.0", "", {}, "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw=="],
+
     "form-data/mime-types": ["mime-types@2.1.35", "", { "dependencies": { "mime-db": "1.52.0" } }, "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw=="],
 
-    "glob/minimatch": ["minimatch@9.0.9", "", { "dependencies": { "brace-expansion": "^2.0.2" } }, "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg=="],
+    "fs-extra/jsonfile": ["jsonfile@6.2.1", "", { "dependencies": { "universalify": "^2.0.0" }, "optionalDependencies": { "graceful-fs": "^4.1.6" } }, "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q=="],
 
-    "globby/ignore": ["ignore@5.3.2", "", {}, "sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g=="],
+    "glob/minimatch": ["minimatch@9.0.9", "", { "dependencies": { "brace-expansion": "^2.0.2" } }, "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg=="],
 
     "h3/cookie-es": ["cookie-es@1.2.3", "", {}, "sha512-lXVyvUvrNXblMqzIRrxHb57UUVmqsSWlxqt3XIjCkUP0wDAf6uicO6KMbEgYrMNtEvWgWHwe42CKxPu9MYAnWw=="],
 
@@ -6122,6 +6151,10 @@
 
     "h3-v2/rou3": ["rou3@0.8.1", "", {}, "sha512-ePa+XGk00/3HuCqrEnK3LxJW7I0SdNg6EFzKUJG73hMAdDcOUC/i/aSz7LSDwLrGr33kal/rqOGydzwl6U7zBA=="],
 
+    "hast-util-from-html/parse5": ["parse5@7.3.0", "", { "dependencies": { "entities": "^6.0.0" } }, "sha512-IInvU7fabl34qmi9gY8XOVxhYyMyuH2xUNpb2q8/Y+7552KlejkRvqvD19nMoUW/uQGGbqNpA6Tufu5FL5BZgw=="],
+
+    "hast-util-raw/parse5": ["parse5@7.3.0", "", { "dependencies": { "entities": "^6.0.0" } }, "sha512-IInvU7fabl34qmi9gY8XOVxhYyMyuH2xUNpb2q8/Y+7552KlejkRvqvD19nMoUW/uQGGbqNpA6Tufu5FL5BZgw=="],
+
     "hoist-non-react-statics/react-is": ["react-is@16.13.1", "", {}, "sha512-24e6ynE2H+OKt4kqsOvNd8kBpV65zoxbA4BVsEOB3ARVWQki/DHzaUoC5KuON/BiccDaCCTZBuOcfZs70kR8bQ=="],
 
     "hosted-git-info/lru-cache": ["lru-cache@6.0.0", "", { "dependencies": { "yallist": "^4.0.0" } }, "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA=="],
@@ -6138,14 +6171,20 @@
 
     "ink/es-toolkit": ["es-toolkit@1.45.1", "", {}, "sha512-/jhoOj/Fx+A+IIyDNOvO3TItGmlMKhtX8ISAHKE90c4b/k1tqaqEZ+uUqfpU8DMnW5cgNJv606zS55jGvza0Xw=="],
 
-    "ink/signal-exit": ["signal-exit@3.0.7", "", {}, "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ=="],
-
     "ink/type-fest": ["type-fest@5.5.0", "", { "dependencies": { "tagged-tag": "^1.0.0" } }, "sha512-PlBfpQwiUvGViBNX84Yxwjsdhd1TUlXr6zjX7eoirtCPIr08NAmxwa+fcYBTeRQxHo9YC9wwF3m9i700sHma8g=="],
 
     "ink/ws": ["ws@8.20.0", "", { "peerDependencies": { "bufferutil": "^4.0.1", "utf-8-validate": ">=5.0.2" }, "optionalPeers": ["bufferutil", "utf-8-validate"] }, "sha512-sAt8BhgNbzCtgGbt2OxmpuryO63ZoDk/sqaB/znQm94T4fCEsy/yV+7CdC1kJhOU9lboAEU7R3kquuycDoibVA=="],
 
     "ink-confirm-input/ink-text-input": ["ink-text-input@3.3.0", "", { "dependencies": { "chalk": "^3.0.0", "prop-types": "^15.5.10" }, "peerDependencies": { "ink": "^2.0.0", "react": "^16.5.2" } }, "sha512-gO4wrOf2ie3YuEARTIwGlw37lMjFn3Gk6CKIDrMlHb46WFMagZU7DplohjM24zynlqfnXA5UDEIfC2NBcvD8kg=="],
 
+    "jsdom/lru-cache": ["lru-cache@11.3.5", "", {}, "sha512-NxVFwLAnrd9i7KUBxC4DrUhmgjzOs+1Qm50D3oF1/oL+r1NpZ4gA7xvG0/zJ8evR7zIKn4vLf7qTNduWFtCrRw=="],
+
+    "jsdom/undici": ["undici@7.25.0", "", {}, "sha512-xXnp4kTyor2Zq+J1FfPI6Eq3ew5h6Vl0F/8d9XU5zZQf1tX9s2Su1/3PiMmUANFULpmksxkClamIZcaUqryHsQ=="],
+
+    "json-schema-to-typescript/prettier": ["prettier@3.8.3", "", { "bin": { "prettier": "bin/prettier.cjs" } }, "sha512-7igPTM53cGHMW8xWuVTydi2KO233VFiTNyF5hLJqpilHfmn8C8gPf+PS7dUT64YcXFbiMGZxS9pCSxL/Dxm/Jw=="],
+
+    "json-schema-to-typescript/tinyglobby": ["tinyglobby@0.2.16", "", { "dependencies": { "fdir": "^6.5.0", "picomatch": "^4.0.4" } }, "sha512-pn99VhoACYR8nFHhxqix+uvsbXineAasWm5ojXoN8xEwK5Kd3/TrhNn1wByuD52UxWRLy8pu+kRMniEi6Eq9Zg=="],
+
     "katex/commander": ["commander@8.3.0", "", {}, "sha512-OkTL9umf+He2DZkUq8f8J9of7yL6RJKI24dVITBmNfZBmri9zYZQrKkuXiKhyfPSu8tUhnVBB1iKXevvnlR4Ww=="],
 
     "knip/jiti": ["jiti@2.6.1", "", { "bin": { "jiti": "lib/jiti-cli.mjs" } }, "sha512-ekilCSN1jwRvIbgeg/57YFh8qQDNbwDb9xT/qu2DAHbFFZUicIl4ygVaAvzveMhMVr3LnpSKTNnwt8PoOfmKhQ=="],
@@ -6172,6 +6211,8 @@
 
     "node-gyp/env-paths": ["env-paths@2.2.1", "", {}, "sha512-+h1lkLKhZMTYjog1VEpJNG7NZJWcuc2DDk/qsqSTRRCOXiLjeQ1d1/udrUGhqMxUgAlwKNZ0cf2uqan5GLuS2A=="],
 
+    "node-gyp/tinyglobby": ["tinyglobby@0.2.16", "", { "dependencies": { "fdir": "^6.5.0", "picomatch": "^4.0.4" } }, "sha512-pn99VhoACYR8nFHhxqix+uvsbXineAasWm5ojXoN8xEwK5Kd3/TrhNn1wByuD52UxWRLy8pu+kRMniEi6Eq9Zg=="],
+
     "node-gyp/undici": ["undici@6.25.0", "", {}, "sha512-ZgpWDC5gmNiuY9CnLVXEH8rl50xhRCuLNA97fAUnKi8RRuV4E6KG31pDTsLVUKnohJE0I3XDrTeEydAXRw47xg=="],
 
     "node-gyp/which": ["which@6.0.1", "", { "dependencies": { "isexe": "^4.0.0" }, "bin": { "node-which": "bin/which.js" } }, "sha512-oGLe46MIrCRqX7ytPUf66EAYvdeMIZYn3WaocqqKZAxrBpkqHfL/qvTyJ/bTk5+AqHCjXmrv3CEWgy368zhRUg=="],
@@ -6182,17 +6223,17 @@
 
     "ora/cli-spinners": ["cli-spinners@3.4.0", "", {}, "sha512-bXfOC4QcT1tKXGorxL3wbJm6XJPDqEnij2gQ2m7ESQuE+/z9YFIWnl/5RpTiKWbMq3EVKR4fRLJGn6DVfu0mpw=="],
 
-    "p-locate/p-limit": ["p-limit@2.3.0", "", { "dependencies": { "p-try": "^2.0.0" } }, "sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w=="],
-
     "parse-entities/@types/unist": ["@types/unist@2.0.11", "", {}, "sha512-CmBKiL6NNo/OqgmMn95Fk9Whlp2mtvIv+KNpQKN2F4SjvrEesubTRWGYSg+BnWZOnlCaSTU1sMpsBOzgbYhnsA=="],
 
-    "parse5/entities": ["entities@6.0.1", "", {}, "sha512-aN97NXWF6AWBTahfVOIrB/NShkzi5H7F9r1s9mD3cDj4Ko5f2qhhVoYMibXF7GlLveb/D2ioWay8lxI97Ven3g=="],
+    "parse5-htmlparser2-tree-adapter/parse5": ["parse5@7.3.0", "", { "dependencies": { "entities": "^6.0.0" } }, "sha512-IInvU7fabl34qmi9gY8XOVxhYyMyuH2xUNpb2q8/Y+7552KlejkRvqvD19nMoUW/uQGGbqNpA6Tufu5FL5BZgw=="],
+
+    "parse5-parser-stream/parse5": ["parse5@7.3.0", "", { "dependencies": { "entities": "^6.0.0" } }, "sha512-IInvU7fabl34qmi9gY8XOVxhYyMyuH2xUNpb2q8/Y+7552KlejkRvqvD19nMoUW/uQGGbqNpA6Tufu5FL5BZgw=="],
 
     "pixelmatch/pngjs": ["pngjs@6.0.0", "", {}, "sha512-TRzzuFRRmEoSW/p1KVAmiOgPco2Irlah+bGFCeNfJXxxYGwSw7YwAOAcd7X28K/m5bjBWKsC29KyoMfHbypayg=="],
 
     "playwright/fsevents": ["fsevents@2.3.2", "", { "os": "darwin" }, "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA=="],
 
-    "postcss/nanoid": ["nanoid@3.3.11", "", { "bin": { "nanoid": "bin/nanoid.cjs" } }, "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w=="],
+    "postcss/nanoid": ["nanoid@3.3.15", "", { "bin": { "nanoid": "bin/nanoid.cjs" } }, "sha512-y7Wygv/7mEOvxTuEQDB8StXdMRBWf1kR/tlhAzBRUFkB2jfcLOAxO/SHmOO2zgz1pVgK29/kyupn059/bCHdjA=="],
 
     "posthog-js/@opentelemetry/api-logs": ["@opentelemetry/api-logs@0.208.0", "", { "dependencies": { "@opentelemetry/api": "^1.3.0" } }, "sha512-CjruKY9V6NMssL/T1kAFgzosF1v9o6oeN+aX5JB/C/xPNtmgIJqcXHG7fA82Ou1zCpWGl4lROQUKwUNE1pMCyg=="],
 
@@ -6204,9 +6245,15 @@
 
     "postject/commander": ["commander@9.5.0", "", {}, "sha512-KRs7WVDKg86PWiuAqhDrAQnTXZKraVcCc6vFdL14qrZ/DcWwuRo7VoiYXalXO7S5GKpqYiVEwCbgFDfxNHKJBQ=="],
 
-    "prop-types/react-is": ["react-is@16.13.1", "", {}, "sha512-24e6ynE2H+OKt4kqsOvNd8kBpV65zoxbA4BVsEOB3ARVWQki/DHzaUoC5KuON/BiccDaCCTZBuOcfZs70kR8bQ=="],
+    "pretty-format/ansi-regex": ["ansi-regex@5.0.1", "", {}, "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ=="],
+
+    "pretty-format/ansi-styles": ["ansi-styles@5.2.0", "", {}, "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA=="],
 
-    "proper-lockfile/signal-exit": ["signal-exit@3.0.7", "", {}, "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ=="],
+    "pretty-format/react-is": ["react-is@17.0.2", "", {}, "sha512-w2GsyukL62IJnlaff/nRegPQR94C/XXamvMWmSHRJ4y7Ts/4ocGRmTHvOs8PSE6pB3dWOrD/nueuU5sduBsQ4w=="],
+
+    "prompts/kleur": ["kleur@3.0.3", "", {}, "sha512-eTIzlVOSUR+JxdDFepEYcBMtZ9Qqdef+rnzWdRZuMbOywu5tO2w2N7rqjoANZ5k9vywhL6Br1VRjUIgTQx4E8w=="],
+
+    "prop-types/react-is": ["react-is@16.13.1", "", {}, "sha512-24e6ynE2H+OKt4kqsOvNd8kBpV65zoxbA4BVsEOB3ARVWQki/DHzaUoC5KuON/BiccDaCCTZBuOcfZs70kR8bQ=="],
 
     "protobufjs/@types/node": ["@types/node@25.6.0", "", { "dependencies": { "undici-types": "~7.19.0" } }, "sha512-+qIYRKdNYJwY3vRCZMdJbPLJAtGjQBudzZzdzwQYkEPQd+PJGixUL5QfvCLDaULoLv+RhT3LDkwEfKaAkgSmNQ=="],
 
@@ -6222,21 +6269,17 @@
 
     "react-rnd/tslib": ["tslib@2.6.2", "", {}, "sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q=="],
 
-    "read-yaml-file/js-yaml": ["js-yaml@3.14.2", "", { "dependencies": { "argparse": "^1.0.7", "esprima": "^4.0.0" }, "bin": { "js-yaml": "bin/js-yaml.js" } }, "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg=="],
-
     "readable-web-to-node-stream/readable-stream": ["readable-stream@4.7.0", "", { "dependencies": { "abort-controller": "^3.0.0", "buffer": "^6.0.3", "events": "^3.3.0", "process": "^0.11.10", "string_decoder": "^1.3.0" } }, "sha512-oIGGmcpTLwPga8Bn6/Z75SVaH1z5dUut2ibSyAMVhmUggWpmDn2dapB0n7f8nwaSiRtepAsfJyfXIO5DCVAODg=="],
 
     "readdirp/picomatch": ["picomatch@2.3.2", "", {}, "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA=="],
 
     "recharts/es-toolkit": ["es-toolkit@1.45.1", "", {}, "sha512-/jhoOj/Fx+A+IIyDNOvO3TItGmlMKhtX8ISAHKE90c4b/k1tqaqEZ+uUqfpU8DMnW5cgNJv606zS55jGvza0Xw=="],
 
-    "restore-cursor/signal-exit": ["signal-exit@3.0.7", "", {}, "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ=="],
-
     "rimraf/glob": ["glob@7.2.3", "", { "dependencies": { "fs.realpath": "^1.0.0", "inflight": "^1.0.4", "inherits": "2", "minimatch": "^3.1.1", "once": "^1.3.0", "path-is-absolute": "^1.0.0" } }, "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q=="],
 
-    "rolldown/@oxc-project/types": ["@oxc-project/types@0.124.0", "", {}, "sha512-VBFWMTBvHxS11Z5Lvlr3IWgrwhMTXV+Md+EQF0Xf60+wAdsGFTBx7X7K/hP4pi8N7dcm1RvcHwDxZ16Qx8keUg=="],
+    "rolldown/@oxc-project/types": ["@oxc-project/types@0.137.0", "", {}, "sha512-WT+Gb24i8hmvo85AIv2oEYouEXkRlKAlT9WaCa3TfLgNCN+GhrJOGZuIlMouAh38Qe4QOx26eUOVsq70qXrywA=="],
 
-    "rolldown/@rolldown/pluginutils": ["@rolldown/pluginutils@1.0.0-rc.15", "", {}, "sha512-UromN0peaE53IaBRe9W7CjrZgXl90fqGpK+mIZbA3qSTeYqg3pqpROBdIPvOG3F5ereDHNwoHBI2e50n1BDr1g=="],
+    "rolldown/@rolldown/pluginutils": ["@rolldown/pluginutils@1.0.1", "", {}, "sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw=="],
 
     "router/path-to-regexp": ["path-to-regexp@8.4.2", "", {}, "sha512-qRcuIdP69NPm4qbACK+aDogI5CBDMi1jKe0ry5rSQJz8JVLsC7jV8XpiJjGRLLol3N+R5ihGYcrPLTno6pAdBA=="],
 
@@ -6260,16 +6303,26 @@
 
     "string-width-cjs/is-fullwidth-code-point": ["is-fullwidth-code-point@3.0.0", "", {}, "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg=="],
 
+    "string-width-cjs/strip-ansi": ["strip-ansi@6.0.1", "", { "dependencies": { "ansi-regex": "^5.0.1" } }, "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A=="],
+
+    "strip-ansi-cjs/ansi-regex": ["ansi-regex@5.0.1", "", {}, "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ=="],
+
     "subsume/escape-string-regexp": ["escape-string-regexp@5.0.0", "", {}, "sha512-/veY75JbMK4j1yjvuUxuVsiS/hr/4iHs9FTT6cgTexxdE0Ly/glccBAkloH/DofkjRbZU3bnoj38mOmhkZ0lHw=="],
 
     "sucrase/commander": ["commander@4.1.1", "", {}, "sha512-NOKm8xhkzAjzFx8B2v5OAHT+u5pRQc2UCa2Vq9jYL/31o2wi9mxBA7LIFs3sV5VSC49z6pEhfbMULvShKj26WA=="],
 
+    "sucrase/tinyglobby": ["tinyglobby@0.2.16", "", { "dependencies": { "fdir": "^6.5.0", "picomatch": "^4.0.4" } }, "sha512-pn99VhoACYR8nFHhxqix+uvsbXineAasWm5ojXoN8xEwK5Kd3/TrhNn1wByuD52UxWRLy8pu+kRMniEi6Eq9Zg=="],
+
+    "svelte/aria-query": ["aria-query@5.3.1", "", {}, "sha512-Z/ZeOgVl7bcSYZ/u/rh0fOpvEpq//LZmdbkXyc7syVzjPAhfOa9ebsdTSjEBDU4vs5nC98Kfduj1uFo0qyET3g=="],
+
+    "svelte/devalue": ["devalue@5.8.1", "", {}, "sha512-4CXDYRBGqN+57wVJkuXBYmpAVUSg3L6JAQa/DFqm238G73E1wuyc/JhGQJzN7vUf/CMphYau2zXbfWzDR5aTEw=="],
+
+    "svelte-check/chokidar": ["chokidar@4.0.3", "", { "dependencies": { "readdirp": "^4.0.1" } }, "sha512-Qgzu8kfBvo+cA4962jnP1KkS6Dop5NS6g7R5LFYJr4b8Ub94PPQXUksCw9PvXoeXPRRddRNC5C1JQUR2SMGtnA=="],
+
     "svgo/commander": ["commander@11.1.0", "", {}, "sha512-yPVavfyCcRhmorC7rWlkHn15b4wDVgVmBA7kV4QVBsF7kv/9TKJAbAXVTxvTnwP8HHKjRCJDClKbciiYS7p0DQ=="],
 
     "tar-fs/chownr": ["chownr@1.1.4", "", {}, "sha512-jJ0bqzaylmJtVnNgzTeSOs8DPavpbYgEr/b0YL8/2GO3xJEhInFmhKMUnEJQjZumK7KXGFhUy89PrsJWlakBVg=="],
 
-    "temp-file/fs-extra": ["fs-extra@10.1.0", "", { "dependencies": { "graceful-fs": "^4.2.0", "jsonfile": "^6.0.1", "universalify": "^2.0.0" } }, "sha512-oRXApq54ETRj4eMiFzGnHWGy+zo5raudjuxN0b8H7s/RU2oW0Wvsx9O0ACRN/kRq9E8Vu/ReskGB5o3ji+FzHQ=="],
-
     "tiny-async-pool/semver": ["semver@5.7.2", "", { "bin": { "semver": "bin/semver" } }, "sha512-cBznnQ9KjJqU67B52RMC65CMarK2600WFnbkcaiwWq3xy/5haFJlshgnpjovMVJ+Hff49d8GEn0b87C5pDQ10g=="],
 
     "to-regex-range/is-number": ["is-number@7.0.0", "", {}, "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng=="],
@@ -6278,6 +6331,8 @@
 
     "tsup/tinyexec": ["tinyexec@0.3.2", "", {}, "sha512-KQQR9yN7R5+OSwaK0XQoj22pwHoTlgYqmUscPYoknOoWCWfj/5/ABTMRi69FrKU5ffPVh5QcFikpWJI/P1ocHA=="],
 
+    "tsup/tinyglobby": ["tinyglobby@0.2.16", "", { "dependencies": { "fdir": "^6.5.0", "picomatch": "^4.0.4" } }, "sha512-pn99VhoACYR8nFHhxqix+uvsbXineAasWm5ojXoN8xEwK5Kd3/TrhNn1wByuD52UxWRLy8pu+kRMniEi6Eq9Zg=="],
+
     "typeorm/dotenv": ["dotenv@16.6.1", "", {}, "sha512-uBq4egWHTcTt33a72vpSG0z3HnPuIl6NqYcTrKEg2azoEyl2hpW0zqlxysq2pK9HlDIHyHyakeYaYnSAwd8bow=="],
 
     "typeorm/uuid": ["uuid@11.1.1", "", { "bin": { "uuid": "dist/esm/bin/uuid" } }, "sha512-vIYxrBCC/N/K+Js3qSN88go7kIfNPssr/hHCesKCQNAjmgvYS2oqr69kIufEG+O4+PfezOH4EbIeHCfFov8ZgQ=="],
@@ -6300,14 +6355,22 @@
 
     "wrap-ansi-cjs/string-width": ["string-width@4.2.3", "", { "dependencies": { "emoji-regex": "^8.0.0", "is-fullwidth-code-point": "^3.0.0", "strip-ansi": "^6.0.1" } }, "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g=="],
 
+    "wrap-ansi-cjs/strip-ansi": ["strip-ansi@6.0.1", "", { "dependencies": { "ansi-regex": "^5.0.1" } }, "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A=="],
+
     "xml2js/xmlbuilder": ["xmlbuilder@11.0.1", "", {}, "sha512-fDlsI/kFEx7gLvbecc0/ohLG50fugQp8ryHzMTuW9vSa1GJ0XYWKnhsUx7oie3G98+r56aTQIUB4kht42R3JvA=="],
 
     "yargs/string-width": ["string-width@4.2.3", "", { "dependencies": { "emoji-regex": "^8.0.0", "is-fullwidth-code-point": "^3.0.0", "strip-ansi": "^6.0.1" } }, "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g=="],
 
     "yargs/yargs-parser": ["yargs-parser@21.1.1", "", {}, "sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw=="],
 
+    "@astrojs/cloudflare/vite/postcss": ["postcss@8.5.10", "", { "dependencies": { "nanoid": "^3.3.11", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" } }, "sha512-pMMHxBOZKFU6HgAZ4eyGnwXF/EvPGGqUr0MnZ5+99485wwW41kW91A4LOGxSHhgugZmSChL5AlElNdwlNgcnLQ=="],
+
     "@astrojs/react/@vitejs/plugin-react/@rolldown/pluginutils": ["@rolldown/pluginutils@1.0.0-rc.3", "", {}, "sha512-eybk3TjzzzV97Dlj5c+XrBFW57eTNhzod66y9HrBlzJ6NsCrWCp/2kaPS3K9wJmurBC0Tdw4yPjXKZqlznim3Q=="],
 
+    "@astrojs/react/vite/postcss": ["postcss@8.5.10", "", { "dependencies": { "nanoid": "^3.3.11", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" } }, "sha512-pMMHxBOZKFU6HgAZ4eyGnwXF/EvPGGqUr0MnZ5+99485wwW41kW91A4LOGxSHhgugZmSChL5AlElNdwlNgcnLQ=="],
+
+    "@astrojs/react/vite/tinyglobby": ["tinyglobby@0.2.16", "", { "dependencies": { "fdir": "^6.5.0", "picomatch": "^4.0.4" } }, "sha512-pn99VhoACYR8nFHhxqix+uvsbXineAasWm5ojXoN8xEwK5Kd3/TrhNn1wByuD52UxWRLy8pu+kRMniEi6Eq9Zg=="],
+
     "@babel/helper-compilation-targets/lru-cache/yallist": ["yallist@3.1.1", "", {}, "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g=="],
 
     "@cloudflare/vite-plugin/miniflare/undici": ["undici@7.24.8", "", {}, "sha512-6KQ/+QxK49Z/p3HO6E5ZCZWNnCasyZLa5ExaVYyvPxUwKtbCPMKELJOqh7EqOle0t9cH/7d2TaaTRRa6Nhs4YQ=="],
@@ -6386,26 +6449,16 @@
 
     "@electron/fuses/fs-extra/jsonfile": ["jsonfile@6.2.1", "", { "dependencies": { "universalify": "^2.0.0" }, "optionalDependencies": { "graceful-fs": "^4.1.6" } }, "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q=="],
 
-    "@electron/fuses/fs-extra/universalify": ["universalify@2.0.1", "", {}, "sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw=="],
+    "@electron/get/fs-extra/universalify": ["universalify@0.1.2", "", {}, "sha512-rBJeI5CXAlmy1pV+617WB9J63U6XcazHHF2f2dbJix4XzpUF0RS3Zbj0FGIOCAva5P/d/GBOYaACQ1w+0azUkg=="],
 
     "@electron/notarize/fs-extra/jsonfile": ["jsonfile@6.2.1", "", { "dependencies": { "universalify": "^2.0.0" }, "optionalDependencies": { "graceful-fs": "^4.1.6" } }, "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q=="],
 
-    "@electron/notarize/fs-extra/universalify": ["universalify@2.0.1", "", {}, "sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw=="],
-
-    "@electron/osx-sign/fs-extra/jsonfile": ["jsonfile@6.2.1", "", { "dependencies": { "universalify": "^2.0.0" }, "optionalDependencies": { "graceful-fs": "^4.1.6" } }, "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q=="],
-
-    "@electron/osx-sign/fs-extra/universalify": ["universalify@2.0.1", "", {}, "sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw=="],
-
     "@electron/universal/fs-extra/jsonfile": ["jsonfile@6.2.1", "", { "dependencies": { "universalify": "^2.0.0" }, "optionalDependencies": { "graceful-fs": "^4.1.6" } }, "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q=="],
 
-    "@electron/universal/fs-extra/universalify": ["universalify@2.0.1", "", {}, "sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw=="],
-
     "@electron/universal/minimatch/brace-expansion": ["brace-expansion@2.1.0", "", { "dependencies": { "balanced-match": "^1.0.0" } }, "sha512-TN1kCZAgdgweJhWWpgKYrQaMNHcDULHkWwQIspdtjV4Y5aurRdZpjAqn6yX3FPqTA9ngHCc4hJxMAMgGfve85w=="],
 
     "@electron/windows-sign/fs-extra/jsonfile": ["jsonfile@6.2.1", "", { "dependencies": { "universalify": "^2.0.0" }, "optionalDependencies": { "graceful-fs": "^4.1.6" } }, "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q=="],
 
-    "@electron/windows-sign/fs-extra/universalify": ["universalify@2.0.1", "", {}, "sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw=="],
-
     "@esbuild-kit/core-utils/esbuild/@esbuild/android-arm": ["@esbuild/android-arm@0.18.20", "", { "os": "android", "cpu": "arm" }, "sha512-fyi7TDI/ijKKNZTUJAQqiG5T7YjJXgnzkURqmGj13C6dCqckZBLdl4h7bkhHt/t0WP+zO9/zwroDvANaOqO5Sw=="],
 
     "@esbuild-kit/core-utils/esbuild/@esbuild/android-arm64": ["@esbuild/android-arm64@0.18.20", "", { "os": "android", "cpu": "arm64" }, "sha512-Nz4rJcchGDtENV0eMKUNa6L12zz2zBDXuhj/Vjh18zGqB44Bi7MBMSXjgunJgjRhCmKOjnPuZp4Mb6OKqtMHLQ=="],
@@ -6498,6 +6551,44 @@
 
     "@executor-js/motel/@opentelemetry/sdk-trace-base/@opentelemetry/resources": ["@opentelemetry/resources@2.6.1", "", { "dependencies": { "@opentelemetry/core": "2.6.1", "@opentelemetry/semantic-conventions": "^1.29.0" }, "peerDependencies": { "@opentelemetry/api": ">=1.3.0 <1.10.0" } }, "sha512-lID/vxSuKWXM55XhAKNoYXu9Cutoq5hFdkbTdI/zDKQktXzcWBVhNsOkiZFTMU9UtEWuGRNe0HUgmsFldIdxVA=="],
 
+    "@executor-js/web/oxlint/@oxlint/binding-android-arm-eabi": ["@oxlint/binding-android-arm-eabi@1.71.0", "", { "os": "android", "cpu": "arm" }, "sha512-ImGmd1njEg4FEJH03jhRnveEegtO3czCtfptvaHivKAZQIYATbVFBrrzbaYMYv0oJioTnxZAZVSyV+oL7W8S2g=="],
+
+    "@executor-js/web/oxlint/@oxlint/binding-android-arm64": ["@oxlint/binding-android-arm64@1.71.0", "", { "os": "android", "cpu": "arm64" }, "sha512-4A5BEexBrwY1YFF8Kiq/lp/wQPRG79G3BWIE1FuWaM5MvmpYSd+7ZySVcKkHdwo0UDzdQGddp6pD9mpctMqLnw=="],
+
+    "@executor-js/web/oxlint/@oxlint/binding-darwin-arm64": ["@oxlint/binding-darwin-arm64@1.71.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-9wJA9GJulLwS2usU3CEisI/ESDO1n1z9eyTCvApMDrAkbJ1ve0mORgTMjcWWsKxkzkeZ2N/Gpra5IQE7x8tYgQ=="],
+
+    "@executor-js/web/oxlint/@oxlint/binding-darwin-x64": ["@oxlint/binding-darwin-x64@1.71.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-PlLCjS06V0PeJMAJwzjrExw1sYNW9Gch3JtNlcwwZDXGlTYDuwHNN89zYH8LTXFfgkVtsYvs2nv0FqrzyuFDzg=="],
+
+    "@executor-js/web/oxlint/@oxlint/binding-freebsd-x64": ["@oxlint/binding-freebsd-x64@1.71.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-Lhil7bWre0ncxbUoDoxfS0JzpTz17BRQKW7iwoAUY8GJ66+WwJEfYPCFJ1P0WgVZR5/O/b3Q2pENlHOjeXLOGQ=="],
+
+    "@executor-js/web/oxlint/@oxlint/binding-linux-arm-gnueabihf": ["@oxlint/binding-linux-arm-gnueabihf@1.71.0", "", { "os": "linux", "cpu": "arm" }, "sha512-Oo9/L58PYD3RC0x05d2upAPLllHytTjHQGsnC06P6Ynn7jKkp5mdImQxXdJ3+FnBaKspNpGogzgVsi6g872LiA=="],
+
+    "@executor-js/web/oxlint/@oxlint/binding-linux-arm-musleabihf": ["@oxlint/binding-linux-arm-musleabihf@1.71.0", "", { "os": "linux", "cpu": "arm" }, "sha512-mSHfyfgJrEbyIR29ejaeS50BdPk+GoNPlC1dckpDiUZbJAIel68sjSMdOt4WY0/gva+ECC7FNITQkxMJU+vSBw=="],
+
+    "@executor-js/web/oxlint/@oxlint/binding-linux-arm64-gnu": ["@oxlint/binding-linux-arm64-gnu@1.71.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-n9yY4M2tiy3aij4AqtlnspzpfdpeT5JQfK2/w2d8oyp5W0FRwOb1dIeX99nORNcxGr08iD9bH8N5XFz3I2iy8w=="],
+
+    "@executor-js/web/oxlint/@oxlint/binding-linux-arm64-musl": ["@oxlint/binding-linux-arm64-musl@1.71.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-fJZrs5sDZtTaPIOiemRQQmo82Ezy+vOGXemPc4Ok7iVVsYsFa7SlW6Z5XN819VfsqBHRm3NJ3rTdnR8+bJYJdQ=="],
+
+    "@executor-js/web/oxlint/@oxlint/binding-linux-ppc64-gnu": ["@oxlint/binding-linux-ppc64-gnu@1.71.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-cwl7VKGERIy9p+G+AvZdfy/06q0aHXaTt/mMRReC751iuNYJgqKjB7NydXSS30nBT9vtr2tunciOtrR4fD6FUA=="],
+
+    "@executor-js/web/oxlint/@oxlint/binding-linux-riscv64-gnu": ["@oxlint/binding-linux-riscv64-gnu@1.71.0", "", { "os": "linux", "cpu": "none" }, "sha512-eZ8ieVXvzGi8jr7+ybQGPK2STw3mldfxZlgA2738iflfB/rzA69sE6m5rDRpQaxC7dpm745Enlh1Tod0QAk9Gg=="],
+
+    "@executor-js/web/oxlint/@oxlint/binding-linux-riscv64-musl": ["@oxlint/binding-linux-riscv64-musl@1.71.0", "", { "os": "linux", "cpu": "none" }, "sha512-puMDbQYe6+NXwfMusojoA7CXGn2b3utukmd23PQqc1E3XhVCwyZ+FueSMzDYeNgDV2dUfIVXAAKZBcFDeCL6sA=="],
+
+    "@executor-js/web/oxlint/@oxlint/binding-linux-s390x-gnu": ["@oxlint/binding-linux-s390x-gnu@1.71.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-4NJLxBs1ujISCt3L/1FcywLs73PWtJuw+piD6feK2V6h6OS6P7xu9/sWt1DTRLibe6QCzmfZzmM/2HPORoV/Lg=="],
+
+    "@executor-js/web/oxlint/@oxlint/binding-linux-x64-gnu": ["@oxlint/binding-linux-x64-gnu@1.71.0", "", { "os": "linux", "cpu": "x64" }, "sha512-cFDaiR8L3430qp88tfZnvFlt3KotFhR/DlbIL0nHOMMYiG/9Wy4l+6f7t8G8pTa9bd8Lt8+M0y/qjRQ/xcB74g=="],
+
+    "@executor-js/web/oxlint/@oxlint/binding-linux-x64-musl": ["@oxlint/binding-linux-x64-musl@1.71.0", "", { "os": "linux", "cpu": "x64" }, "sha512-orfixdt76KlpNly9z0PkWBBNfwjKz+JFVLP/7wnVchlKNU9Dpt9InU/ZggeSej6fC7qwHmHNOGlhLnQXcYoGuA=="],
+
+    "@executor-js/web/oxlint/@oxlint/binding-openharmony-arm64": ["@oxlint/binding-openharmony-arm64@1.71.0", "", { "os": "none", "cpu": "arm64" }, "sha512-9emQu2lAp6yhPB3XuI+++vR+l/o6JR1X+EpxwcumPdQXBWXEPAsquPGL7l158EqU8SebQMXTUa/S5zN98juyHw=="],
+
+    "@executor-js/web/oxlint/@oxlint/binding-win32-arm64-msvc": ["@oxlint/binding-win32-arm64-msvc@1.71.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-bd5kI8spYwTm3BILDtGhi73zoup5dw8MlPQNT8YB3BD5UIsjNe3K9/4ctrzQMX4SZMoK5HgzVLkLJzacEXB7fA=="],
+
+    "@executor-js/web/oxlint/@oxlint/binding-win32-ia32-msvc": ["@oxlint/binding-win32-ia32-msvc@1.71.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-W4HvOHGzVLHcrmFu+bMrJlho+/yrlX5ZNdJZqGe8MEldkQG+RHYhxxad9P4jvWAYFmIqUA5i9DQ8QsJqSU9GIw=="],
+
+    "@executor-js/web/oxlint/@oxlint/binding-win32-x64-msvc": ["@oxlint/binding-win32-x64-msvc@1.71.0", "", { "os": "win32", "cpu": "x64" }, "sha512-D2kyEIPHk/G/wiZLnwTVC/sVst+T/lKldVOjAFpgTIBUAOlry72e5OiapDbDBF4LfJLkN5ypJb/8Eu6yJzkveQ=="],
+
     "@fastify/otel/@opentelemetry/instrumentation/@opentelemetry/api-logs": ["@opentelemetry/api-logs@0.212.0", "", { "dependencies": { "@opentelemetry/api": "^1.3.0" } }, "sha512-TEEVrLbNROUkYY51sBJGk7lO/OLjuepch8+hmpM6ffMJQ2z/KVCjdHuCFX6fJj8OkJP2zckPjrJzQtXU3IAsFg=="],
 
     "@fastify/otel/@opentelemetry/instrumentation/import-in-the-middle": ["import-in-the-middle@2.0.6", "", { "dependencies": { "acorn": "^8.15.0", "acorn-import-attributes": "^1.9.5", "cjs-module-lexer": "^2.2.0", "module-details-from-path": "^1.0.4" } }, "sha512-3vZV3jX0XRFW3EJDTwzWoZa+RH1b8eTTx6YOCjglrLyPuepwoBti1k3L2dKwdCUrnVEfc5CuRuGstaC/uQJJaw=="],
@@ -6506,9 +6597,9 @@
 
     "@inquirer/core/wrap-ansi/string-width": ["string-width@4.2.3", "", { "dependencies": { "emoji-regex": "^8.0.0", "is-fullwidth-code-point": "^3.0.0", "strip-ansi": "^6.0.1" } }, "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g=="],
 
-    "@isaacs/cliui/string-width/emoji-regex": ["emoji-regex@9.2.2", "", {}, "sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg=="],
+    "@inquirer/core/wrap-ansi/strip-ansi": ["strip-ansi@6.0.1", "", { "dependencies": { "ansi-regex": "^5.0.1" } }, "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A=="],
 
-    "@isaacs/cliui/strip-ansi/ansi-regex": ["ansi-regex@6.2.2", "", {}, "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg=="],
+    "@isaacs/cliui/string-width/emoji-regex": ["emoji-regex@9.2.2", "", {}, "sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg=="],
 
     "@libsql/kysely-libsql/@libsql/client/@libsql/core": ["@libsql/core@0.8.1", "", { "dependencies": { "js-base64": "^3.7.5" } }, "sha512-u6nrj6HZMTPsgJ9EBhLzO2uhqhlHQJQmVHV+0yFLvfGf3oSP8w7TjZCNUgu1G8jHISx6KFi7bmcrdXW9lRt++A=="],
 
@@ -6520,8 +6611,6 @@
 
     "@malept/flatpak-bundler/fs-extra/jsonfile": ["jsonfile@6.2.1", "", { "dependencies": { "universalify": "^2.0.0" }, "optionalDependencies": { "graceful-fs": "^4.1.6" } }, "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q=="],
 
-    "@malept/flatpak-bundler/fs-extra/universalify": ["universalify@2.0.1", "", {}, "sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw=="],
-
     "@opentelemetry/instrumentation-pg/@types/pg/@types/node": ["@types/node@25.9.2", "", { "dependencies": { "undici-types": ">=7.24.0 <7.24.7" } }, "sha512-G05zqtJhcDLb8uslf5EjCxXg9G1KQxiV8OS0R26IC//Eoyitzqe8z37I7cqvnZlrlSfgocQRfSn/AHBZJJFyGw=="],
 
     "@opentelemetry/sdk-trace-web/@opentelemetry/sdk-trace-base/@opentelemetry/resources": ["@opentelemetry/resources@2.6.1", "", { "dependencies": { "@opentelemetry/core": "2.6.1", "@opentelemetry/semantic-conventions": "^1.29.0" }, "peerDependencies": { "@opentelemetry/api": ">=1.3.0 <1.10.0" } }, "sha512-lID/vxSuKWXM55XhAKNoYXu9Cutoq5hFdkbTdI/zDKQktXzcWBVhNsOkiZFTMU9UtEWuGRNe0HUgmsFldIdxVA=="],
@@ -6530,8 +6619,6 @@
 
     "@opentui/core/string-width/strip-ansi": ["strip-ansi@7.2.0", "", { "dependencies": { "ansi-regex": "^6.2.2" } }, "sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w=="],
 
-    "@opentui/core/strip-ansi/ansi-regex": ["ansi-regex@6.2.2", "", {}, "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg=="],
-
     "@opentui/react/react-reconciler/scheduler": ["scheduler@0.26.0", "", {}, "sha512-NlHwttCI/l5gCPR3D1nNXtWABUmBwvZpEQiD4IXSbIDq8BzLIK/7Ir5gTFSGZDUu37K5cMNp0hFtzO38sC7gWA=="],
 
     "@pierre/diffs/@shikijs/transformers/@shikijs/core": ["@shikijs/core@3.23.0", "", { "dependencies": { "@shikijs/types": "3.23.0", "@shikijs/vscode-textmate": "^10.0.2", "@types/hast": "^3.0.4", "hast-util-to-html": "^9.0.5" } }, "sha512-NSWQz0riNb67xthdm5br6lAkvpDJRTgB36fxlo37ZzM2yq0PQFFzbd8psqC2XMPgCzo1fW6cVi18+ArJ44wqgA=="],
@@ -6564,6 +6651,8 @@
 
     "@react-grab/cli/ora/strip-ansi": ["strip-ansi@7.2.0", "", { "dependencies": { "ansi-regex": "^6.2.2" } }, "sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w=="],
 
+    "@rolldown/binding-wasm32-wasi/@napi-rs/wasm-runtime/@tybys/wasm-util": ["@tybys/wasm-util@0.10.3", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-F3fo1MYrRJYL3zER0OUOmkutjr1Vp23m7OsSgp7nq4SP6OqX6C/56XFIPAl5bt3zaBRjmW7SGz3u/6LwFpYcOg=="],
+
     "@sentry/electron/@sentry/browser/@sentry-internal/browser-utils": ["@sentry-internal/browser-utils@10.50.0", "", { "dependencies": { "@sentry/core": "10.50.0" } }, "sha512-42bxyRTxnCmYlWnvz4CxikuQNanw8UNma2WJrtxJ0f1MAJV2GhQGSHDLnA+lvFlmiz6qct3pfen/NXGyOTegTA=="],
 
     "@sentry/electron/@sentry/browser/@sentry-internal/feedback": ["@sentry-internal/feedback@10.50.0", "", { "dependencies": { "@sentry/core": "10.50.0" } }, "sha512-0k9XZF0wn86f77mIO2U3gNNyDZooy139CnEanRzHinrN106vVzvBZ6TUEQoHtoO1fqQxr+nWWVrqV/PXUqk47w=="],
@@ -6594,8 +6683,14 @@
 
     "@tanstack/router-generator/@tanstack/router-core/seroval-plugins": ["seroval-plugins@1.5.4", "", { "peerDependencies": { "seroval": "^1.0" } }, "sha512-S0xQPhUTefAhNvNWFg0c1J8qJArHt5KdtJ/cFAofo06KD1MVSeFWyl4iiu+ApDIuw0WhjpOfCdgConOfAnLgkw=="],
 
+    "@tanstack/router-generator/@tanstack/router-utils/tinyglobby": ["tinyglobby@0.2.16", "", { "dependencies": { "fdir": "^6.5.0", "picomatch": "^4.0.4" } }, "sha512-pn99VhoACYR8nFHhxqix+uvsbXineAasWm5ojXoN8xEwK5Kd3/TrhNn1wByuD52UxWRLy8pu+kRMniEi6Eq9Zg=="],
+
+    "@tanstack/router-plugin/@tanstack/router-generator/prettier": ["prettier@3.8.3", "", { "bin": { "prettier": "bin/prettier.cjs" } }, "sha512-7igPTM53cGHMW8xWuVTydi2KO233VFiTNyF5hLJqpilHfmn8C8gPf+PS7dUT64YcXFbiMGZxS9pCSxL/Dxm/Jw=="],
+
     "@tanstack/start-plugin-core/@tanstack/router-generator/@tanstack/virtual-file-routes": ["@tanstack/virtual-file-routes@1.161.7", "", { "bin": { "intent": "bin/intent.js" } }, "sha512-olW33+Cn+bsCsZKPwEGhlkqS6w3M2slFv11JIobdnCFKMLG97oAI2kWKdx5/zsywTL8flpnoIgaZZPlQTFYhdQ=="],
 
+    "@tanstack/start-plugin-core/@tanstack/router-generator/prettier": ["prettier@3.8.3", "", { "bin": { "prettier": "bin/prettier.cjs" } }, "sha512-7igPTM53cGHMW8xWuVTydi2KO233VFiTNyF5hLJqpilHfmn8C8gPf+PS7dUT64YcXFbiMGZxS9pCSxL/Dxm/Jw=="],
+
     "@types/better-sqlite3/@types/node/undici-types": ["undici-types@7.19.2", "", {}, "sha512-qYVnV5OEm2AW8cJMCpdV20CDyaN3g0AjDlOGf1OW4iaDEx8MwdtChUp4zu4H0VP3nDRF/8RKWH+IPp9uW0YGZg=="],
 
     "@types/cacheable-request/@types/node/undici-types": ["undici-types@7.19.2", "", {}, "sha512-qYVnV5OEm2AW8cJMCpdV20CDyaN3g0AjDlOGf1OW4iaDEx8MwdtChUp4zu4H0VP3nDRF/8RKWH+IPp9uW0YGZg=="],
@@ -6632,10 +6727,6 @@
 
     "app-builder-lib/@electron/get/semver": ["semver@6.3.1", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA=="],
 
-    "app-builder-lib/fs-extra/jsonfile": ["jsonfile@6.2.1", "", { "dependencies": { "universalify": "^2.0.0" }, "optionalDependencies": { "graceful-fs": "^4.1.6" } }, "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q=="],
-
-    "app-builder-lib/fs-extra/universalify": ["universalify@2.0.1", "", {}, "sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw=="],
-
     "app-builder-lib/which/isexe": ["isexe@3.1.5", "", {}, "sha512-6B3tLtFqtQS4ekarvLVMZ+X+VlvQekbe4taUkf/rhVO3d/h0M2rfARm/pXLcPEsjjMsFgrFgSrhQIxcSVrBz8w=="],
 
     "astro/@clack/prompts/@clack/core": ["@clack/core@1.2.0", "", { "dependencies": { "fast-wrap-ansi": "^0.1.3", "sisteransi": "^1.0.5" } }, "sha512-qfxof/3T3t9DPU/Rj3OmcFyZInceqj/NVtO9rwIuJqCUgh32gwPjpFQQp/ben07qKlhpwq7GzfWpST4qdJ5Drg=="],
@@ -6644,18 +6735,20 @@
 
     "astro/@clack/prompts/fast-wrap-ansi": ["fast-wrap-ansi@0.1.6", "", { "dependencies": { "fast-string-width": "^1.1.0" } }, "sha512-HlUwET7a5gqjURj70D5jl7aC3Zmy4weA1SHUfM0JFI0Ptq987NH2TwbBFLoERhfwk+E+eaq4EK3jXoT+R3yp3w=="],
 
+    "astro/vite/postcss": ["postcss@8.5.10", "", { "dependencies": { "nanoid": "^3.3.11", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" } }, "sha512-pMMHxBOZKFU6HgAZ4eyGnwXF/EvPGGqUr0MnZ5+99485wwW41kW91A4LOGxSHhgugZmSChL5AlElNdwlNgcnLQ=="],
+
     "builder-util/chalk/ansi-styles": ["ansi-styles@4.3.0", "", { "dependencies": { "color-convert": "^2.0.1" } }, "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg=="],
 
     "builder-util/chalk/supports-color": ["supports-color@7.2.0", "", { "dependencies": { "has-flag": "^4.0.0" } }, "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw=="],
 
-    "builder-util/fs-extra/jsonfile": ["jsonfile@6.2.1", "", { "dependencies": { "universalify": "^2.0.0" }, "optionalDependencies": { "graceful-fs": "^4.1.6" } }, "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q=="],
-
-    "builder-util/fs-extra/universalify": ["universalify@2.0.1", "", {}, "sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw=="],
-
     "bun-types/@types/node/undici-types": ["undici-types@7.19.2", "", {}, "sha512-qYVnV5OEm2AW8cJMCpdV20CDyaN3g0AjDlOGf1OW4iaDEx8MwdtChUp4zu4H0VP3nDRF/8RKWH+IPp9uW0YGZg=="],
 
+    "cheerio/parse5/entities": ["entities@6.0.1", "", {}, "sha512-aN97NXWF6AWBTahfVOIrB/NShkzi5H7F9r1s9mD3cDj4Ko5f2qhhVoYMibXF7GlLveb/D2ioWay8lxI97Ven3g=="],
+
     "cliui/string-width/is-fullwidth-code-point": ["is-fullwidth-code-point@3.0.0", "", {}, "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg=="],
 
+    "cliui/strip-ansi/ansi-regex": ["ansi-regex@5.0.1", "", {}, "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ=="],
+
     "cliui/wrap-ansi/ansi-styles": ["ansi-styles@4.3.0", "", { "dependencies": { "color-convert": "^2.0.1" } }, "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg=="],
 
     "concurrently/chalk/ansi-styles": ["ansi-styles@4.3.0", "", { "dependencies": { "color-convert": "^2.0.1" } }, "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg=="],
@@ -6674,10 +6767,6 @@
 
     "dir-compare/p-limit/yocto-queue": ["yocto-queue@0.1.0", "", {}, "sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q=="],
 
-    "dmg-builder/fs-extra/jsonfile": ["jsonfile@6.2.1", "", { "dependencies": { "universalify": "^2.0.0" }, "optionalDependencies": { "graceful-fs": "^4.1.6" } }, "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q=="],
-
-    "dmg-builder/fs-extra/universalify": ["universalify@2.0.1", "", {}, "sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw=="],
-
     "dmg-license/ajv/json-schema-traverse": ["json-schema-traverse@0.4.1", "", {}, "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg=="],
 
     "drizzle-kit/esbuild/@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.25.12", "", { "os": "aix", "cpu": "ppc64" }, "sha512-Hhmwd6CInZ3dwpuGTF8fJG6yoWmsToE+vYgD4nytZVxcu1ulHpUQRAB1UJ8+N1Am3Mz4+xOByoQoSZf4D+CpkA=="],
@@ -6736,22 +6825,10 @@
 
     "electron-builder/chalk/supports-color": ["supports-color@7.2.0", "", { "dependencies": { "has-flag": "^4.0.0" } }, "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw=="],
 
-    "electron-builder/fs-extra/jsonfile": ["jsonfile@6.2.1", "", { "dependencies": { "universalify": "^2.0.0" }, "optionalDependencies": { "graceful-fs": "^4.1.6" } }, "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q=="],
-
-    "electron-builder/fs-extra/universalify": ["universalify@2.0.1", "", {}, "sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw=="],
-
     "electron-publish/chalk/ansi-styles": ["ansi-styles@4.3.0", "", { "dependencies": { "color-convert": "^2.0.1" } }, "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg=="],
 
     "electron-publish/chalk/supports-color": ["supports-color@7.2.0", "", { "dependencies": { "has-flag": "^4.0.0" } }, "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw=="],
 
-    "electron-publish/fs-extra/jsonfile": ["jsonfile@6.2.1", "", { "dependencies": { "universalify": "^2.0.0" }, "optionalDependencies": { "graceful-fs": "^4.1.6" } }, "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q=="],
-
-    "electron-publish/fs-extra/universalify": ["universalify@2.0.1", "", {}, "sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw=="],
-
-    "electron-updater/fs-extra/jsonfile": ["jsonfile@6.2.1", "", { "dependencies": { "universalify": "^2.0.0" }, "optionalDependencies": { "graceful-fs": "^4.1.6" } }, "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q=="],
-
-    "electron-updater/fs-extra/universalify": ["universalify@2.0.1", "", {}, "sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw=="],
-
     "electron-vite/esbuild/@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.25.12", "", { "os": "aix", "cpu": "ppc64" }, "sha512-Hhmwd6CInZ3dwpuGTF8fJG6yoWmsToE+vYgD4nytZVxcu1ulHpUQRAB1UJ8+N1Am3Mz4+xOByoQoSZf4D+CpkA=="],
 
     "electron-vite/esbuild/@esbuild/android-arm": ["@esbuild/android-arm@0.25.12", "", { "os": "android", "cpu": "arm" }, "sha512-VJ+sKvNA/GE7Ccacc9Cha7bpS8nyzVv0jdVgwNDaR4gDMC/2TTRc33Ip8qrNYUcpkOHUT5OZ0bUcNNVZQ9RLlg=="],
@@ -6806,12 +6883,22 @@
 
     "electron-vite/vite/esbuild": ["esbuild@0.27.7", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.27.7", "@esbuild/android-arm": "0.27.7", "@esbuild/android-arm64": "0.27.7", "@esbuild/android-x64": "0.27.7", "@esbuild/darwin-arm64": "0.27.7", "@esbuild/darwin-x64": "0.27.7", "@esbuild/freebsd-arm64": "0.27.7", "@esbuild/freebsd-x64": "0.27.7", "@esbuild/linux-arm": "0.27.7", "@esbuild/linux-arm64": "0.27.7", "@esbuild/linux-ia32": "0.27.7", "@esbuild/linux-loong64": "0.27.7", "@esbuild/linux-mips64el": "0.27.7", "@esbuild/linux-ppc64": "0.27.7", "@esbuild/linux-riscv64": "0.27.7", "@esbuild/linux-s390x": "0.27.7", "@esbuild/linux-x64": "0.27.7", "@esbuild/netbsd-arm64": "0.27.7", "@esbuild/netbsd-x64": "0.27.7", "@esbuild/openbsd-arm64": "0.27.7", "@esbuild/openbsd-x64": "0.27.7", "@esbuild/openharmony-arm64": "0.27.7", "@esbuild/sunos-x64": "0.27.7", "@esbuild/win32-arm64": "0.27.7", "@esbuild/win32-ia32": "0.27.7", "@esbuild/win32-x64": "0.27.7" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-IxpibTjyVnmrIQo5aqNpCgoACA/dTKLTlhMHihVHhdkxKyPO1uBBthumT0rdHmcsk9uMonIWS0m4FljWzILh3w=="],
 
+    "electron-vite/vite/postcss": ["postcss@8.5.10", "", { "dependencies": { "nanoid": "^3.3.11", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" } }, "sha512-pMMHxBOZKFU6HgAZ4eyGnwXF/EvPGGqUr0MnZ5+99485wwW41kW91A4LOGxSHhgugZmSChL5AlElNdwlNgcnLQ=="],
+
+    "electron-vite/vite/tinyglobby": ["tinyglobby@0.2.16", "", { "dependencies": { "fdir": "^6.5.0", "picomatch": "^4.0.4" } }, "sha512-pn99VhoACYR8nFHhxqix+uvsbXineAasWm5ojXoN8xEwK5Kd3/TrhNn1wByuD52UxWRLy8pu+kRMniEi6Eq9Zg=="],
+
+    "electron-winstaller/fs-extra/universalify": ["universalify@0.1.2", "", {}, "sha512-rBJeI5CXAlmy1pV+617WB9J63U6XcazHHF2f2dbJix4XzpUF0RS3Zbj0FGIOCAva5P/d/GBOYaACQ1w+0azUkg=="],
+
     "filelist/minimatch/brace-expansion": ["brace-expansion@2.1.0", "", { "dependencies": { "balanced-match": "^1.0.0" } }, "sha512-TN1kCZAgdgweJhWWpgKYrQaMNHcDULHkWwQIspdtjV4Y5aurRdZpjAqn6yX3FPqTA9ngHCc4hJxMAMgGfve85w=="],
 
     "form-data/mime-types/mime-db": ["mime-db@1.52.0", "", {}, "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg=="],
 
     "glob/minimatch/brace-expansion": ["brace-expansion@2.1.0", "", { "dependencies": { "balanced-match": "^1.0.0" } }, "sha512-TN1kCZAgdgweJhWWpgKYrQaMNHcDULHkWwQIspdtjV4Y5aurRdZpjAqn6yX3FPqTA9ngHCc4hJxMAMgGfve85w=="],
 
+    "hast-util-from-html/parse5/entities": ["entities@6.0.1", "", {}, "sha512-aN97NXWF6AWBTahfVOIrB/NShkzi5H7F9r1s9mD3cDj4Ko5f2qhhVoYMibXF7GlLveb/D2ioWay8lxI97Ven3g=="],
+
+    "hast-util-raw/parse5/entities": ["entities@6.0.1", "", {}, "sha512-aN97NXWF6AWBTahfVOIrB/NShkzi5H7F9r1s9mD3cDj4Ko5f2qhhVoYMibXF7GlLveb/D2ioWay8lxI97Ven3g=="],
+
     "hosted-git-info/lru-cache/yallist": ["yallist@4.0.0", "", {}, "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A=="],
 
     "iconv-corefoundation/cli-truncate/slice-ansi": ["slice-ansi@3.0.0", "", { "dependencies": { "ansi-styles": "^4.0.0", "astral-regex": "^2.0.0", "is-fullwidth-code-point": "^3.0.0" } }, "sha512-pSyv7bSTC7ig9Dcgbw9AuRNUb5k5V6oDudjZoMBSr13qpLBG7tB+zgCkARjq7xIUgdz5P1Qe8u+rSGdouOOIyQ=="],
@@ -6836,6 +6923,10 @@
 
     "ora/cli-cursor/restore-cursor": ["restore-cursor@5.1.0", "", { "dependencies": { "onetime": "^7.0.0", "signal-exit": "^4.1.0" } }, "sha512-oMA2dcrw6u0YfxJQXm342bFKX/E4sG9rbTzO9ptUcR/e8A33cHuvStiYOwH7fszkZlZ1z/ta9AAoPk2F4qIOHA=="],
 
+    "parse5-htmlparser2-tree-adapter/parse5/entities": ["entities@6.0.1", "", {}, "sha512-aN97NXWF6AWBTahfVOIrB/NShkzi5H7F9r1s9mD3cDj4Ko5f2qhhVoYMibXF7GlLveb/D2ioWay8lxI97Ven3g=="],
+
+    "parse5-parser-stream/parse5/entities": ["entities@6.0.1", "", {}, "sha512-aN97NXWF6AWBTahfVOIrB/NShkzi5H7F9r1s9mD3cDj4Ko5f2qhhVoYMibXF7GlLveb/D2ioWay8lxI97Ven3g=="],
+
     "posthog-js/@opentelemetry/exporter-logs-otlp-http/@opentelemetry/core": ["@opentelemetry/core@2.2.0", "", { "dependencies": { "@opentelemetry/semantic-conventions": "^1.29.0" }, "peerDependencies": { "@opentelemetry/api": ">=1.0.0 <1.10.0" } }, "sha512-FuabnnUm8LflnieVxs6eP7Z383hgQU4W1e3KJS6aOG3RxWxcHyBxH8fDMHNgu/gFx/M2jvTOW/4/PHhLz6bjWw=="],
 
     "posthog-js/@opentelemetry/exporter-logs-otlp-http/@opentelemetry/otlp-exporter-base": ["@opentelemetry/otlp-exporter-base@0.208.0", "", { "dependencies": { "@opentelemetry/core": "2.2.0", "@opentelemetry/otlp-transformer": "0.208.0" }, "peerDependencies": { "@opentelemetry/api": "^1.3.0" } }, "sha512-gMd39gIfVb2OgxldxUtOwGJYSH8P1kVFFlJLuut32L6KgUC4gl1dMhn+YC2mGn0bDOiQYSk/uHOdSjuKp58vvA=="],
@@ -6848,8 +6939,6 @@
 
     "protobufjs/@types/node/undici-types": ["undici-types@7.19.2", "", {}, "sha512-qYVnV5OEm2AW8cJMCpdV20CDyaN3g0AjDlOGf1OW4iaDEx8MwdtChUp4zu4H0VP3nDRF/8RKWH+IPp9uW0YGZg=="],
 
-    "read-yaml-file/js-yaml/argparse": ["argparse@1.0.10", "", { "dependencies": { "sprintf-js": "~1.0.2" } }, "sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg=="],
-
     "rimraf/glob/minimatch": ["minimatch@3.1.5", "", { "dependencies": { "brace-expansion": "^1.1.7" } }, "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w=="],
 
     "run-jxa/execa/get-stream": ["get-stream@6.0.1", "", {}, "sha512-ts6Wi+2j3jQjqi70w5AlN8DFnkSwC+MqmxEzdEALB2qXZYV3X/b1CTfgPLGJNMeAWxdPfU8FO1ms3NUfaHCPYg=="],
@@ -6860,17 +6949,13 @@
 
     "run-jxa/execa/npm-run-path": ["npm-run-path@4.0.1", "", { "dependencies": { "path-key": "^3.0.0" } }, "sha512-S48WzZW777zhNIrn7gxOlISNAqi9ZC/uQFnRdbeIHhZhCA6UqpkOT8T1G7BvfdgP4Er8gF4sUbaS0i7QvIfCWw=="],
 
-    "run-jxa/execa/signal-exit": ["signal-exit@3.0.7", "", {}, "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ=="],
-
     "run-jxa/execa/strip-final-newline": ["strip-final-newline@2.0.0", "", {}, "sha512-BrpvfNAE3dcvq7ll3xVumzjKjZQ5tI1sEUIKr3Uoks0XUl45St3FlatVqef9prk4jRDzhW6WZg+3bk93y6pLjA=="],
 
     "shiki-stream/@shikijs/core/@shikijs/types": ["@shikijs/types@3.23.0", "", { "dependencies": { "@shikijs/vscode-textmate": "^10.0.2", "@types/hast": "^3.0.4" } }, "sha512-3JZ5HXOZfYjsYSk0yPwBrkupyYSLpAE26Qc0HLghhZNGTZg/SKxXIIgoxOpmmeQP0RRSDJTk1/vPfw9tbw+jSQ=="],
 
-    "string-width/strip-ansi/ansi-regex": ["ansi-regex@6.2.2", "", {}, "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg=="],
-
-    "temp-file/fs-extra/jsonfile": ["jsonfile@6.2.1", "", { "dependencies": { "universalify": "^2.0.0" }, "optionalDependencies": { "graceful-fs": "^4.1.6" } }, "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q=="],
+    "string-width-cjs/strip-ansi/ansi-regex": ["ansi-regex@5.0.1", "", {}, "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ=="],
 
-    "temp-file/fs-extra/universalify": ["universalify@2.0.1", "", {}, "sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw=="],
+    "svelte-check/chokidar/readdirp": ["readdirp@4.1.2", "", {}, "sha512-GDhwkLfywWL2s6vEjyhri+eXmfH6j1L7JE27WhqLeYzoh/A3DBaYGEj2H/HFZCn/kMfim73FXxEJTw06WtxQwg=="],
 
     "tsup/chokidar/readdirp": ["readdirp@4.1.2", "", {}, "sha512-GDhwkLfywWL2s6vEjyhri+eXmfH6j1L7JE27WhqLeYzoh/A3DBaYGEj2H/HFZCn/kMfim73FXxEJTw06WtxQwg=="],
 
@@ -6934,12 +7019,18 @@
 
     "wrap-ansi-cjs/string-width/is-fullwidth-code-point": ["is-fullwidth-code-point@3.0.0", "", {}, "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg=="],
 
-    "wrap-ansi/string-width/emoji-regex": ["emoji-regex@10.6.0", "", {}, "sha512-toUI84YS5YmxW219erniWD0CIVOo46xGKColeNQRgOzDorgBi1v4D71/OFzgD9GO2UGKIv1C3Sp8DAn0+j5w7A=="],
+    "wrap-ansi-cjs/strip-ansi/ansi-regex": ["ansi-regex@5.0.1", "", {}, "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ=="],
 
-    "wrap-ansi/strip-ansi/ansi-regex": ["ansi-regex@6.2.2", "", {}, "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg=="],
+    "wrap-ansi/string-width/emoji-regex": ["emoji-regex@10.6.0", "", {}, "sha512-toUI84YS5YmxW219erniWD0CIVOo46xGKColeNQRgOzDorgBi1v4D71/OFzgD9GO2UGKIv1C3Sp8DAn0+j5w7A=="],
 
     "yargs/string-width/is-fullwidth-code-point": ["is-fullwidth-code-point@3.0.0", "", {}, "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg=="],
 
+    "yargs/string-width/strip-ansi": ["strip-ansi@6.0.1", "", { "dependencies": { "ansi-regex": "^5.0.1" } }, "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A=="],
+
+    "@astrojs/cloudflare/vite/postcss/nanoid": ["nanoid@3.3.11", "", { "bin": { "nanoid": "bin/nanoid.cjs" } }, "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w=="],
+
+    "@astrojs/react/vite/postcss/nanoid": ["nanoid@3.3.11", "", { "bin": { "nanoid": "bin/nanoid.cjs" } }, "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w=="],
+
     "@cloudflare/vite-plugin/miniflare/workerd/@cloudflare/workerd-darwin-64": ["@cloudflare/workerd-darwin-64@1.20260415.1", "", { "os": "darwin", "cpu": "x64" }, "sha512-dsxaKsQm3LnPGNPEdsRv09QN3Y4DqCw7kX5j6noKqbAtro2jTr95sVlYM1jUxZ5FkOl1f7SXgaKKB9t5H5Nkbg=="],
 
     "@cloudflare/vite-plugin/miniflare/workerd/@cloudflare/workerd-darwin-arm64": ["@cloudflare/workerd-darwin-arm64@1.20260415.1", "", { "os": "darwin", "cpu": "arm64" }, "sha512-+JgSgVA49KyKteHRA1SnonE4Zn5Ei5zdAp5FQMxFmXI8qulZw4Hl7safXxRyK4i9sTO8gl7TFOKO5Q64VPvSDQ=="],
@@ -7042,7 +7133,7 @@
 
     "@inquirer/core/wrap-ansi/string-width/is-fullwidth-code-point": ["is-fullwidth-code-point@3.0.0", "", {}, "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg=="],
 
-    "@libsql/kysely-libsql/@libsql/client/@libsql/hrana-client/node-fetch": ["node-fetch@3.3.2", "", { "dependencies": { "data-uri-to-buffer": "^4.0.0", "fetch-blob": "^3.1.4", "formdata-polyfill": "^4.0.10" } }, "sha512-dRB78srN/l6gqWulah9SrxeYnxeddIG30+GOqK/9OlLVyLg3HPnr6SqOWTWOXKRwC2eGYCkZ59NNuSgvSrpgOA=="],
+    "@inquirer/core/wrap-ansi/strip-ansi/ansi-regex": ["ansi-regex@5.0.1", "", {}, "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ=="],
 
     "@libsql/kysely-libsql/@libsql/client/libsql/@libsql/darwin-arm64": ["@libsql/darwin-arm64@0.3.19", "", { "os": "darwin", "cpu": "arm64" }, "sha512-rmOqsLcDI65zzxlUOoEiPJLhqmbFsZF6p4UJQ2kMqB+Kc0Rt5/A1OAdOZ/Wo8fQfJWjR1IbkbpEINFioyKf+nQ=="],
 
@@ -7062,8 +7153,6 @@
 
     "@opentelemetry/instrumentation-pg/@types/pg/@types/node/undici-types": ["undici-types@7.24.6", "", {}, "sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg=="],
 
-    "@opentui/core/string-width/strip-ansi/ansi-regex": ["ansi-regex@6.2.2", "", {}, "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg=="],
-
     "@prisma/instrumentation/@opentelemetry/instrumentation/import-in-the-middle/cjs-module-lexer": ["cjs-module-lexer@2.2.0", "", {}, "sha512-4bHTS2YuzUvtoLjdy+98ykbNB5jS0+07EvFNXerqZQJ89F7DI6ET7OQo/HJuW6K0aVsKA9hj9/RVb2kQVOrPDQ=="],
 
     "@react-grab/cli/ora/cli-cursor/restore-cursor": ["restore-cursor@5.1.0", "", { "dependencies": { "onetime": "^7.0.0", "signal-exit": "^4.1.0" } }, "sha512-oMA2dcrw6u0YfxJQXm342bFKX/E4sG9rbTzO9ptUcR/e8A33cHuvStiYOwH7fszkZlZ1z/ta9AAoPk2F4qIOHA=="],
@@ -7072,18 +7161,22 @@
 
     "@react-grab/cli/ora/string-width/emoji-regex": ["emoji-regex@10.6.0", "", {}, "sha512-toUI84YS5YmxW219erniWD0CIVOo46xGKColeNQRgOzDorgBi1v4D71/OFzgD9GO2UGKIv1C3Sp8DAn0+j5w7A=="],
 
-    "@react-grab/cli/ora/strip-ansi/ansi-regex": ["ansi-regex@6.2.2", "", {}, "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg=="],
-
     "agents/yargs/cliui/strip-ansi": ["strip-ansi@7.2.0", "", { "dependencies": { "ansi-regex": "^6.2.2" } }, "sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w=="],
 
     "agents/yargs/string-width/emoji-regex": ["emoji-regex@10.6.0", "", {}, "sha512-toUI84YS5YmxW219erniWD0CIVOo46xGKColeNQRgOzDorgBi1v4D71/OFzgD9GO2UGKIv1C3Sp8DAn0+j5w7A=="],
 
     "agents/yargs/string-width/strip-ansi": ["strip-ansi@7.2.0", "", { "dependencies": { "ansi-regex": "^6.2.2" } }, "sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w=="],
 
+    "app-builder-lib/@electron/get/fs-extra/universalify": ["universalify@0.1.2", "", {}, "sha512-rBJeI5CXAlmy1pV+617WB9J63U6XcazHHF2f2dbJix4XzpUF0RS3Zbj0FGIOCAva5P/d/GBOYaACQ1w+0azUkg=="],
+
     "astro/@clack/prompts/fast-string-width/fast-string-truncated-width": ["fast-string-truncated-width@1.2.1", "", {}, "sha512-Q9acT/+Uu3GwGj+5w/zsGuQjh9O1TyywhIwAxHudtWrgF09nHOPrvTLhQevPbttcxjr/SNN7mJmfOw/B1bXgow=="],
 
+    "astro/vite/postcss/nanoid": ["nanoid@3.3.11", "", { "bin": { "nanoid": "bin/nanoid.cjs" } }, "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w=="],
+
     "dir-compare/minimatch/brace-expansion/balanced-match": ["balanced-match@1.0.2", "", {}, "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="],
 
+    "electron-vite/vite/postcss/nanoid": ["nanoid@3.3.11", "", { "bin": { "nanoid": "bin/nanoid.cjs" } }, "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w=="],
+
     "filelist/minimatch/brace-expansion/balanced-match": ["balanced-match@1.0.2", "", {}, "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="],
 
     "glob/minimatch/brace-expansion/balanced-match": ["balanced-match@1.0.2", "", {}, "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="],
@@ -7094,29 +7187,35 @@
 
     "iconv-corefoundation/cli-truncate/string-width/is-fullwidth-code-point": ["is-fullwidth-code-point@3.0.0", "", {}, "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg=="],
 
+    "iconv-corefoundation/cli-truncate/string-width/strip-ansi": ["strip-ansi@6.0.1", "", { "dependencies": { "ansi-regex": "^5.0.1" } }, "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A=="],
+
     "ink-confirm-input/ink-text-input/chalk/ansi-styles": ["ansi-styles@4.3.0", "", { "dependencies": { "color-convert": "^2.0.1" } }, "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg=="],
 
     "ink-confirm-input/ink-text-input/chalk/supports-color": ["supports-color@7.2.0", "", { "dependencies": { "has-flag": "^4.0.0" } }, "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw=="],
 
     "ora/cli-cursor/restore-cursor/onetime": ["onetime@7.0.0", "", { "dependencies": { "mimic-function": "^5.0.0" } }, "sha512-VXJjc87FScF88uafS3JllDgvAm+c/Slfz06lorj2uAY34rlUu0Nt+v8wreiImcrgAjjIHp1rXpTDlLOGw29WwQ=="],
 
+    "ora/cli-cursor/restore-cursor/signal-exit": ["signal-exit@4.1.0", "", {}, "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw=="],
+
     "posthog-js/@opentelemetry/exporter-logs-otlp-http/@opentelemetry/otlp-transformer/@opentelemetry/resources": ["@opentelemetry/resources@2.2.0", "", { "dependencies": { "@opentelemetry/core": "2.2.0", "@opentelemetry/semantic-conventions": "^1.29.0" }, "peerDependencies": { "@opentelemetry/api": ">=1.3.0 <1.10.0" } }, "sha512-1pNQf/JazQTMA0BiO5NINUzH0cbLbbl7mntLa4aJNmCCXSj0q03T5ZXXL0zw4G55TjdL9Tz32cznGClf+8zr5A=="],
 
     "posthog-js/@opentelemetry/exporter-logs-otlp-http/@opentelemetry/otlp-transformer/@opentelemetry/sdk-metrics": ["@opentelemetry/sdk-metrics@2.2.0", "", { "dependencies": { "@opentelemetry/core": "2.2.0", "@opentelemetry/resources": "2.2.0" }, "peerDependencies": { "@opentelemetry/api": ">=1.9.0 <1.10.0" } }, "sha512-G5KYP6+VJMZzpGipQw7Giif48h6SGQ2PFKEYCybeXJsOCB4fp8azqMAAzE5lnnHK3ZVwYQrgmFbsUJO/zOnwGw=="],
 
     "posthog-js/@opentelemetry/exporter-logs-otlp-http/@opentelemetry/otlp-transformer/@opentelemetry/sdk-trace-base": ["@opentelemetry/sdk-trace-base@2.2.0", "", { "dependencies": { "@opentelemetry/core": "2.2.0", "@opentelemetry/resources": "2.2.0", "@opentelemetry/semantic-conventions": "^1.29.0" }, "peerDependencies": { "@opentelemetry/api": ">=1.3.0 <1.10.0" } }, "sha512-xWQgL0Bmctsalg6PaXExmzdedSp3gyKV8mQBwK/j9VGdCDu2fmXIb2gAehBKbkXCpJ4HPkgv3QfoJWRT4dHWbw=="],
 
-    "read-yaml-file/js-yaml/argparse/sprintf-js": ["sprintf-js@1.0.3", "", {}, "sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g=="],
-
     "rimraf/glob/minimatch/brace-expansion": ["brace-expansion@1.1.14", "", { "dependencies": { "balanced-match": "^1.0.0", "concat-map": "0.0.1" } }, "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g=="],
 
+    "yargs/string-width/strip-ansi/ansi-regex": ["ansi-regex@5.0.1", "", {}, "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ=="],
+
+    "@executor-js/mcporter/rolldown/@rolldown/binding-wasm32-wasi/@emnapi/core/@emnapi/wasi-threads": ["@emnapi/wasi-threads@1.2.1", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-uTII7OYF+/Mes/MrcIOYp5yOtSMLBWSIoLPpcgwipoiKbli6k322tcoFsxoIIxPDqW01SQGAgko4EzZi2BNv2w=="],
+
     "@executor-js/motel/@opentelemetry/exporter-trace-otlp-http/@opentelemetry/otlp-transformer/protobufjs/@types/node": ["@types/node@25.9.2", "", { "dependencies": { "undici-types": ">=7.24.0 <7.24.7" } }, "sha512-G05zqtJhcDLb8uslf5EjCxXg9G1KQxiV8OS0R26IC//Eoyitzqe8z37I7cqvnZlrlSfgocQRfSn/AHBZJJFyGw=="],
 
     "@react-grab/cli/ora/cli-cursor/restore-cursor/onetime": ["onetime@7.0.0", "", { "dependencies": { "mimic-function": "^5.0.0" } }, "sha512-VXJjc87FScF88uafS3JllDgvAm+c/Slfz06lorj2uAY34rlUu0Nt+v8wreiImcrgAjjIHp1rXpTDlLOGw29WwQ=="],
 
-    "agents/yargs/cliui/strip-ansi/ansi-regex": ["ansi-regex@6.2.2", "", {}, "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg=="],
+    "@react-grab/cli/ora/cli-cursor/restore-cursor/signal-exit": ["signal-exit@4.1.0", "", {}, "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw=="],
 
-    "agents/yargs/string-width/strip-ansi/ansi-regex": ["ansi-regex@6.2.2", "", {}, "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg=="],
+    "iconv-corefoundation/cli-truncate/string-width/strip-ansi/ansi-regex": ["ansi-regex@5.0.1", "", {}, "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ=="],
 
     "rimraf/glob/minimatch/brace-expansion/balanced-match": ["balanced-match@1.0.2", "", {}, "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="],
 
diff --git a/compose.yaml b/compose.yaml
new file mode 100644
index 000000000..218d01df9
--- /dev/null
+++ b/compose.yaml
@@ -0,0 +1,65 @@
+name: executor
+
+services:
+  executor:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    image: "${EXECUTOR_IMAGE:-executor:local}"
+    command:
+      - server
+      - --bind
+      - 0.0.0.0:4788
+      - --allow-unsafe-http-non-loopback
+    restart: unless-stopped
+    init: true
+    read_only: true
+    mem_limit: "${EXECUTOR_MEMORY_LIMIT:-2g}"
+    pids_limit: "${EXECUTOR_PIDS_LIMIT:-512}"
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+    ports:
+      - "127.0.0.1:4788:4788"
+    environment:
+      EXECUTOR_DATA_DIR: /var/lib/executor
+      # When changing the published port, also set EXECUTOR_PUBLIC_ORIGIN to
+      # the exact URL used in the browser. Keep plain HTTP on host loopback.
+      EXECUTOR_PUBLIC_ORIGIN: "${EXECUTOR_PUBLIC_ORIGIN:-http://127.0.0.1:4788}"
+      EXECUTOR_MCP_STDIO_TEMPLATES_FILE: /etc/executor/mcp-stdio.json
+      # Null means pass through only when the host variable is set.
+      EXECUTOR_TRUSTED_PROXIES:
+      RUST_LOG: "${RUST_LOG:-executor=info}"
+    volumes:
+      - executor-data:/var/lib/executor
+      - ./docker/mcp-stdio-templates.example.json:/etc/executor/mcp-stdio.json:ro
+      # By default, Executor creates master.key with mode 0600 in the data
+      # volume. To supply an external exact 32-byte key instead, make it
+      # readable by container UID 10001, mount it read-only, and add
+      # EXECUTOR_MASTER_KEY_FILE=/run/secrets/executor-master.key above.
+      # - ./secrets/executor-master.key:/run/secrets/executor-master.key:ro
+      # Mount only fully trusted, self-contained Linux stdio MCP executables.
+      # They run as Executor's UID and can read the data volume and master key.
+      # Use the absolute container paths from mcp-stdio.json. The base image
+      # does not include Node or Bun. Writeable state must remain under a
+      # mounted volume or /tmp.
+      # - /absolute/host/mcp:/opt/executor/mcp:ro
+    tmpfs:
+      - /tmp:rw,noexec,nosuid,nodev,size=64m
+    healthcheck:
+      test:
+        - CMD
+        - curl
+        - --fail
+        - --silent
+        - --show-error
+        - http://127.0.0.1:4788/healthz
+      interval: 30s
+      timeout: 5s
+      start_period: 10s
+      retries: 3
+    stop_grace_period: 2m
+
+volumes:
+  executor-data:
diff --git a/docker/mcp-stdio-templates.example.json b/docker/mcp-stdio-templates.example.json
new file mode 100644
index 000000000..da024f706
--- /dev/null
+++ b/docker/mcp-stdio-templates.example.json
@@ -0,0 +1,3 @@
+{
+  "templates": []
+}
diff --git a/docker/mcp-stdio-templates.full.example.json b/docker/mcp-stdio-templates.full.example.json
new file mode 100644
index 000000000..0e1afe76f
--- /dev/null
+++ b/docker/mcp-stdio-templates.full.example.json
@@ -0,0 +1,14 @@
+{
+  "templates": [
+    {
+      "name": "filesystem",
+      "executable": "/opt/executor/mcp/filesystem-server",
+      "cwd": "/var/lib/executor",
+      "arguments": ["--stdio"],
+      "environment": {
+        "LOG_LEVEL": "warn"
+      },
+      "secretEnvironment": ["API_TOKEN"]
+    }
+  ]
+}
diff --git a/docs/architecture.md b/docs/architecture.md
new file mode 100644
index 000000000..619ec72bb
--- /dev/null
+++ b/docs/architecture.md
@@ -0,0 +1,384 @@
+# Executor rewrite architecture
+
+## Product boundary
+
+The rewrite targets a single-user, local and self-hosted Executor. Linux and
+macOS native binaries plus Docker are first-class release targets. The current
+cloud and desktop products remain legacy surfaces and do not constrain the new
+architecture.
+
+The production artifact is one Rust binary. It owns the control API, gateway
+API, embedded SQLite state, upstream connections, sandboxed TypeScript runtime,
+approval coordination, and static Svelte application. The production runtime
+does not require Node.js. Packaging builds the `web/` application first and
+embeds its static output at the `src/web_assets.rs` boundary. Cargo checks and
+tests do not depend on generated web assets.
+
+Version one supports these upstream source types:
+
+- MCP servers over local stdio and remote Streamable HTTP
+- OpenAPI-described HTTP APIs
+- GraphQL endpoints
+
+It supports API key, bearer token, basic authentication, and OAuth credential
+flows. Each source has one active credential profile. Integrations and existing
+data migration are intentionally out of scope.
+
+## Control and gateway planes
+
+The two authentication planes are deliberately disjoint:
+
+- Control APIs accept only an administrator session cookie. Unsafe requests
+  also require an origin match and CSRF token.
+- Gateway APIs accept only dashboard-generated API tokens.
+
+API tokens initially share one global enabled-tool set. Interactive approval
+rules are evaluated separately and remain available for sensitive calls. An API
+token can never authorize an administrator route.
+
+First boot prints a one-time, high-entropy setup token in a fragment URL. Only a
+keyed digest is stored. The atomic setup claim creates exactly one administrator
+whose password is hashed with Argon2id. Administrator sessions and API tokens
+are opaque, high-entropy values stored only as keyed digests. API token secrets
+are shown once.
+
+Reverse-proxy client addresses are disabled by default. `--trusted-proxy <CIDR>`
+may be repeated, or `EXECUTOR_TRUSTED_PROXIES` may contain a comma-separated
+list. Executor honors `X-Forwarded-For` only when the direct peer is trusted,
+then walks the chain from right to left through configured trusted proxies.
+Malformed, missing, or all-trusted chains are rejected before password work so
+they cannot create a proxy-wide login-rate-limit bucket. Every intermediary
+proxy must be listed and must append or replace `X-Forwarded-For` correctly.
+
+## Storage and key management
+
+SQLite is opened with foreign keys, WAL mode, a five-second busy timeout, and
+`synchronous=FULL`. FULL is the initial durability choice because this local
+control plane stores credential and approval state, while the expected write
+volume is modest. This can be revisited with benchmarks. Network work must
+never occur inside a database transaction.
+
+Migrations are append-only SQL files embedded into the binary. The instance
+master key comes from `EXECUTOR_MASTER_KEY_FILE`, or is atomically created as a
+0600 file inside a 0700 data directory. An initialized database without its key
+fails closed. A boot sentinel detects a wrong key or modified ciphertext.
+Protected values use XChaCha20-Poly1305. HKDF derives purpose-specific subkeys,
+and associated data binds ciphertext to its purpose and record identity.
+
+## Delivery slices
+
+1. Foundation: one Cargo package and binary, SQLite migrations, master-key
+   lifecycle, setup, administrator sessions, CSRF and origin checks, API token
+   management, a gateway authentication proof, and the Svelte SPA shell.
+2. Sources: MCP stdio and Streamable HTTP, OpenAPI, GraphQL, credential profiles,
+   OAuth callbacks, connectivity testing, and source lifecycle UI.
+3. Tool catalog: normalized discovery, search and describe, global enable state,
+   bulk and filtered enable workflows, and request-aware tool testing.
+4. Runtime and approvals: sandboxed TypeScript execution, concurrent tool calls,
+   interactive approvals, resume semantics, and CLI parity.
+5. Operations: request logs, redaction, retention, embedded web assets, Docker,
+   Linux and macOS packaging, upgrade safety, e2e recordings, and archival of
+   the old TypeScript products under `legacy/` after parity was proven.
+
+The prior TypeScript application entry points now live under `legacy/` as
+manual compatibility surfaces. Shared protocol, runtime, SDK, host, app, and
+React packages remain under `packages/` where the native product and package
+compatibility workflows can retain them independently.
+
+## Source and tool catalog contract
+
+The catalog is global to the single-user instance. Every API token sees the
+same source and tool set. A source has one immutable ID, one collision-safe
+slug, one non-secret configuration object, and at most one encrypted credential
+payload. Source kinds are limited to `openapi`, `graphql`, `mcp_http`, and
+`mcp_stdio`. Credential payloads carry a schema version and are encrypted with
+record-bound associated data, so ciphertext copied between sources cannot be
+decrypted.
+
+Tools retain an immutable ID and upstream stable key separately from their
+display name and callable name. The full callable path is
+`tools.<source_slug>.<local_tool_name>`. Sandboxed TypeScript omits the leading
+`tools.` because that is the proxy root. Local names are normalized and
+collision suffixes are allocated in stable-key order. Existing and tombstoned
+names stay reserved, which keeps paths stable when upstream discovery reorders,
+removes, or restores a tool. The source roots `tools`, `search`, `describe`,
+`sources`, and `executor` are reserved for the sandbox and built-in catalog helpers.
+
+A source may expose at most 100,000 active tools and retain at most 25,000
+tombstoned tool identities, for a hard 125,000-row history ceiling. Refreshes
+that would exceed either ceiling fail atomically with `catalog_too_large`.
+Executor never silently deletes tombstones because they carry stable IDs,
+callable names, and administrator overrides. Intentionally discarding that
+history requires deleting and recreating the source. Administrator tool lists
+apply filters, counts, ordering, and pagination in SQLite so reads remain
+memory-bounded at the history ceiling.
+
+Gateway search uses bounded word, trigram, and encoded short-gram indexes. SQL
+first excludes tombstones and effectively disabled tools, then caps the
+deduplicated candidate set at 4,096 before the reference lexical scorer runs.
+This preserves token-prefix, substring, and reverse-prefix recall without
+hydrating the complete historical table.
+
+Each tool has an intrinsic mode. A source and a tool may each add an override.
+The effective mode is always derived in this order:
+
+1. Tool override
+2. Source override
+3. Tool intrinsic mode
+
+The visible modes are `enabled`, `ask`, and `disabled`. Disabled tools remain
+visible in the administrator catalog, but gateway search and describe omit
+them. A direct invocation lookup returns `tool_disabled`, which prevents a
+caller with an old path from bypassing the catalog. Ask tools remain
+discoverable and carry approval-required metadata.
+
+Protocol discovery and schema normalization happen before a catalog write.
+Initial creation uses a create-only staged snapshot with no meaningless CAS
+fields. Refresh snapshots record the source and credential revisions they used.
+The commit rechecks both revisions, serializes catalog writers, replaces source
+artifacts, upserts tools by `(source_id, stable_key)`, tombstones missing tools,
+and advances the source and global catalog revisions in one transaction. Create
+and refresh share the same transaction-scoped artifact, tool, binding, and
+search-index application helpers. A failed stage or stale revision leaves the
+last known good catalog untouched. Network work never occurs inside this
+transaction.
+
+Tool bindings use a closed Rust enum and a generic persisted wire vocabulary:
+protocol, positive binding version, and private JSON definition. SQLite reserves
+the supported source protocol names, while Rust rejects protocol/version pairs
+that have no implemented typed variant. Generic source creation and gateway
+invocation routes own authentication, limits, logging, and typed dispatch;
+OpenAPI owns only its preview, compiler, credential adapter, and invocation
+adapter.
+
+Invocation admission first reads tool presence, effective mode, the input
+schema, typed-binding identity, and credential revision in one coherent SQLite
+snapshot without decrypting credentials. Arguments are validated before policy
+handling. Enabled calls reacquire a full catalog read lease, decrypt credentials
+only in the parent process, and retain the lease through outbound completion.
+Ask calls persist an encrypted approval and release the preflight lease without
+building an outbound request. Approval execution reacquires a fresh lease and
+revalidates every source, tool, binding, catalog, and credential revision.
+
+Administrator catalog reads require a session cookie. Catalog mutations also
+require the matching Origin, CSRF cookie, and CSRF header. Gateway discovery,
+description, and invocation lookup accept API tokens only. The initial routes
+are:
+
+- `GET /api/v1/sources` and `GET /api/v1/sources/{id}`
+- `DELETE /api/v1/sources/{id}`
+- `PATCH /api/v1/sources/{id}/mode`
+- `GET /api/v1/tools` and `GET /api/v1/tools/{id}`
+- `PATCH /api/v1/tools/{id}/mode` and `PATCH /api/v1/tools/modes`
+- `GET /api/v1/request-logs` and `GET /api/v1/request-logs/{id}`
+- `POST /api/v1/gateway/tools/search`
+- `POST /api/v1/gateway/tools/describe`
+- `POST /api/v1/gateway/tools/lookup`
+- `POST /api/v1/sources/openapi/preview`
+- `POST /api/v1/sources` and `POST /api/v1/sources/{id}/refresh`
+- `GET`, `PUT`, and `DELETE /api/v1/sources/{id}/credentials`
+- `POST /api/v1/gateway/tools/invoke`
+
+Request logs store metadata only: request ID, nullable actor token ID, surface,
+nullable source and tool IDs, an immutable callable-path snapshot, outcome,
+stable error code, duration, nullable approval ID, and timestamp. They never
+store request headers, credentials, arguments, or results. Source and tool
+deletion clears their foreign keys while retaining the history and path
+snapshot.
+
+## OpenAPI import and invocation
+
+OpenAPI 3.0 and 3.1 documents can be previewed from pasted JSON or YAML and
+from an HTTP URL. Swagger 2 documents and external references fail closed.
+Local references have cycle and depth limits. Tool identities are derived from
+the HTTP method and exact path, so operation ID and display-name changes do not
+change tool IDs, callable names, or administrator mode overrides on refresh.
+
+The persisted tool binding contains only typed protocol metadata. Static API keys,
+bearer tokens, basic credentials, manually supplied OAuth access tokens, and
+query-bearing source URLs live only in the source-bound encrypted credential
+envelope. The source configuration and admin response expose a query-stripped
+display URL. Refresh
+performs network and compilation work before the catalog transaction, then
+commits artifacts, tools, tombstones, bindings, and health together under
+source and credential revision checks. A failed refresh leaves the last good
+callable catalog in place.
+
+Outbound requests resolve and validate every DNS answer, pin the validated
+addresses into a proxy-free client, and reject mixed safe and unsafe answers.
+Private and loopback targets require a per-source administrator opt-in.
+Link-local, metadata, reserved, documentation, and multicast targets remain
+blocked even with that opt-in. Spec redirects are manual, bounded, revalidated
+at every hop, and cannot downgrade HTTPS. Tool invocation never follows
+redirects. Request and response headers, bodies, time, DNS answers, redirects,
+and document sizes have hard limits.
+
+The first invocation surface deliberately supports this exact serialization
+subset:
+
+- Path and header parameters use `simple` style.
+- Query parameters use `form`, `spaceDelimited`, `pipeDelimited`, or
+  `deepObject`; `allowReserved` is not accepted.
+- Cookie parameters use `form`, including scalar, array, and object explode
+  behavior.
+- Request bodies support JSON and `+json`, string-valued `text/plain`, and
+  closed scalar-object `application/x-www-form-urlencoded` schemas.
+- Parameter `content`, multipart bodies, arbitrary media types, and other
+  styles fail during import instead of producing tools that cannot execute.
+
+Enabled tools execute immediately, disabled or removed tools cannot reach the
+transport, and Ask tools return HTTP 202 with an opaque approval ID, expiry,
+and owner-only status URL. Request logs remain metadata-only and never contain
+arguments, credentials, upstream bodies, or results.
+
+## Persistent approvals and tool invocation
+
+`ToolCallService` is the protocol-neutral parent-side invocation boundary used
+by the HTTP gateway and designed for the TypeScript runtime, CLI, and MCP host.
+A tool call carries its request, actor token, surface, execution, call, path,
+and argument snapshots. The sandbox can request a path and arguments, but it
+cannot select credentials, bindings, policy, actor identity, or approval state.
+
+Ask arguments, input schemas, internal invocation snapshots, and terminal
+results are encrypted with approval-ID-bound associated data. SQLite stores
+only metadata snapshots and revision columns in plaintext. Arguments and
+results never enter audit metadata or request logs. Administrator detail
+responses decrypt only a conservative schema-shaped redaction. Only the active
+API token that created an approval can poll or cancel it and retrieve its
+terminal result.
+
+The fixed approval TTL is ten minutes. The persisted state machine is:
+
+```text
+pending -> approved -> executing -> succeeded | failed | interrupted
+        -> denied | expired | canceled
+approved -> stale | canceled
+```
+
+Administrator decisions use cookie authentication plus Origin and CSRF checks.
+The decision is a SQLite compare-and-swap and its metadata-only audit event is
+committed in the same transaction. Repeating the same decision is idempotent;
+a conflicting decision or revision loses with a stable conflict. The gateway
+owner may cancel only pending or approved work. Executing work is never labeled
+canceled because bytes may already have reached the upstream service.
+Runtime cancellation and approval claims share an execution gate. If
+cancellation marks the continuation lost first, no later approval can claim
+network work. If the claim commits first, the server owns that already-executing
+side effect through truthful terminal completion.
+
+Every terminal transition also inserts a bounded, metadata-only request-log
+event into a transactional outbox. A single background drainer sends those
+events through the shared bounded log sink and acknowledges an outbox row only
+after SQLite confirms the request-log write. Stable event IDs make a crash
+between persistence and acknowledgement idempotent. Delivery retries never
+delay an approval decision or approved tool execution.
+
+Approval acceptance starts a detached server-owned task. That task reacquires
+the exact invocation revision, atomically verifies the original API token is
+still active, commits `executing`, then performs network work while holding the
+fresh catalog lease. No database transaction spans network activity. A source,
+tool, mode, binding, credential, or relevant catalog change makes the approval
+stale without dispatch. API token revocation and cancellation of its pending or
+approved work happen in one immediate transaction.
+
+On startup, only generation-zero direct pending approvals remain decidable and
+generation-zero approved calls are safely queued. Sandbox pending or approved
+approvals tied to a lost worker generation become canceled or stale. Any row
+left executing is marked interrupted and is never retried, because its external
+side effect may have completed before the process stopped.
+A persisted nondecreasing clock high-water mark prevents a backward wall-clock
+adjustment from reviving expired work. Active counts, aggregate ciphertext,
+individual payloads, and terminal history all have hard bounds. Terminal
+retention uses insertion order rather than wall-clock order.
+
+Caller correlation is scoped by typed actor, execution ID, and call ID. A
+nonterminal approval retains that correlation without expiry. On a terminal
+transition, its correlation receives a fixed 24-hour expiry. Identical retries
+during that window recover the original approval or its retained tombstone;
+identity mismatches fail with a conflict. After the full 24 hours, and only
+after any linked gateway idempotency response also expires, the same IDs may
+represent a new call. Cleanup runs before the bounded correlation-cap check and
+never removes active or unexpired entries.
+
+Approval APIs are:
+
+- `GET /api/v1/approvals` and `GET /api/v1/approvals/{id}`
+- `POST /api/v1/approvals/{id}/decision`
+- `GET` and `DELETE /api/v1/gateway/approvals/{id}`
+
+OAuth2 and OpenID Connect operations may still use a manually supplied access
+token in the encrypted credential envelope, labeled
+`manual_oauth_access_token` in metadata. Managed OAuth is available for
+OpenAPI authorization-code security schemes, GraphQL's `default` credential,
+and HTTP MCP's `default` credential. It uses provider-neutral discovery, PKCE,
+administrator-session-bound callback transactions, encrypted token storage,
+refresh-token rotation, and just-in-time access tokens. Managed token values
+are not copied into source credentials, approvals, or request logs. Static
+credentials take precedence when both forms are configured.
+
+## MCP transport boundary
+
+Executor exposes one stateful Streamable HTTP MCP endpoint at `/mcp`. It
+requires dashboard API-token bearer authentication and protocol version
+`2025-11-25`. A session belongs to its creating token and is removed when that
+token is revoked. Explicit deletion, token revocation, and lazy idle-session
+expiry terminate the session, cancel its scoped waits, and prevent a pending
+Ask released by that termination from executing later. The MCP surface
+intentionally exposes five stable virtual tools, `execute`, `call`, `search`,
+`describe`, and `sources`, instead of mirroring an unbounded upstream catalog
+into `tools/list`. For virtual-tool invocations, JSON-RPC request IDs provide
+the idempotency and cancellation correlation. Downstream GET streaming is
+intentionally unavailable and returns 405 after session validation. Body
+admission and detached execution each have independent instance-wide and
+per-token concurrency caps, leaving cancellation handling separate from tool
+execution admission. Pending Ask calls follow the durable ten-minute approval
+TTL with expiry settlement checked at intervals of at most 30 seconds. They do
+not use an independent MCP transport wait timeout.
+
+The Rust package pins `rmcp` exactly at `1.8.0` for MCP model types. Executor
+owns the HTTP and stdio transport implementations so protocol handling remains
+inside the hardened outbound, process, authentication, and lifecycle
+boundaries.
+
+Upstream MCP sources use the same catalog and invocation boundary as OpenAPI.
+Streamable HTTP endpoints use the hardened outbound client, while stdio sources
+can select only administrator-approved templates loaded at server startup.
+Executables, arguments, working directories, and static environment values are
+not accepted from source API requests. Only declared secret environment fields
+can be supplied through the encrypted source credential envelope.
+
+Successful creation with complete credentials and successful refresh complete
+initialization and bounded paginated discovery before an atomic catalog commit.
+Required-secret stdio creation may instead commit the documented deferred empty
+source without starting the child. Upstreams that advertise
+`tools.listChanged` receive one coalescing watcher per source. Watchers are
+restored on startup, replaced after relevant changes, stopped before deletion,
+and drained during shutdown. Candidate HTTP and stdio credentials are used for
+discovery before one transaction replaces the encrypted credential and catalog.
+An HTTP notification-stream GET that returns 405 is treated as permanently
+unsupported only after the current revision-fenced reconciliation commits. The
+watcher then exits without reconnecting, so later catalog changes require a
+manual refresh.
+
+Clearing HTTP authentication tries anonymous discovery; clearing required stdio
+secrets instead retains the last catalog and marks health unknown. A zero-secret
+stdio template treats its empty overlay as a complete credential and refreshes
+normally.
+
+Imported MCP tools are intrinsically `enabled` only when the upstream explicitly
+marks them read-only without marking them destructive. Other MCP tools are
+intrinsically `ask`. Administrator source and tool overrides still use the global
+catalog precedence rules. Invocation creates a fresh upstream connection,
+performs one tool call, and closes it. Outcome-unknown tool calls are never
+automatically replayed. Long-lived HTTP notification streams have a five-minute
+idle-read timeout plus per-event and parser-state bounds, not a fixed lifetime.
+The complete configuration, API payloads, lifecycle, and limit contract is
+documented in [MCP support](mcp.md).
+
+Audit history is bounded to the most recently inserted 10,000 events for a
+single-user instance. Each event's serialized metadata is capped at 64 KiB.
+Insertion and oldest-insertion compaction happen in the same catalog
+transaction, so a committed mutation retains its actor, correlation ID, target
+snapshots, and metadata while never leaving an over-cap audit table. Retention
+uses SQLite insertion order rather than wall-clock timestamps, so clock
+corrections cannot discard the audit for a newly committed mutation.
diff --git a/docs/cli.md b/docs/cli.md
new file mode 100644
index 000000000..84ad361a7
--- /dev/null
+++ b/docs/cli.md
@@ -0,0 +1,135 @@
+# Rust CLI
+
+The `executor` binary is both the self-hosted server and its local client. Client
+commands connect to a running server. They do not open the SQLite database or
+start another server. The server never auto-starts for a client command.
+
+## Connection
+
+The default server is `http://127.0.0.1:4788`. Override it with
+`--base-url` or `EXECUTOR_BASE_URL`. Sign in as the administrator, create an
+API token under **API tokens**, and provide it through `EXECUTOR_API_TOKEN`:
+
+```sh
+export EXECUTOR_API_TOKEN='copy-the-token-from-the-dashboard'
+executor tools search calendar
+```
+
+You can also use `--api-token`, but the environment variable avoids placing a
+secret in shell history or process arguments. Tokens are sent only in the
+Authorization header. Executor never puts them in URLs.
+
+Plain HTTP is accepted only for localhost and literal loopback addresses. Use
+HTTPS for another host. `--allow-insecure-http` is an explicit escape hatch for
+an authenticated and encrypted tunnel or equivalent transport that protects
+the complete path. It sends the reusable bearer token over clear HTTP, so a
+private LAN by itself is not sufficient protection.
+
+Use `--json` for machine-readable output. Errors and approval instructions go
+to stderr, leaving stdout available for JSON and MCP protocol messages.
+
+Connection, authentication, validation, and protocol failures exit nonzero. An
+upstream tool failure is a completed call: `--json` prints its result envelope
+and the process exits successfully. Automation must inspect the envelope's
+`ok` and `error` fields instead of treating exit status alone as tool success.
+
+## Service lifecycle
+
+The release binary embeds the supported systemd and launchd assets. No source
+checkout is needed:
+
+```sh
+executor service install [--no-start]
+executor service status
+executor service start
+executor service stop
+executor service restart
+executor service remove
+```
+
+On Linux, `install`, `start`, `stop`, `restart`, and `remove` manage the system
+unit and must run through `sudo`. Status is unprivileged. On macOS these commands
+manage the logged-in user's LaunchAgent and reject `sudo`. Windows service
+management is not supported.
+
+Status output is intentionally stable for scripts. It prints exactly `active`
+and exits 0, or prints exactly `inactive` and exits 3. A command or platform
+failure exits 1. The global connection and `--json` options do not change
+service output.
+
+Install is idempotent and replaces only files tracked by a private ownership
+manifest. On first install it may adopt an identical copy of its currently
+running binary, but rejects other preexisting service files. It preserves
+existing data, configuration, template registry, and a valid master key.
+Remove unloads the service and removes its managed executable, service
+definition, and ownership manifest while preserving persistent state. Every
+non-install mutation verifies the recorded file hashes before touching a loaded
+service. Install verifies an existing manifest, or applies the first-install
+rules described above. Unsafe paths, symbolic links, hard links, permission
+changes, and replaced file contents fail closed. If manifest publication is
+interrupted, a private recovery marker authorizes only a new `service install`;
+other lifecycle mutations remain blocked until that rerun completes.
+
+On macOS, the service owns `$HOME/.executor/service/bin/executor` and its
+control files under `$HOME/.executor/service`. The archive installer separately
+owns `$HOME/.executor/bin`. Reinstalling the LaunchAgent with no configuration
+environment variables preserves the exact stored data directory, template
+file, public origin, and trusted proxy list. Supplying one variable updates
+only that field, and explicitly empty public-origin or trusted-proxy variables
+clear those fields. Service removal preserves this configuration for a later
+reinstall and does not change the archive installation.
+
+## Tools
+
+Search the non-disabled global catalog. Enabled and Ask tools are discoverable;
+Disabled tools are omitted:
+
+```sh
+executor tools search issue
+executor tools search issue --namespace github --limit 25
+executor tools describe github.issues_create
+executor tools sources
+```
+
+Call a tool with a dotted path or two path segments. Arguments must be one JSON
+object. Prefix a filename with `@` to read the object from disk.
+
+```sh
+executor call github.issues_create '{"owner":"acme","repo":"app","title":"Bug"}'
+executor call github issues_create @arguments.json
+```
+
+Paths contain exactly the source slug and local tool name. A leading `tools.`
+is accepted for a dotted path, but deeper legacy resource or method segments
+are not.
+
+Each call gets one idempotency key that remains stable across safe HTTP retries. An
+Ask-mode tool prints and opens the clean dashboard approval URL, then polls as
+the owning API token until the approval completes. Press Ctrl-C to request
+cancellation.
+
+## MCP stdio bridge
+
+Configure a local MCP client to launch:
+
+```sh
+executor mcp
+```
+
+The bridge forwards newline-delimited MCP JSON-RPC over stdio to the running
+authenticated `/mcp` endpoint. It preserves the server session, writes only MCP
+messages to stdout, and closes the session on EOF or Ctrl-C. The server must
+already be running.
+
+## Dashboard
+
+Open the dashboard without putting credentials in the URL. This command does
+not require an API token. The browser still requires the administrator login
+cookie:
+
+```sh
+executor open
+```
+
+This uses `open` on macOS and `xdg-open` on Linux. If no graphical opener is
+available, the CLI prints the clean URL so it can be copied manually.
diff --git a/docs/docker.md b/docs/docker.md
new file mode 100644
index 000000000..680140492
--- /dev/null
+++ b/docs/docker.md
@@ -0,0 +1,139 @@
+# Run Executor with Docker
+
+The root `Dockerfile` builds the Svelte application and embeds it into the Rust
+binary. Its runtime image contains that one binary plus CA certificates and the
+healthcheck client. Project and dependency license notices are installed under
+`/usr/share/licenses/executor`. It supports Linux `amd64` and `arm64` images.
+
+## Start the local instance
+
+Published releases from the current repository use the root Rust image at
+`ghcr.io/davis7dotsh/executor`. A fork's workflow derives the image owner from
+that fork's repository. Stable releases publish `vX.Y.Z`, `X.Y.Z`, and
+`sha-<commit>` plus `latest`; prereleases publish their immutable release,
+version, and commit tags plus `beta`. Pin a version for repeatable deployments:
+
+```sh
+docker pull ghcr.io/davis7dotsh/executor:v0.1.0
+```
+
+The container package must be public in GHCR package settings. The release
+workflow performs an unauthenticated pull by exact digest and refuses to
+publish the GitHub release while anonymous access is unavailable.
+
+The included Compose file builds the same root `Dockerfile` locally:
+
+```sh
+docker compose up --detach --build
+docker compose logs executor
+```
+
+To run the already-built `runtime-prebuilt` image published by the release
+workflow, choose an immutable tag and tell Compose not to build locally:
+
+```sh
+export EXECUTOR_IMAGE=ghcr.io/davis7dotsh/executor:v0.1.0
+docker compose pull executor
+docker compose up --detach --no-build executor
+docker compose ps executor
+curl --fail --silent --show-error http://127.0.0.1:4788/healthz
+docker compose logs executor
+```
+
+Keep `EXECUTOR_IMAGE` set for later `docker compose` commands that operate on
+that deployment. Unset it to return to the default `executor:local` image and
+the local build flow.
+
+Open `http://127.0.0.1:4788`. On first boot, the logs contain the one-time setup
+URL. The compose configuration publishes the port only on host loopback. Keep
+that binding when using plain HTTP.
+
+The named `executor-data` volume contains SQLite state, its WAL files, and the
+generated `master.key`. Back up the whole volume while the service is stopped.
+The database and key are one recovery unit. Losing the key makes encrypted
+credentials and protected state unrecoverable, and inventing a new key beside
+an existing database is intentionally rejected.
+
+```sh
+docker compose stop executor
+# Snapshot the complete executor-data volume with your normal volume backup tool.
+docker compose start executor
+```
+
+If you configure `EXECUTOR_MASTER_KEY_FILE`, the mounted key must contain
+exactly 32 cryptographically random raw bytes from a secure random source or
+secret manager and be readable by UID `10001`. Do not use a password, repeated
+bytes, hand-authored content, hex text, or base64 text. Include that external
+file in the same stopped recovery snapshot as the volume. Executor does not
+create, chmod, rotate, or recover an external key.
+
+The shipped Compose file does not pass this optional variable by default. Add
+an override such as:
+
+```yaml
+services:
+  executor:
+    environment:
+      EXECUTOR_MASTER_KEY_FILE: /run/secrets/executor-master.key
+    volumes:
+      - ./secrets/executor-master.key:/run/secrets/executor-master.key:ro
+```
+
+The container runs as UID and GID `10001`, uses a read-only root filesystem,
+drops Linux capabilities, and receives a private temporary filesystem. If an
+external backup or secret manager creates mounted files, make them readable by
+UID `10001` without making them writable by other users.
+
+## HTTPS reverse proxy
+
+Leave the compose port bound to host loopback and set the exact browser-facing
+origin before starting the service:
+
+```sh
+EXECUTOR_PUBLIC_ORIGIN=https://executor.example.com docker compose up --detach
+```
+
+Terminate TLS in a reverse proxy on the same host and forward to
+`127.0.0.1:4788`. The compose file passes through
+`EXECUTOR_TRUSTED_PROXIES` only when that host variable is set. Configure it
+only when Executor must use forwarded client addresses, and include only the
+proxy CIDRs that directly append or replace `X-Forwarded-For`.
+
+## MCP stdio templates
+
+The default mounted registry is empty and boot-safe. Start a private registry
+from the full example:
+
+```sh
+mkdir -p .executor-local
+cp docker/mcp-stdio-templates.full.example.json \
+  .executor-local/mcp-stdio-templates.json
+```
+
+Edit the `compose.yaml` bind mount so its host side is
+`./.executor-local/mcp-stdio-templates.json`, then mount each referenced Linux
+executable and working directory at its exact absolute container path.
+
+The runtime image does not include Node.js or Bun. Mounted stdio servers must be
+self-contained Linux executables for the image architecture, or you must derive
+a runtime image containing their dependencies. Treat every configured stdio
+executable as fully trusted: it runs as Executor's UID and can read the data
+volume and master key.
+
+## Multi-platform image check
+
+Release automation can build both supported architectures from the same file:
+
+```sh
+docker buildx build --platform linux/amd64,linux/arm64 --file Dockerfile .
+```
+
+The default root target remains self-contained and builds Svelte and Rust. The
+manual release workflow instead uses the `runtime-prebuilt` target: it copies
+the already-tested Linux binaries and license notices from the native release
+archives, pushes each architecture by digest, then assembles the multi-platform
+manifest. This keeps the embedded UI and notices identical between archives
+and release images. The release target pins its Debian runtime and apt snapshot
+and normalizes image timestamps to the release commit. Existing immutable
+release, version, or commit tags may be reused only when their digest already
+matches; only `latest` or `beta` may move.
diff --git a/docs/install.md b/docs/install.md
new file mode 100644
index 000000000..091257249
--- /dev/null
+++ b/docs/install.md
@@ -0,0 +1,268 @@
+# Install and run Executor
+
+Executor ships as one native binary with its Svelte dashboard embedded. The
+supported native targets are Linux and macOS on x86-64 and ARM64. Windows is not
+supported. The macOS archives require macOS 14 Sonoma or newer. Docker images
+support Linux `amd64` and `arm64`.
+
+## Prerequisites
+
+Building from a checkout requires Bun 1.3.x, Rust 1.96 or newer, a C toolchain,
+and the normal SQLite build prerequisites for the platform. The workspace
+declares Bun 1.3.11 and the release workflow currently uses Rust 1.96.0.
+
+Run `bun run bootstrap` once in a fresh checkout. It installs workspace
+dependencies, prepares retained TypeScript packages, and installs Playwright
+Chromium for browser scenarios.
+
+## Release archive
+
+The manual native release workflow publishes checksum-verified archives to the
+matching GitHub release. Install the latest supported archive with:
+
+```sh
+curl -fsSL https://raw.githubusercontent.com/davis7dotsh/executor-fork-testing/main/scripts/install.sh | bash
+```
+
+The installer and native release workflow use
+`davis7dotsh/executor-fork-testing` as the current publishing origin. Export
+`EXECUTOR_REPOSITORY` before running the script to install from another fork:
+
+```sh
+export EXECUTOR_REPOSITORY=owner/repository
+curl -fsSL "https://raw.githubusercontent.com/$EXECUTOR_REPOSITORY/main/scripts/install.sh" | bash
+```
+
+Forward installer options after `bash -s --`, for example:
+
+```sh
+curl -fsSL "https://raw.githubusercontent.com/$EXECUTOR_REPOSITORY/main/scripts/install.sh" \
+  | bash -s -- --version 2.0.0 --no-modify-path
+```
+
+The installer defaults to
+`$HOME/.executor/bin`. Start a new shell, source its configuration file, or use
+`$HOME/.executor/bin/executor` until the updated PATH is active.
+
+On macOS, `executor service install` creates a separate managed copy at
+`$HOME/.executor/service/bin/executor`. Archive install, upgrade, and uninstall
+preserve the complete `$HOME/.executor/service` subtree. Service lifecycle
+commands likewise leave the archive-owned `$HOME/.executor/bin` subtree alone.
+
+The macOS command-line archive is not Developer ID signed or notarized. Use the
+curl installer above, which verifies the release checksum before installation,
+or download with `gh` and perform the checksum and immutable GitHub Release
+verification checks below.
+Browser-downloaded quarantined binaries are not a supported Gatekeeper
+distribution path. The workflow sets `MACOSX_DEPLOYMENT_TARGET=14.0` and rejects
+an archive whose Mach-O minimum does not match that support floor.
+
+### Uninstall a user-level archive installation
+
+If a managed service was installed, remove it while the binary is still
+available. Skip the matching command when no service was installed:
+
+```sh
+# Linux system service
+sudo "$(command -v executor)" service remove
+
+# macOS per-user LaunchAgent, never use sudo
+executor service remove
+```
+
+Then run the same installer in uninstall mode:
+
+```sh
+curl -fsSL https://raw.githubusercontent.com/davis7dotsh/executor-fork-testing/main/scripts/install.sh \
+  | bash -s -- --uninstall
+```
+
+For a custom location, export the same absolute `EXECUTOR_INSTALL_DIR` used at
+install time before running that command. Uninstall removes only `executor`,
+the three installed notice files, and the exact `# Executor` PATH block added
+by the installer. It preserves all databases, master keys, service definitions,
+other files in the install directory, and every other shell configuration line.
+Use `--no-modify-path` with `--uninstall` to leave shell configuration untouched.
+The operation is safe to repeat. Each successful install records the exact
+owned filenames and SHA-256 hashes in a private manifest. Installation refuses
+to overwrite an unowned file, and uninstall fails closed if an owned file or the
+manifest was replaced. Review and resolve such a replacement manually instead
+of deleting it as though the installer still owned it. Before changing owned
+files, installation publishes private rollback state. A later install or
+uninstall automatically restores that state after an interrupted mutation,
+while a partially completed uninstall resumes around already-removed owned
+files. The ownership state also records every exact shell-config path and PATH
+command the installer added, so uninstall cleans the original block even when
+the current shell or `ZDOTDIR` has changed.
+
+Install, recovery, PATH updates, and uninstall hold one private lock under the
+validated install directory. A custom install path must be normalized, contain
+no symbolic-link components, and have only root- or current-user-owned
+ancestors with no group or world write permission. The installer pins the
+parent and leaf directory identities before any owned-file mutation. A
+concurrent invocation exits with the live owner PID. A lock left by a crashed
+process is reclaimed only after its recorded process-birth identity no longer
+matches, which also protects against PID reuse. Managed file renames, rollback
+restoration, manifest publication, recovery retirement, and uninstall deletion
+are separated by stock `sync` durability barriers. Shell-configuration edits
+use a portable adjacent ownership lock, atomic replacement, and content checks
+so different install roots cannot lose one another's PATH updates. The release
+installer has no Python runtime dependency.
+
+The release artifact workflow creates these archives and matching `.sha256`
+sidecars:
+
+- `executor-x86_64-unknown-linux-gnu.tar.gz`
+- `executor-aarch64-unknown-linux-gnu.tar.gz`
+- `executor-x86_64-apple-darwin.tar.gz`
+- `executor-aarch64-apple-darwin.tar.gz`
+
+Each archive also contains the project `LICENSE`, the generated Rust
+`THIRD_PARTY_LICENSES.html` inventory, and Vite's bundle-derived embedded-web
+`THIRD_PARTY_JAVASCRIPT_LICENSES.json` inventory. The Linux binaries require
+glibc 2.35 or newer, matching the Ubuntu 22.04 release baseline. The release
+workflow inspects symbol versions and rejects a binary above that ceiling. Use
+Docker on older Linux distributions.
+
+The `executor` binary embeds the maintained systemd unit, LaunchAgent template,
+bounded log helper, and hardened installer logic. A downloaded release binary
+can therefore install its service without a source checkout.
+
+The workflow creates `SHA256SUMS`, runs every target natively, smoke-tests each
+binary, and publishes the GitHub release as immutable. Verify both the checksum
+manifest and GitHub's immutable release records before installing a downloaded
+archive:
+
+```sh
+tag=v2.0.0
+repository=OWNER/REPOSITORY
+mkdir release-assets
+gh release download "$tag" --repo "$repository" --dir release-assets
+if command -v sha256sum >/dev/null 2>&1; then
+  (cd release-assets && sha256sum --check SHA256SUMS)
+else
+  (cd release-assets && shasum -a 256 --check SHA256SUMS)
+fi
+gh release verify "$tag" --repo "$repository"
+for archive in release-assets/executor-*.tar.gz; do
+  gh release verify-asset "$tag" "$archive" --repo "$repository"
+done
+```
+
+The release workflow accepts an exact full commit SHA and tag, checks that the
+tag is `v<Cargo.toml version>`, and verifies that the remote tag resolves to the
+same commit before publishing. The GitHub release remains a draft until the
+archives, checksums, and root Docker image have all succeeded. Publishing the
+draft creates the immutable release record checked by the commands above.
+
+## Build a local release binary
+
+Install the prerequisites above, then run from the repository root:
+
+```sh
+bun run bootstrap
+bun run --cwd web build
+cargo build --locked --release
+./scripts/install.sh --binary ./target/release/executor
+```
+
+The web build must happen before the release Cargo build so `build.rs` can
+embed the static application. Node.js or Bun is not required after compilation.
+
+## First boot
+
+For an easy-to-inspect local instance, choose an explicit private data
+directory:
+
+```sh
+mkdir -p "$HOME/.executor-data"
+chmod 0700 "$HOME/.executor-data"
+"$HOME/.executor/bin/executor" server --data-dir "$HOME/.executor-data"
+```
+
+Executor binds to `127.0.0.1:4788` by default. Open the one-time setup URL
+printed at startup and create the administrator login. The dashboard immediately
+signs in with those credentials. If that follow-up login fails, sign in manually,
+then generate API tokens under **API tokens**. Token secrets are shown once.
+The setup token expires after 15 minutes and is replaced on a later boot until
+an administrator is created.
+
+The data directory contains the SQLite database, WAL and SHM files when
+present, process lock, and generated `master.key`. Back up the complete
+directory only while Executor is stopped. Keep the database and key together
+and private.
+
+To use an externally managed key, supply an exact 32-byte cryptographically
+random raw regular file from a secure random source or secret manager, give it
+exactly one hard link, and pass `--master-key-file` or
+`EXECUTOR_MASTER_KEY_FILE`. A key owned by Executor's effective user must use
+mode `0400` or `0600`. A root-owned secret-manager file may use `0400`, `0440`,
+`0600`, or `0640`; group-readable modes work only when Executor belongs to that
+group. This setting is a file path, never key material.
+Do not use a password, repeated bytes, hand-authored content, hex text, or
+base64 text as the key. Executor does not create, chmod, rotate, or recover an
+external key. Files owned by another user, symbolic links, non-regular files,
+additional hard links, and broader permissions fail closed. Include that file
+in the same stopped recovery snapshot as the data directory. Losing the key
+makes protected credentials, OAuth tokens, approvals, and results
+unrecoverable.
+
+Use `--public-origin https://executor.example.com` when a local HTTPS reverse
+proxy exposes the dashboard at another origin. An HTTPS public origin does not
+encrypt or firewall Executor's own listener. Keep the listener on loopback, or
+enforce network isolation so clients can reach it only through the TLS proxy.
+Do not expose the raw plaintext port.
+
+The one-time setup URL is a secret until setup completes. It may appear in the
+terminal, journal, or private service log, so protect those logs accordingly.
+
+## Server configuration
+
+| Environment variable                | Server flag             | Purpose                                        |
+| ----------------------------------- | ----------------------- | ---------------------------------------------- |
+| `EXECUTOR_DATA_DIR`                 | `--data-dir`            | SQLite, lock, and default master-key directory |
+| `EXECUTOR_MASTER_KEY_FILE`          | `--master-key-file`     | Existing raw 32-byte master-key file           |
+| `EXECUTOR_MCP_STDIO_TEMPLATES_FILE` | `--mcp-stdio-templates` | Trusted local MCP template registry            |
+| `EXECUTOR_PUBLIC_ORIGIN`            | `--public-origin`       | Exact browser-facing HTTP or HTTPS origin      |
+| `EXECUTOR_TRUSTED_PROXIES`          | `--trusted-proxy`       | Comma-separated trusted reverse-proxy CIDRs    |
+| `RUST_LOG`                          | none                    | Rust tracing filter, default `executor=info`   |
+
+`--bind` and `--allow-unsafe-http-non-loopback` intentionally have no
+environment equivalents. Do not put credentials, API tokens, or raw key
+material in service environment files.
+
+Configure trusted proxies only when Executor must derive client addresses from
+`X-Forwarded-For`. List only the actual proxy CIDRs, include every hop in the
+chain, and configure each proxy to append or replace the header correctly. A
+broad trust range can permit spoofed login identities, while an incomplete
+chain causes forwarded logins to be rejected.
+
+## Managed services and containers
+
+After installing the release binary, install the native service directly:
+
+```sh
+# Linux system service
+sudo "$(command -v executor)" service install
+
+# macOS per-user LaunchAgent, never use sudo
+executor service install
+```
+
+Use `--no-start` to install while leaving the service stopped. The same binary
+provides `service status`, `start`, `stop`, `restart`, and `remove`. Removal
+preserves persistent data and configuration. A private ownership manifest
+binds later lifecycle mutations to the exact service files installed by this
+workflow, so replacing a managed file outside `service install` fails closed.
+On macOS, reinstall preserves the stored data directory, template file, public
+origin, and trusted proxy list unless the corresponding environment variable
+is explicitly supplied.
+
+- [Linux systemd service](systemd.md)
+- [macOS LaunchAgent](launchd.md)
+- [Docker Compose](docker.md)
+
+MCP stdio templates are machine-admin allowlists. Every approved executable is
+fully trusted because it runs with Executor's operating-system identity and can
+access its data and master key. See [MCP support](mcp.md) for the exact template
+schema and transport limits.
diff --git a/docs/launchd.md b/docs/launchd.md
new file mode 100644
index 000000000..cdae5b3db
--- /dev/null
+++ b/docs/launchd.md
@@ -0,0 +1,137 @@
+# Run Executor with launchd
+
+The native macOS release supports both Apple Silicon and Intel Macs. Install the
+release binary, then install its per-user LaunchAgent:
+
+```sh
+executor service install
+```
+
+Do not use `sudo`. The binary embeds the LaunchAgent template, bounded log
+helper, and installer, copies itself to
+`$HOME/.executor/service/bin/executor`, and uses private temporary files. A
+source checkout is not required. The archive-installed command remains at
+`$HOME/.executor/bin/executor`, with independent ownership and upgrade state.
+Pass `--no-start` to install the files while leaving the agent unloaded.
+
+The CLI records hashes for the installed binary, plist, wrapper, log helper,
+and persisted service configuration in
+`$HOME/.executor/service/service-install.manifest`, owned by the user with mode
+`0600`. Lifecycle mutations fail closed if a managed file is replaced outside
+`service install`. A private recovery marker makes an interrupted manifest
+publication safely rerunnable while keeping the LaunchAgent unloaded.
+
+LaunchAgent settings are stored in the private, non-executable control file
+`$HOME/.executor/service/service-config`. Reinstalling with no related
+environment variables preserves the exact existing data directory, template
+file, public origin, and trusted proxy list. Setting one variable changes only
+that field. An explicitly empty `EXECUTOR_PUBLIC_ORIGIN` or
+`EXECUTOR_TRUSTED_PROXIES` clears that setting.
+
+Custom data and template paths must be absolute. Every existing directory from
+the user's home boundary, or from the filesystem root for paths outside the
+home directory, must be owned by root or the current user and must not be
+group-writable or world-writable. Symbolic-link ancestors are rejected. The
+managed wrapper and bounded logger stay under `$HOME/.executor/service`, while
+the database, key, templates, and log remain under their configured paths.
+The template file also cannot equal, contain, or be nested beneath a managed
+service path or a reserved database, key, lock, or log path. These checks are
+case-insensitive so they remain safe on the default macOS filesystem.
+
+The LaunchAgent runs only while that user is logged in. It binds Executor to
+`127.0.0.1:4788`, keeps persistent state under
+`~/Library/Application Support/Executor`, and stops it with `SIGTERM` so the
+server can drain active work before launchd's 30-second exit deadline.
+
+Executor creates `master.key` inside the data directory on first boot. Back up
+the data directory and master key together. Losing the key makes encrypted
+credentials and protected state unrecoverable. Keep the directory private and
+never copy the key into a shell command, plist, log, or source-control file.
+
+The installer creates an empty, mode `0600` MCP stdio template registry at
+`~/Library/Application Support/Executor/mcp-stdio-templates.json`. Edit that
+file to add trusted local executables, then restart Executor. Do not make the
+template file, referenced executable, working directory, or any ancestor path
+writable by untrusted users.
+
+Treat every configured stdio executable as fully trusted. launchd runs it as
+the same user as Executor, so it can read that user's Executor data directory
+and master key. The template allowlist prevents dashboard users from selecting
+arbitrary commands, but it is not a privilege boundary between Executor and an
+approved executable.
+
+## Operate the service
+
+```sh
+executor service status
+executor service start
+executor service stop
+executor service restart
+```
+
+`service status` prints exactly `active` or `inactive`, exits 0 for active, and
+exits 3 for inactive. Operational failures exit 1. Restart uses a graceful
+`bootout` followed by `bootstrap`. The CLI never uses force-killing
+`kickstart -k`.
+
+Executor output is written to `executor.log` inside its mode `0700` data
+directory. The generated LaunchAgent helper keeps the current log and three
+rotated generations, each capped at 1 MiB and mode `0600`. It copies input in
+fixed-size chunks, so a large stream with no newline cannot make the helper's
+memory grow with the stream. This keeps the first-boot setup token in the
+user's private data directory without allowing normal tracing output to grow
+without a bound.
+
+```sh
+tail -f "$HOME/Library/Application Support/Executor/executor.log"
+```
+
+The one-time setup URL appears in that output on first boot.
+
+To serve the dashboard through an HTTPS reverse proxy, reinstall the agent with
+the exact browser-facing origin:
+
+```sh
+EXECUTOR_PUBLIC_ORIGIN=https://executor.example.com executor service install
+```
+
+Leave Executor on its default loopback bind. The local reverse proxy should be
+the only process that exposes it to other machines. Configure trusted proxy
+CIDRs only when forwarded client addresses are required:
+
+```sh
+EXECUTOR_PUBLIC_ORIGIN=https://executor.example.com \
+EXECUTOR_TRUSTED_PROXIES=127.0.0.1/32,::1/128 \
+executor service install
+```
+
+`EXECUTOR_TRUSTED_PROXIES` accepts the same CIDRs as a comma-separated list.
+
+To remove the service without deleting data:
+
+```sh
+executor service remove
+```
+
+Removal checks `launchctl bootout` errors, then removes the managed plist,
+wrapper, log helper, service-private binary, and ownership manifest. It
+preserves the persisted service configuration, the archive installation under
+`$HOME/.executor/bin`, and the database, master key, template registry, and
+logs under Application Support. A later service install reuses the preserved
+settings unless explicit environment overrides are supplied.
+
+## Back up and restore
+
+Stop Executor before copying its SQLite database, WAL files, and master key.
+Back up the whole data directory as one unit:
+
+```sh
+executor service stop
+cp -pR "$HOME/Library/Application Support/Executor" "$HOME/Executor-backup"
+executor service start
+```
+
+To restore, stop the service, replace the complete data directory from one
+backup, preserve its private permissions, then start the service. Never create
+a replacement key beside an existing `executor.db`; Executor intentionally
+fails closed when the initialized database and its original key are separated.
diff --git a/docs/mcp.md b/docs/mcp.md
new file mode 100644
index 000000000..5169e4bfb
--- /dev/null
+++ b/docs/mcp.md
@@ -0,0 +1,412 @@
+# MCP support
+
+Executor can sit on both sides of MCP:
+
+- MCP clients connect to Executor's stateful Streamable HTTP endpoint at
+  `/mcp`.
+- Executor imports tools from upstream MCP servers over Streamable HTTP or
+  local stdio.
+- `executor mcp` adapts a local stdio-only MCP client to Executor's `/mcp`
+  endpoint.
+
+All three surfaces currently require MCP protocol version `2025-11-25`.
+Executor does not negotiate an older protocol version.
+
+The Rust package pins `rmcp` exactly at `1.8.0` for MCP model types. Executor
+implements its HTTP and stdio transport boundaries locally so the gateway can
+apply its own authentication, SSRF controls, process isolation, limits, and
+lifecycle rules.
+
+This slice supports MCP tools only. The downstream endpoint does not advertise
+resources, prompts, completions, tasks, sampling, or elicitation. Upstream
+discovery imports `tools/list`; other upstream capabilities are retained as
+metadata but are not bridged into Executor surfaces.
+
+## Connect an MCP client to Executor
+
+The downstream endpoint is the instance public origin plus `/mcp`, for example
+`http://127.0.0.1:4788/mcp`. Authenticate every non-preflight request with a
+dashboard-generated API token:
+
+```text
+Authorization: Bearer <executor-api-token>
+```
+
+The endpoint uses the stateful Streamable HTTP lifecycle:
+
+1. Send `initialize` without `MCP-Session-Id`.
+2. Read the new `MCP-Session-Id` response header.
+3. Send `notifications/initialized` with that session ID and
+   `MCP-Protocol-Version: 2025-11-25`.
+4. Include both headers on subsequent requests.
+5. Send `DELETE /mcp` with both headers to close the session.
+
+`POST /mcp` requires `Content-Type: application/json` and an `Accept` value
+that permits both `application/json` and `text/event-stream`. Responses are
+currently JSON request-response messages. `GET /mcp` does not open a server
+event stream. After validating an initialized session it returns HTTP 405 with
+`Allow: POST, DELETE, OPTIONS`.
+
+Sessions belong to the API token that initialized them. A different token sees
+the session as missing. Sending `DELETE /mcp`, revoking the owning API token,
+or lazily pruning an idle-expired session terminates that session and cancels
+its active waits. A pending Ask released by session termination cannot execute
+later. Initialized sessions expire after eight idle hours; incomplete
+handshakes expire after five idle minutes. The server allows 32 sessions per
+API token and 4,096 sessions for the instance, returning service unavailable
+when either capacity is full. Downstream session IDs are at most 128 printable
+ASCII bytes.
+
+Browser-origin requests must use the configured public origin. Executor checks
+both `Host` and `Origin` before authentication and emits narrowly scoped CORS
+headers for that origin. Repeated security-sensitive headers are rejected.
+
+### Virtual tools
+
+`tools/list` always returns five Executor-owned tools. It does not return every
+upstream tool as a separate MCP tool.
+
+| Tool       | Purpose                                                                                                                                                                  |
+| ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `execute`  | Run up to 1 MiB of sandboxed TypeScript that can discover and call multiple Executor tools concurrently. Accepts `code` and optional `timeoutMs` from 1 through 300,000. |
+| `call`     | Call one catalog tool by a 1 through 512 byte `path`, with an optional `arguments` object. Ask-mode tools wait for administrator approval.                               |
+| `search`   | Search the enabled global catalog by `query`, optional `namespace`, `limit`, and `offset`. The limit is 1 through 100 and defaults to 20.                                |
+| `describe` | Return schemas and metadata for one enabled catalog tool by a 1 through 512 byte `path`.                                                                                 |
+| `sources`  | List sources that currently expose tools through the global catalog.                                                                                                     |
+
+Tool paths use `tools.<source_slug>.<tool_name>`. Disabled tools remain
+unavailable. Imported tools are intrinsically `enabled` only when the upstream
+explicitly marks them read-only without also marking them destructive. All
+other imported MCP tools default to `ask` mode.
+
+For `tools/call`, the MCP JSON-RPC request ID is part of the idempotency identity
+and cancellation correlation. Numeric and string IDs are distinct; string IDs
+are at most 256 bytes and cannot contain a NUL character. Reusing an ID for a
+different virtual-tool invocation is rejected. `notifications/cancelled` is
+scoped to an in-flight `tools/call` in the same session. A call that may already
+have reached an upstream MCP server is never silently replayed.
+
+### Local stdio bridge
+
+For clients that can launch only a stdio MCP server, configure them to run:
+
+```sh
+EXECUTOR_API_TOKEN='<dashboard-token>' \
+  executor --base-url http://127.0.0.1:4788 mcp
+```
+
+The bridge keeps stdout protocol-only, forwards requests concurrently, reserves
+capacity for cancellation notifications, and closes the HTTP session on exit.
+It allows eight ordinary requests in flight, with a separate ceiling of 16
+while admitting cancellations. Non-loopback plaintext HTTP is rejected unless
+the client command also receives `--allow-insecure-http`.
+
+## Add upstream MCP sources
+
+MCP source management uses the same administrator routes as other protocols:
+
+- `POST /api/v1/sources`
+- `POST /api/v1/sources/{id}/refresh`
+- `GET`, `PUT`, and `DELETE /api/v1/sources/{id}/credentials`
+- `GET /api/v1/mcp/stdio/templates`
+
+Reads require the administrator session cookie. Mutations additionally require
+the matching Origin and CSRF cookie/header pair. The dashboard is the normal
+way to satisfy these controls. The JSON below documents the protocol payloads
+for API clients that already implement administrator authentication.
+
+### Streamable HTTP source
+
+Create a remote HTTP source with `kind: "mcp_http"`:
+
+```json
+{
+  "kind": "mcp_http",
+  "displayName": "Issue tracker",
+  "preferredSlug": "issues",
+  "description": "Internal issue tools",
+  "endpoint": "https://mcp.example.com/mcp",
+  "allowPrivateNetwork": false,
+  "credential": {
+    "type": "bearer",
+    "token": "secret"
+  }
+}
+```
+
+`preferredSlug`, `description`, and `credential` are optional.
+`allowPrivateNetwork` defaults to `false`. The endpoint must be an absolute
+HTTP or HTTPS URL without user information or a fragment. A query string is
+allowed, but it is encrypted with the credential state and removed from the
+public source configuration.
+
+The HTTP credential is one of:
+
+```json
+{ "type": "bearer", "token": "secret" }
+```
+
+```json
+{ "type": "basic", "username": "user", "password": "secret" }
+```
+
+```json
+{ "type": "api_key_header", "name": "X-Api-Key", "value": "secret" }
+```
+
+```json
+{ "type": "oauth_access_token", "accessToken": "secret" }
+```
+
+The OAuth form above is a manually supplied access token. For managed OAuth,
+leave the static credential empty and configure the source's `default`
+credential in the dashboard's Managed OAuth panel. HTTP MCP sources use
+protected-resource and authorization-server discovery, PKCE authorization-code
+callbacks, encrypted refresh-token storage, and just-in-time access tokens.
+Static credentials take precedence when one is configured. Stdio MCP sources
+do not expose managed OAuth.
+
+Transport-owned headers cannot be used for `api_key_header`. This includes
+`Authorization`, `Host`, `Content-Type`, `Accept`, length and connection
+headers, `MCP-Session-Id`, `MCP-Protocol-Version`, `Origin`, `Referer`, and
+proxy headers.
+
+Replace the HTTP credential with optimistic concurrency:
+
+```json
+{
+  "expectedRevision": 3,
+  "credential": {
+    "credential": {
+      "type": "bearer",
+      "token": "replacement"
+    }
+  }
+}
+```
+
+For a non-null replacement, Executor discovers with the candidate credential
+first. One SQLite transaction then replaces the encrypted credential and
+refreshes artifacts, bindings, tools, health, and revisions. Discovery or
+commit failure leaves the prior credential, catalog, and watcher unchanged.
+
+Use `"credential": null` inside the protocol credential object to remove HTTP
+authentication without changing the endpoint. Executor first attempts
+anonymous discovery. On success, one SQLite transaction clears the credential
+and refreshes the catalog. After commit, Executor installs a replacement
+watcher only when the refreshed capabilities advertise `tools.listChanged`. If
+anonymous discovery fails, Executor still commits the credential clear together
+with unknown source health, preserves the last known catalog, and leaves its
+watcher stopped. A failed clear commit preserves the old database state and
+reinstalls its prior watcher. `GET` returns only the revision and configured
+credential type, never secret values.
+
+### Stdio source templates
+
+Arbitrary commands are never accepted through the source API. The machine
+administrator must first approve every executable, argument, working directory,
+and non-secret environment value in a strict JSON template file. Start the
+server with either form:
+
+```sh
+executor server --mcp-stdio-templates /absolute/path/to/mcp-stdio.json
+```
+
+```sh
+EXECUTOR_MCP_STDIO_TEMPLATES_FILE=/absolute/path/to/mcp-stdio.json executor server
+```
+
+If neither is set, the registry is empty and HTTP MCP sources remain
+available. If a path is set, an unreadable or invalid file fails server
+startup.
+
+The file has exactly this top-level shape:
+
+```json
+{
+  "templates": [
+    {
+      "name": "filesystem",
+      "executable": "/absolute/path/to/mcp-server",
+      "cwd": "/absolute/path/to/approved-directory",
+      "arguments": ["--stdio"],
+      "environment": {
+        "LOG_LEVEL": "warn"
+      },
+      "secretEnvironment": ["API_TOKEN"]
+    }
+  ]
+}
+```
+
+`cwd`, `arguments`, `environment`, and `secretEnvironment` are optional. Unknown
+fields fail startup. Template names contain only ASCII letters, digits, `_`, or
+`-` and are at most 64 bytes. Template names must be unique. Executables and
+working directories must be absolute and are canonicalized when the registry
+loads. The executable must be a regular executable file, and `cwd` must be a
+directory.
+
+The configuration file is limited to 1 MiB and 256 templates. Each template
+allows at most 128 arguments. The final static-plus-secret environment allows
+at most 128 entries. An argument is at most 8 KiB, an environment value is at
+most 16 KiB, and the combined argument or environment data for a template is
+at most 128 KiB. Environment names use shell-style identifiers. A secret field
+cannot duplicate a static environment entry.
+
+Child processes receive a clean environment containing only the approved
+static entries plus the exact secret overlay. On Unix, each child receives its
+own process group. Graceful shutdown escalates to killing that process group,
+including descendants that remain alive.
+
+Executor does not enforce ownership or write permissions for the template
+file, executable, or their ancestor directories. The machine administrator is
+responsible for protecting those paths from untrusted modification.
+
+After server startup, discover the non-secret template descriptors at
+`GET /api/v1/mcp/stdio/templates`:
+
+```json
+{
+  "templates": [
+    {
+      "name": "filesystem",
+      "secretFields": ["API_TOKEN"]
+    }
+  ]
+}
+```
+
+Create a source with a template name, never an executable path:
+
+```json
+{
+  "kind": "mcp_stdio",
+  "displayName": "Local filesystem",
+  "preferredSlug": "files",
+  "description": "Approved local file tools",
+  "templateName": "filesystem",
+  "secretValues": {
+    "API_TOKEN": "secret"
+  }
+}
+```
+
+`preferredSlug`, `description`, and `secretValues` are optional. If a template
+declares secrets and `secretValues` is omitted or empty, Executor creates an
+empty source without starting the process. A later credential update must
+supply every declared secret and no others, then discovery runs. Credential
+replacement uses:
+
+```json
+{
+  "expectedRevision": 0,
+  "credential": {
+    "secretValues": {
+      "API_TOKEN": "replacement"
+    }
+  }
+}
+```
+
+Credential replacement discovers first, then commits the encrypted credential
+and refreshed catalog atomically. A discovery failure leaves both unchanged.
+Clear credentials with
+`DELETE /api/v1/sources/{id}/credentials?expectedRevision=<revision>`. For HTTP
+sources, the nested `"credential": null` PUT form described above has the same
+clear semantics.
+
+Clearing credentials for a template that declares secrets stops its catalog
+watcher and leaves both the approved template selection and existing catalog
+entries in place. The empty encrypted overlay and unknown source health commit
+together; calls cannot start until complete credentials are restored.
+Templates without secret fields treat the empty overlay as complete, discover
+first, and atomically commit the empty credential plus refreshed catalog so the
+source remains healthy.
+
+## Discovery, refresh, and invocation lifecycle
+
+When credentials are complete, source creation initializes the upstream, walks
+every `tools/list` page, validates and normalizes the complete result, then
+commits the source, encrypted credential envelope, capabilities artifact,
+bindings, and tools atomically. A stdio source created without its required
+secrets follows the deferred empty-source behavior described above. Discovery
+permits at most 1,000 pages, 100,000 tools, 32 MiB of aggregate tool metadata,
+5 MiB for one tool, 2 MiB for one schema, and 8 MiB of capability metadata.
+Cursor cycles, duplicate tool names, malformed schemas, and unstable catalogs
+fail the operation.
+
+Refresh performs all upstream work before opening the catalog transaction. It
+commits only if the source and credential revisions still match. A failed or
+stale refresh leaves the existing catalog untouched. When the retained
+credential state remains complete, that catalog remains callable. Upstream tool
+names are stable keys, so refresh preserves Executor tool IDs, callable paths,
+and administrator mode overrides.
+
+If an upstream advertises `tools.listChanged`, Executor maintains a watcher and
+coalesces notifications into bounded refreshes. Watchers are restored at
+startup and run a full revision-fenced catalog reconciliation on every
+successful initial or reconnect handshake before entering steady notification
+handling. They are replaced after relevant credential changes, stopped before
+source deletion, and drained during shutdown. Stdio watchers also heartbeat the
+transport lifecycle so an idle child exit reconnects even without a
+notification. If an HTTP upstream returns 405 to the notification-stream GET,
+Executor lets the current revision-fenced reconciliation commit, then treats
+live notifications as unsupported and exits that watcher without reconnecting.
+Use manual refresh for later catalog changes from that upstream.
+
+An invocation uses a fresh upstream connection and MCP session. Executor
+initializes it, calls the named tool, then terminates or shuts down the session.
+An upstream `isError: true` result becomes a failed Executor tool result with
+code `upstream_tool_error`. Disconnects after a stdio tool call or transport
+failures during an HTTP tool call are treated as outcome-unknown and are not
+replayed.
+
+## Transport safety and limits
+
+Remote HTTP MCP uses the shared hardened outbound client. It allows only HTTP
+and HTTPS, disables environment proxies and redirects, validates and pins DNS
+answers, and blocks private targets unless the source explicitly opts in.
+Link-local, cloud metadata, multicast, documentation, and reserved addresses
+remain blocked even with private-network access enabled.
+
+An MCP endpoint is capped at 8 KiB. The shared client limits a resolved host to
+32 addresses, request bodies to 8 MiB, collected request-response bodies to 16
+MiB, and request or response headers to 64 KiB. Connection setup has a
+five-second timeout. The HTTP MCP transport adds a 30-second deadline to
+request-response exchanges, a 16 MiB aggregate ceiling across request-response
+SSE resumptions, at most 1,024 SSE events per exchange, at most three
+resumptions, and session IDs capped at 1,024 visible ASCII bytes.
+
+Long-lived notification streams have no cumulative byte or lifetime limit.
+They use a five-minute per-read idle timeout; declared `Content-Length`, each
+delivered body chunk, each undelimited parser line, and each accumulated SSE
+event are independently capped at 16 MiB. A connection accepts at most 1,024
+completed SSE events. Event 1,025 fails the listener, after which the source
+watcher reconnects with backoff and a fresh MCP initialization. The transport
+accepts only JSON or SSE response media types. Session changes, malformed
+JSON-RPC, unsupported server requests, and invalid content types fail closed.
+Server `ping` requests are answered; other server-initiated requests receive
+method not found.
+
+The stdio transport defaults to a 16 MiB message limit, 64 KiB stderr
+accounting ceiling, 60-second request timeout, two-second shutdown grace, and a
+256-command queue. Stderr is continuously drained and is not exposed or stored;
+only the exit code and whether the accounting ceiling was exceeded survive
+internally. The transport restarts a failed process with bounded exponential
+backoff, but a restart requires a new MCP initialization. It does not retry a
+tool call after bytes may have reached the child.
+
+The downstream `/mcp` body limit is the 8 MiB tool-argument ceiling plus a
+64 KiB protocol envelope. Bearer tokens are capped at 512 bytes. Body admission
+is limited to 16 requests for the instance and four per token. Detached
+execution is independently limited to 16 for the instance and four per token,
+leaving a control lane available for cancellation notifications. Body
+saturation returns HTTP 429 with `mcp_busy`; execution saturation returns a
+JSON-RPC `-32603` error. The cancellation registry is capped at 4,096 active
+requests, with at most 128 short-lived pre-cancellation records per session.
+Pre-cancellation records expire after 60 seconds. Pending Ask calls use the
+durable ten-minute approval TTL, and expiry settlement is checked at intervals
+of at most 30 seconds. There is no separate MCP transport wait timeout.
+`notifications/cancelled` explicitly cancels the matching request wait;
+`DELETE /mcp`, API-token revocation, and lazy idle-session expiry cancel all
+session-scoped waits.
diff --git a/docs/runtime.md b/docs/runtime.md
new file mode 100644
index 000000000..e7e4c41b5
--- /dev/null
+++ b/docs/runtime.md
@@ -0,0 +1,133 @@
+# Sandboxed TypeScript runtime
+
+Executor runs each TypeScript execution in a fresh hidden worker process. The
+server process owns authentication, policy, approvals, credentials, network
+access, tool dispatch, cancellation, and request logging. The worker receives
+only source code, public limits, and sanitized tool results.
+
+## Integration contract
+
+`RuntimeManager::execute` accepts an `ExecutionRequest`, a
+`HostToolDispatcher`, and an `ExecutionCancellation`. The worker can request
+only a tool path and one JSON argument. The parent adds the execution identity
+before calling `HostToolDispatcher::dispatch`. Implementations must select on
+the supplied cancellation handle while waiting for an interactive approval.
+They must also treat a dropped dispatch future as cancellation and remove any
+pending approval for that execution.
+
+The application adapter captures the authenticated actor and surface outside
+the worker, maps each runtime `ToolCall` into `invocation::ToolCallService`, and
+waits for an Ask decision while selecting on cancellation. When an execution
+ends, it calls `cancel_execution(execution_id)` so pending approval calls do not
+outlive their QuickJS continuation.
+
+The adapter assigns a distinct request-log ID to every tool call while keeping
+the HTTP request ID and execution ID as parent-side correlation. Worker
+generations are positive signed-range integers. They are included in approval
+records but expose no authority. Approval decisions start at most one
+server-owned background invocation. The worker waiter only observes the stored
+terminal result and never dispatches the upstream call itself.
+
+Expected upstream tool failures use `ToolResult::Failure`. They resolve in
+TypeScript as `{ error: { code, message } }`, so a script can inspect and react
+to them. IPC, worker, and internal bridge failures reject the tool promise or
+fail the execution with a stable public code.
+
+The result contract keeps the final JSON result, emitted JSON items, captured
+console entries, and parent-side tool-call correlation separate. Neither IPC
+nor runtime output contains credentials, request headers, source bindings, or
+approval records.
+
+## Source recovery and tool proxy
+
+Executor uses the first fenced code block when one is present. It accepts an
+async body with top-level `await` and `return`, a named function declaration, a
+function or arrow expression, a callable variable declaration, or a default
+exported callable. Oxc parses and removes TypeScript syntax inside the worker.
+Imports, module loading, decorators, enums, namespaces, and JSX fail closed.
+
+`tools` is a lazy recursive frozen proxy. Dotted and bracket access are
+equivalent. `then` and symbol property reads return `undefined`, which prevents
+accidental thenable behavior. A call forwards only its first argument and that
+argument must be JSON serializable. `Promise.all` creates concurrent parent
+dispatches, with at most 16 active calls and 128 total calls per execution.
+
+Three protocol-neutral discovery calls are handled entirely by the parent:
+`tools.search`, `tools.describe`, and `tools.sources`. They use the same catalog
+visibility rules as gateway discovery. `tools.sources` returns only public
+source metadata and never returns source configuration or credentials.
+
+## Gateway execution API
+
+`POST /api/v1/gateway/execute` is bearer-token only. Its JSON body is
+`{ "code": string, "timeoutMs"?: number }`. Authentication runs before JSON
+body parsing. Code is limited to 1 MiB, and the timeout defaults to 30 seconds
+with a five-minute maximum.
+
+The response contains `executionId`, `result`, `emits`, `console`, and `calls`.
+The call records contain only worker call IDs, public paths, and sanitized
+results. The endpoint holds the HTTP request open while Ask tools await an
+administrator decision. It does not provide persistence or replay. A client
+disconnect cancels the worker and all pending or approved calls that have not
+started upstream execution. Already-executing approved work remains owned by
+the server because an upstream side effect may already have occurred.
+
+The application-level `ExecutionService` owns actor context, runtime admission,
+disconnect cancellation, worker construction, and active execution tracking.
+HTTP only authenticates, parses, and maps the protocol response. CLI and MCP
+can reuse the same service without rebuilding lifecycle logic. Graceful
+shutdown stops new runtime admission, cancels active workers, waits for their
+parent-side cleanup, then stops approval and request-log tasks before closing
+SQLite.
+
+Before disconnect, revocation, shutdown, timeout, or worker-failure cancellation
+reaches the runtime, execution records an in-memory lost-continuation barrier.
+Approval decisions and approved-work claims share that gate, so cancellation
+and the `approved -> executing` transition have one linearized winner. If
+immediate SQLite cleanup repeatedly fails, a tracked retry task keeps the
+barrier active. Shutdown aborts that retry deterministically, and startup
+recovery terminalizes every pending or approved sandbox approval whose worker
+generation was lost.
+
+The worker has no module loader and exposes no filesystem, environment,
+process, FFI, or network API. `fetch`, `XMLHttpRequest`, `WebSocket`, `process`,
+`require`, `module`, `Deno`, and `Bun` are absent.
+
+## Isolation and limits
+
+IPC uses a private inherited Unix socket, never standard output. Every
+length-prefixed JSON frame has a strict version, execution generation, tagged
+schema, 18 MiB frame ceiling, and 32 MiB aggregate ceiling. Call IDs are
+monotonic. Unknown fields, duplicate or unknown IDs, wrong generations,
+partial frames, invalid lengths, and excessive JSON depth or node counts fail
+closed before serde allocation.
+
+QuickJS has a 64 MiB heap limit and 1 MiB engine stack limit. Source and
+transformed code are each capped at 1 MiB. Arguments and final results are
+capped at 8 MiB. Console capture is capped at 1,000 entries and 256 KiB. Emits
+are capped at 100 items and 8 MiB. The server admits at most eight workers at
+once. Additional executions fail immediately with `runtime_busy` rather than
+forming an unbounded waiter queue.
+
+The child starts with an empty environment, null standard streams, a private
+empty working directory, umask `077`, a new process group, and resource limits
+for CPU, address space, process stack, open files, output files, and core
+dumps. Executor intentionally does not set `RLIMIT_NPROC`, which would affect
+the shared user account rather than one worker. Cancellation and timeout kill
+the worker process group and reap the child before releasing its worker slot.
+Linux also sets `no_new_privs` and a parent-death kill signal before exec.
+
+Linux applies the complete resource-limit contract. macOS uses the
+same process, descriptor, environment, QuickJS, and IPC boundaries, but its
+kernel may treat address-space and CPU limits less strictly. Executor does not
+claim a macOS Seatbelt profile or container boundary.
+
+This is a capability, crash, and resource boundary for JavaScript, not a
+multi-tenant native-code sandbox. A QuickJS, Oxc, or Rust memory-safety escape
+would still run as the service account on both Linux and macOS. Executor does
+not currently install a Linux seccomp or Landlock policy.
+
+The caller chooses a positive wall deadline of at most five minutes. The same
+deadline drives parent timeout handling and the QuickJS interrupt handler. The
+kernel CPU limit is the deadline rounded up to a whole second, with exact whole
+seconds left unchanged and subsecond deadlines receiving a one-second minimum.
diff --git a/docs/sources.md b/docs/sources.md
new file mode 100644
index 000000000..30ea6370c
--- /dev/null
+++ b/docs/sources.md
@@ -0,0 +1,194 @@
+# Sources, credentials, and managed OAuth
+
+Source management is available only to the signed-in administrator. API tokens
+can discover and call the resulting global catalog, but cannot create sources,
+change credentials, or alter tool modes.
+
+## Before connecting
+
+Open **Sources** in the dashboard. Give each source a clear name and, when
+offered, a stable preferred slug. Tool paths use
+`tools.<source_slug>.<tool_name>`.
+
+Outbound connections ignore ambient HTTP proxy variables and do not follow
+tool-call redirects. Public targets are allowed by default. Enable **Allow
+private network addresses** only when the source intentionally runs on
+loopback or a private network. Link-local, cloud metadata, multicast, and
+reserved targets remain blocked.
+
+For a managed OAuth source, that same opt-in also covers issuer discovery, MCP
+protected-resource discovery, authorization metadata, token exchange, and
+refresh endpoints. It can permit loopback HTTP for those OAuth endpoints. Keep
+the opt-in off unless both the source and its OAuth provider intentionally need
+private-network reachability.
+
+Credentials are encrypted with the instance master key and are never shown
+again. Enter secrets in the dashboard, not in endpoint URLs. Static credentials
+take precedence over a managed OAuth connection for the same credential key.
+
+## OpenAPI
+
+1. Choose **OpenAPI service**.
+2. Select **URL** or **Paste**, then provide an OpenAPI 3.0 or 3.1 document in
+   JSON or YAML.
+3. Select **Preview specification** and review the detected operations and
+   security schemes.
+4. Enter any API key, bearer, basic, or manual OAuth access-token credentials.
+5. Import the source, then review its effective tool modes under **Tools**.
+
+Swagger 2 and external references are not supported. For a URL import, the
+document's server information determines the upstream request target. Query
+parameters in a source URL are treated as protected credential state and are
+not shown in source metadata.
+
+Managed OAuth becomes available after import for supported authorization-code
+security schemes. Configure each eligible scheme separately in the source's
+**Managed OAuth** panel.
+
+## GraphQL
+
+1. Choose **GraphQL API**.
+2. Enter the GraphQL endpoint and source name.
+3. Select static authentication when you intend to use it. For managed OAuth,
+   choose **None**.
+4. Connect the source and review its imported queries and mutations.
+
+Introspection must succeed before tools can be imported and on later refreshes.
+With no static credential, a recognized authentication-required response
+stages an empty source so you can configure its managed OAuth `default`
+credential, authorize it, and then refresh the catalog.
+Queries start Enabled, mutations start Ask, and deprecated operations start
+Disabled. Managed OAuth uses the GraphQL source's `default` credential.
+
+## MCP Streamable HTTP
+
+1. Choose **MCP Streamable HTTP**.
+2. Enter the endpoint and source name.
+3. Select no authentication, bearer, basic, API-key header, or a manually
+   managed OAuth access token.
+4. Connect, then review imported tools and their modes.
+
+Executor currently requires MCP protocol version `2025-11-25`. It imports MCP
+tools only. An upstream tool starts Enabled only when the upstream explicitly
+marks it read-only without also marking it destructive. All other imported MCP
+tools start Ask.
+
+For managed OAuth, first create the HTTP MCP source without a static
+credential, then configure its `default` credential in **Managed OAuth**. See
+[MCP support](mcp.md) for transport limits and lifecycle details.
+
+## MCP stdio templates
+
+Dashboard users cannot submit arbitrary commands. A machine administrator must
+approve the executable, arguments, working directory, static environment, and
+names of secret environment fields in a JSON template file. Start Executor
+with:
+
+```sh
+executor server \
+  --mcp-stdio-templates /absolute/path/to/mcp-stdio-templates.json
+```
+
+The equivalent environment variable is
+`EXECUTOR_MCP_STDIO_TEMPLATES_FILE`. The file format is:
+
+```json
+{
+  "templates": [
+    {
+      "name": "filesystem",
+      "executable": "/absolute/path/to/mcp-server",
+      "cwd": "/absolute/path/to/approved-directory",
+      "arguments": ["--stdio"],
+      "environment": {
+        "LOG_LEVEL": "warn"
+      },
+      "secretEnvironment": ["API_TOKEN"]
+    }
+  ]
+}
+```
+
+Restart Executor after editing the registry. In **Sources**, choose **MCP local
+template**, select the approved template, and enter every required secret. The
+template allowlist is a command-selection control, not a sandbox between
+Executor and the selected process. Every approved executable runs with
+Executor's operating-system identity and must be fully trusted.
+
+Protect the template file, executable, working directory, and every ancestor
+path from untrusted writes. Executor canonicalizes and validates configured
+targets when it loads the registry, but it does not enforce their ownership or
+permissions.
+
+The systemd and launchd installers create empty template registries at their
+documented service paths. Docker mounts the repository's empty example by
+default. Container templates must reference Linux executables available at the
+same absolute path inside the container.
+
+## Managed OAuth
+
+Managed OAuth supports eligible OpenAPI authorization-code schemes, the
+GraphQL `default` credential, and the HTTP MCP `default` credential. It uses
+authorization-code flow with PKCE and stores access and refresh tokens
+encrypted. This is OAuth 2 only. OpenID Connect and the `openid` scope are not
+supported.
+
+Before configuring OAuth, start Executor with the exact browser-facing origin:
+
+```sh
+executor server --public-origin https://executor.example.com
+```
+
+Or set:
+
+```sh
+EXECUTOR_PUBLIC_ORIGIN=https://executor.example.com
+```
+
+The value must be an origin only, with no path, query, fragment, or embedded
+credentials. It controls control-mutation Origin checks, MCP Host and Origin
+validation, cookie security, setup links, and OAuth callbacks. Keep Executor
+bound to loopback and terminate TLS at a local reverse proxy.
+
+Then:
+
+1. Import the source.
+2. Open its **Managed OAuth** panel.
+3. Choose the eligible credential and enter the provider issuer, client ID,
+   client authentication method, optional client secret, and requested scopes.
+   For HTTP MCP, provider discovery can begin from the MCP protected resource.
+4. Save the connection.
+5. Copy the callback URL displayed by Executor and register that exact URL with
+   the provider.
+6. Select **Connect OAuth** and finish authorization in the provider window.
+7. Return to the source and refresh its catalog if it was created before
+   authorization completed.
+
+Callback paths are connection-specific:
+
+```text
+/api/v1/oauth/callback/<connection-id>
+```
+
+Do not replace them with one shared callback path. If the provider revokes the
+grant or refresh fails, the dashboard marks the connection for
+reauthorization. Disconnecting removes active token material without deleting
+the source.
+
+## Tool modes and refresh
+
+Each tool has an intrinsic mode, an optional source override, and an optional
+tool override. Effective mode precedence is:
+
+1. Tool override
+2. Source override
+3. Intrinsic mode
+
+Enabled calls run immediately. Ask calls wait for the administrator under
+**Approvals**. Disabled tools stay visible to the administrator but are hidden
+from gateway search and cannot be invoked.
+
+Use **Refresh** after an upstream OpenAPI document, GraphQL schema, or MCP tool
+list changes. A failed refresh leaves the last successfully imported catalog
+in place. Deleting and recreating a source intentionally discards its stable
+tool identity and tombstone history.
diff --git a/docs/systemd.md b/docs/systemd.md
new file mode 100644
index 000000000..fa664d2e8
--- /dev/null
+++ b/docs/systemd.md
@@ -0,0 +1,210 @@
+# Linux systemd service
+
+Executor ships a hardened system service for Linux distributions that use
+systemd. It runs as a dedicated unprivileged `executor` account and listens on
+`127.0.0.1:4788` by default.
+
+## Install
+
+Install or download the Executor release binary, then run its embedded service
+installer:
+
+```sh
+sudo "$(command -v executor)" service install
+```
+
+Using the resolved path matters on first install because `sudo` commonly omits
+the user's `$HOME/.executor/bin` directory from its secure PATH. After the
+managed copy exists at `/usr/local/bin/executor`, ordinary `sudo executor ...`
+commands work.
+
+The release binary contains the hardened installer, unit, environment template,
+and master-key helper. A source checkout is not required.
+
+Use `--no-start` to inspect or customize the installed files before the first
+boot. If Executor is already running, the installer stops it before inspecting
+managed directories or files. `--no-start` deliberately leaves that service
+stopped.
+
+The installer is safe to run again during an upgrade. It replaces the binary
+and unit but never replaces the master key, environment file, or MCP stdio
+template registry. An existing master key must already be a non-symlinked,
+32-byte regular file owned by `executor:executor` with mode `0600` and exactly
+one hard link. A valid key is preserved byte-for-byte. A new key is generated
+inside a private root-only staging directory on the same filesystem. It gets
+its final ownership and mode there before an exact-destination hard link
+atomically publishes it at `master.key`.
+
+If installation or the readiness check fails after the service lifecycle is
+under its control, the installer leaves the service stopped. If systemd cannot
+stop it, the installer reports that explicitly instead of claiming a safe
+state. A private recovery marker distinguishes an interrupted managed-file
+replacement from unrelated files, so a manifest-publication failure can be
+fixed and safely retried. Rerun the installer after correcting the reported
+problem; do not start a partially installed service manually.
+
+The installed paths are:
+
+| Path                                     | Purpose                          | Ownership and mode          |
+| ---------------------------------------- | -------------------------------- | --------------------------- |
+| `/usr/local/bin/executor`                | Rust server and CLI binary       | `root:root`, `0755`         |
+| `/etc/systemd/system/executor.service`   | systemd unit                     | `root:root`, `0644`         |
+| `/etc/executor/executor.env`             | Non-secret service configuration | `root:executor`, `0640`     |
+| `/etc/executor/mcp-stdio-templates.json` | Approved local MCP commands      | `root:executor`, `0640`     |
+| `/etc/executor/service-install.manifest` | Managed-file ownership hashes    | `root:root`, `0600`         |
+| `/var/lib/executor`                      | SQLite state and protected data  | `executor:executor`, `0700` |
+| `/var/lib/executor/master.key`           | Raw 32-byte instance master key  | `executor:executor`, `0600` |
+
+For an external secret-manager key configured with
+`EXECUTOR_MASTER_KEY_FILE`, a root-owned `root:executor` file with mode `0440`
+or `0640` is also supported. Executor opens the file before accepting that
+shape, so the service account must actually have access through its groups.
+Symbolic links, non-regular files, extra hard links, other owners, and broader
+permissions are rejected.
+
+For the first boot with an external key, install without starting, place the
+key, configure its path, then start Executor:
+
+```sh
+sudo "$(command -v executor)" service install --no-start
+sudo install --owner root --group executor --mode 0640 \
+  /secure/source/executor-master.key /etc/executor/external-master.key
+sudoedit /etc/executor/executor.env
+# Set EXECUTOR_MASTER_KEY_FILE=/etc/executor/external-master.key
+sudo executor service start
+```
+
+The unit leaves `--master-key-file` unset, so this environment setting selects
+the external file. Without it, Executor uses `/var/lib/executor/master.key`.
+The example uses persistent protected configuration storage, so the key remains
+available after reboot. A secret manager may use an ephemeral runtime path only
+when its boot-time provisioning unit is ordered before `executor.service`.
+
+Back up the SQLite database and its selected key together. For the default key,
+stop the service and copy the complete `/var/lib/executor` directory, then start
+it again. Include an external key in that same stopped recovery snapshot when
+configured. Losing the selected key makes encrypted credentials and initialized
+instance state unrecoverable. Replacing the key while keeping the database
+makes startup fail closed. The installer refuses to invent a default key for an
+existing database.
+
+## First boot and operation
+
+The one-time setup URL is written to the journal on first boot:
+
+```sh
+sudo journalctl -u executor.service -b
+```
+
+Complete setup in a browser, then create API tokens in the dashboard. Routine
+service commands are:
+
+```sh
+executor service status
+sudo executor service restart
+sudo executor service stop
+sudo executor service start
+sudo journalctl -u executor.service -f
+```
+
+`service status` does not require root. It prints exactly `active` or
+`inactive`, exits 0 for active, and exits 3 for inactive. Operational failures
+exit 1. All mutating Linux service commands require `sudo` and fail before
+running systemctl when invoked without it.
+
+`systemctl stop` sends `SIGTERM`. Executor stops accepting work, cancels owned
+waits, drains upstream MCP processes and background tasks, closes SQLite, and
+then exits. systemd allows 90 seconds for this graceful path before forcing
+termination.
+
+## Public origin and reverse proxies
+
+The default unit is intentionally loopback-only. For a browser-facing reverse
+proxy, keep the bind address on loopback and set the exact external HTTPS
+origin in `/etc/executor/executor.env`:
+
+```sh
+EXECUTOR_PUBLIC_ORIGIN=https://executor.example.com
+```
+
+This origin controls browser origin checks, setup links, and managed OAuth
+callback URLs. It must contain only a scheme, host, and optional port.
+
+Only configure `EXECUTOR_TRUSTED_PROXIES` when Executor must use forwarded
+client addresses. List every proxy CIDR in the chain:
+
+```sh
+EXECUTOR_TRUSTED_PROXIES=127.0.0.1/32,::1/128
+```
+
+Restart the service after changing the environment file. Do not bind plaintext
+HTTP to a non-loopback address. Terminate HTTPS at the local reverse proxy or
+another explicitly trusted transport boundary.
+
+## Local MCP stdio templates
+
+Treat every approved MCP stdio executable as fully trusted with the complete
+Executor instance. It runs under the same operating-system account as Executor
+and can read the master key and database. The service-level sandbox limits what
+the combined service can reach, but it is not a security boundary between the
+Rust server and its stdio children. Do not approve untrusted executables.
+
+The installer creates an empty template registry at
+`/etc/executor/mcp-stdio-templates.json`. Start from
+`packaging/systemd/mcp-stdio-templates.example.json` when approving a local MCP
+server. Executables and working directories must use absolute paths and must be
+readable or executable by the `executor` account. Put secret values in the
+dashboard, not in the template or environment file.
+
+The unit applies `ProtectSystem=strict`, `ProtectHome=yes`, and `PrivateTmp=yes`
+to Executor and its MCP children. A child can read system paths, has private
+temporary directories, and can persist writes only within `/var/lib/executor`
+by default. Home directories are hidden. Grant only the paths a reviewed
+template needs with a systemd drop-in:
+
+```sh
+sudo systemctl edit executor.service
+```
+
+For example:
+
+```ini
+[Service]
+ReadOnlyPaths=/srv/reference-data
+ReadWritePaths=/srv/executor-workspace
+```
+
+Create those paths with ownership and modes appropriate for the `executor`
+account, then run:
+
+```sh
+sudo systemctl daemon-reload
+sudo systemctl restart executor.service
+```
+
+The service-level sandbox is inherited by every MCP stdio child. Do not weaken
+the whole unit when one child needs a narrow filesystem exception. Any
+supplemental groups assigned to the `executor` account are inherited too, so
+review those memberships as part of every template approval.
+
+## Upgrade or remove
+
+To upgrade, run `sudo "$(command -v executor)" service install` from the
+replacement binary. The service is stopped before managed state is inspected
+and started only after the new binary and unit are installed and the master key
+passes validation.
+
+To remove the unit and managed binary while preserving `/etc/executor`,
+`/var/lib/executor`, and the service account:
+
+```sh
+sudo executor service remove
+```
+
+The ownership manifest records hashes for the installed binary and unit.
+Lifecycle mutations fail before touching systemd if either file was replaced
+outside `service install`. Removal deletes the manifest but preserves all other
+configuration and state.
+
+Remove `/etc/executor`, `/var/lib/executor`, and the `executor` account only
+after making and verifying any required backup.
diff --git a/e2e/AGENTS.md b/e2e/AGENTS.md
index a77694871..dc9d6c011 100644
--- a/e2e/AGENTS.md
+++ b/e2e/AGENTS.md
@@ -106,14 +106,20 @@ expect(span.span.tags["executor.tool.outcome"]).toBe("fail");
 
 ```sh
 cd e2e
-bun run test               # boots both dev servers, runs everything
-bun run test:cloud         # one target
+bun run test               # runs the prepared Rust local-selfhost binary
+bun run test:legacy:cloud  # archived cloud target, explicit opt-in
 bun run ports              # print THIS checkout's derived ports
 # attach to an already-running server while iterating (use `bun run ports` URLs):
-E2E_CLOUD_URL=http://127.0.0.1:<port> ../node_modules/.bin/vitest run --project cloud <file>
-E2E_SELFHOST_URL=http://localhost:<port> ../node_modules/.bin/vitest run --project selfhost <file>
+E2E_CLOUD_URL=http://127.0.0.1:<port> ../node_modules/.bin/vitest run --config vitest.legacy.config.ts --project cloud <file>
+E2E_SELFHOST_URL=http://localhost:<port> ../node_modules/.bin/vitest run --config vitest.legacy.config.ts --project selfhost <file>
 ```
 
+From the repository root, `bun run test:e2e` is the complete active command:
+it builds the Svelte assets, compiles the Rust binary with those assets, and
+runs only the `local-selfhost` project. Do not use bare `vitest` for the active
+suite. Archived projects live in `vitest.legacy.config.ts` and are reachable
+only through the explicit legacy scripts.
+
 Ports are claimed at boot (see `src/ports.ts`): each checkout hashes its repo
 root to a preferred block, atomically locks it (a held lock port makes races
 impossible), and walks to the next free block if it's locked or squatted — so
diff --git a/e2e/cloud/auth-session.test.ts b/e2e/cloud/auth-session.test.ts
index 7d5e96be9..da9707484 100644
--- a/e2e/cloud/auth-session.test.ts
+++ b/e2e/cloud/auth-session.test.ts
@@ -19,7 +19,7 @@ const setCookieFor = (response: Response, name: string): string => {
 };
 
 // state = base64url(JSON { nonce, returnTo? }) — the app's login-state
-// envelope (apps/cloud/src/auth/login-state.ts).
+// envelope (legacy/cloud/src/auth/login-state.ts).
 const decodeLoginState = Schema.decodeUnknownOption(
   Schema.fromJsonString(
     Schema.Struct({ nonce: Schema.String, returnTo: Schema.optional(Schema.String) }),
diff --git a/e2e/cloud/mcp-client-sessions.test.ts b/e2e/cloud/mcp-client-sessions.test.ts
index 43f44eec6..b4eb29f40 100644
--- a/e2e/cloud/mcp-client-sessions.test.ts
+++ b/e2e/cloud/mcp-client-sessions.test.ts
@@ -4,7 +4,7 @@
 // session continuity here is real Durable Object state surviving across
 // client connections, not a stub.
 //
-// Ported from apps/cloud/src/mcp-miniflare.e2e.node.test.ts (unstable_dev +
+// Ported from legacy/cloud/src/mcp-miniflare.e2e.node.test.ts (unstable_dev +
 // test-seam bearers) onto the e2e dev server with real OAuth bearers.
 // Telemetry-span assertions from that file required injecting an OTLP
 // receiver into the worker env and were NOT carried (not black-box).
diff --git a/e2e/cloud/mcp-protocol.test.ts b/e2e/cloud/mcp-protocol.test.ts
index df81e067d..edff45420 100644
--- a/e2e/cloud/mcp-protocol.test.ts
+++ b/e2e/cloud/mcp-protocol.test.ts
@@ -5,7 +5,7 @@
 // real McpSessionDO, and real bearers minted from the authorization server the
 // product itself advertises (discovery → DCR → authorize → token).
 //
-// Ported from apps/cloud/src/mcp-flow.test.ts (workerd-pool SELF.fetch with
+// Ported from legacy/cloud/src/mcp-flow.test.ts (workerd-pool SELF.fetch with
 // test-seam bearers). DO-internal coverage from that file (forced runtime
 // eviction, idle-alarm firing, alarm scheduling, storage seeding) is clock /
 // internals dependent and intentionally NOT carried — only black-box
diff --git a/e2e/cloud/oauth-connections.test.ts b/e2e/cloud/oauth-connections.test.ts
index ff0a9c4d8..6d02c5261 100644
--- a/e2e/cloud/oauth-connections.test.ts
+++ b/e2e/cloud/oauth-connections.test.ts
@@ -5,7 +5,7 @@
 // product API while a real OAuth authorization server runs inside the scenario
 // on 127.0.0.1 (the dev server exchanges the code against it directly).
 //
-// Ported from apps/cloud/src/mcp/mcp-oauth.node.test.ts, extended to cover
+// Ported from legacy/cloud/src/mcp/mcp-oauth.node.test.ts, extended to cover
 // `complete` (the original stopped at the redirect).
 import { randomBytes } from "node:crypto";
 
diff --git a/e2e/cloud/sources-api.test.ts b/e2e/cloud/sources-api.test.ts
index 785fe3d09..f43365287 100644
--- a/e2e/cloud/sources-api.test.ts
+++ b/e2e/cloud/sources-api.test.ts
@@ -6,7 +6,7 @@
 // execution proves the whole chain: catalog row → connection → stamped tool →
 // QuickJS execution → live upstream request.
 //
-// Ported from apps/cloud/src/api/sources-api.node.test.ts. Cross-user
+// Ported from legacy/cloud/src/api/sources-api.node.test.ts. Cross-user
 // isolation of personal connections (alice/bob in one org) is NOT covered
 // here: minting a second member of an existing org has no public API surface.
 import { randomBytes } from "node:crypto";
diff --git a/e2e/cloud/sources-refresh.test.ts b/e2e/cloud/sources-refresh.test.ts
index fe2b70afd..2a736a291 100644
--- a/e2e/cloud/sources-refresh.test.ts
+++ b/e2e/cloud/sources-refresh.test.ts
@@ -5,7 +5,7 @@
 // whether the catalog row can be refreshed at all: a spec registered from a
 // URL can be re-fetched, a pasted blob cannot.
 //
-// Ported from apps/cloud/src/api/sources-refresh.node.test.ts. The upstream
+// Ported from legacy/cloud/src/api/sources-refresh.node.test.ts. The upstream
 // MCP server is a real HTTP server started inside the scenario on 127.0.0.1.
 import { randomBytes } from "node:crypto";
 import { createServer } from "node:http";
diff --git a/e2e/cloud/unauthenticated-skeleton.test.ts b/e2e/cloud/unauthenticated-skeleton.test.ts
index 77005df21..b940ccd21 100644
--- a/e2e/cloud/unauthenticated-skeleton.test.ts
+++ b/e2e/cloud/unauthenticated-skeleton.test.ts
@@ -4,7 +4,7 @@
 // AuthGate used to SSR the AUTHENTICATED app-shell skeleton (sidebar + card
 // grid) for every visitor and only swap to a login page after a client-side
 // `/account/me` 401 — signed-out users were shown an app they'd never reach.
-// Now the SSR auth gate (apps/cloud/src/auth/ssr-gate.ts) verifies the sealed
+// Now the SSR auth gate (legacy/cloud/src/auth/ssr-gate.ts) verifies the sealed
 // session cookie in the worker and 302s signed-out document requests to
 // /login (carrying ?returnTo=), so the app shell never exists for them.
 import { expect } from "@effect/vitest";
diff --git a/e2e/desktop/local-auth-mcp.test.ts b/e2e/desktop/local-auth-mcp.test.ts
index a0ca14ee5..99f3919ca 100644
--- a/e2e/desktop/local-auth-mcp.test.ts
+++ b/e2e/desktop/local-auth-mcp.test.ts
@@ -33,7 +33,7 @@ import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/
 import { scenario } from "../src/scenario";
 import { RunDir } from "../src/services";
 
-const appDir = fileURLToPath(new URL("../../apps/desktop/", import.meta.url));
+const appDir = fileURLToPath(new URL("../../legacy/desktop/", import.meta.url));
 const electronBinary = createRequire(join(appDir, "package.json"))("electron") as string;
 
 const APPROVAL_TARGET_TOOL = "executor.coreTools.policies.list";
diff --git a/e2e/desktop/reset-state.test.ts b/e2e/desktop/reset-state.test.ts
index 534b28401..f778ab5a7 100644
--- a/e2e/desktop/reset-state.test.ts
+++ b/e2e/desktop/reset-state.test.ts
@@ -19,7 +19,7 @@ import { _electron } from "playwright";
 import { scenario } from "../src/scenario";
 import { RunDir } from "../src/services";
 
-const appDir = fileURLToPath(new URL("../../apps/desktop/", import.meta.url));
+const appDir = fileURLToPath(new URL("../../legacy/desktop/", import.meta.url));
 const electronBinary = createRequire(join(appDir, "package.json"))("electron") as string;
 
 const CORRUPT_MARKER = "executor-e2e-corrupted-db";
diff --git a/e2e/desktop/sidecar-crash-screen.test.ts b/e2e/desktop/sidecar-crash-screen.test.ts
index 66433064c..9872f42ec 100644
--- a/e2e/desktop/sidecar-crash-screen.test.ts
+++ b/e2e/desktop/sidecar-crash-screen.test.ts
@@ -20,10 +20,10 @@ import { _electron } from "playwright";
 import { scenario } from "../src/scenario";
 import { RunDir } from "../src/services";
 
-const appDir = fileURLToPath(new URL("../../apps/desktop/", import.meta.url));
+const appDir = fileURLToPath(new URL("../../legacy/desktop/", import.meta.url));
 
 // require("electron") resolves to the binary path (electron's index.js
-// exports it) — resolved from apps/desktop so we get the app's pinned
+// exports it), resolved from legacy/desktop so we get the app's pinned
 // version out of the workspace store.
 const electronBinary = createRequire(join(appDir, "package.json"))("electron") as string;
 
diff --git a/e2e/desktop/traffic-light-overlap.test.ts b/e2e/desktop/traffic-light-overlap.test.ts
index 7d05cc9ac..db7c28ccf 100644
--- a/e2e/desktop/traffic-light-overlap.test.ts
+++ b/e2e/desktop/traffic-light-overlap.test.ts
@@ -1,6 +1,6 @@
 // Regression for issue #1125: on the macOS desktop app the native traffic-light
 // window controls are drawn over the frameless web content at
-// trafficLightPosition {x:16,y:17} (apps/desktop/src/main/index.ts) — three
+// trafficLightPosition {x:16,y:17} (legacy/desktop/src/main/index.ts) — three
 // 12px buttons with 20px center spacing, occupying x ∈ [16, 68].
 //
 // The original bug: the window minWidth was 720 but the web layout switches to
@@ -40,7 +40,7 @@ import { _electron, type ElectronApplication, type Locator, type Page } from "pl
 import { scenario } from "../src/scenario";
 import { RunDir } from "../src/services";
 
-const appDir = fileURLToPath(new URL("../../apps/desktop/", import.meta.url));
+const appDir = fileURLToPath(new URL("../../legacy/desktop/", import.meta.url));
 const electronBinary = createRequire(join(appDir, "package.json"))("electron") as string;
 
 // Rightmost edge of the traffic-light cluster (left edges 16/36/56, +12px) plus
diff --git a/e2e/fixtures/stdio-mcp-server.mjs b/e2e/fixtures/stdio-mcp-server.mjs
new file mode 100644
index 000000000..ed950db09
--- /dev/null
+++ b/e2e/fixtures/stdio-mcp-server.mjs
@@ -0,0 +1,29 @@
+import { createHash } from "node:crypto";
+
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+
+const server = new McpServer(
+  { name: "executor-e2e-stdio", version: "1.0.0" },
+  { capabilities: {} },
+);
+
+server.registerTool(
+  "secret_status",
+  {
+    description: "Reports whether Executor supplied the configured template secret",
+    inputSchema: {},
+  },
+  async () => ({
+    content: [
+      {
+        type: "text",
+        text: `secret-sha256:${createHash("sha256")
+          .update(process.env.EXECUTOR_E2E_STDIO_SECRET ?? "")
+          .digest("hex")}`,
+      },
+    ],
+  }),
+);
+
+await server.connect(new StdioServerTransport());
diff --git a/e2e/local-selfhost/core-journeys.test.ts b/e2e/local-selfhost/core-journeys.test.ts
new file mode 100644
index 000000000..040308768
--- /dev/null
+++ b/e2e/local-selfhost/core-journeys.test.ts
@@ -0,0 +1,2657 @@
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+
+import { expect } from "@effect/vitest";
+import { createEmulator, type Emulator, type LedgerEntry } from "@executor-js/emulate";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import {
+  makeGreetingGraphqlSchema,
+  serveGraphqlTestServer,
+} from "@executor-js/plugin-graphql/testing";
+import { makeGreetingMcpServer, serveMcpServer } from "@executor-js/plugin-mcp/testing";
+import { serveOpenApiEchoTestServer } from "@executor-js/plugin-openapi/testing";
+import { Effect, Predicate } from "effect";
+import type { Page } from "playwright";
+
+import { scenario } from "../src/scenario";
+import { LocalAdminClient, type LocalSource, type LocalToken } from "../src/local-admin";
+import {
+  expectLocatorChecked,
+  expectLocatorCount,
+  expectLocatorDisabled,
+  expectLocatorFocused,
+  expectLocatorText,
+  expectLocatorValue,
+  expectLocatorVisible,
+} from "../src/locator-assertions";
+import { approveOAuthTestAuthorization, serveOAuthTestProvider } from "../src/oauth-test-provider";
+import { e2ePort } from "../src/ports";
+import { Browser, Target } from "../src/services";
+import { openConnectSourcePanel } from "../src/source-panel";
+import { LOCAL_ADMIN, LOCAL_SETUP_BASE_URL } from "../targets/local-selfhost";
+
+const unique = (prefix: string) => `${prefix}-${randomBytes(4).toString("hex")}`;
+const executeFile = promisify(execFile);
+const emulatorPortA = e2ePort("E2E_LOCAL_EMULATOR_A_PORT", 6);
+const emulatorPortB = e2ePort("E2E_LOCAL_EMULATOR_B_PORT", 7);
+const emulatorPortC = e2ePort("E2E_LOCAL_EMULATOR_C_PORT", 8);
+const sourceCreateStorageKey = "executor.source-create.idempotency-key.v1";
+
+const sourceCreateStorageValue = (page: Page) =>
+  page.evaluate((key) => sessionStorage.getItem(key), sourceCreateStorageKey);
+
+const isSuccessfulMcpToolCall = (entry: LedgerEntry) => {
+  const body = entry.request.body;
+  return (
+    entry.path === "/mcp" &&
+    entry.response.status === 200 &&
+    typeof body === "object" &&
+    body !== null &&
+    "method" in body &&
+    body.method === "tools/call"
+  );
+};
+
+const adminClient = (baseUrl: string) =>
+  Effect.promise(() =>
+    LocalAdminClient.signIn(baseUrl, LOCAL_ADMIN.username, LOCAL_ADMIN.password),
+  );
+
+const isLocalToken = (value: unknown): value is LocalToken =>
+  typeof value === "object" &&
+  value !== null &&
+  "id" in value &&
+  typeof value.id === "string" &&
+  "token" in value &&
+  typeof value.token === "string";
+
+const resendEmulator = Effect.acquireRelease(
+  Effect.promise(() => createEmulator({ service: "resend", port: emulatorPortA })),
+  (emulator: Emulator) => Effect.promise(() => emulator.close()).pipe(Effect.ignore),
+);
+
+const githubEmulator = Effect.acquireRelease(
+  Effect.promise(() => createEmulator({ service: "github", port: emulatorPortA })),
+  (emulator: Emulator) => Effect.promise(() => emulator.close()).pipe(Effect.ignore),
+);
+
+const deleteSources = (client: LocalAdminClient, sources: readonly LocalSource[]) =>
+  Effect.forEach(sources, (source) =>
+    Effect.promise(() => client.deleteSource(source.id)).pipe(Effect.ignore),
+  ).pipe(Effect.asVoid);
+
+const deleteSourcesNamed = (client: LocalAdminClient, names: readonly string[]) =>
+  Effect.gen(function* () {
+    const sources = yield* Effect.promise(() => client.listSources());
+    yield* deleteSources(
+      client,
+      sources.sources.filter((source) => names.includes(source.displayName)),
+    );
+  });
+
+const acquireToken = (client: LocalAdminClient, baseUrl: string, name: string) =>
+  Effect.acquireRelease(
+    Effect.promise(() => client.createToken(name)),
+    (token) =>
+      Effect.gen(function* () {
+        yield* Effect.promise(() =>
+          client.revokeToken(token.id).then(
+            () => undefined,
+            () => undefined,
+          ),
+        );
+        const gatewayStatus = yield* Effect.promise(() =>
+          fetch(new URL("/api/v1/gateway/tools/invoke", baseUrl), {
+            method: "POST",
+            headers: {
+              authorization: `Bearer ${token.token}`,
+              "content-type": "application/json",
+            },
+            body: JSON.stringify({ path: "tools.revoked.probe", arguments: {} }),
+          }).then(
+            (response) => response.status,
+            () => 0,
+          ),
+        );
+        if (gatewayStatus !== 401) {
+          return yield* Effect.die(`token cleanup left ${token.id} authorized`);
+        }
+      }),
+  );
+
+const prepareInlineOpenApiSource = async (page: Page, document: string, displayName: string) => {
+  await page.goto("/sources");
+  await openConnectSourcePanel(page);
+  await page.getByRole("group", { name: "Source type" }).getByLabel("OpenAPI service").check();
+  await page.getByLabel("Paste document").check();
+  await page.getByLabel("OpenAPI JSON or YAML").fill(document);
+  await page.getByLabel("Allow private network addresses for this source").check();
+  await page.getByRole("button", { name: "Preview tools" }).click();
+  await expectLocatorVisible(page.getByLabel("Source name"));
+  await page.getByLabel("Source name").fill(displayName);
+};
+
+const minimalOpenApiDocument = (origin: string, title: string) =>
+  JSON.stringify({
+    openapi: "3.1.0",
+    info: { title, version: "1.0.0" },
+    servers: [{ url: origin }],
+    paths: {
+      "/zen": {
+        get: {
+          operationId: "readZen",
+          summary: "Read Zen",
+          responses: { "200": { description: "OK" } },
+        },
+      },
+    },
+  });
+
+const staticAuthOpenApiDocument = (githubOrigin: string, spotifyOrigin: string) =>
+  JSON.stringify({
+    openapi: "3.1.0",
+    info: { title: "Executor authentication evidence", version: "1.0.0" },
+    servers: [{ url: githubOrigin }],
+    components: {
+      securitySchemes: {
+        basicAuth: { type: "http", scheme: "basic" },
+        apiKeyAuth: { type: "apiKey", in: "header", name: "X-Executor-E2E-Key" },
+        manualOAuth: {
+          type: "oauth2",
+          flows: {
+            authorizationCode: {
+              authorizationUrl: `${githubOrigin}/login/oauth/authorize`,
+              tokenUrl: `${githubOrigin}/login/oauth/access_token`,
+              scopes: { repo: "Read repositories" },
+            },
+          },
+        },
+      },
+    },
+    paths: {
+      "/api/token": {
+        post: {
+          operationId: "exchangeClientCredentialsWithBasic",
+          summary: "Exchange client credentials with Basic",
+          servers: [{ url: spotifyOrigin }],
+          security: [{ basicAuth: [] }],
+          requestBody: {
+            required: true,
+            content: {
+              "application/json": {
+                schema: {
+                  type: "object",
+                  properties: {
+                    grant_type: { type: "string", enum: ["client_credentials"] },
+                  },
+                  required: ["grant_type"],
+                  additionalProperties: false,
+                },
+              },
+            },
+          },
+          responses: { "200": { description: "OK" } },
+        },
+      },
+      "/meta": {
+        get: {
+          operationId: "readMetaWithApiKey",
+          summary: "Read metadata with API key",
+          security: [{ apiKeyAuth: [] }],
+          responses: { "200": { description: "OK" } },
+        },
+      },
+      "/user": {
+        get: {
+          operationId: "readCurrentUserWithManualToken",
+          summary: "Read current user with manual token",
+          security: [{ manualOAuth: ["repo"] }],
+          responses: { "200": { description: "OK" } },
+        },
+      },
+    },
+  });
+
+const registerMcpOAuthClient = async (issuer: string, redirectUri: string) => {
+  const response = await fetch(`${issuer}/register`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({
+      client_name: "Executor browser e2e",
+      redirect_uris: [redirectUri],
+      grant_types: ["authorization_code"],
+      response_types: ["code"],
+      token_endpoint_auth_method: "none",
+    }),
+  });
+  if (!response.ok) throw new Error(`MCP emulator client registration failed (${response.status})`);
+  const registration = (await response.json()) as { readonly client_id?: string };
+  if (!registration.client_id) {
+    throw new Error("MCP emulator client registration returned no client_id");
+  }
+  return registration.client_id;
+};
+
+scenario(
+  "First boot · the one-time setup link creates the only administrator",
+  {},
+  Effect.gen(function* () {
+    const browser = yield* Browser;
+    const setupToken = process.env.E2E_LOCAL_SETUP_TOKEN;
+    if (!setupToken) return yield* Effect.die("the fresh setup instance did not publish a token");
+
+    yield* browser.privateSession({ label: "first-boot administrator" }, async ({ page, step }) => {
+      await step("Open the one-time setup link and create the administrator", async () => {
+        await page.goto(`${LOCAL_SETUP_BASE_URL}/setup#token=${encodeURIComponent(setupToken)}`);
+        await expect.poll(() => new URL(page.url()).hash).toBe("");
+        await page.getByLabel("Administrator username").fill("first-boot-admin");
+        await page.getByLabel(/^Password\b/).fill("first-boot-password-123");
+        await page.getByLabel("Confirm password").fill("first-boot-password-123");
+        await page.getByRole("button", { name: "Create administrator" }).click();
+        await page.waitForURL((url) => url.pathname === "/sources");
+        await expectLocatorVisible(page.getByRole("heading", { name: "Sources" }));
+      });
+    });
+    const replay = yield* Effect.promise(() =>
+      fetch(new URL("/api/v1/setup", LOCAL_SETUP_BASE_URL), {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          origin: new URL(LOCAL_SETUP_BASE_URL).origin,
+        },
+        body: JSON.stringify({
+          setupToken,
+          username: "second-admin",
+          password: "second-admin-password-123",
+        }),
+      }),
+    );
+    expect(replay.status, "the consumed setup token cannot create another administrator").toBe(409);
+  }),
+);
+
+scenario(
+  "Administrator access · sign-in creates a gateway token without exposing it twice",
+  {},
+  Effect.gen(function* () {
+    const target = yield* Target;
+    const browser = yield* Browser;
+    const client = yield* adminClient(target.baseUrl);
+    const tokenNames = [unique("E2E local agent"), unique("E2E local agent")] as const;
+    const createdTokens: Array<LocalToken | undefined> = [];
+    const tokenCreationGates = tokenNames.map(() => {
+      let release = () => {};
+      const wait = new Promise<void>((resolve) => {
+        release = resolve;
+      });
+      let requestStarted = false;
+      let markStarted = () => {};
+      const started = new Promise<void>((resolve) => {
+        markStarted = resolve;
+      });
+      let markSettled = () => {};
+      const settled = new Promise<void>((resolve) => {
+        markSettled = resolve;
+      });
+      return {
+        wait,
+        started,
+        settled,
+        release: () => release(),
+        markStarted: () => {
+          requestStarted = true;
+          markStarted();
+        },
+        markSettled: () => markSettled(),
+        hasStarted: () => requestStarted,
+      };
+    });
+
+    expect(tokenNames[0], "sequential runs use different exact names").not.toBe(tokenNames[1]);
+
+    yield* Effect.ensuring(
+      Effect.gen(function* () {
+        yield* browser.privateSession(
+          { label: "signed-out administrator" },
+          async ({ page, step }) => {
+            const sessionDeletes: string[] = [];
+            let tokenCreationIndex = 0;
+            let unexpectedTokenPosts = 0;
+
+            page.on("request", (request) => {
+              const url = new URL(request.url());
+              if (request.method() === "DELETE" && url.pathname === "/api/v1/session") {
+                sessionDeletes.push(request.url());
+              }
+            });
+            await page.route("**/api/v1/tokens", async (route) => {
+              if (route.request().method() !== "POST") {
+                await route.continue();
+                return;
+              }
+              const index = tokenCreationIndex++;
+              const gate = tokenCreationGates[index];
+              if (gate === undefined) {
+                unexpectedTokenPosts += 1;
+                await route.abort("failed");
+                return;
+              }
+              gate.markStarted();
+              try {
+                await gate.wait;
+                const response = await route.fetch();
+                const body: unknown = await response.json();
+                if (!isLocalToken(body)) {
+                  throw new Error("token creation returned an invalid response");
+                }
+                createdTokens[index] = body;
+                expect(response.status(), "the token API created one credential").toBe(201);
+                await route.fulfill({ response });
+              } finally {
+                gate.markSettled();
+              }
+            });
+
+            await step("Sign in and open gateway token management", async () => {
+              await page.goto("/login");
+              await page.getByLabel("Username").fill(LOCAL_ADMIN.username);
+              await page.getByLabel("Password").fill(LOCAL_ADMIN.password);
+              await page.getByRole("button", { name: "Sign in" }).click();
+              await page.waitForURL((url) => url.pathname === "/sources");
+              await page.goto("/tokens");
+              await expectLocatorVisible(page.getByRole("heading", { name: "API tokens" }));
+            });
+
+            const createAndDismissToken = async (index: number) => {
+              const tokenName = tokenNames[index];
+              const gate = tokenCreationGates[index];
+              if (tokenName === undefined || gate === undefined) {
+                throw new Error("token creation run is missing its unique fixture");
+              }
+              await page.getByLabel("Token name").fill(tokenName);
+              try {
+                await page.getByRole("button", { name: "Create token" }).click();
+                await gate.started;
+                await expectLocatorDisabled(
+                  page.getByRole("button", { name: "Creating token..." }),
+                );
+                await page.getByRole("button", { name: "Sign out" }).click();
+                await expectLocatorVisible(
+                  page.getByRole("status").filter({
+                    hasText:
+                      "Wait for token creation to finish before leaving this page or signing out.",
+                  }),
+                );
+                expect(
+                  sessionDeletes,
+                  "blocked sign-out does not destroy the administrator session",
+                ).toHaveLength(0);
+                expect(
+                  new URL(page.url()).pathname,
+                  "the guarded page stays open during creation",
+                ).toBe("/tokens");
+              } finally {
+                gate.release();
+                if (gate.hasStarted()) await gate.settled;
+              }
+
+              await expectLocatorVisible(page.getByLabel("API token"));
+              const secret = await page.getByLabel("API token").inputValue();
+              const created = createdTokens[index];
+              if (created === undefined) throw new Error("created token ID was not captured");
+              expect(secret.slice(0, 4), "the revealed token has the gateway prefix").toBe("exr_");
+              expect(
+                createHash("sha256").update(secret).digest("hex"),
+                "the one-time reveal matches the captured response without logging the secret",
+              ).toBe(createHash("sha256").update(created.token).digest("hex"));
+              expect(
+                created.id.length,
+                "the exact created token ID is retained for cleanup",
+              ).toBeGreaterThan(0);
+
+              await page.getByRole("button", { name: "Sign out" }).click();
+              await expectLocatorVisible(
+                page.getByRole("status").filter({
+                  hasText:
+                    "Save the token and choose “I saved it” before leaving this page or signing out.",
+                }),
+              );
+              expect(sessionDeletes, "the unsaved reveal blocks session deletion too").toHaveLength(
+                0,
+              );
+              expect(
+                new URL(page.url()).pathname,
+                "the revealed secret remains on the guarded page",
+              ).toBe("/tokens");
+              await page.getByRole("button", { name: "I saved it" }).click();
+              await expectLocatorCount(page.getByLabel("API token"), 0);
+            };
+
+            await step("Create and safely dismiss the first unique token", async () => {
+              await createAndDismissToken(0);
+            });
+            await step("Create and safely dismiss the second unique token", async () => {
+              await createAndDismissToken(1);
+            });
+            await step("Sign out only after both one-time reveals are gone", async () => {
+              const sessionDelete = page.waitForRequest((request) => {
+                const url = new URL(request.url());
+                return request.method() === "DELETE" && url.pathname === "/api/v1/session";
+              });
+              await page.getByRole("button", { name: "Sign out" }).click();
+              await sessionDelete;
+              await page.waitForURL((url) => url.pathname === "/login");
+              expect(
+                sessionDeletes,
+                "acknowledgement permits exactly one session deletion",
+              ).toHaveLength(1);
+              expect(unexpectedTokenPosts, "two runs issued exactly two token POSTs").toBe(0);
+            });
+          },
+        );
+
+        expect(
+          createdTokens.filter(Predicate.isNotUndefined),
+          "both sequential runs captured their exact token IDs",
+        ).toHaveLength(2);
+        const identity = yield* target.newIdentity();
+        yield* browser.session(identity, async ({ page, step }) => {
+          try {
+            await step("See only masked metadata for both exact unique token rows", async () => {
+              await page.goto("/tokens");
+              for (const tokenName of tokenNames) {
+                const exactName = page.getByText(tokenName, { exact: true });
+                const row = page.locator("tbody tr").filter({ has: exactName });
+                await expectLocatorCount(row, 1, `${tokenName} selects one repeat-safe row`);
+                await expectLocatorText(row.locator('td[data-label="Status"]'), "Active");
+                await expectLocatorText(row.locator('td[data-label="Token"] code'), "...");
+              }
+            });
+            await step("Revoke one exact token from the dashboard", async () => {
+              const tokenName = tokenNames[0];
+              const token = createdTokens[0];
+              if (token === undefined) throw new Error("the first created token was not captured");
+              const row = page.locator("tbody tr").filter({
+                has: page.getByText(tokenName, { exact: true }),
+              });
+              await row.getByRole("button", { name: `Revoke ${tokenName}` }).click();
+              const confirmation = page.getByRole("dialog", {
+                name: `Stop using ${tokenName}?`,
+              });
+              await expectLocatorVisible(confirmation);
+              await confirmation.getByRole("button", { name: "Revoke token" }).click();
+              await expectLocatorText(row.locator('td[data-label="Status"]'), "Revoked");
+
+              const rejected = await fetch(
+                new URL("/api/v1/gateway/tools/invoke", target.baseUrl),
+                {
+                  method: "POST",
+                  headers: {
+                    authorization: `Bearer ${token.token}`,
+                    "content-type": "application/json",
+                  },
+                  body: JSON.stringify({ path: "tools.revoked.probe", arguments: {} }),
+                },
+              );
+              expect(rejected.status, "dashboard revocation immediately rejects the token").toBe(
+                401,
+              );
+            });
+          } finally {
+            await step("End the recorded administrator session", async () => {
+              const csrf = identity.cookies?.find(
+                (cookie) => cookie.name === "executor_csrf",
+              )?.value;
+              if (csrf === undefined) {
+                throw new Error("the recorded administrator identity has no CSRF cookie");
+              }
+              const response = await fetch(new URL("/api/v1/session", target.baseUrl), {
+                method: "DELETE",
+                headers: {
+                  ...identity.headers,
+                  origin: new URL(target.baseUrl).origin,
+                  "x-executor-csrf": csrf,
+                },
+              });
+              expect(
+                response.status,
+                "the traced administrator cookie is invalidated before artifacts close",
+              ).toBe(204);
+              await page.goto("/login");
+              await expectLocatorVisible(page.getByLabel("Username"));
+            });
+          }
+        });
+      }),
+      Effect.gen(function* () {
+        for (const gate of tokenCreationGates) gate.release();
+        yield* Effect.promise(() =>
+          Promise.all(
+            tokenCreationGates.filter((gate) => gate.hasStarted()).map((gate) => gate.settled),
+          ),
+        );
+        const captured = createdTokens.filter(Predicate.isNotUndefined);
+        const outcomes = yield* Effect.forEach(
+          captured,
+          (token) =>
+            Effect.promise(async () => {
+              await client.revokeToken(token.id).then(
+                () => undefined,
+                () => undefined,
+              );
+              const gatewayStatus = await fetch(
+                new URL("/api/v1/gateway/tools/invoke", target.baseUrl),
+                {
+                  method: "POST",
+                  headers: {
+                    authorization: `Bearer ${token.token}`,
+                    "content-type": "application/json",
+                  },
+                  body: JSON.stringify({ path: "tools.revoked.probe", arguments: {} }),
+                },
+              ).then(
+                (response) => response.status,
+                () => 0,
+              );
+              return { id: token.id, gatewayStatus };
+            }),
+          { concurrency: "unbounded" },
+        );
+        createdTokens.length = 0;
+        for (const outcome of outcomes) {
+          expect(
+            outcome.gatewayStatus,
+            `captured token ${outcome.id} is revoked and unauthorized`,
+          ).toBe(401);
+        }
+      }),
+    );
+  }),
+);
+
+scenario(
+  "Sources · OpenAPI, GraphQL, and MCP join one local catalog",
+  { timeout: 180_000 },
+  Effect.scoped(
+    Effect.gen(function* () {
+      const target = yield* Target;
+      const browser = yield* Browser;
+      const client = yield* adminClient(target.baseUrl);
+      const resend = yield* resendEmulator;
+      const graphql = yield* serveGraphqlTestServer({
+        schema: makeGreetingGraphqlSchema({ includeMutation: false }),
+      });
+      const mcp = yield* serveMcpServer(() =>
+        makeGreetingMcpServer({ name: unique("mcp"), text: "hello from local MCP" }),
+      );
+      const suffix = randomBytes(3).toString("hex");
+      const created: LocalSource[] = [];
+
+      yield* Effect.ensuring(
+        Effect.gen(function* () {
+          created.push(
+            yield* Effect.promise(() =>
+              client.createSource({
+                kind: "openapi",
+                displayName: `Resend emulator ${suffix}`,
+                spec: { type: "url", url: resend.openapiUrl },
+                allowPrivateNetwork: true,
+              }),
+            ),
+          );
+          created.push(
+            yield* Effect.promise(() =>
+              client.createSource({
+                kind: "graphql",
+                displayName: `GraphQL greeting ${suffix}`,
+                endpoint: graphql.endpoint,
+                allowPrivateNetwork: true,
+              }),
+            ),
+          );
+          created.push(
+            yield* Effect.promise(() =>
+              client.createSource({
+                kind: "mcp_http",
+                displayName: `MCP greeting ${suffix}`,
+                endpoint: mcp.endpoint,
+                allowPrivateNetwork: true,
+              }),
+            ),
+          );
+
+          const token = yield* acquireToken(client, target.baseUrl, unique("source-agent"));
+          for (const source of created.slice(1)) {
+            const catalog = yield* Effect.promise(() => client.listTools({ sourceId: source.id }));
+            expect(
+              catalog.items.length,
+              `${source.displayName} discovers at least one tool`,
+            ).toBeGreaterThan(0);
+            const enabled = yield* Effect.promise(() =>
+              client.setToolMode(catalog.items[0]!, "enabled"),
+            );
+            const argumentsForTool = source.id === created[1]?.id ? { name: "Ada" } : {};
+            const invoked = yield* Effect.promise(() =>
+              fetch(new URL("/api/v1/gateway/tools/invoke", target.baseUrl), {
+                method: "POST",
+                headers: {
+                  authorization: `Bearer ${token.token}`,
+                  "content-type": "application/json",
+                },
+                body: JSON.stringify({ path: enabled.callablePath, arguments: argumentsForTool }),
+              }),
+            );
+            expect(invoked.status, `${source.displayName} executes through the gateway`).toBe(200);
+          }
+          const graphqlRequests = yield* graphql.requests;
+          expect(
+            graphqlRequests.filter((request) => !request.payload.query?.includes("__schema")),
+            "the GraphQL resolver received a non-introspection call",
+          ).not.toHaveLength(0);
+          const mcpRequests = yield* mcp.requests;
+          expect(
+            mcpRequests.length,
+            "the MCP server received discovery and invocation traffic",
+          ).toBeGreaterThanOrEqual(2);
+
+          const identity = yield* target.newIdentity();
+          yield* browser.session(identity, async ({ page, step }) => {
+            await step("Open Sources and see every supported protocol", async () => {
+              await page.goto("/sources");
+              const sourceProtocols = [
+                [created[0], /^OpenAPI · /],
+                [created[1], /^GraphQL · /],
+                [created[2], /^MCP HTTP · /],
+              ] as const;
+              for (const [source, protocol] of sourceProtocols) {
+                if (source === undefined) {
+                  throw new Error("the protocol source fixture was not created");
+                }
+                const card = page.getByRole("article", {
+                  name: source.displayName,
+                  exact: true,
+                });
+                const label = card.getByText(protocol);
+                await label.scrollIntoViewIfNeeded();
+                await expectLocatorVisible(label);
+              }
+            });
+          });
+        }),
+        deleteSources(client, created),
+      );
+    }),
+  ),
+);
+
+scenario(
+  "Sources dashboard · every protocol, static auth family, and managed OAuth work end to end",
+  { timeout: 180_000 },
+  Effect.scoped(
+    Effect.gen(function* () {
+      const target = yield* Target;
+      const browser = yield* Browser;
+      const client = yield* adminClient(target.baseUrl);
+      const githubToken = unique("github-token");
+      const mcpToken = unique("mcp-token");
+      const spotifyClientId = unique("spotify-client");
+      const basicPassword = unique("basic-password");
+      const apiKey = unique("api-key");
+      const stdioSecret = unique("stdio-secret");
+      const stdioSecretDigest = createHash("sha256").update(stdioSecret).digest("hex");
+      const github = yield* Effect.acquireRelease(
+        Effect.promise(() =>
+          createEmulator({
+            service: "github",
+            port: emulatorPortA,
+            seed: {
+              tokens: { [githubToken]: { login: "octocat", scopes: ["repo"] } },
+              github: {
+                users: [{ login: "octocat", name: "The Octocat", email: "octocat@example.test" }],
+              },
+            },
+          }),
+        ),
+        (emulator) => Effect.promise(() => emulator.close()).pipe(Effect.ignore),
+      );
+      const staticMcp = yield* Effect.acquireRelease(
+        Effect.promise(() =>
+          createEmulator({
+            service: "mcp",
+            port: emulatorPortB,
+            baseUrl: `http://127.0.0.1:${emulatorPortB}`,
+            seed: {
+              tokens: { [mcpToken]: { login: "admin", scopes: ["repo", "read:user"] } },
+            },
+          }),
+        ),
+        (emulator) => Effect.promise(() => emulator.close()).pipe(Effect.ignore),
+      );
+      const spotify = yield* Effect.acquireRelease(
+        Effect.promise(() =>
+          createEmulator({
+            service: "spotify",
+            port: emulatorPortC,
+            seed: {
+              spotify: {
+                clients: [
+                  {
+                    client_id: spotifyClientId,
+                    client_secret: basicPassword,
+                    name: "Executor browser e2e",
+                  },
+                ],
+              },
+            },
+          }),
+        ),
+        (emulator) => Effect.promise(() => emulator.close()).pipe(Effect.ignore),
+      );
+      const provider = {
+        issuer: staticMcp.url,
+        endpoint: `${staticMcp.url}/mcp`,
+        registerClient: (redirectUri: string) => registerMcpOAuthClient(staticMcp.url, redirectUri),
+        approveAuthorization: (authorizationUrl: string, login: string) =>
+          approveOAuthTestAuthorization(staticMcp.url, authorizationUrl, login),
+        ledger: () => staticMcp.ledger.list(),
+      };
+      const suffix = randomBytes(3).toString("hex");
+      const names = {
+        openapi: `Browser OpenAPI ${suffix}`,
+        graphql: `Browser GraphQL ${suffix}`,
+        mcpHttp: `Browser MCP HTTP ${suffix}`,
+        mcpStdio: `Browser MCP stdio ${suffix}`,
+        managedOAuth: `Browser managed OAuth ${suffix}`,
+      } as const;
+      const createdNames = Object.values(names);
+
+      yield* Effect.ensuring(
+        Effect.gen(function* () {
+          const identity = yield* target.newIdentity();
+          yield* browser.privateSession(identity, async ({ page, step }) => {
+            await step("Import OpenAPI with Basic, API key, and a manual OAuth token", async () => {
+              await prepareInlineOpenApiSource(
+                page,
+                staticAuthOpenApiDocument(github.url, spotify.url),
+                names.openapi,
+              );
+              await page.getByRole("checkbox", { name: /basicAuth/ }).check();
+              await page.getByLabel("Username").fill(spotifyClientId);
+              await page.getByLabel("Basic auth", { exact: true }).fill(basicPassword);
+              await page.getByRole("checkbox", { name: /apiKeyAuth/ }).check();
+              await page.getByLabel("API key", { exact: true }).fill(apiKey);
+              await page.getByRole("checkbox", { name: /manualOAuth/ }).check();
+              await page
+                .getByLabel("OAuth access token (manual, advanced)", { exact: true })
+                .fill(githubToken);
+              await page.getByRole("button", { name: "Import source" }).click();
+              await expectLocatorVisible(page.getByRole("heading", { name: names.openapi }));
+            });
+
+            await step("Connect GraphQL with a bearer token", async () => {
+              await page.goto("/sources");
+              await openConnectSourcePanel(page);
+              await page
+                .getByRole("group", { name: "Source type" })
+                .getByLabel("GraphQL API")
+                .check();
+              await page.getByLabel("Endpoint").fill(`${github.url}/graphql`);
+              await page.getByLabel("Source name").fill(names.graphql);
+              await page.getByLabel("Allow private network addresses for this source").check();
+              await page.getByLabel("Method").selectOption("bearer");
+              await page.getByLabel("Bearer token", { exact: true }).fill(githubToken);
+              await page.getByRole("button", { name: "Connect source" }).click();
+              await expectLocatorVisible(page.getByRole("heading", { name: names.graphql }));
+            });
+
+            await step("Connect MCP HTTP with a manually managed access token", async () => {
+              await page.goto("/sources");
+              await openConnectSourcePanel(page);
+              await page
+                .getByRole("group", { name: "Source type" })
+                .getByLabel("MCP over HTTP")
+                .check();
+              await page.getByLabel("Endpoint").fill(`${staticMcp.url}/mcp`);
+              await page.getByLabel("Source name").fill(names.mcpHttp);
+              await page.getByLabel("Allow private network addresses for this source").check();
+              await page.getByLabel("Method").selectOption("oauth_access_token");
+              await page.getByLabel("OAuth access token", { exact: true }).fill(mcpToken);
+              const sourceCreation = page.waitForResponse((response) => {
+                const request = response.request();
+                return (
+                  request.method() === "POST" &&
+                  new URL(response.url()).pathname === "/api/v1/sources"
+                );
+              });
+              await page.getByRole("button", { name: "Connect source" }).click();
+              const sourceResponse = await sourceCreation;
+              const sourceBody = await sourceResponse.text();
+              expect(
+                sourceResponse.ok(),
+                `MCP HTTP source creation failed (${sourceResponse.status()}): ${sourceBody}`,
+              ).toBe(true);
+              await expectLocatorVisible(page.getByRole("heading", { name: names.mcpHttp }));
+            });
+
+            await step("Connect the trusted local MCP stdio template", async () => {
+              await page.goto("/sources");
+              await openConnectSourcePanel(page);
+              await page
+                .getByRole("group", { name: "Source type" })
+                .getByLabel("Trusted local MCP template")
+                .check();
+              await page
+                .getByLabel("Trusted template")
+                .selectOption({ label: "executor-e2e-stdio" });
+              await page.getByLabel("Source name").fill(names.mcpStdio);
+              await page.getByLabel("EXECUTOR_E2E_STDIO_SECRET").fill(stdioSecret);
+              await page.getByRole("button", { name: "Connect source" }).click();
+              await expectLocatorVisible(page.getByRole("heading", { name: names.mcpStdio }));
+            });
+
+            await step("Configure and connect managed OAuth from the dashboard", async () => {
+              await page.goto("/sources");
+              await openConnectSourcePanel(page);
+              await page
+                .getByRole("group", { name: "Source type" })
+                .getByLabel("MCP over HTTP")
+                .check();
+              await page.getByLabel("Endpoint").fill(provider.endpoint);
+              await page.getByLabel("Source name").fill(names.managedOAuth);
+              await page.getByLabel("Allow private network addresses for this source").check();
+              await page.getByRole("button", { name: "Connect source" }).click();
+              await expectLocatorVisible(page.getByRole("heading", { name: names.managedOAuth }));
+
+              const oauth = page.getByRole("region", {
+                name: `Managed OAuth for ${names.managedOAuth}`,
+              });
+              await expectLocatorVisible(oauth.getByLabel("Client ID"));
+              await oauth
+                .getByLabel("Authorization server override (optional)")
+                .fill(provider.issuer);
+              await oauth.getByLabel("Client ID").fill("pending-browser-registration");
+              await oauth.getByLabel("Requested scopes").fill("repo read:user");
+              const initialOAuthSave = page.waitForResponse((response) => {
+                const request = response.request();
+                return (
+                  request.method() === "PUT" && new URL(response.url()).pathname.includes("/oauth/")
+                );
+              });
+              await oauth.getByRole("button", { name: "Save configuration" }).click();
+              const initialOAuthSaveResponse = await initialOAuthSave;
+              const initialOAuthSaveBody = await initialOAuthSaveResponse.text();
+              expect(
+                initialOAuthSaveResponse.ok(),
+                `Managed OAuth configuration failed (${initialOAuthSaveResponse.status()}): ${initialOAuthSaveBody}`,
+              ).toBe(true);
+              const callback = oauth.getByLabel("Exact callback URL");
+              await expectLocatorVisible(callback);
+              const clientId = await provider.registerClient(await callback.inputValue());
+              await oauth.getByLabel("Client ID").fill(clientId);
+              await oauth.getByRole("button", { name: "Save configuration" }).click();
+              await expectLocatorVisible(oauth.getByText("OAuth configuration saved"));
+              const reachedProvider = page.waitForURL(
+                (url) =>
+                  url.origin === new URL(provider.issuer).origin && url.pathname === "/authorize",
+                { waitUntil: "commit" },
+              );
+              await oauth.getByRole("button", { name: "Connect OAuth" }).click();
+              await reachedProvider;
+              const callbackUrl = await provider.approveAuthorization(
+                page.url(),
+                LOCAL_ADMIN.username,
+              );
+              const returnedToExecutor = page.waitForURL(
+                (url) => url.pathname === "/sources" && url.searchParams.has("oauth"),
+                { waitUntil: "commit" },
+              );
+              await page.goto(callbackUrl);
+              await returnedToExecutor;
+              await expectLocatorVisible(page.getByText("OAuth authorization completed"));
+              const connectedOauth = page.getByRole("region", {
+                name: `Managed OAuth for ${names.managedOAuth}`,
+              });
+              await expectLocatorVisible(connectedOauth.getByText("Connected", { exact: true }));
+              const card = page.getByRole("article").filter({
+                has: page.getByRole("heading", { name: names.managedOAuth, exact: true }),
+              });
+              await card.getByRole("button", { name: "Reconnect and refresh tools" }).click();
+              await expectLocatorText(page.locator("#source-status"), "Source refreshed:");
+            });
+          });
+
+          const stored = yield* Effect.promise(() => client.listSources());
+          const byName = (name: string) => {
+            const source = stored.sources.find((candidate) => candidate.displayName === name);
+            if (!source) throw new Error(`browser source was not stored: ${name}`);
+            return source;
+          };
+          const sources = {
+            openapi: byName(names.openapi),
+            graphql: byName(names.graphql),
+            mcpHttp: byName(names.mcpHttp),
+            mcpStdio: byName(names.mcpStdio),
+            managedOAuth: byName(names.managedOAuth),
+          };
+          const gatewayToken = yield* acquireToken(
+            client,
+            target.baseUrl,
+            unique("browser-source-agent"),
+          );
+          const invoke = async (
+            source: LocalSource,
+            label: RegExp,
+            arguments_: Readonly<Record<string, unknown>> = {},
+          ) => {
+            const catalog = await client.listTools({ sourceId: source.id });
+            const tool = catalog.items.find((candidate) =>
+              label.test(`${candidate.stableKey} ${candidate.displayName}`),
+            );
+            if (!tool) throw new Error(`${source.displayName} did not expose ${label.source}`);
+            const enabled = await client.setToolMode(tool, "enabled");
+            const response = await fetch(new URL("/api/v1/gateway/tools/invoke", target.baseUrl), {
+              method: "POST",
+              headers: {
+                authorization: `Bearer ${gatewayToken.token}`,
+                "content-type": "application/json",
+              },
+              body: JSON.stringify({ path: enabled.callablePath, arguments: arguments_ }),
+            });
+            const body = await response.text();
+            expect(response.status, `${source.displayName} invokes through the gateway`).toBe(200);
+            return body;
+          };
+
+          yield* Effect.promise(() =>
+            invoke(sources.openapi, /client.*credentials.*basic/i, {
+              body: { grant_type: "client_credentials" },
+            }),
+          );
+          const spotifyLedger = yield* Effect.promise(() => spotify.ledger.list());
+          const basicCall = spotifyLedger.find((entry) => entry.path === "/api/token");
+          expect(
+            basicCall?.request.headers.authorization,
+            "Spotify observed the HTTP Basic header",
+          ).toBe("[redacted]");
+          expect(
+            basicCall?.response.status,
+            "Spotify accepted the exact seeded Basic username and password",
+          ).toBe(200);
+          yield* Effect.promise(() => invoke(sources.openapi, /meta.*api.*key/i));
+          yield* Effect.promise(() => invoke(sources.openapi, /current.*user.*manual/i));
+          yield* Effect.promise(() => invoke(sources.graphql, /viewer/i));
+          yield* Effect.promise(() => invoke(sources.mcpHttp, /get_me/i));
+          const staticMcpLedger = yield* Effect.promise(() => staticMcp.ledger.list());
+          const staticMcpCall = staticMcpLedger.find(
+            (entry) =>
+              entry.path === "/mcp" && JSON.stringify(entry.request.body).includes("get_me"),
+          );
+          expect(
+            staticMcpCall?.request.headers.authorization,
+            "the MCP emulator observed its manual access token",
+          ).toBe("[redacted]");
+          expect(staticMcpCall?.identity.user?.login).toBe("admin");
+          const mcpToolCallsBeforeOAuth = staticMcpLedger.filter(
+            (entry) =>
+              entry.path === "/mcp" && JSON.stringify(entry.request.body).includes("get_me"),
+          ).length;
+          const stdioResult = yield* Effect.promise(() =>
+            invoke(sources.mcpStdio, /secret_status/i),
+          );
+          expect(
+            stdioResult,
+            "the stdio process receives the exact encrypted template secret",
+          ).toContain(`secret-sha256:${stdioSecretDigest}`);
+          yield* Effect.promise(() => invoke(sources.managedOAuth, /get_me/i));
+
+          const githubLedger = yield* Effect.promise(() => github.ledger.list());
+          const githubCall = (path: string) => {
+            const entry = githubLedger.find((candidate) => candidate.path === path);
+            if (!entry) throw new Error(`GitHub emulator did not observe ${path}`);
+            return entry;
+          };
+          expect(
+            githubCall("/meta").request.headers["x-executor-e2e-key"],
+            "the emulator observed the configured API key header",
+          ).toBe(apiKey);
+          expect(
+            githubCall("/user").identity.user?.login,
+            "the manual OAuth token authenticated its upstream request",
+          ).toBe("octocat");
+          const graphqlCall = githubLedger.find(
+            (candidate) =>
+              candidate.path === "/graphql" &&
+              !JSON.stringify(candidate.request.body).includes("__schema"),
+          );
+          expect(
+            graphqlCall?.identity.user?.login,
+            "the GraphQL bearer token authenticated a non-introspection query",
+          ).toBe("octocat");
+
+          const oauthLedger = yield* Effect.promise(() => provider.ledger());
+          const oauthToolCall = oauthLedger.find(
+            (entry) =>
+              entry.path === "/mcp" && JSON.stringify(entry.request.body).includes("get_me"),
+          );
+          expect(
+            oauthToolCall?.identity.user?.login,
+            "the managed OAuth token authenticated the upstream MCP call",
+          ).toBe("admin");
+          expect(
+            oauthLedger.filter(
+              (entry) =>
+                entry.path === "/mcp" && JSON.stringify(entry.request.body).includes("get_me"),
+            ).length,
+            "managed OAuth added one independently authenticated tool call",
+          ).toBe(mcpToolCallsBeforeOAuth + 1);
+
+          yield* browser.session(identity, async ({ page, step }) => {
+            await step(
+              "Review every browser-created source in the redesigned dashboard",
+              async () => {
+                await page.goto("/sources");
+                for (const name of createdNames) {
+                  await expectLocatorVisible(page.getByRole("heading", { name, exact: true }));
+                }
+                await expectLocatorText(
+                  page.getByRole("region", { name: `Managed OAuth for ${names.managedOAuth}` }),
+                  "Connected",
+                );
+              },
+            );
+            await step(
+              "Open the shared tool catalog from the browser-created OpenAPI source",
+              async () => {
+                const card = page.getByRole("article").filter({
+                  has: page.getByRole("heading", { name: names.openapi, exact: true }),
+                });
+                await card.getByRole("link", { name: "View tools" }).click();
+                await expectLocatorText(
+                  page.getByRole("table"),
+                  "Exchange client credentials with Basic",
+                );
+              },
+            );
+          });
+        }),
+        Effect.gen(function* () {
+          yield* deleteSourcesNamed(client, createdNames);
+        }),
+      );
+    }),
+  ),
+);
+
+scenario(
+  "Source creation recovery · a committed plain-text 502 reloads as exactly one source",
+  { timeout: 180_000 },
+  Effect.scoped(
+    Effect.gen(function* () {
+      const target = yield* Target;
+      const browser = yield* Browser;
+      const client = yield* adminClient(target.baseUrl);
+      const github = yield* githubEmulator;
+      const sourceName = unique("Committed replay");
+
+      yield* Effect.ensuring(
+        Effect.gen(function* () {
+          const identity = yield* target.newIdentity();
+          yield* browser.session(identity, async ({ page, step }) => {
+            let postCount = 0;
+            let releaseLookup = () => {};
+            const lookupGate = new Promise<void>((resolve) => {
+              releaseLookup = resolve;
+            });
+            let markLookupStarted = () => {};
+            const lookupStarted = new Promise<void>((resolve) => {
+              markLookupStarted = resolve;
+            });
+            let lookupCount = 0;
+            let replayResponse:
+              | { readonly status: number; readonly headers: Record<string, string> }
+              | undefined;
+
+            await page.route("**/api/v1/sources/idempotency", async (route) => {
+              if (route.request().method() !== "GET") {
+                await route.continue();
+                return;
+              }
+              lookupCount += 1;
+              if (lookupCount === 1) {
+                markLookupStarted();
+                await lookupGate;
+                await route.abort("aborted").catch(() => {});
+                return;
+              }
+              if (lookupCount === 2) {
+                await route.fulfill({
+                  status: 200,
+                  headers: {
+                    "cache-control": "no-store",
+                    "content-type": "application/json",
+                  },
+                  body: JSON.stringify({ status: "in_progress" }),
+                });
+                return;
+              }
+              const replay = await route.fetch();
+              replayResponse = { status: replay.status(), headers: replay.headers() };
+              await route.fulfill({ response: replay });
+            });
+            await page.route("**/api/v1/sources", async (route) => {
+              if (route.request().method() !== "POST") {
+                await route.continue();
+                return;
+              }
+              postCount += 1;
+              const committed = await route.fetch();
+              expect(committed.status(), "the real API committed before delivery failed").toBe(201);
+              await route.fulfill({
+                status: 502,
+                headers: { "content-type": "text/plain; charset=utf-8" },
+                body: "gateway lost the committed response",
+              });
+            });
+
+            await step("Reload the ambiguous create and recover its committed result", async () => {
+              await prepareInlineOpenApiSource(
+                page,
+                minimalOpenApiDocument(github.url, sourceName),
+                sourceName,
+              );
+              await page.getByRole("button", { name: "Import source" }).click();
+              try {
+                await lookupStarted;
+                const pendingKey = await sourceCreateStorageValue(page);
+                expect(pendingKey, "one opaque key survives the ambiguous response").toMatch(
+                  /^[0-9a-f]{32}$/,
+                );
+                const reloaded = page.reload();
+                releaseLookup();
+                await reloaded;
+                await expectLocatorVisible(
+                  page.getByRole("status").filter({
+                    hasText: "Executor is still finishing this source connection.",
+                  }),
+                );
+                await expectLocatorVisible(page.getByRole("heading", { name: sourceName }));
+                await expect
+                  .poll(() => sourceCreateStorageValue(page), { timeout: 10_000 })
+                  .toBeNull();
+              } finally {
+                releaseLookup();
+              }
+              expect(postCount, "reload recovery never issued a second create").toBe(1);
+              expect(
+                lookupCount,
+                "recovery polled after an in-progress status",
+              ).toBeGreaterThanOrEqual(3);
+              expect(replayResponse?.status, "the completed lookup replays HTTP 201").toBe(201);
+              expect(
+                replayResponse?.headers["idempotency-replayed"],
+                "the browser accepted the real replay marker",
+              ).toBe("true");
+              expect(
+                replayResponse?.headers["cache-control"],
+                "replay handling remains explicitly uncached",
+              ).toBe("no-store");
+            });
+          });
+
+          const stored = yield* Effect.promise(() => client.listSources());
+          expect(
+            stored.sources.filter((source) => source.displayName === sourceName),
+            "the committed key resolves to exactly one durable source",
+          ).toHaveLength(1);
+        }),
+        deleteSourcesNamed(client, [sourceName]),
+      );
+    }),
+  ),
+);
+
+scenario(
+  "Source creation recovery · a hard reload seals a missing request before unlocking",
+  { timeout: 180_000 },
+  Effect.scoped(
+    Effect.gen(function* () {
+      const target = yield* Target;
+      const browser = yield* Browser;
+      const client = yield* adminClient(target.baseUrl);
+      const github = yield* githubEmulator;
+      const sourceName = unique("Missing sealed");
+
+      yield* Effect.ensuring(
+        Effect.gen(function* () {
+          const identity = yield* target.newIdentity();
+          yield* browser.session(identity, async ({ page, step }) => {
+            let postCount = 0;
+            let sealCount = 0;
+            let releaseLookup = () => {};
+            const lookupGate = new Promise<void>((resolve) => {
+              releaseLookup = resolve;
+            });
+            let markLookupStarted = () => {};
+            const lookupStarted = new Promise<void>((resolve) => {
+              markLookupStarted = resolve;
+            });
+            let firstLookup = true;
+
+            await page.route("**/api/v1/sources", async (route) => {
+              if (route.request().method() !== "POST") {
+                await route.continue();
+                return;
+              }
+              postCount += 1;
+              await route.abort("connectionreset");
+            });
+            await page.route("**/api/v1/sources/idempotency", async (route) => {
+              if (route.request().method() === "GET" && firstLookup) {
+                firstLookup = false;
+                markLookupStarted();
+                await lookupGate;
+                await route.abort("aborted").catch(() => {});
+                return;
+              }
+              await route.continue();
+            });
+            await page.route("**/api/v1/sources/idempotency/seal", async (route) => {
+              if (route.request().method() === "POST") sealCount += 1;
+              await route.continue();
+            });
+
+            await step("Reload after delivery loss and seal the server's missing key", async () => {
+              await prepareInlineOpenApiSource(
+                page,
+                minimalOpenApiDocument(github.url, sourceName),
+                sourceName,
+              );
+              await page.getByRole("button", { name: "Import source" }).click();
+              try {
+                await lookupStarted;
+                const unload = await page.evaluate(() => {
+                  const event = new Event("beforeunload", { cancelable: true });
+                  return {
+                    dispatched: window.dispatchEvent(event),
+                    defaultPrevented: event.defaultPrevented,
+                  };
+                });
+                expect(
+                  unload,
+                  "recovery allows a real reload because no request is being dispatched",
+                ).toEqual({ dispatched: true, defaultPrevented: false });
+                const reloaded = page.reload();
+                releaseLookup();
+                await reloaded;
+                await expectLocatorVisible(
+                  page.getByText(
+                    "The unused source connection key was sealed. You can start a new request.",
+                  ),
+                );
+                await expect.poll(() => sourceCreateStorageValue(page)).toBeNull();
+              } finally {
+                releaseLookup();
+              }
+              expect(postCount, "reload recovery did not redispatch the lost payload").toBe(1);
+              expect(sealCount, "one seal permanently fences the unused key").toBe(1);
+            });
+          });
+
+          const stored = yield* Effect.promise(() => client.listSources());
+          expect(stored.sources.filter((source) => source.displayName === sourceName)).toHaveLength(
+            0,
+          );
+        }),
+        deleteSourcesNamed(client, [sourceName]),
+      );
+    }),
+  ),
+);
+
+scenario(
+  "Source creation recovery · failed delivery retries the same key and exact payload",
+  { timeout: 180_000 },
+  Effect.scoped(
+    Effect.gen(function* () {
+      const target = yield* Target;
+      const browser = yield* Browser;
+      const client = yield* adminClient(target.baseUrl);
+      const github = yield* githubEmulator;
+      const sourceName = unique("Exact retry");
+
+      yield* Effect.ensuring(
+        Effect.gen(function* () {
+          const identity = yield* target.newIdentity();
+          yield* browser.session(identity, async ({ page, step }) => {
+            const attempts: Array<{ readonly key: string | undefined; readonly body: string }> = [];
+            await page.route("**/api/v1/sources", async (route) => {
+              if (route.request().method() !== "POST") {
+                await route.continue();
+                return;
+              }
+              attempts.push({
+                key: route.request().headers()["idempotency-key"],
+                body: route.request().postData() ?? "",
+              });
+              if (attempts.length <= 2) {
+                await route.abort("connectionreset");
+                return;
+              }
+              await route.continue();
+            });
+
+            await step("Retry one in-memory request until the real API receives it", async () => {
+              await prepareInlineOpenApiSource(
+                page,
+                minimalOpenApiDocument(github.url, sourceName),
+                sourceName,
+              );
+              await page.getByRole("button", { name: "Import source" }).click();
+              const retry = page.getByRole("button", { name: "Retry exact request" });
+              await expectLocatorVisible(retry);
+              expect(attempts, "initial delivery and its automatic retry both failed").toHaveLength(
+                2,
+              );
+              expect(
+                attempts.map((attempt) => attempt.key),
+                "the automatic retry retained one idempotency key",
+              ).toEqual([attempts[0]?.key, attempts[0]?.key]);
+              expect(
+                attempts.map((attempt) => attempt.body),
+                "the automatic retry retained byte-identical JSON",
+              ).toEqual([attempts[0]?.body, attempts[0]?.body]);
+
+              await retry.click();
+              await expectLocatorVisible(page.getByRole("heading", { name: sourceName }));
+              expect(attempts, "the deliberate retry reached the server").toHaveLength(3);
+              expect(attempts[2]?.key).toBe(attempts[0]?.key);
+              expect(attempts[2]?.body).toBe(attempts[0]?.body);
+              expect(attempts[0]?.key).toMatch(/^[0-9a-f]{32}$/);
+            });
+          });
+
+          const stored = yield* Effect.promise(() => client.listSources());
+          expect(stored.sources.filter((source) => source.displayName === sourceName)).toHaveLength(
+            1,
+          );
+        }),
+        deleteSourcesNamed(client, [sourceName]),
+      );
+    }),
+  ),
+);
+
+scenario(
+  "Source creation recovery · a lost failed response replays its exact error and headers",
+  { timeout: 180_000 },
+  Effect.scoped(
+    Effect.gen(function* () {
+      const target = yield* Target;
+      const browser = yield* Browser;
+      const client = yield* adminClient(target.baseUrl);
+      const github = yield* githubEmulator;
+      const sourceName = unique("Failed replay");
+
+      yield* Effect.ensuring(
+        Effect.gen(function* () {
+          const identity = yield* target.newIdentity();
+          yield* browser.session(identity, async ({ page, step }) => {
+            let postCount = 0;
+            let releaseFirstLookup = () => {};
+            const firstLookupGate = new Promise<void>((resolve) => {
+              releaseFirstLookup = resolve;
+            });
+            let markFirstLookupStarted = () => {};
+            const firstLookupStarted = new Promise<void>((resolve) => {
+              markFirstLookupStarted = resolve;
+            });
+            let firstLookup = true;
+            let originalFailure:
+              | {
+                  readonly status: number;
+                  readonly body: string;
+                  readonly headers: Record<string, string>;
+                }
+              | undefined;
+            let replayFailure:
+              | {
+                  readonly status: number;
+                  readonly body: string;
+                  readonly headers: Record<string, string>;
+                }
+              | undefined;
+
+            await page.route("**/api/v1/sources", async (route) => {
+              if (route.request().method() !== "POST") {
+                await route.continue();
+                return;
+              }
+              postCount += 1;
+              const failed = await route.fetch({
+                postData: JSON.stringify({
+                  kind: "openapi",
+                  displayName: sourceName,
+                  preferredSlug: unique("invalid-replay"),
+                  spec: { type: "inline", content: "not an OpenAPI document" },
+                }),
+              });
+              originalFailure = {
+                status: failed.status(),
+                body: await failed.text(),
+                headers: failed.headers(),
+              };
+              await route.fulfill({
+                status: 502,
+                headers: { "content-type": "text/plain; charset=utf-8" },
+                body: "gateway lost the failed response",
+              });
+            });
+            await page.route("**/api/v1/sources/idempotency", async (route) => {
+              if (firstLookup) {
+                firstLookup = false;
+                markFirstLookupStarted();
+                await firstLookupGate;
+                await route.abort("aborted").catch(() => {});
+                return;
+              }
+              const replay = await route.fetch();
+              const body = await replay.text();
+              replayFailure = {
+                status: replay.status(),
+                body,
+                headers: replay.headers(),
+              };
+              await route.fulfill({
+                status: replay.status(),
+                headers: replay.headers(),
+                body,
+              });
+            });
+
+            await step(
+              "Recover the server's exact failed result after its response is lost",
+              async () => {
+                await prepareInlineOpenApiSource(
+                  page,
+                  minimalOpenApiDocument(github.url, sourceName),
+                  sourceName,
+                );
+                await page.getByRole("button", { name: "Import source" }).click();
+                try {
+                  await firstLookupStarted;
+                  const reloaded = page.reload();
+                  releaseFirstLookup();
+                  await reloaded;
+                } finally {
+                  releaseFirstLookup();
+                }
+                await expectLocatorVisible(page.locator("#source-create-status"));
+                await expect.poll(() => sourceCreateStorageValue(page)).toBeNull();
+                expect(postCount, "failed replay recovery never resubmits the source").toBe(1);
+                expect(replayFailure?.status).toBe(originalFailure?.status);
+                expect(replayFailure?.body, "the replay body is byte-identical").toBe(
+                  originalFailure?.body,
+                );
+                expect(replayFailure?.headers["content-type"]).toBe(
+                  originalFailure?.headers["content-type"],
+                );
+                const originalRequestReference = JSON.parse(originalFailure?.body ?? "{}") as {
+                  readonly error?: { readonly requestId?: string };
+                };
+                const replayRequestReference = JSON.parse(replayFailure?.body ?? "{}") as {
+                  readonly error?: { readonly requestId?: string };
+                };
+                expect(originalRequestReference.error?.requestId).toMatch(/\S+/);
+                expect(replayRequestReference.error?.requestId).toBe(
+                  originalRequestReference.error?.requestId,
+                );
+                expect(replayFailure?.headers["idempotency-replayed"]).toBe("true");
+                expect(replayFailure?.headers["cache-control"]).toBe(
+                  originalFailure?.headers["cache-control"],
+                );
+              },
+            );
+          });
+
+          const stored = yield* Effect.promise(() => client.listSources());
+          expect(stored.sources.filter((source) => source.displayName === sourceName)).toHaveLength(
+            0,
+          );
+        }),
+        deleteSourcesNamed(client, [sourceName]),
+      );
+    }),
+  ),
+);
+
+scenario(
+  "Source creation recovery · a duplicated tab joins one pending attempt without another POST",
+  { timeout: 180_000 },
+  Effect.scoped(
+    Effect.gen(function* () {
+      const target = yield* Target;
+      const browser = yield* Browser;
+      const client = yield* adminClient(target.baseUrl);
+      const github = yield* githubEmulator;
+      const sourceName = unique("Duplicated tab");
+
+      yield* Effect.ensuring(
+        Effect.gen(function* () {
+          const identity = yield* target.newIdentity();
+          yield* browser.session(identity, async ({ page, step }) => {
+            let releaseOriginal = () => {};
+            const originalGate = new Promise<void>((resolve) => {
+              releaseOriginal = resolve;
+            });
+            let markCommitted = () => {};
+            const committed = new Promise<void>((resolve) => {
+              markCommitted = resolve;
+            });
+            let postCount = 0;
+            page.context().on("request", (request) => {
+              const url = new URL(request.url());
+              if (request.method() === "POST" && url.pathname === "/api/v1/sources") {
+                postCount += 1;
+              }
+            });
+            await page.route("**/api/v1/sources", async (route) => {
+              if (route.request().method() !== "POST") {
+                await route.continue();
+                return;
+              }
+              const response = await route.fetch();
+              expect(response.status(), "the pending browser delivery committed once").toBe(201);
+              markCommitted();
+              await originalGate;
+              await route.fulfill({ response });
+            });
+
+            await step("Duplicate the pending tab and recover from its copied key", async () => {
+              await prepareInlineOpenApiSource(
+                page,
+                minimalOpenApiDocument(github.url, sourceName),
+                sourceName,
+              );
+              await page.getByRole("button", { name: "Import source" }).click();
+              let clone: Page | null = null;
+              try {
+                await committed;
+                expect(await sourceCreateStorageValue(page)).toMatch(/^[0-9a-f]{32}$/);
+                const popup = page.waitForEvent("popup");
+                await page.evaluate(() => {
+                  window.open("/sources", "_blank");
+                });
+                clone = await popup;
+                await expectLocatorVisible(clone.getByRole("heading", { name: sourceName }));
+                await expect
+                  .poll(() => (clone ? sourceCreateStorageValue(clone) : null))
+                  .toBeNull();
+                expect(postCount, "the duplicated tab used lookup instead of POST").toBe(1);
+              } finally {
+                releaseOriginal();
+              }
+              await expectLocatorVisible(page.getByRole("heading", { name: sourceName }));
+              expect(postCount, "both tabs converge on the original POST").toBe(1);
+              await clone?.close();
+            });
+          });
+
+          const stored = yield* Effect.promise(() => client.listSources());
+          expect(stored.sources.filter((source) => source.displayName === sourceName)).toHaveLength(
+            1,
+          );
+        }),
+        deleteSourcesNamed(client, [sourceName]),
+      );
+    }),
+  ),
+);
+
+scenario(
+  "Source creation recovery · signing out during lookup never redispatches the request",
+  { timeout: 180_000 },
+  Effect.scoped(
+    Effect.gen(function* () {
+      const target = yield* Target;
+      const browser = yield* Browser;
+      const client = yield* adminClient(target.baseUrl);
+      const github = yield* githubEmulator;
+      const sourceName = unique("Signout recovery");
+
+      yield* Effect.ensuring(
+        Effect.gen(function* () {
+          const identity = yield* target.newIdentity();
+          yield* browser.privateSession(identity, async ({ page, step }) => {
+            let postCount = 0;
+            let sealCount = 0;
+            let sessionDeleteCount = 0;
+            let releaseLookup = () => {};
+            const lookupGate = new Promise<void>((resolve) => {
+              releaseLookup = resolve;
+            });
+            let markLookupStarted = () => {};
+            const lookupStarted = new Promise<void>((resolve) => {
+              markLookupStarted = resolve;
+            });
+            let markLookupSettled = () => {};
+            const lookupSettled = new Promise<void>((resolve) => {
+              markLookupSettled = resolve;
+            });
+            let releaseSessionDelete = () => {};
+            const sessionDeleteGate = new Promise<void>((resolve) => {
+              releaseSessionDelete = resolve;
+            });
+            let markSessionDeleteStarted = () => {};
+            const sessionDeleteStarted = new Promise<void>((resolve) => {
+              markSessionDeleteStarted = resolve;
+            });
+            let holdFirstLookup = true;
+            await page.route("**/api/v1/sources", async (route) => {
+              if (route.request().method() !== "POST") {
+                await route.continue();
+                return;
+              }
+              postCount += 1;
+              const committed = await route.fetch();
+              await route.fulfill({
+                status: 502,
+                headers: { "content-type": "text/plain; charset=utf-8" },
+                body: "gateway lost the committed response",
+              });
+              expect(committed.status()).toBe(201);
+            });
+            await page.route("**/api/v1/sources/idempotency", async (route) => {
+              if (route.request().method() === "GET" && holdFirstLookup) {
+                holdFirstLookup = false;
+                markLookupStarted();
+                await lookupGate;
+                await route.abort("aborted").catch(() => {});
+                markLookupSettled();
+                return;
+              }
+              await route.continue();
+            });
+            await page.route("**/api/v1/sources/idempotency/seal", async (route) => {
+              if (route.request().method() === "POST") sealCount += 1;
+              await route.continue();
+            });
+            await page.route("**/api/v1/session", async (route) => {
+              if (route.request().method() !== "DELETE") {
+                await route.continue();
+                return;
+              }
+              sessionDeleteCount += 1;
+              markSessionDeleteStarted();
+              await sessionDeleteGate;
+              await route.continue();
+            });
+
+            await step(
+              "Sign out during recovery, sign back in, and join the committed result",
+              async () => {
+                await prepareInlineOpenApiSource(
+                  page,
+                  minimalOpenApiDocument(github.url, sourceName),
+                  sourceName,
+                );
+                await page.getByRole("button", { name: "Import source" }).click();
+                try {
+                  await lookupStarted;
+                  const unload = await page.evaluate(() => {
+                    const event = new Event("beforeunload", { cancelable: true });
+                    return {
+                      dispatched: window.dispatchEvent(event),
+                      defaultPrevented: event.defaultPrevented,
+                    };
+                  });
+                  expect(unload, "recovery permits session navigation").toEqual({
+                    dispatched: true,
+                    defaultPrevented: false,
+                  });
+                  const signOut = page.getByRole("button", { name: "Sign out" }).click();
+                  await sessionDeleteStarted;
+                  expect(
+                    new URL(page.url()).pathname,
+                    "the recovery page remains mounted while session deletion is in flight",
+                  ).toBe("/sources");
+                  expect(await sourceCreateStorageValue(page)).toMatch(/^[0-9a-f]{32}$/);
+                  releaseLookup();
+                  await lookupSettled;
+                  await page.evaluate(
+                    () =>
+                      new Promise<void>((resolve) => {
+                        requestAnimationFrame(() => requestAnimationFrame(() => resolve()));
+                      }),
+                  );
+                  expect(
+                    postCount,
+                    "settled lookup did not redispatch while DELETE was gated",
+                  ).toBe(1);
+                  expect(sealCount, "sign-out pause never seals the recoverable key").toBe(0);
+                  expect(
+                    await sourceCreateStorageValue(page),
+                    "the pending key survives the lookup and session-delete race",
+                  ).toMatch(/^[0-9a-f]{32}$/);
+                  releaseSessionDelete();
+                  await signOut;
+                  await page.waitForURL((url) => url.pathname === "/login");
+                  expect(sessionDeleteCount, "recovery permits one deliberate sign-out").toBe(1);
+                  expect(
+                    await sourceCreateStorageValue(page),
+                    "the key remains available to the next authenticated Sources page",
+                  ).toMatch(/^[0-9a-f]{32}$/);
+
+                  await page.getByLabel("Username").fill(LOCAL_ADMIN.username);
+                  await page.getByLabel("Password").fill(LOCAL_ADMIN.password);
+                  await page.getByRole("button", { name: "Sign in" }).click();
+                  await page.waitForURL((url) => url.pathname === "/sources");
+                  await expectLocatorVisible(page.getByRole("heading", { name: sourceName }));
+                  await expect.poll(() => sourceCreateStorageValue(page)).toBeNull();
+                  expect(postCount, "authenticated recovery still uses the original POST").toBe(1);
+                  expect(sealCount, "authenticated recovery never seals a committed key").toBe(0);
+                } finally {
+                  releaseLookup();
+                  releaseSessionDelete();
+                }
+                expect(postCount, "session recovery joins by key instead of redispatching").toBe(1);
+              },
+            );
+          });
+
+          const stored = yield* Effect.promise(() => client.listSources());
+          expect(stored.sources.filter((source) => source.displayName === sourceName)).toHaveLength(
+            1,
+          );
+        }),
+        deleteSourcesNamed(client, [sourceName]),
+      );
+    }),
+  ),
+);
+
+scenario(
+  "Source creation recovery · authoritative refresh B cannot be overwritten by stale list A",
+  { timeout: 180_000 },
+  Effect.scoped(
+    Effect.gen(function* () {
+      const target = yield* Target;
+      const browser = yield* Browser;
+      const client = yield* adminClient(target.baseUrl);
+      const github = yield* githubEmulator;
+      const sourceName = unique("Authoritative refresh");
+
+      yield* Effect.ensuring(
+        Effect.gen(function* () {
+          const identity = yield* target.newIdentity();
+          yield* browser.session(identity, async ({ page, step }) => {
+            let postCount = 0;
+            let committedStatus: number | undefined;
+            let listCount = 0;
+            let releaseStaleList = () => {};
+            const staleListGate = new Promise<void>((resolve) => {
+              releaseStaleList = resolve;
+            });
+            let markStaleListCaptured = () => {};
+            const staleListCaptured = new Promise<void>((resolve) => {
+              markStaleListCaptured = resolve;
+            });
+            let markStaleListDelivered = () => {};
+            const staleListDelivered = new Promise<void>((resolve) => {
+              markStaleListDelivered = resolve;
+            });
+            let markAuthoritativeListDelivered = () => {};
+            const authoritativeListDelivered = new Promise<void>((resolve) => {
+              markAuthoritativeListDelivered = resolve;
+            });
+
+            await page.route("**/api/v1/sources", async (route) => {
+              if (route.request().method() === "POST") {
+                postCount += 1;
+                const committed = await route.fetch();
+                committedStatus = committed.status();
+                await route.fulfill({
+                  status: 502,
+                  headers: { "content-type": "text/plain; charset=utf-8" },
+                  body: "gateway lost the committed response",
+                });
+                return;
+              }
+              if (route.request().method() !== "GET") {
+                await route.continue();
+                return;
+              }
+              const currentList = ++listCount;
+              const response = await route.fetch();
+              if (currentList === 1) {
+                markStaleListCaptured();
+                await staleListGate;
+              } else if (currentList === 2) {
+                markAuthoritativeListDelivered();
+              }
+              if (currentList === 1) {
+                await route.fulfill({ response }).catch(() => {});
+                markStaleListDelivered();
+                return;
+              }
+              await route.fulfill({ response });
+            });
+
+            await step(
+              "Keep list A in flight until replay refresh B is authoritative",
+              async () => {
+                await prepareInlineOpenApiSource(
+                  page,
+                  minimalOpenApiDocument(github.url, sourceName),
+                  sourceName,
+                );
+                await staleListCaptured;
+                await page.getByRole("button", { name: "Import source" }).click();
+                try {
+                  await authoritativeListDelivered;
+                  await expectLocatorVisible(page.getByRole("heading", { name: sourceName }));
+                  releaseStaleList();
+                  await staleListDelivered;
+                  await page.evaluate(
+                    () =>
+                      new Promise<void>((resolve) => {
+                        requestAnimationFrame(() => requestAnimationFrame(() => resolve()));
+                      }),
+                  );
+                  await expectLocatorVisible(page.getByRole("heading", { name: sourceName }));
+                } finally {
+                  releaseStaleList();
+                }
+                expect(
+                  committedStatus,
+                  "the source committed before response delivery failed",
+                ).toBe(201);
+                expect(postCount, "replay recovery keeps one source create").toBe(1);
+                expect(listCount, "refresh B follows the earlier list A").toBeGreaterThanOrEqual(2);
+              },
+            );
+          });
+
+          const stored = yield* Effect.promise(() => client.listSources());
+          expect(stored.sources.filter((source) => source.displayName === sourceName)).toHaveLength(
+            1,
+          );
+        }),
+        deleteSourcesNamed(client, [sourceName]),
+      );
+    }),
+  ),
+);
+
+scenario(
+  "Source creation guard · navigation waits and session storage retains only an opaque key",
+  { timeout: 180_000 },
+  Effect.scoped(
+    Effect.gen(function* () {
+      const target = yield* Target;
+      const browser = yield* Browser;
+      const client = yield* adminClient(target.baseUrl);
+      const github = yield* githubEmulator;
+      const sourceName = unique("Guarded source");
+      const credential = unique("guarded-credential");
+
+      yield* Effect.ensuring(
+        Effect.gen(function* () {
+          const identity = yield* target.newIdentity();
+          yield* browser.privateSession(identity, async ({ page, step }) => {
+            let releaseSubmission = () => {};
+            const submissionGate = new Promise<void>((resolve) => {
+              releaseSubmission = resolve;
+            });
+            let markSubmissionStarted = () => {};
+            const submissionStarted = new Promise<void>((resolve) => {
+              markSubmissionStarted = resolve;
+            });
+            let submittedPayload = "";
+            const sessionDeletes: string[] = [];
+            page.on("request", (request) => {
+              const url = new URL(request.url());
+              if (request.method() === "DELETE" && url.pathname === "/api/v1/session") {
+                sessionDeletes.push(request.url());
+              }
+            });
+            await page.route("**/api/v1/sources", async (route) => {
+              if (route.request().method() !== "POST") {
+                await route.continue();
+                return;
+              }
+              submittedPayload = route.request().postData() ?? "";
+              markSubmissionStarted();
+              await submissionGate;
+              await route.continue();
+            });
+
+            await step("Block every exit while the exact source request is gated", async () => {
+              await page.goto("/tools");
+              await prepareInlineOpenApiSource(
+                page,
+                staticAuthOpenApiDocument(github.url, github.url),
+                sourceName,
+              );
+              await page.getByRole("checkbox", { name: /basicAuth/ }).check();
+              await page.getByLabel("Username").fill("guarded-admin");
+              await page.getByLabel("Basic auth", { exact: true }).fill(credential);
+              await page.getByRole("button", { name: "Import source" }).click();
+              try {
+                await submissionStarted;
+                await expectLocatorValue(page.getByLabel("Basic auth", { exact: true }), "");
+                const sourceTypes = page.getByRole("group", { name: "Source type" });
+                for (const connector of [
+                  "OpenAPI service",
+                  "GraphQL API",
+                  "MCP over HTTP",
+                  "Trusted local MCP template",
+                ]) {
+                  await expectLocatorDisabled(
+                    sourceTypes.getByLabel(connector),
+                    `${connector} stays locked during dispatch`,
+                  );
+                }
+
+                const unload = await page.evaluate(() => {
+                  const event = new Event("beforeunload", { cancelable: true });
+                  return {
+                    dispatched: window.dispatchEvent(event),
+                    defaultPrevented: event.defaultPrevented,
+                  };
+                });
+                expect(
+                  unload,
+                  "dispatch blocks an unload that could lose the in-memory payload",
+                ).toEqual({ dispatched: false, defaultPrevented: true });
+
+                const storage = await page.evaluate(() =>
+                  Object.fromEntries(
+                    Array.from({ length: sessionStorage.length }, (_, index) => {
+                      const key = sessionStorage.key(index) ?? "";
+                      return [key, sessionStorage.getItem(key) ?? ""];
+                    }),
+                  ),
+                );
+                const entries = Object.entries(storage).filter(
+                  ([key]) => key === sourceCreateStorageKey,
+                );
+                expect(entries, "session storage has one pending idempotency record").toHaveLength(
+                  1,
+                );
+                expect(entries[0]?.[1]).toMatch(/^[0-9a-f]{32}$/);
+                const persisted = JSON.stringify(storage);
+                expect(persisted).not.toContain(github.url);
+                expect(persisted).not.toContain(sourceName);
+                expect(persisted).not.toContain(credential);
+                expect(persisted).not.toContain(submittedPayload);
+
+                const toolsLink = page
+                  .getByRole("navigation", { name: "Dashboard" })
+                  .getByRole("link", { name: "Tools", exact: true });
+                await toolsLink.click();
+                expect(new URL(page.url()).pathname).toBe("/sources");
+                const warning = page.locator("#source-navigation-status");
+                await expectLocatorText(warning, "still being submitted");
+                await expectLocatorFocused(warning);
+
+                const unloadPrompt = page
+                  .waitForEvent("dialog", { timeout: 2_000 })
+                  .catch(() => null);
+                const historyNavigation = page
+                  .goBack({
+                    waitUntil: "domcontentloaded",
+                    timeout: 2_000,
+                  })
+                  .catch(() => null);
+                const dialog = await unloadPrompt;
+                const dialogType = dialog?.type() ?? null;
+                expect(
+                  [null, "beforeunload"],
+                  "history navigation either cancels in-app or raises the native unload guard",
+                ).toContain(dialogType);
+                if (dialog !== null) {
+                  await dialog.dismiss();
+                }
+                await historyNavigation;
+                expect(new URL(page.url()).pathname).toBe("/sources");
+                await expectLocatorFocused(warning);
+
+                await page.getByRole("button", { name: "Sign out" }).click();
+                expect(new URL(page.url()).pathname).toBe("/sources");
+                await expectLocatorFocused(warning);
+                expect(
+                  sessionDeletes,
+                  "blocked sign-out never destroys the administrator session",
+                ).toHaveLength(0);
+              } finally {
+                releaseSubmission();
+              }
+
+              await expectLocatorVisible(page.getByRole("heading", { name: sourceName }));
+              await expect.poll(() => sourceCreateStorageValue(page)).toBeNull();
+              await page
+                .getByRole("navigation", { name: "Dashboard" })
+                .getByRole("link", { name: "Tools", exact: true })
+                .click();
+              await page.waitForURL((url) => url.pathname === "/tools");
+              expect(
+                sessionDeletes,
+                "successful release does not sign the administrator out",
+              ).toHaveLength(0);
+            });
+          });
+
+          const stored = yield* Effect.promise(() => client.listSources());
+          expect(stored.sources.filter((source) => source.displayName === sourceName)).toHaveLength(
+            1,
+          );
+        }),
+        deleteSourcesNamed(client, [sourceName]),
+      );
+    }),
+  ),
+);
+
+scenario(
+  "Tools · search, filters, and broad mode changes stay explicit",
+  { timeout: 180_000 },
+  Effect.scoped(
+    Effect.gen(function* () {
+      const target = yield* Target;
+      const browser = yield* Browser;
+      const client = yield* adminClient(target.baseUrl);
+      const upstream = yield* serveOpenApiEchoTestServer();
+      const name = unique("Mode controls");
+      const source = yield* Effect.promise(() =>
+        client.createSource({
+          kind: "openapi",
+          displayName: name,
+          preferredSlug: unique("modes").replaceAll("-", "_"),
+          spec: { type: "inline", content: upstream.specJson },
+          allowPrivateNetwork: true,
+        }),
+      );
+      const catalog = yield* Effect.promise(() => client.listTools({ sourceId: source.id }));
+      const tool = catalog.items.find((candidate) =>
+        candidate.sandboxPath.endsWith(".echo_echo_message"),
+      );
+      if (!tool) return yield* Effect.die("the mode fixture produced no echo message tool");
+      const token = yield* acquireToken(client, target.baseUrl, unique("mode-agent"));
+      const invoke = (idempotencyKey?: string) => {
+        const headers = new Headers({
+          authorization: `Bearer ${token.token}`,
+          "content-type": "application/json",
+        });
+        if (idempotencyKey !== undefined) headers.set("idempotency-key", idempotencyKey);
+        return fetch(new URL("/api/v1/gateway/tools/invoke", target.baseUrl), {
+          method: "POST",
+          headers,
+          body: JSON.stringify({
+            path: tool.callablePath,
+            arguments: { path: { message: "Mode" } },
+          }),
+        });
+      };
+
+      yield* Effect.ensuring(
+        Effect.gen(function* () {
+          const identity = yield* target.newIdentity();
+          yield* browser.session(identity, async ({ page, step }) => {
+            await step(
+              "Set the source default to Enabled with deliberate confirmation",
+              async () => {
+                await page.goto("/sources");
+                const card = page.getByRole("article").filter({
+                  has: page.getByRole("heading", { name, exact: true }),
+                });
+                const sourceModes = card.getByRole("group", { name: "Default tool behavior" });
+                await sourceModes.getByLabel("Enabled", { exact: true }).check();
+                await card.getByRole("button", { name: "Apply source default" }).click();
+                const confirmation = card.getByRole("group", {
+                  name: `Confirm default for ${name}`,
+                });
+                await expectLocatorVisible(confirmation);
+                await confirmation.getByRole("button", { name: "Confirm broad change" }).click();
+                await expectLocatorText(
+                  page.locator("#source-status"),
+                  "Source default changed to Enabled",
+                );
+              },
+            );
+
+            await step("Search the global catalog and filter to one source", async () => {
+              await page.goto("/tools");
+              await page.getByLabel("Search tools").fill("echo");
+              await page.getByRole("button", { name: "Search" }).click();
+              await page.getByLabel("Source").selectOption({ label: name });
+              await expectLocatorText(page.getByRole("table"), "echo");
+            });
+
+            await step(
+              "Disable one tool from its row and enforce the change at the gateway",
+              async () => {
+                const toolModes = page.getByRole("group", {
+                  name: `Behavior for ${tool.displayName}`,
+                });
+                const changed = page.waitForResponse((response) => {
+                  const url = new URL(response.url());
+                  return (
+                    response.request().method() === "PATCH" &&
+                    url.pathname === `/api/v1/tools/${tool.id}/mode`
+                  );
+                });
+                await toolModes.getByLabel("Disabled", { exact: true }).check();
+                expect((await changed).status(), "the row mutation reached the real API").toBe(200);
+                await expectLocatorChecked(toolModes.getByLabel("Disabled", { exact: true }));
+                const denied = await invoke();
+                expect(
+                  (await denied.json()) as unknown,
+                  "the row-level Disabled setting is enforced at the gateway",
+                ).toMatchObject({ error: { code: "tool_disabled" } });
+              },
+            );
+
+            await step(
+              "Inherit warns before the Disabled tool becomes source Enabled",
+              async () => {
+                await page.getByLabel(`Select ${tool.displayName}`).check();
+                await page.getByRole("button", { name: "Apply Inherit to 1 selected" }).click();
+                const confirmation = page.getByRole("group", {
+                  name: "Confirm bulk tool behavior",
+                });
+                await expectLocatorText(
+                  confirmation,
+                  "1 tool will become Enabled under its source default",
+                );
+                await confirmation.getByRole("button", { name: "Confirm Inherit" }).click();
+                await expectLocatorText(
+                  page.locator("#bulk-status"),
+                  "Inherit applied to 1 selected tool",
+                );
+                expect(
+                  (await invoke()).status,
+                  "the confirmed inherited Enabled mode is callable",
+                ).toBe(200);
+              },
+            );
+
+            await step("Set Ask from the tool row and approve its real gateway call", async () => {
+              const toolModes = page.getByRole("group", {
+                name: `Behavior for ${tool.displayName}`,
+              });
+              const changed = page.waitForResponse((response) => {
+                const url = new URL(response.url());
+                return (
+                  response.request().method() === "PATCH" &&
+                  url.pathname === `/api/v1/tools/${tool.id}/mode`
+                );
+              });
+              await toolModes.getByLabel("Ask", { exact: true }).check();
+              expect((await changed).status(), "the Ask row mutation reached the real API").toBe(
+                200,
+              );
+              await expectLocatorChecked(toolModes.getByLabel("Ask", { exact: true }));
+
+              const asked = await invoke(randomUUID());
+              expect(asked.status, "the row-level Ask setting pauses the gateway call").toBe(202);
+              const pending = (await asked.json()) as {
+                readonly approval: { readonly id: string; readonly statusUrl: string };
+              };
+              await page.goto(`/approvals?approval=${encodeURIComponent(pending.approval.id)}`);
+              await expectLocatorVisible(page.getByText(tool.callablePath, { exact: true }).last());
+              await page.getByRole("button", { name: "Approve once" }).click();
+              await page.getByRole("button", { name: "Yes, approve once" }).click();
+              await expectLocatorVisible(page.getByText(/was approved/i));
+              await expect
+                .poll(
+                  async () => {
+                    const response = await fetch(
+                      new URL(pending.approval.statusUrl, target.baseUrl),
+                      { headers: { authorization: `Bearer ${token.token}` } },
+                    );
+                    const body = (await response.json()) as { readonly status: string };
+                    return body.status;
+                  },
+                  { timeout: 10_000 },
+                )
+                .toBe("succeeded");
+              await page.goto(
+                `/tools?source=${encodeURIComponent(source.id)}&q=${encodeURIComponent("echo")}`,
+              );
+              await expectLocatorText(page.getByRole("table"), tool.displayName);
+            });
+
+            await step("Ask applies immediately to the selected tools", async () => {
+              await page.getByLabel("Select all active tools on this page").check();
+              await page
+                .getByRole("group", { name: "Set selected tools" })
+                .getByLabel("Ask")
+                .check();
+              await page.getByRole("button", { name: /^Apply Ask to \d+ selected$/ }).click();
+              await expectLocatorText(page.locator("#bulk-status"), "Ask applied");
+            });
+
+            await step("Disabling many tools requires a second confirmation", async () => {
+              const selectAll = page.getByLabel("Select all active tools on this page");
+              const selection = page.getByLabel(`Select ${tool.displayName}`);
+              const bulkModes = page.getByRole("group", { name: "Set selected tools" });
+              const toolModes = page.getByRole("group", {
+                name: `Behavior for ${tool.displayName}`,
+              });
+              const applyDisabled = page.getByRole("button", {
+                name: /^Apply Disabled to \d+ selected$/,
+              });
+              const applyInherit = page.getByRole("button", {
+                name: /^Apply Inherit to \d+ selected$/,
+              });
+
+              await selectAll.check();
+              await bulkModes.getByLabel("Disabled").check();
+              await applyDisabled.click();
+
+              let confirmation = page.getByRole("group", {
+                name: "Confirm bulk tool behavior",
+              });
+              let cancel = confirmation.getByRole("button", { name: "Cancel" });
+              await expectLocatorVisible(confirmation);
+              await expectLocatorFocused(cancel);
+              await expectLocatorDisabled(selectAll);
+              await expectLocatorDisabled(selection);
+              await expectLocatorDisabled(bulkModes.getByLabel("Disabled"));
+              await expectLocatorDisabled(toolModes.getByLabel("Ask", { exact: true }));
+              await expectLocatorDisabled(applyDisabled);
+              await expectLocatorDisabled(applyInherit);
+
+              await cancel.press("Escape");
+              await expectLocatorCount(confirmation, 0);
+              await expectLocatorFocused(applyDisabled);
+
+              await applyDisabled.click();
+              confirmation = page.getByRole("group", { name: "Confirm bulk tool behavior" });
+              cancel = confirmation.getByRole("button", { name: "Cancel" });
+              await expectLocatorFocused(cancel);
+              await cancel.click();
+              await expectLocatorCount(confirmation, 0);
+              await expectLocatorFocused(applyDisabled);
+
+              await applyDisabled.click();
+              confirmation = page.getByRole("group", { name: "Confirm bulk tool behavior" });
+              await confirmation.getByRole("button", { name: "Confirm Disabled" }).click();
+              const status = page.locator("#bulk-status");
+              await expectLocatorText(status, "Disabled applied");
+              await expectLocatorFocused(status);
+              const denied = await invoke();
+              expect(
+                (await denied.json()) as unknown,
+                "disabled tools are denied at the gateway",
+              ).toMatchObject({
+                error: { code: "tool_disabled" },
+              });
+            });
+
+            await step("Re-enabling many tools also requires deliberate confirmation", async () => {
+              await page.getByLabel("Effective mode").selectOption("disabled");
+              await page.getByLabel("Select all active tools on this page").check();
+              await page
+                .getByRole("group", { name: "Set selected tools" })
+                .getByLabel("Enabled")
+                .check();
+              await page.getByRole("button", { name: /^Apply Enabled to \d+ selected$/ }).click();
+              await page.getByRole("button", { name: "Confirm Enabled" }).click();
+              await expectLocatorText(page.locator("#bulk-status"), "Enabled applied");
+              expect((await invoke()).status, "enabled tools are callable without approval").toBe(
+                200,
+              );
+            });
+          });
+        }),
+        Effect.promise(() => client.deleteSource(source.id)).pipe(Effect.ignore),
+      );
+    }),
+  ),
+);
+
+scenario(
+  "MCP and CLI · bearer clients share the global catalog and concurrent runtime",
+  { timeout: 180_000 },
+  Effect.scoped(
+    Effect.gen(function* () {
+      const target = yield* Target;
+      const client = yield* adminClient(target.baseUrl);
+      const upstream = yield* serveOpenApiEchoTestServer();
+      const source = yield* Effect.promise(() =>
+        client.createSource({
+          kind: "openapi",
+          displayName: unique("MCP CLI source"),
+          spec: { type: "inline", content: upstream.specJson },
+          allowPrivateNetwork: true,
+        }),
+      );
+      const catalog = yield* Effect.promise(() => client.listTools({ sourceId: source.id }));
+      const tool = catalog.items.find((candidate) =>
+        candidate.sandboxPath.endsWith(".echo_echo_message"),
+      );
+      if (!tool) return yield* Effect.die("the MCP and CLI fixture produced no echo message tool");
+      yield* Effect.promise(() => client.setToolMode(tool, "enabled"));
+      const token = yield* acquireToken(client, target.baseUrl, unique("mcp-cli-agent"));
+      const binary = process.env.E2E_EXECUTOR_BIN;
+      if (!binary) return yield* Effect.die("the e2e harness did not publish its Executor binary");
+      const cliEnvironment = { ...process.env, EXECUTOR_API_TOKEN: token.token };
+      const cli = (arguments_: readonly string[]) =>
+        Effect.promise(() =>
+          executeFile(binary, ["--base-url", target.baseUrl, "--json", ...arguments_], {
+            env: cliEnvironment,
+          }),
+        );
+
+      yield* Effect.ensuring(
+        Effect.gen(function* () {
+          const sources = yield* cli(["tools", "sources"]);
+          expect(sources.stdout, "the CLI lists the source catalog").toContain(source.slug);
+          const search = yield* cli(["tools", "search", "echo"]);
+          expect(search.stdout, "the CLI searches the same global tools").toContain(
+            tool.sandboxPath,
+          );
+          const described = yield* cli(["tools", "describe", tool.sandboxPath]);
+          expect(described.stdout, "the CLI describes the selected tool").toContain(
+            tool.sandboxPath,
+          );
+          const called = yield* cli(["call", tool.sandboxPath, '{"path":{"message":"CLI"}}']);
+          expect(called.stdout, "the CLI calls the enabled tool").toContain("CLI");
+
+          const httpMcp = yield* Effect.acquireRelease(
+            Effect.promise(async () => {
+              const mcp = new Client({ name: "executor-e2e-http", version: "1.0.0" });
+              const transport = new StreamableHTTPClientTransport(new URL(target.mcpUrl), {
+                requestInit: { headers: { authorization: `Bearer ${token.token}` } },
+              });
+              await mcp.connect(transport);
+              return mcp;
+            }),
+            (mcp) => Effect.promise(() => mcp.close()).pipe(Effect.ignore),
+          );
+          const advertised = yield* Effect.promise(() => httpMcp.listTools());
+          expect(
+            advertised.tools.map((candidate) => candidate.name),
+            "HTTP MCP advertises the bounded gateway surface",
+          ).toEqual(expect.arrayContaining(["execute", "call", "search", "describe", "sources"]));
+          const executed = yield* Effect.promise(() =>
+            httpMcp.callTool({
+              name: "execute",
+              arguments: {
+                code: `const values = await Promise.all([${tool.callablePath}({ path: { message: "one" } }), ${tool.callablePath}({ path: { message: "two" } })]); return values;`,
+              },
+            }),
+          );
+          expect(
+            JSON.stringify(executed),
+            "the TS runtime completes two concurrent calls",
+          ).toContain("one");
+          expect(JSON.stringify(executed)).toContain("two");
+
+          const stdioMcp = yield* Effect.acquireRelease(
+            Effect.promise(async () => {
+              const mcp = new Client({ name: "executor-e2e-stdio", version: "1.0.0" });
+              const transport = new StdioClientTransport({
+                command: binary,
+                args: ["--base-url", target.baseUrl, "mcp"],
+                env: {
+                  PATH: process.env.PATH ?? "",
+                  HOME: process.env.HOME ?? "",
+                  EXECUTOR_API_TOKEN: token.token,
+                },
+                stderr: "pipe",
+              });
+              await mcp.connect(transport);
+              return mcp;
+            }),
+            (mcp) => Effect.promise(() => mcp.close()).pipe(Effect.ignore),
+          );
+          const bridged = yield* Effect.promise(() => stdioMcp.listTools());
+          expect(
+            bridged.tools.map((candidate) => candidate.name),
+            "the CLI stdio bridge exposes the same MCP tools",
+          ).toEqual(advertised.tools.map((candidate) => candidate.name));
+
+          yield* Effect.promise(() => client.revokeToken(token.id));
+          const afterRevocation = yield* Effect.exit(Effect.tryPromise(() => httpMcp.listTools()));
+          expect(afterRevocation._tag, "revocation invalidates an existing MCP session").toBe(
+            "Failure",
+          );
+        }),
+        Effect.promise(() => client.deleteSource(source.id)).pipe(Effect.ignore),
+      );
+    }),
+  ),
+);
+
+scenario(
+  "Approvals and logs · an Ask call waits for one administrator decision",
+  { timeout: 180_000 },
+  Effect.scoped(
+    Effect.gen(function* () {
+      const target = yield* Target;
+      const browser = yield* Browser;
+      const client = yield* adminClient(target.baseUrl);
+      const upstream = yield* serveOpenApiEchoTestServer();
+      const source = yield* Effect.promise(() =>
+        client.createSource({
+          kind: "openapi",
+          displayName: unique("Approval source"),
+          spec: { type: "inline", content: upstream.specJson },
+          allowPrivateNetwork: true,
+        }),
+      );
+
+      yield* Effect.ensuring(
+        Effect.gen(function* () {
+          const page = yield* Effect.promise(() => client.listTools({ sourceId: source.id }));
+          const tool = page.items.find((candidate) =>
+            candidate.sandboxPath.endsWith(".echo_echo_message"),
+          );
+          if (!tool) return yield* Effect.die("the approval fixture produced no echo message tool");
+          yield* Effect.promise(() => client.setToolMode(tool, "ask"));
+          const token = yield* acquireToken(client, target.baseUrl, unique("approval-agent"));
+          const invoke = yield* Effect.promise(() =>
+            fetch(new URL("/api/v1/gateway/tools/invoke", target.baseUrl), {
+              method: "POST",
+              headers: {
+                authorization: `Bearer ${token.token}`,
+                "content-type": "application/json",
+                "idempotency-key": randomUUID(),
+              },
+              body: JSON.stringify({
+                path: tool.callablePath,
+                arguments: { path: { message: "Ada" } },
+              }),
+            }),
+          );
+          const invokeBody = yield* Effect.promise(() => invoke.clone().text());
+          expect(invoke.status, `Ask returns an accepted approval handle: ${invokeBody}`).toBe(202);
+          const pending = (yield* Effect.promise(() => invoke.json())) as {
+            readonly approval: { readonly id: string; readonly statusUrl: string };
+          };
+          const approvalStatusUrl = new URL(pending.approval.statusUrl, target.baseUrl);
+          expect(approvalStatusUrl.origin, "the bearer stays on this Executor origin").toBe(
+            new URL(target.baseUrl).origin,
+          );
+          expect(approvalStatusUrl.pathname, "the handle names this exact approval").toBe(
+            `/api/v1/gateway/approvals/${pending.approval.id}`,
+          );
+
+          const identity = yield* target.newIdentity();
+          yield* browser.session(identity, async ({ page, step }) => {
+            await step("Review the exact pending request", async () => {
+              await page.goto(`/approvals?approval=${encodeURIComponent(pending.approval.id)}`);
+              await expectLocatorVisible(page.getByText(tool.callablePath, { exact: true }).last());
+              await expectLocatorVisible(page.getByText("Structural, redacted argument preview"));
+            });
+            await step("Approve this invocation once", async () => {
+              await page.getByRole("button", { name: "Approve once" }).click();
+              await page.getByRole("button", { name: "Yes, approve once" }).click();
+              await expectLocatorVisible(page.getByText(/was approved/i));
+            });
+            await step("Open Logs and find the completed gateway request", async () => {
+              await page.goto("/logs");
+              await expectLocatorVisible(
+                page.getByText(tool.callablePath, { exact: true }).first(),
+              );
+            });
+          });
+
+          const completed = yield* Effect.promise(async () => {
+            for (let attempt = 0; attempt < 80; attempt += 1) {
+              const response = await fetch(approvalStatusUrl, {
+                headers: { authorization: `Bearer ${token.token}` },
+              });
+              const body = (await response.json()) as { readonly status: string };
+              if (!["pending", "approved", "executing"].includes(body.status)) return body;
+              await new Promise((resolveWait) => setTimeout(resolveWait, 100));
+            }
+            throw new Error("approved call did not finish");
+          });
+          expect(completed.status, "the approved invocation runs exactly once").toBe("succeeded");
+          const requests = yield* upstream.requests;
+          expect(
+            requests.filter((request) => request.path.startsWith("/echo/")).length,
+            "one approval produces one upstream side effect",
+          ).toBe(1);
+        }),
+        Effect.promise(() => client.deleteSource(source.id)).pipe(Effect.ignore),
+      );
+    }),
+  ),
+);
+
+scenario(
+  "Managed OAuth · the provider callback connects a source without exposing tokens",
+  { timeout: 180_000 },
+  Effect.scoped(
+    Effect.gen(function* () {
+      const target = yield* Target;
+      const browser = yield* Browser;
+      const client = yield* adminClient(target.baseUrl);
+      const provider = yield* serveOAuthTestProvider(emulatorPortC);
+      const source = yield* Effect.promise(() =>
+        client.createSource({
+          kind: "mcp_http",
+          displayName: unique("Managed OAuth"),
+          allowPrivateNetwork: true,
+          endpoint: provider.endpoint,
+        }),
+      );
+
+      yield* Effect.ensuring(
+        Effect.gen(function* () {
+          const available = yield* Effect.promise(() => client.getOAuthConnections(source.id));
+          const credentialKey = available.availableCredentials[0]?.credentialKey;
+          if (!credentialKey) return yield* Effect.die("the OAuth source exposed no credential");
+          const placeholder = yield* Effect.promise(() =>
+            client.putOAuthConnection(source.id, credentialKey, {
+              expectedRevision: 0,
+              discovery: { type: "issuer", issuer: provider.issuer },
+              client: { clientId: "pending-dynamic-registration", authentication: "none" },
+              scopes: ["repo", "read:user"],
+            }),
+          );
+          const clientId = yield* Effect.promise(() =>
+            provider.registerClient(placeholder.callbackUrl),
+          );
+          const connection = yield* Effect.promise(() =>
+            client.putOAuthConnection(source.id, credentialKey, {
+              expectedRevision: placeholder.revision,
+              discovery: { type: "issuer", issuer: provider.issuer },
+              client: { clientId, authentication: "none" },
+              scopes: ["repo", "read:user"],
+            }),
+          );
+          expect(connection.callbackUrl, "the callback is connection-specific").toContain(
+            "/api/v1/oauth/callback/",
+          );
+          const authorization = yield* Effect.promise(() =>
+            client.authorizeOAuthConnection(source.id, credentialKey, connection.revision),
+          );
+          const identity = client.asIdentity(LOCAL_ADMIN.username);
+          yield* browser.privateSession(identity, async ({ page, step }) => {
+            await step(
+              "Follow the provider authorization back to this exact connection",
+              async () => {
+                const callbackUrl = await provider.approveAuthorization(
+                  authorization.authorizationUrl,
+                  LOCAL_ADMIN.username,
+                );
+                const returnedToExecutor = page.waitForURL(
+                  (url) => url.pathname === "/sources" && url.searchParams.has("oauth"),
+                  { waitUntil: "commit" },
+                );
+                await page.goto(callbackUrl);
+                await returnedToExecutor;
+                await expectLocatorVisible(page.getByText("OAuth authorization completed"));
+                await expectLocatorVisible(page.getByText("Connected", { exact: true }).last());
+              },
+            );
+          });
+          const after = yield* Effect.promise(() => client.getOAuthConnections(source.id));
+          expect(after.connections[0]?.status, "the callback exchanged the code").toBe("connected");
+          yield* Effect.promise(() => client.refreshSource(source.id));
+          yield* browser.session(identity, async ({ page, step }) => {
+            await step("Return to Sources and see the managed connection online", async () => {
+              await page.goto("/sources");
+              await expectLocatorVisible(page.getByText(source.displayName, { exact: true }));
+              const oauth = page.getByRole("region", {
+                name: `Managed OAuth for ${source.displayName}`,
+              });
+              await expectLocatorVisible(oauth.getByText("Connected", { exact: true }));
+            });
+            await step(
+              "Cancel OAuth deletion with the keyboard and return to its opener",
+              async () => {
+                const oauth = page.getByRole("region", {
+                  name: `Managed OAuth for ${source.displayName}`,
+                });
+                const deleteOpener = oauth.getByRole("button", { name: "Delete configuration" });
+                await deleteOpener.click();
+                const confirmation = oauth.getByRole("dialog", {
+                  name: "Delete this OAuth configuration?",
+                });
+                const cancel = confirmation.getByRole("button", { name: "Cancel" });
+                await expectLocatorVisible(confirmation);
+                await expectLocatorFocused(cancel);
+                await cancel.press("Escape");
+                await expectLocatorCount(confirmation, 0);
+                await expectLocatorFocused(deleteOpener);
+              },
+            );
+          });
+          const tools = yield* Effect.promise(() => client.listTools({ sourceId: source.id }));
+          const tool = tools.items.find((candidate) => candidate.stableKey.endsWith("get_me"));
+          if (!tool) return yield* Effect.die("the managed OAuth source produced no tool");
+          const enabled = yield* Effect.promise(() => client.setToolMode(tool, "enabled"));
+          const token = yield* acquireToken(client, target.baseUrl, unique("oauth-agent"));
+          const callsBefore = (yield* Effect.promise(() => provider.ledger())).filter(
+            isSuccessfulMcpToolCall,
+          ).length;
+          const invoked = yield* Effect.promise(() =>
+            fetch(new URL("/api/v1/gateway/tools/invoke", target.baseUrl), {
+              method: "POST",
+              headers: {
+                authorization: `Bearer ${token.token}`,
+                "content-type": "application/json",
+              },
+              body: JSON.stringify({ path: enabled.callablePath, arguments: {} }),
+            }),
+          );
+          expect(invoked.status, "the connected OAuth tool is callable").toBe(200);
+          expect(
+            (yield* Effect.promise(() => provider.ledger())).filter(isSuccessfulMcpToolCall).length,
+            "the emulator ledger records an authenticated MCP tool call",
+          ).toBeGreaterThan(callsBefore);
+        }),
+        Effect.promise(() => client.deleteSource(source.id)).pipe(Effect.ignore),
+      );
+    }),
+  ),
+);
diff --git a/e2e/local/cli-open-stale-manifest.test.ts b/e2e/local/cli-open-stale-manifest.test.ts
index c33aab461..b75a10778 100644
--- a/e2e/local/cli-open-stale-manifest.test.ts
+++ b/e2e/local/cli-open-stale-manifest.test.ts
@@ -67,7 +67,7 @@ scenario(
       writeFileSync(openerPath, "#!/bin/sh\nexit 0\n", { mode: 0o755 });
       chmodSync(openerPath, 0o755);
 
-      const { stdout, stderr } = await execFileAsync("bun", ["run", "dev:cli", "open"], {
+      const { stdout, stderr } = await execFileAsync("bun", ["run", "legacy:dev:cli", "open"], {
         cwd: repoRoot,
         env: {
           ...process.env,
diff --git a/e2e/local/cli-systemd-unit-escaping.test.ts b/e2e/local/cli-systemd-unit-escaping.test.ts
index ead36d92d..dae36ab77 100644
--- a/e2e/local/cli-systemd-unit-escaping.test.ts
+++ b/e2e/local/cli-systemd-unit-escaping.test.ts
@@ -4,7 +4,7 @@
 import { expect } from "@effect/vitest";
 import { Effect } from "effect";
 
-import { generateSystemdUnit } from "../../apps/cli/src/service";
+import { generateSystemdUnit } from "../../legacy/cli/src/service";
 import { scenario } from "../src/scenario";
 
 scenario(
diff --git a/e2e/local/cli-web-transition.test.ts b/e2e/local/cli-web-transition.test.ts
index c6865c416..a549b5854 100644
--- a/e2e/local/cli-web-transition.test.ts
+++ b/e2e/local/cli-web-transition.test.ts
@@ -25,7 +25,7 @@ scenario(
     const root = mkdtempSync(join(tmpdir(), "executor-web-transition-"));
     const dataDir = join(root, "data");
     try {
-      const { stdout, stderr } = await execFileAsync("bun", ["run", "dev:cli", "web"], {
+      const { stdout, stderr } = await execFileAsync("bun", ["run", "legacy:dev:cli", "web"], {
         cwd: repoRoot,
         env: { ...process.env, EXECUTOR_DATA_DIR: dataDir },
       });
diff --git a/e2e/local/local-server.ts b/e2e/local/local-server.ts
index 818b272fb..b73f8a0cd 100644
--- a/e2e/local/local-server.ts
+++ b/e2e/local/local-server.ts
@@ -55,7 +55,7 @@ export const withLocalServer = (
     yield* Effect.all(
       [
         cli.session(
-          ["bun", "run", "dev:cli", "web", "--foreground", "--port", "0"],
+          ["bun", "run", "legacy:dev:cli", "web", "--foreground", "--port", "0"],
           async (term) => {
             markRecordingStart(runDir, "terminal");
             markFocus(runDir, "terminal");
diff --git a/e2e/local/vite-dev-routing.test.ts b/e2e/local/vite-dev-routing.test.ts
index 287eb3f8c..1d6de523d 100644
--- a/e2e/local/vite-dev-routing.test.ts
+++ b/e2e/local/vite-dev-routing.test.ts
@@ -1,4 +1,4 @@
-// Local-only: plain `apps/local` Vite dev must route the same local-only HTTP
+// Local-only: plain `legacy/local` Vite dev must route the same local-only HTTP
 // surfaces as production `executor web`. These routes live outside the typed
 // `/api` HttpApi: `/api/health`, `/api/oauth/await/*`, and browser approval's
 // `/api/mcp-sessions/*`.
@@ -19,7 +19,7 @@ import { scenario } from "../src/scenario";
 import { waitForHttp } from "../setup/boot";
 
 const repoRoot = fileURLToPath(new URL("../../", import.meta.url));
-const localAppDir = join(repoRoot, "apps/local");
+const localAppDir = join(repoRoot, "legacy/local");
 
 const APPROVAL_TARGET_TOOL = "executor.coreTools.policies.list";
 const EXECUTE_CODE = `
@@ -221,7 +221,7 @@ scenario(
 
       expect(
         failures,
-        "plain apps/local Vite dev should special-case the same local-only routes as production",
+        "plain legacy/local Vite dev should special-case the same local-only routes as production",
       ).toEqual([]);
     });
   }),
diff --git a/e2e/package.json b/e2e/package.json
index 06370f939..a702c27c4 100644
--- a/e2e/package.json
+++ b/e2e/package.json
@@ -5,18 +5,20 @@
   "type": "module",
   "scripts": {
     "cli": "bun scripts/cli.ts",
-    "test": "vitest run --project cloud && vitest run --project selfhost",
-    "test:cloud": "vitest run --project cloud",
-    "test:selfhost": "vitest run --project selfhost",
-    "test:selfhost-docker": "vitest run --project selfhost-docker",
-    "test:cloudflare": "vitest run --project cloudflare",
-    "test:watch": "vitest",
+    "test": "vitest run --project local-selfhost",
+    "test:local": "vitest run --project local-selfhost",
+    "test:unit": "vitest run --config vitest.unit.config.ts",
+    "test:legacy:cloud": "vitest run --config vitest.legacy.config.ts --project cloud",
+    "test:legacy:selfhost": "vitest run --config vitest.legacy.config.ts --project selfhost",
+    "test:legacy:selfhost-docker": "vitest run --config vitest.legacy.config.ts --project selfhost-docker",
+    "test:legacy:cloudflare": "vitest run --config vitest.legacy.config.ts --project cloudflare",
+    "test:watch": "vitest --project local-selfhost",
     "ports": "bun scripts/ports.ts",
     "summary": "bun scripts/summary.ts",
     "viewer:build": "bun scripts/rebuild-viewer.ts",
     "serve": "bun scripts/rebuild-viewer.ts && bun scripts/serve.ts",
     "typecheck": "tsc --noEmit",
-    "test:desktop": "vitest run --project desktop",
+    "test:legacy:desktop": "vitest run --config vitest.legacy.config.ts --project desktop",
     "motel": "MOTEL_OTEL_BASE_URL=http://127.0.0.1:4796 MOTEL_OTEL_DB_PATH=runs/.motel/telemetry.sqlite motel server"
   },
   "dependencies": {
diff --git a/e2e/scripts/ports.ts b/e2e/scripts/ports.ts
index 1724a41d9..5a3d61428 100644
--- a/e2e/scripts/ports.ts
+++ b/e2e/scripts/ports.ts
@@ -10,6 +10,7 @@ import {
   WORKOS_EMULATOR_PORT,
 } from "../targets/cloud";
 import { SELFHOST_PORT } from "../targets/selfhost";
+import { LOCAL_SELFHOST_PORT, LOCAL_SETUP_PORT } from "../targets/local-selfhost";
 import { repoRoot } from "../src/ports";
 
 console.log(`preferred e2e ports for ${repoRoot}`);
@@ -18,3 +19,5 @@ console.log(`  cloud dev-db    ${CLOUD_DB_PORT}`);
 console.log(`  workos emulator ${WORKOS_EMULATOR_PORT}`);
 console.log(`  autumn emulator ${AUTUMN_EMULATOR_PORT}`);
 console.log(`  selfhost        http://localhost:${SELFHOST_PORT}`);
+console.log(`  local executor  http://127.0.0.1:${LOCAL_SELFHOST_PORT}`);
+console.log(`  first boot      http://127.0.0.1:${LOCAL_SETUP_PORT}`);
diff --git a/e2e/setup/cloud.boot.ts b/e2e/setup/cloud.boot.ts
index 24e7cd9c9..b5c072c6f 100644
--- a/e2e/setup/cloud.boot.ts
+++ b/e2e/setup/cloud.boot.ts
@@ -12,7 +12,7 @@ import { createEmulator } from "@executor-js/emulate";
 
 import { bootProcesses, waitForHttp } from "./boot";
 
-export const cloudDir = fileURLToPath(new URL("../../apps/cloud/", import.meta.url));
+export const cloudDir = fileURLToPath(new URL("../../legacy/cloud/", import.meta.url));
 
 export interface CloudBootOptions {
   readonly cloudPort: number;
diff --git a/e2e/setup/cloudflare.boot.ts b/e2e/setup/cloudflare.boot.ts
index df58a54b7..8020b2f1d 100644
--- a/e2e/setup/cloudflare.boot.ts
+++ b/e2e/setup/cloudflare.boot.ts
@@ -11,9 +11,11 @@ import { promisify } from "node:util";
 
 import { bootProcesses, waitForHttp, type BootedProcesses } from "./boot";
 
-export const cloudflareDir = fileURLToPath(new URL("../../apps/host-cloudflare/", import.meta.url));
+export const cloudflareDir = fileURLToPath(
+  new URL("../../legacy/host-cloudflare/", import.meta.url),
+);
 const wranglerBin = fileURLToPath(
-  new URL("../../apps/host-cloudflare/node_modules/.bin/wrangler", import.meta.url),
+  new URL("../../legacy/host-cloudflare/node_modules/.bin/wrangler", import.meta.url),
 );
 
 export interface CloudflareBootOptions {
diff --git a/e2e/setup/desktop-packaged.globalsetup.ts b/e2e/setup/desktop-packaged.globalsetup.ts
index 14a0f3b7a..acef3452c 100644
--- a/e2e/setup/desktop-packaged.globalsetup.ts
+++ b/e2e/setup/desktop-packaged.globalsetup.ts
@@ -16,7 +16,7 @@ import { existsSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { join } from "node:path";
 
-const appDir = fileURLToPath(new URL("../../apps/desktop/", import.meta.url));
+const appDir = fileURLToPath(new URL("../../legacy/desktop/", import.meta.url));
 
 // (launch exe, bundled executor binary) inside the packaged bundle, per platform.
 const bundlePaths = (): { exe: string; executor: string } => {
diff --git a/e2e/setup/desktop.globalsetup.ts b/e2e/setup/desktop.globalsetup.ts
index ab2d74a2d..4108e1c1d 100644
--- a/e2e/setup/desktop.globalsetup.ts
+++ b/e2e/setup/desktop.globalsetup.ts
@@ -7,7 +7,7 @@ import { execFileSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 
 const repoRoot = fileURLToPath(new URL("../../", import.meta.url));
-const appsDesktop = fileURLToPath(new URL("../../apps/desktop/", import.meta.url));
+const appsDesktop = fileURLToPath(new URL("../../legacy/desktop/", import.meta.url));
 
 export default function setup() {
   execFileSync("bun", ["run", "--filter", "@executor-js/local", "build"], {
diff --git a/e2e/setup/local-selfhost.globalsetup.ts b/e2e/setup/local-selfhost.globalsetup.ts
new file mode 100644
index 000000000..d104a2338
--- /dev/null
+++ b/e2e/setup/local-selfhost.globalsetup.ts
@@ -0,0 +1,161 @@
+import { spawn, type ChildProcess } from "node:child_process";
+import { existsSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { resolve } from "node:path";
+
+import { claimPorts, repoRoot } from "../src/ports";
+import { LOCAL_ADMIN } from "../targets/local-selfhost";
+import { waitForHttp } from "./boot";
+
+interface BootedExecutor {
+  readonly child: ChildProcess;
+  readonly dataDir: string;
+  readonly setupToken: string;
+}
+
+const stop = async (process: ChildProcess) => {
+  if (process.pid === undefined || process.exitCode !== null) return;
+  const exited = new Promise<void>((resolveExit) => process.once("exit", () => resolveExit()));
+  try {
+    globalThis.process.kill(-process.pid, "SIGTERM");
+  } catch {
+    process.kill("SIGTERM");
+  }
+  const graceful = await Promise.race([
+    exited.then(() => true),
+    new Promise<false>((resolveGrace) => setTimeout(() => resolveGrace(false), 5_000)),
+  ]);
+  if (!graceful) {
+    try {
+      globalThis.process.kill(-process.pid, "SIGKILL");
+    } catch {
+      process.kill("SIGKILL");
+    }
+    await Promise.race([exited, new Promise((resolveWait) => setTimeout(resolveWait, 2_000))]);
+  }
+};
+
+const bootExecutor = async (
+  binary: string,
+  port: number,
+  label: string,
+): Promise<BootedExecutor> => {
+  const dataDir = mkdtempSync(`${tmpdir()}/executor-e2e-${label}-`);
+  const stdioTemplatesFile = resolve(dataDir, "mcp-stdio-templates.json");
+  writeFileSync(
+    stdioTemplatesFile,
+    JSON.stringify({
+      templates: [
+        {
+          name: "executor-e2e-stdio",
+          executable: process.execPath,
+          cwd: repoRoot,
+          arguments: [resolve(repoRoot, "e2e/fixtures/stdio-mcp-server.mjs")],
+          environment: {},
+          secretEnvironment: ["EXECUTOR_E2E_STDIO_SECRET"],
+        },
+      ],
+    }),
+  );
+  const child = spawn(
+    binary,
+    [
+      "server",
+      "--bind",
+      `127.0.0.1:${port}`,
+      "--data-dir",
+      dataDir,
+      "--public-origin",
+      `http://127.0.0.1:${port}`,
+      "--mcp-stdio-templates",
+      stdioTemplatesFile,
+    ],
+    { cwd: repoRoot, detached: true, stdio: ["ignore", "pipe", "pipe"] },
+  );
+  let output = "";
+  let collectingSetupLink = true;
+  const capture = (chunk: Buffer) => {
+    if (!collectingSetupLink) return;
+    output = `${output}${chunk.toString("utf8")}`.slice(-64 * 1024);
+  };
+  child.stdout?.on("data", capture);
+  child.stderr?.on("data", capture);
+
+  try {
+    await waitForHttp(`http://127.0.0.1:${port}/api/v1/bootstrap`, { timeoutMs: 30_000 });
+    const deadline = Date.now() + 10_000;
+    while (!output.match(/\/setup#token=([^\s]+)/) && Date.now() < deadline) {
+      await new Promise((resolveWait) => setTimeout(resolveWait, 50));
+    }
+    const setupToken = output.match(/\/setup#token=([^\s]+)/)?.[1];
+    if (!setupToken) throw new Error(`could not read setup token from ${label} server output`);
+    collectingSetupLink = false;
+    output = "";
+    return { child, dataDir, setupToken };
+  } catch (error) {
+    await stop(child);
+    rmSync(dataDir, { recursive: true, force: true });
+    throw error;
+  }
+};
+
+const completeSetup = async (baseUrl: string, setupToken: string) => {
+  const response = await fetch(new URL("/api/v1/setup", baseUrl), {
+    method: "POST",
+    headers: { "content-type": "application/json", origin: new URL(baseUrl).origin },
+    body: JSON.stringify({ setupToken, ...LOCAL_ADMIN }),
+  });
+  if (!response.ok) {
+    throw new Error(`could not prepare local selfhost administrator (${response.status})`);
+  }
+};
+
+export default async function setup(): Promise<() => Promise<void>> {
+  if (process.env.E2E_LOCAL_SELFHOST_URL || process.env.E2E_LOCAL_SETUP_URL) {
+    throw new Error(
+      "The complete local e2e suite needs two fresh instances. Run without E2E_LOCAL_SELFHOST_URL and E2E_LOCAL_SETUP_URL.",
+    );
+  }
+  const binary = resolve(
+    process.env.E2E_EXECUTOR_BIN ?? resolve(repoRoot, "target/debug/executor"),
+  );
+  if (!existsSync(binary)) {
+    throw new Error(
+      `Executor binary not found at ${binary}. Run the root test:e2e command so the Svelte assets and Rust binary are prepared first.`,
+    );
+  }
+  process.env.E2E_EXECUTOR_BIN = binary;
+
+  const { ports, release } = await claimPorts([
+    { envVar: "E2E_LOCAL_SELFHOST_PORT", offset: 4, label: "Rust local selfhost" },
+    { envVar: "E2E_LOCAL_SETUP_PORT", offset: 5, label: "Rust first-boot setup" },
+    { envVar: "E2E_LOCAL_EMULATOR_A_PORT", offset: 6, label: "local emulator A" },
+    { envVar: "E2E_LOCAL_EMULATOR_B_PORT", offset: 7, label: "local emulator B" },
+    { envVar: "E2E_LOCAL_EMULATOR_C_PORT", offset: 8, label: "local emulator C" },
+  ]);
+  const mainPort = ports.E2E_LOCAL_SELFHOST_PORT!;
+  const setupPort = ports.E2E_LOCAL_SETUP_PORT!;
+  const main = await bootExecutor(binary, mainPort, "main");
+  let firstBoot: BootedExecutor | undefined;
+  try {
+    await completeSetup(`http://127.0.0.1:${mainPort}`, main.setupToken);
+    firstBoot = await bootExecutor(binary, setupPort, "setup");
+    process.env.E2E_LOCAL_SELFHOST_URL = `http://127.0.0.1:${mainPort}`;
+    process.env.E2E_LOCAL_SETUP_URL = `http://127.0.0.1:${setupPort}`;
+    process.env.E2E_LOCAL_SETUP_TOKEN = firstBoot.setupToken;
+  } catch (error) {
+    await stop(main.child);
+    if (firstBoot) await stop(firstBoot.child);
+    rmSync(main.dataDir, { recursive: true, force: true });
+    if (firstBoot) rmSync(firstBoot.dataDir, { recursive: true, force: true });
+    await release();
+    throw error;
+  }
+
+  return async () => {
+    await Promise.all([stop(main.child), stop(firstBoot.child)]);
+    rmSync(main.dataDir, { recursive: true, force: true });
+    rmSync(firstBoot.dataDir, { recursive: true, force: true });
+    await release();
+  };
+}
diff --git a/e2e/setup/selfhost-docker.boot.ts b/e2e/setup/selfhost-docker.boot.ts
index 67f49d0fb..0390b66a2 100644
--- a/e2e/setup/selfhost-docker.boot.ts
+++ b/e2e/setup/selfhost-docker.boot.ts
@@ -1,5 +1,5 @@
 // Boot recipe for the selfhost PRODUCTION Docker artifact: build the image
-// from this checkout's apps/host-selfhost/Dockerfile (or use
+// from this checkout's legacy/host-selfhost/Dockerfile (or use
 // E2E_SELFHOST_DOCKER_IMAGE, e.g. a published ghcr tag), then run it.
 //
 // The container runs with HOST networking, for the same reason the dev-server
@@ -56,8 +56,8 @@ const resolveImage = async (logFile?: string): Promise<string> => {
   const pinned = process.env.E2E_SELFHOST_DOCKER_IMAGE;
   if (pinned) return pinned;
   const image = "executor-selfhost:e2e";
-  log(logFile, `building ${image} from ${repoRoot}apps/host-selfhost/Dockerfile`);
-  await exec("docker", ["build", "-f", "apps/host-selfhost/Dockerfile", "-t", image, "."], {
+  log(logFile, `building ${image} from ${repoRoot}legacy/host-selfhost/Dockerfile`);
+  await exec("docker", ["build", "-f", "legacy/host-selfhost/Dockerfile", "-t", image, "."], {
     cwd: repoRoot,
     maxBuffer: 64 * 1024 * 1024,
   }).catch((error: { stdout?: string; stderr?: string }) => {
diff --git a/e2e/setup/selfhost.boot.ts b/e2e/setup/selfhost.boot.ts
index 6f0d743d7..b1be07e00 100644
--- a/e2e/setup/selfhost.boot.ts
+++ b/e2e/setup/selfhost.boot.ts
@@ -7,7 +7,7 @@ import { fileURLToPath } from "node:url";
 
 import { bootProcesses, waitForHttp, type BootedProcesses } from "./boot";
 
-export const selfhostDir = fileURLToPath(new URL("../../apps/host-selfhost/", import.meta.url));
+export const selfhostDir = fileURLToPath(new URL("../../legacy/host-selfhost/", import.meta.url));
 
 export interface SelfhostBootOptions {
   readonly port: number;
diff --git a/e2e/src/local-admin.test.ts b/e2e/src/local-admin.test.ts
new file mode 100644
index 000000000..de2f24b60
--- /dev/null
+++ b/e2e/src/local-admin.test.ts
@@ -0,0 +1,215 @@
+import { createHash, randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+
+import { expect, it } from "@effect/vitest";
+import { Effect } from "effect";
+
+import { LocalAdminClient } from "./local-admin";
+
+const digest = (value: string) => createHash("sha256").update(value).digest("hex");
+
+it.effect("reuses one administrator session across API and browser identities", () =>
+  Effect.acquireUseRelease(
+    Effect.promise(async () => {
+      const session = randomBytes(32).toString("hex");
+      const csrf = randomBytes(32).toString("hex");
+      let observedCookie: string | undefined;
+      const server = createServer((request, response) => {
+        request.resume();
+        if (request.method === "POST" && request.url === "/api/v1/session") {
+          response.statusCode = 200;
+          response.setHeader("content-type", "application/json");
+          response.setHeader("set-cookie", [
+            `executor_session=${session}; Path=/; HttpOnly; SameSite=Lax`,
+            `executor_csrf=${csrf}; Path=/; SameSite=Lax`,
+          ]);
+          response.end("{}");
+          return;
+        }
+        if (request.method === "GET" && request.url === "/api/v1/sources") {
+          observedCookie = request.headers.cookie;
+          response.statusCode = 200;
+          response.setHeader("content-type", "application/json");
+          response.end('{"sources":[]}');
+          return;
+        }
+        response.statusCode = 404;
+        response.end();
+      });
+      await new Promise<void>((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(0, "127.0.0.1", resolve);
+      });
+      const address = server.address();
+      if (address === null || typeof address === "string") {
+        throw new Error("administrator test server has no TCP address");
+      }
+      return {
+        origin: `http://127.0.0.1:${address.port}`,
+        server,
+        observedCookie: () => observedCookie,
+      };
+    }),
+    ({ origin, observedCookie }) =>
+      Effect.gen(function* () {
+        const client = yield* Effect.promise(() =>
+          LocalAdminClient.signIn(origin, "admin", "test-password"),
+        );
+        const identity = client.asIdentity("admin");
+        yield* Effect.promise(() => client.listSources());
+
+        expect(identity.label).toBe("admin");
+        expect(identity.credentials).toBeUndefined();
+        expect(identity.cookies?.map((cookie) => cookie.name).sort()).toEqual([
+          "executor_csrf",
+          "executor_session",
+        ]);
+        expect(
+          identity.cookies?.map((cookie) => ({
+            name: cookie.name,
+            valueLength: cookie.value.length,
+          })),
+        ).toEqual([
+          { name: "executor_session", valueLength: 64 },
+          { name: "executor_csrf", valueLength: 64 },
+        ]);
+
+        const apiCookie = observedCookie();
+        const identityCookie = identity.headers?.cookie;
+        const browserCookie = identity.cookies
+          ?.map((cookie) => `${cookie.name}=${cookie.value}`)
+          .join("; ");
+        if (!apiCookie || !identityCookie || !browserCookie) {
+          return yield* Effect.die("administrator identity omitted its session cookies");
+        }
+        expect(digest(identityCookie), "the browser header keeps API session A").toBe(
+          digest(apiCookie),
+        );
+        expect(digest(browserCookie), "Playwright receives the same session A cookie pairs").toBe(
+          digest(apiCookie),
+        );
+      }),
+    ({ server }) =>
+      Effect.callback<void, Error>((resume) => {
+        server.close((error) => resume(error ? Effect.fail(error) : Effect.succeed(undefined)));
+      }),
+  ),
+);
+
+it.effect("refreshes a tool revision once after an optimistic update conflict", () =>
+  Effect.acquireUseRelease(
+    Effect.promise(async () => {
+      const session = randomBytes(32).toString("hex");
+      const csrf = randomBytes(32).toString("hex");
+      const updateBodies: string[] = [];
+      const server = createServer((request, response) => {
+        if (request.method === "POST" && request.url === "/api/v1/session") {
+          request.resume();
+          response.statusCode = 200;
+          response.setHeader("content-type", "application/json");
+          response.setHeader("set-cookie", [
+            `executor_session=${session}; Path=/; HttpOnly; SameSite=Lax`,
+            `executor_csrf=${csrf}; Path=/; SameSite=Lax`,
+          ]);
+          response.end("{}");
+          return;
+        }
+        if (request.method === "GET" && request.url === "/api/v1/tools/tool-1") {
+          request.resume();
+          response.statusCode = 200;
+          response.setHeader("content-type", "application/json");
+          response.end(
+            JSON.stringify({
+              id: "tool-1",
+              sourceId: "source-1",
+              stableKey: "hello",
+              displayName: "Hello",
+              callablePath: "tools.source_1.hello",
+              sandboxPath: "executor.tools.source_1.hello",
+              revision: 2,
+              effectiveMode: { mode: "disabled" },
+            }),
+          );
+          return;
+        }
+        if (request.method === "PATCH" && request.url === "/api/v1/tools/tool-1/mode") {
+          request.setEncoding("utf8");
+          let body = "";
+          request.on("data", (chunk) => {
+            body += chunk;
+          });
+          request.on("end", () => {
+            updateBodies.push(body);
+            response.setHeader("content-type", "application/json");
+            if (updateBodies.length === 1) {
+              response.statusCode = 409;
+              response.end('{"error":{"code":"revision_conflict","message":"Refresh and retry."}}');
+              return;
+            }
+            response.statusCode = 200;
+            response.end(
+              JSON.stringify({
+                id: "tool-1",
+                sourceId: "source-1",
+                stableKey: "hello",
+                displayName: "Hello",
+                callablePath: "tools.source_1.hello",
+                sandboxPath: "executor.tools.source_1.hello",
+                revision: 3,
+                effectiveMode: { mode: "enabled" },
+              }),
+            );
+          });
+          return;
+        }
+        request.resume();
+        response.statusCode = 404;
+        response.end();
+      });
+      await new Promise<void>((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(0, "127.0.0.1", resolve);
+      });
+      const address = server.address();
+      if (address === null || typeof address === "string") {
+        throw new Error("administrator test server has no TCP address");
+      }
+      return {
+        origin: `http://127.0.0.1:${address.port}`,
+        server,
+        updateBodies,
+      };
+    }),
+    ({ origin, updateBodies }) =>
+      Effect.gen(function* () {
+        const client = yield* Effect.promise(() =>
+          LocalAdminClient.signIn(origin, "admin", "test-password"),
+        );
+        const updated = yield* Effect.promise(() =>
+          client.setToolMode(
+            {
+              id: "tool-1",
+              sourceId: "source-1",
+              stableKey: "hello",
+              displayName: "Hello",
+              callablePath: "tools.source_1.hello",
+              sandboxPath: "executor.tools.source_1.hello",
+              revision: 1,
+              effectiveMode: { mode: "disabled" },
+            },
+            "enabled",
+          ),
+        );
+
+        expect(updated.revision).toBe(3);
+        expect(updateBodies.map((body) => JSON.parse(body))).toEqual([
+          { mode: "enabled", expectedRevision: 1 },
+          { mode: "enabled", expectedRevision: 2 },
+        ]);
+      }),
+    ({ server }) =>
+      Effect.callback<void, Error>((resume) => {
+        server.close((error) => resume(error ? Effect.fail(error) : Effect.succeed(undefined)));
+      }),
+  ),
+);
diff --git a/e2e/src/local-admin.ts b/e2e/src/local-admin.ts
new file mode 100644
index 000000000..44f692a23
--- /dev/null
+++ b/e2e/src/local-admin.ts
@@ -0,0 +1,222 @@
+import type { Identity } from "./target";
+
+export interface LocalTool {
+  readonly id: string;
+  readonly sourceId: string;
+  readonly stableKey: string;
+  readonly displayName: string;
+  readonly callablePath: string;
+  readonly sandboxPath: string;
+  readonly revision: number;
+  readonly effectiveMode: { readonly mode: "enabled" | "ask" | "disabled" };
+}
+
+export interface LocalSource {
+  readonly id: string;
+  readonly slug: string;
+  readonly displayName: string;
+  readonly revision: number;
+  readonly toolCount: number;
+}
+
+export interface LocalToken {
+  readonly id: string;
+  readonly token: string;
+}
+
+export class LocalAdminClient {
+  readonly #origin: string;
+  readonly #cookie: string;
+  readonly #cookiePairs: readonly string[];
+  readonly #csrf: string;
+
+  private constructor(origin: string, cookiePairs: readonly string[], csrf: string) {
+    this.#origin = origin;
+    this.#cookiePairs = [...cookiePairs];
+    this.#cookie = cookiePairs.join("; ");
+    this.#csrf = csrf;
+  }
+
+  static async signIn(origin: string, username: string, password: string) {
+    const response = await fetch(new URL("/api/v1/session", origin), {
+      method: "POST",
+      headers: { "content-type": "application/json", origin: new URL(origin).origin },
+      body: JSON.stringify({ username, password }),
+    });
+    if (!response.ok) throw new Error(`administrator sign-in failed (${response.status})`);
+    const pairs = response.headers
+      .getSetCookie()
+      .map((cookie) => cookie.split(";", 1)[0]?.trim())
+      .filter((cookie): cookie is string => Boolean(cookie));
+    const csrf = pairs
+      .find((cookie) => cookie.startsWith("executor_csrf="))
+      ?.slice("executor_csrf=".length);
+    if (pairs.length === 0 || !csrf)
+      throw new Error("administrator sign-in returned no CSRF cookie");
+    return new LocalAdminClient(origin, pairs, csrf);
+  }
+
+  asIdentity(label: string): Identity {
+    return {
+      label,
+      headers: { cookie: this.#cookie },
+      cookies: this.#cookiePairs.map((pair) => {
+        const separator = pair.indexOf("=");
+        if (separator <= 0) throw new Error("administrator sign-in returned an invalid cookie");
+        return { name: pair.slice(0, separator), value: pair.slice(separator + 1) };
+      }),
+    };
+  }
+
+  async createToken(name: string) {
+    const bytes = crypto.getRandomValues(new Uint8Array(32));
+    const idempotencyKey = Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+    return this.#json<LocalToken>("/api/v1/tokens", {
+      method: "POST",
+      body: { name },
+      headers: { "Idempotency-Key": idempotencyKey },
+    });
+  }
+
+  async revokeToken(tokenId: string) {
+    await this.#request(`/api/v1/tokens/${encodeURIComponent(tokenId)}`, { method: "DELETE" });
+  }
+
+  async createSource(input: unknown) {
+    return this.#json<LocalSource>("/api/v1/sources", { method: "POST", body: input });
+  }
+
+  async listSources() {
+    return this.#json<{ readonly sources: readonly LocalSource[] }>("/api/v1/sources");
+  }
+
+  async deleteSource(sourceId: string) {
+    await this.#request(`/api/v1/sources/${encodeURIComponent(sourceId)}`, { method: "DELETE" });
+  }
+
+  async refreshSource(sourceId: string) {
+    await this.#request(`/api/v1/sources/${encodeURIComponent(sourceId)}/refresh`, {
+      method: "POST",
+      body: {},
+    });
+  }
+
+  async listTools(query: { readonly sourceId?: string; readonly q?: string } = {}) {
+    const parameters = new URLSearchParams({ limit: "100" });
+    if (query.sourceId) parameters.set("sourceId", query.sourceId);
+    if (query.q) parameters.set("query", query.q);
+    return this.#json<{ readonly items: readonly LocalTool[]; readonly catalogRevision: number }>(
+      `/api/v1/tools?${parameters}`,
+    );
+  }
+
+  async setToolMode(tool: LocalTool, mode: "enabled" | "ask" | "disabled" | null) {
+    const toolPath = `/api/v1/tools/${encodeURIComponent(tool.id)}`;
+    const modePath = `${toolPath}/mode`;
+    const response = await this.#send(modePath, {
+      method: "PATCH",
+      body: { mode, expectedRevision: tool.revision },
+    });
+    if (response.status !== 409) {
+      return this.#readJson<LocalTool>(modePath, "PATCH", response);
+    }
+
+    const current = await this.#json<LocalTool>(toolPath);
+    return this.#json<LocalTool>(modePath, {
+      method: "PATCH",
+      body: { mode, expectedRevision: current.revision },
+    });
+  }
+
+  async putOAuthConnection(sourceId: string, credentialKey: string, input: unknown) {
+    return this.#json<{ readonly revision: number; readonly callbackUrl: string }>(
+      `/api/v1/sources/${encodeURIComponent(sourceId)}/oauth/${encodeURIComponent(credentialKey)}`,
+      { method: "PUT", body: input },
+    );
+  }
+
+  async authorizeOAuthConnection(
+    sourceId: string,
+    credentialKey: string,
+    expectedRevision: number,
+  ) {
+    return this.#json<{ readonly authorizationUrl: string }>(
+      `/api/v1/sources/${encodeURIComponent(sourceId)}/oauth/${encodeURIComponent(credentialKey)}/authorize`,
+      { method: "POST", body: { expectedRevision } },
+    );
+  }
+
+  async getOAuthConnections(sourceId: string) {
+    return this.#json<{
+      readonly connections: ReadonlyArray<{
+        readonly credentialKey: string;
+        readonly status: string;
+        readonly callbackUrl: string;
+      }>;
+      readonly availableCredentials: ReadonlyArray<{ readonly credentialKey: string }>;
+    }>(`/api/v1/sources/${encodeURIComponent(sourceId)}/oauth`);
+  }
+
+  async #json<Value>(
+    path: string,
+    options: {
+      readonly method?: string;
+      readonly body?: unknown;
+      readonly headers?: Readonly<Record<string, string>>;
+    } = {},
+  ) {
+    const method = options.method ?? "GET";
+    const response = await this.#send(path, options);
+    return this.#readJson<Value>(path, method, response);
+  }
+
+  async #request(
+    path: string,
+    options: {
+      readonly method?: string;
+      readonly body?: unknown;
+      readonly headers?: Readonly<Record<string, string>>;
+    } = {},
+  ) {
+    const method = options.method ?? "GET";
+    const response = await this.#send(path, options);
+    if (!response.ok) {
+      throw new Error(`${method} ${path} failed (${response.status}): ${await response.text()}`);
+    }
+    return response;
+  }
+
+  async #send(
+    path: string,
+    options: {
+      readonly method?: string;
+      readonly body?: unknown;
+      readonly headers?: Readonly<Record<string, string>>;
+    } = {},
+  ) {
+    const method = options.method ?? "GET";
+    const headers = new Headers({
+      accept: "application/json",
+      cookie: this.#cookie,
+      ...options.headers,
+    });
+    if (options.body !== undefined) headers.set("content-type", "application/json");
+    if (!["GET", "HEAD", "OPTIONS"].includes(method)) {
+      headers.set("origin", new URL(this.#origin).origin);
+      headers.set("x-executor-csrf", this.#csrf);
+    }
+    const response = await fetch(new URL(path, this.#origin), {
+      method,
+      headers,
+      body: options.body === undefined ? undefined : JSON.stringify(options.body),
+    });
+    return response;
+  }
+
+  async #readJson<Value>(path: string, method: string, response: Response) {
+    if (!response.ok) {
+      throw new Error(`${method} ${path} failed (${response.status}): ${await response.text()}`);
+    }
+    return (await response.json()) as Value;
+  }
+}
diff --git a/e2e/src/locator-assertions.test.ts b/e2e/src/locator-assertions.test.ts
new file mode 100644
index 000000000..19ba2e75c
--- /dev/null
+++ b/e2e/src/locator-assertions.test.ts
@@ -0,0 +1,27 @@
+import { it } from "@effect/vitest";
+
+import {
+  expectLocatorChecked,
+  expectLocatorCount,
+  expectLocatorDisabled,
+  expectLocatorFocused,
+  expectLocatorText,
+  expectLocatorValue,
+  expectLocatorVisible,
+} from "./locator-assertions";
+
+const sequence = <Value>(first: Value, ...rest: readonly Value[]) => {
+  const values = [first, ...rest];
+  let index = 0;
+  return async () => values[Math.min(index++, values.length - 1)]!;
+};
+
+it("polls locator state until the user-visible assertion succeeds", async () => {
+  await expectLocatorVisible({ isVisible: sequence(false, true) });
+  await expectLocatorDisabled({ isDisabled: sequence(false, true) });
+  await expectLocatorChecked({ isChecked: sequence(false, true) });
+  await expectLocatorFocused({ evaluate: sequence(false, true) });
+  await expectLocatorValue({ inputValue: sequence("pending", "ready") }, "ready");
+  await expectLocatorCount({ count: sequence(0, 2) }, 2);
+  await expectLocatorText({ textContent: sequence("Pending", "Ready\n now") }, "Ready now");
+});
diff --git a/e2e/src/locator-assertions.ts b/e2e/src/locator-assertions.ts
new file mode 100644
index 000000000..57f04e41d
--- /dev/null
+++ b/e2e/src/locator-assertions.ts
@@ -0,0 +1,76 @@
+import { expect } from "@effect/vitest";
+import type { Locator } from "playwright";
+
+const locatorAssertionTimeout = 30_000;
+
+const pollOptions = (message: string | undefined, fallback: string) => ({
+  timeout: locatorAssertionTimeout,
+  message: message ?? fallback,
+});
+
+const normalizeText = (text: string) => text.replace(/\s+/gu, " ").trim();
+
+interface FocusLocator {
+  readonly evaluate: (
+    pageFunction: (element: HTMLElement | SVGElement) => boolean,
+  ) => Promise<boolean>;
+}
+
+export const expectLocatorVisible = (locator: Pick<Locator, "isVisible">, message?: string) =>
+  expect
+    .poll(() => locator.isVisible(), pollOptions(message, "expected locator to become visible"))
+    .toBe(true);
+
+export const expectLocatorDisabled = (locator: Pick<Locator, "isDisabled">, message?: string) =>
+  expect
+    .poll(() => locator.isDisabled(), pollOptions(message, "expected locator to become disabled"))
+    .toBe(true);
+
+export const expectLocatorChecked = (locator: Pick<Locator, "isChecked">, message?: string) =>
+  expect
+    .poll(() => locator.isChecked(), pollOptions(message, "expected locator to become checked"))
+    .toBe(true);
+
+export const expectLocatorFocused = (locator: FocusLocator, message?: string) =>
+  expect
+    .poll(
+      () => locator.evaluate((element) => element === element.ownerDocument.activeElement),
+      pollOptions(message, "expected locator to become focused"),
+    )
+    .toBe(true);
+
+export const expectLocatorValue = (
+  locator: Pick<Locator, "inputValue">,
+  expected: string,
+  message?: string,
+) =>
+  expect
+    .poll(
+      () => locator.inputValue(),
+      pollOptions(message, `expected locator value to equal ${JSON.stringify(expected)}`),
+    )
+    .toBe(expected);
+
+export const expectLocatorCount = (
+  locator: Pick<Locator, "count">,
+  expected: number,
+  message?: string,
+) =>
+  expect
+    .poll(
+      () => locator.count(),
+      pollOptions(message, `expected locator count to equal ${expected}`),
+    )
+    .toBe(expected);
+
+export const expectLocatorText = (
+  locator: Pick<Locator, "textContent">,
+  expected: string,
+  message?: string,
+) =>
+  expect
+    .poll(
+      () => locator.textContent().then((text) => normalizeText(text ?? "")),
+      pollOptions(message, `expected locator text to contain ${JSON.stringify(expected)}`),
+    )
+    .toContain(normalizeText(expected));
diff --git a/e2e/src/oauth-test-provider.test.ts b/e2e/src/oauth-test-provider.test.ts
new file mode 100644
index 000000000..405ab9d0e
--- /dev/null
+++ b/e2e/src/oauth-test-provider.test.ts
@@ -0,0 +1,49 @@
+import { expect, it } from "@effect/vitest";
+import { Effect } from "effect";
+
+import { serveOAuthTestProvider } from "./oauth-test-provider";
+
+it.effect("uses the MCP emulator's RFC 8414 and dynamic client surfaces", () =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const provider = yield* serveOAuthTestProvider();
+      expect(new URL(provider.issuer).hostname).toBe("127.0.0.1");
+      expect(provider.endpoint).toBe(`${provider.issuer}/mcp`);
+      const metadata = yield* Effect.promise(() =>
+        fetch(`${provider.issuer}/.well-known/oauth-authorization-server`).then((response) =>
+          response.json(),
+        ),
+      );
+      expect(metadata).toMatchObject({
+        issuer: provider.issuer,
+        response_types_supported: ["code"],
+        code_challenge_methods_supported: ["S256"],
+      });
+
+      const clientId = yield* Effect.promise(() =>
+        provider.registerClient("http://127.0.0.1/callback"),
+      );
+      expect(clientId).toMatch(/^mcp-client-/);
+      const authorization = new URL(`${provider.issuer}/authorize`);
+      authorization.searchParams.set("client_id", clientId);
+      authorization.searchParams.set("redirect_uri", "http://127.0.0.1/callback");
+      authorization.searchParams.set("state", "unit-state");
+      authorization.searchParams.set("response_type", "code");
+      const callbackUrl = yield* Effect.promise(() =>
+        provider.approveAuthorization(authorization.toString(), "admin"),
+      );
+      const callback = new URL(callbackUrl);
+      expect(`${callback.origin}${callback.pathname}`).toBe("http://127.0.0.1/callback");
+      expect(callback.searchParams.get("state")).toBe("unit-state");
+      expect(/^[0-9a-f]+$/.test(callback.searchParams.get("code") ?? "")).toBe(true);
+      const ledger = yield* Effect.promise(() => provider.ledger());
+      expect(ledger.map((entry) => entry.path)).toEqual(
+        expect.arrayContaining(["/register", "/authorize", "/authorize/approve"]),
+      );
+      const approval = ledger.find((entry) => entry.path === "/authorize/approve");
+      expect(approval?.method).toBe("POST");
+      expect(approval?.request.body).toMatchObject({ login: "admin", state: "unit-state" });
+      expect(approval?.response.status).toBe(302);
+    }),
+  ),
+);
diff --git a/e2e/src/oauth-test-provider.ts b/e2e/src/oauth-test-provider.ts
new file mode 100644
index 000000000..da9b42f47
--- /dev/null
+++ b/e2e/src/oauth-test-provider.ts
@@ -0,0 +1,115 @@
+import { createEmulator, type Emulator, type LedgerEntry } from "@executor-js/emulate";
+import { Effect } from "effect";
+
+export interface OAuthTestProvider {
+  readonly issuer: string;
+  readonly endpoint: string;
+  readonly registerClient: (redirectUri: string) => Promise<string>;
+  readonly approveAuthorization: (authorizationUrl: string, login: string) => Promise<string>;
+  readonly ledger: () => Promise<ReadonlyArray<LedgerEntry>>;
+}
+
+const DEFAULT_EMULATOR_PORT = 4000;
+
+const decodeHtmlAttribute = (value: string) =>
+  value
+    .replaceAll("&quot;", '"')
+    .replaceAll("&#39;", "'")
+    .replaceAll("&lt;", "<")
+    .replaceAll("&gt;", ">")
+    .replaceAll("&amp;", "&");
+
+const authorizationFormFields = (html: string) => {
+  const fields = new URLSearchParams();
+  for (const match of html.matchAll(
+    /<input\s+type="hidden"\s+name="([^"]+)"\s+value="([^"]*)"\s*\/?>/giu,
+  )) {
+    const [, name, value] = match;
+    if (name !== undefined && value !== undefined) {
+      fields.append(decodeHtmlAttribute(name), decodeHtmlAttribute(value));
+    }
+  }
+  if (!fields.has("client_id") || !fields.has("redirect_uri") || !fields.has("state")) {
+    throw new Error("MCP emulator authorization page returned no usable consent form");
+  }
+  return fields;
+};
+
+export const approveOAuthTestAuthorization = async (
+  issuer: string,
+  authorizationUrl: string,
+  login: string,
+) => {
+  const authorization = new URL(authorizationUrl);
+  if (authorization.origin !== new URL(issuer).origin) {
+    throw new Error("MCP emulator authorization URL uses an unexpected origin");
+  }
+  const consent = await fetch(authorization, {
+    headers: { accept: "text/html" },
+    redirect: "manual",
+  });
+  if (!consent.ok) {
+    throw new Error(`MCP emulator authorization page failed (${consent.status})`);
+  }
+  const fields = authorizationFormFields(await consent.text());
+  fields.set("login", login);
+  const approval = await fetch(new URL("/authorize/approve", issuer), {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: fields,
+    redirect: "manual",
+  });
+  if (approval.status !== 302) {
+    throw new Error(`MCP emulator authorization approval failed (${approval.status})`);
+  }
+  const location = approval.headers.get("location");
+  if (!location) {
+    throw new Error("MCP emulator authorization approval returned no callback URL");
+  }
+  return new URL(location, issuer).toString();
+};
+
+export const serveOAuthTestProvider = (port?: number) =>
+  Effect.acquireRelease(
+    Effect.promise(async (): Promise<{ provider: OAuthTestProvider; emulator: Emulator }> => {
+      const resolvedPort = port ?? DEFAULT_EMULATOR_PORT;
+      const baseUrl = `http://127.0.0.1:${resolvedPort}`;
+      const emulator = await createEmulator({
+        service: "mcp",
+        port: resolvedPort,
+        baseUrl,
+      });
+      return {
+        emulator,
+        provider: {
+          issuer: emulator.url,
+          endpoint: `${emulator.url}/mcp`,
+          registerClient: async (redirectUri) => {
+            const response = await fetch(`${emulator.url}/register`, {
+              method: "POST",
+              headers: { "content-type": "application/json" },
+              body: JSON.stringify({
+                client_name: "Executor local e2e",
+                redirect_uris: [redirectUri],
+                grant_types: ["authorization_code"],
+                response_types: ["code"],
+                token_endpoint_auth_method: "none",
+              }),
+            });
+            if (!response.ok) {
+              throw new Error(`MCP emulator client registration failed (${response.status})`);
+            }
+            const registration = (await response.json()) as { readonly client_id?: string };
+            if (!registration.client_id) {
+              throw new Error("MCP emulator client registration returned no client_id");
+            }
+            return registration.client_id;
+          },
+          approveAuthorization: (authorizationUrl, login) =>
+            approveOAuthTestAuthorization(emulator.url, authorizationUrl, login),
+          ledger: () => emulator.ledger.list(),
+        },
+      };
+    }),
+    ({ emulator }) => Effect.promise(() => emulator.close()).pipe(Effect.ignore),
+  ).pipe(Effect.map(({ provider }) => provider));
diff --git a/e2e/src/scenario-redaction.test.ts b/e2e/src/scenario-redaction.test.ts
new file mode 100644
index 000000000..d3ed0e608
--- /dev/null
+++ b/e2e/src/scenario-redaction.test.ts
@@ -0,0 +1,36 @@
+import { expect, it } from "@effect/vitest";
+
+import { redactFailureText } from "./scenario";
+
+it("removes setup, API, cookie, CSRF, and password credentials from persisted failures", () => {
+  const secret = [
+    "http://127.0.0.1/setup#token=setup-secret",
+    "Authorization: Bearer bearer-secret",
+    "exr_token-secret",
+    "Cookie: executor_session=session-secret; executor_csrf=csrf-secret",
+    "x-executor-csrf: csrf-secret",
+    '{"password":"password-secret","setupToken":"setup-secret"}',
+    "http://127.0.0.1/callback?code=code-secret&state=state-secret&code_verifier=verifier-secret&code_challenge=challenge-secret",
+    '{"access_token":"access-secret","refresh_token":"refresh-secret","clientSecret":"client-secret","apiToken":"api-secret"}',
+  ].join("\n");
+  const redacted = redactFailureText(secret);
+  for (const value of [
+    "setup-secret",
+    "bearer-secret",
+    "token-secret",
+    "session-secret",
+    "csrf-secret",
+    "password-secret",
+    "code-secret",
+    "state-secret",
+    "verifier-secret",
+    "challenge-secret",
+    "access-secret",
+    "refresh-secret",
+    "client-secret",
+    "api-secret",
+  ]) {
+    expect(redacted).not.toContain(value);
+  }
+  expect(redacted).toContain("[REDACTED]");
+});
diff --git a/e2e/src/scenario.ts b/e2e/src/scenario.ts
index cb233c237..cfbb3cdd6 100644
--- a/e2e/src/scenario.ts
+++ b/e2e/src/scenario.ts
@@ -208,10 +208,22 @@ const missingServices = (cause: Cause.Cause<unknown>): ReadonlyArray<string> =>
 };
 
 const failureMessage = (cause: Cause.Cause<unknown>): string => {
-  const rendered = String(Cause.squash(cause));
+  const rendered = redactFailureText(String(Cause.squash(cause)));
   return rendered.length > 2_000 ? `${rendered.slice(0, 2_000)}…` : rendered;
 };
 
+export const redactFailureText = (text: string): string =>
+  text
+    .replace(/(#token=)[^\s"'<>]+/giu, "$1[REDACTED]")
+    .replace(/([?&](?:code|state|code_verifier|code_challenge)=)[^&#\s"'<>]+/giu, "$1[REDACTED]")
+    .replace(/\b(Bearer\s+)[A-Za-z0-9._~+/-]+=*/giu, "$1[REDACTED]")
+    .replace(/\bex[er]_[A-Za-z0-9._~-]+\b/gu, "exr_[REDACTED]")
+    .replace(
+      /("(?:password|setupToken|csrfToken|token|apiToken|access_token|refresh_token|clientSecret|client_secret|code_verifier|code_challenge)"\s*:\s*")[^"]*(")/giu,
+      "$1[REDACTED]$2",
+    )
+    .replace(/\b(cookie|set-cookie|x-executor-csrf):\s*[^\r\n]+/giu, "$1: [REDACTED]");
+
 /** The *.test.ts file that called scenario(), from the registration stack. */
 const captureTestFile = (): string | undefined => {
   const stack = new Error().stack ?? "";
diff --git a/e2e/src/source-panel.test.ts b/e2e/src/source-panel.test.ts
new file mode 100644
index 000000000..79ef49c70
--- /dev/null
+++ b/e2e/src/source-panel.test.ts
@@ -0,0 +1,77 @@
+import { expect, it } from "@effect/vitest";
+
+import { openConnectSourcePanel, type SourcePanelPage } from "./source-panel";
+
+const sourcePanelSelector = "details.import-panel";
+const sourcePickerSelector = 'role:group[name="Source type"]';
+const sourceSummarySelector = 'text:exact="Connect a source"';
+
+const fixture = (initiallyOpen: boolean, autoOpenBeforeFirstClick = false) => {
+  const calls: string[] = [];
+  let panelOpen = initiallyOpen;
+  let pendingAutoOpen = autoOpenBeforeFirstClick;
+
+  const makeLocator = (selector: string) => ({
+    async waitFor(options: { readonly state: "visible" }) {
+      calls.push(`wait:${selector}:${options.state}`);
+    },
+    async getAttribute(name: string) {
+      calls.push(`attribute:${selector}:${name}`);
+      return selector === sourcePanelSelector && name === "open" && panelOpen ? "" : null;
+    },
+    async click() {
+      calls.push(`click:${selector}`);
+      if (pendingAutoOpen) {
+        pendingAutoOpen = false;
+        panelOpen = true;
+      }
+      panelOpen = !panelOpen;
+    },
+  });
+
+  const page = {
+    getByRole: () => makeLocator(sourcePickerSelector),
+    getByText: () => makeLocator(sourceSummarySelector),
+    locator: (selector: string) => makeLocator(selector),
+  } satisfies SourcePanelPage;
+
+  return { calls, page };
+};
+
+it("does not click a source panel that is visible once its picker is attached", async () => {
+  const { calls, page } = fixture(true);
+
+  await openConnectSourcePanel(page);
+
+  expect(calls).toEqual([
+    `attribute:${sourcePanelSelector}:open`,
+    `wait:${sourcePickerSelector}:visible`,
+  ]);
+});
+
+it("opens an attached source picker when its panel is closed", async () => {
+  const { calls, page } = fixture(false);
+
+  await openConnectSourcePanel(page);
+
+  expect(calls).toEqual([
+    `attribute:${sourcePanelSelector}:open`,
+    `click:${sourceSummarySelector}`,
+    `attribute:${sourcePanelSelector}:open`,
+    `wait:${sourcePickerSelector}:visible`,
+  ]);
+});
+
+it("reopens a panel that auto-opens between the open-state check and click", async () => {
+  const { calls, page } = fixture(false, true);
+
+  await openConnectSourcePanel(page);
+
+  expect(calls).toEqual([
+    `attribute:${sourcePanelSelector}:open`,
+    `click:${sourceSummarySelector}`,
+    `attribute:${sourcePanelSelector}:open`,
+    `click:${sourceSummarySelector}`,
+    `wait:${sourcePickerSelector}:visible`,
+  ]);
+});
diff --git a/e2e/src/source-panel.ts b/e2e/src/source-panel.ts
new file mode 100644
index 000000000..c68ccde3a
--- /dev/null
+++ b/e2e/src/source-panel.ts
@@ -0,0 +1,30 @@
+interface SourcePanelLocator {
+  readonly waitFor: (options: { readonly state: "visible" }) => Promise<void>;
+  readonly getAttribute: (name: string) => Promise<string | null>;
+  readonly click: () => Promise<void>;
+}
+
+export interface SourcePanelPage {
+  readonly getByRole: (
+    role: "group",
+    options: { readonly name: "Source type" },
+  ) => SourcePanelLocator;
+  readonly getByText: (
+    text: "Connect a source",
+    options: { readonly exact: true },
+  ) => SourcePanelLocator;
+  readonly locator: (selector: string) => SourcePanelLocator;
+}
+
+const sourcePanelSelector = "details.import-panel";
+
+export const openConnectSourcePanel = async (page: SourcePanelPage) => {
+  const panel = page.locator(sourcePanelSelector);
+  if ((await panel.getAttribute("open")) === null) {
+    await page.getByText("Connect a source", { exact: true }).click();
+    if ((await panel.getAttribute("open")) === null) {
+      await page.getByText("Connect a source", { exact: true }).click();
+    }
+  }
+  await page.getByRole("group", { name: "Source type" }).waitFor({ state: "visible" });
+};
diff --git a/e2e/src/surfaces/browser.ts b/e2e/src/surfaces/browser.ts
index 2cc24903e..43742165c 100644
--- a/e2e/src/surfaces/browser.ts
+++ b/e2e/src/surfaces/browser.ts
@@ -26,6 +26,15 @@ export interface BrowserSurface {
     identity: Identity,
     drive: (session: BrowserSession) => Promise<void>,
   ) => Effect.Effect<void>;
+  /**
+   * Drive credential entry without persisting network bodies, DOM snapshots,
+   * or video. Step screenshots are still written after each action, so callers
+   * must leave the page in a secret-free state before a step returns.
+   */
+  readonly privateSession: (
+    identity: Identity,
+    drive: (session: BrowserSession) => Promise<void>,
+  ) => Effect.Effect<void>;
 }
 
 const slug = (text: string): string =>
@@ -37,8 +46,12 @@ const slug = (text: string): string =>
 
 // acquireUseRelease so a vitest timeout (fiber interruption) still closes the
 // browser and flushes video + trace — a bare promise would leak Chromium.
-export const makeBrowserSurface = (dir: string, target: Target): BrowserSurface => ({
-  session: (identity, drive) =>
+export const makeBrowserSurface = (dir: string, target: Target): BrowserSurface => {
+  const session = (
+    identity: Identity,
+    drive: (session: BrowserSession) => Promise<void>,
+    record: boolean,
+  ) =>
     Effect.acquireUseRelease(
       Effect.promise(async () => {
         const videoTmp = join(dir, ".video-tmp");
@@ -66,14 +79,16 @@ export const makeBrowserSurface = (dir: string, target: Target): BrowserSurface
         const context = await browser.newContext({
           colorScheme: "dark",
           viewport: { width: 1280, height: 800 },
-          recordVideo: { dir: videoTmp, size: { width: 1280, height: 800 } },
+          ...(record ? { recordVideo: { dir: videoTmp, size: { width: 1280, height: 800 } } } : {}),
           baseURL: target.baseUrl,
         });
-        await context.tracing.start({
-          screenshots: true,
-          snapshots: true,
-          sources: true,
-        });
+        if (record) {
+          await context.tracing.start({
+            screenshots: true,
+            snapshots: true,
+            sources: true,
+          });
+        }
         if (identity.cookies?.length) {
           await context.addCookies(
             identity.cookies.map((cookie) => ({
@@ -85,13 +100,15 @@ export const makeBrowserSurface = (dir: string, target: Target): BrowserSurface
         const page = await context.newPage();
         // The session video's clock starts with the page; anchor it for the
         // run's focus timeline (scripts/film.ts cuts on these).
-        markRecordingStart(dir, "browser");
+        if (record) markRecordingStart(dir, "browser");
         // Main-frame navigations feed the viewer's synthetic URL bar — the
         // recording itself is chromeless, so this is the only place the
         // address the developer "typed" survives.
-        page.on("framenavigated", (frame) => {
-          if (frame === page.mainFrame()) markNavigation(dir, frame.url());
-        });
+        if (record) {
+          page.on("framenavigated", (frame) => {
+            if (frame === page.mainFrame()) markNavigation(dir, frame.url());
+          });
+        }
         // Harvest distributed-trace ids: every app API request carries a W3C
         // traceparent (Effect's HttpClient), and each id names one
         // click→server→DB trace in whatever OTLP store the run exported to
@@ -145,11 +162,11 @@ export const makeBrowserSurface = (dir: string, target: Target): BrowserSurface
             // filming, enterFocus lingers a beat on whatever the developer was
             // looking at before tabbing here.
             await enterFocus(dir, "browser");
-            await context.tracing.group(label);
+            if (record) await context.tracing.group(label);
             try {
               await action(page);
             } finally {
-              await context.tracing.groupEnd();
+              if (record) await context.tracing.groupEnd();
             }
             await page.screenshot({
               path: join(dir, `${String(shots.count++).padStart(2, "0")}-${slug(label)}.png`),
@@ -162,14 +179,18 @@ export const makeBrowserSurface = (dir: string, target: Target): BrowserSurface
             await drive({ page, step });
           } catch (error) {
             // Freeze the scene: the artifact dir shows the screen at failure.
-            await page.screenshot({ path: join(dir, "failure.png") }).catch(() => {});
+            if (record) {
+              await page.screenshot({ path: join(dir, "failure.png") }).catch(() => {});
+            }
             throw error;
           }
         }),
       ({ browser, context, page, videoTmp, traceIds }) =>
         Effect.promise(async () => {
           appendTraces(dir, traceIds);
-          await context.tracing.stop({ path: join(dir, "trace.zip") }).catch(() => {});
+          if (record) {
+            await context.tracing.stop({ path: join(dir, "trace.zip") }).catch(() => {});
+          }
           const video = page.video();
           await context.close(); // flushes the recording
           await browser.close();
@@ -199,5 +220,10 @@ export const makeBrowserSurface = (dir: string, target: Target): BrowserSurface
           }
           rmSync(videoTmp, { recursive: true, force: true });
         }),
-    ),
-});
+    );
+
+  return {
+    session: (identity, drive) => session(identity, drive, true),
+    privateSession: (identity, drive) => session(identity, drive, false),
+  };
+};
diff --git a/e2e/src/vm/build-binary.ts b/e2e/src/vm/build-binary.ts
index b5d32c26d..78f7779cb 100644
--- a/e2e/src/vm/build-binary.ts
+++ b/e2e/src/vm/build-binary.ts
@@ -1,6 +1,6 @@
 // Build the compiled `executor` for a guest os/arch. `service install` refuses
 // to run from a dev (.ts) entrypoint, so the VM targets need a real binary —
-// produced via the `--target` flag on apps/cli/src/build.ts.
+// produced via the `--target` flag on legacy/cli/src/build.ts.
 
 import { execFile } from "node:child_process";
 import { existsSync } from "node:fs";
@@ -15,7 +15,7 @@ const PLATFORM_TAG: Record<VmOs, string> = { macos: "darwin", linux: "linux", wi
 
 // e2e/src/vm/build-binary.ts → repo root.
 const REPO_ROOT = path.resolve(import.meta.dirname, "../../..");
-const CLI_DIR = path.join(REPO_ROOT, "apps", "cli");
+const CLI_DIR = path.join(REPO_ROOT, "legacy", "cli");
 
 /**
  * Build the `executor` binary for a guest and return its `bin` directory
diff --git a/e2e/targets/cloudflare.ts b/e2e/targets/cloudflare.ts
index abce7ddee..e137de6c4 100644
--- a/e2e/targets/cloudflare.ts
+++ b/e2e/targets/cloudflare.ts
@@ -1,4 +1,4 @@
-// The Cloudflare self-host app (apps/host-cloudflare) as a target: the REAL
+// The Cloudflare self-host app (legacy/host-cloudflare) as a target: the REAL
 // worker on workerd via Miniflare (wrangler `unstable_dev`) with a local D1 +
 // R2, booted in setup/cloudflare.globalsetup.ts. Dev-auth is on, so every
 // request is the fixed dev admin — no per-identity login and no MCP OAuth (the
diff --git a/e2e/targets/local-selfhost.ts b/e2e/targets/local-selfhost.ts
new file mode 100644
index 000000000..ff4fc72e5
--- /dev/null
+++ b/e2e/targets/local-selfhost.ts
@@ -0,0 +1,53 @@
+import { Effect } from "effect";
+
+import { e2ePort } from "../src/ports";
+import type { Identity, Target } from "../src/target";
+
+export const LOCAL_SELFHOST_PORT = e2ePort("E2E_LOCAL_SELFHOST_PORT", 4);
+export const LOCAL_SETUP_PORT = e2ePort("E2E_LOCAL_SETUP_PORT", 5);
+export const LOCAL_SELFHOST_BASE_URL =
+  process.env.E2E_LOCAL_SELFHOST_URL ?? `http://127.0.0.1:${LOCAL_SELFHOST_PORT}`;
+export const LOCAL_SETUP_BASE_URL =
+  process.env.E2E_LOCAL_SETUP_URL ?? `http://127.0.0.1:${LOCAL_SETUP_PORT}`;
+
+export const LOCAL_ADMIN = {
+  username: process.env.E2E_LOCAL_ADMIN_USERNAME ?? "admin",
+  password: process.env.E2E_LOCAL_ADMIN_PASSWORD ?? "executor-e2e-admin-password",
+};
+
+const cookiePairs = (headers: Headers) =>
+  (headers.getSetCookie?.() ?? [])
+    .map((cookie) => cookie.split(";", 1)[0]?.trim())
+    .filter((cookie): cookie is string => Boolean(cookie));
+
+export const signInLocalAdmin = async (
+  baseUrl: string,
+  credentials = LOCAL_ADMIN,
+): Promise<Identity> => {
+  const response = await fetch(new URL("/api/v1/session", baseUrl), {
+    method: "POST",
+    headers: { "content-type": "application/json", origin: new URL(baseUrl).origin },
+    body: JSON.stringify(credentials),
+    redirect: "manual",
+  });
+  if (!response.ok) throw new Error(`local selfhost sign-in failed (${response.status})`);
+  const pairs = cookiePairs(response.headers);
+  if (pairs.length === 0) throw new Error("local selfhost sign-in returned no cookies");
+  return {
+    label: credentials.username,
+    credentials: { email: credentials.username, password: credentials.password },
+    headers: { cookie: pairs.join("; ") },
+    cookies: pairs.map((pair) => {
+      const separator = pair.indexOf("=");
+      return { name: pair.slice(0, separator), value: pair.slice(separator + 1) };
+    }),
+  };
+};
+
+export const localSelfhostTarget = (): Target => ({
+  name: "local-selfhost",
+  baseUrl: LOCAL_SELFHOST_BASE_URL,
+  mcpUrl: `${LOCAL_SELFHOST_BASE_URL}/mcp`,
+  capabilities: new Set(["browser"]),
+  newIdentity: () => Effect.promise(() => signInLocalAdmin(LOCAL_SELFHOST_BASE_URL)),
+});
diff --git a/e2e/targets/registry.ts b/e2e/targets/registry.ts
index 94e966746..1074a4088 100644
--- a/e2e/targets/registry.ts
+++ b/e2e/targets/registry.ts
@@ -7,6 +7,7 @@ import { cloudTarget } from "./cloud";
 import { cloudflareTarget } from "./cloudflare";
 import { desktopTarget } from "./desktop";
 import { localTarget } from "./local";
+import { localSelfhostTarget } from "./local-selfhost";
 import { selfhostTarget } from "./selfhost";
 import { selfhostDockerTarget } from "./selfhost-docker";
 
@@ -20,6 +21,7 @@ const factories: Record<string, () => Target> = {
   // `desktop` — no standard surfaces to carry. See desktop-packaged.globalsetup.
   "desktop-packaged": desktopTarget,
   local: localTarget,
+  "local-selfhost": localSelfhostTarget,
   // The supervised CLI daemon inside a VM, one project per guest OS — restart()
   // is a real reboot. See setup/cli.globalsetup.ts.
   "cli-macos": cliTarget,
diff --git a/e2e/targets/selfhost-docker.ts b/e2e/targets/selfhost-docker.ts
index 1c3d9dc30..bf1e556a2 100644
--- a/e2e/targets/selfhost-docker.ts
+++ b/e2e/targets/selfhost-docker.ts
@@ -1,5 +1,5 @@
 // The PRODUCTION self-host artifact as a target: the Docker image from
-// apps/host-selfhost/Dockerfile (production Vite build, `bun src/serve.ts`,
+// legacy/host-selfhost/Dockerfile (production Vite build, `bun src/serve.ts`,
 // /data volume) instead of the dev server. Same surface as the selfhost
 // target — same bootstrap admin, same Better Auth sign-in, same MCP consent —
 // so the whole scenario suite runs against what users actually deploy. Boot
diff --git a/e2e/tsconfig.json b/e2e/tsconfig.json
index 38d1e7965..200558998 100644
--- a/e2e/tsconfig.json
+++ b/e2e/tsconfig.json
@@ -10,5 +10,15 @@
     "jsx": "react-jsx",
     "types": ["node"]
   },
-  "include": ["src", "cloud", "scenarios", "selfhost", "setup", "targets", "scripts", "viewer/src"]
+  "include": [
+    "src",
+    "cloud",
+    "scenarios",
+    "selfhost",
+    "local-selfhost",
+    "setup",
+    "targets",
+    "scripts",
+    "viewer/src"
+  ]
 }
diff --git a/e2e/vitest.config.ts b/e2e/vitest.config.ts
index 6f008b459..83bb5a22e 100644
--- a/e2e/vitest.config.ts
+++ b/e2e/vitest.config.ts
@@ -1,109 +1,19 @@
 import { defineConfig } from "vitest/config";
 
-// One project per target. Same scenario files, different running instance:
-// `vitest run --project cloud` / `--project selfhost` (or both, the default).
-// Each project's globalsetup boots that app's OWN dev server (or attaches to
-// E2E_<TARGET>_URL). Scenarios are isolated by fresh identities, not resets.
-const project = (name: string, overrides: Record<string, unknown> = {}) => ({
-  test: {
-    name,
-    include: ["scenarios/**/*.test.ts", `${name}/**/*.test.ts`],
-    env: { E2E_TARGET: name },
-    globalSetup: [`./setup/${name}.globalsetup.ts`],
-    testTimeout: 180_000,
-    hookTimeout: 120_000,
-    ...overrides,
-  },
-});
-
 export default defineConfig({
   test: {
     projects: [
-      // PGlite's socket server is effectively single-connection; parallel test
-      // files (each fanning out per-request postgres sockets) crash it. Run
-      // files serially — swap PGlite for real Postgres if wall-clock matters.
-      project("cloud", { fileParallelism: false }),
-      // selfhost identities are the shared bootstrap admin for now — run files
-      // serially until per-test invite-signup isolation lands.
-      project("selfhost", { fileParallelism: false }),
-      // The same app as the PRODUCTION Docker artifact (the image users
-      // deploy: production build, bun serve.ts, /data volume) instead of the
-      // dev server. Runs the cross-target scenarios AND the selfhost/**
-      // scenarios — it is the same single-tenant app, so they all apply.
-      // Needs a docker daemon with host-networking support (Engine ≥ 26 on
-      // Docker Desktop); not part of the default `npm run test` chain — run
-      // with `npm run test:selfhost-docker` (release gate + CI for the
-      // publish workflow).
-      project("selfhost-docker", {
-        include: ["scenarios/**/*.test.ts", "selfhost/**/*.test.ts"],
-        fileParallelism: false,
-      }),
-      // The Cloudflare self-host worker (workerd via wrangler dev, dev-auth).
-      // Scoped to the cross-target scenarios wired for this host; the rest of
-      // scenarios/** is not yet validated against the worker. The full-graph
-      // scenario is included on purpose: workerd's 128MB isolate is the exact
-      // limit the streaming compile + content-addressed serve path defends, so
-      // it is the one host where that regression must be proven. Shares
-      // self-host's single-admin model.
-      project("cloudflare", {
-        include: [
-          "scenarios/browser-approval.test.ts",
-          "scenarios/microsoft-graph-full.test.ts",
-          "scenarios/toolkits-mcp.test.ts",
-          "cloudflare/**/*.test.ts",
-        ],
-        fileParallelism: false,
-      }),
-      // The Electron desktop app. Only desktop/** scenarios — the desktop
-      // target provides none of the standard surfaces (each scenario
-      // launches its own app via Playwright's electron driver), so running
-      // the cross-target suite here would just emit a page of skips. Needs
-      // a display; not part of the default `npm run test` chain.
-      project("desktop", {
-        include: ["desktop/**/*.test.ts"],
-        fileParallelism: false,
-        testTimeout: 300_000,
-      }),
-      // The PACKAGED desktop app: the real electron-builder bundle, where
-      // app.isPackaged is true — the ONLY target that exercises the supervised-
-      // daemon attach path (ensureSupervisedConnection) and the bundled executor.
-      // Its globalsetup builds the bundle (slow), so it's separate from
-      // `desktop` to keep the fast dev-electron suite off the package build.
-      // Needs a display; not part of the default `npm run test` chain — run with
-      // `vitest run --project desktop-packaged`.
-      project("desktop-packaged", {
-        include: ["desktop-packaged/**/*.test.ts"],
-        fileParallelism: false,
-        testTimeout: 360_000,
-        hookTimeout: 600_000,
-      }),
-      // The single-user local app. Each scenario launches its OWN `executor
-      // web` via the CLI on a throwaway data dir + an OS-assigned port, so
-      // there is no shared instance and scenarios are independent — file
-      // parallelism is ON. No globalSetup (nothing shared to boot). Only
-      // local/** scenarios. Not part of the default `npm run test` chain; run
-      // with `vitest run --project local`.
-      project("local", {
-        include: ["local/**/*.test.ts"],
-        globalSetup: [],
-        fileParallelism: true,
-        testTimeout: 180_000,
-      }),
-      // The supervised CLI daemon inside a guest VM, one project per OS. The
-      // globalsetup provisions a VM, `executor service install`s the daemon, and
-      // tunnels it; restart() reboots the guest for REAL, so restart-persistence
-      // proves the boot-time auto-start path. Needs tart (macOS/Linux) or an EC2
-      // credential (Windows); not part of the default `npm run test` chain — run
-      // with `vitest run --project cli-macos` (etc.) on the Mini.
-      ...(["macos", "linux", "windows"] as const).map((os) =>
-        project(`cli-${os}`, {
-          include: ["scenarios/restart-persistence.test.ts", "cli/**/*.test.ts"],
-          env: { E2E_TARGET: `cli-${os}`, E2E_VM_OS: os },
+      {
+        test: {
+          name: "local-selfhost",
+          include: ["local-selfhost/**/*.test.ts"],
+          env: { E2E_TARGET: "local-selfhost" },
+          globalSetup: ["./setup/local-selfhost.globalsetup.ts"],
           fileParallelism: false,
-          testTimeout: 300_000,
-          hookTimeout: 900_000,
-        }),
-      ),
+          testTimeout: 180_000,
+          hookTimeout: 120_000,
+        },
+      },
     ],
   },
 });
diff --git a/e2e/vitest.legacy.config.ts b/e2e/vitest.legacy.config.ts
new file mode 100644
index 000000000..94a5ef1f3
--- /dev/null
+++ b/e2e/vitest.legacy.config.ts
@@ -0,0 +1,60 @@
+import { defineConfig } from "vitest/config";
+
+const project = (name: string, overrides: Record<string, unknown> = {}) => ({
+  test: {
+    name,
+    include: ["scenarios/**/*.test.ts", `${name}/**/*.test.ts`],
+    env: { E2E_TARGET: name },
+    globalSetup: [`./setup/${name}.globalsetup.ts`],
+    testTimeout: 180_000,
+    hookTimeout: 120_000,
+    ...overrides,
+  },
+});
+
+export default defineConfig({
+  test: {
+    projects: [
+      project("cloud", { fileParallelism: false }),
+      project("selfhost", { fileParallelism: false }),
+      project("selfhost-docker", {
+        include: ["scenarios/**/*.test.ts", "selfhost/**/*.test.ts"],
+        fileParallelism: false,
+      }),
+      project("cloudflare", {
+        include: [
+          "scenarios/browser-approval.test.ts",
+          "scenarios/microsoft-graph-full.test.ts",
+          "scenarios/toolkits-mcp.test.ts",
+          "cloudflare/**/*.test.ts",
+        ],
+        fileParallelism: false,
+      }),
+      project("desktop", {
+        include: ["desktop/**/*.test.ts"],
+        fileParallelism: false,
+        testTimeout: 300_000,
+      }),
+      project("desktop-packaged", {
+        include: ["desktop-packaged/**/*.test.ts"],
+        fileParallelism: false,
+        testTimeout: 360_000,
+        hookTimeout: 600_000,
+      }),
+      project("local", {
+        include: ["local/**/*.test.ts"],
+        globalSetup: [],
+        fileParallelism: true,
+      }),
+      ...(["macos", "linux"] as const).map((os) =>
+        project(`cli-${os}`, {
+          include: ["scenarios/restart-persistence.test.ts", "cli/**/*.test.ts"],
+          env: { E2E_TARGET: `cli-${os}`, E2E_VM_OS: os },
+          fileParallelism: false,
+          testTimeout: 300_000,
+          hookTimeout: 900_000,
+        }),
+      ),
+    ],
+  },
+});
diff --git a/apps/cli/vitest.config.ts b/e2e/vitest.unit.config.ts
similarity index 100%
rename from apps/cli/vitest.config.ts
rename to e2e/vitest.unit.config.ts
diff --git a/knip.config.ts b/knip.config.ts
index b823e3b4f..522f2166f 100644
--- a/knip.config.ts
+++ b/knip.config.ts
@@ -3,14 +3,16 @@ import type { KnipConfig } from "knip";
 const config: KnipConfig = {
   workspaces: {
     ".": {},
-    "apps/cli": {},
-    "apps/local": {
+    "legacy/cli": {},
+    "legacy/local": {
       entry: ["src/server.ts", "src/routes/**/*.tsx", "src/server/*.ts"],
     },
-    "apps/cloud": {
+    "legacy/host-cloudflare": {},
+    "legacy/host-selfhost": {},
+    "legacy/cloud": {
       entry: ["src/server.ts", "src/routes/**/*.tsx", "src/server/*.ts"],
     },
-    "apps/desktop": {
+    "legacy/desktop": {
       entry: ["src/preload.ts"],
     },
     "apps/marketing": {
diff --git a/legacy/README.md b/legacy/README.md
new file mode 100644
index 000000000..2b82eab09
--- /dev/null
+++ b/legacy/README.md
@@ -0,0 +1,27 @@
+# Legacy products
+
+This directory contains all previous TypeScript application entry points. The
+active product is the local/self-hosted Rust server and Svelte dashboard in the
+repository root and `web/`.
+
+The legacy packages remain in the Bun workspace so their dependency graph and
+historical end-to-end scenarios stay reproducible. They are excluded from the
+default development, test, typecheck, lint, format, and CI paths. Use the root
+`legacy:dev`, `legacy:dev:cli`, `legacy:test`, or `legacy:typecheck` scripts when
+working on them explicitly. `legacy:dev` covers the five packages with a real
+`dev` script; the archived CLI uses `legacy:dev:cli`. They are not the
+foundation for new product work.
+
+- `cli/`: the archived npm CLI compatibility package
+- `local/`: the archived local React server and UI bundled by that CLI
+- `host-cloudflare/`: the archived self-hosted Cloudflare Worker
+- `host-selfhost/`: the archived TypeScript self-hosted server and container
+- `cloud/`: the previous managed Cloudflare deployment
+- `desktop/`: the previous Electron desktop deployment
+
+The shared TypeScript packages under `packages/` remain outside this directory.
+They are retained independently from these deployment entry points.
+
+Cloudflare previews and TypeScript package publishing remain manual or
+repository-variable-gated compatibility workflows. They do not participate in
+the native product release path.
diff --git a/apps/cli/CHANGELOG.md b/legacy/cli/CHANGELOG.md
similarity index 100%
rename from apps/cli/CHANGELOG.md
rename to legacy/cli/CHANGELOG.md
diff --git a/apps/cli/bin/executor.ts b/legacy/cli/bin/executor.ts
similarity index 100%
rename from apps/cli/bin/executor.ts
rename to legacy/cli/bin/executor.ts
diff --git a/apps/cli/package.json b/legacy/cli/package.json
similarity index 87%
rename from apps/cli/package.json
rename to legacy/cli/package.json
index 6cd4ff4b0..dfc2f7a45 100644
--- a/apps/cli/package.json
+++ b/legacy/cli/package.json
@@ -15,9 +15,6 @@
     "build:preview": "bun run src/build.ts preview",
     "build:preview:tarball": "bun run src/build.ts preview-tarball",
     "build:preview:wrapper": "bun run src/build.ts preview-wrapper",
-    "build:publish": "bun run src/build.ts publish",
-    "release:publish:dry-run": "bun run src/release.ts --dry-run",
-    "release:publish": "bun run src/release.ts",
     "test": "bun --bun vitest run",
     "typecheck": "tsgo --noEmit",
     "typecheck:slow": "tsc --noEmit"
diff --git a/apps/cli/src/build.ts b/legacy/cli/src/build.ts
similarity index 84%
rename from apps/cli/src/build.ts
rename to legacy/cli/src/build.ts
index 162951fbd..309acc6e6 100644
--- a/apps/cli/src/build.ts
+++ b/legacy/cli/src/build.ts
@@ -7,8 +7,8 @@ import { parseArgs } from "node:util";
 import { $ } from "bun";
 
 const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), "../../..");
-const cliRoot = resolve(repoRoot, "apps/cli");
-const webRoot = resolve(repoRoot, "apps/local");
+const cliRoot = resolve(repoRoot, "legacy/cli");
+const webRoot = resolve(repoRoot, "legacy/local");
 const distDir = resolve(cliRoot, "dist");
 
 const resolveQuickJsWasmPath = (): string => {
@@ -188,7 +188,7 @@ const resolveLibsqlNative = (t: Target): string | null => {
   if (!target) return null;
   const pkg = `@libsql/${target}`;
   try {
-    const req = createRequire(join(repoRoot, "apps/local", "package.json"));
+    const req = createRequire(join(repoRoot, "legacy/local", "package.json"));
     const pkgJson = req.resolve(`${pkg}/package.json`);
     return join(dirname(pkgJson), "index.node");
   } catch {
@@ -225,7 +225,7 @@ const buildWeb = async (mode: BuildMode) => {
 };
 
 // ---------------------------------------------------------------------------
-// Embedded web UI — generates a virtual module that imports all web assets
+// Embedded web UI: generates a virtual module that imports all web assets
 // using `with { type: "file" }` so Bun bakes them into the compiled binary.
 // ---------------------------------------------------------------------------
 
@@ -243,7 +243,7 @@ const createEmbeddedWebUISource = async (mode: BuildMode) => {
   const entries = files.map((file, i) => `  ${JSON.stringify(file)}: file_${i},`);
 
   return [
-    "// Auto-generated — maps web UI paths to embedded file references",
+    "// Auto-generated: maps web UI paths to embedded file references",
     ...imports,
     "export default {",
     ...entries,
@@ -252,7 +252,7 @@ const createEmbeddedWebUISource = async (mode: BuildMode) => {
 };
 
 // ---------------------------------------------------------------------------
-// Embedded legacy v1 drizzle migrations — inlined as text imports so drizzle's
+// Embedded legacy v1 drizzle migrations: inlined as text imports so drizzle's
 // `migrate()` (which reads a folder from disk) can be given a tmpdir
 // populated from the inlined contents at runtime. The v1→v2 data migration
 // replays this chain to bring an older v1 database up to v1-final before
@@ -273,7 +273,7 @@ const createEmbeddedMigrationsSource = async () => {
   const entries = files.map((file, i) => `  ${JSON.stringify(file)}: file_${i},`);
 
   return [
-    "// Auto-generated — maps migration paths to inlined file contents",
+    "// Auto-generated: maps migration paths to inlined file contents",
     ...imports,
     "export default {",
     ...entries,
@@ -340,10 +340,10 @@ const buildBinaries = async (targets: Target[], mode: BuildMode) => {
         },
       });
 
-      // Copy QuickJS WASM next to binary — loaded at runtime by the server
+      // Copy QuickJS WASM next to binary, loaded at runtime by the server
       await cp(quickJsWasmPath, join(binDir, "emscripten-module.wasm"));
 
-      // Copy @napi-rs/keyring native binding next to executor — bun --compile
+      // Copy @napi-rs/keyring native binding next to executor. bun --compile
       // doesn't bundle .node files, so the loader needs to find it on disk
       // via NAPI_RS_NATIVE_LIBRARY_PATH (set in main.ts).
       const keyringNative = resolveKeyringNative(target);
@@ -351,7 +351,7 @@ const buildBinaries = async (targets: Target[], mode: BuildMode) => {
         await cp(keyringNative, join(binDir, "keyring.node"));
       }
 
-      // Copy the libSQL native binding next to executor — same bunfs limitation
+      // Copy the libSQL native binding next to executor, with the same bunfs limitation
       // as keyring; main.ts redirects `require('@libsql/<plat>')` to it.
       const libsqlNative = resolveLibsqlNative(target);
       if (libsqlNative && existsSync(libsqlNative)) {
@@ -371,10 +371,10 @@ const buildBinaries = async (targets: Target[], mode: BuildMode) => {
       // `1.4.14-linux-x64`). The wrapper references each variant via an
       // `npm:` alias in its optionalDependencies. This mirrors codex's
       // pattern and avoids ever having to claim a new npm package name when
-      // a new platform is added — a single trusted-publishing config on the
+      // a new platform is added. A single trusted-publishing config on the
       // `executor` package covers everything.
       //
-      // No `bin` field on purpose — the wrapper's launcher resolves the
+      // No `bin` field on purpose. The wrapper's launcher resolves the
       // platform binary via require.resolve on the alias name and execs it.
       const tag = platformTag(target);
       const variantVersion = `${meta.version}-${tag}`;
@@ -423,7 +423,7 @@ const buildWrapperPackage = async (binaries: Record<string, string>) => {
 
   await mkdir(binDir, { recursive: true });
 
-  // Node.js launcher — resolves the platform binary via require.resolve
+  // Node.js launcher resolves the platform binary via require.resolve
   // against optionalDependencies and execs it. No postinstall: the binary
   // ships as an os/cpu-filtered optional dep, the launcher resolves it at
   // runtime. This works whether or not the package manager runs postinstalls
@@ -450,7 +450,7 @@ const buildWrapperPackage = async (binaries: Record<string, string>) => {
         // npm/bun fetch only the variant matching the current os/cpu (set
         // on each variant's package.json); everything else is a no-op.
         // The local alias name on the left is what the launcher passes to
-        // require.resolve at runtime — npm puts the variant at
+        // require.resolve at runtime. npm puts the variant at
         // `node_modules/executor-<plat>-<arch>/` so resolution just works.
         optionalDependencies: binaries,
         engines: {
@@ -473,7 +473,7 @@ const buildWrapperPackage = async (binaries: Record<string, string>) => {
 };
 
 // ---------------------------------------------------------------------------
-// Preview wrapper — a slim npm package for pkg.pr.new previews that fetches
+// Preview wrapper: a slim npm package for pkg.pr.new previews that fetches
 // the platform binary from our R2 bucket at install time.
 //
 // The release wrapper points postinstall at GitHub Releases. For previews
@@ -543,7 +543,7 @@ const buildPreviewWrapperPackage = async (targets: Target[]) => {
   await writeFile(join(wrapperDir, "postinstall.cjs"), postinstall);
 
   // Restrict os/cpu to platforms we actually built this run so npm refuses
-  // the install on anything else — a clear error beats a cryptic 404 from
+  // the install on anything else. A clear error beats a cryptic 404 from
   // postinstall on an unbuilt platform.
   const osList = Array.from(new Set(targets.map((t) => t.os)));
   const cpuList = Array.from(new Set(targets.map((t) => t.arch)));
@@ -578,117 +578,10 @@ const buildPreviewWrapperPackage = async (targets: Target[]) => {
   }
 
   console.log(`\nPreview wrapper: ${wrapperDir}`);
-  console.log(`  ${meta.name}@${meta.version} — CDN ${cdnUrl}/${sha}`);
+  console.log(`  ${meta.name}@${meta.version}, CDN ${cdnUrl}/${sha}`);
   console.log(`  targets: ${targets.map(targetPackageName).join(", ")}`);
 };
 
-// ---------------------------------------------------------------------------
-// Publish
-// ---------------------------------------------------------------------------
-
-const packageAlreadyPublished = async (pkgDir: string) => {
-  const pkg = (await Bun.file(join(pkgDir, "package.json")).json()) as {
-    name?: string;
-    version?: string;
-  };
-
-  if (!pkg.name || !pkg.version) {
-    throw new Error(`Missing name/version in ${join(pkgDir, "package.json")}`);
-  }
-
-  const proc = Bun.spawn(["npm", "view", `${pkg.name}@${pkg.version}`, "version"], {
-    cwd: pkgDir,
-    stdio: ["ignore", "ignore", "ignore"],
-  });
-
-  return (await proc.exited) === 0;
-};
-
-/** Recognize npm error output for "this version already exists." Used to
- *  make publish retries idempotent — if a previous workflow run got partway
- *  through and crashed, we should skip what's already on the registry and
- *  push the rest. Mirrors codex's `rust-release.yml` skip pattern. */
-const ALREADY_PUBLISHED_RE = /previously published|cannot publish over|version already exists/i;
-
-const publishPackedPackage = async (pkgDir: string, channel: string) => {
-  if (await packageAlreadyPublished(pkgDir)) {
-    console.log(`Skipping ${pkgDir}; package version already exists on npm.`);
-    return;
-  }
-
-  await $`bun pm pack`.cwd(pkgDir);
-
-  const provenance = process.env.GITHUB_ACTIONS === "true" ? ["--provenance"] : [];
-  const result = await $`npm publish *.tgz --access public --tag ${channel} ${provenance}`
-    .cwd(pkgDir)
-    .nothrow()
-    .quiet();
-
-  const stdout = result.stdout.toString();
-  const stderr = result.stderr.toString();
-  process.stdout.write(stdout);
-  process.stderr.write(stderr);
-
-  if (result.exitCode === 0) return;
-
-  // The pre-check via `npm view` has a propagation race — even when an
-  // earlier publish in this same run committed, `npm view` may 404 for a few
-  // seconds. Treat "already published" errors as success on retry.
-  if (ALREADY_PUBLISHED_RE.test(stderr) || ALREADY_PUBLISHED_RE.test(stdout)) {
-    console.log(`Skipping ${pkgDir}; npm reported version already published.`);
-    return;
-  }
-
-  throw new Error(`npm publish failed for ${pkgDir} (exit ${result.exitCode})`);
-};
-
-/** Extract the platform-tag suffix from a variant version string.
- *  e.g. "1.4.14-linux-x64" -> "linux-x64".
- *  Variants get a per-platform npm dist-tag (not `latest` or `beta`) so
- *  publishing them doesn't move the channel pointer. The wrapper alone
- *  drives `latest`/`beta`. */
-const variantTagFromVersion = (version: string): string => {
-  const idx = version.indexOf("-");
-  if (idx === -1) {
-    throw new Error(
-      `Variant version missing platform-tag suffix (expected '<base>-<tag>'): ${version}`,
-    );
-  }
-  return version.slice(idx + 1);
-};
-
-const publish = async (channel: string) => {
-  const meta = await readMetadata();
-
-  // Variants publish first so the wrapper's optionalDependencies resolve.
-  // All variants and the wrapper publish to the same npm package
-  // (`executor`) — variants under platform-tagged versions, wrapper under
-  // the channel tag. Single trusted-publishing config covers everything.
-  const platformDirs: string[] = [];
-  for (const entry of new Bun.Glob("executor-*/package.json").scanSync({ cwd: distDir })) {
-    platformDirs.push(join(distDir, dirname(entry)));
-  }
-  platformDirs.sort();
-
-  // Publish variants sequentially. They all PUT to the same npm package
-  // (`executor`), and the registry rejects concurrent packument updates with
-  // 409 Conflict ("Failed to save packument. A common cause is if you try to
-  // publish a new package before the previous package has been fully
-  // processed.") — that's exactly what happened on v1.4.14's first attempt,
-  // where 3 of 8 raced through and the rest 409'd. Serial is plenty fast
-  // (~5s per variant × 8 ≈ 40s).
-  console.log(`Publishing ${platformDirs.length} platform variant(s)...`);
-  for (const dir of platformDirs) {
-    const pkg = (await Bun.file(join(dir, "package.json")).json()) as { version: string };
-    const tag = variantTagFromVersion(pkg.version);
-    await publishPackedPackage(dir, tag);
-  }
-
-  const wrapperDir = join(distDir, meta.name);
-  console.log(`Publishing wrapper ${wrapperDir} under @${channel}...`);
-  await publishPackedPackage(wrapperDir, channel);
-};
-
 // ---------------------------------------------------------------------------
 // GitHub release assets
 // ---------------------------------------------------------------------------
@@ -704,7 +597,7 @@ const ZIP_ASSET_SCRIPT = [
 
 const createReleaseAssets = async () => {
   // The dir name (e.g. "executor-linux-x64") still encodes the platform tag.
-  // Don't read `pkg.name` here — under the npm:alias pattern every variant's
+  // Don't read `pkg.name` here. Under the npm:alias pattern every variant's
   // package.json has the same `name: "executor"`, so all assets would collide
   // on the same filename.
   for (const entry of new Bun.Glob("executor-*/package.json").scanSync({ cwd: distDir })) {
@@ -724,11 +617,11 @@ const createReleaseAssets = async () => {
 };
 
 // ---------------------------------------------------------------------------
-// Node.js launcher — resolves the platform binary shipped as an
+// Node.js launcher resolves the platform binary shipped as an
 // optionalDependency and execs it. Resolution order:
 //   1. EXECUTOR_BIN_PATH override
 //   2. require.resolve("executor-<platform>-<arch>/package.json")
-//   3. bin/runtime/<binary> (preview wrapper compat — pkg.pr.new previews
+//   3. bin/runtime/<binary> (preview wrapper compat, pkg.pr.new previews
 //      download the binary here at install time instead of via
 //      optionalDependencies)
 //
@@ -835,7 +728,7 @@ process.exit(1);
 `;
 
 // ---------------------------------------------------------------------------
-// Preview postinstall — download per-PR tarballs from our R2 CDN instead of
+// Preview postinstall downloads per-PR tarballs from our R2 CDN instead of
 // GitHub Releases. The __CDN_BASE_URL__ placeholder is replaced at build time
 // with `${cdnBase}/${sha}` so each preview fetches its own commit's binary.
 // ---------------------------------------------------------------------------
@@ -970,16 +863,12 @@ if (command === "binary") {
   await buildPreviewWrapperPackage(targets);
 } else if (command === "release-assets") {
   await createReleaseAssets();
-} else if (command === "publish") {
-  const channel = positionals[1] ?? "latest";
-  await publish(channel);
 } else {
   console.log(`Usage:
   bun run build.ts binary [--single] [--mode production|development]
   bun run build.ts preview [--mode production|development]
   bun run build.ts preview-tarball [--mode production|development]
   bun run build.ts preview-wrapper
-  bun run build.ts release-assets
-  bun run build.ts publish [channel]`);
+  bun run build.ts release-assets`);
   process.exit(1);
 }
diff --git a/apps/cli/src/daemon-state.test.ts b/legacy/cli/src/daemon-state.test.ts
similarity index 100%
rename from apps/cli/src/daemon-state.test.ts
rename to legacy/cli/src/daemon-state.test.ts
diff --git a/apps/cli/src/daemon-state.ts b/legacy/cli/src/daemon-state.ts
similarity index 100%
rename from apps/cli/src/daemon-state.ts
rename to legacy/cli/src/daemon-state.ts
diff --git a/apps/cli/src/daemon.test.ts b/legacy/cli/src/daemon.test.ts
similarity index 98%
rename from apps/cli/src/daemon.test.ts
rename to legacy/cli/src/daemon.test.ts
index 13ffdc80c..8758a9f14 100644
--- a/apps/cli/src/daemon.test.ts
+++ b/legacy/cli/src/daemon.test.ts
@@ -12,7 +12,7 @@ import {
 
 describe("isDevCliEntrypoint", () => {
   it("treats source entrypoints as dev", () => {
-    expect(isDevCliEntrypoint("/Users/x/src/executor/apps/cli/src/main.ts")).toBe(true);
+    expect(isDevCliEntrypoint("/Users/x/src/executor/legacy/cli/src/main.ts")).toBe(true);
     expect(isDevCliEntrypoint("/Users/x/dist/main.js")).toBe(true);
   });
 
diff --git a/apps/cli/src/daemon.ts b/legacy/cli/src/daemon.ts
similarity index 100%
rename from apps/cli/src/daemon.ts
rename to legacy/cli/src/daemon.ts
diff --git a/apps/cli/src/device-login.test.ts b/legacy/cli/src/device-login.test.ts
similarity index 100%
rename from apps/cli/src/device-login.test.ts
rename to legacy/cli/src/device-login.test.ts
diff --git a/apps/cli/src/device-login.ts b/legacy/cli/src/device-login.ts
similarity index 100%
rename from apps/cli/src/device-login.ts
rename to legacy/cli/src/device-login.ts
diff --git a/apps/cli/src/embedded-web-ui.gen.d.ts b/legacy/cli/src/embedded-web-ui.gen.d.ts
similarity index 100%
rename from apps/cli/src/embedded-web-ui.gen.d.ts
rename to legacy/cli/src/embedded-web-ui.gen.d.ts
diff --git a/apps/cli/src/embedded-web-ui.gen.ts b/legacy/cli/src/embedded-web-ui.gen.ts
similarity index 100%
rename from apps/cli/src/embedded-web-ui.gen.ts
rename to legacy/cli/src/embedded-web-ui.gen.ts
diff --git a/apps/cli/src/installation.ts b/legacy/cli/src/installation.ts
similarity index 100%
rename from apps/cli/src/installation.ts
rename to legacy/cli/src/installation.ts
diff --git a/apps/cli/src/integrations.ts b/legacy/cli/src/integrations.ts
similarity index 94%
rename from apps/cli/src/integrations.ts
rename to legacy/cli/src/integrations.ts
index 3d3dd7e23..687610640 100644
--- a/apps/cli/src/integrations.ts
+++ b/legacy/cli/src/integrations.ts
@@ -18,7 +18,7 @@ const refreshRegistry = IntegrationsRegistry.asEffect().pipe(
 // returns immediately, never throws, never blocks the caller. Bun's event
 // loop stays alive while the request is in flight, so sub-second CLI commands
 // still complete the fetch before process exit; long-lived commands (e.g.
-// `executor mcp`) get their recurring refresh from apps/local instead.
+// `executor mcp`) get their recurring refresh from legacy/local instead.
 // Honors DO_NOT_TRACK and EXECUTOR_DISABLE_INTEGRATIONS_FETCH inside the
 // layer.
 export const fetchIntegrations = (): void => {
diff --git a/apps/cli/src/local-server-manifest.test.ts b/legacy/cli/src/local-server-manifest.test.ts
similarity index 100%
rename from apps/cli/src/local-server-manifest.test.ts
rename to legacy/cli/src/local-server-manifest.test.ts
diff --git a/apps/cli/src/local-server-manifest.ts b/legacy/cli/src/local-server-manifest.ts
similarity index 100%
rename from apps/cli/src/local-server-manifest.ts
rename to legacy/cli/src/local-server-manifest.ts
diff --git a/apps/cli/src/main.ts b/legacy/cli/src/main.ts
similarity index 100%
rename from apps/cli/src/main.ts
rename to legacy/cli/src/main.ts
diff --git a/apps/cli/src/native-bindings.ts b/legacy/cli/src/native-bindings.ts
similarity index 100%
rename from apps/cli/src/native-bindings.ts
rename to legacy/cli/src/native-bindings.ts
diff --git a/apps/cli/src/server-connection.test.ts b/legacy/cli/src/server-connection.test.ts
similarity index 100%
rename from apps/cli/src/server-connection.test.ts
rename to legacy/cli/src/server-connection.test.ts
diff --git a/apps/cli/src/server-connection.ts b/legacy/cli/src/server-connection.ts
similarity index 100%
rename from apps/cli/src/server-connection.ts
rename to legacy/cli/src/server-connection.ts
diff --git a/apps/cli/src/server-profile.test.ts b/legacy/cli/src/server-profile.test.ts
similarity index 100%
rename from apps/cli/src/server-profile.test.ts
rename to legacy/cli/src/server-profile.test.ts
diff --git a/apps/cli/src/server-profile.ts b/legacy/cli/src/server-profile.ts
similarity index 100%
rename from apps/cli/src/server-profile.ts
rename to legacy/cli/src/server-profile.ts
diff --git a/apps/cli/src/service.test.ts b/legacy/cli/src/service.test.ts
similarity index 100%
rename from apps/cli/src/service.test.ts
rename to legacy/cli/src/service.test.ts
diff --git a/apps/cli/src/service.ts b/legacy/cli/src/service.ts
similarity index 100%
rename from apps/cli/src/service.ts
rename to legacy/cli/src/service.ts
diff --git a/apps/cli/src/tooling.test.ts b/legacy/cli/src/tooling.test.ts
similarity index 100%
rename from apps/cli/src/tooling.test.ts
rename to legacy/cli/src/tooling.test.ts
diff --git a/apps/cli/src/tooling.ts b/legacy/cli/src/tooling.ts
similarity index 100%
rename from apps/cli/src/tooling.ts
rename to legacy/cli/src/tooling.ts
diff --git a/apps/cli/tsconfig.json b/legacy/cli/tsconfig.json
similarity index 100%
rename from apps/cli/tsconfig.json
rename to legacy/cli/tsconfig.json
diff --git a/apps/desktop/vitest.config.ts b/legacy/cli/vitest.config.ts
similarity index 100%
rename from apps/desktop/vitest.config.ts
rename to legacy/cli/vitest.config.ts
diff --git a/apps/cloud/.gitignore b/legacy/cloud/.gitignore
similarity index 100%
rename from apps/cloud/.gitignore
rename to legacy/cloud/.gitignore
diff --git a/apps/cloud/CHANGELOG.md b/legacy/cloud/CHANGELOG.md
similarity index 100%
rename from apps/cloud/CHANGELOG.md
rename to legacy/cloud/CHANGELOG.md
diff --git a/apps/cloud/drizzle.config.ts b/legacy/cloud/drizzle.config.ts
similarity index 100%
rename from apps/cloud/drizzle.config.ts
rename to legacy/cloud/drizzle.config.ts
diff --git a/apps/cloud/drizzle/0000_v2_baseline.sql b/legacy/cloud/drizzle/0000_v2_baseline.sql
similarity index 100%
rename from apps/cloud/drizzle/0000_v2_baseline.sql
rename to legacy/cloud/drizzle/0000_v2_baseline.sql
diff --git a/apps/cloud/drizzle/0001_illegal_wolverine.sql b/legacy/cloud/drizzle/0001_illegal_wolverine.sql
similarity index 100%
rename from apps/cloud/drizzle/0001_illegal_wolverine.sql
rename to legacy/cloud/drizzle/0001_illegal_wolverine.sql
diff --git a/apps/cloud/drizzle/0002_unwrap_openapi_output_envelope.sql b/legacy/cloud/drizzle/0002_unwrap_openapi_output_envelope.sql
similarity index 100%
rename from apps/cloud/drizzle/0002_unwrap_openapi_output_envelope.sql
rename to legacy/cloud/drizzle/0002_unwrap_openapi_output_envelope.sql
diff --git a/apps/cloud/drizzle/0003_friendly_monster_badoon.sql b/legacy/cloud/drizzle/0003_friendly_monster_badoon.sql
similarity index 100%
rename from apps/cloud/drizzle/0003_friendly_monster_badoon.sql
rename to legacy/cloud/drizzle/0003_friendly_monster_badoon.sql
diff --git a/apps/cloud/drizzle/0004_nervous_quasar.sql b/legacy/cloud/drizzle/0004_nervous_quasar.sql
similarity index 100%
rename from apps/cloud/drizzle/0004_nervous_quasar.sql
rename to legacy/cloud/drizzle/0004_nervous_quasar.sql
diff --git a/apps/cloud/drizzle/0005_integration_descriptions.sql b/legacy/cloud/drizzle/0005_integration_descriptions.sql
similarity index 100%
rename from apps/cloud/drizzle/0005_integration_descriptions.sql
rename to legacy/cloud/drizzle/0005_integration_descriptions.sql
diff --git a/apps/cloud/drizzle/0006_google_openapi_ownership.sql b/legacy/cloud/drizzle/0006_google_openapi_ownership.sql
similarity index 100%
rename from apps/cloud/drizzle/0006_google_openapi_ownership.sql
rename to legacy/cloud/drizzle/0006_google_openapi_ownership.sql
diff --git a/apps/cloud/drizzle/0007_red_dragon_lord.sql b/legacy/cloud/drizzle/0007_red_dragon_lord.sql
similarity index 100%
rename from apps/cloud/drizzle/0007_red_dragon_lord.sql
rename to legacy/cloud/drizzle/0007_red_dragon_lord.sql
diff --git a/apps/cloud/drizzle/meta/0000_snapshot.json b/legacy/cloud/drizzle/meta/0000_snapshot.json
similarity index 100%
rename from apps/cloud/drizzle/meta/0000_snapshot.json
rename to legacy/cloud/drizzle/meta/0000_snapshot.json
diff --git a/apps/cloud/drizzle/meta/0001_snapshot.json b/legacy/cloud/drizzle/meta/0001_snapshot.json
similarity index 100%
rename from apps/cloud/drizzle/meta/0001_snapshot.json
rename to legacy/cloud/drizzle/meta/0001_snapshot.json
diff --git a/apps/cloud/drizzle/meta/0002_snapshot.json b/legacy/cloud/drizzle/meta/0002_snapshot.json
similarity index 100%
rename from apps/cloud/drizzle/meta/0002_snapshot.json
rename to legacy/cloud/drizzle/meta/0002_snapshot.json
diff --git a/apps/cloud/drizzle/meta/0003_snapshot.json b/legacy/cloud/drizzle/meta/0003_snapshot.json
similarity index 100%
rename from apps/cloud/drizzle/meta/0003_snapshot.json
rename to legacy/cloud/drizzle/meta/0003_snapshot.json
diff --git a/apps/cloud/drizzle/meta/0004_snapshot.json b/legacy/cloud/drizzle/meta/0004_snapshot.json
similarity index 100%
rename from apps/cloud/drizzle/meta/0004_snapshot.json
rename to legacy/cloud/drizzle/meta/0004_snapshot.json
diff --git a/apps/cloud/drizzle/meta/0005_snapshot.json b/legacy/cloud/drizzle/meta/0005_snapshot.json
similarity index 100%
rename from apps/cloud/drizzle/meta/0005_snapshot.json
rename to legacy/cloud/drizzle/meta/0005_snapshot.json
diff --git a/apps/cloud/drizzle/meta/0006_snapshot.json b/legacy/cloud/drizzle/meta/0006_snapshot.json
similarity index 100%
rename from apps/cloud/drizzle/meta/0006_snapshot.json
rename to legacy/cloud/drizzle/meta/0006_snapshot.json
diff --git a/apps/cloud/drizzle/meta/0007_snapshot.json b/legacy/cloud/drizzle/meta/0007_snapshot.json
similarity index 100%
rename from apps/cloud/drizzle/meta/0007_snapshot.json
rename to legacy/cloud/drizzle/meta/0007_snapshot.json
diff --git a/apps/cloud/drizzle/meta/_journal.json b/legacy/cloud/drizzle/meta/_journal.json
similarity index 100%
rename from apps/cloud/drizzle/meta/_journal.json
rename to legacy/cloud/drizzle/meta/_journal.json
diff --git a/apps/cloud/executor.config.ts b/legacy/cloud/executor.config.ts
similarity index 100%
rename from apps/cloud/executor.config.ts
rename to legacy/cloud/executor.config.ts
diff --git a/apps/cloud/package.json b/legacy/cloud/package.json
similarity index 100%
rename from apps/cloud/package.json
rename to legacy/cloud/package.json
diff --git a/apps/cloud/public/apple-touch-icon.png b/legacy/cloud/public/apple-touch-icon.png
similarity index 100%
rename from apps/cloud/public/apple-touch-icon.png
rename to legacy/cloud/public/apple-touch-icon.png
diff --git a/apps/cloud/public/favicon-192.png b/legacy/cloud/public/favicon-192.png
similarity index 100%
rename from apps/cloud/public/favicon-192.png
rename to legacy/cloud/public/favicon-192.png
diff --git a/apps/cloud/public/favicon-32.png b/legacy/cloud/public/favicon-32.png
similarity index 100%
rename from apps/cloud/public/favicon-32.png
rename to legacy/cloud/public/favicon-32.png
diff --git a/apps/cloud/public/favicon.ico b/legacy/cloud/public/favicon.ico
similarity index 100%
rename from apps/cloud/public/favicon.ico
rename to legacy/cloud/public/favicon.ico
diff --git a/apps/cloud/scripts/backfill-org-slugs.ts b/legacy/cloud/scripts/backfill-org-slugs.ts
similarity index 100%
rename from apps/cloud/scripts/backfill-org-slugs.ts
rename to legacy/cloud/scripts/backfill-org-slugs.ts
diff --git a/apps/cloud/scripts/build.mjs b/legacy/cloud/scripts/build.mjs
similarity index 100%
rename from apps/cloud/scripts/build.mjs
rename to legacy/cloud/scripts/build.mjs
diff --git a/apps/cloud/scripts/code-migrations/google-openapi-r2-blobs.ts b/legacy/cloud/scripts/code-migrations/google-openapi-r2-blobs.ts
similarity index 100%
rename from apps/cloud/scripts/code-migrations/google-openapi-r2-blobs.ts
rename to legacy/cloud/scripts/code-migrations/google-openapi-r2-blobs.ts
diff --git a/apps/cloud/scripts/code-migrations/index.ts b/legacy/cloud/scripts/code-migrations/index.ts
similarity index 100%
rename from apps/cloud/scripts/code-migrations/index.ts
rename to legacy/cloud/scripts/code-migrations/index.ts
diff --git a/apps/cloud/scripts/code-migrations/runner.ts b/legacy/cloud/scripts/code-migrations/runner.ts
similarity index 100%
rename from apps/cloud/scripts/code-migrations/runner.ts
rename to legacy/cloud/scripts/code-migrations/runner.ts
diff --git a/apps/cloud/scripts/dev-db.ts b/legacy/cloud/scripts/dev-db.ts
similarity index 100%
rename from apps/cloud/scripts/dev-db.ts
rename to legacy/cloud/scripts/dev-db.ts
diff --git a/apps/cloud/scripts/gen-routes.ts b/legacy/cloud/scripts/gen-routes.ts
similarity index 95%
rename from apps/cloud/scripts/gen-routes.ts
rename to legacy/cloud/scripts/gen-routes.ts
index 60fc3ff14..34df80650 100644
--- a/apps/cloud/scripts/gen-routes.ts
+++ b/legacy/cloud/scripts/gen-routes.ts
@@ -27,4 +27,4 @@ await generateRouteTree({
     "}",
   ],
 });
-console.log("generated apps/cloud route tree");
+console.log("generated legacy/cloud route tree");
diff --git a/apps/cloud/scripts/migrate-auth-configs.ts b/legacy/cloud/scripts/migrate-auth-configs.ts
similarity index 100%
rename from apps/cloud/scripts/migrate-auth-configs.ts
rename to legacy/cloud/scripts/migrate-auth-configs.ts
diff --git a/apps/cloud/scripts/migrate-specs-to-blobs.ts b/legacy/cloud/scripts/migrate-specs-to-blobs.ts
similarity index 100%
rename from apps/cloud/scripts/migrate-specs-to-blobs.ts
rename to legacy/cloud/scripts/migrate-specs-to-blobs.ts
diff --git a/apps/cloud/scripts/migrate.ts b/legacy/cloud/scripts/migrate.ts
similarity index 100%
rename from apps/cloud/scripts/migrate.ts
rename to legacy/cloud/scripts/migrate.ts
diff --git a/apps/cloud/scripts/repartition-vault-metadata.ts b/legacy/cloud/scripts/repartition-vault-metadata.ts
similarity index 100%
rename from apps/cloud/scripts/repartition-vault-metadata.ts
rename to legacy/cloud/scripts/repartition-vault-metadata.ts
diff --git a/apps/cloud/scripts/test-globalsetup.ts b/legacy/cloud/scripts/test-globalsetup.ts
similarity index 100%
rename from apps/cloud/scripts/test-globalsetup.ts
rename to legacy/cloud/scripts/test-globalsetup.ts
diff --git a/apps/cloud/src/account/account-api.ts b/legacy/cloud/src/account/account-api.ts
similarity index 100%
rename from apps/cloud/src/account/account-api.ts
rename to legacy/cloud/src/account/account-api.ts
diff --git a/apps/cloud/src/account/member-limits.node.test.ts b/legacy/cloud/src/account/member-limits.node.test.ts
similarity index 100%
rename from apps/cloud/src/account/member-limits.node.test.ts
rename to legacy/cloud/src/account/member-limits.node.test.ts
diff --git a/apps/cloud/src/account/organization-limits.node.test.ts b/legacy/cloud/src/account/organization-limits.node.test.ts
similarity index 100%
rename from apps/cloud/src/account/organization-limits.node.test.ts
rename to legacy/cloud/src/account/organization-limits.node.test.ts
diff --git a/apps/cloud/src/account/workos-account-service.ts b/legacy/cloud/src/account/workos-account-service.ts
similarity index 100%
rename from apps/cloud/src/account/workos-account-service.ts
rename to legacy/cloud/src/account/workos-account-service.ts
diff --git a/apps/cloud/src/api.request-scope.node.test.ts b/legacy/cloud/src/api.request-scope.node.test.ts
similarity index 100%
rename from apps/cloud/src/api.request-scope.node.test.ts
rename to legacy/cloud/src/api.request-scope.node.test.ts
diff --git a/apps/cloud/src/api/error-response.ts b/legacy/cloud/src/api/error-response.ts
similarity index 100%
rename from apps/cloud/src/api/error-response.ts
rename to legacy/cloud/src/api/error-response.ts
diff --git a/apps/cloud/src/api/layers.ts b/legacy/cloud/src/api/layers.ts
similarity index 100%
rename from apps/cloud/src/api/layers.ts
rename to legacy/cloud/src/api/layers.ts
diff --git a/apps/cloud/src/api/protected-api-key-auth.node.test.ts b/legacy/cloud/src/api/protected-api-key-auth.node.test.ts
similarity index 100%
rename from apps/cloud/src/api/protected-api-key-auth.node.test.ts
rename to legacy/cloud/src/api/protected-api-key-auth.node.test.ts
diff --git a/apps/cloud/src/api/protected-jwt-auth.node.test.ts b/legacy/cloud/src/api/protected-jwt-auth.node.test.ts
similarity index 100%
rename from apps/cloud/src/api/protected-jwt-auth.node.test.ts
rename to legacy/cloud/src/api/protected-jwt-auth.node.test.ts
diff --git a/apps/cloud/src/api/protected.test.ts b/legacy/cloud/src/api/protected.test.ts
similarity index 100%
rename from apps/cloud/src/api/protected.test.ts
rename to legacy/cloud/src/api/protected.test.ts
diff --git a/apps/cloud/src/api/protected.ts b/legacy/cloud/src/api/protected.ts
similarity index 98%
rename from apps/cloud/src/api/protected.ts
rename to legacy/cloud/src/api/protected.ts
index 3d8a513bb..0a38f5815 100644
--- a/apps/cloud/src/api/protected.ts
+++ b/legacy/cloud/src/api/protected.ts
@@ -85,7 +85,7 @@ const ExecutionStackMiddleware = makeExecutionStackMiddleware<
 // collapses `requires: IdentityProvider | DbService | UserStoreService` to the
 // boot-only `WorkOSClient | ApiKeyService` (so `.layer` is a real Layer instead
 // of the "Need to combine" sentinel). Exposed as a factory so tests can swap in a
-// counting fake — see `apps/cloud/src/api.request-scope.node.test.ts`.
+// counting fake, see `legacy/cloud/src/api.request-scope.node.test.ts`.
 //
 // `AutumnService` is provided HERE — the billing service is scoped to the
 // executor plane that meters, not to the neutral boot core. (`/autumn`, the
@@ -109,7 +109,7 @@ export const makeProtectedApiLive = (rsLive: Layer.Layer<DbService | UserStoreSe
   // UserStoreService` to `never` (so `.layer` is a real Layer instead of the "Need
   // to combine" sentinel) AND keeps the socket request-scoped. Exposed as a
   // factory so tests can swap in a counting fake — see
-  // `apps/cloud/src/api.request-scope.node.test.ts`.
+  // `legacy/cloud/src/api.request-scope.node.test.ts`.
   const requestScopedLive = rsLive.pipe(Layer.provideMerge(identityLive));
   const protectedMiddleware = ExecutionStackMiddleware.combine(
     requestScopedMiddleware(requestScopedLive),
diff --git a/apps/cloud/src/api/router.ts b/legacy/cloud/src/api/router.ts
similarity index 97%
rename from apps/cloud/src/api/router.ts
rename to legacy/cloud/src/api/router.ts
index d74f9c0b2..fc730fea6 100644
--- a/apps/cloud/src/api/router.ts
+++ b/legacy/cloud/src/api/router.ts
@@ -28,7 +28,7 @@ import { makeProtectedApiLive } from "./protected";
 // `Layer.provideMerge`. `requestScopedLive` is exposed as a parameter
 // so tests can substitute a counting fake for `DbService.Live` and
 // assert per-request semantics — see
-// `apps/cloud/src/api.request-scope.node.test.ts`.
+// `legacy/cloud/src/api.request-scope.node.test.ts`.
 export const makeApiLive = (requestScopedLive: Layer.Layer<DbService | UserStoreService>) => {
   const BillingRoutesLive = AutumnRoutesLive.pipe(
     Layer.provide(requestScopedMiddleware(requestScopedLive).layer),
diff --git a/apps/cloud/src/app-paths.test.ts b/legacy/cloud/src/app-paths.test.ts
similarity index 100%
rename from apps/cloud/src/app-paths.test.ts
rename to legacy/cloud/src/app-paths.test.ts
diff --git a/apps/cloud/src/app-paths.ts b/legacy/cloud/src/app-paths.ts
similarity index 100%
rename from apps/cloud/src/app-paths.ts
rename to legacy/cloud/src/app-paths.ts
diff --git a/apps/cloud/src/app.ts b/legacy/cloud/src/app.ts
similarity index 99%
rename from apps/cloud/src/app.ts
rename to legacy/cloud/src/app.ts
index ef5cbf61a..7ea55c93c 100644
--- a/apps/cloud/src/app.ts
+++ b/legacy/cloud/src/app.ts
@@ -35,7 +35,7 @@ import { WorkerTelemetryLive } from "./observability/telemetry";
 // capture — and Autumn BILLING entering ONLY as extensions: the engine
 // metering decorator, the account seat-gate, the `/api/billing/*` proxy route,
 // and the createOrganization free-limit gate. `diff` against
-// `apps/host-selfhost/src/app.ts` is the entire product difference.
+// `legacy/host-selfhost/src/app.ts` is the entire product difference.
 //
 // `ExecutorApp.make` owns the assembly (the execution-stack middleware wrapping
 // the protected API, the MCP envelope, the account API on the /api-prefixed
diff --git a/apps/cloud/src/auth/api-jwt-bearer.ts b/legacy/cloud/src/auth/api-jwt-bearer.ts
similarity index 100%
rename from apps/cloud/src/auth/api-jwt-bearer.ts
rename to legacy/cloud/src/auth/api-jwt-bearer.ts
diff --git a/apps/cloud/src/auth/api-keys.node.test.ts b/legacy/cloud/src/auth/api-keys.node.test.ts
similarity index 100%
rename from apps/cloud/src/auth/api-keys.node.test.ts
rename to legacy/cloud/src/auth/api-keys.node.test.ts
diff --git a/apps/cloud/src/auth/api-keys.ts b/legacy/cloud/src/auth/api-keys.ts
similarity index 100%
rename from apps/cloud/src/auth/api-keys.ts
rename to legacy/cloud/src/auth/api-keys.ts
diff --git a/apps/cloud/src/auth/api.ts b/legacy/cloud/src/auth/api.ts
similarity index 100%
rename from apps/cloud/src/auth/api.ts
rename to legacy/cloud/src/auth/api.ts
diff --git a/apps/cloud/src/auth/bearer.ts b/legacy/cloud/src/auth/bearer.ts
similarity index 100%
rename from apps/cloud/src/auth/bearer.ts
rename to legacy/cloud/src/auth/bearer.ts
diff --git a/apps/cloud/src/auth/context.ts b/legacy/cloud/src/auth/context.ts
similarity index 100%
rename from apps/cloud/src/auth/context.ts
rename to legacy/cloud/src/auth/context.ts
diff --git a/apps/cloud/src/auth/cookies.ts b/legacy/cloud/src/auth/cookies.ts
similarity index 100%
rename from apps/cloud/src/auth/cookies.ts
rename to legacy/cloud/src/auth/cookies.ts
diff --git a/apps/cloud/src/auth/errors.ts b/legacy/cloud/src/auth/errors.ts
similarity index 100%
rename from apps/cloud/src/auth/errors.ts
rename to legacy/cloud/src/auth/errors.ts
diff --git a/apps/cloud/src/auth/handlers.ts b/legacy/cloud/src/auth/handlers.ts
similarity index 100%
rename from apps/cloud/src/auth/handlers.ts
rename to legacy/cloud/src/auth/handlers.ts
diff --git a/apps/cloud/src/auth/jwks-cache.node.test.ts b/legacy/cloud/src/auth/jwks-cache.node.test.ts
similarity index 100%
rename from apps/cloud/src/auth/jwks-cache.node.test.ts
rename to legacy/cloud/src/auth/jwks-cache.node.test.ts
diff --git a/apps/cloud/src/auth/jwks-cache.ts b/legacy/cloud/src/auth/jwks-cache.ts
similarity index 100%
rename from apps/cloud/src/auth/jwks-cache.ts
rename to legacy/cloud/src/auth/jwks-cache.ts
diff --git a/apps/cloud/src/auth/login-state.test.ts b/legacy/cloud/src/auth/login-state.test.ts
similarity index 100%
rename from apps/cloud/src/auth/login-state.test.ts
rename to legacy/cloud/src/auth/login-state.test.ts
diff --git a/apps/cloud/src/auth/login-state.ts b/legacy/cloud/src/auth/login-state.ts
similarity index 100%
rename from apps/cloud/src/auth/login-state.ts
rename to legacy/cloud/src/auth/login-state.ts
diff --git a/apps/cloud/src/auth/middleware-live.ts b/legacy/cloud/src/auth/middleware-live.ts
similarity index 100%
rename from apps/cloud/src/auth/middleware-live.ts
rename to legacy/cloud/src/auth/middleware-live.ts
diff --git a/apps/cloud/src/auth/middleware.ts b/legacy/cloud/src/auth/middleware.ts
similarity index 100%
rename from apps/cloud/src/auth/middleware.ts
rename to legacy/cloud/src/auth/middleware.ts
diff --git a/apps/cloud/src/auth/org-selector-auth.node.test.ts b/legacy/cloud/src/auth/org-selector-auth.node.test.ts
similarity index 100%
rename from apps/cloud/src/auth/org-selector-auth.node.test.ts
rename to legacy/cloud/src/auth/org-selector-auth.node.test.ts
diff --git a/apps/cloud/src/auth/organization.ts b/legacy/cloud/src/auth/organization.ts
similarity index 100%
rename from apps/cloud/src/auth/organization.ts
rename to legacy/cloud/src/auth/organization.ts
diff --git a/apps/cloud/src/auth/request-origin.test.ts b/legacy/cloud/src/auth/request-origin.test.ts
similarity index 100%
rename from apps/cloud/src/auth/request-origin.test.ts
rename to legacy/cloud/src/auth/request-origin.test.ts
diff --git a/apps/cloud/src/auth/request-origin.ts b/legacy/cloud/src/auth/request-origin.ts
similarity index 100%
rename from apps/cloud/src/auth/request-origin.ts
rename to legacy/cloud/src/auth/request-origin.ts
diff --git a/apps/cloud/src/auth/return-to.test.ts b/legacy/cloud/src/auth/return-to.test.ts
similarity index 100%
rename from apps/cloud/src/auth/return-to.test.ts
rename to legacy/cloud/src/auth/return-to.test.ts
diff --git a/apps/cloud/src/auth/return-to.ts b/legacy/cloud/src/auth/return-to.ts
similarity index 100%
rename from apps/cloud/src/auth/return-to.ts
rename to legacy/cloud/src/auth/return-to.ts
diff --git a/apps/cloud/src/auth/route-paths.ts b/legacy/cloud/src/auth/route-paths.ts
similarity index 100%
rename from apps/cloud/src/auth/route-paths.ts
rename to legacy/cloud/src/auth/route-paths.ts
diff --git a/apps/cloud/src/auth/ssr-gate.ts b/legacy/cloud/src/auth/ssr-gate.ts
similarity index 100%
rename from apps/cloud/src/auth/ssr-gate.ts
rename to legacy/cloud/src/auth/ssr-gate.ts
diff --git a/apps/cloud/src/auth/user-store.ts b/legacy/cloud/src/auth/user-store.ts
similarity index 100%
rename from apps/cloud/src/auth/user-store.ts
rename to legacy/cloud/src/auth/user-store.ts
diff --git a/apps/cloud/src/auth/workos-auth-provider.ts b/legacy/cloud/src/auth/workos-auth-provider.ts
similarity index 100%
rename from apps/cloud/src/auth/workos-auth-provider.ts
rename to legacy/cloud/src/auth/workos-auth-provider.ts
diff --git a/apps/cloud/src/auth/workos.node.test.ts b/legacy/cloud/src/auth/workos.node.test.ts
similarity index 100%
rename from apps/cloud/src/auth/workos.node.test.ts
rename to legacy/cloud/src/auth/workos.node.test.ts
diff --git a/apps/cloud/src/auth/workos.ts b/legacy/cloud/src/auth/workos.ts
similarity index 100%
rename from apps/cloud/src/auth/workos.ts
rename to legacy/cloud/src/auth/workos.ts
diff --git a/apps/cloud/src/db/code-migration-runner.test.ts b/legacy/cloud/src/db/code-migration-runner.test.ts
similarity index 100%
rename from apps/cloud/src/db/code-migration-runner.test.ts
rename to legacy/cloud/src/db/code-migration-runner.test.ts
diff --git a/apps/cloud/src/db/db.schema.test.ts b/legacy/cloud/src/db/db.schema.test.ts
similarity index 100%
rename from apps/cloud/src/db/db.schema.test.ts
rename to legacy/cloud/src/db/db.schema.test.ts
diff --git a/apps/cloud/src/db/db.test.ts b/legacy/cloud/src/db/db.test.ts
similarity index 100%
rename from apps/cloud/src/db/db.test.ts
rename to legacy/cloud/src/db/db.test.ts
diff --git a/apps/cloud/src/db/db.ts b/legacy/cloud/src/db/db.ts
similarity index 98%
rename from apps/cloud/src/db/db.ts
rename to legacy/cloud/src/db/db.ts
index 219beaf38..b45bc2d2e 100644
--- a/apps/cloud/src/db/db.ts
+++ b/legacy/cloud/src/db/db.ts
@@ -25,7 +25,7 @@ import * as executorSchema from "./executor-schema";
 // Exported so every drizzle() call in the cloud app shares one schema
 // object. Historically `mcp-session.ts` built its own and forgot to spread
 // `executorSchema`, producing runtime "unknown model source" errors that
-// only surfaced in prod. See apps/cloud/src/db/db.schema.test.ts.
+// only surfaced in prod. See legacy/cloud/src/db/db.schema.test.ts.
 export const combinedSchema = { ...cloudSchema, ...executorSchema };
 
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
diff --git a/apps/cloud/src/db/executor-schema.ts b/legacy/cloud/src/db/executor-schema.ts
similarity index 100%
rename from apps/cloud/src/db/executor-schema.ts
rename to legacy/cloud/src/db/executor-schema.ts
diff --git a/apps/cloud/src/db/fuma.ts b/legacy/cloud/src/db/fuma.ts
similarity index 100%
rename from apps/cloud/src/db/fuma.ts
rename to legacy/cloud/src/db/fuma.ts
diff --git a/apps/cloud/src/db/google-openapi-r2-code-migration.test.ts b/legacy/cloud/src/db/google-openapi-r2-code-migration.test.ts
similarity index 100%
rename from apps/cloud/src/db/google-openapi-r2-code-migration.test.ts
rename to legacy/cloud/src/db/google-openapi-r2-code-migration.test.ts
diff --git a/apps/cloud/src/db/schema.ts b/legacy/cloud/src/db/schema.ts
similarity index 100%
rename from apps/cloud/src/db/schema.ts
rename to legacy/cloud/src/db/schema.ts
diff --git a/apps/cloud/src/edge/docs.test.ts b/legacy/cloud/src/edge/docs.test.ts
similarity index 100%
rename from apps/cloud/src/edge/docs.test.ts
rename to legacy/cloud/src/edge/docs.test.ts
diff --git a/apps/cloud/src/edge/docs.ts b/legacy/cloud/src/edge/docs.ts
similarity index 100%
rename from apps/cloud/src/edge/docs.ts
rename to legacy/cloud/src/edge/docs.ts
diff --git a/apps/cloud/src/edge/index.ts b/legacy/cloud/src/edge/index.ts
similarity index 100%
rename from apps/cloud/src/edge/index.ts
rename to legacy/cloud/src/edge/index.ts
diff --git a/apps/cloud/src/edge/marketing.ts b/legacy/cloud/src/edge/marketing.ts
similarity index 100%
rename from apps/cloud/src/edge/marketing.ts
rename to legacy/cloud/src/edge/marketing.ts
diff --git a/apps/cloud/src/edge/posthog.ts b/legacy/cloud/src/edge/posthog.ts
similarity index 100%
rename from apps/cloud/src/edge/posthog.ts
rename to legacy/cloud/src/edge/posthog.ts
diff --git a/apps/cloud/src/edge/sentry-tunnel.ts b/legacy/cloud/src/edge/sentry-tunnel.ts
similarity index 100%
rename from apps/cloud/src/edge/sentry-tunnel.ts
rename to legacy/cloud/src/edge/sentry-tunnel.ts
diff --git a/apps/cloud/src/engine/execution-stack-metered.ts b/legacy/cloud/src/engine/execution-stack-metered.ts
similarity index 100%
rename from apps/cloud/src/engine/execution-stack-metered.ts
rename to legacy/cloud/src/engine/execution-stack-metered.ts
diff --git a/apps/cloud/src/engine/execution-stack.ts b/legacy/cloud/src/engine/execution-stack.ts
similarity index 100%
rename from apps/cloud/src/engine/execution-stack.ts
rename to legacy/cloud/src/engine/execution-stack.ts
diff --git a/apps/cloud/src/engine/execution-usage.ts b/legacy/cloud/src/engine/execution-usage.ts
similarity index 100%
rename from apps/cloud/src/engine/execution-usage.ts
rename to legacy/cloud/src/engine/execution-usage.ts
diff --git a/apps/cloud/src/env-augment.d.ts b/legacy/cloud/src/env-augment.d.ts
similarity index 100%
rename from apps/cloud/src/env-augment.d.ts
rename to legacy/cloud/src/env-augment.d.ts
diff --git a/apps/cloud/src/extensions/billing/plans.ts b/legacy/cloud/src/extensions/billing/plans.ts
similarity index 100%
rename from apps/cloud/src/extensions/billing/plans.ts
rename to legacy/cloud/src/extensions/billing/plans.ts
diff --git a/apps/cloud/src/extensions/billing/route.node.test.ts b/legacy/cloud/src/extensions/billing/route.node.test.ts
similarity index 100%
rename from apps/cloud/src/extensions/billing/route.node.test.ts
rename to legacy/cloud/src/extensions/billing/route.node.test.ts
diff --git a/apps/cloud/src/extensions/billing/route.ts b/legacy/cloud/src/extensions/billing/route.ts
similarity index 100%
rename from apps/cloud/src/extensions/billing/route.ts
rename to legacy/cloud/src/extensions/billing/route.ts
diff --git a/apps/cloud/src/extensions/billing/service.ts b/legacy/cloud/src/extensions/billing/service.ts
similarity index 100%
rename from apps/cloud/src/extensions/billing/service.ts
rename to legacy/cloud/src/extensions/billing/service.ts
diff --git a/apps/cloud/src/extensions/docs.ts b/legacy/cloud/src/extensions/docs.ts
similarity index 100%
rename from apps/cloud/src/extensions/docs.ts
rename to legacy/cloud/src/extensions/docs.ts
diff --git a/apps/cloud/src/extensions/routes.ts b/legacy/cloud/src/extensions/routes.ts
similarity index 100%
rename from apps/cloud/src/extensions/routes.ts
rename to legacy/cloud/src/extensions/routes.ts
diff --git a/apps/cloud/src/frontend-atom-error-capture.node.test.ts b/legacy/cloud/src/frontend-atom-error-capture.node.test.ts
similarity index 100%
rename from apps/cloud/src/frontend-atom-error-capture.node.test.ts
rename to legacy/cloud/src/frontend-atom-error-capture.node.test.ts
diff --git a/apps/cloud/src/mcp-session.e2e.node.test.ts b/legacy/cloud/src/mcp-session.e2e.node.test.ts
similarity index 100%
rename from apps/cloud/src/mcp-session.e2e.node.test.ts
rename to legacy/cloud/src/mcp-session.e2e.node.test.ts
diff --git a/apps/cloud/src/mcp/auth-provider.ts b/legacy/cloud/src/mcp/auth-provider.ts
similarity index 100%
rename from apps/cloud/src/mcp/auth-provider.ts
rename to legacy/cloud/src/mcp/auth-provider.ts
diff --git a/apps/cloud/src/mcp/auth.ts b/legacy/cloud/src/mcp/auth.ts
similarity index 100%
rename from apps/cloud/src/mcp/auth.ts
rename to legacy/cloud/src/mcp/auth.ts
diff --git a/apps/cloud/src/mcp/index.ts b/legacy/cloud/src/mcp/index.ts
similarity index 100%
rename from apps/cloud/src/mcp/index.ts
rename to legacy/cloud/src/mcp/index.ts
diff --git a/apps/cloud/src/mcp/jwt.ts b/legacy/cloud/src/mcp/jwt.ts
similarity index 100%
rename from apps/cloud/src/mcp/jwt.ts
rename to legacy/cloud/src/mcp/jwt.ts
diff --git a/apps/cloud/src/mcp/mcp-auth.node.test.ts b/legacy/cloud/src/mcp/mcp-auth.node.test.ts
similarity index 100%
rename from apps/cloud/src/mcp/mcp-auth.node.test.ts
rename to legacy/cloud/src/mcp/mcp-auth.node.test.ts
diff --git a/apps/cloud/src/mcp/mount.test.ts b/legacy/cloud/src/mcp/mount.test.ts
similarity index 100%
rename from apps/cloud/src/mcp/mount.test.ts
rename to legacy/cloud/src/mcp/mount.test.ts
diff --git a/apps/cloud/src/mcp/mount.ts b/legacy/cloud/src/mcp/mount.ts
similarity index 99%
rename from apps/cloud/src/mcp/mount.ts
rename to legacy/cloud/src/mcp/mount.ts
index cbb302717..a46f0c49d 100644
--- a/apps/cloud/src/mcp/mount.ts
+++ b/legacy/cloud/src/mcp/mount.ts
@@ -154,7 +154,7 @@ export const prepareMcpOrgScope = (request: Request): Request => {
 
 /**
  * Build the envelope web handler from the shared `McpServingRoutes` Layer,
- * provided cloud's two seams. Mirrors the self-host mount (apps/host-selfhost
+ * provided cloud's two seams. Mirrors the self-host mount (legacy/host-selfhost
  * api.ts): `HttpRouter.provideRequest` clears the route handlers' per-request
  * seam requirements, the build-time `Layer.provide(McpAuthProviderLive)`
  * satisfies the `HttpRouter.use` callback's read of `discoveryRoutes`, and
diff --git a/apps/cloud/src/mcp/oauth-metadata.ts b/legacy/cloud/src/mcp/oauth-metadata.ts
similarity index 100%
rename from apps/cloud/src/mcp/oauth-metadata.ts
rename to legacy/cloud/src/mcp/oauth-metadata.ts
diff --git a/apps/cloud/src/mcp/reporter.ts b/legacy/cloud/src/mcp/reporter.ts
similarity index 100%
rename from apps/cloud/src/mcp/reporter.ts
rename to legacy/cloud/src/mcp/reporter.ts
diff --git a/apps/cloud/src/mcp/responses.ts b/legacy/cloud/src/mcp/responses.ts
similarity index 100%
rename from apps/cloud/src/mcp/responses.ts
rename to legacy/cloud/src/mcp/responses.ts
diff --git a/apps/cloud/src/mcp/session-durable-object.ts b/legacy/cloud/src/mcp/session-durable-object.ts
similarity index 100%
rename from apps/cloud/src/mcp/session-durable-object.ts
rename to legacy/cloud/src/mcp/session-durable-object.ts
diff --git a/apps/cloud/src/mcp/session-store.ts b/legacy/cloud/src/mcp/session-store.ts
similarity index 100%
rename from apps/cloud/src/mcp/session-store.ts
rename to legacy/cloud/src/mcp/session-store.ts
diff --git a/apps/cloud/src/mcp/telemetry.ts b/legacy/cloud/src/mcp/telemetry.ts
similarity index 100%
rename from apps/cloud/src/mcp/telemetry.ts
rename to legacy/cloud/src/mcp/telemetry.ts
diff --git a/apps/cloud/src/mcp/worker-transport.test.ts b/legacy/cloud/src/mcp/worker-transport.test.ts
similarity index 100%
rename from apps/cloud/src/mcp/worker-transport.test.ts
rename to legacy/cloud/src/mcp/worker-transport.test.ts
diff --git a/apps/cloud/src/observability/browser-traces.test.ts b/legacy/cloud/src/observability/browser-traces.test.ts
similarity index 100%
rename from apps/cloud/src/observability/browser-traces.test.ts
rename to legacy/cloud/src/observability/browser-traces.test.ts
diff --git a/apps/cloud/src/observability/browser-traces.ts b/legacy/cloud/src/observability/browser-traces.ts
similarity index 100%
rename from apps/cloud/src/observability/browser-traces.ts
rename to legacy/cloud/src/observability/browser-traces.ts
diff --git a/apps/cloud/src/observability/error-logging.ts b/legacy/cloud/src/observability/error-logging.ts
similarity index 100%
rename from apps/cloud/src/observability/error-logging.ts
rename to legacy/cloud/src/observability/error-logging.ts
diff --git a/apps/cloud/src/observability/index.ts b/legacy/cloud/src/observability/index.ts
similarity index 100%
rename from apps/cloud/src/observability/index.ts
rename to legacy/cloud/src/observability/index.ts
diff --git a/apps/cloud/src/observability/observability.test.ts b/legacy/cloud/src/observability/observability.test.ts
similarity index 100%
rename from apps/cloud/src/observability/observability.test.ts
rename to legacy/cloud/src/observability/observability.test.ts
diff --git a/apps/cloud/src/observability/telemetry.ts b/legacy/cloud/src/observability/telemetry.ts
similarity index 100%
rename from apps/cloud/src/observability/telemetry.ts
rename to legacy/cloud/src/observability/telemetry.ts
diff --git a/apps/cloud/src/org/api.ts b/legacy/cloud/src/org/api.ts
similarity index 100%
rename from apps/cloud/src/org/api.ts
rename to legacy/cloud/src/org/api.ts
diff --git a/apps/cloud/src/org/auth-middleware.ts b/legacy/cloud/src/org/auth-middleware.ts
similarity index 100%
rename from apps/cloud/src/org/auth-middleware.ts
rename to legacy/cloud/src/org/auth-middleware.ts
diff --git a/apps/cloud/src/org/handlers.test.ts b/legacy/cloud/src/org/handlers.test.ts
similarity index 100%
rename from apps/cloud/src/org/handlers.test.ts
rename to legacy/cloud/src/org/handlers.test.ts
diff --git a/apps/cloud/src/org/handlers.ts b/legacy/cloud/src/org/handlers.ts
similarity index 100%
rename from apps/cloud/src/org/handlers.ts
rename to legacy/cloud/src/org/handlers.ts
diff --git a/apps/cloud/src/plugins.ts b/legacy/cloud/src/plugins.ts
similarity index 100%
rename from apps/cloud/src/plugins.ts
rename to legacy/cloud/src/plugins.ts
diff --git a/apps/cloud/src/routeTree.gen.ts b/legacy/cloud/src/routeTree.gen.ts
similarity index 100%
rename from apps/cloud/src/routeTree.gen.ts
rename to legacy/cloud/src/routeTree.gen.ts
diff --git a/apps/cloud/src/router.tsx b/legacy/cloud/src/router.tsx
similarity index 100%
rename from apps/cloud/src/router.tsx
rename to legacy/cloud/src/router.tsx
diff --git a/apps/cloud/src/routes/__root.tsx b/legacy/cloud/src/routes/__root.tsx
similarity index 100%
rename from apps/cloud/src/routes/__root.tsx
rename to legacy/cloud/src/routes/__root.tsx
diff --git a/apps/cloud/src/routes/app/api-keys.tsx b/legacy/cloud/src/routes/app/api-keys.tsx
similarity index 100%
rename from apps/cloud/src/routes/app/api-keys.tsx
rename to legacy/cloud/src/routes/app/api-keys.tsx
diff --git a/apps/cloud/src/routes/app/billing.tsx b/legacy/cloud/src/routes/app/billing.tsx
similarity index 100%
rename from apps/cloud/src/routes/app/billing.tsx
rename to legacy/cloud/src/routes/app/billing.tsx
diff --git a/apps/cloud/src/routes/app/billing_.plans.tsx b/legacy/cloud/src/routes/app/billing_.plans.tsx
similarity index 100%
rename from apps/cloud/src/routes/app/billing_.plans.tsx
rename to legacy/cloud/src/routes/app/billing_.plans.tsx
diff --git a/apps/cloud/src/routes/app/org.tsx b/legacy/cloud/src/routes/app/org.tsx
similarity index 100%
rename from apps/cloud/src/routes/app/org.tsx
rename to legacy/cloud/src/routes/app/org.tsx
diff --git a/apps/cloud/src/routes/app/resume.$executionId.tsx b/legacy/cloud/src/routes/app/resume.$executionId.tsx
similarity index 100%
rename from apps/cloud/src/routes/app/resume.$executionId.tsx
rename to legacy/cloud/src/routes/app/resume.$executionId.tsx
diff --git a/apps/cloud/src/routes/app/secrets.tsx b/legacy/cloud/src/routes/app/secrets.tsx
similarity index 100%
rename from apps/cloud/src/routes/app/secrets.tsx
rename to legacy/cloud/src/routes/app/secrets.tsx
diff --git a/apps/cloud/src/routes/bare/create-org.tsx b/legacy/cloud/src/routes/bare/create-org.tsx
similarity index 100%
rename from apps/cloud/src/routes/bare/create-org.tsx
rename to legacy/cloud/src/routes/bare/create-org.tsx
diff --git a/apps/cloud/src/routes/bare/login.tsx b/legacy/cloud/src/routes/bare/login.tsx
similarity index 100%
rename from apps/cloud/src/routes/bare/login.tsx
rename to legacy/cloud/src/routes/bare/login.tsx
diff --git a/apps/cloud/src/routes/bare/setup-mcp.tsx b/legacy/cloud/src/routes/bare/setup-mcp.tsx
similarity index 100%
rename from apps/cloud/src/routes/bare/setup-mcp.tsx
rename to legacy/cloud/src/routes/bare/setup-mcp.tsx
diff --git a/apps/cloud/src/server.ts b/legacy/cloud/src/server.ts
similarity index 100%
rename from apps/cloud/src/server.ts
rename to legacy/cloud/src/server.ts
diff --git a/apps/cloud/src/start.ts b/legacy/cloud/src/start.ts
similarity index 100%
rename from apps/cloud/src/start.ts
rename to legacy/cloud/src/start.ts
diff --git a/apps/cloud/src/vite-env.d.ts b/legacy/cloud/src/vite-env.d.ts
similarity index 100%
rename from apps/cloud/src/vite-env.d.ts
rename to legacy/cloud/src/vite-env.d.ts
diff --git a/apps/cloud/src/web/auth.tsx b/legacy/cloud/src/web/auth.tsx
similarity index 100%
rename from apps/cloud/src/web/auth.tsx
rename to legacy/cloud/src/web/auth.tsx
diff --git a/apps/cloud/src/web/client.tsx b/legacy/cloud/src/web/client.tsx
similarity index 100%
rename from apps/cloud/src/web/client.tsx
rename to legacy/cloud/src/web/client.tsx
diff --git a/apps/cloud/src/web/components/create-organization-form.tsx b/legacy/cloud/src/web/components/create-organization-form.tsx
similarity index 100%
rename from apps/cloud/src/web/components/create-organization-form.tsx
rename to legacy/cloud/src/web/components/create-organization-form.tsx
diff --git a/apps/cloud/src/web/components/org-menu-slot.tsx b/legacy/cloud/src/web/components/org-menu-slot.tsx
similarity index 100%
rename from apps/cloud/src/web/components/org-menu-slot.tsx
rename to legacy/cloud/src/web/components/org-menu-slot.tsx
diff --git a/apps/cloud/src/web/components/support-options.tsx b/legacy/cloud/src/web/components/support-options.tsx
similarity index 100%
rename from apps/cloud/src/web/components/support-options.tsx
rename to legacy/cloud/src/web/components/support-options.tsx
diff --git a/apps/cloud/src/web/components/support-slot.tsx b/legacy/cloud/src/web/components/support-slot.tsx
similarity index 100%
rename from apps/cloud/src/web/components/support-slot.tsx
rename to legacy/cloud/src/web/components/support-slot.tsx
diff --git a/apps/cloud/src/web/mcp-resume-atoms.ts b/legacy/cloud/src/web/mcp-resume-atoms.ts
similarity index 100%
rename from apps/cloud/src/web/mcp-resume-atoms.ts
rename to legacy/cloud/src/web/mcp-resume-atoms.ts
diff --git a/apps/cloud/src/web/org-atoms.ts b/legacy/cloud/src/web/org-atoms.ts
similarity index 100%
rename from apps/cloud/src/web/org-atoms.ts
rename to legacy/cloud/src/web/org-atoms.ts
diff --git a/apps/cloud/src/web/pages/create-org.tsx b/legacy/cloud/src/web/pages/create-org.tsx
similarity index 100%
rename from apps/cloud/src/web/pages/create-org.tsx
rename to legacy/cloud/src/web/pages/create-org.tsx
diff --git a/apps/cloud/src/web/pages/login.tsx b/legacy/cloud/src/web/pages/login.tsx
similarity index 100%
rename from apps/cloud/src/web/pages/login.tsx
rename to legacy/cloud/src/web/pages/login.tsx
diff --git a/apps/cloud/src/web/pages/setup-mcp.tsx b/legacy/cloud/src/web/pages/setup-mcp.tsx
similarity index 100%
rename from apps/cloud/src/web/pages/setup-mcp.tsx
rename to legacy/cloud/src/web/pages/setup-mcp.tsx
diff --git a/apps/cloud/src/web/shell.tsx b/legacy/cloud/src/web/shell.tsx
similarity index 100%
rename from apps/cloud/src/web/shell.tsx
rename to legacy/cloud/src/web/shell.tsx
diff --git a/apps/cloud/test-stubs/cloudflare-workers.ts b/legacy/cloud/test-stubs/cloudflare-workers.ts
similarity index 100%
rename from apps/cloud/test-stubs/cloudflare-workers.ts
rename to legacy/cloud/test-stubs/cloudflare-workers.ts
diff --git a/apps/cloud/test-stubs/tanstack-start-entry.ts b/legacy/cloud/test-stubs/tanstack-start-entry.ts
similarity index 100%
rename from apps/cloud/test-stubs/tanstack-start-entry.ts
rename to legacy/cloud/test-stubs/tanstack-start-entry.ts
diff --git a/apps/cloud/tsconfig.json b/legacy/cloud/tsconfig.json
similarity index 97%
rename from apps/cloud/tsconfig.json
rename to legacy/cloud/tsconfig.json
index 129885505..ebc542fad 100644
--- a/apps/cloud/tsconfig.json
+++ b/legacy/cloud/tsconfig.json
@@ -8,7 +8,6 @@
     "skipLibCheck": true,
     "types": ["@cloudflare/workers-types"],
     "outDir": "dist",
-    "rootDir": ".",
     "declaration": false,
     "declarationMap": false,
     "sourceMap": true,
diff --git a/apps/cloud/tsr.routes.ts b/legacy/cloud/tsr.routes.ts
similarity index 100%
rename from apps/cloud/tsr.routes.ts
rename to legacy/cloud/tsr.routes.ts
diff --git a/apps/cloud/vite.config.ts b/legacy/cloud/vite.config.ts
similarity index 100%
rename from apps/cloud/vite.config.ts
rename to legacy/cloud/vite.config.ts
diff --git a/apps/cloud/vitest.config.ts b/legacy/cloud/vitest.config.ts
similarity index 100%
rename from apps/cloud/vitest.config.ts
rename to legacy/cloud/vitest.config.ts
diff --git a/apps/cloud/worker-configuration.d.ts b/legacy/cloud/worker-configuration.d.ts
similarity index 100%
rename from apps/cloud/worker-configuration.d.ts
rename to legacy/cloud/worker-configuration.d.ts
diff --git a/apps/cloud/wrangler.jsonc b/legacy/cloud/wrangler.jsonc
similarity index 100%
rename from apps/cloud/wrangler.jsonc
rename to legacy/cloud/wrangler.jsonc
diff --git a/apps/desktop/.gitignore b/legacy/desktop/.gitignore
similarity index 100%
rename from apps/desktop/.gitignore
rename to legacy/desktop/.gitignore
diff --git a/apps/desktop/CHANGELOG.md b/legacy/desktop/CHANGELOG.md
similarity index 100%
rename from apps/desktop/CHANGELOG.md
rename to legacy/desktop/CHANGELOG.md
diff --git a/apps/desktop/build/entitlements.mac.plist b/legacy/desktop/build/entitlements.mac.plist
similarity index 100%
rename from apps/desktop/build/entitlements.mac.plist
rename to legacy/desktop/build/entitlements.mac.plist
diff --git a/apps/desktop/build/icon.png b/legacy/desktop/build/icon.png
similarity index 100%
rename from apps/desktop/build/icon.png
rename to legacy/desktop/build/icon.png
diff --git a/apps/desktop/electron-builder.config.ts b/legacy/desktop/electron-builder.config.ts
similarity index 100%
rename from apps/desktop/electron-builder.config.ts
rename to legacy/desktop/electron-builder.config.ts
diff --git a/apps/desktop/electron-builder.e2e.config.ts b/legacy/desktop/electron-builder.e2e.config.ts
similarity index 100%
rename from apps/desktop/electron-builder.e2e.config.ts
rename to legacy/desktop/electron-builder.e2e.config.ts
diff --git a/apps/desktop/electron.vite.config.ts b/legacy/desktop/electron.vite.config.ts
similarity index 91%
rename from apps/desktop/electron.vite.config.ts
rename to legacy/desktop/electron.vite.config.ts
index 55dd2536c..a559dd063 100644
--- a/apps/desktop/electron.vite.config.ts
+++ b/legacy/desktop/electron.vite.config.ts
@@ -3,7 +3,7 @@ import { defineConfig, externalizeDepsPlugin } from "electron-vite";
 import appPlugin from "@executor-js/app/vite";
 
 const APP_ROOT = resolve(import.meta.dirname, "../../packages/app");
-const APPS_LOCAL = resolve(import.meta.dirname, "../local");
+const LEGACY_LOCAL = resolve(import.meta.dirname, "../local");
 
 // Electron's runtime is provided by the launcher binary, not the bundle.
 // electron-log etc. ship native modules that also must stay external.
@@ -79,8 +79,8 @@ export default defineConfig({
     },
     plugins: [
       appPlugin({
-        executorConfigPath: resolve(APPS_LOCAL, "executor.config.ts"),
-        executorJsoncPath: resolve(APPS_LOCAL, "executor.jsonc"),
+        executorConfigPath: resolve(LEGACY_LOCAL, "executor.config.ts"),
+        executorJsoncPath: resolve(LEGACY_LOCAL, "executor.jsonc"),
       }),
     ],
   },
diff --git a/apps/desktop/package.json b/legacy/desktop/package.json
similarity index 100%
rename from apps/desktop/package.json
rename to legacy/desktop/package.json
diff --git a/apps/desktop/scripts/build-sidecar.ts b/legacy/desktop/scripts/build-sidecar.ts
similarity index 97%
rename from apps/desktop/scripts/build-sidecar.ts
rename to legacy/desktop/scripts/build-sidecar.ts
index cf248e910..fc6b981f8 100644
--- a/apps/desktop/scripts/build-sidecar.ts
+++ b/legacy/desktop/scripts/build-sidecar.ts
@@ -10,7 +10,7 @@ import { resolve, join } from "node:path";
 
 const ROOT = resolve(import.meta.dir, "..");
 const REPO_ROOT = resolve(ROOT, "../..");
-const CLI_ROOT = resolve(REPO_ROOT, "apps/cli");
+const CLI_ROOT = resolve(REPO_ROOT, "legacy/cli");
 const EXECUTOR_OUT_DIR = resolve(ROOT, "resources/executor");
 
 const platformName = (platform: NodeJS.Platform): string =>
diff --git a/scripts/merge-latest-mac-yml.ts b/legacy/desktop/scripts/merge-latest-mac-yml.ts
similarity index 75%
rename from scripts/merge-latest-mac-yml.ts
rename to legacy/desktop/scripts/merge-latest-mac-yml.ts
index 06811631c..49223d9ac 100644
--- a/scripts/merge-latest-mac-yml.ts
+++ b/legacy/desktop/scripts/merge-latest-mac-yml.ts
@@ -2,17 +2,17 @@
 /**
  * Merge per-arch electron-builder update manifests into one latest-mac.yml.
  *
- * The desktop publish workflow builds mac arm64 and x64 in separate matrix
- * legs, and each electron-builder invocation emits its own latest-mac.yml
- * listing only that arch's artifacts. electron-updater clients fetch the
- * single `latest-mac.yml` from the release, so publishing either leg's file
- * as-is points every Mac at one arch (arm64 users were being served x64
- * zips). This script unions the `files` entries; electron-updater picks the
- * right one per client by matching the running arch against the file name.
+ * The archived desktop publish workflow built mac arm64 and x64 in separate
+ * matrix legs, and each electron-builder invocation emitted its own
+ * latest-mac.yml listing only that arch's artifacts. electron-updater clients
+ * fetched the single latest-mac.yml from the release, so publishing either
+ * leg's file as-is pointed every Mac at one arch. This helper is retained only
+ * with the legacy desktop source for historical maintenance.
  *
- * Usage: bun scripts/merge-latest-mac-yml.ts <x64.yml> <arm64.yml> <out.yml>
- * The first input's top-level path/sha512 (the legacy single-file fields read
- * by very old updaters) are kept, so pass the x64 manifest first.
+ * Usage: bun legacy/desktop/scripts/merge-latest-mac-yml.ts <x64.yml>
+ *   <arm64.yml> <out.yml>
+ * The first input's top-level path/sha512 fields are kept, so pass the x64
+ * manifest first.
  */
 
 interface UpdateFileEntry {
@@ -97,4 +97,6 @@ const files = [...primary.files, ...secondary.files].filter((file) => {
 });
 
 await Bun.write(outPath, serializeManifest({ ...primary, files }));
-console.log(`Merged ${primaryPath} + ${secondaryPath} → ${outPath} (${files.length} files)`);
+console.log(`Merged ${primaryPath} + ${secondaryPath} -> ${outPath} (${files.length} files)`);
+
+export {};
diff --git a/apps/desktop/scripts/smoke-sidecar.ts b/legacy/desktop/scripts/smoke-sidecar.ts
similarity index 98%
rename from apps/desktop/scripts/smoke-sidecar.ts
rename to legacy/desktop/scripts/smoke-sidecar.ts
index 88a6ee9b5..09262c98f 100644
--- a/apps/desktop/scripts/smoke-sidecar.ts
+++ b/legacy/desktop/scripts/smoke-sidecar.ts
@@ -26,7 +26,7 @@ import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 
 const ROOT = resolve(import.meta.dir, "..");
-const APPS_LOCAL_DRIZZLE = resolve(ROOT, "../local/drizzle-legacy-v1");
+const LEGACY_LOCAL_DRIZZLE = resolve(ROOT, "../local/drizzle-legacy-v1");
 const BINARY = resolve(
   ROOT,
   "resources/executor",
@@ -56,13 +56,13 @@ const makeScopeId = (cwd: string): string => {
 };
 
 const readLegacyMigrations = async (): Promise<readonly { sql: string; hash: string }[]> => {
-  const journal = (await Bun.file(join(APPS_LOCAL_DRIZZLE, "meta/_journal.json")).json()) as {
+  const journal = (await Bun.file(join(LEGACY_LOCAL_DRIZZLE, "meta/_journal.json")).json()) as {
     readonly entries: readonly { readonly idx: number; readonly tag: string }[];
   };
 
   const migrations: { sql: string; hash: string }[] = [];
   for (const entry of [...journal.entries].sort((left, right) => left.idx - right.idx)) {
-    const query = await Bun.file(join(APPS_LOCAL_DRIZZLE, `${entry.tag}.sql`)).text();
+    const query = await Bun.file(join(LEGACY_LOCAL_DRIZZLE, `${entry.tag}.sql`)).text();
     migrations.push({
       sql: query,
       hash: createHash("sha256").update(query).digest("hex"),
@@ -322,7 +322,7 @@ const completePausedResult = async (
 const main = async () => {
   if (!(await Bun.file(BINARY).exists())) {
     fail(
-      `binary not found at ${BINARY}. Run \`bun ./scripts/build-sidecar.ts\` from apps/desktop first.`,
+      `binary not found at ${BINARY}. Run \`bun ./scripts/build-sidecar.ts\` from legacy/desktop first.`,
     );
   }
 
diff --git a/apps/desktop/src/main/crash-screen.ts b/legacy/desktop/src/main/crash-screen.ts
similarity index 100%
rename from apps/desktop/src/main/crash-screen.ts
rename to legacy/desktop/src/main/crash-screen.ts
diff --git a/apps/desktop/src/main/diagnostics.ts b/legacy/desktop/src/main/diagnostics.ts
similarity index 100%
rename from apps/desktop/src/main/diagnostics.ts
rename to legacy/desktop/src/main/diagnostics.ts
diff --git a/apps/desktop/src/main/global.d.ts b/legacy/desktop/src/main/global.d.ts
similarity index 100%
rename from apps/desktop/src/main/global.d.ts
rename to legacy/desktop/src/main/global.d.ts
diff --git a/apps/desktop/src/main/index.ts b/legacy/desktop/src/main/index.ts
similarity index 99%
rename from apps/desktop/src/main/index.ts
rename to legacy/desktop/src/main/index.ts
index d4850dee9..ce9f711e0 100644
--- a/apps/desktop/src/main/index.ts
+++ b/legacy/desktop/src/main/index.ts
@@ -348,7 +348,7 @@ const installBearerAuthHeader = (origin: string, token: string | null) => {
  * it programmatically (dock on mac, BrowserWindow on linux/win).
  *
  * In dev `app.getAppPath()` returns the directory of the app's
- * `package.json` (i.e. `apps/desktop`), which is more robust than
+ * `package.json` (i.e. `legacy/desktop`), which is more robust than
  * relative path math from the compiled main bundle.
  */
 const resolveSourceIconPath = (): string =>
diff --git a/apps/desktop/src/main/local-auth.ts b/legacy/desktop/src/main/local-auth.ts
similarity index 100%
rename from apps/desktop/src/main/local-auth.ts
rename to legacy/desktop/src/main/local-auth.ts
diff --git a/apps/desktop/src/main/reset-state.ts b/legacy/desktop/src/main/reset-state.ts
similarity index 100%
rename from apps/desktop/src/main/reset-state.ts
rename to legacy/desktop/src/main/reset-state.ts
diff --git a/apps/desktop/src/main/service.ts b/legacy/desktop/src/main/service.ts
similarity index 100%
rename from apps/desktop/src/main/service.ts
rename to legacy/desktop/src/main/service.ts
diff --git a/apps/desktop/src/main/settings.ts b/legacy/desktop/src/main/settings.ts
similarity index 100%
rename from apps/desktop/src/main/settings.ts
rename to legacy/desktop/src/main/settings.ts
diff --git a/apps/desktop/src/main/sidecar.ts b/legacy/desktop/src/main/sidecar.ts
similarity index 99%
rename from apps/desktop/src/main/sidecar.ts
rename to legacy/desktop/src/main/sidecar.ts
index 905e987b5..654d83efd 100644
--- a/apps/desktop/src/main/sidecar.ts
+++ b/legacy/desktop/src/main/sidecar.ts
@@ -1,7 +1,7 @@
 /**
  * Sidecar lifecycle manager run inside the Electron main process.
  *
- * In dev: spawns `bun run apps/desktop/src/sidecar/server.ts`.
+ * In dev: spawns `bun run legacy/desktop/src/sidecar/server.ts`.
  * In prod: spawns the bundled CLI binary in foreground daemon mode.
  *
  * Either way, the child receives EXECUTOR_PORT/EXECUTOR_HOST/EXECUTOR_AUTH_TOKEN
@@ -246,13 +246,13 @@ const resolveSidecarCommand = (input: {
   }
   // Dev: run the TS source directly via bun on PATH.
   const repoRoot = resolve(import.meta.dirname, "..", "..", "..", "..");
-  const sidecarSource = resolve(repoRoot, "apps/desktop/src/sidecar/server.ts");
+  const sidecarSource = resolve(repoRoot, "legacy/desktop/src/sidecar/server.ts");
   return { command: "bun", args: ["run", sidecarSource], cwd: repoRoot, cliManagedManifest: false };
 };
 
 const resolveClientDir = (): string => {
   const repoRoot = resolve(import.meta.dirname, "..", "..", "..", "..");
-  return resolve(repoRoot, "apps/local/dist");
+  return resolve(repoRoot, "legacy/local/dist");
 };
 
 const delay = (ms: number): Promise<void> =>
diff --git a/apps/desktop/src/main/supervised-connection.test.ts b/legacy/desktop/src/main/supervised-connection.test.ts
similarity index 100%
rename from apps/desktop/src/main/supervised-connection.test.ts
rename to legacy/desktop/src/main/supervised-connection.test.ts
diff --git a/apps/desktop/src/main/supervised-connection.ts b/legacy/desktop/src/main/supervised-connection.ts
similarity index 100%
rename from apps/desktop/src/main/supervised-connection.ts
rename to legacy/desktop/src/main/supervised-connection.ts
diff --git a/apps/desktop/src/main/supervised-daemon.test.ts b/legacy/desktop/src/main/supervised-daemon.test.ts
similarity index 100%
rename from apps/desktop/src/main/supervised-daemon.test.ts
rename to legacy/desktop/src/main/supervised-daemon.test.ts
diff --git a/apps/desktop/src/main/supervised-daemon.ts b/legacy/desktop/src/main/supervised-daemon.ts
similarity index 100%
rename from apps/desktop/src/main/supervised-daemon.ts
rename to legacy/desktop/src/main/supervised-daemon.ts
diff --git a/apps/desktop/src/preload/index.ts b/legacy/desktop/src/preload/index.ts
similarity index 100%
rename from apps/desktop/src/preload/index.ts
rename to legacy/desktop/src/preload/index.ts
diff --git a/apps/desktop/src/renderer/index.html b/legacy/desktop/src/renderer/index.html
similarity index 100%
rename from apps/desktop/src/renderer/index.html
rename to legacy/desktop/src/renderer/index.html
diff --git a/apps/desktop/src/shared/server-settings.ts b/legacy/desktop/src/shared/server-settings.ts
similarity index 100%
rename from apps/desktop/src/shared/server-settings.ts
rename to legacy/desktop/src/shared/server-settings.ts
diff --git a/apps/desktop/src/sidecar/native-bindings.ts b/legacy/desktop/src/sidecar/native-bindings.ts
similarity index 95%
rename from apps/desktop/src/sidecar/native-bindings.ts
rename to legacy/desktop/src/sidecar/native-bindings.ts
index d54a6400f..effd7e0ad 100644
--- a/apps/desktop/src/sidecar/native-bindings.ts
+++ b/legacy/desktop/src/sidecar/native-bindings.ts
@@ -6,7 +6,7 @@
 // the binary fails. If this dev sidecar is compiled directly, copy each
 // platform's `.node` next to the executable (`libsql.node`, `keyring.node`);
 // here we publish their
-// on-disk paths via env vars the loaders read. Mirrors apps/cli/src/native-bindings.ts.
+// on-disk paths via env vars the loaders read. Mirrors legacy/cli/src/native-bindings.ts.
 //
 // This MUST be the FIRST import in server.ts. ES modules evaluate every import
 // before the importer's own body, and libSQL resolves its native addon EAGERLY
diff --git a/apps/desktop/src/sidecar/server.ts b/legacy/desktop/src/sidecar/server.ts
similarity index 100%
rename from apps/desktop/src/sidecar/server.ts
rename to legacy/desktop/src/sidecar/server.ts
diff --git a/apps/desktop/tsconfig.json b/legacy/desktop/tsconfig.json
similarity index 100%
rename from apps/desktop/tsconfig.json
rename to legacy/desktop/tsconfig.json
diff --git a/apps/local/vitest.config.ts b/legacy/desktop/vitest.config.ts
similarity index 100%
rename from apps/local/vitest.config.ts
rename to legacy/desktop/vitest.config.ts
diff --git a/apps/host-cloudflare/.gitignore b/legacy/host-cloudflare/.gitignore
similarity index 100%
rename from apps/host-cloudflare/.gitignore
rename to legacy/host-cloudflare/.gitignore
diff --git a/apps/host-cloudflare/CHANGELOG.md b/legacy/host-cloudflare/CHANGELOG.md
similarity index 100%
rename from apps/host-cloudflare/CHANGELOG.md
rename to legacy/host-cloudflare/CHANGELOG.md
diff --git a/apps/host-cloudflare/README.md b/legacy/host-cloudflare/README.md
similarity index 97%
rename from apps/host-cloudflare/README.md
rename to legacy/host-cloudflare/README.md
index 1770dbbe8..080bff266 100644
--- a/apps/host-cloudflare/README.md
+++ b/legacy/host-cloudflare/README.md
@@ -33,7 +33,7 @@ without). The SPA's auth context reads `/api/account/me`.
 
 ```bash
 bunx wrangler login
-bun run deploy:setup    # apps/host-cloudflare — provisions D1 + secret + deploys
+bun run deploy:setup    # legacy/host-cloudflare provisions D1 + secret + deploys
 ```
 
 `deploy:setup` (scripts/deploy.sh) is idempotent: it creates/reuses the
diff --git a/apps/host-cloudflare/executor.config.ts b/legacy/host-cloudflare/executor.config.ts
similarity index 100%
rename from apps/host-cloudflare/executor.config.ts
rename to legacy/host-cloudflare/executor.config.ts
diff --git a/apps/host-cloudflare/package.json b/legacy/host-cloudflare/package.json
similarity index 98%
rename from apps/host-cloudflare/package.json
rename to legacy/host-cloudflare/package.json
index 159266b85..76cd07778 100644
--- a/apps/host-cloudflare/package.json
+++ b/legacy/host-cloudflare/package.json
@@ -8,6 +8,7 @@
     "dev": "wrangler dev",
     "dev:web": "vite dev",
     "typecheck": "tsgo --noEmit",
+    "typecheck:slow": "tsc --noEmit",
     "cf-typegen": "wrangler types",
     "deploy:setup": "bash scripts/deploy.sh",
     "vendor-wasm": "bun run scripts/vendor-quickjs-wasm.ts",
diff --git a/apps/host-cloudflare/scripts/deploy.sh b/legacy/host-cloudflare/scripts/deploy.sh
similarity index 98%
rename from apps/host-cloudflare/scripts/deploy.sh
rename to legacy/host-cloudflare/scripts/deploy.sh
index 4d8a2857e..bcdfcddda 100755
--- a/apps/host-cloudflare/scripts/deploy.sh
+++ b/legacy/host-cloudflare/scripts/deploy.sh
@@ -10,7 +10,7 @@
 #   5. prints the single manual step: the Cloudflare Access application
 #
 # Idempotent — safe to re-run. Run from anywhere:
-#   bash apps/host-cloudflare/scripts/deploy.sh
+#   bash legacy/host-cloudflare/scripts/deploy.sh
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
diff --git a/apps/host-cloudflare/scripts/gen-routes.ts b/legacy/host-cloudflare/scripts/gen-routes.ts
similarity index 91%
rename from apps/host-cloudflare/scripts/gen-routes.ts
rename to legacy/host-cloudflare/scripts/gen-routes.ts
index 7ebf787ea..dcca4a30f 100644
--- a/apps/host-cloudflare/scripts/gen-routes.ts
+++ b/legacy/host-cloudflare/scripts/gen-routes.ts
@@ -13,4 +13,4 @@ await generateRouteTree({
   generatedRouteTree: fileURLToPath(new URL("../web/routeTree.gen.ts", import.meta.url)),
   virtualRouteConfig: routes,
 });
-console.log("generated apps/host-cloudflare route tree");
+console.log("generated legacy/host-cloudflare route tree");
diff --git a/apps/host-cloudflare/scripts/preview.ts b/legacy/host-cloudflare/scripts/preview.ts
similarity index 100%
rename from apps/host-cloudflare/scripts/preview.ts
rename to legacy/host-cloudflare/scripts/preview.ts
diff --git a/apps/host-cloudflare/scripts/vendor-quickjs-wasm.ts b/legacy/host-cloudflare/scripts/vendor-quickjs-wasm.ts
similarity index 100%
rename from apps/host-cloudflare/scripts/vendor-quickjs-wasm.ts
rename to legacy/host-cloudflare/scripts/vendor-quickjs-wasm.ts
diff --git a/apps/host-cloudflare/src/account/account-provider.ts b/legacy/host-cloudflare/src/account/account-provider.ts
similarity index 100%
rename from apps/host-cloudflare/src/account/account-provider.ts
rename to legacy/host-cloudflare/src/account/account-provider.ts
diff --git a/apps/host-cloudflare/src/app.ts b/legacy/host-cloudflare/src/app.ts
similarity index 100%
rename from apps/host-cloudflare/src/app.ts
rename to legacy/host-cloudflare/src/app.ts
diff --git a/apps/host-cloudflare/src/auth/cloudflare-access.test.ts b/legacy/host-cloudflare/src/auth/cloudflare-access.test.ts
similarity index 100%
rename from apps/host-cloudflare/src/auth/cloudflare-access.test.ts
rename to legacy/host-cloudflare/src/auth/cloudflare-access.test.ts
diff --git a/apps/host-cloudflare/src/auth/cloudflare-access.ts b/legacy/host-cloudflare/src/auth/cloudflare-access.ts
similarity index 100%
rename from apps/host-cloudflare/src/auth/cloudflare-access.ts
rename to legacy/host-cloudflare/src/auth/cloudflare-access.ts
diff --git a/apps/host-cloudflare/src/config.ts b/legacy/host-cloudflare/src/config.ts
similarity index 100%
rename from apps/host-cloudflare/src/config.ts
rename to legacy/host-cloudflare/src/config.ts
diff --git a/apps/host-cloudflare/src/db/d1.ts b/legacy/host-cloudflare/src/db/d1.ts
similarity index 100%
rename from apps/host-cloudflare/src/db/d1.ts
rename to legacy/host-cloudflare/src/db/d1.ts
diff --git a/apps/host-cloudflare/src/db/data-migrations.test.ts b/legacy/host-cloudflare/src/db/data-migrations.test.ts
similarity index 100%
rename from apps/host-cloudflare/src/db/data-migrations.test.ts
rename to legacy/host-cloudflare/src/db/data-migrations.test.ts
diff --git a/apps/host-cloudflare/src/db/data-migrations.ts b/legacy/host-cloudflare/src/db/data-migrations.ts
similarity index 100%
rename from apps/host-cloudflare/src/db/data-migrations.ts
rename to legacy/host-cloudflare/src/db/data-migrations.ts
diff --git a/apps/host-cloudflare/src/execution.ts b/legacy/host-cloudflare/src/execution.ts
similarity index 100%
rename from apps/host-cloudflare/src/execution.ts
rename to legacy/host-cloudflare/src/execution.ts
diff --git a/apps/host-cloudflare/src/mcp/auth.ts b/legacy/host-cloudflare/src/mcp/auth.ts
similarity index 100%
rename from apps/host-cloudflare/src/mcp/auth.ts
rename to legacy/host-cloudflare/src/mcp/auth.ts
diff --git a/apps/host-cloudflare/src/mcp/index.ts b/legacy/host-cloudflare/src/mcp/index.ts
similarity index 100%
rename from apps/host-cloudflare/src/mcp/index.ts
rename to legacy/host-cloudflare/src/mcp/index.ts
diff --git a/apps/host-cloudflare/src/mcp/session-durable-object.ts b/legacy/host-cloudflare/src/mcp/session-durable-object.ts
similarity index 100%
rename from apps/host-cloudflare/src/mcp/session-durable-object.ts
rename to legacy/host-cloudflare/src/mcp/session-durable-object.ts
diff --git a/apps/host-cloudflare/src/mcp/session-store.ts b/legacy/host-cloudflare/src/mcp/session-store.ts
similarity index 100%
rename from apps/host-cloudflare/src/mcp/session-store.ts
rename to legacy/host-cloudflare/src/mcp/session-store.ts
diff --git a/apps/host-cloudflare/src/observability.ts b/legacy/host-cloudflare/src/observability.ts
similarity index 100%
rename from apps/host-cloudflare/src/observability.ts
rename to legacy/host-cloudflare/src/observability.ts
diff --git a/apps/host-cloudflare/src/plugins.ts b/legacy/host-cloudflare/src/plugins.ts
similarity index 100%
rename from apps/host-cloudflare/src/plugins.ts
rename to legacy/host-cloudflare/src/plugins.ts
diff --git a/apps/host-cloudflare/src/quickjs-engine.wasm b/legacy/host-cloudflare/src/quickjs-engine.wasm
similarity index 100%
rename from apps/host-cloudflare/src/quickjs-engine.wasm
rename to legacy/host-cloudflare/src/quickjs-engine.wasm
diff --git a/apps/host-cloudflare/src/quickjs.ts b/legacy/host-cloudflare/src/quickjs.ts
similarity index 100%
rename from apps/host-cloudflare/src/quickjs.ts
rename to legacy/host-cloudflare/src/quickjs.ts
diff --git a/apps/host-cloudflare/src/wasm.d.ts b/legacy/host-cloudflare/src/wasm.d.ts
similarity index 100%
rename from apps/host-cloudflare/src/wasm.d.ts
rename to legacy/host-cloudflare/src/wasm.d.ts
diff --git a/apps/host-cloudflare/src/worker.e2e.node.test.ts b/legacy/host-cloudflare/src/worker.e2e.node.test.ts
similarity index 100%
rename from apps/host-cloudflare/src/worker.e2e.node.test.ts
rename to legacy/host-cloudflare/src/worker.e2e.node.test.ts
diff --git a/apps/host-cloudflare/src/worker.ts b/legacy/host-cloudflare/src/worker.ts
similarity index 100%
rename from apps/host-cloudflare/src/worker.ts
rename to legacy/host-cloudflare/src/worker.ts
diff --git a/apps/host-cloudflare/tsconfig.json b/legacy/host-cloudflare/tsconfig.json
similarity index 100%
rename from apps/host-cloudflare/tsconfig.json
rename to legacy/host-cloudflare/tsconfig.json
diff --git a/apps/host-cloudflare/tsr.routes.ts b/legacy/host-cloudflare/tsr.routes.ts
similarity index 100%
rename from apps/host-cloudflare/tsr.routes.ts
rename to legacy/host-cloudflare/tsr.routes.ts
diff --git a/apps/host-cloudflare/vite.config.ts b/legacy/host-cloudflare/vite.config.ts
similarity index 100%
rename from apps/host-cloudflare/vite.config.ts
rename to legacy/host-cloudflare/vite.config.ts
diff --git a/apps/host-cloudflare/vitest.config.ts b/legacy/host-cloudflare/vitest.config.ts
similarity index 100%
rename from apps/host-cloudflare/vitest.config.ts
rename to legacy/host-cloudflare/vitest.config.ts
diff --git a/apps/host-cloudflare/web/entry-client.tsx b/legacy/host-cloudflare/web/entry-client.tsx
similarity index 100%
rename from apps/host-cloudflare/web/entry-client.tsx
rename to legacy/host-cloudflare/web/entry-client.tsx
diff --git a/apps/host-cloudflare/web/index.html b/legacy/host-cloudflare/web/index.html
similarity index 100%
rename from apps/host-cloudflare/web/index.html
rename to legacy/host-cloudflare/web/index.html
diff --git a/apps/host-cloudflare/web/routeTree.gen.ts b/legacy/host-cloudflare/web/routeTree.gen.ts
similarity index 100%
rename from apps/host-cloudflare/web/routeTree.gen.ts
rename to legacy/host-cloudflare/web/routeTree.gen.ts
diff --git a/apps/host-cloudflare/web/router.tsx b/legacy/host-cloudflare/web/router.tsx
similarity index 100%
rename from apps/host-cloudflare/web/router.tsx
rename to legacy/host-cloudflare/web/router.tsx
diff --git a/apps/host-cloudflare/web/routes/__root.tsx b/legacy/host-cloudflare/web/routes/__root.tsx
similarity index 100%
rename from apps/host-cloudflare/web/routes/__root.tsx
rename to legacy/host-cloudflare/web/routes/__root.tsx
diff --git a/apps/host-cloudflare/wrangler.jsonc b/legacy/host-cloudflare/wrangler.jsonc
similarity index 100%
rename from apps/host-cloudflare/wrangler.jsonc
rename to legacy/host-cloudflare/wrangler.jsonc
diff --git a/apps/host-selfhost/.env.example b/legacy/host-selfhost/.env.example
similarity index 100%
rename from apps/host-selfhost/.env.example
rename to legacy/host-selfhost/.env.example
diff --git a/apps/host-selfhost/CHANGELOG.md b/legacy/host-selfhost/CHANGELOG.md
similarity index 100%
rename from apps/host-selfhost/CHANGELOG.md
rename to legacy/host-selfhost/CHANGELOG.md
diff --git a/apps/host-selfhost/Dockerfile b/legacy/host-selfhost/Dockerfile
similarity index 83%
rename from apps/host-selfhost/Dockerfile
rename to legacy/host-selfhost/Dockerfile
index 689f161ab..97dbbbbe8 100644
--- a/apps/host-selfhost/Dockerfile
+++ b/legacy/host-selfhost/Dockerfile
@@ -1,6 +1,6 @@
 # Self-hosted Executor, single container, no external services.
 # Build context is the repo root because Bun workspaces need every member:
-#   docker build -f apps/host-selfhost/Dockerfile -t executor-selfhost .
+#   docker build -f legacy/host-selfhost/Dockerfile -t executor-selfhost .
 #
 # Runtime needs this container plus a volume for the data dir:
 #   docker run -p 4788:4788 -e BETTER_AUTH_SECRET=$(openssl rand -hex 32) \
@@ -13,13 +13,13 @@ FROM oven/bun:1 AS prod-deps
 WORKDIR /app
 COPY . .
 RUN bun install --frozen-lockfile --production --ignore-scripts --filter @executor-js/host-selfhost \
-  && bun run apps/host-selfhost/scripts/package-runtime.ts
+  && bun run legacy/host-selfhost/scripts/package-runtime.ts
 
 FROM oven/bun:1 AS build
 WORKDIR /app
 COPY . .
 RUN bun install --frozen-lockfile
-RUN cd apps/host-selfhost && bun run build
+RUN cd legacy/host-selfhost && bun run build
 
 FROM gcr.io/distroless/cc-debian12 AS runtime
 WORKDIR /app
@@ -32,8 +32,8 @@ ENV NODE_ENV=production \
     EXECUTOR_DATA_DIR=/data
 COPY --from=prod-deps /usr/local/bin/bun /usr/local/bin/bun
 COPY --from=prod-deps /app/.selfhost-runtime /app
-COPY --from=build /app/apps/host-selfhost/dist /app/apps/host-selfhost/dist
-WORKDIR /app/apps/host-selfhost
+COPY --from=build /app/legacy/host-selfhost/dist /app/legacy/host-selfhost/dist
+WORKDIR /app/legacy/host-selfhost
 VOLUME ["/data"]
 EXPOSE 4788
 HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=5 \
diff --git a/apps/host-selfhost/README.md b/legacy/host-selfhost/README.md
similarity index 100%
rename from apps/host-selfhost/README.md
rename to legacy/host-selfhost/README.md
diff --git a/apps/host-selfhost/docker-compose.yml b/legacy/host-selfhost/docker-compose.yml
similarity index 96%
rename from apps/host-selfhost/docker-compose.yml
rename to legacy/host-selfhost/docker-compose.yml
index ed6cc80de..f33caddfa 100644
--- a/apps/host-selfhost/docker-compose.yml
+++ b/legacy/host-selfhost/docker-compose.yml
@@ -17,7 +17,7 @@ services:
     build:
       # Build context is the repo root: the Bun workspace install needs every member.
       context: ../..
-      dockerfile: apps/host-selfhost/Dockerfile
+      dockerfile: legacy/host-selfhost/Dockerfile
     image: executor-selfhost
     restart: unless-stopped
     ports:
diff --git a/apps/host-selfhost/executor.config.ts b/legacy/host-selfhost/executor.config.ts
similarity index 100%
rename from apps/host-selfhost/executor.config.ts
rename to legacy/host-selfhost/executor.config.ts
diff --git a/apps/host-selfhost/package.json b/legacy/host-selfhost/package.json
similarity index 98%
rename from apps/host-selfhost/package.json
rename to legacy/host-selfhost/package.json
index 7fe129ad0..021cbca9b 100644
--- a/apps/host-selfhost/package.json
+++ b/legacy/host-selfhost/package.json
@@ -13,6 +13,7 @@
     "build": "turbo run build --filter @executor-js/vite-plugin && vite build",
     "start": "bun run src/serve.ts",
     "typecheck": "tsgo --noEmit",
+    "typecheck:slow": "tsc --noEmit",
     "test": "vitest run",
     "test:watch": "vitest",
     "routes:gen": "bun scripts/gen-routes.ts"
diff --git a/apps/host-selfhost/scripts/gen-routes.ts b/legacy/host-selfhost/scripts/gen-routes.ts
similarity index 91%
rename from apps/host-selfhost/scripts/gen-routes.ts
rename to legacy/host-selfhost/scripts/gen-routes.ts
index 0c9f50acb..57cc304f2 100644
--- a/apps/host-selfhost/scripts/gen-routes.ts
+++ b/legacy/host-selfhost/scripts/gen-routes.ts
@@ -13,4 +13,4 @@ await generateRouteTree({
   generatedRouteTree: fileURLToPath(new URL("../web/routeTree.gen.ts", import.meta.url)),
   virtualRouteConfig: routes,
 });
-console.log("generated apps/host-selfhost route tree");
+console.log("generated legacy/host-selfhost route tree");
diff --git a/apps/host-selfhost/scripts/package-runtime.ts b/legacy/host-selfhost/scripts/package-runtime.ts
similarity index 83%
rename from apps/host-selfhost/scripts/package-runtime.ts
rename to legacy/host-selfhost/scripts/package-runtime.ts
index d5c112341..3472f29bb 100644
--- a/apps/host-selfhost/scripts/package-runtime.ts
+++ b/legacy/host-selfhost/scripts/package-runtime.ts
@@ -4,8 +4,8 @@ import { createRequire } from "node:module";
 
 const root = process.cwd();
 const out = join(root, ".selfhost-runtime");
-const serverOut = join(out, "apps/host-selfhost/dist-server");
-const requireFromSelfHost = createRequire(join(root, "apps/host-selfhost/package.json"));
+const serverOut = join(out, "legacy/host-selfhost/dist-server");
+const requireFromSelfHost = createRequire(join(root, "legacy/host-selfhost/package.json"));
 
 // libSQL ships its native addon as per-platform optional dependencies
 // (`@libsql/<os>-<arch>-<abi>`), and Bun installs only the one matching the
@@ -29,7 +29,7 @@ const libsqlNativePackage = (): string => {
   if (!target) {
     throw new Error(
       `package-runtime: no @libsql native package mapped for ${key}. ` +
-        "Add it to the platform map in apps/host-selfhost/scripts/package-runtime.ts.",
+        "Add it to the platform map in legacy/host-selfhost/scripts/package-runtime.ts.",
     );
   }
   return `@libsql/${target}`;
@@ -66,13 +66,13 @@ const copyPackage = (name: string): void => {
 rmSync(out, { recursive: true, force: true });
 mkdirSync(serverOut, { recursive: true });
 
-await Bun.$`bun build apps/host-selfhost/src/serve.ts --target=bun --format=esm --outdir=${serverOut} ${quickJsExternals.map((name) => `--external=${name}`)}`;
+await Bun.$`bun build legacy/host-selfhost/src/serve.ts --target=bun --format=esm --outdir=${serverOut} ${quickJsExternals.map((name) => `--external=${name}`)}`;
 
 for (const name of externalPackages) copyPackage(name);
 
 if (!existsSync(join(serverOut, "serve.js"))) {
   throw new Error(
-    "Expected bundled self-host server at .selfhost-runtime/apps/host-selfhost/dist-server/serve.js",
+    "Expected bundled self-host server at .selfhost-runtime/legacy/host-selfhost/dist-server/serve.js",
   );
 }
 
diff --git a/apps/host-selfhost/src/account/account-api.ts b/legacy/host-selfhost/src/account/account-api.ts
similarity index 100%
rename from apps/host-selfhost/src/account/account-api.ts
rename to legacy/host-selfhost/src/account/account-api.ts
diff --git a/apps/host-selfhost/src/account/better-auth-account-provider.ts b/legacy/host-selfhost/src/account/better-auth-account-provider.ts
similarity index 100%
rename from apps/host-selfhost/src/account/better-auth-account-provider.ts
rename to legacy/host-selfhost/src/account/better-auth-account-provider.ts
diff --git a/apps/host-selfhost/src/account/index.ts b/legacy/host-selfhost/src/account/index.ts
similarity index 100%
rename from apps/host-selfhost/src/account/index.ts
rename to legacy/host-selfhost/src/account/index.ts
diff --git a/apps/host-selfhost/src/admin/api.ts b/legacy/host-selfhost/src/admin/api.ts
similarity index 100%
rename from apps/host-selfhost/src/admin/api.ts
rename to legacy/host-selfhost/src/admin/api.ts
diff --git a/apps/host-selfhost/src/admin/handlers.ts b/legacy/host-selfhost/src/admin/handlers.ts
similarity index 100%
rename from apps/host-selfhost/src/admin/handlers.ts
rename to legacy/host-selfhost/src/admin/handlers.ts
diff --git a/apps/host-selfhost/src/admin/invites.node.test.ts b/legacy/host-selfhost/src/admin/invites.node.test.ts
similarity index 100%
rename from apps/host-selfhost/src/admin/invites.node.test.ts
rename to legacy/host-selfhost/src/admin/invites.node.test.ts
diff --git a/apps/host-selfhost/src/api/api.ts b/legacy/host-selfhost/src/api/api.ts
similarity index 100%
rename from apps/host-selfhost/src/api/api.ts
rename to legacy/host-selfhost/src/api/api.ts
diff --git a/apps/host-selfhost/src/app.ts b/legacy/host-selfhost/src/app.ts
similarity index 100%
rename from apps/host-selfhost/src/app.ts
rename to legacy/host-selfhost/src/app.ts
diff --git a/apps/host-selfhost/src/auth/better-auth.test.ts b/legacy/host-selfhost/src/auth/better-auth.test.ts
similarity index 100%
rename from apps/host-selfhost/src/auth/better-auth.test.ts
rename to legacy/host-selfhost/src/auth/better-auth.test.ts
diff --git a/apps/host-selfhost/src/auth/better-auth.ts b/legacy/host-selfhost/src/auth/better-auth.ts
similarity index 100%
rename from apps/host-selfhost/src/auth/better-auth.ts
rename to legacy/host-selfhost/src/auth/better-auth.ts
diff --git a/apps/host-selfhost/src/auth/force-mcp-consent.test.ts b/legacy/host-selfhost/src/auth/force-mcp-consent.test.ts
similarity index 100%
rename from apps/host-selfhost/src/auth/force-mcp-consent.test.ts
rename to legacy/host-selfhost/src/auth/force-mcp-consent.test.ts
diff --git a/apps/host-selfhost/src/auth/force-mcp-consent.ts b/legacy/host-selfhost/src/auth/force-mcp-consent.ts
similarity index 100%
rename from apps/host-selfhost/src/auth/force-mcp-consent.ts
rename to legacy/host-selfhost/src/auth/force-mcp-consent.ts
diff --git a/apps/host-selfhost/src/auth/identity.ts b/legacy/host-selfhost/src/auth/identity.ts
similarity index 100%
rename from apps/host-selfhost/src/auth/identity.ts
rename to legacy/host-selfhost/src/auth/identity.ts
diff --git a/apps/host-selfhost/src/auth/index.ts b/legacy/host-selfhost/src/auth/index.ts
similarity index 100%
rename from apps/host-selfhost/src/auth/index.ts
rename to legacy/host-selfhost/src/auth/index.ts
diff --git a/apps/host-selfhost/src/auth/invalid-origin-help.test.ts b/legacy/host-selfhost/src/auth/invalid-origin-help.test.ts
similarity index 100%
rename from apps/host-selfhost/src/auth/invalid-origin-help.test.ts
rename to legacy/host-selfhost/src/auth/invalid-origin-help.test.ts
diff --git a/apps/host-selfhost/src/auth/invalid-origin-help.ts b/legacy/host-selfhost/src/auth/invalid-origin-help.ts
similarity index 100%
rename from apps/host-selfhost/src/auth/invalid-origin-help.ts
rename to legacy/host-selfhost/src/auth/invalid-origin-help.ts
diff --git a/apps/host-selfhost/src/auth/invites.ts b/legacy/host-selfhost/src/auth/invites.ts
similarity index 100%
rename from apps/host-selfhost/src/auth/invites.ts
rename to legacy/host-selfhost/src/auth/invites.ts
diff --git a/apps/host-selfhost/src/auth/oauth-callback-login.test.ts b/legacy/host-selfhost/src/auth/oauth-callback-login.test.ts
similarity index 100%
rename from apps/host-selfhost/src/auth/oauth-callback-login.test.ts
rename to legacy/host-selfhost/src/auth/oauth-callback-login.test.ts
diff --git a/apps/host-selfhost/src/auth/oauth-callback-login.ts b/legacy/host-selfhost/src/auth/oauth-callback-login.ts
similarity index 100%
rename from apps/host-selfhost/src/auth/oauth-callback-login.ts
rename to legacy/host-selfhost/src/auth/oauth-callback-login.ts
diff --git a/apps/host-selfhost/src/auth/origin-resolution.test.ts b/legacy/host-selfhost/src/auth/origin-resolution.test.ts
similarity index 100%
rename from apps/host-selfhost/src/auth/origin-resolution.test.ts
rename to legacy/host-selfhost/src/auth/origin-resolution.test.ts
diff --git a/apps/host-selfhost/src/auth/return-to.test.ts b/legacy/host-selfhost/src/auth/return-to.test.ts
similarity index 100%
rename from apps/host-selfhost/src/auth/return-to.test.ts
rename to legacy/host-selfhost/src/auth/return-to.test.ts
diff --git a/apps/host-selfhost/src/auth/return-to.ts b/legacy/host-selfhost/src/auth/return-to.ts
similarity index 100%
rename from apps/host-selfhost/src/auth/return-to.ts
rename to legacy/host-selfhost/src/auth/return-to.ts
diff --git a/apps/host-selfhost/src/auth/seed.ts b/legacy/host-selfhost/src/auth/seed.ts
similarity index 100%
rename from apps/host-selfhost/src/auth/seed.ts
rename to legacy/host-selfhost/src/auth/seed.ts
diff --git a/apps/host-selfhost/src/boot.test.ts b/legacy/host-selfhost/src/boot.test.ts
similarity index 100%
rename from apps/host-selfhost/src/boot.test.ts
rename to legacy/host-selfhost/src/boot.test.ts
diff --git a/apps/host-selfhost/src/config.ts b/legacy/host-selfhost/src/config.ts
similarity index 100%
rename from apps/host-selfhost/src/config.ts
rename to legacy/host-selfhost/src/config.ts
diff --git a/apps/host-selfhost/src/db/auth-config-migration.ts b/legacy/host-selfhost/src/db/auth-config-migration.ts
similarity index 100%
rename from apps/host-selfhost/src/db/auth-config-migration.ts
rename to legacy/host-selfhost/src/db/auth-config-migration.ts
diff --git a/apps/host-selfhost/src/db/data-migrations.ts b/legacy/host-selfhost/src/db/data-migrations.ts
similarity index 100%
rename from apps/host-selfhost/src/db/data-migrations.ts
rename to legacy/host-selfhost/src/db/data-migrations.ts
diff --git a/apps/host-selfhost/src/db/self-host-db.ts b/legacy/host-selfhost/src/db/self-host-db.ts
similarity index 96%
rename from apps/host-selfhost/src/db/self-host-db.ts
rename to legacy/host-selfhost/src/db/self-host-db.ts
index fde91f89b..4788d10b1 100644
--- a/apps/host-selfhost/src/db/self-host-db.ts
+++ b/legacy/host-selfhost/src/db/self-host-db.ts
@@ -22,9 +22,9 @@ import type { FumaDb, FumaTables } from "@executor-js/sdk";
 import { SELF_HOST_NAMESPACE, SELF_HOST_SCHEMA_VERSION } from "../config";
 
 // ---------------------------------------------------------------------------
-// SQLite executor DB factory, inline (like apps/local's sqlite-fumadb.ts and
-// apps/cloud's fuma.ts — each app owns its DB wiring; there is no shared
-// storage package). Differences from apps/local: busy_timeout + synchronous
+// SQLite executor DB factory, inline (like legacy/local's sqlite-fumadb.ts and
+// legacy/cloud's fuma.ts, each app owns its DB wiring; there is no shared
+// storage package). Differences from legacy/local: busy_timeout + synchronous
 // pragmas for the multi-user HTTP server, and the idempotent
 // `ensureDrizzleRuntimeSchemaFromTables` schema-ensure (the drizzle adapter
 // has no versioned migrator). Built ONCE for the process; the per-request
diff --git a/apps/host-selfhost/src/execution.ts b/legacy/host-selfhost/src/execution.ts
similarity index 100%
rename from apps/host-selfhost/src/execution.ts
rename to legacy/host-selfhost/src/execution.ts
diff --git a/apps/host-selfhost/src/first-run.node.test.ts b/legacy/host-selfhost/src/first-run.node.test.ts
similarity index 100%
rename from apps/host-selfhost/src/first-run.node.test.ts
rename to legacy/host-selfhost/src/first-run.node.test.ts
diff --git a/apps/host-selfhost/src/index.ts b/legacy/host-selfhost/src/index.ts
similarity index 100%
rename from apps/host-selfhost/src/index.ts
rename to legacy/host-selfhost/src/index.ts
diff --git a/apps/host-selfhost/src/mcp/auth.ts b/legacy/host-selfhost/src/mcp/auth.ts
similarity index 100%
rename from apps/host-selfhost/src/mcp/auth.ts
rename to legacy/host-selfhost/src/mcp/auth.ts
diff --git a/apps/host-selfhost/src/mcp/index.ts b/legacy/host-selfhost/src/mcp/index.ts
similarity index 100%
rename from apps/host-selfhost/src/mcp/index.ts
rename to legacy/host-selfhost/src/mcp/index.ts
diff --git a/apps/host-selfhost/src/mcp/mcp-oauth.test.ts b/legacy/host-selfhost/src/mcp/mcp-oauth.test.ts
similarity index 100%
rename from apps/host-selfhost/src/mcp/mcp-oauth.test.ts
rename to legacy/host-selfhost/src/mcp/mcp-oauth.test.ts
diff --git a/apps/host-selfhost/src/mcp/mcp.test.ts b/legacy/host-selfhost/src/mcp/mcp.test.ts
similarity index 100%
rename from apps/host-selfhost/src/mcp/mcp.test.ts
rename to legacy/host-selfhost/src/mcp/mcp.test.ts
diff --git a/apps/host-selfhost/src/mcp/org-path.test.ts b/legacy/host-selfhost/src/mcp/org-path.test.ts
similarity index 100%
rename from apps/host-selfhost/src/mcp/org-path.test.ts
rename to legacy/host-selfhost/src/mcp/org-path.test.ts
diff --git a/apps/host-selfhost/src/mcp/org-path.ts b/legacy/host-selfhost/src/mcp/org-path.ts
similarity index 100%
rename from apps/host-selfhost/src/mcp/org-path.ts
rename to legacy/host-selfhost/src/mcp/org-path.ts
diff --git a/apps/host-selfhost/src/mcp/session-store.ts b/legacy/host-selfhost/src/mcp/session-store.ts
similarity index 100%
rename from apps/host-selfhost/src/mcp/session-store.ts
rename to legacy/host-selfhost/src/mcp/session-store.ts
diff --git a/apps/host-selfhost/src/multi-user.test.ts b/legacy/host-selfhost/src/multi-user.test.ts
similarity index 100%
rename from apps/host-selfhost/src/multi-user.test.ts
rename to legacy/host-selfhost/src/multi-user.test.ts
diff --git a/apps/host-selfhost/src/observability.ts b/legacy/host-selfhost/src/observability.ts
similarity index 100%
rename from apps/host-selfhost/src/observability.ts
rename to legacy/host-selfhost/src/observability.ts
diff --git a/apps/host-selfhost/src/plugins.ts b/legacy/host-selfhost/src/plugins.ts
similarity index 90%
rename from apps/host-selfhost/src/plugins.ts
rename to legacy/host-selfhost/src/plugins.ts
index bbd4c65ef..ea83f6550 100644
--- a/apps/host-selfhost/src/plugins.ts
+++ b/legacy/host-selfhost/src/plugins.ts
@@ -1,5 +1,5 @@
 // Single shared instantiation of the self-host plugin list, mirroring
-// `apps/cloud/src/api/cloud-plugins.ts`. The API composition
+// `legacy/cloud/src/api/cloud-plugins.ts`. The API composition
 // (`composePluginApi`/`composePluginHandlerLayer`) and the per-request
 // middleware (`providePluginExtensions`, `PluginExtensionServices<...>`) all
 // derive their typed views from this one tuple, so adding/removing a plugin is
diff --git a/apps/host-selfhost/src/scope-isolation.test.ts b/legacy/host-selfhost/src/scope-isolation.test.ts
similarity index 100%
rename from apps/host-selfhost/src/scope-isolation.test.ts
rename to legacy/host-selfhost/src/scope-isolation.test.ts
diff --git a/apps/host-selfhost/src/secrets-integration.test.ts b/legacy/host-selfhost/src/secrets-integration.test.ts
similarity index 100%
rename from apps/host-selfhost/src/secrets-integration.test.ts
rename to legacy/host-selfhost/src/secrets-integration.test.ts
diff --git a/apps/host-selfhost/src/serve.ts b/legacy/host-selfhost/src/serve.ts
similarity index 97%
rename from apps/host-selfhost/src/serve.ts
rename to legacy/host-selfhost/src/serve.ts
index a521ab5f1..44385c2b4 100644
--- a/apps/host-selfhost/src/serve.ts
+++ b/legacy/host-selfhost/src/serve.ts
@@ -10,7 +10,7 @@
  *   - /docs        Swagger
  *   - everything else: the built web SPA (static files + index.html fallback)
  *
- * Run directly:  bun run apps/host-selfhost/src/serve.ts  (after `bun run build`)
+ * Run directly:  bun run legacy/host-selfhost/src/serve.ts  (after `bun run build`)
  */
 
 import { fileURLToPath } from "node:url";
diff --git a/apps/host-selfhost/src/sources-mcp.test.ts b/legacy/host-selfhost/src/sources-mcp.test.ts
similarity index 100%
rename from apps/host-selfhost/src/sources-mcp.test.ts
rename to legacy/host-selfhost/src/sources-mcp.test.ts
diff --git a/apps/host-selfhost/src/sources.test.ts b/legacy/host-selfhost/src/sources.test.ts
similarity index 100%
rename from apps/host-selfhost/src/sources.test.ts
rename to legacy/host-selfhost/src/sources.test.ts
diff --git a/apps/host-selfhost/src/system/api.ts b/legacy/host-selfhost/src/system/api.ts
similarity index 100%
rename from apps/host-selfhost/src/system/api.ts
rename to legacy/host-selfhost/src/system/api.ts
diff --git a/apps/host-selfhost/src/system/handlers.ts b/legacy/host-selfhost/src/system/handlers.ts
similarity index 100%
rename from apps/host-selfhost/src/system/handlers.ts
rename to legacy/host-selfhost/src/system/handlers.ts
diff --git a/apps/host-selfhost/src/testing/mint-invite.ts b/legacy/host-selfhost/src/testing/mint-invite.ts
similarity index 100%
rename from apps/host-selfhost/src/testing/mint-invite.ts
rename to legacy/host-selfhost/src/testing/mint-invite.ts
diff --git a/apps/host-selfhost/src/testing/test-app.ts b/legacy/host-selfhost/src/testing/test-app.ts
similarity index 100%
rename from apps/host-selfhost/src/testing/test-app.ts
rename to legacy/host-selfhost/src/testing/test-app.ts
diff --git a/apps/host-selfhost/tsconfig.json b/legacy/host-selfhost/tsconfig.json
similarity index 100%
rename from apps/host-selfhost/tsconfig.json
rename to legacy/host-selfhost/tsconfig.json
diff --git a/apps/host-selfhost/tsr.routes.ts b/legacy/host-selfhost/tsr.routes.ts
similarity index 100%
rename from apps/host-selfhost/tsr.routes.ts
rename to legacy/host-selfhost/tsr.routes.ts
diff --git a/apps/host-selfhost/vite.config.ts b/legacy/host-selfhost/vite.config.ts
similarity index 100%
rename from apps/host-selfhost/vite.config.ts
rename to legacy/host-selfhost/vite.config.ts
diff --git a/apps/host-selfhost/vitest.config.ts b/legacy/host-selfhost/vitest.config.ts
similarity index 100%
rename from apps/host-selfhost/vitest.config.ts
rename to legacy/host-selfhost/vitest.config.ts
diff --git a/apps/host-selfhost/web/admin-atoms.tsx b/legacy/host-selfhost/web/admin-atoms.tsx
similarity index 100%
rename from apps/host-selfhost/web/admin-atoms.tsx
rename to legacy/host-selfhost/web/admin-atoms.tsx
diff --git a/apps/host-selfhost/web/admin-client.tsx b/legacy/host-selfhost/web/admin-client.tsx
similarity index 100%
rename from apps/host-selfhost/web/admin-client.tsx
rename to legacy/host-selfhost/web/admin-client.tsx
diff --git a/apps/host-selfhost/web/auth-client.ts b/legacy/host-selfhost/web/auth-client.ts
similarity index 100%
rename from apps/host-selfhost/web/auth-client.ts
rename to legacy/host-selfhost/web/auth-client.ts
diff --git a/apps/host-selfhost/web/chromeless/device-page.tsx b/legacy/host-selfhost/web/chromeless/device-page.tsx
similarity index 100%
rename from apps/host-selfhost/web/chromeless/device-page.tsx
rename to legacy/host-selfhost/web/chromeless/device-page.tsx
diff --git a/apps/host-selfhost/web/chromeless/mcp-consent-page.tsx b/legacy/host-selfhost/web/chromeless/mcp-consent-page.tsx
similarity index 100%
rename from apps/host-selfhost/web/chromeless/mcp-consent-page.tsx
rename to legacy/host-selfhost/web/chromeless/mcp-consent-page.tsx
diff --git a/apps/host-selfhost/web/entry-client.tsx b/legacy/host-selfhost/web/entry-client.tsx
similarity index 100%
rename from apps/host-selfhost/web/entry-client.tsx
rename to legacy/host-selfhost/web/entry-client.tsx
diff --git a/apps/host-selfhost/web/index.html b/legacy/host-selfhost/web/index.html
similarity index 100%
rename from apps/host-selfhost/web/index.html
rename to legacy/host-selfhost/web/index.html
diff --git a/apps/host-selfhost/web/login.tsx b/legacy/host-selfhost/web/login.tsx
similarity index 100%
rename from apps/host-selfhost/web/login.tsx
rename to legacy/host-selfhost/web/login.tsx
diff --git a/apps/host-selfhost/web/routeTree.gen.ts b/legacy/host-selfhost/web/routeTree.gen.ts
similarity index 100%
rename from apps/host-selfhost/web/routeTree.gen.ts
rename to legacy/host-selfhost/web/routeTree.gen.ts
diff --git a/apps/host-selfhost/web/router.tsx b/legacy/host-selfhost/web/router.tsx
similarity index 100%
rename from apps/host-selfhost/web/router.tsx
rename to legacy/host-selfhost/web/router.tsx
diff --git a/apps/host-selfhost/web/routes/__root.tsx b/legacy/host-selfhost/web/routes/__root.tsx
similarity index 100%
rename from apps/host-selfhost/web/routes/__root.tsx
rename to legacy/host-selfhost/web/routes/__root.tsx
diff --git a/apps/host-selfhost/web/routes/app/admin.tsx b/legacy/host-selfhost/web/routes/app/admin.tsx
similarity index 100%
rename from apps/host-selfhost/web/routes/app/admin.tsx
rename to legacy/host-selfhost/web/routes/app/admin.tsx
diff --git a/apps/host-selfhost/web/routes/app/api-keys.tsx b/legacy/host-selfhost/web/routes/app/api-keys.tsx
similarity index 100%
rename from apps/host-selfhost/web/routes/app/api-keys.tsx
rename to legacy/host-selfhost/web/routes/app/api-keys.tsx
diff --git a/apps/host-selfhost/web/routes/public/join.$code.tsx b/legacy/host-selfhost/web/routes/public/join.$code.tsx
similarity index 100%
rename from apps/host-selfhost/web/routes/public/join.$code.tsx
rename to legacy/host-selfhost/web/routes/public/join.$code.tsx
diff --git a/apps/host-selfhost/web/setup-status.ts b/legacy/host-selfhost/web/setup-status.ts
similarity index 100%
rename from apps/host-selfhost/web/setup-status.ts
rename to legacy/host-selfhost/web/setup-status.ts
diff --git a/apps/host-selfhost/web/setup.tsx b/legacy/host-selfhost/web/setup.tsx
similarity index 100%
rename from apps/host-selfhost/web/setup.tsx
rename to legacy/host-selfhost/web/setup.tsx
diff --git a/apps/local/CHANGELOG.md b/legacy/local/CHANGELOG.md
similarity index 100%
rename from apps/local/CHANGELOG.md
rename to legacy/local/CHANGELOG.md
diff --git a/apps/local/drizzle-legacy-v1/0000_overconfident_sharon_carter.sql b/legacy/local/drizzle-legacy-v1/0000_overconfident_sharon_carter.sql
similarity index 100%
rename from apps/local/drizzle-legacy-v1/0000_overconfident_sharon_carter.sql
rename to legacy/local/drizzle-legacy-v1/0000_overconfident_sharon_carter.sql
diff --git a/apps/local/drizzle-legacy-v1/0001_sour_catseye.sql b/legacy/local/drizzle-legacy-v1/0001_sour_catseye.sql
similarity index 100%
rename from apps/local/drizzle-legacy-v1/0001_sour_catseye.sql
rename to legacy/local/drizzle-legacy-v1/0001_sour_catseye.sql
diff --git a/apps/local/drizzle-legacy-v1/0002_lively_sue_storm.sql b/legacy/local/drizzle-legacy-v1/0002_lively_sue_storm.sql
similarity index 100%
rename from apps/local/drizzle-legacy-v1/0002_lively_sue_storm.sql
rename to legacy/local/drizzle-legacy-v1/0002_lively_sue_storm.sql
diff --git a/apps/local/drizzle-legacy-v1/0003_little_silk_fever.sql b/legacy/local/drizzle-legacy-v1/0003_little_silk_fever.sql
similarity index 100%
rename from apps/local/drizzle-legacy-v1/0003_little_silk_fever.sql
rename to legacy/local/drizzle-legacy-v1/0003_little_silk_fever.sql
diff --git a/apps/local/drizzle-legacy-v1/0004_add_tool_policy.sql b/legacy/local/drizzle-legacy-v1/0004_add_tool_policy.sql
similarity index 100%
rename from apps/local/drizzle-legacy-v1/0004_add_tool_policy.sql
rename to legacy/local/drizzle-legacy-v1/0004_add_tool_policy.sql
diff --git a/apps/local/drizzle-legacy-v1/0005_repair_mcp_oauth_session.sql b/legacy/local/drizzle-legacy-v1/0005_repair_mcp_oauth_session.sql
similarity index 100%
rename from apps/local/drizzle-legacy-v1/0005_repair_mcp_oauth_session.sql
rename to legacy/local/drizzle-legacy-v1/0005_repair_mcp_oauth_session.sql
diff --git a/apps/local/drizzle-legacy-v1/0006_neat_terror.sql b/legacy/local/drizzle-legacy-v1/0006_neat_terror.sql
similarity index 100%
rename from apps/local/drizzle-legacy-v1/0006_neat_terror.sql
rename to legacy/local/drizzle-legacy-v1/0006_neat_terror.sql
diff --git a/apps/local/drizzle-legacy-v1/0007_normalize_plugin_secret_refs.sql b/legacy/local/drizzle-legacy-v1/0007_normalize_plugin_secret_refs.sql
similarity index 100%
rename from apps/local/drizzle-legacy-v1/0007_normalize_plugin_secret_refs.sql
rename to legacy/local/drizzle-legacy-v1/0007_normalize_plugin_secret_refs.sql
diff --git a/apps/local/drizzle-legacy-v1/0008_scoped_credentials_cutover.sql b/legacy/local/drizzle-legacy-v1/0008_scoped_credentials_cutover.sql
similarity index 100%
rename from apps/local/drizzle-legacy-v1/0008_scoped_credentials_cutover.sql
rename to legacy/local/drizzle-legacy-v1/0008_scoped_credentials_cutover.sql
diff --git a/apps/local/drizzle-legacy-v1/0009_repair_openapi_oauth_cutover_residue.sql b/legacy/local/drizzle-legacy-v1/0009_repair_openapi_oauth_cutover_residue.sql
similarity index 100%
rename from apps/local/drizzle-legacy-v1/0009_repair_openapi_oauth_cutover_residue.sql
rename to legacy/local/drizzle-legacy-v1/0009_repair_openapi_oauth_cutover_residue.sql
diff --git a/apps/local/drizzle-legacy-v1/0010_add_credential_binding_secret_scope.sql b/legacy/local/drizzle-legacy-v1/0010_add_credential_binding_secret_scope.sql
similarity index 100%
rename from apps/local/drizzle-legacy-v1/0010_add_credential_binding_secret_scope.sql
rename to legacy/local/drizzle-legacy-v1/0010_add_credential_binding_secret_scope.sql
diff --git a/apps/local/drizzle-legacy-v1/0011_plugin_storage_sources.sql b/legacy/local/drizzle-legacy-v1/0011_plugin_storage_sources.sql
similarity index 100%
rename from apps/local/drizzle-legacy-v1/0011_plugin_storage_sources.sql
rename to legacy/local/drizzle-legacy-v1/0011_plugin_storage_sources.sql
diff --git a/apps/local/drizzle-legacy-v1/0012_connection_identity_override.sql b/legacy/local/drizzle-legacy-v1/0012_connection_identity_override.sql
similarity index 100%
rename from apps/local/drizzle-legacy-v1/0012_connection_identity_override.sql
rename to legacy/local/drizzle-legacy-v1/0012_connection_identity_override.sql
diff --git a/apps/local/drizzle-legacy-v1/meta/_journal.json b/legacy/local/drizzle-legacy-v1/meta/_journal.json
similarity index 100%
rename from apps/local/drizzle-legacy-v1/meta/_journal.json
rename to legacy/local/drizzle-legacy-v1/meta/_journal.json
diff --git a/apps/local/drizzle.config.ts b/legacy/local/drizzle.config.ts
similarity index 100%
rename from apps/local/drizzle.config.ts
rename to legacy/local/drizzle.config.ts
diff --git a/apps/local/drizzle/0000_v2_baseline.sql b/legacy/local/drizzle/0000_v2_baseline.sql
similarity index 100%
rename from apps/local/drizzle/0000_v2_baseline.sql
rename to legacy/local/drizzle/0000_v2_baseline.sql
diff --git a/apps/local/drizzle/0001_past_doctor_strange.sql b/legacy/local/drizzle/0001_past_doctor_strange.sql
similarity index 100%
rename from apps/local/drizzle/0001_past_doctor_strange.sql
rename to legacy/local/drizzle/0001_past_doctor_strange.sql
diff --git a/apps/local/drizzle/0002_empty_rictor.sql b/legacy/local/drizzle/0002_empty_rictor.sql
similarity index 100%
rename from apps/local/drizzle/0002_empty_rictor.sql
rename to legacy/local/drizzle/0002_empty_rictor.sql
diff --git a/apps/local/drizzle/meta/0000_snapshot.json b/legacy/local/drizzle/meta/0000_snapshot.json
similarity index 100%
rename from apps/local/drizzle/meta/0000_snapshot.json
rename to legacy/local/drizzle/meta/0000_snapshot.json
diff --git a/apps/local/drizzle/meta/0001_snapshot.json b/legacy/local/drizzle/meta/0001_snapshot.json
similarity index 100%
rename from apps/local/drizzle/meta/0001_snapshot.json
rename to legacy/local/drizzle/meta/0001_snapshot.json
diff --git a/apps/local/drizzle/meta/0002_snapshot.json b/legacy/local/drizzle/meta/0002_snapshot.json
similarity index 100%
rename from apps/local/drizzle/meta/0002_snapshot.json
rename to legacy/local/drizzle/meta/0002_snapshot.json
diff --git a/apps/local/drizzle/meta/_journal.json b/legacy/local/drizzle/meta/_journal.json
similarity index 100%
rename from apps/local/drizzle/meta/_journal.json
rename to legacy/local/drizzle/meta/_journal.json
diff --git a/apps/local/executor.config.ts b/legacy/local/executor.config.ts
similarity index 100%
rename from apps/local/executor.config.ts
rename to legacy/local/executor.config.ts
diff --git a/apps/local/package.json b/legacy/local/package.json
similarity index 100%
rename from apps/local/package.json
rename to legacy/local/package.json
diff --git a/apps/local/src/app.ts b/legacy/local/src/app.ts
similarity index 98%
rename from apps/local/src/app.ts
rename to legacy/local/src/app.ts
index a9915daf5..7142d6dad 100644
--- a/apps/local/src/app.ts
+++ b/legacy/local/src/app.ts
@@ -22,7 +22,7 @@ import { ErrorCaptureLive } from "./observability";
 // (`<basename>-<hash>`, with `oauthEndpointUrlPolicy: { allowHttp: true }`),
 // QuickJS in-process code execution, console error capture, Swagger at /docs —
 // and NO account API, NO usage metering. `diff` against
-// `apps/host-selfhost/src/app.ts` is the whole product difference: local serves
+// `legacy/host-selfhost/src/app.ts` is the whole product difference: local serves
 // its ONE cwd executor directly (the `fixedExecution` seam) instead of building
 // a per-request `[user-org:…, org]` scoped executor from identity.
 //
diff --git a/apps/local/src/auth-tool-failures.test.ts b/legacy/local/src/auth-tool-failures.test.ts
similarity index 100%
rename from apps/local/src/auth-tool-failures.test.ts
rename to legacy/local/src/auth-tool-failures.test.ts
diff --git a/apps/local/src/auth.ts b/legacy/local/src/auth.ts
similarity index 100%
rename from apps/local/src/auth.ts
rename to legacy/local/src/auth.ts
diff --git a/apps/local/src/db/auth-config-migration.ts b/legacy/local/src/db/auth-config-migration.ts
similarity index 100%
rename from apps/local/src/db/auth-config-migration.ts
rename to legacy/local/src/db/auth-config-migration.ts
diff --git a/apps/local/src/db/data-migrations.ts b/legacy/local/src/db/data-migrations.ts
similarity index 100%
rename from apps/local/src/db/data-migrations.ts
rename to legacy/local/src/db/data-migrations.ts
diff --git a/apps/local/src/db/embedded-migrations.gen.ts b/legacy/local/src/db/embedded-migrations.gen.ts
similarity index 100%
rename from apps/local/src/db/embedded-migrations.gen.ts
rename to legacy/local/src/db/embedded-migrations.gen.ts
diff --git a/apps/local/src/db/executor-schema.ts b/legacy/local/src/db/executor-schema.ts
similarity index 98%
rename from apps/local/src/db/executor-schema.ts
rename to legacy/local/src/db/executor-schema.ts
index 6d005e4c5..d86ffe7dd 100644
--- a/apps/local/src/db/executor-schema.ts
+++ b/legacy/local/src/db/executor-schema.ts
@@ -2,7 +2,7 @@
 // Drizzle schema for the v2 executor core tables.
 //
 // This file exists ONLY to drive `drizzle-kit generate` for the committed
-// migration baseline (`apps/local/drizzle`). It is NOT used at runtime: the
+// migration baseline (`legacy/local/drizzle`). It is NOT used at runtime: the
 // local server brings its SQLite schema up directly from the FumaDB
 // `coreTables` definition via `createDrizzleRuntimeSchemaSqlFromTables`
 // (see `./sqlite-fumadb.ts`). It mirrors the column set FumaDB derives from
diff --git a/apps/local/src/db/libsql.ts b/legacy/local/src/db/libsql.ts
similarity index 100%
rename from apps/local/src/db/libsql.ts
rename to legacy/local/src/db/libsql.ts
diff --git a/apps/local/src/db/migration-nesting.test.ts b/legacy/local/src/db/migration-nesting.test.ts
similarity index 100%
rename from apps/local/src/db/migration-nesting.test.ts
rename to legacy/local/src/db/migration-nesting.test.ts
diff --git a/apps/local/src/db/sqlite-fumadb.ts b/legacy/local/src/db/sqlite-fumadb.ts
similarity index 100%
rename from apps/local/src/db/sqlite-fumadb.ts
rename to legacy/local/src/db/sqlite-fumadb.ts
diff --git a/apps/local/src/db/v1-v2-boot-drive.test.ts b/legacy/local/src/db/v1-v2-boot-drive.test.ts
similarity index 99%
rename from apps/local/src/db/v1-v2-boot-drive.test.ts
rename to legacy/local/src/db/v1-v2-boot-drive.test.ts
index d8f78a561..a8423e68d 100644
--- a/apps/local/src/db/v1-v2-boot-drive.test.ts
+++ b/legacy/local/src/db/v1-v2-boot-drive.test.ts
@@ -95,7 +95,7 @@ const WidgetsLive = HttpApiBuilder.group(DriveApi, "widgets", (handlers) =>
 
 // ---------------------------------------------------------------------------
 // Boot the real local stack over a database file. Mirrors
-// apps/local/src/executor.ts's createLocalExecutorLayer (gate → DDL →
+// legacy/local/src/executor.ts's createLocalExecutorLayer (gate → DDL →
 // ledger → createExecutor) with test-friendly plugins.
 // ---------------------------------------------------------------------------
 
diff --git a/apps/local/src/db/v1-v2-ledger.test.ts b/legacy/local/src/db/v1-v2-ledger.test.ts
similarity index 99%
rename from apps/local/src/db/v1-v2-ledger.test.ts
rename to legacy/local/src/db/v1-v2-ledger.test.ts
index a7e3af88d..de549eca6 100644
--- a/apps/local/src/db/v1-v2-ledger.test.ts
+++ b/legacy/local/src/db/v1-v2-ledger.test.ts
@@ -138,7 +138,7 @@ const seedV1Content = async (dbPath: string): Promise<void> => {
   client.close();
 };
 
-/** The boot sequence apps/local/src/executor.ts runs, minus the executor:
+/** The boot sequence legacy/local/src/executor.ts runs, minus the executor:
  *  v1 gate → fumadb DDL → ledger. Returns what each phase reported. */
 const bootOnce = async (dbPath: string) => {
   const migration = await migrateLocalV1ToV2IfNeeded({
diff --git a/apps/local/src/db/v1-v2-migration.test.ts b/legacy/local/src/db/v1-v2-migration.test.ts
similarity index 100%
rename from apps/local/src/db/v1-v2-migration.test.ts
rename to legacy/local/src/db/v1-v2-migration.test.ts
diff --git a/apps/local/src/db/v1-v2-migration.ts b/legacy/local/src/db/v1-v2-migration.ts
similarity index 99%
rename from apps/local/src/db/v1-v2-migration.ts
rename to legacy/local/src/db/v1-v2-migration.ts
index 651591b5c..c90d05c3b 100644
--- a/apps/local/src/db/v1-v2-migration.ts
+++ b/legacy/local/src/db/v1-v2-migration.ts
@@ -139,7 +139,7 @@ const isLocalV1Database = async (client: Client): Promise<boolean> => {
 //
 // Once a database has passed the v1 gate (either it was migrated, or it was
 // inspected and found to be v2-native), the boot ledger stamps
-// LOCAL_V1_V2_LEDGER_NAME (see apps/local/src/db/data-migrations.ts). On
+// LOCAL_V1_V2_LEDGER_NAME (see legacy/local/src/db/data-migrations.ts). On
 // every later boot the stamp short-circuits this module before any schema
 // probing — the stamp row, not the data shape, is the source of truth.
 // ---------------------------------------------------------------------------
@@ -161,8 +161,8 @@ const hasV1GateStamp = async (client: Client): Promise<boolean> => {
 // The v1→v2 data migration below reads the v1-FINAL schema (it queries
 // `plugin_storage`, which only exists after v1 migration 0011). A database
 // last touched by an older release is still mid-chain, so replay the bundled
-// legacy drizzle migrations (`apps/local/drizzle-legacy-v1`, embedded into
-// the binary by apps/cli/src/build.ts) to bring it to v1-final first — the
+// legacy drizzle migrations (`legacy/local/drizzle-legacy-v1`, embedded into
+// the binary by legacy/cli/src/build.ts) to bring it to v1-final first, then the
 // same step every pre-v1.5 release performed at startup.
 // ---------------------------------------------------------------------------
 
diff --git a/apps/local/src/executor.ts b/legacy/local/src/executor.ts
similarity index 100%
rename from apps/local/src/executor.ts
rename to legacy/local/src/executor.ts
diff --git a/apps/local/src/identity.test.ts b/legacy/local/src/identity.test.ts
similarity index 100%
rename from apps/local/src/identity.test.ts
rename to legacy/local/src/identity.test.ts
diff --git a/apps/local/src/identity.ts b/legacy/local/src/identity.ts
similarity index 100%
rename from apps/local/src/identity.ts
rename to legacy/local/src/identity.ts
diff --git a/apps/local/src/index.ts b/legacy/local/src/index.ts
similarity index 100%
rename from apps/local/src/index.ts
rename to legacy/local/src/index.ts
diff --git a/apps/local/src/installation.ts b/legacy/local/src/installation.ts
similarity index 91%
rename from apps/local/src/installation.ts
rename to legacy/local/src/installation.ts
index 90f7ea50c..7c7cb5047 100644
--- a/apps/local/src/installation.ts
+++ b/legacy/local/src/installation.ts
@@ -8,7 +8,7 @@ const pkg = await import("../package.json");
 const LOCAL_VERSION: string = pkg.version;
 
 // A `-` in semver indicates a prerelease (beta train).
-// TODO: source channel from release infra once it lands; mirrors apps/cli.
+// TODO: source channel from release infra once it lands; mirrors legacy/cli.
 const resolveChannel = (version: string): InstallationChannel => {
   if (version.includes("-")) return "beta";
   if (version === "0.0.0" || version === "local") return "dev";
@@ -16,7 +16,7 @@ const resolveChannel = (version: string): InstallationChannel => {
 };
 
 // The desktop main process sets `EXECUTOR_CLIENT=desktop` when it spawns the
-// sidecar so PostHog can slice desktop installs from headless apps/local
+// sidecar so PostHog can slice desktop installs from headless legacy/local
 // (CLI `executor web`, `daemon run --foreground`, etc.).
 const resolveClient = (): SurfaceClient =>
   process.env.EXECUTOR_CLIENT === "desktop" ? "desktop" : "local";
diff --git a/apps/local/src/integrations.ts b/legacy/local/src/integrations.ts
similarity index 93%
rename from apps/local/src/integrations.ts
rename to legacy/local/src/integrations.ts
index 549cdfe91..0621513bf 100644
--- a/apps/local/src/integrations.ts
+++ b/legacy/local/src/integrations.ts
@@ -12,7 +12,7 @@ import { USER_AGENT } from "./installation";
 // Module-singleton runtime for the integrations.sh registry. The layer's
 // scoped fork fetches the registry at startup and refreshes on a 12-hour
 // cadence for the runtime's lifetime. Shared across every long-running
-// apps/local surface (HTTP server, stdio MCP) so concurrent surfaces don't
+// legacy/local surface (HTTP server, stdio MCP) so concurrent surfaces don't
 // each spin up their own refresh fork.
 const integrationsRuntime = ManagedRuntime.make(
   integrationsRegistryLayer({ userAgent: USER_AGENT }).pipe(
diff --git a/apps/local/src/main.ts b/legacy/local/src/main.ts
similarity index 100%
rename from apps/local/src/main.ts
rename to legacy/local/src/main.ts
diff --git a/apps/local/src/mcp-browser-resume.test.ts b/legacy/local/src/mcp-browser-resume.test.ts
similarity index 100%
rename from apps/local/src/mcp-browser-resume.test.ts
rename to legacy/local/src/mcp-browser-resume.test.ts
diff --git a/apps/local/src/mcp-oauth.test.ts b/legacy/local/src/mcp-oauth.test.ts
similarity index 100%
rename from apps/local/src/mcp-oauth.test.ts
rename to legacy/local/src/mcp-oauth.test.ts
diff --git a/apps/local/src/mcp.ts b/legacy/local/src/mcp.ts
similarity index 100%
rename from apps/local/src/mcp.ts
rename to legacy/local/src/mcp.ts
diff --git a/apps/local/src/oauth-result-store.ts b/legacy/local/src/oauth-result-store.ts
similarity index 100%
rename from apps/local/src/oauth-result-store.ts
rename to legacy/local/src/oauth-result-store.ts
diff --git a/apps/local/src/observability.ts b/legacy/local/src/observability.ts
similarity index 100%
rename from apps/local/src/observability.ts
rename to legacy/local/src/observability.ts
diff --git a/apps/local/src/serve-shared.test.ts b/legacy/local/src/serve-shared.test.ts
similarity index 100%
rename from apps/local/src/serve-shared.test.ts
rename to legacy/local/src/serve-shared.test.ts
diff --git a/apps/local/src/serve-shared.ts b/legacy/local/src/serve-shared.ts
similarity index 100%
rename from apps/local/src/serve-shared.ts
rename to legacy/local/src/serve-shared.ts
diff --git a/apps/local/src/serve.test.ts b/legacy/local/src/serve.test.ts
similarity index 100%
rename from apps/local/src/serve.test.ts
rename to legacy/local/src/serve.test.ts
diff --git a/apps/local/src/serve.ts b/legacy/local/src/serve.ts
similarity index 98%
rename from apps/local/src/serve.ts
rename to legacy/local/src/serve.ts
index 474cbd411..96c2d91a8 100644
--- a/apps/local/src/serve.ts
+++ b/legacy/local/src/serve.ts
@@ -3,7 +3,7 @@
  *
  * Serves the Vite-built SPA + Effect API + MCP server.
  *
- * Run directly:   bun run apps/local/src/serve.ts
+ * Run directly:   bun run legacy/local/src/serve.ts
  * Or import:      import { startServer } from "@executor-js/local/serve"
  */
 
@@ -102,7 +102,7 @@ function embeddedToStaticRoutes(embedded: Record<string, string>): Record<string
 // ---------------------------------------------------------------------------
 // Dev mode: spawn vite as a child and proxy non-API requests to it
 //
-// Enabled when EXECUTOR_DEV=1. Lets `dev:cli` serve a fresh UI without
+// Enabled when EXECUTOR_DEV=1. Lets `legacy:dev:cli` serve a fresh UI without
 // requiring a manual `bun run build` after every change. The daemon still
 // owns /api and /mcp — only SPA/asset requests get proxied.
 // ---------------------------------------------------------------------------
@@ -129,7 +129,7 @@ async function startViteChild(): Promise<ViteChild> {
   const env = { ...process.env };
   delete env.PORT;
   // `bunx --bun vite` runs vite under Bun, matching the `dev:vite` script
-  // already in apps/local. --strictPort keeps the URL we hand back stable.
+  // already in legacy/local. --strictPort keeps the URL we hand back stable.
   const child: Subprocess = Bun.spawn(
     [
       "bunx",
diff --git a/apps/local/src/vite-env.d.ts b/legacy/local/src/vite-env.d.ts
similarity index 100%
rename from apps/local/src/vite-env.d.ts
rename to legacy/local/src/vite-env.d.ts
diff --git a/apps/local/tsconfig.json b/legacy/local/tsconfig.json
similarity index 100%
rename from apps/local/tsconfig.json
rename to legacy/local/tsconfig.json
diff --git a/apps/local/vite.config.ts b/legacy/local/vite.config.ts
similarity index 99%
rename from apps/local/vite.config.ts
rename to legacy/local/vite.config.ts
index a44a088f1..ec9d2434e 100644
--- a/apps/local/vite.config.ts
+++ b/legacy/local/vite.config.ts
@@ -92,7 +92,7 @@ function executorApiPlugin(): Plugin {
       }
 
       server.watcher.on("change", (path) => {
-        if (path.includes("/apps/local/src/") || path.endsWith("/executor.config.ts")) {
+        if (path.includes("/legacy/local/src/") || path.endsWith("/executor.config.ts")) {
           handlers = null;
         }
       });
diff --git a/legacy/local/vitest.config.ts b/legacy/local/vitest.config.ts
new file mode 100644
index 000000000..ae847ff6d
--- /dev/null
+++ b/legacy/local/vitest.config.ts
@@ -0,0 +1,7 @@
+import { defineConfig } from "vitest/config";
+
+export default defineConfig({
+  test: {
+    include: ["src/**/*.test.ts"],
+  },
+});
diff --git a/migrations/20260623000000_initial.sql b/migrations/20260623000000_initial.sql
new file mode 100644
index 000000000..0684174f4
--- /dev/null
+++ b/migrations/20260623000000_initial.sql
@@ -0,0 +1,45 @@
+PRAGMA foreign_keys = ON;
+
+CREATE TABLE instance_metadata (
+    key TEXT PRIMARY KEY NOT NULL,
+    value BLOB NOT NULL
+);
+
+CREATE TABLE setup_state (
+    id INTEGER PRIMARY KEY NOT NULL CHECK (id = 1),
+    token_digest BLOB NOT NULL,
+    created_at INTEGER NOT NULL,
+    used_at INTEGER
+);
+
+CREATE TABLE admins (
+    id INTEGER PRIMARY KEY NOT NULL CHECK (id = 1),
+    username TEXT NOT NULL UNIQUE,
+    password_hash TEXT NOT NULL,
+    created_at INTEGER NOT NULL
+);
+
+CREATE TABLE admin_sessions (
+    session_digest BLOB PRIMARY KEY NOT NULL,
+    admin_id INTEGER NOT NULL REFERENCES admins(id) ON DELETE CASCADE,
+    csrf_digest BLOB NOT NULL,
+    created_at INTEGER NOT NULL,
+    expires_at INTEGER NOT NULL
+);
+
+CREATE INDEX admin_sessions_expiry_idx ON admin_sessions(expires_at);
+
+CREATE TABLE api_tokens (
+    id TEXT PRIMARY KEY NOT NULL,
+    name TEXT NOT NULL,
+    token_digest BLOB NOT NULL UNIQUE,
+    token_prefix TEXT NOT NULL,
+    token_suffix TEXT NOT NULL,
+    created_at INTEGER NOT NULL,
+    last_used_at INTEGER,
+    revoked_at INTEGER
+);
+
+CREATE INDEX api_tokens_active_digest_idx
+    ON api_tokens(token_digest)
+    WHERE revoked_at IS NULL;
diff --git a/migrations/20260623010000_catalog.sql b/migrations/20260623010000_catalog.sql
new file mode 100644
index 000000000..bb9741ff0
--- /dev/null
+++ b/migrations/20260623010000_catalog.sql
@@ -0,0 +1,175 @@
+PRAGMA foreign_keys = ON;
+
+CREATE TABLE catalog_state (
+    id INTEGER PRIMARY KEY NOT NULL CHECK (id = 1),
+    revision INTEGER NOT NULL DEFAULT 0 CHECK (revision >= 0),
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL
+) STRICT;
+
+INSERT INTO catalog_state (id, revision, created_at, updated_at)
+VALUES (1, 0, unixepoch(), unixepoch());
+
+CREATE TABLE sources (
+    id TEXT PRIMARY KEY NOT NULL CHECK (length(id) BETWEEN 1 AND 128),
+    kind TEXT NOT NULL CHECK (kind IN ('openapi', 'graphql', 'mcp_http', 'mcp_stdio')),
+    slug TEXT NOT NULL UNIQUE
+        CHECK (length(slug) BETWEEN 1 AND 63)
+        CHECK (substr(slug, 1, 1) BETWEEN 'a' AND 'z')
+        CHECK (slug NOT GLOB '*[^a-z0-9_]*')
+        CHECK (slug NOT IN ('tools', 'search', 'describe', 'executor')),
+    search_short_grams TEXT NOT NULL DEFAULT '',
+    display_name TEXT NOT NULL CHECK (length(display_name) BETWEEN 1 AND 200),
+    description TEXT CHECK (description IS NULL OR length(description) <= 2000),
+    configuration_json TEXT NOT NULL DEFAULT '{}'
+        CHECK (json_valid(configuration_json))
+        CHECK (json_type(configuration_json) = 'object'),
+    mode_override TEXT CHECK (mode_override IS NULL OR mode_override IN ('enabled', 'ask', 'disabled')),
+    health_status TEXT NOT NULL DEFAULT 'unknown'
+        CHECK (health_status IN ('unknown', 'healthy', 'error')),
+    health_error_code TEXT
+        CHECK (health_error_code IS NULL OR length(health_error_code) BETWEEN 1 AND 128),
+    revision INTEGER NOT NULL DEFAULT 0 CHECK (revision >= 0),
+    catalog_revision INTEGER NOT NULL DEFAULT 0 CHECK (catalog_revision >= 0),
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL,
+    last_refreshed_at INTEGER,
+    CHECK (
+        (health_status = 'error' AND health_error_code IS NOT NULL)
+        OR (health_status <> 'error' AND health_error_code IS NULL)
+    )
+) STRICT;
+
+CREATE INDEX sources_kind_slug_idx ON sources(kind, slug);
+
+CREATE TABLE source_credentials (
+    source_id TEXT PRIMARY KEY NOT NULL
+        REFERENCES sources(id) ON DELETE CASCADE,
+    schema_version INTEGER NOT NULL CHECK (schema_version > 0),
+    payload_ciphertext BLOB NOT NULL CHECK (length(payload_ciphertext) > 0),
+    revision INTEGER NOT NULL DEFAULT 0 CHECK (revision >= 0),
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL
+) STRICT;
+
+CREATE TABLE source_artifacts (
+    id TEXT PRIMARY KEY NOT NULL CHECK (length(id) BETWEEN 1 AND 128),
+    source_id TEXT NOT NULL REFERENCES sources(id) ON DELETE CASCADE,
+    artifact_kind TEXT NOT NULL
+        CHECK (artifact_kind IN ('openapi_document', 'graphql_schema', 'mcp_capabilities', 'metadata')),
+    stable_key TEXT NOT NULL CHECK (length(stable_key) BETWEEN 1 AND 512),
+    content_json TEXT NOT NULL CHECK (json_valid(content_json)),
+    revision INTEGER NOT NULL DEFAULT 0 CHECK (revision >= 0),
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL,
+    UNIQUE (source_id, artifact_kind, stable_key)
+) STRICT;
+
+CREATE TABLE tools (
+    id TEXT PRIMARY KEY NOT NULL CHECK (length(id) BETWEEN 1 AND 128),
+    source_id TEXT NOT NULL REFERENCES sources(id) ON DELETE CASCADE,
+    stable_key TEXT NOT NULL CHECK (length(stable_key) BETWEEN 1 AND 1024),
+    local_name TEXT NOT NULL
+        CHECK (length(local_name) BETWEEN 1 AND 128)
+        CHECK (substr(local_name, 1, 1) BETWEEN 'a' AND 'z')
+        CHECK (local_name NOT GLOB '*[^a-z0-9_]*'),
+    display_name TEXT NOT NULL CHECK (length(display_name) BETWEEN 1 AND 300),
+    description TEXT CHECK (description IS NULL OR length(description) <= 4000),
+    search_description TEXT NOT NULL DEFAULT '',
+    search_short_grams TEXT NOT NULL DEFAULT '',
+    input_schema_json TEXT NOT NULL CHECK (json_valid(input_schema_json)),
+    output_schema_json TEXT CHECK (output_schema_json IS NULL OR json_valid(output_schema_json)),
+    input_typescript TEXT CHECK (input_typescript IS NULL OR length(input_typescript) <= 100000),
+    output_typescript TEXT CHECK (output_typescript IS NULL OR length(output_typescript) <= 100000),
+    typescript_definitions_json TEXT NOT NULL DEFAULT '{}'
+        CHECK (json_valid(typescript_definitions_json))
+        CHECK (json_type(typescript_definitions_json) = 'object'),
+    intrinsic_mode TEXT NOT NULL CHECK (intrinsic_mode IN ('enabled', 'ask', 'disabled')),
+    mode_override TEXT CHECK (mode_override IS NULL OR mode_override IN ('enabled', 'ask', 'disabled')),
+    present INTEGER NOT NULL DEFAULT 1 CHECK (present IN (0, 1)),
+    revision INTEGER NOT NULL DEFAULT 0 CHECK (revision >= 0),
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL,
+    last_seen_at INTEGER NOT NULL,
+    tombstoned_at INTEGER,
+    UNIQUE (source_id, stable_key),
+    UNIQUE (source_id, local_name),
+    CHECK (
+        (present = 1 AND tombstoned_at IS NULL)
+        OR (present = 0 AND tombstoned_at IS NOT NULL)
+    )
+) STRICT;
+
+CREATE INDEX tools_source_presence_name_idx
+    ON tools(source_id, present, local_name);
+CREATE INDEX tools_presence_mode_idx
+    ON tools(present, intrinsic_mode, mode_override);
+
+CREATE VIRTUAL TABLE tool_search USING fts5(
+    source_id UNINDEXED,
+    tool_id UNINDEXED,
+    source_slug,
+    local_name,
+    description,
+    sandbox_path,
+    tokenize = 'unicode61'
+);
+
+CREATE VIRTUAL TABLE tool_search_trigram USING fts5(
+    source_id UNINDEXED,
+    tool_id UNINDEXED,
+    source_slug,
+    local_name,
+    description,
+    sandbox_path,
+    tokenize = 'trigram'
+);
+
+CREATE VIRTUAL TABLE tool_search_short USING fts5(
+    source_id UNINDEXED,
+    tool_id UNINDEXED,
+    grams,
+    tokenize = 'unicode61'
+);
+
+CREATE TABLE request_logs (
+    request_id TEXT PRIMARY KEY NOT NULL CHECK (length(request_id) BETWEEN 1 AND 128),
+    actor_api_token_id TEXT REFERENCES api_tokens(id) ON DELETE SET NULL,
+    surface TEXT NOT NULL CHECK (surface IN ('admin', 'gateway', 'cli', 'mcp')),
+    source_id TEXT REFERENCES sources(id) ON DELETE SET NULL,
+    tool_id TEXT REFERENCES tools(id) ON DELETE SET NULL,
+    path_snapshot TEXT CHECK (path_snapshot IS NULL OR length(path_snapshot) BETWEEN 1 AND 512),
+    outcome TEXT NOT NULL CHECK (outcome IN ('succeeded', 'failed', 'pending_approval', 'denied')),
+    error_code TEXT CHECK (error_code IS NULL OR length(error_code) BETWEEN 1 AND 128),
+    duration_ms INTEGER NOT NULL CHECK (duration_ms >= 0),
+    approval_id TEXT CHECK (approval_id IS NULL OR length(approval_id) BETWEEN 1 AND 128),
+    created_at INTEGER NOT NULL,
+    CHECK ((source_id IS NULL AND tool_id IS NULL) OR path_snapshot IS NOT NULL)
+) STRICT;
+
+CREATE INDEX request_logs_created_cursor_idx
+    ON request_logs(created_at DESC, request_id DESC);
+CREATE INDEX request_logs_actor_created_idx
+    ON request_logs(actor_api_token_id, created_at DESC);
+CREATE INDEX request_logs_tool_created_idx
+    ON request_logs(tool_id, created_at DESC);
+
+CREATE TABLE audit_events (
+    id TEXT PRIMARY KEY NOT NULL CHECK (length(id) BETWEEN 1 AND 128),
+    request_id TEXT CHECK (request_id IS NULL OR length(request_id) BETWEEN 1 AND 128),
+    actor_admin_id INTEGER REFERENCES admins(id) ON DELETE SET NULL,
+    action TEXT NOT NULL CHECK (length(action) BETWEEN 1 AND 128),
+    source_id TEXT REFERENCES sources(id) ON DELETE SET NULL,
+    tool_id TEXT REFERENCES tools(id) ON DELETE SET NULL,
+    target_path_snapshot TEXT
+        CHECK (target_path_snapshot IS NULL OR length(target_path_snapshot) BETWEEN 1 AND 512),
+    metadata_json TEXT NOT NULL DEFAULT '{}'
+        CHECK (json_valid(metadata_json))
+        CHECK (json_type(metadata_json) = 'object'),
+    created_at INTEGER NOT NULL
+) STRICT;
+
+CREATE INDEX audit_events_created_idx
+    ON audit_events(created_at DESC, id DESC);
+CREATE INDEX audit_events_source_created_idx
+    ON audit_events(source_id, created_at DESC);
diff --git a/migrations/20260623020000_tool_bindings.sql b/migrations/20260623020000_tool_bindings.sql
new file mode 100644
index 000000000..1bfe67f0f
--- /dev/null
+++ b/migrations/20260623020000_tool_bindings.sql
@@ -0,0 +1,17 @@
+PRAGMA foreign_keys = ON;
+
+CREATE TABLE tool_bindings (
+    tool_id TEXT PRIMARY KEY NOT NULL REFERENCES tools(id) ON DELETE CASCADE,
+    protocol TEXT NOT NULL
+        CHECK (protocol IN ('openapi', 'graphql', 'mcp_http', 'mcp_stdio')),
+    binding_version INTEGER NOT NULL CHECK (binding_version > 0),
+    definition_json TEXT NOT NULL
+        CHECK (json_valid(definition_json))
+        CHECK (json_type(definition_json) = 'object'),
+    revision INTEGER NOT NULL DEFAULT 0 CHECK (revision >= 0),
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL
+) STRICT;
+
+CREATE INDEX tool_bindings_protocol_idx
+    ON tool_bindings(protocol, binding_version, tool_id);
diff --git a/migrations/20260623030000_approvals.sql b/migrations/20260623030000_approvals.sql
new file mode 100644
index 000000000..d44834c9a
--- /dev/null
+++ b/migrations/20260623030000_approvals.sql
@@ -0,0 +1,212 @@
+PRAGMA foreign_keys = ON;
+
+CREATE TABLE approval_clock (
+    id INTEGER PRIMARY KEY NOT NULL CHECK (id = 1),
+    effective_now INTEGER NOT NULL CHECK (effective_now >= 0)
+) STRICT;
+
+INSERT INTO approval_clock (id, effective_now) VALUES (1, 0);
+
+CREATE TABLE approvals (
+    sequence INTEGER PRIMARY KEY AUTOINCREMENT,
+    id TEXT NOT NULL UNIQUE CHECK (length(id) BETWEEN 1 AND 128),
+    execution_id TEXT NOT NULL CHECK (length(execution_id) BETWEEN 1 AND 128),
+    call_id TEXT NOT NULL CHECK (length(call_id) BETWEEN 1 AND 128),
+    worker_generation INTEGER NOT NULL CHECK (worker_generation >= 0),
+    actor_kind TEXT NOT NULL CHECK (actor_kind IN ('api_token', 'admin', 'system')),
+    actor_id TEXT NOT NULL CHECK (length(actor_id) BETWEEN 1 AND 128),
+    actor_api_token_id TEXT REFERENCES api_tokens(id) ON DELETE RESTRICT,
+    actor_name_snapshot TEXT
+        CHECK (actor_name_snapshot IS NULL OR length(actor_name_snapshot) BETWEEN 1 AND 200),
+    surface TEXT NOT NULL CHECK (surface IN ('gateway', 'cli', 'mcp')),
+    source_id TEXT NOT NULL CHECK (length(source_id) BETWEEN 1 AND 128),
+    tool_id TEXT NOT NULL CHECK (length(tool_id) BETWEEN 1 AND 128),
+    callable_path_snapshot TEXT NOT NULL
+        CHECK (length(callable_path_snapshot) BETWEEN 1 AND 512),
+    source_display_name_snapshot TEXT
+        CHECK (source_display_name_snapshot IS NULL OR length(source_display_name_snapshot) BETWEEN 1 AND 300),
+    tool_display_name_snapshot TEXT
+        CHECK (tool_display_name_snapshot IS NULL OR length(tool_display_name_snapshot) BETWEEN 1 AND 300),
+    mode_provenance TEXT NOT NULL
+        CHECK (mode_provenance IN ('tool_override', 'source_override', 'intrinsic')),
+    source_revision INTEGER NOT NULL CHECK (source_revision >= 0),
+    catalog_revision INTEGER NOT NULL CHECK (catalog_revision >= 0),
+    tool_revision INTEGER NOT NULL CHECK (tool_revision >= 0),
+    binding_revision INTEGER NOT NULL CHECK (binding_revision >= 0),
+    credential_revision INTEGER CHECK (credential_revision IS NULL OR credential_revision >= 0),
+    arguments_digest BLOB NOT NULL CHECK (length(arguments_digest) = 32),
+    arguments_ciphertext BLOB NOT NULL CHECK (length(arguments_ciphertext) BETWEEN 42 AND 8388650),
+    redacted_arguments_ciphertext BLOB NOT NULL
+        CHECK (length(redacted_arguments_ciphertext) BETWEEN 42 AND 8388650),
+    input_schema_ciphertext BLOB NOT NULL CHECK (length(input_schema_ciphertext) BETWEEN 42 AND 2097194),
+    output_schema_ciphertext BLOB CHECK (
+        output_schema_ciphertext IS NULL
+        OR length(output_schema_ciphertext) BETWEEN 42 AND 2097194
+    ),
+    invocation_snapshot_ciphertext BLOB NOT NULL
+        CHECK (length(invocation_snapshot_ciphertext) BETWEEN 42 AND 8388650),
+    result_ciphertext BLOB CHECK (
+        result_ciphertext IS NULL
+        OR length(result_ciphertext) BETWEEN 42 AND 8388650
+    ),
+    status TEXT NOT NULL CHECK (
+        status IN (
+            'pending', 'approved', 'denied', 'expired', 'canceled',
+            'executing', 'succeeded', 'failed', 'stale', 'interrupted'
+        )
+    ),
+    revision INTEGER NOT NULL DEFAULT 0 CHECK (revision >= 0),
+    decision_id TEXT CHECK (decision_id IS NULL OR length(decision_id) BETWEEN 1 AND 128),
+    decision TEXT CHECK (decision IS NULL OR decision IN ('approve', 'deny')),
+    decided_by_admin_id INTEGER REFERENCES admins(id) ON DELETE SET NULL,
+    failure_code TEXT CHECK (failure_code IS NULL OR length(failure_code) BETWEEN 1 AND 128),
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL,
+    expires_at INTEGER NOT NULL CHECK (expires_at > created_at),
+    decided_at INTEGER,
+    execution_started_at INTEGER,
+    completed_at INTEGER,
+    CHECK (
+        (actor_kind = 'api_token' AND actor_api_token_id IS NOT NULL AND actor_id = actor_api_token_id)
+        OR (actor_kind IN ('admin', 'system') AND actor_api_token_id IS NULL)
+    ),
+    CHECK (
+        (decision_id IS NULL AND decision IS NULL AND decided_at IS NULL AND decided_by_admin_id IS NULL)
+        OR (decision_id IS NOT NULL AND decision IS NOT NULL AND decided_at IS NOT NULL)
+    ),
+    CHECK (
+        status NOT IN ('approved', 'denied')
+        OR decision IS NOT NULL
+    ),
+    CHECK (
+        (status = 'executing' AND execution_started_at IS NOT NULL)
+        OR status <> 'executing'
+    ),
+    CHECK (
+        (status IN ('succeeded', 'failed', 'stale', 'interrupted', 'denied', 'expired', 'canceled')
+            AND completed_at IS NOT NULL)
+        OR status IN ('pending', 'approved', 'executing')
+    ),
+    UNIQUE (actor_kind, actor_id, execution_id, call_id)
+) STRICT;
+
+CREATE INDEX approvals_admin_cursor_idx
+    ON approvals(sequence DESC);
+CREATE INDEX approvals_status_cursor_idx
+    ON approvals(status, sequence DESC);
+CREATE INDEX approvals_actor_cursor_idx
+    ON approvals(actor_kind, actor_id, sequence DESC);
+CREATE INDEX approvals_execution_idx
+    ON approvals(execution_id, status);
+
+CREATE TABLE approval_terminal_order (
+    sequence INTEGER PRIMARY KEY AUTOINCREMENT,
+    approval_id TEXT NOT NULL UNIQUE
+        REFERENCES approvals(id) ON DELETE CASCADE
+) STRICT;
+
+CREATE TABLE approval_log_outbox (
+    request_id TEXT PRIMARY KEY NOT NULL CHECK (length(request_id) BETWEEN 1 AND 128),
+    approval_id TEXT NOT NULL CHECK (length(approval_id) BETWEEN 1 AND 128),
+    actor_api_token_id TEXT CHECK (
+        actor_api_token_id IS NULL OR length(actor_api_token_id) BETWEEN 1 AND 128
+    ),
+    surface TEXT NOT NULL CHECK (surface IN ('gateway', 'cli', 'mcp')),
+    source_id TEXT NOT NULL CHECK (length(source_id) BETWEEN 1 AND 128),
+    tool_id TEXT NOT NULL CHECK (length(tool_id) BETWEEN 1 AND 128),
+    path_snapshot TEXT NOT NULL CHECK (length(path_snapshot) BETWEEN 1 AND 512),
+    outcome TEXT NOT NULL CHECK (outcome IN ('succeeded', 'failed', 'denied')),
+    error_code TEXT CHECK (error_code IS NULL OR length(error_code) BETWEEN 1 AND 128),
+    created_at INTEGER NOT NULL
+) STRICT;
+
+CREATE TABLE approval_log_outbox_state (
+    id INTEGER PRIMARY KEY NOT NULL CHECK (id = 1),
+    dropped_count INTEGER NOT NULL DEFAULT 0 CHECK (dropped_count >= 0)
+) STRICT;
+
+INSERT INTO approval_log_outbox_state (id, dropped_count) VALUES (1, 0);
+
+CREATE TRIGGER approvals_fixed_expiry
+BEFORE UPDATE OF created_at, expires_at ON approvals
+WHEN NEW.created_at <> OLD.created_at OR NEW.expires_at <> OLD.expires_at
+BEGIN
+    SELECT RAISE(ABORT, 'approval expiry is immutable');
+END;
+
+CREATE TRIGGER approvals_immutable_snapshot
+BEFORE UPDATE OF
+    id, execution_id, call_id, worker_generation, actor_kind, actor_id, actor_api_token_id,
+    surface,
+    actor_name_snapshot, source_id, tool_id, callable_path_snapshot,
+    source_display_name_snapshot, tool_display_name_snapshot, mode_provenance,
+    source_revision, catalog_revision, tool_revision, binding_revision,
+    credential_revision, arguments_digest, arguments_ciphertext,
+    redacted_arguments_ciphertext,
+    input_schema_ciphertext, output_schema_ciphertext,
+    invocation_snapshot_ciphertext
+ON approvals
+BEGIN
+    SELECT RAISE(ABORT, 'approval snapshot is immutable');
+END;
+
+CREATE TRIGGER approvals_legal_status_transition
+BEFORE UPDATE OF status ON approvals
+WHEN NEW.status <> OLD.status AND NOT (
+    (OLD.status = 'pending' AND NEW.status IN ('approved', 'denied', 'expired', 'canceled'))
+    OR (OLD.status = 'approved' AND NEW.status IN ('executing', 'stale', 'canceled'))
+    OR (OLD.status = 'executing' AND NEW.status IN ('succeeded', 'failed', 'interrupted'))
+)
+BEGIN
+    SELECT RAISE(ABORT, 'illegal approval status transition');
+END;
+
+CREATE TRIGGER approvals_terminal_log_outbox
+AFTER UPDATE OF status ON approvals
+WHEN NEW.status <> OLD.status
+ AND NEW.status IN ('denied', 'expired', 'canceled', 'succeeded', 'failed', 'stale', 'interrupted')
+BEGIN
+    INSERT OR IGNORE INTO approval_log_outbox (
+        request_id, approval_id, actor_api_token_id, surface, source_id, tool_id,
+        path_snapshot, outcome, error_code, created_at
+    ) VALUES (
+        substr(NEW.execution_id, 1, 48) || ':approval:' || NEW.id || ':' || NEW.status,
+        NEW.id,
+        NEW.actor_api_token_id,
+        NEW.surface,
+        NEW.source_id,
+        NEW.tool_id,
+        NEW.callable_path_snapshot,
+        CASE
+            WHEN NEW.status = 'succeeded' THEN 'succeeded'
+            WHEN NEW.status IN ('denied', 'expired', 'canceled') THEN 'denied'
+            ELSE 'failed'
+        END,
+        CASE NEW.status
+            WHEN 'denied' THEN 'approval_denied'
+            WHEN 'expired' THEN 'approval_expired'
+            WHEN 'canceled' THEN 'approval_canceled'
+            WHEN 'failed' THEN coalesce(NEW.failure_code, 'approval_execution_failed')
+            WHEN 'stale' THEN coalesce(NEW.failure_code, 'approval_stale')
+            WHEN 'interrupted' THEN coalesce(NEW.failure_code, 'approval_interrupted')
+            ELSE NULL
+        END,
+        NEW.updated_at
+    );
+END;
+
+CREATE TRIGGER approval_log_outbox_retention
+AFTER INSERT ON approval_log_outbox
+WHEN (SELECT count(*) FROM approval_log_outbox) > 10000
+BEGIN
+    UPDATE approval_log_outbox_state
+    SET dropped_count = dropped_count + (
+        (SELECT count(*) FROM approval_log_outbox) - 10000
+    )
+    WHERE id = 1;
+    DELETE FROM approval_log_outbox
+    WHERE rowid IN (
+        SELECT rowid FROM approval_log_outbox
+        ORDER BY rowid DESC LIMIT -1 OFFSET 10000
+    );
+END;
diff --git a/migrations/20260623040000_gateway_idempotency.sql b/migrations/20260623040000_gateway_idempotency.sql
new file mode 100644
index 000000000..f40b73f8c
--- /dev/null
+++ b/migrations/20260623040000_gateway_idempotency.sql
@@ -0,0 +1,127 @@
+PRAGMA foreign_keys = ON;
+
+CREATE TABLE gateway_idempotency_clock (
+    id INTEGER PRIMARY KEY NOT NULL CHECK (id = 1),
+    effective_now INTEGER NOT NULL CHECK (effective_now >= 0)
+) STRICT;
+
+INSERT INTO gateway_idempotency_clock (id, effective_now) VALUES (1, 0);
+
+CREATE TABLE gateway_invocation_idempotency (
+    sequence INTEGER PRIMARY KEY AUTOINCREMENT,
+    id TEXT NOT NULL UNIQUE CHECK (length(id) BETWEEN 1 AND 128),
+    owner_api_token_id TEXT NOT NULL
+        REFERENCES api_tokens(id) ON DELETE CASCADE,
+    key_digest BLOB NOT NULL CHECK (length(key_digest) = 32),
+    request_digest BLOB NOT NULL CHECK (length(request_digest) = 32),
+    state TEXT NOT NULL CHECK (
+        state IN ('reserved', 'executing', 'completed', 'indeterminate')
+    ),
+    approval_id TEXT REFERENCES approvals(id) ON DELETE SET NULL,
+    approval_correlation_id TEXT CHECK (
+        approval_correlation_id IS NULL OR length(approval_correlation_id) BETWEEN 1 AND 128
+    ),
+    response_kind TEXT CHECK (
+        response_kind IS NULL OR response_kind IN ('tool', 'approval')
+    ),
+    response_ciphertext BLOB CHECK (
+        response_ciphertext IS NULL
+        OR length(response_ciphertext) BETWEEN 42 AND 12582954
+    ),
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL,
+    completed_at INTEGER,
+    expires_at INTEGER,
+    UNIQUE (owner_api_token_id, key_digest),
+    CHECK (
+        (state IN ('reserved', 'executing')
+            AND response_kind IS NULL
+            AND response_ciphertext IS NULL
+            AND completed_at IS NULL
+            AND expires_at IS NULL)
+        OR (state = 'completed'
+            AND response_kind IS NOT NULL
+            AND response_ciphertext IS NOT NULL
+            AND completed_at IS NOT NULL
+            AND expires_at > completed_at)
+        OR (state = 'indeterminate'
+            AND response_kind IS NULL
+            AND response_ciphertext IS NULL
+            AND completed_at IS NOT NULL
+            AND expires_at > completed_at)
+    )
+) STRICT;
+
+CREATE INDEX gateway_invocation_idempotency_expiry_idx
+    ON gateway_invocation_idempotency(expires_at)
+    WHERE expires_at IS NOT NULL;
+
+CREATE INDEX gateway_invocation_idempotency_owner_idx
+    ON gateway_invocation_idempotency(owner_api_token_id, sequence DESC);
+
+CREATE INDEX gateway_invocation_idempotency_approval_correlation_idx
+    ON gateway_invocation_idempotency(approval_correlation_id)
+    WHERE approval_correlation_id IS NOT NULL;
+
+CREATE TRIGGER gateway_idempotency_immutable_binding
+BEFORE UPDATE OF id, owner_api_token_id, key_digest, request_digest, created_at
+ON gateway_invocation_idempotency
+BEGIN
+    SELECT RAISE(ABORT, 'gateway idempotency binding is immutable');
+END;
+
+CREATE TRIGGER gateway_idempotency_legal_transition
+BEFORE UPDATE OF state ON gateway_invocation_idempotency
+WHEN NEW.state <> OLD.state AND NOT (
+    (OLD.state = 'reserved' AND NEW.state IN ('executing', 'completed', 'indeterminate'))
+    OR (OLD.state = 'executing' AND NEW.state IN ('completed', 'indeterminate'))
+)
+BEGIN
+    SELECT RAISE(ABORT, 'illegal gateway idempotency state transition');
+END;
+
+CREATE TRIGGER gateway_idempotency_immutable_terminal
+BEFORE UPDATE OF response_kind, response_ciphertext, completed_at, expires_at
+ON gateway_invocation_idempotency
+WHEN OLD.state IN ('completed', 'indeterminate')
+BEGIN
+    SELECT RAISE(ABORT, 'terminal gateway idempotency response is immutable');
+END;
+
+CREATE TRIGGER gateway_idempotency_capture_approval_correlation_insert
+AFTER INSERT ON gateway_invocation_idempotency
+WHEN NEW.approval_id IS NOT NULL AND NEW.approval_correlation_id IS NULL
+BEGIN
+    UPDATE gateway_invocation_idempotency
+    SET approval_correlation_id = NEW.approval_id
+    WHERE id = NEW.id;
+END;
+
+CREATE TRIGGER gateway_idempotency_capture_approval_correlation_update
+AFTER UPDATE OF approval_id ON gateway_invocation_idempotency
+WHEN OLD.approval_id IS NULL AND NEW.approval_id IS NOT NULL
+BEGIN
+    UPDATE gateway_invocation_idempotency
+    SET approval_correlation_id = NEW.approval_id
+    WHERE id = NEW.id;
+END;
+
+CREATE TRIGGER gateway_idempotency_approval_correlation_transition
+BEFORE UPDATE OF approval_correlation_id ON gateway_invocation_idempotency
+WHEN NOT (
+    OLD.approval_correlation_id IS NULL
+    AND NEW.approval_correlation_id = NEW.approval_id
+    AND NEW.approval_correlation_id IS NOT NULL
+)
+BEGIN
+    SELECT RAISE(ABORT, 'gateway approval correlation transition is invalid');
+END;
+
+CREATE TRIGGER gateway_idempotency_approval_reference_transition
+BEFORE UPDATE OF approval_id ON gateway_invocation_idempotency
+WHEN OLD.approval_id IS NOT NULL
+ AND NEW.approval_id IS NOT NULL
+ AND NEW.approval_id <> OLD.approval_id
+BEGIN
+    SELECT RAISE(ABORT, 'gateway approval reference is immutable');
+END;
diff --git a/migrations/20260623050000_approval_correlations.sql b/migrations/20260623050000_approval_correlations.sql
new file mode 100644
index 000000000..e06cdc610
--- /dev/null
+++ b/migrations/20260623050000_approval_correlations.sql
@@ -0,0 +1,131 @@
+PRAGMA foreign_keys = ON;
+
+CREATE TABLE approval_correlations (
+    execution_id TEXT NOT NULL CHECK (length(execution_id) BETWEEN 1 AND 128),
+    call_id TEXT NOT NULL CHECK (length(call_id) BETWEEN 1 AND 128),
+    approval_id TEXT NOT NULL UNIQUE CHECK (length(approval_id) BETWEEN 1 AND 128),
+    actor_kind TEXT NOT NULL CHECK (actor_kind IN ('api_token', 'admin', 'system')),
+    actor_id TEXT NOT NULL CHECK (length(actor_id) BETWEEN 1 AND 128),
+    surface TEXT NOT NULL CHECK (surface IN ('gateway', 'cli', 'mcp')),
+    worker_generation INTEGER NOT NULL CHECK (worker_generation >= 0),
+    callable_path TEXT NOT NULL CHECK (length(callable_path) BETWEEN 1 AND 512),
+    arguments_digest BLOB NOT NULL CHECK (length(arguments_digest) = 32),
+    expires_at INTEGER CHECK (expires_at IS NULL OR expires_at >= 0),
+    PRIMARY KEY (actor_kind, actor_id, execution_id, call_id)
+) STRICT;
+
+CREATE INDEX approval_correlations_expiry_idx
+    ON approval_correlations(expires_at)
+    WHERE expires_at IS NOT NULL;
+
+CREATE TABLE approval_correlation_state (
+    id INTEGER PRIMARY KEY NOT NULL CHECK (id = 1),
+    correlation_count INTEGER NOT NULL CHECK (correlation_count BETWEEN 0 AND 100000)
+) STRICT;
+
+INSERT INTO approval_correlation_state (id, correlation_count) VALUES (1, 0);
+
+INSERT INTO approval_correlations (
+    execution_id, call_id, approval_id, actor_kind, actor_id, surface,
+    worker_generation, callable_path, arguments_digest, expires_at
+)
+SELECT
+    execution_id, call_id, id, actor_kind, actor_id, surface,
+    worker_generation, callable_path_snapshot, arguments_digest,
+    CASE
+        WHEN status IN ('denied', 'expired', 'canceled', 'succeeded', 'failed', 'stale', 'interrupted')
+        THEN completed_at + 86400
+        ELSE NULL
+    END
+FROM approvals;
+
+UPDATE approval_correlation_state
+SET correlation_count = (SELECT count(*) FROM approval_correlations)
+WHERE id = 1;
+
+CREATE TRIGGER approval_correlations_capacity
+BEFORE INSERT ON approval_correlations
+WHEN (SELECT correlation_count FROM approval_correlation_state WHERE id = 1) >= 100000
+BEGIN
+    SELECT RAISE(ABORT, 'approval correlation capacity reached');
+END;
+
+CREATE TRIGGER approval_correlations_count_insert
+AFTER INSERT ON approval_correlations
+BEGIN
+    UPDATE approval_correlation_state
+    SET correlation_count = correlation_count + 1
+    WHERE id = 1;
+END;
+
+CREATE TRIGGER approval_correlations_initial_expiry
+BEFORE INSERT ON approval_correlations
+WHEN NEW.expires_at IS NOT NULL
+BEGIN
+    SELECT RAISE(ABORT, 'new approval correlation expiry must be null');
+END;
+
+CREATE TRIGGER approvals_insert_correlation
+AFTER INSERT ON approvals
+BEGIN
+    INSERT INTO approval_correlations (
+        execution_id, call_id, approval_id, actor_kind, actor_id, surface,
+        worker_generation, callable_path, arguments_digest, expires_at
+    ) VALUES (
+        NEW.execution_id, NEW.call_id, NEW.id, NEW.actor_kind, NEW.actor_id, NEW.surface,
+        NEW.worker_generation, NEW.callable_path_snapshot, NEW.arguments_digest, NULL
+    );
+END;
+
+CREATE TRIGGER approval_correlations_immutable
+BEFORE UPDATE OF
+    execution_id, call_id, approval_id, actor_kind, actor_id, surface,
+    worker_generation, callable_path, arguments_digest
+ON approval_correlations
+BEGIN
+    SELECT RAISE(ABORT, 'approval correlation is immutable');
+END;
+
+CREATE TRIGGER approval_correlations_expiry_transition
+BEFORE UPDATE OF expires_at ON approval_correlations
+WHEN NOT (
+    OLD.expires_at IS NULL
+    AND NEW.expires_at = (
+        SELECT completed_at + 86400
+        FROM approvals
+        WHERE id = OLD.approval_id
+          AND status IN ('denied', 'expired', 'canceled', 'succeeded', 'failed', 'stale', 'interrupted')
+    )
+)
+BEGIN
+    SELECT RAISE(ABORT, 'approval correlation expiry transition is invalid');
+END;
+
+CREATE TRIGGER approvals_terminalize_correlation
+AFTER UPDATE OF status ON approvals
+WHEN NEW.status <> OLD.status
+ AND NEW.status IN ('denied', 'expired', 'canceled', 'succeeded', 'failed', 'stale', 'interrupted')
+BEGIN
+    UPDATE approval_correlations
+    SET expires_at = NEW.completed_at + 86400
+    WHERE approval_id = NEW.id AND expires_at IS NULL;
+END;
+
+CREATE TRIGGER approval_correlations_delete_guard
+BEFORE DELETE ON approval_correlations
+WHEN OLD.expires_at IS NULL
+  OR OLD.expires_at > (SELECT effective_now FROM approval_clock WHERE id = 1)
+BEGIN
+    SELECT RAISE(ABORT, 'unexpired approval correlation cannot be deleted');
+END;
+
+CREATE TRIGGER approval_correlations_count_delete
+AFTER DELETE ON approval_correlations
+BEGIN
+    UPDATE approval_correlation_state
+    SET correlation_count = correlation_count - 1
+    WHERE id = 1;
+    DELETE FROM approvals
+    WHERE id = OLD.approval_id
+      AND status IN ('denied', 'expired', 'canceled', 'succeeded', 'failed', 'stale', 'interrupted');
+END;
diff --git a/migrations/20260623060000_approval_delivery_pins.sql b/migrations/20260623060000_approval_delivery_pins.sql
new file mode 100644
index 000000000..4cefa3a16
--- /dev/null
+++ b/migrations/20260623060000_approval_delivery_pins.sql
@@ -0,0 +1,10 @@
+PRAGMA foreign_keys = ON;
+
+CREATE TABLE approval_delivery_pins (
+    approval_id TEXT PRIMARY KEY NOT NULL
+        REFERENCES approvals(id) ON DELETE RESTRICT,
+    ref_count INTEGER NOT NULL CHECK (ref_count BETWEEN 1 AND 128),
+    snapshot_ciphertext_bytes INTEGER NOT NULL
+        CHECK (snapshot_ciphertext_bytes BETWEEN 1 AND 67108864),
+    created_at INTEGER NOT NULL
+) STRICT;
diff --git a/migrations/20260624000000_oauth.sql b/migrations/20260624000000_oauth.sql
new file mode 100644
index 000000000..f19a4ef5b
--- /dev/null
+++ b/migrations/20260624000000_oauth.sql
@@ -0,0 +1,246 @@
+PRAGMA foreign_keys = ON;
+
+CREATE TABLE oauth_connections (
+    id TEXT PRIMARY KEY NOT NULL CHECK (length(id) BETWEEN 1 AND 128),
+    source_id TEXT NOT NULL REFERENCES sources(id) ON DELETE CASCADE,
+    credential_key TEXT NOT NULL CHECK (length(credential_key) BETWEEN 1 AND 128),
+    revision INTEGER NOT NULL CHECK (revision >= 0),
+    current_config_revision INTEGER NOT NULL
+        CHECK (current_config_revision > 0),
+    current_secret_revision INTEGER
+        CHECK (current_secret_revision IS NULL OR current_secret_revision > 0),
+    status TEXT NOT NULL
+        CHECK (status IN ('pending_authorization', 'connecting', 'active', 'reauth_required')),
+    granted_scopes_json TEXT NOT NULL DEFAULT '[]'
+        CHECK (json_valid(granted_scopes_json))
+        CHECK (json_type(granted_scopes_json) = 'array'),
+    has_client_secret INTEGER NOT NULL DEFAULT 0 CHECK (has_client_secret IN (0, 1)),
+    has_refresh_token INTEGER NOT NULL DEFAULT 0 CHECK (has_refresh_token IN (0, 1)),
+    access_expires_at INTEGER,
+    authorized_at INTEGER,
+    last_refreshed_at INTEGER,
+    error_code TEXT
+        CHECK (error_code IS NULL OR length(error_code) BETWEEN 1 AND 128),
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL,
+    UNIQUE (source_id, credential_key),
+    FOREIGN KEY (id, current_config_revision)
+        REFERENCES oauth_connection_config_revisions(connection_id, revision)
+        DEFERRABLE INITIALLY DEFERRED,
+    FOREIGN KEY (id, current_secret_revision)
+        REFERENCES oauth_connection_secret_revisions(connection_id, revision)
+        DEFERRABLE INITIALLY DEFERRED,
+    CHECK (
+        status <> 'reauth_required' OR error_code IS NOT NULL
+    )
+) STRICT;
+
+CREATE TABLE oauth_connection_config_revisions (
+    connection_id TEXT NOT NULL
+        REFERENCES oauth_connections(id) ON DELETE CASCADE,
+    revision INTEGER NOT NULL CHECK (revision > 0),
+    config_json TEXT NOT NULL
+        CHECK (length(config_json) BETWEEN 2 AND 65536)
+        CHECK (json_valid(config_json))
+        CHECK (json_type(config_json) = 'object'),
+    created_at INTEGER NOT NULL,
+    PRIMARY KEY (connection_id, revision)
+) STRICT;
+
+CREATE TABLE oauth_connection_secret_revisions (
+    connection_id TEXT NOT NULL
+        REFERENCES oauth_connections(id) ON DELETE CASCADE,
+    revision INTEGER NOT NULL CHECK (revision > 0),
+    payload_ciphertext BLOB NOT NULL
+        CHECK (length(payload_ciphertext) BETWEEN 42 AND 262186),
+    access_token_expires_at INTEGER,
+    created_at INTEGER NOT NULL,
+    PRIMARY KEY (connection_id, revision)
+) STRICT;
+
+CREATE TABLE oauth_authorization_transactions (
+    id TEXT PRIMARY KEY NOT NULL CHECK (length(id) BETWEEN 1 AND 128),
+    connection_id TEXT NOT NULL
+        REFERENCES oauth_connections(id) ON DELETE CASCADE,
+    connection_revision INTEGER NOT NULL CHECK (connection_revision >= 0),
+    config_revision INTEGER NOT NULL CHECK (config_revision > 0),
+    base_secret_revision INTEGER
+        CHECK (base_secret_revision IS NULL OR base_secret_revision > 0),
+    state_digest BLOB NOT NULL UNIQUE CHECK (length(state_digest) = 32),
+    admin_session_digest BLOB NOT NULL CHECK (length(admin_session_digest) = 32),
+    pkce_verifier_ciphertext BLOB NOT NULL
+        CHECK (length(pkce_verifier_ciphertext) BETWEEN 42 AND 8192),
+    exchange_claim_digest BLOB CHECK (
+        exchange_claim_digest IS NULL OR length(exchange_claim_digest) = 32
+    ),
+    status TEXT NOT NULL
+        CHECK (status IN ('pending', 'exchanging', 'succeeded', 'failed', 'expired')),
+    result_secret_revision INTEGER
+        CHECK (result_secret_revision IS NULL OR result_secret_revision > 0),
+    error_code TEXT CHECK (error_code IS NULL OR length(error_code) BETWEEN 1 AND 128),
+    created_at INTEGER NOT NULL,
+    expires_at INTEGER NOT NULL CHECK (expires_at > created_at),
+    claimed_at INTEGER,
+    exchange_expires_at INTEGER CHECK (
+        exchange_expires_at IS NULL OR exchange_expires_at > claimed_at
+    ),
+    completed_at INTEGER,
+    CHECK (
+        (status = 'pending'
+            AND exchange_claim_digest IS NULL
+            AND claimed_at IS NULL
+            AND exchange_expires_at IS NULL
+            AND completed_at IS NULL
+            AND result_secret_revision IS NULL
+            AND error_code IS NULL)
+        OR (status = 'exchanging'
+            AND exchange_claim_digest IS NOT NULL
+            AND claimed_at IS NOT NULL
+            AND exchange_expires_at IS NOT NULL
+            AND completed_at IS NULL
+            AND result_secret_revision IS NULL
+            AND error_code IS NULL)
+        OR (status = 'succeeded'
+            AND exchange_claim_digest IS NOT NULL
+            AND claimed_at IS NOT NULL
+            AND completed_at IS NOT NULL
+            AND result_secret_revision IS NOT NULL
+            AND error_code IS NULL)
+        OR (status IN ('failed', 'expired')
+            AND completed_at IS NOT NULL
+            AND result_secret_revision IS NULL
+            AND error_code IS NOT NULL)
+    )
+) STRICT;
+
+CREATE INDEX oauth_authorization_transactions_connection_idx
+    ON oauth_authorization_transactions(connection_id, created_at DESC);
+CREATE INDEX oauth_authorization_transactions_status_expiry_idx
+    ON oauth_authorization_transactions(status, expires_at);
+
+CREATE TABLE oauth_refresh_leases (
+    connection_id TEXT PRIMARY KEY NOT NULL
+        REFERENCES oauth_connections(id) ON DELETE CASCADE,
+    lease_digest BLOB NOT NULL UNIQUE CHECK (length(lease_digest) = 32),
+    base_secret_revision INTEGER NOT NULL CHECK (base_secret_revision > 0),
+    claimed_at INTEGER NOT NULL,
+    expires_at INTEGER NOT NULL CHECK (expires_at > claimed_at)
+) STRICT;
+
+CREATE INDEX oauth_refresh_leases_expiry_idx
+    ON oauth_refresh_leases(expires_at);
+
+CREATE TRIGGER oauth_config_revisions_immutable
+BEFORE UPDATE ON oauth_connection_config_revisions
+BEGIN
+    SELECT RAISE(ABORT, 'OAuth config revisions are immutable');
+END;
+
+CREATE TRIGGER oauth_secret_revisions_immutable
+BEFORE UPDATE ON oauth_connection_secret_revisions
+BEGIN
+    SELECT RAISE(ABORT, 'OAuth secret revisions are immutable');
+END;
+
+CREATE TRIGGER oauth_current_config_revision_delete_guard
+BEFORE DELETE ON oauth_connection_config_revisions
+WHEN EXISTS (
+    SELECT 1 FROM oauth_connections
+    WHERE id = OLD.connection_id AND current_config_revision = OLD.revision
+)
+BEGIN
+    SELECT RAISE(ABORT, 'current OAuth config revision cannot be deleted');
+END;
+
+CREATE TRIGGER oauth_current_secret_revision_delete_guard
+BEFORE DELETE ON oauth_connection_secret_revisions
+WHEN EXISTS (
+    SELECT 1 FROM oauth_connections
+    WHERE id = OLD.connection_id AND current_secret_revision = OLD.revision
+)
+BEGIN
+    SELECT RAISE(ABORT, 'current OAuth secret revision cannot be deleted');
+END;
+
+CREATE TRIGGER oauth_connections_config_pointer_valid
+BEFORE UPDATE OF current_config_revision ON oauth_connections
+WHEN NOT EXISTS (
+    SELECT 1 FROM oauth_connection_config_revisions
+    WHERE connection_id = OLD.id AND revision = NEW.current_config_revision
+)
+BEGIN
+    SELECT RAISE(ABORT, 'OAuth config revision does not exist');
+END;
+
+CREATE TRIGGER oauth_connections_secret_pointer_valid
+BEFORE UPDATE OF current_secret_revision ON oauth_connections
+WHEN NEW.current_secret_revision IS NOT NULL AND NOT EXISTS (
+    SELECT 1 FROM oauth_connection_secret_revisions
+    WHERE connection_id = OLD.id AND revision = NEW.current_secret_revision
+)
+BEGIN
+    SELECT RAISE(ABORT, 'OAuth secret revision does not exist');
+END;
+
+CREATE TRIGGER oauth_authorization_transactions_immutable_binding
+BEFORE UPDATE OF
+    id, connection_id, connection_revision, config_revision, base_secret_revision, state_digest,
+    admin_session_digest, pkce_verifier_ciphertext, created_at, expires_at
+ON oauth_authorization_transactions
+BEGIN
+    SELECT RAISE(ABORT, 'OAuth authorization transaction binding is immutable');
+END;
+
+CREATE TRIGGER oauth_authorization_transactions_legal_transition
+BEFORE UPDATE OF status ON oauth_authorization_transactions
+WHEN NEW.status <> OLD.status AND NOT (
+    (OLD.status = 'pending' AND NEW.status IN ('exchanging', 'failed', 'expired'))
+    OR (OLD.status = 'exchanging' AND NEW.status IN ('succeeded', 'failed'))
+)
+BEGIN
+    SELECT RAISE(ABORT, 'illegal OAuth authorization transaction transition');
+END;
+
+CREATE TRIGGER oauth_authorization_transactions_claim_transition
+BEFORE UPDATE OF exchange_claim_digest, claimed_at, exchange_expires_at
+ON oauth_authorization_transactions
+WHEN NOT (
+    OLD.status = 'pending'
+    AND NEW.status = 'exchanging'
+    AND OLD.exchange_claim_digest IS NULL
+    AND NEW.exchange_claim_digest IS NOT NULL
+    AND OLD.claimed_at IS NULL
+    AND NEW.claimed_at IS NOT NULL
+    AND OLD.exchange_expires_at IS NULL
+    AND NEW.exchange_expires_at > NEW.claimed_at
+)
+BEGIN
+    SELECT RAISE(ABORT, 'invalid OAuth authorization exchange claim');
+END;
+
+CREATE TRIGGER oauth_authorization_transactions_capacity
+BEFORE INSERT ON oauth_authorization_transactions
+WHEN (
+    SELECT count(*) FROM oauth_authorization_transactions
+    WHERE connection_id = NEW.connection_id AND status IN ('pending', 'exchanging')
+) >= 128
+BEGIN
+    SELECT RAISE(ABORT, 'OAuth authorization transaction capacity reached');
+END;
+
+CREATE TRIGGER oauth_authorization_transactions_terminal_retention
+AFTER UPDATE OF status ON oauth_authorization_transactions
+WHEN NEW.status <> OLD.status
+ AND NEW.status IN ('succeeded', 'failed', 'expired')
+ AND (
+    SELECT count(*) FROM oauth_authorization_transactions
+    WHERE status IN ('succeeded', 'failed', 'expired')
+ ) > 10000
+BEGIN
+    DELETE FROM oauth_authorization_transactions
+    WHERE rowid IN (
+        SELECT rowid FROM oauth_authorization_transactions
+        WHERE status IN ('succeeded', 'failed', 'expired')
+        ORDER BY rowid DESC LIMIT -1 OFFSET 10000
+    );
+END;
diff --git a/migrations/20260624010000_source_creation_idempotency.sql b/migrations/20260624010000_source_creation_idempotency.sql
new file mode 100644
index 000000000..d8a46d2b7
--- /dev/null
+++ b/migrations/20260624010000_source_creation_idempotency.sql
@@ -0,0 +1,83 @@
+PRAGMA foreign_keys = ON;
+
+CREATE TABLE source_creation_idempotency_clock (
+    id INTEGER PRIMARY KEY NOT NULL CHECK (id = 1),
+    effective_now INTEGER NOT NULL CHECK (effective_now >= 0)
+) STRICT;
+
+INSERT INTO source_creation_idempotency_clock (id, effective_now) VALUES (1, 0);
+
+CREATE TABLE source_creation_idempotency (
+    sequence INTEGER PRIMARY KEY AUTOINCREMENT,
+    id TEXT NOT NULL UNIQUE CHECK (length(id) BETWEEN 1 AND 128),
+    admin_id INTEGER NOT NULL REFERENCES admins(id) ON DELETE CASCADE,
+    route TEXT NOT NULL CHECK (length(route) BETWEEN 1 AND 200),
+    key_digest BLOB NOT NULL CHECK (length(key_digest) = 32),
+    request_digest BLOB CHECK (
+        request_digest IS NULL OR length(request_digest) = 32
+    ),
+    state TEXT NOT NULL CHECK (
+        state IN ('reserved', 'completed', 'failed', 'abandoned', 'interrupted')
+    ),
+    response_ciphertext BLOB CHECK (
+        response_ciphertext IS NULL
+        OR length(response_ciphertext) BETWEEN 42 AND 25165824
+    ),
+    created_at INTEGER NOT NULL CHECK (created_at >= 0),
+    updated_at INTEGER NOT NULL CHECK (updated_at >= created_at),
+    completed_at INTEGER,
+    expires_at INTEGER,
+    purge_at INTEGER,
+    UNIQUE (admin_id, route, key_digest),
+    CHECK (
+        (state = 'reserved'
+            AND request_digest IS NOT NULL
+            AND response_ciphertext IS NULL
+            AND completed_at IS NULL
+            AND expires_at IS NULL
+            AND purge_at IS NULL)
+        OR (state IN ('completed', 'failed')
+            AND request_digest IS NOT NULL
+            AND response_ciphertext IS NOT NULL
+            AND completed_at IS NOT NULL
+            AND expires_at > completed_at
+            AND purge_at > expires_at)
+        OR (state IN ('abandoned', 'interrupted')
+            AND response_ciphertext IS NULL
+            AND completed_at IS NOT NULL
+            AND expires_at > completed_at
+            AND purge_at > expires_at)
+    )
+) STRICT;
+
+CREATE INDEX source_creation_idempotency_expiry_idx
+    ON source_creation_idempotency(purge_at)
+    WHERE purge_at IS NOT NULL;
+
+CREATE INDEX source_creation_idempotency_admin_route_idx
+    ON source_creation_idempotency(admin_id, route, sequence DESC);
+
+CREATE TRIGGER source_creation_idempotency_immutable_binding
+BEFORE UPDATE OF id, admin_id, route, key_digest, request_digest, created_at
+ON source_creation_idempotency
+BEGIN
+    SELECT RAISE(ABORT, 'source creation idempotency binding is immutable');
+END;
+
+CREATE TRIGGER source_creation_idempotency_legal_transition
+BEFORE UPDATE OF state ON source_creation_idempotency
+WHEN NEW.state <> OLD.state AND NOT (
+    OLD.state = 'reserved'
+    AND NEW.state IN ('completed', 'failed', 'abandoned', 'interrupted')
+)
+BEGIN
+    SELECT RAISE(ABORT, 'illegal source creation idempotency state transition');
+END;
+
+CREATE TRIGGER source_creation_idempotency_immutable_terminal
+BEFORE UPDATE OF response_ciphertext, completed_at, expires_at, purge_at, updated_at
+ON source_creation_idempotency
+WHEN OLD.state IN ('completed', 'failed', 'abandoned', 'interrupted')
+BEGIN
+    SELECT RAISE(ABORT, 'terminal source creation idempotency response is immutable');
+END;
diff --git a/migrations/20260624020000_oauth_refresh_state_fence.sql b/migrations/20260624020000_oauth_refresh_state_fence.sql
new file mode 100644
index 000000000..80a6a9730
--- /dev/null
+++ b/migrations/20260624020000_oauth_refresh_state_fence.sql
@@ -0,0 +1,28 @@
+ALTER TABLE oauth_refresh_leases RENAME TO oauth_refresh_leases_unfenced;
+
+CREATE TABLE oauth_refresh_leases (
+    connection_id TEXT PRIMARY KEY NOT NULL
+        REFERENCES oauth_connections(id) ON DELETE CASCADE,
+    lease_digest BLOB NOT NULL UNIQUE CHECK (length(lease_digest) = 32),
+    base_secret_revision INTEGER NOT NULL CHECK (base_secret_revision > 0),
+    connection_revision INTEGER NOT NULL CHECK (connection_revision >= 0),
+    config_revision INTEGER NOT NULL CHECK (config_revision > 0),
+    claimed_at INTEGER NOT NULL,
+    expires_at INTEGER NOT NULL CHECK (expires_at > claimed_at)
+) STRICT;
+
+INSERT INTO oauth_refresh_leases (
+    connection_id, lease_digest, base_secret_revision,
+    connection_revision, config_revision, claimed_at, expires_at
+)
+SELECT
+    lease.connection_id, lease.lease_digest, lease.base_secret_revision,
+    connection.revision, connection.current_config_revision,
+    lease.claimed_at, lease.expires_at
+FROM oauth_refresh_leases_unfenced lease
+JOIN oauth_connections connection ON connection.id = lease.connection_id;
+
+DROP TABLE oauth_refresh_leases_unfenced;
+
+CREATE INDEX oauth_refresh_leases_expiry_idx
+    ON oauth_refresh_leases(expires_at);
diff --git a/migrations/20260624030000_api_token_creation_idempotency.sql b/migrations/20260624030000_api_token_creation_idempotency.sql
new file mode 100644
index 000000000..7ff342484
--- /dev/null
+++ b/migrations/20260624030000_api_token_creation_idempotency.sql
@@ -0,0 +1,20 @@
+PRAGMA foreign_keys = ON;
+
+CREATE TABLE api_token_creation_idempotency (
+    record_id TEXT PRIMARY KEY NOT NULL CHECK (length(record_id) BETWEEN 1 AND 128),
+    admin_id INTEGER NOT NULL REFERENCES admins(id) ON DELETE CASCADE,
+    key_digest BLOB NOT NULL CHECK (length(key_digest) = 32),
+    request_digest BLOB NOT NULL CHECK (length(request_digest) = 32),
+    token_id TEXT NOT NULL UNIQUE REFERENCES api_tokens(id) ON DELETE RESTRICT,
+    created_at INTEGER NOT NULL CHECK (created_at >= 0),
+    UNIQUE (admin_id, key_digest)
+) STRICT;
+
+CREATE INDEX api_token_creation_idempotency_admin_idx
+    ON api_token_creation_idempotency(admin_id, created_at DESC);
+
+CREATE TRIGGER api_token_creation_idempotency_immutable
+BEFORE UPDATE ON api_token_creation_idempotency
+BEGIN
+    SELECT RAISE(ABORT, 'API token creation idempotency records are immutable');
+END;
diff --git a/opencode.json b/opencode.json
index 915fccd69..8f9b80710 100644
--- a/opencode.json
+++ b/opencode.json
@@ -1,19 +1,4 @@
 {
   "$schema": "https://opencode.ai/config.json",
-  "mcp": {
-    "executor": {
-      "type": "remote",
-      "url": "https://executor-local.localhost:1355/mcp",
-      "enabled": true,
-      "command": [
-        "bun",
-        "run",
-        "dev:cli",
-        "mcp",
-        "--scope",
-        "/Users/rhyssullivan/src/executor/apps/local"
-      ],
-      "environment": {}
-    }
-  }
+  "mcp": {}
 }
diff --git a/package.json b/package.json
index 8f40bea46..3ae315110 100644
--- a/package.json
+++ b/package.json
@@ -11,77 +11,73 @@
     "executor",
     "local-first"
   ],
-  "homepage": "https://github.com/RhysSullivan/executor",
+  "homepage": "https://github.com/davis7dotsh/executor-fork-testing",
   "bugs": {
-    "url": "https://github.com/RhysSullivan/executor/issues"
+    "url": "https://github.com/davis7dotsh/executor-fork-testing/issues"
   },
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/RhysSullivan/executor.git"
+    "url": "git+https://github.com/davis7dotsh/executor-fork-testing.git"
   },
   "workspaces": [
     "packages/*/*",
     "packages/react",
     "packages/app",
     "apps/*",
+    "legacy/*",
     "examples/*",
-    "e2e"
+    "e2e",
+    "web"
   ],
   "type": "module",
   "scripts": {
     "bootstrap": "bun run scripts/bootstrap.ts",
     "reap": "bun run scripts/reap-dev-servers.ts",
-    "dev": "turbo run dev --filter='!@executor-js/desktop' --filter='!@executor-js/cloud'",
-    "dev:desktop": "turbo run dev",
-    "dev:cli": "EXECUTOR_DEV=1 EXECUTOR_DATA_DIR=${EXECUTOR_DATA_DIR:-apps/local/.executor-dev} bun run apps/cli/src/main.ts",
-    "test": "turbo run test --filter=!@executor-js/e2e",
-    "test:e2e": "bun run --cwd e2e test",
+    "dev": "turbo run dev --filter='!executor' --filter='!@executor-js/local' --filter='!@executor-js/host-cloudflare' --filter='!@executor-js/host-selfhost' --filter='!@executor-js/cloud' --filter='!@executor-js/desktop'",
+    "test": "turbo run test --filter='!@executor-js/e2e' --filter='!executor' --filter='!@executor-js/local' --filter='!@executor-js/host-cloudflare' --filter='!@executor-js/host-selfhost' --filter='!@executor-js/cloud' --filter='!@executor-js/desktop'",
+    "test:e2e": "bun run scripts/run-local-e2e.ts",
+    "test:release:installer": "bash scripts/test-install-release-archive.sh",
+    "test:release:systemd": "bash scripts/test-install-systemd-master-key.sh",
+    "test:release:shell": "bash -n scripts/install.sh scripts/install-systemd.sh scripts/install-launchd.sh scripts/lib/install-systemd-master-key.sh scripts/test-install-release-archive.sh scripts/smoke-release-server.sh scripts/smoke-release-container.sh scripts/verify-apple-toolchain.sh packaging/launchd/bounded-log.sh",
+    "test:release:static": "vitest run tests/release-workflows.test.ts tests/release-dockerfile.test.ts",
     "test:release:bootstrap": "vitest run tests/release-bootstrap-smoke.test.ts",
     "build:packages": "bun run --filter='@executor-js/fumadb' build && bun run --filter='@executor-js/codemode-core' build && bun run --filter='@executor-js/runtime-quickjs' build && bun run --filter='@executor-js/sdk' build && bun run --filter='@executor-js/config' build && bun run --filter='@executor-js/execution' build && bun run --filter='@executor-js/cli' build && bun run --filter='@executor-js/plugin-*' build",
-    "typecheck": "turbo run typecheck",
-    "typecheck:slow": "turbo run typecheck:slow",
+    "typecheck": "turbo run typecheck --filter='!executor' --filter='!@executor-js/local' --filter='!@executor-js/host-cloudflare' --filter='!@executor-js/host-selfhost' --filter='!@executor-js/cloud' --filter='!@executor-js/desktop'",
+    "typecheck:slow": "turbo run typecheck:slow --filter='!executor' --filter='!@executor-js/local' --filter='!@executor-js/host-cloudflare' --filter='!@executor-js/host-selfhost' --filter='!@executor-js/cloud' --filter='!@executor-js/desktop'",
+    "legacy:dev": "turbo run dev --filter='@executor-js/local' --filter='@executor-js/host-cloudflare' --filter='@executor-js/host-selfhost' --filter='@executor-js/cloud' --filter='@executor-js/desktop'",
+    "legacy:dev:cli": "EXECUTOR_DEV=1 EXECUTOR_DATA_DIR=${EXECUTOR_DATA_DIR:-legacy/local/.executor-dev} bun run legacy/cli/src/main.ts",
+    "legacy:test": "turbo run test --filter='executor' --filter='@executor-js/local' --filter='@executor-js/host-cloudflare' --filter='@executor-js/host-selfhost' --filter='@executor-js/cloud' --filter='@executor-js/desktop'",
+    "legacy:test:e2e:cloud": "bun run --cwd e2e test:legacy:cloud",
+    "legacy:test:e2e:desktop": "bun run --cwd e2e test:legacy:desktop",
+    "legacy:typecheck": "turbo run typecheck --filter='executor' --filter='@executor-js/local' --filter='@executor-js/host-cloudflare' --filter='@executor-js/host-selfhost' --filter='@executor-js/cloud' --filter='@executor-js/desktop'",
+    "legacy:typecheck:slow": "bun run --filter='./legacy/*' typecheck:slow",
     "ci": "bun run lint && bun run typecheck && bun run test",
-    "lint": "oxlint -c .oxlintrc.jsonc . --deny-warnings && bun run lint:changelog-stubs",
-    "lint:changelog-stubs": "bun run scripts/check-changelog-stubs.ts",
+    "lint": "oxlint -c .oxlintrc.jsonc . --deny-warnings && bun run lint:docker-workspace-context && bun run lint:warden-targets",
+    "lint:docker-workspace-context": "bun run scripts/check-docker-workspace-context.ts",
+    "lint:warden-targets": "bun run scripts/check-warden-targets.ts",
     "lint:fix": "oxlint -c .oxlintrc.jsonc --fix .",
     "docs:snippets": "bun run scripts/generate-doc-snippets.ts",
-    "docs:smoke:install": "bun run scripts/smoke-docs-install.ts",
     "smoke:agent-config": "bun run scripts/agent-config-smoke.ts",
     "format": "oxfmt .",
     "format:check": "oxfmt --check .",
     "pull:references": "bun run scripts/pull-references.ts",
-    "changeset": "changeset",
-    "changeset:version": "changeset version && bun install --lockfile-only && oxfmt .",
-    "release:check": "bun run --cwd apps/cli typecheck && bun run test:release:bootstrap && bun run release:publish:dry-run",
-    "release:pre:enter": "changeset pre enter beta",
-    "release:pre:exit": "changeset pre exit",
-    "release:beta:start": "changeset pre enter beta",
-    "release:beta:stop": "changeset pre exit",
-    "release:publish:dry-run": "bun run --cwd apps/cli release:publish:dry-run",
-    "release:publish": "bun run --cwd apps/cli release:publish",
-    "release:publish:packages": "bun run scripts/publish-packages.ts",
-    "release:publish:packages:dry-run": "bun run scripts/publish-packages.ts --dry-run",
-    "release:publish:packages:prepare": "bun run scripts/publish-packages.ts --prepare-only",
-    "release:smoke:packages": "bun run scripts/smoke-test-packed.ts",
     "clean": "bun run scripts/clean.ts",
     "prepare": "effect-language-service patch && effect-tsgo patch && bun run --cwd packages/core/vite-plugin build:bundle && bun run --cwd packages/react build"
   },
   "dependencies": {},
   "devDependencies": {
-    "@changesets/changelog-github": "^0.7.0",
-    "@changesets/cli": "^2.30.0",
     "@effect/language-service": "^0.85.1",
     "@effect/tsgo": "^0.5.2",
     "@effect/vitest": "catalog:",
     "@typescript/native-preview": "^7.0.0-dev.20260410.1",
-    "@vitest/expect": "catalog:",
-    "@vitest/mocker": "catalog:",
-    "@vitest/pretty-format": "catalog:",
-    "@vitest/runner": "catalog:",
-    "@vitest/snapshot": "catalog:",
-    "@vitest/spy": "catalog:",
-    "@vitest/utils": "catalog:",
+    "@vitest/expect": "4.1.9",
+    "@vitest/mocker": "4.1.9",
+    "@vitest/pretty-format": "4.1.9",
+    "@vitest/runner": "4.1.9",
+    "@vitest/snapshot": "4.1.9",
+    "@vitest/spy": "4.1.9",
+    "@vitest/utils": "4.1.9",
     "atmn": "^1.1.8",
     "effect": "catalog:",
     "knip": "^6.3.0",
@@ -89,7 +85,7 @@
     "oxlint": "^1.56.0",
     "turbo": "^2.5.6",
     "typescript": "^5.9.3",
-    "vitest": "catalog:"
+    "vitest": "4.1.9"
   },
   "packageManager": "bun@1.3.11",
   "catalog": {
diff --git a/packages/app/vite.config.ts b/packages/app/vite.config.ts
index fcff0014b..0a1fdba4c 100644
--- a/packages/app/vite.config.ts
+++ b/packages/app/vite.config.ts
@@ -3,10 +3,12 @@ import { defineConfig } from "vite";
 import appPlugin from "./vite";
 
 // Standalone Vite config for iterating on the SPA in isolation, without
-// the apps/local API middleware or Electron sidecar. API/MCP calls fail
+// the legacy/local API middleware or Electron sidecar. API/MCP calls fail
 // here unless a separate server is running.
-const LOCAL_CONFIG = fileURLToPath(new URL("../../apps/local/executor.config.ts", import.meta.url));
-const LOCAL_JSONC = fileURLToPath(new URL("../../apps/local/executor.jsonc", import.meta.url));
+const LOCAL_CONFIG = fileURLToPath(
+  new URL("../../legacy/local/executor.config.ts", import.meta.url),
+);
+const LOCAL_JSONC = fileURLToPath(new URL("../../legacy/local/executor.jsonc", import.meta.url));
 const REPO_ROOT = fileURLToPath(new URL("../..", import.meta.url));
 
 export default defineConfig({
diff --git a/packages/app/vite.ts b/packages/app/vite.ts
index 51e27e890..4d1beaff0 100644
--- a/packages/app/vite.ts
+++ b/packages/app/vite.ts
@@ -14,7 +14,7 @@ interface AppPluginOptions {
    * Absolute path to the `executor.config.ts` whose plugin list should
    * feed `virtual:executor/plugins-client`. The Vite root for this app
    * is `packages/app/` which has no executor.config, so consumers must
-   * point this at their own (typically `apps/local/executor.config.ts`).
+   * point this at their own (typically `legacy/local/executor.config.ts`).
    *
    * If omitted, no plugin UIs get bundled — the renderer still works
    * for built-in pages but Sources / Connections / etc. plugin pages
@@ -28,7 +28,7 @@ interface AppPluginOptions {
 /**
  * Vite plugin bundle for the executor React app.
  *
- * Layered into apps/local's vite config (web build) and apps/desktop's
+ * Layered into legacy/local's vite config (web build) and legacy/desktop's
  * electron.vite renderer config. Consumers must pass `executorConfigPath`
  * so plugin client bundles get included — see option docs above.
  *
diff --git a/packages/core/api/src/observability.ts b/packages/core/api/src/observability.ts
index 1bda74d5a..74999cc55 100644
--- a/packages/core/api/src/observability.ts
+++ b/packages/core/api/src/observability.ts
@@ -25,7 +25,7 @@
 //      once; catches any cause that slipped past the typed channel and
 //      produces the same `InternalError({ traceId })` shape.
 //
-// Distinct from `apps/cloud/src/services/telemetry.ts` — that's the
+// Distinct from `legacy/cloud/src/services/telemetry.ts`, that's the
 // OTEL bridge wiring spans to Axiom; this is exception capture in the
 // Sentry sense.
 // ---------------------------------------------------------------------------
diff --git a/packages/core/api/src/server/request-scoped.ts b/packages/core/api/src/server/request-scoped.ts
index 1436d851b..f01ac1cdb 100644
--- a/packages/core/api/src/server/request-scoped.ts
+++ b/packages/core/api/src/server/request-scoped.ts
@@ -25,7 +25,7 @@
 // shared across two request handlers, which the runtime forbids). A
 // per-request MemoMap scopes memoization to a single request fiber.
 //
-// See `apps/cloud/src/api.request-scope.node.test.ts` for the regression
+// See `legacy/cloud/src/api.request-scope.node.test.ts` for the regression
 // coverage that pins this rule down (sequential AND concurrent cases).
 // ---------------------------------------------------------------------------
 
diff --git a/packages/core/cli/package.json b/packages/core/cli/package.json
index d62995c70..b7dd916cb 100644
--- a/packages/core/cli/package.json
+++ b/packages/core/cli/package.json
@@ -1,6 +1,7 @@
 {
   "name": "@executor-js/cli",
   "version": "0.2.26",
+  "private": true,
   "description": "CLI for the executor SDK — schema generation, migrations",
   "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/core/cli",
   "bugs": {
diff --git a/packages/core/config/package.json b/packages/core/config/package.json
index 738cf8159..d3887cb84 100644
--- a/packages/core/config/package.json
+++ b/packages/core/config/package.json
@@ -1,6 +1,7 @@
 {
   "name": "@executor-js/config",
   "version": "1.5.20",
+  "private": true,
   "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/core/config",
   "bugs": {
     "url": "https://github.com/RhysSullivan/executor/issues"
diff --git a/packages/core/execution/package.json b/packages/core/execution/package.json
index b0bf17e25..b91220ce5 100644
--- a/packages/core/execution/package.json
+++ b/packages/core/execution/package.json
@@ -1,6 +1,7 @@
 {
   "name": "@executor-js/execution",
   "version": "1.5.20",
+  "private": true,
   "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/core/execution",
   "bugs": {
     "url": "https://github.com/RhysSullivan/executor/issues"
diff --git a/packages/core/execution/src/promise.ts b/packages/core/execution/src/promise.ts
index cf57304a5..5995825f8 100644
--- a/packages/core/execution/src/promise.ts
+++ b/packages/core/execution/src/promise.ts
@@ -135,7 +135,7 @@ const wrapPromiseExecutor = (pe: PromiseExecutor): EffectExecutor => {
 /**
  * Promise-wrap an Effect-native `ExecutionEngine` (from `./engine`).
  * Exposed separately so callers that already hold an Effect engine
- * (apps/cloud's execution-stack composes both) can convert it for hosts
+ * (legacy/cloud's execution-stack composes both) can convert it for hosts
  * that need the Promise surface (host-mcp).
  */
 export const toPromiseExecutionEngine = <E extends Cause.YieldableError>(
diff --git a/packages/core/fumadb/package.json b/packages/core/fumadb/package.json
index ccd101adf..d6152f961 100644
--- a/packages/core/fumadb/package.json
+++ b/packages/core/fumadb/package.json
@@ -2,6 +2,7 @@
   "name": "@executor-js/fumadb",
   "description": "A library for interacting with different databases for your package.",
   "version": "1.5.7",
+  "private": true,
   "repository": {
     "type": "git",
     "url": "git+https://github.com/RhysSullivan/executor.git",
diff --git a/packages/core/fumadb/src/adapters/drizzle/runtime-ensure.test.ts b/packages/core/fumadb/src/adapters/drizzle/runtime-ensure.test.ts
index e49552d7e..5c0dff20b 100644
--- a/packages/core/fumadb/src/adapters/drizzle/runtime-ensure.test.ts
+++ b/packages/core/fumadb/src/adapters/drizzle/runtime-ensure.test.ts
@@ -38,8 +38,8 @@ const columnNames = async (client: ReturnType<typeof createClient>): Promise<rea
   return info.rows.map((row) => String(row["name"]));
 };
 
-// This is the boot bring-up that backs apps/local, apps/host-selfhost, and
-// apps/host-cloudflare: `CREATE TABLE IF NOT EXISTS` never alters an existing
+// This is the boot bring-up that backs legacy/local, legacy/host-selfhost, and
+// legacy/host-cloudflare: `CREATE TABLE IF NOT EXISTS` never alters an existing
 // table, so without column evolution a file from an earlier baseline would
 // 500 on the first query against a new column. (Cloud Postgres gets the same
 // columns from a generated drizzle migration instead.)
diff --git a/packages/core/sdk/package.json b/packages/core/sdk/package.json
index 2d367417e..29bc0a674 100644
--- a/packages/core/sdk/package.json
+++ b/packages/core/sdk/package.json
@@ -1,6 +1,7 @@
 {
   "name": "@executor-js/sdk",
   "version": "1.5.20",
+  "private": true,
   "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/core/sdk",
   "bugs": {
     "url": "https://github.com/RhysSullivan/executor/issues"
diff --git a/packages/core/sdk/src/plugin-storage.test.ts b/packages/core/sdk/src/plugin-storage.test.ts
index a547d06a5..95c7c0b71 100644
--- a/packages/core/sdk/src/plugin-storage.test.ts
+++ b/packages/core/sdk/src/plugin-storage.test.ts
@@ -222,29 +222,32 @@ describe("plugin storage collections", () => {
     }),
   );
 
-  it.effect("bulk puts large plugin storage row sets in bounded batches", () =>
-    Effect.gen(function* () {
-      const executor = yield* makeTestExecutor({
-        backend: "sqlite",
-        plugins: [executionHistoryPlugin] as const,
-      });
-      const rows = Array.from({ length: 7_000 }, (_, index) => ({
-        key: `large-call-${String(index).padStart(5, "0")}`,
-        data: call({
-          runId: "run-large-bulk",
-          toolId: index % 2 === 0 ? "browser" : "shell",
-          status: "ok",
-          startedAt: new Date(Date.UTC(2026, 4, 29, 12, 0, index)).toISOString(),
-        }),
-      }));
+  it.effect(
+    "bulk puts large plugin storage row sets in bounded batches",
+    () =>
+      Effect.gen(function* () {
+        const executor = yield* makeTestExecutor({
+          backend: "sqlite",
+          plugins: [executionHistoryPlugin] as const,
+        });
+        const rows = Array.from({ length: 7_000 }, (_, index) => ({
+          key: `large-call-${String(index).padStart(5, "0")}`,
+          data: call({
+            runId: "run-large-bulk",
+            toolId: index % 2 === 0 ? "browser" : "shell",
+            status: "ok",
+            startedAt: new Date(Date.UTC(2026, 4, 29, 12, 0, index)).toISOString(),
+          }),
+        }));
 
-      yield* executor.executionHistory.recordMany("org", rows);
+        yield* executor.executionHistory.recordMany("org", rows);
 
-      const count = yield* executor.executionHistory.count({
-        where: { runId: "run-large-bulk" },
-      });
-      expect(count).toBe(rows.length);
-    }),
+        const count = yield* executor.executionHistory.count({
+          where: { runId: "run-large-bulk" },
+        });
+        expect(count).toBe(rows.length);
+      }),
+    15_000,
   );
 
   it.effect("user rows shadow org rows on read; both share one plugin_storage table", () =>
diff --git a/packages/core/vite-plugin/package.json b/packages/core/vite-plugin/package.json
index 3b138ce30..b9bacda90 100644
--- a/packages/core/vite-plugin/package.json
+++ b/packages/core/vite-plugin/package.json
@@ -1,6 +1,7 @@
 {
   "name": "@executor-js/vite-plugin",
   "version": "0.0.37",
+  "private": true,
   "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/core/vite-plugin",
   "bugs": {
     "url": "https://github.com/RhysSullivan/executor/issues"
diff --git a/packages/core/vite-plugin/src/index.ts b/packages/core/vite-plugin/src/index.ts
index 4b89e87dc..77a551a3d 100644
--- a/packages/core/vite-plugin/src/index.ts
+++ b/packages/core/vite-plugin/src/index.ts
@@ -187,7 +187,7 @@ export default function executorVitePlugin(options: ExecutorVitePluginOptions =
       const ident = `__executor_plugin_${exportExpressions.length}`;
       // Emit the absolute file path rather than `${pkg}/client`. Vite
       // resolves bare specifiers from its `root`, which for hosts like
-      // apps/local is `packages/app/` — a location that doesn't see
+      // legacy/local is `packages/app/`, a location that doesn't see
       // plugin packages installed under the consumer's node_modules.
       // Resolving here (from the consumer's executor.config dir) and
       // emitting the absolute path bypasses Vite's node_modules walk
diff --git a/packages/hosts/mcp/src/browser-approval-store.ts b/packages/hosts/mcp/src/browser-approval-store.ts
index 812b7c49e..825acac0f 100644
--- a/packages/hosts/mcp/src/browser-approval-store.ts
+++ b/packages/hosts/mcp/src/browser-approval-store.ts
@@ -1,6 +1,6 @@
 // ---------------------------------------------------------------------------
 // In-process browser-approval store — the single-process equivalent of the
-// Durable Object's persisted approval responses (apps/cloud, host-cloudflare).
+// Durable Object's persisted approval responses (legacy/cloud, host-cloudflare).
 //
 // It is the bridge between the two halves of a browser approval:
 //   - the MCP `resume` tool long-polls `store.waitForResponse(executionId)`,
diff --git a/packages/hosts/mcp/src/browser-approval.ts b/packages/hosts/mcp/src/browser-approval.ts
index fa6e34829..87ae439b0 100644
--- a/packages/hosts/mcp/src/browser-approval.ts
+++ b/packages/hosts/mcp/src/browser-approval.ts
@@ -9,7 +9,7 @@
 // host's `BrowserApprovalStore` — consumes it.
 //
 // Three hosts implement that flow over two transports: the in-process handler
-// (apps/local, host-selfhost) and the Durable Object (cloud, host-cloudflare).
+// (legacy/local, host-selfhost) and the Durable Object (cloud, host-cloudflare).
 // The wire-shape pieces are identical across all of them, so they live here
 // once: how the mode is read off the request, how the approval URL is built,
 // the resume-payload schema, and the acknowledgement text/structured content.
diff --git a/packages/hosts/mcp/src/stdio-integration.test.ts b/packages/hosts/mcp/src/stdio-integration.test.ts
index d66f9893f..1c039021d 100644
--- a/packages/hosts/mcp/src/stdio-integration.test.ts
+++ b/packages/hosts/mcp/src/stdio-integration.test.ts
@@ -7,8 +7,8 @@ import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 
 const repoRoot = resolve(import.meta.dirname, "../../../..");
-const cliEntry = resolve(repoRoot, "apps/cli/src/main.ts");
-const testScope = resolve(repoRoot, "apps/local");
+const cliEntry = resolve(repoRoot, "legacy/cli/src/main.ts");
+const testScope = resolve(repoRoot, "legacy/local");
 
 describe("MCP stdio integration", () => {
   it.effect(
diff --git a/packages/kernel/core/package.json b/packages/kernel/core/package.json
index 85bf6b721..fc2517036 100644
--- a/packages/kernel/core/package.json
+++ b/packages/kernel/core/package.json
@@ -1,6 +1,7 @@
 {
   "name": "@executor-js/codemode-core",
   "version": "1.5.20",
+  "private": true,
   "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/kernel/core",
   "bugs": {
     "url": "https://github.com/RhysSullivan/executor/issues"
diff --git a/packages/kernel/runtime-quickjs/package.json b/packages/kernel/runtime-quickjs/package.json
index 79cb1562e..47cbec5c5 100644
--- a/packages/kernel/runtime-quickjs/package.json
+++ b/packages/kernel/runtime-quickjs/package.json
@@ -1,6 +1,7 @@
 {
   "name": "@executor-js/runtime-quickjs",
   "version": "1.5.20",
+  "private": true,
   "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/kernel/runtime-quickjs",
   "bugs": {
     "url": "https://github.com/RhysSullivan/executor/issues"
diff --git a/packages/plugins/desktop-settings/package.json b/packages/plugins/desktop-settings/package.json
index 2e48df7c3..bc360afec 100644
--- a/packages/plugins/desktop-settings/package.json
+++ b/packages/plugins/desktop-settings/package.json
@@ -1,6 +1,7 @@
 {
   "name": "@executor-js/plugin-desktop-settings",
   "version": "1.5.20",
+  "private": true,
   "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/plugins/desktop-settings",
   "bugs": {
     "url": "https://github.com/RhysSullivan/executor/issues"
diff --git a/packages/plugins/desktop-settings/src/client.tsx b/packages/plugins/desktop-settings/src/client.tsx
index 3241cc4ac..ecf361aaa 100644
--- a/packages/plugins/desktop-settings/src/client.tsx
+++ b/packages/plugins/desktop-settings/src/client.tsx
@@ -5,9 +5,9 @@
  * A single page mounted at `/plugins/desktop-settings/` that lets the user
  * inspect and configure the Electron sidecar's server connection. Talks to
  * the main process via `window.executor.*` (exposed by
- * `apps/desktop/src/preload`).
+ * `legacy/desktop/src/preload`).
  *
- * The plugin is bundled into apps/local's renderer too (because executor
+ * The plugin is bundled into legacy/local's renderer too (because executor
  * web + desktop share the same client bundle pipeline), but the page
  * only registers a nav entry when `window.executor` is present at
  * module-init time — so the web UI doesn't show a non-functional link.
diff --git a/packages/plugins/example/package.json b/packages/plugins/example/package.json
index 0c4aadfeb..eec827a56 100644
--- a/packages/plugins/example/package.json
+++ b/packages/plugins/example/package.json
@@ -1,6 +1,7 @@
 {
   "name": "@executor-js/plugin-example",
   "version": "1.5.20",
+  "private": true,
   "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/plugins/example",
   "bugs": {
     "url": "https://github.com/RhysSullivan/executor/issues"
diff --git a/packages/plugins/file-secrets/package.json b/packages/plugins/file-secrets/package.json
index 0e1d913a9..ff99aa725 100644
--- a/packages/plugins/file-secrets/package.json
+++ b/packages/plugins/file-secrets/package.json
@@ -1,6 +1,7 @@
 {
   "name": "@executor-js/plugin-file-secrets",
   "version": "1.5.20",
+  "private": true,
   "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/plugins/file-secrets",
   "bugs": {
     "url": "https://github.com/RhysSullivan/executor/issues"
diff --git a/packages/plugins/google/package.json b/packages/plugins/google/package.json
index 06d70811b..56deef143 100644
--- a/packages/plugins/google/package.json
+++ b/packages/plugins/google/package.json
@@ -1,6 +1,7 @@
 {
   "name": "@executor-js/plugin-google",
   "version": "1.5.19",
+  "private": true,
   "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/plugins/google",
   "bugs": {
     "url": "https://github.com/RhysSullivan/executor/issues"
diff --git a/packages/plugins/graphql/package.json b/packages/plugins/graphql/package.json
index e9ef0f9ea..c98196229 100644
--- a/packages/plugins/graphql/package.json
+++ b/packages/plugins/graphql/package.json
@@ -1,6 +1,7 @@
 {
   "name": "@executor-js/plugin-graphql",
   "version": "1.5.20",
+  "private": true,
   "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/plugins/graphql",
   "bugs": {
     "url": "https://github.com/RhysSullivan/executor/issues"
diff --git a/packages/plugins/keychain/package.json b/packages/plugins/keychain/package.json
index 0328b672f..8ef95a99f 100644
--- a/packages/plugins/keychain/package.json
+++ b/packages/plugins/keychain/package.json
@@ -1,6 +1,7 @@
 {
   "name": "@executor-js/plugin-keychain",
   "version": "1.5.20",
+  "private": true,
   "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/plugins/keychain",
   "bugs": {
     "url": "https://github.com/RhysSullivan/executor/issues"
diff --git a/packages/plugins/keychain/src/keyring.ts b/packages/plugins/keychain/src/keyring.ts
index aeb8ad855..c5a1c5dbc 100644
--- a/packages/plugins/keychain/src/keyring.ts
+++ b/packages/plugins/keychain/src/keyring.ts
@@ -39,8 +39,8 @@ let entryCtorPromise: Promise<EntryConstructor> | null = null;
 // In compiled bun binaries (`bun build --compile`) `.node` modules aren't
 // included in bunfs and there's no node_modules at runtime, so
 // @napi-rs/keyring's loader can't find its platform-specific binding.
-// `apps/cli/src/build.ts` copies the .node next to the executor and
-// `apps/cli/src/main.ts` exports its absolute path here. We load it
+// `legacy/cli/src/build.ts` copies the .node next to the executor and
+// `legacy/cli/src/main.ts` exports its absolute path here. We load it
 // directly because @napi-rs/keyring@1.2.0's NAPI_RS_NATIVE_LIBRARY_PATH
 // branch is buggy (assigns to a local that gets overwritten before return).
 const loadEntryCtor = async (): Promise<EntryConstructor> => {
diff --git a/packages/plugins/mcp/package.json b/packages/plugins/mcp/package.json
index 0f601c7a2..55d7266a7 100644
--- a/packages/plugins/mcp/package.json
+++ b/packages/plugins/mcp/package.json
@@ -1,6 +1,7 @@
 {
   "name": "@executor-js/plugin-mcp",
   "version": "1.5.20",
+  "private": true,
   "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/plugins/mcp",
   "bugs": {
     "url": "https://github.com/RhysSullivan/executor/issues"
diff --git a/packages/plugins/mcp/src/sdk/elicitation.test.ts b/packages/plugins/mcp/src/sdk/elicitation.test.ts
index 9c0a6e50a..e9ec5a380 100644
--- a/packages/plugins/mcp/src/sdk/elicitation.test.ts
+++ b/packages/plugins/mcp/src/sdk/elicitation.test.ts
@@ -6,7 +6,6 @@ import type { JsonSchemaType } from "@modelcontextprotocol/sdk/validation/types"
 import {
   AuthTemplateSlug,
   ConnectionName,
-  createExecutor,
   FormElicitation,
   ElicitationResponse,
   IntegrationSlug,
@@ -16,7 +15,7 @@ import {
   type Tool,
 } from "@executor-js/sdk";
 import {
-  makeTestConfig,
+  makeTestWorkspaceHarness,
   memoryCredentialsPlugin,
   typeCheckOutputTypeScript,
 } from "@executor-js/sdk/testing";
@@ -56,10 +55,10 @@ const TEMPLATE = AuthTemplateSlug.make("none");
 // ---------------------------------------------------------------------------
 
 const makeTestExecutor = (serverUrl: string) =>
-  createExecutor(
-    makeTestConfig({ plugins: [memoryCredentialsPlugin(), mcpPlugin()] as const }),
-  ).pipe(
-    Effect.tap((executor) =>
+  makeTestWorkspaceHarness({
+    plugins: [memoryCredentialsPlugin(), mcpPlugin()] as const,
+  }).pipe(
+    Effect.tap(({ executor }) =>
       Effect.gen(function* () {
         yield* executor.mcp.addServer({
           name: "test-mcp",
@@ -75,6 +74,7 @@ const makeTestExecutor = (serverUrl: string) =>
         });
       }),
     ),
+    Effect.map(({ executor }) => executor),
   );
 
 const findTool = (tools: readonly Tool[], name: string): Tool =>
@@ -304,7 +304,9 @@ describe("MCP elicitation (end-to-end)", () => {
   it.effect("addServer preserves the configured display name as the integration description", () =>
     Effect.gen(function* () {
       const server = yield* serveElicitationTestServer;
-      const executor = yield* createExecutor(makeTestConfig({ plugins: [mcpPlugin()] as const }));
+      const { executor } = yield* makeTestWorkspaceHarness({
+        plugins: [mcpPlugin()] as const,
+      });
 
       yield* executor.mcp.addServer({
         name: "Gmail",
diff --git a/packages/plugins/mcp/src/sdk/multi-placement-auth.test.ts b/packages/plugins/mcp/src/sdk/multi-placement-auth.test.ts
index 4729eb39e..2180027df 100644
--- a/packages/plugins/mcp/src/sdk/multi-placement-auth.test.ts
+++ b/packages/plugins/mcp/src/sdk/multi-placement-auth.test.ts
@@ -12,14 +12,8 @@
 import { describe, expect, it } from "@effect/vitest";
 import { Effect } from "effect";
 
-import {
-  AuthTemplateSlug,
-  ConnectionName,
-  IntegrationSlug,
-  ToolAddress,
-  createExecutor,
-} from "@executor-js/sdk";
-import { makeTestConfig, memoryCredentialsPlugin } from "@executor-js/sdk/testing";
+import { AuthTemplateSlug, ConnectionName, IntegrationSlug, ToolAddress } from "@executor-js/sdk";
+import { makeTestExecutor, memoryCredentialsPlugin } from "@executor-js/sdk/testing";
 
 import { mcpPlugin } from "./plugin";
 import { variable } from "@executor-js/sdk/http-auth";
@@ -39,9 +33,9 @@ describe("MCP multi-placement auth", () => {
   it.effect("one method renders a bearer header AND a team-id query param", () =>
     Effect.gen(function* () {
       const server = yield* serveRecordingServer;
-      const executor = yield* createExecutor(
-        makeTestConfig({ plugins: [memoryCredentialsPlugin(), mcpPlugin()] as const }),
-      );
+      const executor = yield* makeTestExecutor({
+        plugins: [memoryCredentialsPlugin(), mcpPlugin()] as const,
+      });
 
       yield* executor.mcp.addServer({
         name: "Mixed MCP",
@@ -76,7 +70,9 @@ describe("MCP multi-placement auth", () => {
         data: { content: [{ type: "text", text: "ok:mixed" }] },
       });
 
-      const requests = (yield* server.requests).slice(before);
+      const requests = (yield* server.requests)
+        .slice(before)
+        .filter((request) => request.method === "POST");
       expect(requests.length).toBeGreaterThan(0);
       // BOTH carriers rendered, each from its own credential input.
       expect(requests.every((request) => request.authorization === "Bearer tok_A")).toBe(true);
@@ -87,9 +83,9 @@ describe("MCP multi-placement auth", () => {
   it.effect("a query-only method renders ?token= and no Authorization header (ui.sh)", () =>
     Effect.gen(function* () {
       const server = yield* serveRecordingServer;
-      const executor = yield* createExecutor(
-        makeTestConfig({ plugins: [memoryCredentialsPlugin(), mcpPlugin()] as const }),
-      );
+      const executor = yield* makeTestExecutor({
+        plugins: [memoryCredentialsPlugin(), mcpPlugin()] as const,
+      });
 
       yield* executor.mcp.addServer({
         name: "Query MCP",
@@ -115,7 +111,9 @@ describe("MCP multi-placement auth", () => {
       );
       expect(result).toMatchObject({ ok: true });
 
-      const requests = (yield* server.requests).slice(before);
+      const requests = (yield* server.requests)
+        .slice(before)
+        .filter((request) => request.method === "POST");
       expect(requests.length).toBeGreaterThan(0);
       expect(requests.every((request) => request.url.includes("token=tok_secret_123"))).toBe(true);
       expect(requests.every((request) => request.authorization === undefined)).toBe(true);
@@ -125,9 +123,9 @@ describe("MCP multi-placement auth", () => {
   it.effect("a connection binding one method does not leak into another method's shape", () =>
     Effect.gen(function* () {
       const server = yield* serveRecordingServer;
-      const executor = yield* createExecutor(
-        makeTestConfig({ plugins: [memoryCredentialsPlugin(), mcpPlugin()] as const }),
-      );
+      const executor = yield* makeTestExecutor({
+        plugins: [memoryCredentialsPlugin(), mcpPlugin()] as const,
+      });
 
       // Two declared methods; each connection picks one by template slug.
       yield* executor.mcp.addServer({
@@ -169,7 +167,9 @@ describe("MCP multi-placement auth", () => {
         { marker: "h" },
         { onElicitation: "accept-all" },
       );
-      const headerRequests = (yield* server.requests).slice(beforeHeader);
+      const headerRequests = (yield* server.requests)
+        .slice(beforeHeader)
+        .filter((request) => request.method === "POST");
       expect(headerRequests.every((r) => r.authorization === "Bearer header-secret")).toBe(true);
       expect(headerRequests.every((r) => !r.url.includes("auth_token="))).toBe(true);
 
@@ -179,7 +179,9 @@ describe("MCP multi-placement auth", () => {
         { marker: "q" },
         { onElicitation: "accept-all" },
       );
-      const queryRequests = (yield* server.requests).slice(beforeQuery);
+      const queryRequests = (yield* server.requests)
+        .slice(beforeQuery)
+        .filter((request) => request.method === "POST");
       expect(queryRequests.every((r) => r.url.includes("auth_token=query-secret"))).toBe(true);
       expect(queryRequests.every((r) => r.authorization === undefined)).toBe(true);
     }),
@@ -188,9 +190,9 @@ describe("MCP multi-placement auth", () => {
   it.effect("invoking with a missing credential input fails explicitly, not silently", () =>
     Effect.gen(function* () {
       const server = yield* serveRecordingServer;
-      const executor = yield* createExecutor(
-        makeTestConfig({ plugins: [memoryCredentialsPlugin(), mcpPlugin()] as const }),
-      );
+      const executor = yield* makeTestExecutor({
+        plugins: [memoryCredentialsPlugin(), mcpPlugin()] as const,
+      });
 
       yield* executor.mcp.addServer({
         name: "Strict MCP",
diff --git a/packages/plugins/mcp/src/testing/server.ts b/packages/plugins/mcp/src/testing/server.ts
index 2567253c7..9e8a0dc7b 100644
--- a/packages/plugins/mcp/src/testing/server.ts
+++ b/packages/plugins/mcp/src/testing/server.ts
@@ -398,18 +398,21 @@ export const makeElicitationMcpServer = () => {
       description: "Asks for approval before echoing a value",
       inputSchema: { value: z.string() },
     },
-    async ({ value }: { value: string }) => {
-      const response = await server.server.elicitInput({
-        mode: "form",
-        message: `Approve echo for "${value}"?`,
-        requestedSchema: {
-          type: "object",
-          properties: {
-            approved: { type: "boolean", title: "Approve" },
+    async ({ value }: { value: string }, extra) => {
+      const response = await server.server.elicitInput(
+        {
+          mode: "form",
+          message: `Approve echo for "${value}"?`,
+          requestedSchema: {
+            type: "object",
+            properties: {
+              approved: { type: "boolean", title: "Approve" },
+            },
+            required: ["approved"],
           },
-          required: ["approved"],
         },
-      });
+        { relatedRequestId: extra.requestId },
+      );
 
       if (response.action !== "accept" || !response.content || response.content.approved !== true) {
         return {
diff --git a/packages/plugins/microsoft/package.json b/packages/plugins/microsoft/package.json
index f833cb720..e1a97f0ef 100644
--- a/packages/plugins/microsoft/package.json
+++ b/packages/plugins/microsoft/package.json
@@ -1,6 +1,7 @@
 {
   "name": "@executor-js/plugin-microsoft",
   "version": "1.5.19",
+  "private": true,
   "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/plugins/microsoft",
   "bugs": {
     "url": "https://github.com/RhysSullivan/executor/issues"
diff --git a/packages/plugins/onepassword/package.json b/packages/plugins/onepassword/package.json
index 13e5d5669..9bfcb7099 100644
--- a/packages/plugins/onepassword/package.json
+++ b/packages/plugins/onepassword/package.json
@@ -1,6 +1,7 @@
 {
   "name": "@executor-js/plugin-onepassword",
   "version": "1.5.20",
+  "private": true,
   "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/plugins/onepassword",
   "bugs": {
     "url": "https://github.com/RhysSullivan/executor/issues"
diff --git a/packages/plugins/openapi/package.json b/packages/plugins/openapi/package.json
index 6c7c6e5af..595d890d8 100644
--- a/packages/plugins/openapi/package.json
+++ b/packages/plugins/openapi/package.json
@@ -1,6 +1,7 @@
 {
   "name": "@executor-js/plugin-openapi",
   "version": "1.5.20",
+  "private": true,
   "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/plugins/openapi",
   "bugs": {
     "url": "https://github.com/RhysSullivan/executor/issues"
diff --git a/packages/plugins/openapi/src/sdk/output-schema-migration.ts b/packages/plugins/openapi/src/sdk/output-schema-migration.ts
index c5a5421cb..864479609 100644
--- a/packages/plugins/openapi/src/sdk/output-schema-migration.ts
+++ b/packages/plugins/openapi/src/sdk/output-schema-migration.ts
@@ -5,7 +5,7 @@
 // `http` side channel), so persisted schemas must describe the payload
 // only — otherwise describe previews show an envelope invocations no
 // longer return. Mirrors the cloud drizzle migration
-// (apps/cloud/drizzle/0002_unwrap_openapi_output_envelope.sql) for the
+// (legacy/cloud/drizzle/0002_unwrap_openapi_output_envelope.sql) for the
 // libSQL-backed apps, where it runs once through the data-migration ledger.
 //
 // Idempotent: payload-shaped rows don't match the envelope signature, so
diff --git a/packages/plugins/openapi/src/sdk/real-specs.test.ts b/packages/plugins/openapi/src/sdk/real-specs.test.ts
index a2b3f895b..59963c6f2 100644
--- a/packages/plugins/openapi/src/sdk/real-specs.test.ts
+++ b/packages/plugins/openapi/src/sdk/real-specs.test.ts
@@ -1,6 +1,6 @@
 // Parse / extract / preview coverage against a big real-world spec.
 // DB-touching behaviour (addSpec, removeSpec, tool registration) moved
-// to apps/cloud/src/services/sources-api.node.test.ts — those run
+// to legacy/cloud/src/services/sources-api.node.test.ts, those run
 // through the real Drizzle/FumaDB path so storage regressions
 // (e.g. a per-row createMany fallback) surface automatically instead
 // of needing a dedicated budget assertion.
diff --git a/packages/plugins/toolkits/package.json b/packages/plugins/toolkits/package.json
index 432588b46..c55899e8d 100644
--- a/packages/plugins/toolkits/package.json
+++ b/packages/plugins/toolkits/package.json
@@ -1,6 +1,7 @@
 {
   "name": "@executor-js/plugin-toolkits",
   "version": "1.5.12",
+  "private": true,
   "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/plugins/toolkits",
   "bugs": {
     "url": "https://github.com/RhysSullivan/executor/issues"
diff --git a/packages/plugins/workos-vault/package.json b/packages/plugins/workos-vault/package.json
index 1f1017918..d2f832119 100644
--- a/packages/plugins/workos-vault/package.json
+++ b/packages/plugins/workos-vault/package.json
@@ -1,6 +1,7 @@
 {
   "name": "@executor-js/plugin-workos-vault",
   "version": "0.0.2",
+  "private": true,
   "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/plugins/workos-vault",
   "bugs": {
     "url": "https://github.com/RhysSullivan/executor/issues"
diff --git a/packages/react/src/api/oauth-popup.ts b/packages/react/src/api/oauth-popup.ts
index 3c9bb7834..cd1d49e25 100644
--- a/packages/react/src/api/oauth-popup.ts
+++ b/packages/react/src/api/oauth-popup.ts
@@ -228,7 +228,7 @@ export const openOAuthPopup = <TAuth>(input: OpenOAuthPopupInput<TAuth>): (() =>
 // URL in the user's real browser. There's no shared origin, so the
 // renderer polls `/api/oauth/await/:sessionId` for the result. The local
 // server publishes there via `setOAuthCompletionListener` (see
-// apps/local/src/serve.ts).
+// legacy/local/src/serve.ts).
 // ---------------------------------------------------------------------------
 
 export type OpenOAuthSystemBrowserInput<TAuth> = {
diff --git a/packages/react/src/components/mcp-install-card.test.ts b/packages/react/src/components/mcp-install-card.test.ts
index df31a2094..1ace98e58 100644
--- a/packages/react/src/components/mcp-install-card.test.ts
+++ b/packages/react/src/components/mcp-install-card.test.ts
@@ -91,11 +91,11 @@ describe("MCP install command rendering", () => {
         mode: "stdio",
         isDev: true,
         origin: null,
-        scopeDir: "/Users/rhyssullivan/src/executor/apps/local",
-        devCliCwd: "/Users/rhyssullivan/src/executor",
+        scopeDir: "/Users/example/src/executor/legacy/local",
+        devCliCwd: "/Users/example/src/executor",
       }),
     ).toBe(
-      "npx add-mcp 'bun run --cwd /Users/rhyssullivan/src/executor dev:cli mcp --scope /Users/rhyssullivan/src/executor/apps/local' --name executor",
+      "npx add-mcp 'bun run --cwd /Users/example/src/executor legacy:dev:cli mcp --scope /Users/example/src/executor/legacy/local' --name executor",
     );
   });
 
diff --git a/packages/react/src/components/mcp-install-card.tsx b/packages/react/src/components/mcp-install-card.tsx
index d24920d21..007979429 100644
--- a/packages/react/src/components/mcp-install-card.tsx
+++ b/packages/react/src/components/mcp-install-card.tsx
@@ -103,8 +103,8 @@ export const buildMcpInstallCommand = (input: {
 
   const innerArgs = input.isDev
     ? input.devCliCwd
-      ? ["bun", "run", "--cwd", input.devCliCwd, "dev:cli", "mcp"]
-      : ["bun", "run", "dev:cli", "mcp"]
+      ? ["bun", "run", "--cwd", input.devCliCwd, "legacy:dev:cli", "mcp"]
+      : ["bun", "run", "legacy:dev:cli", "mcp"]
     : ["executor", "mcp"];
   if (input.scopeDir) {
     innerArgs.push("--scope", input.scopeDir);
diff --git a/packages/react/src/styles/globals.css b/packages/react/src/styles/globals.css
index 595864e01..716a23fa9 100644
--- a/packages/react/src/styles/globals.css
+++ b/packages/react/src/styles/globals.css
@@ -3,8 +3,7 @@
 @custom-variant dark (&:is(.dark *));
 
 @source "../**/*.{ts,tsx}";
-@source "../../../../apps/local/src/**/*.{ts,tsx}";
-@source "../../../../apps/cloud/src/**/*.{ts,tsx}";
+@source "../../../../legacy/local/src/**/*.{ts,tsx}";
 @source "../../../plugins/*/src/react/**/*.{ts,tsx}";
 
 @theme inline {
@@ -151,7 +150,7 @@
 
 /* The sidebar header sits at the top-left of the desktop window, under the
    native macOS traffic-light controls (trafficLightPosition {x:16,y:17} in
-   apps/desktop/src/main/index.ts). Offset its content past the lights and make
+   legacy/desktop/src/main/index.ts). Offset its content past the lights and make
    the freed strip draggable like a native title bar. The desktop window stays
    at or above the mobile breakpoint (minWidth 768), so the sidebar header is
    the only header the lights ever overlap. */
diff --git a/packaging/launchd/bounded-log.sh b/packaging/launchd/bounded-log.sh
new file mode 100755
index 000000000..25cf59c32
--- /dev/null
+++ b/packaging/launchd/bounded-log.sh
@@ -0,0 +1,107 @@
+#!/bin/bash
+set -euo pipefail
+
+readonly MAX_BYTES=$((1024 * 1024))
+readonly GENERATIONS=3
+readonly CHUNK_BYTES=$((64 * 1024))
+readonly LOG_PATH=${1:?a log path is required}
+
+umask 0077
+LC_ALL=C
+export LC_ALL
+
+temporary_file=""
+cleanup() {
+    if [[ -n "$temporary_file" ]]; then
+        rm -f "$temporary_file"
+    fi
+}
+trap cleanup EXIT
+
+require_regular_file_or_absent() {
+    local path=$1
+
+    if [[ -L "$path" ]]; then
+        printf 'refusing symbolic-link log path: %s\n' "$path" >&2
+        exit 1
+    fi
+    if [[ -e "$path" && ! -f "$path" ]]; then
+        printf 'log path is not a regular file: %s\n' "$path" >&2
+        exit 1
+    fi
+}
+
+require_regular_file_or_absent "$LOG_PATH"
+generation=1
+while [[ "$generation" -le "$GENERATIONS" ]]; do
+    require_regular_file_or_absent "${LOG_PATH}.${generation}"
+    generation=$((generation + 1))
+done
+
+touch "$LOG_PATH"
+chmod 0600 "$LOG_PATH"
+generation=1
+while [[ "$generation" -le "$GENERATIONS" ]]; do
+    if [[ -f "${LOG_PATH}.${generation}" ]]; then
+        chmod 0600 "${LOG_PATH}.${generation}"
+    fi
+    generation=$((generation + 1))
+done
+bytes=$(wc -c < "$LOG_PATH")
+
+if [[ "$bytes" -gt "$MAX_BYTES" ]]; then
+    trimmed_log=$(mktemp "${LOG_PATH}.trim.XXXXXXXX")
+    temporary_file=$trimmed_log
+    tail -c "$MAX_BYTES" "$LOG_PATH" > "$trimmed_log"
+    chmod 0600 "$trimmed_log"
+    mv -f "$trimmed_log" "$LOG_PATH"
+    temporary_file=""
+    bytes=$MAX_BYTES
+fi
+
+rotate() {
+    local generation
+    rm -f "${LOG_PATH}.${GENERATIONS}"
+    generation=$((GENERATIONS - 1))
+    while [[ "$generation" -ge 1 ]]; do
+        if [[ -f "${LOG_PATH}.${generation}" ]]; then
+            mv -f "${LOG_PATH}.${generation}" "${LOG_PATH}.$((generation + 1))"
+        fi
+        generation=$((generation - 1))
+    done
+    if [[ -f "$LOG_PATH" ]]; then
+        mv -f "$LOG_PATH" "${LOG_PATH}.1"
+    fi
+    : > "$LOG_PATH"
+    chmod 0600 "$LOG_PATH"
+    bytes=0
+}
+
+chunk_file=$(mktemp "${LOG_PATH}.chunk.XXXXXXXX")
+temporary_file=$chunk_file
+
+while :; do
+    if [[ "$bytes" -ge "$MAX_BYTES" ]]; then
+        read_size=$CHUNK_BYTES
+    else
+        read_size=$((MAX_BYTES - bytes))
+        if [[ "$read_size" -gt "$CHUNK_BYTES" ]]; then
+            read_size=$CHUNK_BYTES
+        fi
+    fi
+
+    : > "$chunk_file"
+    if ! dd bs="$read_size" count=1 of="$chunk_file" 2>/dev/null; then
+        printf 'failed to read launchd log input\n' >&2
+        exit 1
+    fi
+    chunk_size=$(wc -c < "$chunk_file")
+    if [[ "$chunk_size" -eq 0 ]]; then
+        break
+    fi
+    if [[ "$bytes" -ge "$MAX_BYTES" ]]; then
+        rotate
+    fi
+    cat "$chunk_file" >> "$LOG_PATH"
+    bytes=$((bytes + chunk_size))
+done
diff --git a/packaging/launchd/dev.executor.gateway.plist b/packaging/launchd/dev.executor.gateway.plist
new file mode 100644
index 000000000..2b7623ca5
--- /dev/null
+++ b/packaging/launchd/dev.executor.gateway.plist
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>dev.executor.gateway</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>@EXECUTOR_WRAPPER@</string>
+  </array>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <dict>
+    <key>SuccessfulExit</key>
+    <false/>
+  </dict>
+  <key>ThrottleInterval</key>
+  <integer>5</integer>
+  <key>ExitTimeOut</key>
+  <integer>30</integer>
+  <key>Umask</key>
+  <integer>63</integer>
+  <key>ProcessType</key>
+  <string>Background</string>
+</dict>
+</plist>
diff --git a/packaging/systemd/executor.env.example b/packaging/systemd/executor.env.example
new file mode 100644
index 000000000..0c801291b
--- /dev/null
+++ b/packaging/systemd/executor.env.example
@@ -0,0 +1,14 @@
+# Executor defaults to the loopback origin derived from its bind address.
+# Set the exact browser-facing HTTPS origin when using a reverse proxy.
+# EXECUTOR_PUBLIC_ORIGIN=https://executor.example.com
+
+# Trust forwarded client addresses only from explicitly listed proxy networks.
+# Every proxy in the chain must be listed.
+# EXECUTOR_TRUSTED_PROXIES=127.0.0.1/32,::1/128
+
+# Optional path to an externally managed 32-byte master key. This is a path,
+# never key material. See docs/systemd.md for ownership and mode requirements.
+# EXECUTOR_MASTER_KEY_FILE=/etc/executor/external-master.key
+
+# Rust tracing filter. Do not place credentials or API tokens in this file.
+RUST_LOG=executor=info
diff --git a/packaging/systemd/executor.service b/packaging/systemd/executor.service
new file mode 100644
index 000000000..1fc4cfa58
--- /dev/null
+++ b/packaging/systemd/executor.service
@@ -0,0 +1,57 @@
+[Unit]
+Description=Executor self-hosted gateway
+Documentation=https://github.com/davis7dotsh/executor-fork-testing/blob/main/docs/systemd.md
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=executor
+Group=executor
+WorkingDirectory=/var/lib/executor
+EnvironmentFile=-/etc/executor/executor.env
+ExecStart=/usr/local/bin/executor server \
+    --bind 127.0.0.1:4788 \
+    --data-dir /var/lib/executor \
+    --mcp-stdio-templates /etc/executor/mcp-stdio-templates.json
+Restart=on-failure
+RestartSec=2s
+KillSignal=SIGTERM
+TimeoutStartSec=30s
+TimeoutStopSec=90s
+UMask=0077
+
+# systemd creates these paths before dropping privileges.
+StateDirectory=executor
+StateDirectoryMode=0700
+ConfigurationDirectory=executor
+ConfigurationDirectoryMode=0750
+
+# The server and any approved MCP stdio children inherit this sandbox. Add
+# narrowly scoped ReadOnlyPaths= or ReadWritePaths= entries in a drop-in when a
+# template needs access outside the Executor state directory.
+NoNewPrivileges=yes
+CapabilityBoundingSet=
+AmbientCapabilities=
+PrivateDevices=yes
+PrivateTmp=yes
+ProtectSystem=strict
+ProtectHome=yes
+ReadWritePaths=/var/lib/executor
+ProtectControlGroups=yes
+ProtectKernelLogs=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+ProtectClock=yes
+ProtectHostname=yes
+ProtectProc=invisible
+ProcSubset=pid
+LockPersonality=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+SystemCallArchitectures=native
+KeyringMode=private
+
+[Install]
+WantedBy=multi-user.target
diff --git a/packaging/systemd/mcp-stdio-templates.example.json b/packaging/systemd/mcp-stdio-templates.example.json
new file mode 100644
index 000000000..834f94b8c
--- /dev/null
+++ b/packaging/systemd/mcp-stdio-templates.example.json
@@ -0,0 +1,14 @@
+{
+  "templates": [
+    {
+      "name": "example",
+      "executable": "/usr/local/libexec/executor/example-mcp-server",
+      "cwd": "/var/lib/executor/mcp/example",
+      "arguments": ["--stdio"],
+      "environment": {
+        "LOG_LEVEL": "warn"
+      },
+      "secretEnvironment": ["API_TOKEN"]
+    }
+  ]
+}
diff --git a/scripts/agent-config-smoke.ts b/scripts/agent-config-smoke.ts
index 5bab28383..c184be3f9 100644
--- a/scripts/agent-config-smoke.ts
+++ b/scripts/agent-config-smoke.ts
@@ -23,7 +23,7 @@ import {
 import { Effect } from "effect";
 
 const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
-const cliEntrypoint = join(repoRoot, "apps/cli/src/main.ts");
+const cliEntrypoint = join(repoRoot, "legacy/cli/src/main.ts");
 
 type CliContext = {
   readonly dataDir: string;
diff --git a/scripts/bootstrap.ts b/scripts/bootstrap.ts
index 923d868d7..45c86b1b5 100644
--- a/scripts/bootstrap.ts
+++ b/scripts/bootstrap.ts
@@ -11,24 +11,43 @@ import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
-const repoRoot = resolve(fileURLToPath(new URL("..", import.meta.url)));
+export type BootstrapExecutor = (
+  label: string,
+  command: string,
+  args: ReadonlyArray<string>,
+) => void;
 
-const run = (label: string, cmd: string, args: ReadonlyArray<string>) => {
-  console.log(`\n[bootstrap] ${label}: ${cmd} ${args.join(" ")}`);
-  execFileSync(cmd, [...args], { cwd: repoRoot, stdio: "inherit" });
+export const runBootstrap = (execute: BootstrapExecutor) => {
+  execute("dependencies (+ prepare builds)", "bun", ["install", "--frozen-lockfile"]);
+  execute("playwright chromium", "bun", [
+    "run",
+    "--cwd",
+    "e2e",
+    "playwright",
+    "install",
+    "--with-deps",
+    "chromium",
+  ]);
 };
 
-// `bun install` runs the workspace prepare hook, which builds
-// @executor-js/vite-plugin and @executor-js/react — the two artifacts the
-// apps' vite dev servers fail without in a fresh worktree.
-run("dependencies (+ prepare builds)", "bun", ["install"]);
+const repoRoot = resolve(fileURLToPath(new URL("..", import.meta.url)));
+
+const main = () => {
+  // `bun install --frozen-lockfile` runs the workspace prepare hook, which builds
+  // @executor-js/vite-plugin and @executor-js/react, the two artifacts the
+  // legacy apps' Vite dev servers fail without in a fresh worktree.
+  // Resolve Playwright from e2e so the browser revision matches its locked
+  // dependency. The cache is shared per-machine when Chromium is already present.
+  runBootstrap((label, command, args) => {
+    console.log(`\n[bootstrap] ${label}: ${command} ${args.join(" ")}`);
+    execFileSync(command, [...args], { cwd: repoRoot, stdio: "inherit" });
+  });
 
-// e2e browser scenarios need Playwright's chromium; the cache is shared
-// per-machine so this is a fast no-op when already present.
-run("playwright chromium", "bunx", ["playwright", "install", "chromium"]);
+  if (!existsSync(resolve(repoRoot, "node_modules/.bin/vitest"))) {
+    throw new Error("bootstrap: vitest missing after install, bun install likely failed");
+  }
 
-if (!existsSync(resolve(repoRoot, "node_modules/.bin/vitest"))) {
-  throw new Error("bootstrap: vitest missing after install — bun install likely failed");
-}
+  console.log("\n[bootstrap] done. See RUNNING.md for current verification commands.");
+};
 
-console.log("\n[bootstrap] done — `cd e2e && bun run test` runs the full suite.");
+if (import.meta.main) main();
diff --git a/scripts/check-changelog-stubs.ts b/scripts/check-changelog-stubs.ts
deleted file mode 100644
index 98dbee22f..000000000
--- a/scripts/check-changelog-stubs.ts
+++ /dev/null
@@ -1,71 +0,0 @@
-#!/usr/bin/env bun
-/**
- * Verifies every workspace package directory has a `CHANGELOG.md` file.
- *
- * `changesets/action@v1` (the GitHub Action wrapping the Changesets CLI in
- * `release.yml`) creates the Version Packages PR after `changeset version`
- * updates package versions and changelogs. Every workspace package should have
- * a `CHANGELOG.md` seed so Changesets has a stable file to update and the
- * action never falls back to missing-file behavior. Keep seed files H1-only:
- * Changesets inserts generated version sections immediately after the H1, so
- * any placeholder prose would become part of the first generated release notes.
- *
- * GitHub Release notes are still authored separately at
- * `apps/cli/release-notes/next.md`; package changelogs are generated from
- * `.changeset/*.md`.
- *
- * Usage:
- *   bun run scripts/check-changelog-stubs.ts        # fail on missing
- *   bun run scripts/check-changelog-stubs.ts --fix  # create missing stubs
- */
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname, relative, resolve } from "node:path";
-
-const repoRoot = resolve(import.meta.dir, "..");
-
-type Pkg = { name?: string; private?: boolean };
-
-const findWorkspacePackages = (): string[] => {
-  const root = JSON.parse(readFileSync(resolve(repoRoot, "package.json"), "utf8")) as {
-    workspaces?: string[];
-  };
-  const patterns = root.workspaces ?? [];
-  const dirs = new Set<string>();
-  for (const pattern of patterns) {
-    // Bun.Glob — handles workspace patterns like "packages/*/*", "apps/*"
-    for (const match of new Bun.Glob(`${pattern}/package.json`).scanSync({ cwd: repoRoot })) {
-      dirs.add(dirname(resolve(repoRoot, match)));
-    }
-  }
-  return [...dirs].sort();
-};
-
-const STUB_TEMPLATE = (name: string) => `# ${name}\n`;
-
-const fix = process.argv.includes("--fix");
-const missing: string[] = [];
-
-for (const pkgDir of findWorkspacePackages()) {
-  const changelogPath = resolve(pkgDir, "CHANGELOG.md");
-  if (existsSync(changelogPath)) continue;
-
-  const pkg = JSON.parse(readFileSync(resolve(pkgDir, "package.json"), "utf8")) as Pkg;
-  const name = pkg.name ?? relative(repoRoot, pkgDir);
-
-  if (fix) {
-    writeFileSync(changelogPath, STUB_TEMPLATE(name));
-    console.log(`Created stub: ${relative(repoRoot, changelogPath)}`);
-  } else {
-    missing.push(`${relative(repoRoot, pkgDir)} (${name})`);
-  }
-}
-
-if (!fix && missing.length > 0) {
-  console.error(
-    `\nMissing CHANGELOG.md in ${missing.length} workspace package(s):\n  - ${missing.join("\n  - ")}\n\n` +
-      "These seed files are required so Changesets can update every affected\n" +
-      "workspace changelog during the Version Packages PR.\n\n" +
-      "Run `bun run scripts/check-changelog-stubs.ts --fix` to create stubs.\n",
-  );
-  process.exit(1);
-}
diff --git a/scripts/check-docker-workspace-context.ts b/scripts/check-docker-workspace-context.ts
new file mode 100644
index 000000000..458c57c45
--- /dev/null
+++ b/scripts/check-docker-workspace-context.ts
@@ -0,0 +1,173 @@
+#!/usr/bin/env bun
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+import { runBootstrap, type BootstrapExecutor } from "./bootstrap";
+
+const repoRoot = resolve(import.meta.dir, "..");
+const sourceWorkspaceRoots = new Set(["web"]);
+
+const read = (path: string) => readFileSync(resolve(repoRoot, path), "utf8");
+const normalizedLines = (contents: string) =>
+  contents
+    .split(/\r?\n/u)
+    .map((line) => line.trim())
+    .filter((line) => line.length > 0 && !line.startsWith("#"));
+
+const rootPackage = JSON.parse(read("package.json")) as { readonly workspaces?: unknown };
+if (
+  !Array.isArray(rootPackage.workspaces) ||
+  !rootPackage.workspaces.every((workspace): workspace is string => typeof workspace === "string")
+) {
+  throw new Error("package.json must declare a string array of workspaces");
+}
+
+const failures: string[] = [];
+const embeddedServiceFiles = [
+  ...read("src/service.rs").matchAll(/include_bytes!\("\.\.\/([^"\n]+)"\)/gu),
+].map((match) => match[1]);
+const rustDockerfiles = ["Dockerfile", "Dockerfile.release-native"] as const;
+for (const dockerfileName of rustDockerfiles) {
+  const contents = read(dockerfileName);
+  for (const embeddedFile of embeddedServiceFiles) {
+    const copy = `COPY ${embeddedFile} ./${embeddedFile}`;
+    if (!contents.includes(copy)) {
+      failures.push(`${dockerfileName} must stage embedded Rust input: ${copy}`);
+    }
+  }
+}
+
+const requiredChromiumInstall = "run: bun run --cwd e2e playwright install --with-deps chromium";
+const ciWorkflow = read(".github/workflows/ci.yml");
+const chromiumInstallCount = ciWorkflow.split(requiredChromiumInstall).length - 1;
+if (chromiumInstallCount !== 1) {
+  failures.push(
+    `CI must install Chromium exactly once through the e2e workspace: ${requiredChromiumInstall}`,
+  );
+}
+if (ciWorkflow.includes("bunx playwright install")) {
+  failures.push("CI must not install Playwright through root bunx resolution");
+}
+
+const bootstrapCommands: Parameters<BootstrapExecutor>[] = [];
+runBootstrap((label, command, args) => bootstrapCommands.push([label, command, args]));
+const actualBootstrapCommands = bootstrapCommands.map(([, command, args]) => [command, ...args]);
+const expectedBootstrapCommands = [
+  ["bun", "install", "--frozen-lockfile"],
+  ["bun", "run", "--cwd", "e2e", "playwright", "install", "--with-deps", "chromium"],
+];
+if (JSON.stringify(actualBootstrapCommands) !== JSON.stringify(expectedBootstrapCommands)) {
+  failures.push(
+    "Bootstrap command plan must run only the frozen dependency install followed by the locked e2e Chromium install",
+  );
+}
+
+const workspacePatterns = rootPackage.workspaces.map((workspace) => workspace.replace(/\/+$/u, ""));
+const workspaceManifests = new Set<string>();
+const patternsByRoot = new Map<string, string[]>();
+
+for (const pattern of workspacePatterns) {
+  const root = pattern.split("/", 1)[0];
+  if (!root || /[*?[\]{}]/u.test(root)) {
+    failures.push(`workspace pattern needs a literal top-level directory: ${pattern}`);
+    continue;
+  }
+
+  const patterns = patternsByRoot.get(root) ?? [];
+  patterns.push(pattern);
+  patternsByRoot.set(root, patterns);
+
+  const matches = [
+    ...new Bun.Glob(`${pattern}/package.json`).scanSync({ cwd: repoRoot, onlyFiles: true }),
+  ].map((path) => path.replaceAll("\\", "/"));
+  if (matches.length === 0) {
+    failures.push(`workspace pattern matches no package manifests: ${pattern}`);
+  }
+  for (const manifest of matches) workspaceManifests.add(manifest);
+}
+
+const manifestOnlyRoots = [...patternsByRoot.keys()]
+  .filter((root) => !sourceWorkspaceRoots.has(root))
+  .sort();
+const dockerignoreRules = normalizedLines(read("Dockerfile.dockerignore"));
+const requiredDockerContextPaths = [...embeddedServiceFiles, "scripts/package-release-archive.py"];
+const requiredDockerContextDirectories = new Set(
+  requiredDockerContextPaths.flatMap((path) => {
+    const segments = path.split("/");
+    return segments.slice(0, -1).map((_, index) => segments.slice(0, index + 1).join("/"));
+  }),
+);
+for (const path of [...requiredDockerContextDirectories, ...requiredDockerContextPaths]) {
+  if (!dockerignoreRules.includes(`!${path}`)) {
+    failures.push(`Dockerfile.dockerignore must include release build input: !${path}`);
+  }
+}
+
+const packageDockerfile = read("Dockerfile.release-package");
+if (!packageDockerfile.includes("COPY scripts/package-release-archive.py")) {
+  failures.push("Dockerfile.release-package must copy the deterministic archive packager");
+}
+const actualManifestRules = dockerignoreRules.filter((rule) => {
+  const path = rule.startsWith("!") ? rule.slice(1) : rule;
+  return manifestOnlyRoots.some((root) => path === root || path.startsWith(`${root}/`));
+});
+const expectedManifestRules = manifestOnlyRoots.flatMap((root) => [
+  `!${root}`,
+  `${root}/**`,
+  ...(patternsByRoot.get(root) ?? []).toSorted().map((pattern) => `!${pattern}/package.json`),
+]);
+
+if (actualManifestRules.join("\n") !== expectedManifestRules.join("\n")) {
+  failures.push(
+    [
+      "Dockerfile.dockerignore workspace rules are out of sync.",
+      "Expected this manifest-only rule sequence:",
+      ...expectedManifestRules.map((rule) => `  ${rule}`),
+    ].join("\n"),
+  );
+}
+
+const dockerfileLines = normalizedLines(read("Dockerfile")).map((line) =>
+  line.replace(/\s+/gu, " "),
+);
+const installIndex = dockerfileLines.findIndex((line) =>
+  line.includes("bun install --frozen-lockfile"),
+);
+if (installIndex === -1) {
+  failures.push("Dockerfile has no frozen Bun install to validate");
+} else {
+  const stagedBeforeInstall = new Set(dockerfileLines.slice(0, installIndex));
+  for (const root of manifestOnlyRoots) {
+    const instruction = `COPY ${root} ./${root}`;
+    if (!stagedBeforeInstall.has(instruction)) {
+      failures.push(
+        `Dockerfile must stage ${root} manifests before the frozen install: ${instruction}`,
+      );
+    }
+  }
+  for (const root of sourceWorkspaceRoots) {
+    for (const manifest of [...workspaceManifests].filter((path) => path.startsWith(`${root}/`))) {
+      const instruction = `COPY ${manifest} ./${manifest}`;
+      if (!stagedBeforeInstall.has(instruction)) {
+        failures.push(
+          `Dockerfile must stage ${manifest} before the frozen install: ${instruction}`,
+        );
+      }
+    }
+  }
+}
+
+for (const root of sourceWorkspaceRoots) {
+  if (!patternsByRoot.has(root)) {
+    failures.push(`source workspace root is no longer declared: ${root}`);
+  }
+}
+
+if (failures.length > 0) {
+  console.error(`Docker workspace context check failed:\n\n${failures.join("\n\n")}\n`);
+  process.exit(1);
+}
+
+console.log(
+  `Docker workspace context stages ${workspaceManifests.size} manifests across ${patternsByRoot.size} roots.`,
+);
diff --git a/scripts/check-release-channel-order.py b/scripts/check-release-channel-order.py
new file mode 100644
index 000000000..064701ef3
--- /dev/null
+++ b/scripts/check-release-channel-order.py
@@ -0,0 +1,141 @@
+#!/usr/bin/env python3
+import argparse
+import json
+import pathlib
+import re
+import sys
+
+
+NUMERIC_IDENTIFIER = r"(?:0|[1-9][0-9]*)"
+PRERELEASE_IDENTIFIER = rf"(?:{NUMERIC_IDENTIFIER}|[0-9]*[A-Za-z-][0-9A-Za-z-]*)"
+SEMVER_PATTERN = re.compile(
+    rf"^({NUMERIC_IDENTIFIER})\.({NUMERIC_IDENTIFIER})\.({NUMERIC_IDENTIFIER})"
+    rf"(?:-({PRERELEASE_IDENTIFIER}(?:\.{PRERELEASE_IDENTIFIER})*))?"
+    r"(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$"
+)
+
+
+def parse_args():
+    parser = argparse.ArgumentParser(
+        description="Refuse release channel moves that would lower SemVer precedence"
+    )
+    parser.add_argument("--channel", choices=("latest", "beta"), required=True)
+    current_source = parser.add_mutually_exclusive_group(required=True)
+    current_source.add_argument("--current")
+    current_source.add_argument("--history-file")
+    parser.add_argument("--candidate", required=True)
+    return parser.parse_args()
+
+
+def parse_version(value):
+    match = SEMVER_PATTERN.fullmatch(value)
+    if match is None:
+        raise ValueError(f"invalid SemVer: {value}")
+    major, minor, patch, prerelease = match.groups()
+    return (
+        (int(major), int(minor), int(patch)),
+        None if prerelease is None else prerelease.split("."),
+    )
+
+
+def compare_prerelease(left, right):
+    if left is None:
+        return 0 if right is None else 1
+    if right is None:
+        return -1
+
+    for left_identifier, right_identifier in zip(left, right, strict=False):
+        if left_identifier == right_identifier:
+            continue
+        left_numeric = left_identifier.isdigit()
+        right_numeric = right_identifier.isdigit()
+        if left_numeric and right_numeric:
+            return 1 if int(left_identifier) > int(right_identifier) else -1
+        if left_numeric != right_numeric:
+            return -1 if left_numeric else 1
+        return 1 if left_identifier > right_identifier else -1
+
+    if len(left) == len(right):
+        return 0
+    return 1 if len(left) > len(right) else -1
+
+
+def compare_versions(left, right):
+    left_core, left_prerelease = parse_version(left)
+    right_core, right_prerelease = parse_version(right)
+    if left_core != right_core:
+        return 1 if left_core > right_core else -1
+    return compare_prerelease(left_prerelease, right_prerelease)
+
+
+def validate_channel_version(channel, value, role):
+    parsed = parse_version(value)
+    is_prerelease = parsed[1] is not None
+    expected_prerelease = channel == "beta"
+    if is_prerelease != expected_prerelease:
+        raise ValueError(f"{channel} channel has an incompatible {role} version")
+    return parsed
+
+
+def load_release_history(path):
+    if path == "-":
+        pages = json.load(sys.stdin)
+    else:
+        pages = json.loads(pathlib.Path(path).read_text(encoding="utf-8"))
+    if not isinstance(pages, list):
+        raise ValueError("release history must be a JSON array of pages")
+    for page in pages:
+        if not isinstance(page, list):
+            raise ValueError("release history page must be a JSON array")
+        for release in page:
+            if not isinstance(release, dict):
+                raise ValueError("release history entry must be a JSON object")
+            yield release
+
+
+def latest_published_version(channel, history_file):
+    latest = None
+    for release in load_release_history(history_file):
+        if release.get("draft") is not False:
+            continue
+        tag = release.get("tag_name")
+        if not isinstance(tag, str) or not tag.startswith("v"):
+            continue
+        version = tag[1:]
+        try:
+            validate_channel_version(channel, version, "published")
+        except ValueError:
+            continue
+        if latest is None or compare_versions(version, latest) > 0:
+            latest = version
+    return latest
+
+
+def main():
+    args = parse_args()
+    try:
+        validate_channel_version(args.channel, args.candidate, "candidate")
+        current = (
+            args.current
+            if args.current is not None
+            else latest_published_version(args.channel, args.history_file)
+        )
+        if current is not None:
+            validate_channel_version(args.channel, current, "current")
+    except ValueError as error:
+        raise SystemExit(str(error)) from error
+
+    if current is None:
+        print("first")
+        return
+
+    relation = compare_versions(args.candidate, current)
+    if relation < 0:
+        raise SystemExit(
+            f"candidate would move {args.channel} backward from {current} to {args.candidate}"
+        )
+    print("equal" if relation == 0 else "newer")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/scripts/check-warden-targets.ts b/scripts/check-warden-targets.ts
new file mode 100644
index 000000000..05e343849
--- /dev/null
+++ b/scripts/check-warden-targets.ts
@@ -0,0 +1,49 @@
+#!/usr/bin/env bun
+
+import { Schema } from "effect";
+import { resolve } from "node:path";
+
+const WardenConfig = Schema.Struct({
+  defaults: Schema.Struct({
+    ignorePaths: Schema.Array(Schema.String),
+  }),
+  skills: Schema.Array(
+    Schema.Struct({
+      name: Schema.String,
+      paths: Schema.Array(Schema.String),
+    }),
+  ),
+});
+
+const decodeWardenConfig = Schema.decodeUnknownSync(WardenConfig);
+const repoRoot = resolve(import.meta.dirname, "..");
+const configPath = resolve(repoRoot, process.argv[2] ?? "warden.toml");
+const config = decodeWardenConfig(Bun.TOML.parse(await Bun.file(configPath).text()));
+const ignored = config.defaults.ignorePaths.map((pattern) => new Bun.Glob(pattern));
+const zeroMatchTargets: string[] = [];
+let targetCount = 0;
+
+for (const skill of config.skills) {
+  for (const pattern of skill.paths) {
+    targetCount += 1;
+    const matches = [
+      ...new Bun.Glob(pattern).scanSync({
+        cwd: repoRoot,
+        dot: true,
+        onlyFiles: true,
+      }),
+    ].filter((path) => !ignored.some((glob) => glob.match(path)));
+
+    if (matches.length === 0) {
+      zeroMatchTargets.push(`${skill.name}: ${pattern}`);
+    }
+  }
+}
+
+if (zeroMatchTargets.length > 0) {
+  console.error("Warden targets resolving to zero non-ignored files:");
+  for (const target of zeroMatchTargets) console.error(`- ${target}`);
+  process.exit(1);
+}
+
+console.log(`Warden target guard checked ${targetCount} configured targets.`);
diff --git a/scripts/clean.ts b/scripts/clean.ts
index 859eaf641..ab5451ca2 100644
--- a/scripts/clean.ts
+++ b/scripts/clean.ts
@@ -20,7 +20,7 @@ for (const name of rootTargets) {
 
 const nestedTargets = new Set(["node_modules", "dist", ".turbo", ".output", ".astro"]);
 const nestedGlobs = /\.tsbuildinfo$/;
-const searchRoots = ["apps", "packages"];
+const searchRoots = ["apps", "legacy", "packages"];
 const maxDepth = 5;
 
 function clean(dir: string, depth: number) {
diff --git a/scripts/install-launchd.sh b/scripts/install-launchd.sh
new file mode 100755
index 000000000..4bed9c60e
--- /dev/null
+++ b/scripts/install-launchd.sh
@@ -0,0 +1,812 @@
+#!/usr/bin/env bash
+set -eo pipefail
+export LC_ALL=C
+
+LABEL="dev.executor.gateway"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
+REPOSITORY_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd -P)"
+TEMPLATE="${REPOSITORY_ROOT}/packaging/launchd/${LABEL}.plist"
+LOG_WRITER_SOURCE="${REPOSITORY_ROOT}/packaging/launchd/bounded-log.sh"
+PLIST="${HOME}/Library/LaunchAgents/${LABEL}.plist"
+EXECUTOR_BINARY="${EXECUTOR_BINARY:-}"
+DEFAULT_DATA_DIR="${HOME}/Library/Application Support/Executor"
+EXECUTOR_ROOT="${HOME}/.executor"
+INSTALL_ROOT="${EXECUTOR_ROOT}/service"
+MANIFEST="${INSTALL_ROOT}/service-install.manifest"
+RECOVERY_MARKER="${INSTALL_ROOT}/service-install.recovery"
+CONFIG_FILE="${INSTALL_ROOT}/service-config"
+CURRENT_UID="$(id -u)"
+data_dir_explicit=false
+templates_explicit=false
+public_origin_explicit=false
+trusted_proxies_explicit=false
+data_dir_override=""
+templates_override=""
+public_origin_override=""
+trusted_proxies_override=""
+if [[ ${EXECUTOR_DATA_DIR+x} == x ]]; then
+    data_dir_explicit=true
+    data_dir_override=$EXECUTOR_DATA_DIR
+fi
+if [[ ${EXECUTOR_MCP_STDIO_TEMPLATES_FILE+x} == x ]]; then
+    templates_explicit=true
+    templates_override=$EXECUTOR_MCP_STDIO_TEMPLATES_FILE
+fi
+if [[ ${EXECUTOR_PUBLIC_ORIGIN+x} == x ]]; then
+    public_origin_explicit=true
+    public_origin_override=$EXECUTOR_PUBLIC_ORIGIN
+fi
+if [[ ${EXECUTOR_TRUSTED_PROXIES+x} == x ]]; then
+    trusted_proxies_explicit=true
+    trusted_proxies_override=$EXECUTOR_TRUSTED_PROXIES
+fi
+trusted_proxy_options=()
+start_service=true
+validate_only=false
+
+usage() {
+    cat <<EOF
+Install Executor as a per-user macOS LaunchAgent.
+
+Usage: install-launchd.sh [options]
+
+Options:
+    --binary <path>          Executor binary (default: executor from PATH)
+    --data-dir <path>        Persistent data directory
+    --templates <path>       MCP stdio template file
+    --public-origin <origin> Browser-facing origin when using an HTTPS proxy
+    --trusted-proxy <CIDR>   Trust one proxy network (repeatable)
+    --no-start               Install without loading the service
+    --validate-only          Validate paths and configuration without changes
+    -h, --help               Display this help message
+EOF
+}
+
+fail() {
+    printf 'Error: %s\n' "$1" >&2
+    exit 1
+}
+
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --binary)
+            [[ -n "${2:-}" ]] || fail "--binary requires a path"
+            EXECUTOR_BINARY="$2"
+            shift 2
+            ;;
+        --data-dir)
+            [[ -n "${2:-}" ]] || fail "--data-dir requires a path"
+            data_dir_explicit=true
+            data_dir_override="$2"
+            shift 2
+            ;;
+        --templates)
+            [[ -n "${2:-}" ]] || fail "--templates requires a path"
+            templates_explicit=true
+            templates_override="$2"
+            shift 2
+            ;;
+        --public-origin)
+            [[ -n "${2:-}" ]] || fail "--public-origin requires an origin"
+            public_origin_explicit=true
+            public_origin_override="$2"
+            shift 2
+            ;;
+        --trusted-proxy)
+            [[ -n "${2:-}" ]] || fail "--trusted-proxy requires a CIDR"
+            trusted_proxies_explicit=true
+            trusted_proxy_options+=("$2")
+            shift 2
+            ;;
+        --no-start)
+            start_service=false
+            shift
+            ;;
+        --validate-only)
+            validate_only=true
+            shift
+            ;;
+        -h|--help)
+            usage
+            exit 0
+            ;;
+        *) fail "unknown option: $1" ;;
+    esac
+done
+
+[[ "$(uname -s)" == "Darwin" ]] || fail "launchd installation is supported only on macOS"
+command -v shasum >/dev/null 2>&1 || fail "shasum is required"
+[[ -f "$TEMPLATE" ]] || fail "launchd template not found at $TEMPLATE"
+[[ -f "$LOG_WRITER_SOURCE" ]] || fail "bounded log writer not found at $LOG_WRITER_SOURCE"
+
+if [[ -z "$EXECUTOR_BINARY" ]]; then
+    EXECUTOR_BINARY="$(command -v executor || true)"
+fi
+[[ -n "$EXECUTOR_BINARY" && -x "$EXECUTOR_BINARY" ]] \
+    || fail "an executable Executor binary is required"
+
+absolute_path() {
+    local path=$1 directory base
+    directory="$(dirname "$path")"
+    base="$(basename "$path")"
+    [[ -d "$directory" ]] || fail "directory does not exist: $directory"
+    printf '%s/%s\n' "$(cd "$directory" && pwd -P)" "$base"
+}
+
+EXECUTOR_BINARY="$(absolute_path "$EXECUTOR_BINARY")"
+
+require_directory_or_absent() {
+    local path=$1 description=$2
+
+    [[ ! -L "$path" ]] || fail "$description must not be a symbolic link: $path"
+    if [[ -e "$path" && ! -d "$path" ]]; then
+        fail "$description must be a directory: $path"
+    fi
+}
+
+require_regular_file_or_absent() {
+    local path=$1 description=$2
+
+    [[ ! -L "$path" ]] || fail "$description must not be a symbolic link: $path"
+    if [[ -e "$path" && ! -f "$path" ]]; then
+        fail "$description must be a regular file: $path"
+    fi
+}
+
+private_file_metadata() {
+    local path=$1
+    if stat --version >/dev/null 2>&1; then
+        stat -c '%u|%a|%h' "$path"
+    else
+        stat -f '%u|%Lp|%l' "$path"
+    fi
+}
+
+private_file_identity() {
+    local path=$1
+    if stat --version >/dev/null 2>&1; then
+        stat -c '%u|%a|%h|%d|%i|%s' "$path"
+    else
+        stat -f '%u|%Lp|%l|%d|%i|%z' "$path"
+    fi
+}
+
+require_private_control_file() {
+    local path=$1 description=$2 metadata owner mode links
+
+    require_regular_file_or_absent "$path" "$description"
+    [[ -e "$path" ]] || return 0
+    metadata="$(private_file_metadata "$path")" \
+        || fail "could not inspect $description: $path"
+    IFS='|' read -r owner mode links <<< "$metadata"
+    if [[ "$owner" != "$CURRENT_UID" || "$mode" != 600 || "$links" != 1 ]]; then
+        fail "$description must be owned by the current user with mode 0600 and one hard link"
+    fi
+}
+
+require_recoverable_template_file() {
+    local recover=$1 path=$TEMPLATES_FILE parent candidate candidate_name
+    local metadata owner mode links destination_identity expected_digest actual_digest
+    local matching_alias=""
+    local -a candidates=()
+
+    require_regular_file_or_absent "$path" "the MCP stdio template path"
+    [[ -e "$path" ]] || return 0
+    metadata="$(private_file_metadata "$path")" \
+        || fail "could not inspect the MCP stdio template path: $path"
+    IFS='|' read -r owner mode links <<< "$metadata"
+    if [[ "$owner" == "$CURRENT_UID" && "$mode" == 600 && "$links" == 1 ]]; then
+        return 0
+    fi
+    if [[ "$owner" != "$CURRENT_UID" || "$mode" != 600 || "$links" != 2 ]]; then
+        fail "the MCP stdio template path has unsafe metadata"
+    fi
+
+    parent="$(dirname "$path")"
+    destination_identity="$(private_file_identity "$path")" \
+        || fail "could not inspect the MCP stdio template path"
+    shopt -s nullglob
+    candidates=("${parent}"/.executor-templates.????????)
+    shopt -u nullglob
+    for candidate in "${candidates[@]}"; do
+        [[ "$candidate" != "$path" ]] || continue
+        candidate_name="$(basename "$candidate")"
+        [[ "$candidate_name" =~ ^\.executor-templates\.[A-Za-z0-9]{8}$ ]] \
+            || continue
+        [[ -f "$candidate" && ! -L "$candidate" ]] || continue
+        if [[ "$(private_file_identity "$candidate")" == "$destination_identity" ]]; then
+            [[ -z "$matching_alias" ]] \
+                || fail "multiple MCP template recovery aliases were found"
+            matching_alias=$candidate
+        fi
+    done
+    [[ -n "$matching_alias" ]] \
+        || fail "the MCP stdio template path has an unknown hard link"
+    expected_digest="$(printf '{\n  "templates": []\n}\n' | shasum -a 256 | awk '{print $1}')"
+    actual_digest="$(shasum -a 256 "$path" | awk '{print $1}')"
+    [[ "$actual_digest" == "$expected_digest" ]] \
+        || fail "the MCP template recovery alias has unexpected contents"
+
+    if [[ "$recover" == true ]]; then
+        require_private_control_file "$RECOVERY_MARKER" \
+            "the service installation recovery marker"
+        [[ "$(cat "$RECOVERY_MARKER")" == executor-service-install-recovery-v1 ]] \
+            || fail "the service installation recovery marker is malformed"
+        rm -f "$matching_alias"
+        sync
+        require_private_control_file "$path" "the MCP stdio template path"
+    fi
+}
+
+require_safe_directory_metadata() {
+    local path=$1 description=$2 owner_requirement=${3:-trusted}
+    local metadata owner mode links permissions
+
+    require_directory_or_absent "$path" "$description"
+    [[ -d "$path" ]] || fail "$description does not exist: $path"
+    metadata="$(private_file_metadata "$path")" \
+        || fail "could not inspect $description: $path"
+    IFS='|' read -r owner mode links <<< "$metadata"
+    if [[ "$owner" != 0 && "$owner" != "$CURRENT_UID" ]]; then
+        fail "$description must be owned by root or the current user: $path"
+    fi
+    if [[ "$owner_requirement" == current && "$owner" != "$CURRENT_UID" ]]; then
+        fail "$description must be owned by the current user: $path"
+    fi
+    permissions=$((8#$mode))
+    if (( permissions & 0022 )); then
+        fail "$description must not be group-writable or world-writable: $path"
+    fi
+}
+
+check_safe_directory_path() {
+    local path=$1 description=$2 create_missing=$3 current relative component
+    local -a components
+
+    [[ "$path" == /* ]] || fail "$description must be an absolute path: $path"
+    if [[ "$path" == "$HOME" ]]; then
+        require_safe_directory_metadata "$HOME" "the home directory" current
+        return
+    fi
+    if [[ "$path" == "$HOME/"* ]]; then
+        current=$HOME
+        relative=${path#"$HOME"/}
+        require_safe_directory_metadata "$current" "the home directory" current
+    else
+        current=/
+        relative=${path#/}
+        require_safe_directory_metadata "$current" "the filesystem root"
+    fi
+    IFS='/' read -r -a components <<< "$relative"
+    for component in "${components[@]}"; do
+        [[ -n "$component" && "$component" != . && "$component" != .. ]] \
+            || fail "$description contains an unsafe path component: $path"
+        current="${current%/}/${component}"
+        [[ ! -L "$current" ]] || fail "$description has a symbolic-link ancestor: $current"
+        if [[ ! -e "$current" ]]; then
+            if [[ "$create_missing" != true ]]; then
+                return
+            fi
+            if ! mkdir -m 0700 "$current"; then
+                fail "could not create $description: $current"
+            fi
+        fi
+        require_safe_directory_metadata "$current" "$description"
+    done
+}
+
+validate_safe_directory_path() {
+    check_safe_directory_path "$1" "$2" false
+}
+
+ensure_safe_directory_path() {
+    check_safe_directory_path "$1" "$2" true
+}
+
+normalize_absolute_path() {
+    local path=$1 description=$2 relative component result=""
+    local -a components
+
+    [[ "$path" == /* ]] || fail "$description must be an absolute path: $path"
+    [[ "$path" != *//* ]] \
+        || fail "$description must not contain empty path components: $path"
+    if [[ "$path" != / && "$path" == */ ]]; then
+        fail "$description must not end with an empty path component: $path"
+    fi
+    relative=${path#/}
+    if [[ -z "$relative" ]]; then
+        normalized_path=/
+        return
+    fi
+    IFS='/' read -r -a components <<< "$relative"
+    for component in "${components[@]}"; do
+        [[ -n "$component" && "$component" != . && "$component" != .. ]] \
+            || fail "$description contains an unsafe path component: $path"
+        result="${result}/${component}"
+    done
+    normalized_path=$result
+}
+
+canonicalize_path_without_creation() {
+    local path=$1 description=$2 ancestor suffix="" component physical
+
+    normalize_absolute_path "$path" "$description"
+    ancestor=$normalized_path
+    while [[ ! -d "$ancestor" ]]; do
+        component=${ancestor##*/}
+        suffix="/${component}${suffix}"
+        ancestor=${ancestor%/*}
+        [[ -n "$ancestor" ]] || ancestor=/
+    done
+    physical="$(cd "$ancestor" && pwd -P)" \
+        || fail "could not resolve $description: $path"
+    if [[ "$physical" == / ]]; then
+        canonical_path="${physical}${suffix#/}"
+    else
+        canonical_path="${physical}${suffix}"
+    fi
+}
+
+casefold_path() {
+    printf '%s' "$1" | tr '[:upper:]' '[:lower:]'
+}
+
+paths_overlap() {
+    local left=$1 right=$2 left_fold right_fold
+
+    canonicalize_path_without_creation "$left" "a configured path"
+    left_fold="$(casefold_path "$canonical_path")"
+    canonicalize_path_without_creation "$right" "a reserved path"
+    right_fold="$(casefold_path "$canonical_path")"
+    if [[ "$left_fold" == / || "$right_fold" == / \
+        || "$left_fold" == "$right_fold" \
+        || "$left_fold" == "$right_fold/"* \
+        || "$right_fold" == "$left_fold/"* ]]; then
+        return 0
+    fi
+    return 1
+}
+
+path_is_same_or_ancestor() {
+    local possible_ancestor=$1 path=$2 ancestor_fold path_fold
+
+    canonicalize_path_without_creation "$possible_ancestor" "a configured path"
+    ancestor_fold="$(casefold_path "$canonical_path")"
+    canonicalize_path_without_creation "$path" "a configured path"
+    path_fold="$(casefold_path "$canonical_path")"
+    [[ "$ancestor_fold" == / || "$ancestor_fold" == "$path_fold" \
+        || "$path_fold" == "$ancestor_fold/"* ]]
+}
+
+reject_path_overlap() {
+    local configured_path=$1 configured_description=$2 reserved_path=$3 reserved_description=$4
+
+    if paths_overlap "$configured_path" "$reserved_path"; then
+        fail "$configured_description must not overlap $reserved_description: $reserved_path"
+    fi
+}
+
+validate_configured_path_collisions() {
+    local service_binary="${INSTALL_ROOT}/bin/executor" reserved_path
+
+    reject_path_overlap "$DATA_DIR" "the Executor data directory" \
+        "$INSTALL_ROOT" "the managed service directory"
+    reject_path_overlap "$DATA_DIR" "the Executor data directory" \
+        "$PLIST" "the managed LaunchAgent plist"
+
+    for reserved_path in \
+        "$INSTALL_ROOT" \
+        "$service_binary" \
+        "$CONFIG_FILE" \
+        "$MANIFEST" \
+        "$RECOVERY_MARKER" \
+        "$wrapper" \
+        "$log_writer" \
+        "$PLIST"; do
+        reject_path_overlap "$TEMPLATES_FILE" "the MCP stdio template file" \
+            "$reserved_path" "a managed service path"
+    done
+
+    if path_is_same_or_ancestor "$TEMPLATES_FILE" "$DATA_DIR"; then
+        fail "the MCP stdio template file must not equal or contain the Executor data directory"
+    fi
+    for reserved_path in \
+        "${DATA_DIR}/master.key" \
+        "${DATA_DIR}/executor.db" \
+        "${DATA_DIR}/executor.db-journal" \
+        "${DATA_DIR}/executor.db-wal" \
+        "${DATA_DIR}/executor.db-shm" \
+        "${DATA_DIR}/executor.lock" \
+        "$private_log" \
+        "${private_log}.1" \
+        "${private_log}.2" \
+        "${private_log}.3"; do
+        reject_path_overlap "$TEMPLATES_FILE" "the MCP stdio template file" \
+            "$reserved_path" "a reserved Executor state path"
+    done
+}
+
+validate_encoded_config_value() {
+    local encoded=$1 description=$2 byte remainder
+
+    if (( ${#encoded} % 2 != 0 )); then
+        fail "$description has an invalid encoded length"
+    fi
+    case "$encoded" in
+        *[!0-9a-f]*) fail "$description contains invalid encoded bytes" ;;
+    esac
+    remainder=$encoded
+    while [[ -n "$remainder" ]]; do
+        byte=${remainder:0:2}
+        case "$byte" in
+            0[0-9a-f]|1[0-9a-f]|7f)
+                fail "$description contains unsupported control bytes"
+                ;;
+        esac
+        remainder=${remainder:2}
+    done
+}
+
+decode_config_value() {
+    local encoded=$1 description=$2 byte decoded_byte
+
+    validate_encoded_config_value "$encoded" "$description"
+    decoded_config_value=""
+    while [[ -n "$encoded" ]]; do
+        byte=${encoded:0:2}
+        printf -v decoded_byte '%b' "\\x${byte}"
+        decoded_config_value="${decoded_config_value}${decoded_byte}"
+        encoded=${encoded:2}
+    done
+}
+
+encode_config_value() {
+    printf '%s' "$1" | od -An -v -tx1 | tr -d ' \n'
+}
+
+validate_safe_directory_path "$EXECUTOR_ROOT" "the Executor root directory"
+if [[ -d "$EXECUTOR_ROOT" ]]; then
+    require_safe_directory_metadata "$EXECUTOR_ROOT" "the Executor root directory" current
+fi
+validate_safe_directory_path "$INSTALL_ROOT" "the Executor service directory"
+if [[ -d "$INSTALL_ROOT" ]]; then
+    require_safe_directory_metadata "$INSTALL_ROOT" "the Executor service directory" current
+fi
+require_private_control_file "$CONFIG_FILE" "the persisted service configuration"
+require_private_control_file "$MANIFEST" "the service ownership manifest"
+require_private_control_file "$RECOVERY_MARKER" "the service installation recovery marker"
+
+config_existed=false
+DATA_DIR=$DEFAULT_DATA_DIR
+TEMPLATES_FILE="${DATA_DIR}/mcp-stdio-templates.json"
+PUBLIC_ORIGIN=""
+trusted_proxies=()
+if [[ -e "$CONFIG_FILE" ]]; then
+    config_existed=true
+    config_size="$(wc -c < "$CONFIG_FILE" | tr -d '[:space:]')"
+    case "$config_size" in
+        ''|*[!0-9]*) fail "the persisted service configuration size is invalid" ;;
+    esac
+    if (( config_size > 65536 )); then
+        fail "the persisted service configuration is too large"
+    fi
+
+    config_line_number=0
+    saw_data_dir=false
+    saw_templates_file=false
+    saw_public_origin=false
+    while IFS= read -r config_line || [[ -n "$config_line" ]]; do
+        config_line_number=$((config_line_number + 1))
+        if [[ "$config_line_number" -eq 1 ]]; then
+            [[ "$config_line" == executor-launchd-config-v1 ]] \
+                || fail "the persisted service configuration has an unsupported format"
+            continue
+        fi
+        case "$config_line" in
+            data_dir_hex=*)
+                [[ "$saw_data_dir" == false ]] \
+                    || fail "the persisted service configuration repeats data_dir_hex"
+                decode_config_value "${config_line#data_dir_hex=}" "the persisted data directory"
+                DATA_DIR=$decoded_config_value
+                saw_data_dir=true
+                ;;
+            templates_file_hex=*)
+                [[ "$saw_templates_file" == false ]] \
+                    || fail "the persisted service configuration repeats templates_file_hex"
+                decode_config_value "${config_line#templates_file_hex=}" \
+                    "the persisted template file"
+                TEMPLATES_FILE=$decoded_config_value
+                saw_templates_file=true
+                ;;
+            public_origin_hex=*)
+                [[ "$saw_public_origin" == false ]] \
+                    || fail "the persisted service configuration repeats public_origin_hex"
+                decode_config_value "${config_line#public_origin_hex=}" \
+                    "the persisted public origin"
+                PUBLIC_ORIGIN=$decoded_config_value
+                saw_public_origin=true
+                ;;
+            trusted_proxy_hex=*)
+                decode_config_value "${config_line#trusted_proxy_hex=}" \
+                    "a persisted trusted proxy"
+                [[ -n "$decoded_config_value" ]] \
+                    || fail "persisted trusted proxy entries cannot be empty"
+                trusted_proxies+=("$decoded_config_value")
+                ;;
+            *) fail "the persisted service configuration contains an unknown field" ;;
+        esac
+    done < "$CONFIG_FILE"
+    [[ "$config_line_number" -gt 0 && "$saw_data_dir" == true \
+        && "$saw_templates_file" == true && "$saw_public_origin" == true ]] \
+        || fail "the persisted service configuration is incomplete"
+fi
+
+if [[ "$data_dir_explicit" == true ]]; then
+    DATA_DIR=$data_dir_override
+fi
+if [[ "$templates_explicit" == true ]]; then
+    TEMPLATES_FILE=$templates_override
+elif [[ "$config_existed" == false && "$data_dir_explicit" == true ]]; then
+    TEMPLATES_FILE="${DATA_DIR}/mcp-stdio-templates.json"
+fi
+if [[ "$public_origin_explicit" == true ]]; then
+    PUBLIC_ORIGIN=$public_origin_override
+fi
+if [[ "$trusted_proxies_explicit" == true ]]; then
+    trusted_proxies=()
+    if [[ -n "$trusted_proxies_override" ]]; then
+        case "$trusted_proxies_override" in
+            ,*|*,|*,,*) fail "trusted proxy entries cannot be empty" ;;
+        esac
+        IFS=',' read -r -a environment_proxies <<< "$trusted_proxies_override"
+        trusted_proxies+=("${environment_proxies[@]}")
+    fi
+    trusted_proxies+=("${trusted_proxy_options[@]}")
+fi
+
+[[ -n "$DATA_DIR" ]] || fail "the Executor data directory cannot be empty"
+[[ -n "$TEMPLATES_FILE" ]] || fail "the MCP stdio template file cannot be empty"
+wrapper="${INSTALL_ROOT}/run-launchd.sh"
+log_writer="${INSTALL_ROOT}/bounded-log.sh"
+for value in \
+    "$EXECUTOR_BINARY" \
+    "$DATA_DIR" \
+    "$TEMPLATES_FILE" \
+    "$PUBLIC_ORIGIN" \
+    "$wrapper"; do
+    encoded_value="$(encode_config_value "$value")"
+    validate_encoded_config_value "$encoded_value" "a service path or origin"
+    case "$value" in
+        *'&'*|*'<'*|*'>'*|*'|'*|*'\'*)
+            fail "service paths and origins cannot contain XML or template metacharacters"
+            ;;
+    esac
+done
+for trusted_proxy in "${trusted_proxies[@]}"; do
+    [[ -n "$trusted_proxy" ]] || fail "trusted proxy entries cannot be empty"
+    encoded_value="$(encode_config_value "$trusted_proxy")"
+    validate_encoded_config_value "$encoded_value" "a trusted proxy"
+done
+
+normalize_absolute_path "$DATA_DIR" "the Executor data directory"
+DATA_DIR=$normalized_path
+normalize_absolute_path "$TEMPLATES_FILE" "the MCP stdio template file"
+TEMPLATES_FILE=$normalized_path
+templates_directory="$(dirname "$TEMPLATES_FILE")"
+plist_directory="$(dirname "$PLIST")"
+validate_safe_directory_path "$DATA_DIR" "the Executor data directory"
+validate_safe_directory_path "$templates_directory" "the MCP template directory"
+validate_safe_directory_path "$plist_directory" "the LaunchAgents directory"
+canonicalize_path_without_creation "$DATA_DIR" "the Executor data directory"
+DATA_DIR=$canonical_path
+canonicalize_path_without_creation "$TEMPLATES_FILE" "the MCP stdio template file"
+TEMPLATES_FILE=$canonical_path
+templates_directory="$(dirname "$TEMPLATES_FILE")"
+private_log="${DATA_DIR}/executor.log"
+validate_configured_path_collisions
+require_recoverable_template_file false
+require_regular_file_or_absent "$wrapper" "the LaunchAgent wrapper path"
+require_regular_file_or_absent "$log_writer" "the bounded log helper path"
+require_regular_file_or_absent "$private_log" "the private log path"
+for generation in {1..3}; do
+    require_regular_file_or_absent "${private_log}.${generation}" \
+        "the rotated private log path"
+done
+require_regular_file_or_absent "$PLIST" "the LaunchAgent plist path"
+
+if [[ "$validate_only" == true ]]; then
+    printf 'LaunchAgent paths and configuration are valid.\n'
+    exit 0
+fi
+
+ensure_safe_directory_path "$EXECUTOR_ROOT" "the Executor root directory"
+require_safe_directory_metadata "$EXECUTOR_ROOT" "the Executor root directory" current
+chmod 0700 "$EXECUTOR_ROOT"
+ensure_safe_directory_path "$INSTALL_ROOT" "the Executor service directory"
+require_safe_directory_metadata "$INSTALL_ROOT" "the Executor service directory" current
+chmod 0700 "$INSTALL_ROOT"
+require_private_control_file "$CONFIG_FILE" "the persisted service configuration"
+require_private_control_file "$MANIFEST" "the service ownership manifest"
+require_private_control_file "$RECOVERY_MARKER" "the service installation recovery marker"
+
+ensure_safe_directory_path "$DATA_DIR" "the Executor data directory"
+require_safe_directory_metadata "$DATA_DIR" "the Executor data directory" current
+ensure_safe_directory_path "$templates_directory" "the MCP template directory"
+ensure_safe_directory_path "$plist_directory" "the LaunchAgents directory"
+chmod 0700 "$DATA_DIR"
+DATA_DIR="$(cd "$DATA_DIR" && pwd -P)"
+TEMPLATES_FILE="$(absolute_path "$TEMPLATES_FILE")"
+
+private_log="${DATA_DIR}/executor.log"
+validate_configured_path_collisions
+require_recoverable_template_file false
+require_regular_file_or_absent "$wrapper" "the LaunchAgent wrapper path"
+require_regular_file_or_absent "$log_writer" "the bounded log helper path"
+require_regular_file_or_absent "$private_log" "the private log path"
+for generation in {1..3}; do
+    require_regular_file_or_absent "${private_log}.${generation}" \
+        "the rotated private log path"
+done
+require_regular_file_or_absent "$PLIST" "the LaunchAgent plist path"
+
+if [[ -e "$RECOVERY_MARKER" ]]; then
+    recovery_contents="$(cat "$RECOVERY_MARKER")"
+    [[ "$recovery_contents" == executor-service-install-recovery-v1 ]] \
+        || fail "the service installation recovery marker is malformed"
+else
+    temporary_recovery="$(mktemp "${INSTALL_ROOT}/.service-recovery.XXXXXXXX")"
+    trap 'rm -f "$temporary_recovery"' EXIT
+    printf 'executor-service-install-recovery-v1\n' > "$temporary_recovery"
+    chmod 0600 "$temporary_recovery"
+    sync
+    mv "$temporary_recovery" "$RECOVERY_MARKER"
+    trap - EXIT
+    sync
+fi
+
+require_recoverable_template_file true
+
+temporary_config="$(mktemp "${INSTALL_ROOT}/.service-config.XXXXXXXX")"
+trap 'rm -f "$temporary_config"' EXIT
+{
+    printf 'executor-launchd-config-v1\n'
+    printf 'data_dir_hex=%s\n' "$(encode_config_value "$DATA_DIR")"
+    printf 'templates_file_hex=%s\n' "$(encode_config_value "$TEMPLATES_FILE")"
+    printf 'public_origin_hex=%s\n' "$(encode_config_value "$PUBLIC_ORIGIN")"
+    for trusted_proxy in "${trusted_proxies[@]}"; do
+        printf 'trusted_proxy_hex=%s\n' "$(encode_config_value "$trusted_proxy")"
+    done
+} > "$temporary_config"
+chmod 0600 "$temporary_config"
+sync
+mv -f "$temporary_config" "$CONFIG_FILE"
+trap - EXIT
+sync
+
+if [[ ! -e "$TEMPLATES_FILE" && ! -L "$TEMPLATES_FILE" ]]; then
+    temporary_templates="$(mktemp "${templates_directory}/.executor-templates.XXXXXXXX")"
+    trap 'rm -f "$temporary_templates"' EXIT
+    printf '{\n  "templates": []\n}\n' > "$temporary_templates"
+    chmod 0600 "$temporary_templates"
+    sync
+    if ! ln "$temporary_templates" "$TEMPLATES_FILE"; then
+        fail "the MCP stdio template path appeared during installation"
+    fi
+    sync
+    if [[ ${EXECUTOR_INSTALL_TEST_CRASH_AFTER_TEMPLATE_LINK:-} == 1 ]]; then
+        kill -KILL "${BASHPID}"
+    fi
+    rm -f "$temporary_templates"
+    if [[ ${EXECUTOR_INSTALL_TEST_CRASH_AFTER_TEMPLATE_UNLINK:-} == 1 ]]; then
+        kill -KILL "${BASHPID}"
+    fi
+    sync
+    trap - EXIT
+fi
+[[ -f "$TEMPLATES_FILE" && ! -L "$TEMPLATES_FILE" ]] \
+    || fail "the MCP stdio template path must be a regular file"
+chmod 0600 "$TEMPLATES_FILE"
+require_private_control_file "$TEMPLATES_FILE" "the MCP stdio template path"
+
+temporary_log_writer="$(mktemp "${log_writer}.XXXXXXXX")"
+trap 'rm -f "$temporary_log_writer"' EXIT
+cp "$LOG_WRITER_SOURCE" "$temporary_log_writer"
+chmod 0700 "$temporary_log_writer"
+mv -f "$temporary_log_writer" "$log_writer"
+trap - EXIT
+
+temporary_wrapper="$(mktemp "${wrapper}.XXXXXXXX")"
+trap 'rm -f "$temporary_wrapper"' EXIT
+{
+    printf '#!/bin/bash\nset -euo pipefail\nexec '
+    printf '%q ' "$EXECUTOR_BINARY" server --data-dir "$DATA_DIR" \
+        --mcp-stdio-templates "$TEMPLATES_FILE"
+    if [[ -n "$PUBLIC_ORIGIN" ]]; then
+        printf '%q ' --public-origin "$PUBLIC_ORIGIN"
+    fi
+    if [[ ${#trusted_proxies[@]} -gt 0 ]]; then
+        for trusted_proxy in "${trusted_proxies[@]}"; do
+            [[ -n "$trusted_proxy" ]] || fail "trusted proxy entries cannot be empty"
+            printf '%q ' --trusted-proxy "$trusted_proxy"
+        done
+    fi
+    printf '> >(%q %q) 2>&1\n' "$log_writer" "$private_log"
+} > "$temporary_wrapper"
+chmod 0700 "$temporary_wrapper"
+mv -f "$temporary_wrapper" "$wrapper"
+trap - EXIT
+
+temporary_plist="$(mktemp "${PLIST}.XXXXXXXX")"
+trap 'rm -f "$temporary_plist"' EXIT
+sed -e "s|@EXECUTOR_WRAPPER@|${wrapper}|g" "$TEMPLATE" > "$temporary_plist"
+
+plutil -lint "$temporary_plist" >/dev/null
+chmod 0600 "$temporary_plist"
+mv -f "$temporary_plist" "$PLIST"
+trap - EXIT
+
+binary_hash="$(shasum -a 256 "$EXECUTOR_BINARY" | awk '{print $1}')"
+plist_hash="$(shasum -a 256 "$PLIST" | awk '{print $1}')"
+wrapper_hash="$(shasum -a 256 "$wrapper" | awk '{print $1}')"
+logger_hash="$(shasum -a 256 "$log_writer" | awk '{print $1}')"
+config_hash="$(shasum -a 256 "$CONFIG_FILE" | awk '{print $1}')"
+temporary_manifest="$(mktemp "${INSTALL_ROOT}/.service-install.XXXXXXXX")"
+trap 'rm -f "$temporary_manifest"' EXIT
+{
+    printf 'executor-service-install-v1\n'
+    printf 'binary %s\n' "$binary_hash"
+    printf 'plist %s\n' "$plist_hash"
+    printf 'wrapper %s\n' "$wrapper_hash"
+    printf 'logger %s\n' "$logger_hash"
+    printf 'config %s\n' "$config_hash"
+} > "$temporary_manifest"
+chmod 0600 "$temporary_manifest"
+sync
+mv -f "$temporary_manifest" "$MANIFEST"
+trap - EXIT
+sync
+rm -f "$RECOVERY_MARKER"
+sync
+
+domain="gui/$(id -u)"
+launchctl bootout "$domain/$LABEL" >/dev/null 2>&1 || true
+if [[ "$start_service" == "true" ]]; then
+    launchctl enable "$domain/$LABEL"
+    launchctl bootstrap "$domain" "$PLIST"
+    ready=false
+    previous_pid=""
+    consecutive_checks=0
+    for _ in {1..30}; do
+        current_pid="$(launchctl print "$domain/$LABEL" 2>/dev/null \
+            | awk '/^[[:space:]]*pid = [0-9]+$/ { print $3; exit }')"
+        if [[ -n "$current_pid" ]] \
+            && curl --fail --silent --show-error --noproxy '*' \
+                --connect-timeout 1 --max-time 1 \
+                http://127.0.0.1:4788/healthz >/dev/null 2>&1; then
+            if [[ "$current_pid" == "$previous_pid" ]]; then
+                consecutive_checks=$((consecutive_checks + 1))
+            else
+                consecutive_checks=1
+                previous_pid="$current_pid"
+            fi
+            if [[ "$consecutive_checks" -ge 2 ]]; then
+                ready=true
+                break
+            fi
+        else
+            consecutive_checks=0
+            previous_pid=""
+        fi
+        sleep 1
+    done
+    if [[ "$ready" != "true" ]]; then
+        launchctl print "$domain/$LABEL" >&2 || true
+        launchctl bootout "$domain/$LABEL" >/dev/null 2>&1 || true
+        fail "Executor did not become healthy within 30 seconds"
+    fi
+    printf 'Executor is running at http://127.0.0.1:4788\n'
+    printf 'Read first-boot setup and logs at %s\n' "$private_log"
+else
+    printf 'Installed %s\n' "$PLIST"
+    printf 'Load it with: launchctl bootstrap %s %q\n' "$domain" "$PLIST"
+fi
diff --git a/scripts/install-systemd.sh b/scripts/install-systemd.sh
new file mode 100755
index 000000000..e6d205655
--- /dev/null
+++ b/scripts/install-systemd.sh
@@ -0,0 +1,362 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+readonly APP_USER="executor"
+readonly APP_GROUP="executor"
+readonly BINARY_TARGET="/usr/local/bin/executor"
+readonly CONFIG_DIR="/etc/executor"
+readonly DATA_DIR="/var/lib/executor"
+readonly MASTER_KEY_STAGING_PARENT="${DATA_DIR%/*}"
+readonly UNIT_TARGET="/etc/systemd/system/executor.service"
+readonly MANIFEST_TARGET="${CONFIG_DIR}/service-install.manifest"
+readonly RECOVERY_TARGET="${CONFIG_DIR}/service-install.recovery"
+readonly SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)
+readonly REPO_DIR=$(cd -- "${SCRIPT_DIR}/.." && pwd -P)
+readonly UNIT_SOURCE="${REPO_DIR}/packaging/systemd/executor.service"
+readonly ENV_SOURCE="${REPO_DIR}/packaging/systemd/executor.env.example"
+source "${SCRIPT_DIR}/lib/install-systemd-master-key.sh"
+
+validate_systemd_path_layout() {
+    local persistent_path persistent_root managed_path
+
+    for persistent_path in \
+        "${DATA_DIR}/master.key" \
+        "${CONFIG_DIR}/executor.env" \
+        "${CONFIG_DIR}/mcp-stdio-templates.json"; do
+        for managed_path in \
+            "${BINARY_TARGET}" \
+            "${UNIT_TARGET}" \
+            "${MANIFEST_TARGET}" \
+            "${RECOVERY_TARGET}"; do
+            executor_require_disjoint_paths \
+                "${persistent_path}" "persistent Executor state" \
+                "${managed_path}" "a managed service path"
+        done
+    done
+    for persistent_root in "${DATA_DIR}" "${CONFIG_DIR}"; do
+        executor_require_disjoint_paths \
+            "${persistent_root}" "an Executor state directory" \
+            "${BINARY_TARGET}" "the managed service binary"
+        executor_require_disjoint_paths \
+            "${persistent_root}" "an Executor state directory" \
+            "${UNIT_TARGET}" "the managed systemd unit"
+    done
+}
+
+usage() {
+    cat <<'EOF'
+Install Executor as a hardened systemd service.
+
+Usage: sudo scripts/install-systemd.sh [--binary /path/to/executor] [--no-start]
+
+Options:
+    --binary PATH  Install this binary. Defaults to executor from PATH.
+    --no-start     Install and enable the unit without starting it.
+    -h, --help     Show this help.
+
+The installer never replaces an existing master key, environment file, or MCP
+stdio template registry.
+EOF
+}
+
+binary_source=""
+start_service=true
+while (($# > 0)); do
+    case "$1" in
+        --binary)
+            if (($# < 2)); then
+                echo "--binary requires a path" >&2
+                exit 2
+            fi
+            binary_source=$2
+            shift 2
+            ;;
+        --no-start)
+            start_service=false
+            shift
+            ;;
+        -h|--help)
+            usage
+            exit 0
+            ;;
+        *)
+            echo "unknown option: $1" >&2
+            usage >&2
+            exit 2
+            ;;
+    esac
+done
+
+validate_systemd_path_layout
+
+if [[ ${EUID} -ne 0 ]]; then
+    echo "run this installer as root, for example with sudo" >&2
+    exit 1
+fi
+if ! command -v systemctl >/dev/null 2>&1; then
+    echo "systemctl is required" >&2
+    exit 1
+fi
+if ! command -v sha256sum >/dev/null 2>&1; then
+    echo "sha256sum is required" >&2
+    exit 1
+fi
+if [[ ${start_service} == true ]] && ! command -v curl >/dev/null 2>&1; then
+    echo "curl is required for the startup readiness check" >&2
+    exit 1
+fi
+
+service_was_active=false
+service_is_quiescent=false
+service_lifecycle_managed=false
+installation_finished=false
+manifest_temporary=""
+recovery_temporary=""
+
+on_installer_exit() {
+    local status=$?
+    trap - EXIT
+    if [[ -n ${manifest_temporary} ]]; then
+        rm -f -- "${manifest_temporary}"
+    fi
+    if [[ -n ${recovery_temporary} ]]; then
+        rm -f -- "${recovery_temporary}"
+    fi
+    if ((status != 0)) && [[ ${service_lifecycle_managed} == true \
+        && ${installation_finished} != true ]]; then
+        if [[ ${service_is_quiescent} != true ]]; then
+            if systemctl stop executor.service >/dev/null 2>&1; then
+                service_is_quiescent=true
+            else
+                echo "installation failed and executor.service could not be stopped" >&2
+                echo "inspect its status before retrying the installation" >&2
+            fi
+        fi
+        if [[ ${service_is_quiescent} == true ]]; then
+            echo "installation failed; executor.service was left stopped" >&2
+            echo "fix the reported problem, then rerun the installer or start the service manually" >&2
+        fi
+    fi
+    exit "${status}"
+}
+trap on_installer_exit EXIT
+
+service_state=$(systemctl is-active executor.service 2>/dev/null || true)
+case "${service_state}" in
+    active|activating|reloading|deactivating)
+        service_was_active=true
+        if ! systemctl stop executor.service; then
+            echo "could not stop executor.service before inspecting its state" >&2
+            exit 1
+        fi
+        service_is_quiescent=true
+        ;;
+    inactive|failed|unknown)
+        service_is_quiescent=true
+        ;;
+    *)
+        echo "could not determine whether executor.service is active" >&2
+        exit 1
+        ;;
+esac
+service_lifecycle_managed=true
+
+if [[ -z ${binary_source} ]]; then
+    binary_source=$(command -v executor || true)
+fi
+if [[ -z ${binary_source} || ! -f ${binary_source} || ! -x ${binary_source} ]]; then
+    echo "an executable Executor binary is required; pass --binary PATH" >&2
+    exit 1
+fi
+binary_source=$(cd -- "$(dirname -- "${binary_source}")" && pwd -P)/$(basename -- "${binary_source}")
+
+if ! getent group "${APP_GROUP}" >/dev/null; then
+    groupadd --system "${APP_GROUP}"
+fi
+if ! id -u "${APP_USER}" >/dev/null 2>&1; then
+    useradd \
+        --system \
+        --gid "${APP_GROUP}" \
+        --home-dir "${DATA_DIR}" \
+        --shell "$(command -v nologin || echo /usr/sbin/nologin)" \
+        "${APP_USER}"
+fi
+IFS=: read -r _ _ app_uid _ _ app_home app_shell \
+    <<< "$(getent passwd "${APP_USER}")"
+app_primary_group=$(id -gn "${APP_USER}")
+password_status=$(passwd -S "${APP_USER}" 2>/dev/null | awk '{print $2}')
+if [[ ${app_uid} -eq 0 \
+    || ${app_home} != "${DATA_DIR}" \
+    || ! ${app_shell} =~ /(nologin|false)$ \
+    || ${app_primary_group} != "${APP_GROUP}" \
+    || ! ${password_status} =~ ^(L|LK)$ ]]; then
+    echo "the executor account exists but is not the expected locked system account" >&2
+    echo "refusing to grant it access to Executor state" >&2
+    exit 1
+fi
+
+for managed_dir in "${CONFIG_DIR}" "${DATA_DIR}"; do
+    executor_require_safe_directory "${managed_dir}"
+done
+for managed_file in \
+    "${BINARY_TARGET}" \
+    "${UNIT_TARGET}" \
+    "${CONFIG_DIR}/executor.env" \
+    "${CONFIG_DIR}/mcp-stdio-templates.json" \
+    "${MANIFEST_TARGET}" \
+    "${RECOVERY_TARGET}" \
+    "${DATA_DIR}/master.key"; do
+    executor_require_regular_file_or_absent "${managed_file}"
+done
+if [[ -e ${MANIFEST_TARGET} ]]; then
+    manifest_uid=$(stat -c '%u' -- "${MANIFEST_TARGET}")
+    manifest_gid=$(stat -c '%g' -- "${MANIFEST_TARGET}")
+    manifest_mode=$(stat -c '%a' -- "${MANIFEST_TARGET}")
+    manifest_links=$(stat -c '%h' -- "${MANIFEST_TARGET}")
+    if [[ ${manifest_uid} -ne 0 || ${manifest_gid} -ne 0 \
+        || ${manifest_mode} != 600 || ${manifest_links} -ne 1 ]]; then
+        echo "the service ownership manifest has unsafe metadata" >&2
+        exit 1
+    fi
+fi
+if [[ -e ${RECOVERY_TARGET} ]]; then
+    recovery_uid=$(stat -c '%u' -- "${RECOVERY_TARGET}")
+    recovery_gid=$(stat -c '%g' -- "${RECOVERY_TARGET}")
+    recovery_mode=$(stat -c '%a' -- "${RECOVERY_TARGET}")
+    recovery_links=$(stat -c '%h' -- "${RECOVERY_TARGET}")
+    recovery_contents=$(cat -- "${RECOVERY_TARGET}")
+    if [[ ${recovery_uid} -ne 0 || ${recovery_gid} -ne 0 \
+        || ${recovery_mode} != 600 || ${recovery_links} -ne 1 \
+        || ${recovery_contents} != executor-service-install-recovery-v1 ]]; then
+        echo "the service installation recovery marker is unsafe or malformed" >&2
+        exit 1
+    fi
+fi
+
+install -d -o root -g "${APP_GROUP}" -m 0750 "${CONFIG_DIR}"
+install -d -o "${APP_USER}" -g "${APP_GROUP}" -m 0700 "${DATA_DIR}"
+
+if [[ ! -e ${CONFIG_DIR}/executor.env ]]; then
+    install -o root -g "${APP_GROUP}" -m 0640 \
+        "${ENV_SOURCE}" "${CONFIG_DIR}/executor.env"
+fi
+if [[ ! -e ${CONFIG_DIR}/mcp-stdio-templates.json ]]; then
+    umask 0027
+    printf '{\n  "templates": []\n}\n' > "${CONFIG_DIR}/mcp-stdio-templates.json"
+    chown root:"${APP_GROUP}" "${CONFIG_DIR}/mcp-stdio-templates.json"
+    chmod 0640 "${CONFIG_DIR}/mcp-stdio-templates.json"
+fi
+if [[ ( -e ${DATA_DIR}/executor.db || -L ${DATA_DIR}/executor.db ) \
+    && ! -e ${DATA_DIR}/master.key \
+    && ! -L ${DATA_DIR}/master.key ]]; then
+    echo "an existing Executor database has no master key; restore the original key" >&2
+    exit 1
+fi
+app_gid=$(id -g "${APP_USER}")
+executor_ensure_master_key \
+    "${MASTER_KEY_STAGING_PARENT}" "${DATA_DIR}" \
+    "${DATA_DIR}/master.key" "${app_uid}" "${app_gid}"
+
+chown root:"${APP_GROUP}" \
+    "${CONFIG_DIR}/executor.env" \
+    "${CONFIG_DIR}/mcp-stdio-templates.json"
+chmod 0640 \
+    "${CONFIG_DIR}/executor.env" \
+    "${CONFIG_DIR}/mcp-stdio-templates.json"
+
+if [[ ! -e ${RECOVERY_TARGET} ]]; then
+    recovery_temporary=$(mktemp "${CONFIG_DIR}/.service-recovery.XXXXXXXX")
+    printf 'executor-service-install-recovery-v1\n' > "${recovery_temporary}"
+    chown root:root "${recovery_temporary}"
+    chmod 0600 "${recovery_temporary}"
+    sync -f "${recovery_temporary}"
+    mv -- "${recovery_temporary}" "${RECOVERY_TARGET}"
+    recovery_temporary=""
+    sync -f "${RECOVERY_TARGET}"
+fi
+
+if [[ ${binary_source} != "${BINARY_TARGET}" ]]; then
+    install -o root -g root -m 0755 "${binary_source}" "${BINARY_TARGET}"
+else
+    chown root:root "${BINARY_TARGET}"
+    chmod 0755 "${BINARY_TARGET}"
+fi
+install -o root -g root -m 0644 "${UNIT_SOURCE}" "${UNIT_TARGET}"
+executor_require_filesystem_sync \
+    "${BINARY_TARGET}" "the installed Executor binary"
+executor_require_filesystem_sync \
+    "${BINARY_TARGET%/*}" "the Executor binary directory"
+executor_require_filesystem_sync \
+    "${UNIT_TARGET}" "the installed systemd unit"
+executor_require_filesystem_sync \
+    "${UNIT_TARGET%/*}" "the systemd unit directory"
+
+binary_hash=$(sha256sum -- "${BINARY_TARGET}" | awk '{print $1}')
+unit_hash=$(sha256sum -- "${UNIT_TARGET}" | awk '{print $1}')
+manifest_temporary=$(mktemp "${CONFIG_DIR}/.service-install.XXXXXXXX")
+{
+    printf 'executor-service-install-v1\n'
+    printf 'binary %s\n' "${binary_hash}"
+    printf 'unit %s\n' "${unit_hash}"
+} > "${manifest_temporary}"
+chown root:root "${manifest_temporary}"
+chmod 0600 "${manifest_temporary}"
+sync -f "${manifest_temporary}"
+mv -f -- "${manifest_temporary}" "${MANIFEST_TARGET}"
+manifest_temporary=""
+sync -f "${MANIFEST_TARGET}"
+rm -f -- "${RECOVERY_TARGET}"
+sync -f "${CONFIG_DIR}"
+
+systemctl daemon-reload
+systemctl enable executor.service
+if [[ ${start_service} == true ]]; then
+    service_is_quiescent=false
+    if ! systemctl start executor.service; then
+        systemctl status --no-pager executor.service || true
+        exit 1
+    fi
+    ready=false
+    healthy_checks=0
+    last_main_pid=0
+    for _ in {1..30}; do
+        main_pid=$(systemctl show --property MainPID --value executor.service)
+        if systemctl is-active --quiet executor.service \
+            && [[ ${main_pid} =~ ^[1-9][0-9]*$ ]] \
+            && curl --noproxy '*' --fail --silent --max-time 1 \
+                http://127.0.0.1:4788/healthz >/dev/null; then
+            if [[ ${main_pid} == "${last_main_pid}" ]]; then
+                ((healthy_checks += 1))
+            else
+                healthy_checks=1
+                last_main_pid=${main_pid}
+            fi
+            if ((healthy_checks >= 2)); then
+                ready=true
+                break
+            fi
+        else
+            healthy_checks=0
+            last_main_pid=0
+        fi
+        if systemctl is-failed --quiet executor.service; then
+            break
+        fi
+        sleep 1
+    done
+    if [[ ${ready} != true ]]; then
+        echo "Executor did not become ready" >&2
+        systemctl status --no-pager executor.service || true
+        journalctl --unit executor.service --lines 30 --no-pager || true
+        exit 1
+    fi
+    installation_finished=true
+    echo "Executor is ready at http://127.0.0.1:4788"
+else
+    installation_finished=true
+    if [[ ${service_was_active} == true ]]; then
+        echo "Executor was stopped and remains stopped because --no-start was supplied."
+    fi
+    echo "Executor is installed. Start it with: systemctl start executor.service"
+fi
+echo "Follow logs with: journalctl -u executor.service -f"
diff --git a/scripts/install.sh b/scripts/install.sh
index 345743148..eda8da73a 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -1,12 +1,66 @@
 #!/usr/bin/env bash
 set -euo pipefail
-APP=executor
-REPO=RhysSullivan/executor
 
-MUTED='\033[0;2m'
-RED='\033[0;31m'
-ORANGE='\033[38;5;214m'
-NC='\033[0m'
+APP="executor"
+REPOSITORY="${EXECUTOR_REPOSITORY:-davis7dotsh/executor-fork-testing}"
+INSTALL_DIR="${EXECUTOR_INSTALL_DIR:-$HOME/.executor/bin}"
+MANIFEST_NAME=".executor-install-manifest"
+PATH_OWNERSHIP_NAME=".executor-path-ownership"
+RECOVERY_NAME=".executor-install-recovery"
+LOCK_NAME=".executor-install-lock"
+requested_version="${VERSION:-}"
+binary_path=""
+local_archive_path=""
+local_checksum_path=""
+no_modify_path=false
+uninstall=false
+version_option=false
+manifest_present=false
+manifest_digest=""
+manifest_executor_hash=""
+manifest_license_hash=""
+manifest_rust_notices_hash=""
+manifest_javascript_notices_hash=""
+manifest_path_ownership_hash=""
+install_source_executor=""
+install_source_license=""
+install_source_rust_notices=""
+install_source_javascript_notices=""
+record_path_config=false
+path_update_requested=false
+path_already_present=false
+recorded_config_file=""
+recorded_path_command=""
+path_edit_changed=false
+path_edit_error=""
+path_edit_lock_acquired=false
+path_edit_lock_digest=""
+path_edit_lock_identity=""
+path_edit_lock_path=""
+path_edit_parent=""
+path_edit_parent_identity=""
+path_edit_result=""
+trusted_temp_root=""
+trusted_temp_root_identity=""
+temporary_directory=""
+temporary_directory_identity=""
+test_swapped_temp_directory=""
+install_lock_acquired=false
+install_lock_digest=""
+install_lock_identity=""
+install_root_identity=""
+install_root_parent=""
+install_root_parent_identity=""
+recovery_executor_old=""
+recovery_executor_new=""
+recovery_license_old=""
+recovery_license_new=""
+recovery_rust_notices_old=""
+recovery_rust_notices_new=""
+recovery_javascript_notices_old=""
+recovery_javascript_notices_new=""
+recovery_path_ownership_old=""
+recovery_path_ownership_new=""
 
 usage() {
     cat <<EOF
@@ -16,20 +70,31 @@ Usage: install.sh [options]
 
 Options:
     -h, --help              Display this help message
-    -v, --version <version> Install a specific version (e.g. 1.4.12)
+    -v, --version <version> Install a specific version, such as 2.0.0
     -b, --binary <path>     Install from a local binary instead of downloading
-        --no-modify-path    Don't modify shell config files (.zshrc, .bashrc, etc.)
+    -a, --archive <path>    Install a release archive from disk
+        --checksum <path>   Checksum sidecar for --archive (default: <path>.sha256)
+        --no-modify-path    Do not modify shell configuration files
+        --uninstall         Remove installer-owned files and PATH entry
+
+Environment:
+    EXECUTOR_INSTALL_DIR    Binary directory (default: \$HOME/.executor/bin)
+    EXECUTOR_REPOSITORY     GitHub owner/repository for downloads
+                            (default: davis7dotsh/executor-fork-testing)
+    VERSION                 Version to install when --version is omitted
 
 Examples:
-    curl -fsSL https://raw.githubusercontent.com/${REPO}/main/scripts/install.sh | bash
-    curl -fsSL https://raw.githubusercontent.com/${REPO}/main/scripts/install.sh | bash -s -- --version 1.4.12
-    ./install.sh --binary /path/to/executor
+    curl -fsSL https://raw.githubusercontent.com/${REPOSITORY}/main/scripts/install.sh | bash
+    curl -fsSL https://raw.githubusercontent.com/${REPOSITORY}/main/scripts/install.sh | bash -s -- --version 2.0.0
+    curl -fsSL https://raw.githubusercontent.com/${REPOSITORY}/main/scripts/install.sh | bash -s -- --uninstall
+    ./scripts/install.sh --binary ./target/release/executor
 EOF
 }
 
-requested_version=${VERSION:-}
-no_modify_path=false
-binary_path=""
+fail() {
+    printf 'Error: %s\n' "$1" >&2
+    exit 1
+}
 
 while [[ $# -gt 0 ]]; do
     case "$1" in
@@ -38,250 +103,1855 @@ while [[ $# -gt 0 ]]; do
             exit 0
             ;;
         -v|--version)
-            if [[ -n "${2:-}" ]]; then
-                requested_version="$2"
-                shift 2
-            else
-                echo -e "${RED}Error: --version requires a version argument${NC}" >&2
-                exit 1
-            fi
+            [[ -n "${2:-}" ]] || fail "--version requires a version"
+            requested_version="$2"
+            version_option=true
+            shift 2
             ;;
         -b|--binary)
-            if [[ -n "${2:-}" ]]; then
-                binary_path="$2"
-                shift 2
-            else
-                echo -e "${RED}Error: --binary requires a path argument${NC}" >&2
-                exit 1
-            fi
+            [[ -n "${2:-}" ]] || fail "--binary requires a path"
+            binary_path="$2"
+            shift 2
+            ;;
+        -a|--archive)
+            [[ -n "${2:-}" ]] || fail "--archive requires a path"
+            local_archive_path="$2"
+            shift 2
+            ;;
+        --checksum)
+            [[ -n "${2:-}" ]] || fail "--checksum requires a path"
+            local_checksum_path="$2"
+            shift 2
             ;;
         --no-modify-path)
             no_modify_path=true
             shift
             ;;
-        *)
-            echo -e "${ORANGE}Warning: Unknown option '$1'${NC}" >&2
+        --uninstall)
+            uninstall=true
             shift
             ;;
+        *)
+            fail "unknown option: $1"
+            ;;
     esac
 done
 
-INSTALL_DIR="${EXECUTOR_INSTALL_DIR:-$HOME/.executor/bin}"
-mkdir -p "$INSTALL_DIR"
-
-print_message() {
-    local level=$1 message=$2 color=""
-    case "$level" in
-        info) color="${NC}" ;;
-        warning) color="${ORANGE}" ;;
-        error) color="${RED}" ;;
+if [[ -n "$binary_path" && -n "$local_archive_path" ]]; then
+    fail "--binary and --archive cannot be used together"
+fi
+if [[ -n "$local_checksum_path" && -z "$local_archive_path" ]]; then
+    fail "--checksum requires --archive"
+fi
+if [[ "$uninstall" == "true" ]] \
+    && [[ "$version_option" == "true" \
+        || -n "$binary_path" \
+        || -n "$local_archive_path" \
+        || -n "$local_checksum_path" ]]; then
+    fail "--uninstall cannot be combined with install source options"
+fi
+
+[[ "$INSTALL_DIR" == /* ]] || fail "EXECUTOR_INSTALL_DIR must be an absolute path"
+[[ "$INSTALL_DIR" != "/" ]] || fail "EXECUTOR_INSTALL_DIR cannot be the filesystem root"
+case "$INSTALL_DIR" in
+    *:*|*$'\n'*|*$'\r'*) fail "EXECUTOR_INSTALL_DIR cannot contain colons or line breaks" ;;
+esac
+
+resolve_path_config() {
+    local current_shell quoted_install_dir
+    current_shell="$(basename "${SHELL:-bash}")"
+    case "$current_shell" in
+        fish)
+            config_file="$HOME/.config/fish/config.fish"
+            quoted_install_dir=${INSTALL_DIR//\\/\\\\}
+            quoted_install_dir=${quoted_install_dir//\'/\\\'}
+            path_command="fish_add_path -- '$quoted_install_dir'"
+            ;;
+        zsh)
+            config_file="${ZDOTDIR:-$HOME}/.zshrc"
+            printf -v quoted_install_dir '%q' "$INSTALL_DIR"
+            path_command="export PATH=$quoted_install_dir:\$PATH"
+            ;;
+        *)
+            config_file="$HOME/.bashrc"
+            printf -v quoted_install_dir '%q' "$INSTALL_DIR"
+            path_command="export PATH=$quoted_install_dir:\$PATH"
+            ;;
     esac
-    echo -e "${color}${message}${NC}"
 }
 
-if [[ -n "$binary_path" ]]; then
-    if [[ ! -f "$binary_path" ]]; then
-        print_message error "Error: binary not found at $binary_path"
-        exit 1
+file_has_exact_line() {
+    local file=$1 expected=$2 line normalized
+    while IFS= read -r line || [[ -n "$line" ]]; do
+        normalized="${line%$'\r'}"
+        if [[ "$normalized" == "$expected" ]]; then
+            return 0
+        fi
+    done < "$file"
+    return 1
+}
+
+prepare_path_config_tracking() {
+    if [[ "$no_modify_path" == "true" || ":${PATH}:" == *":${INSTALL_DIR}:"* ]]; then
+        return 0
     fi
-    specific_version="local"
-else
-    raw_os=$(uname -s)
-    case "$raw_os" in
-        Darwin*) os="darwin" ;;
-        Linux*) os="linux" ;;
-        MINGW*|MSYS*|CYGWIN*) os="windows" ;;
-        *)
-            print_message error "Unsupported OS: $raw_os"
-            exit 1
-            ;;
+    path_update_requested=true
+    resolve_path_config
+    recorded_config_file="$config_file"
+    recorded_path_command="$path_command"
+    case "$recorded_config_file$recorded_path_command" in
+        *$'\t'*|*$'\n'*|*$'\r'*) return 0 ;;
     esac
+    [[ "$recorded_config_file" == /* ]] || return 0
+    if [[ -f "$recorded_config_file" \
+        && ! -L "$recorded_config_file" \
+        && -O "$recorded_config_file" \
+        && -w "$recorded_config_file" ]]; then
+        if file_has_exact_line "$recorded_config_file" "$recorded_path_command"; then
+            path_already_present=true
+            return 0
+        fi
+        record_path_config=true
+    fi
+}
 
-    arch=$(uname -m)
-    case "$arch" in
-        aarch64|arm64) arch="arm64" ;;
-        x86_64|amd64) arch="x64" ;;
-        *)
-            print_message error "Unsupported architecture: $arch"
-            exit 1
+print_manual_path_change() {
+    local operation=$1 config=$2 command=$3
+    if [[ "$operation" == "add" ]]; then
+        printf 'Add this to %s:\n  %s\n' "$config" "$command"
+    else
+        printf 'Could not update %s. Remove these exact lines manually:\n' "$config"
+        printf '  # Executor\n  %s\n' "$command"
+    fi
+}
+
+remove_path_entry() {
+    edit_path_config_portable remove "$1" "$2"
+}
+
+sha256_file() {
+    local path=$1
+    if command -v sha256sum >/dev/null 2>&1; then
+        sha256sum "$path" | awk '{ print $1 }'
+    elif command -v shasum >/dev/null 2>&1; then
+        shasum -a 256 "$path" | awk '{ print $1 }'
+    else
+        fail "sha256sum or shasum is required"
+    fi
+}
+
+durability_checkpoint() {
+    local label=$1
+    if [[ -n "${EXECUTOR_INSTALL_TEST_DURABILITY_LOG:-}" ]]; then
+        printf '%s\n' "$label" >> "$EXECUTOR_INSTALL_TEST_DURABILITY_LOG" \
+            || fail "could not record durability checkpoint: $label"
+    fi
+    if [[ "${EXECUTOR_INSTALL_TEST_FAIL_DURABILITY_POINT:-}" == "$label" ]]; then
+        fail "injected durability failure at $label"
+    fi
+}
+
+sync_with_label() {
+    local label=$1
+    command -v sync >/dev/null 2>&1 || return 1
+    EXECUTOR_INSTALL_SYNC_LABEL="$label" sync
+}
+
+durability_barrier() {
+    local label=$1
+    if [[ -n "$install_root_identity" ]]; then
+        assert_install_root
+    fi
+    sync_with_label "$label" || fail "could not complete durability barrier: $label"
+    durability_checkpoint "$label"
+}
+
+portable_file_identity() {
+    if stat -c '%d:%i:%u:%g:%f' -- "$1" >/dev/null 2>&1; then
+        stat -c '%d:%i:%u:%g:%f' -- "$1"
+    else
+        stat -f '%d:%i:%u:%g:%p' "$1"
+    fi
+}
+
+portable_link_count() {
+    if stat -c '%h' -- "$1" >/dev/null 2>&1; then
+        stat -c '%h' -- "$1"
+    else
+        stat -f '%l' "$1"
+    fi
+}
+
+process_identity() {
+    local pid=$1 stat_line remainder start_time boot_id snapshot
+    if [[ "${EXECUTOR_INSTALL_TEST_FAIL_PROCESS_IDENTITY_PID:-}" == "$pid" ]]; then
+        return 1
+    fi
+    if [[ -r "/proc/${pid}/stat" && -r /proc/sys/kernel/random/boot_id ]]; then
+        stat_line="$(< "/proc/${pid}/stat")" || return 1
+        [[ "$stat_line" == *') '* ]] || return 1
+        remainder="${stat_line##*) }"
+        start_time="$(awk '{ print $20 }' <<< "$remainder")"
+        [[ "$start_time" =~ ^[0-9]+$ ]] || return 1
+        boot_id="$(< /proc/sys/kernel/random/boot_id)" || return 1
+        printf 'linux:%s:%s\n' "$boot_id" "$start_time"
+        return 0
+    fi
+    snapshot="$(LC_ALL=C ps -p "$pid" -o lstart= -o command= 2>/dev/null)" \
+        || return 1
+    [[ -n "$snapshot" ]] || return 1
+    printf '%s' "$snapshot" | cksum | awk '{ printf "ps:%s:%s\n", $1, $2 }'
+}
+
+validate_existing_secure_directory_chain() {
+    local path=$1 remainder component current
+    [[ "$path" == /* ]] || return 1
+    case "$path" in
+        */|*//*|*/./*|*/../*|*/.|*/..) return 1 ;;
+    esac
+    validate_install_path_component /
+    remainder="${path#/}"
+    current=""
+    while [[ -n "$remainder" ]]; do
+        component="${remainder%%/*}"
+        [[ -n "$component" && "$component" != "." && "$component" != ".." ]] \
+            || return 1
+        current="${current}/${component}"
+        validate_install_path_component "$current"
+        if [[ "$remainder" == "$component" ]]; then
+            remainder=""
+        else
+            remainder="${remainder#*/}"
+        fi
+    done
+}
+
+assert_path_edit_parent() {
+    [[ -d "$path_edit_parent" && ! -L "$path_edit_parent" ]] \
+        || return 1
+    [[ "$(portable_file_identity "$path_edit_parent")" == "$path_edit_parent_identity" ]]
+}
+
+read_path_edit_lock() {
+    local lock=$1 before after line key value extra line_number=0
+    observed_lock_pid=""
+    observed_lock_process_identity=""
+    [[ -f "$lock" && ! -L "$lock" && -O "$lock" ]] || return 1
+    before="$(sha256_file "$lock")" || return 1
+    while IFS= read -r line || [[ -n "$line" ]]; do
+        line_number=$((line_number + 1))
+        if [[ "$line_number" -eq 1 ]]; then
+            [[ "$line" == "executor-path-edit-lock-v1" ]] || return 1
+            continue
+        fi
+        IFS=' ' read -r key value extra <<< "$line"
+        [[ -n "$key" && -n "$value" && -z "${extra:-}" ]] || return 1
+        case "$key" in
+            pid)
+                [[ -z "$observed_lock_pid" && "$value" =~ ^[1-9][0-9]*$ ]] \
+                    || return 1
+                observed_lock_pid="$value"
+                ;;
+            identity)
+                [[ -z "$observed_lock_process_identity" \
+                    && "$value" =~ ^[A-Za-z0-9:._-]+$ ]] \
+                    || return 1
+                observed_lock_process_identity="$value"
+                ;;
+            *) return 1 ;;
+        esac
+    done < "$lock"
+    [[ "$line_number" -eq 3 \
+        && -n "$observed_lock_pid" \
+        && -n "$observed_lock_process_identity" ]] \
+        || return 1
+    after="$(sha256_file "$lock")" || return 1
+    [[ "$after" == "$before" ]] || return 1
+    observed_lock_digest="$after"
+    observed_lock_identity="$(portable_file_identity "$lock")" || return 1
+}
+
+reclaim_stale_path_edit_lock() {
+    local lock=$1 expected_identity=$2 expected_digest=$3 candidate snapshot
+    assert_install_root
+    assert_path_edit_parent || return 1
+    for candidate in "${lock}.owner."*; do
+        [[ -e "$candidate" || -L "$candidate" ]] || continue
+        if [[ -f "$candidate" && ! -L "$candidate" && -O "$candidate" ]] \
+            && [[ "$(portable_file_identity "$candidate")" == "$expected_identity" ]] \
+            && [[ "$(sha256_file "$candidate")" == "$expected_digest" ]]; then
+            rm -f -- "$candidate" || return 1
+        fi
+    done
+    sync_with_label path-edit-stale-owner-cleanup || return 1
+    snapshot="$(mktemp "${lock}.stale.XXXXXXXX")" || return 1
+    rm -f -- "$snapshot" || return 1
+    if ! ln "$lock" "$snapshot" 2>/dev/null; then
+        return 1
+    fi
+    if [[ ! -f "$lock" \
+        || -L "$lock" \
+        || "$(portable_file_identity "$lock")" != "$expected_identity" \
+        || "$(sha256_file "$lock")" != "$expected_digest" \
+        || "$(portable_file_identity "$snapshot")" != "$expected_identity" \
+        || "$(portable_link_count "$snapshot")" -ne 2 ]]; then
+        rm -f -- "$snapshot" || return 1
+        sync_with_label path-edit-stale-snapshot-cleanup || return 1
+        return 1
+    fi
+    if ! assert_path_edit_parent; then
+        rm -f -- "$snapshot" || return 1
+        return 1
+    fi
+    if ! rm -f -- "$lock"; then
+        if ! rm -f -- "$snapshot"; then
+            :
+        fi
+        return 1
+    fi
+    sync_with_label path-edit-stale-lock-reclaimed || return 1
+    rm -f -- "$snapshot" || return 1
+    sync_with_label path-edit-stale-lock-cleanup || return 1
+}
+
+cleanup_unacquired_path_edit_lock() {
+    local lock=$1 temporary=$2 status=0
+    rm -f -- "$lock" || status=1
+    rm -f -- "$temporary" || status=1
+    return "$status"
+}
+
+acquire_path_edit_lock() {
+    local config=$1 temporary owner_identity current_identity attempt
+    path_edit_parent="$(dirname "$config")"
+    validate_existing_secure_directory_chain "$path_edit_parent" || return 1
+    path_edit_parent_identity="$(portable_file_identity "$path_edit_parent")" || return 1
+    path_edit_lock_path="${config}.executor-edit-lock"
+    owner_identity="$(process_identity "$$")" || return 1
+
+    for attempt in {1..200}; do
+        assert_install_root
+        assert_path_edit_parent || return 1
+        if [[ -e "$path_edit_lock_path" || -L "$path_edit_lock_path" ]]; then
+            read_path_edit_lock "$path_edit_lock_path" || return 1
+            if kill -0 "$observed_lock_pid" 2>/dev/null; then
+                current_identity="$(process_identity "$observed_lock_pid" 2>/dev/null)" \
+                    || return 1
+                if [[ "$current_identity" == "$observed_lock_process_identity" ]]; then
+                    sleep 0.05 || return 1
+                    continue
+                fi
+            elif current_identity="$(process_identity "$observed_lock_pid" 2>/dev/null)"; then
+                return 1
+            fi
+            if reclaim_stale_path_edit_lock \
+                "$path_edit_lock_path" \
+                "$observed_lock_identity" \
+                "$observed_lock_digest"; then
+                continue
+            fi
+            sleep 0.05 || return 1
+            continue
+        fi
+
+        temporary="$(mktemp "${path_edit_lock_path}.owner.XXXXXXXX")" || return 1
+        if ! {
+            printf 'executor-path-edit-lock-v1\n'
+            printf 'pid %s\n' "$$"
+            printf 'identity %s\n' "$owner_identity"
+        } > "$temporary"; then
+            rm -f -- "$temporary" || return 1
+            return 1
+        fi
+        if ! chmod 0600 "$temporary"; then
+            rm -f -- "$temporary" || return 1
+            return 1
+        fi
+        if ! sync_with_label path-edit-owner-record-durable; then
+            rm -f -- "$temporary" || return 1
+            return 1
+        fi
+        if ln "$temporary" "$path_edit_lock_path" 2>/dev/null; then
+            if ! sync_with_label path-edit-lock-acquired; then
+                rm -f -- "$path_edit_lock_path" || return 1
+                rm -f -- "$temporary" || return 1
+                sync_with_label path-edit-lock-acquire-rollback || return 1
+                return 1
+            fi
+            path_edit_lock_identity="$(portable_file_identity "$path_edit_lock_path")" \
+                || { cleanup_unacquired_path_edit_lock "$path_edit_lock_path" "$temporary"; return 1; }
+            path_edit_lock_digest="$(sha256_file "$path_edit_lock_path")" \
+                || { cleanup_unacquired_path_edit_lock "$path_edit_lock_path" "$temporary"; return 1; }
+            path_edit_lock_acquired=true
+            if ! rm -f -- "$temporary"; then
+                release_path_edit_lock || return 1
+                return 1
+            fi
+            sync_with_label path-edit-owner-temp-cleanup || return 1
+            return 0
+        fi
+        rm -f -- "$temporary" || return 1
+        sync_with_label path-edit-owner-temp-cleanup || return 1
+    done
+    return 1
+}
+
+release_path_edit_lock() {
+    if [[ "$path_edit_lock_acquired" != "true" ]]; then
+        return 0
+    fi
+    assert_path_edit_parent || return 1
+    [[ -f "$path_edit_lock_path" \
+        && ! -L "$path_edit_lock_path" \
+        && "$(portable_file_identity "$path_edit_lock_path")" == "$path_edit_lock_identity" \
+        && "$(sha256_file "$path_edit_lock_path")" == "$path_edit_lock_digest" ]] \
+        || return 1
+    rm -f -- "$path_edit_lock_path" || return 1
+    sync_with_label path-edit-lock-release || return 1
+    path_edit_lock_acquired=false
+}
+
+file_has_owned_path_block() {
+    local file=$1 expected=$2 previous="" line normalized
+    while IFS= read -r line || [[ -n "$line" ]]; do
+        normalized="${line%$'\r'}"
+        if [[ "$previous" == "# Executor" && "$normalized" == "$expected" ]]; then
+            return 0
+        fi
+        previous="$normalized"
+    done < "$file"
+    return 1
+}
+
+perform_path_config_edit() {
+    local operation=$1 config=$2 command=$3 attempt temporary
+    local initial_identity initial_digest current_identity current_digest final_newline
+    path_edit_error=""
+    path_edit_result=""
+    for attempt in {1..4}; do
+        assert_install_root
+        assert_path_edit_parent \
+            || { path_edit_error="shell-config parent changed during update"; return 1; }
+        initial_identity="$(portable_file_identity "$config")" \
+            || { path_edit_error="could not inspect shell config"; return 1; }
+        initial_digest="$(sha256_file "$config")" \
+            || { path_edit_error="could not hash shell config"; return 1; }
+
+        if [[ "$operation" == "add" ]] && file_has_exact_line "$config" "$command"; then
+            path_edit_result=unchanged
+            return 0
+        fi
+        if [[ "$operation" == "remove" ]] \
+            && ! file_has_owned_path_block "$config" "$command"; then
+            path_edit_result=unchanged
+            return 0
+        fi
+
+        temporary="$(mktemp "${path_edit_parent}/.$(basename "$config").executor-XXXXXXXX")" \
+            || { path_edit_error="could not create shell-config staging file"; return 1; }
+        if ! cp -p "$config" "$temporary"; then
+            rm -f -- "$temporary" \
+                || path_edit_error="could not remove failed shell-config staging file"
+            path_edit_error="could not stage shell config"
+            return 1
+        fi
+        if [[ "${EXECUTOR_INSTALL_TEST_FAIL_CONFIG_WRITE:-}" == "1" ]]; then
+            rm -f -- "$temporary" \
+                || path_edit_error="could not remove injected shell-config staging file"
+            path_edit_error="injected shell-config write failure"
+            return 1
+        fi
+        if [[ "${EXECUTOR_INSTALL_TEST_FAIL_REAL_CONFIG_WRITE:-}" == "1" ]]; then
+            if ! chmod 0400 "$temporary"; then
+                rm -f -- "$temporary" \
+                    || path_edit_error="could not remove failed shell-config staging file"
+                path_edit_error="could not make the shell-config staging file read-only"
+                return 1
+            fi
+        fi
+
+        if [[ "$operation" == "add" ]]; then
+            if [[ -s "$config" && "$(tail -c 1 "$config" | wc -l)" -eq 0 ]]; then
+                if ! printf '\n' >> "$temporary"; then
+                    rm -f -- "$temporary" \
+                        || path_edit_error="could not remove failed shell-config staging file"
+                    path_edit_error="could not append a shell-config separator"
+                    return 1
+                fi
+            fi
+            if ! printf '# Executor\n%s\n' "$command" >> "$temporary"; then
+                rm -f -- "$temporary" \
+                    || path_edit_error="could not remove failed shell-config staging file"
+                path_edit_error="could not append the shell-config PATH block"
+                return 1
+            fi
+        elif [[ "$operation" == "remove" ]]; then
+            if [[ ! -s "$config" || "$(tail -c 1 "$config" | wc -l)" -eq 1 ]]; then
+                final_newline=true
+            else
+                final_newline=false
+            fi
+            if ! EXECUTOR_PATH_EDIT_COMMAND="$command" \
+                EXECUTOR_PATH_EDIT_FINAL_NEWLINE="$final_newline" \
+                awk '
+                    function body(value, normalized) {
+                        normalized = value
+                        sub(/\r$/, "", normalized)
+                        return normalized
+                    }
+                    { lines[++count] = $0 }
+                    END {
+                        for (cursor = 1; cursor <= count; cursor++) {
+                            if (body(lines[cursor]) == "# Executor" \
+                                && cursor < count \
+                                && body(lines[cursor + 1]) == ENVIRON["EXECUTOR_PATH_EDIT_COMMAND"]) {
+                                cursor++
+                                continue
+                            }
+                            printf "%s", lines[cursor]
+                            if (cursor < count \
+                                || ENVIRON["EXECUTOR_PATH_EDIT_FINAL_NEWLINE"] == "true") {
+                                printf "\n"
+                            }
+                        }
+                    }
+                ' "$config" > "$temporary"; then
+                rm -f -- "$temporary" \
+                    || path_edit_error="could not remove failed shell-config staging file"
+                path_edit_error="could not rewrite shell config"
+                return 1
+            fi
+        else
+            rm -f -- "$temporary" \
+                || path_edit_error="could not remove invalid shell-config staging file"
+            path_edit_error="invalid shell-config operation"
+            return 1
+        fi
+
+        durability_barrier "staged-path-config-durable:$operation" sync "$temporary"
+        if ! assert_path_edit_parent; then
+            if ! rm -f -- "$temporary"; then
+                path_edit_error="shell-config parent changed and staging cleanup failed"
+            else
+                path_edit_error="shell-config parent changed during update"
+            fi
+            return 1
+        fi
+        current_identity="$(portable_file_identity "$config")" || current_identity=""
+        current_digest="$(sha256_file "$config")" || current_digest=""
+        if [[ "$current_identity" != "$initial_identity" \
+            || "$current_digest" != "$initial_digest" ]]; then
+            rm -f -- "$temporary" \
+                || { path_edit_error="could not remove stale shell-config staging file"; return 1; }
+            continue
+        fi
+        if [[ "${EXECUTOR_INSTALL_TEST_FAIL_CONFIG_RENAME:-}" == "1" ]]; then
+            rm -f -- "$temporary" \
+                || path_edit_error="could not remove injected shell-config staging file"
+            path_edit_error="injected shell-config rename failure"
+            return 1
+        fi
+        if ! mv -f "$temporary" "$config"; then
+            rm -f -- "$temporary" \
+                || path_edit_error="could not remove failed shell-config staging file"
+            path_edit_error="could not publish shell-config update"
+            return 1
+        fi
+        durability_barrier "path-config-durable:$operation" sync "$config" "$path_edit_parent"
+        path_edit_result=changed
+        return 0
+    done
+    path_edit_error="shell config changed during every update attempt"
+    return 1
+}
+
+edit_path_config_portable() {
+    local operation=$1 config=$2 command=$3
+    path_edit_changed=false
+    if [[ ! -e "$config" ]]; then
+        if [[ "$operation" == "add" ]]; then
+            print_manual_path_change "$operation" "$config" "$command"
+        fi
+        return 0
+    fi
+    if [[ ! -f "$config" || -L "$config" || ! -O "$config" || ! -w "$config" ]]; then
+        print_manual_path_change "$operation" "$config" "$command"
+        return 0
+    fi
+    if ! acquire_path_edit_lock "$config"; then
+        print_manual_path_change "$operation" "$config" "$command"
+        return 0
+    fi
+    if [[ -n "${EXECUTOR_INSTALL_TEST_CONFIG_PAUSE_READY:-}" \
+        || -n "${EXECUTOR_INSTALL_TEST_CONFIG_PAUSE_RELEASE:-}" ]]; then
+        if [[ -z "${EXECUTOR_INSTALL_TEST_CONFIG_PAUSE_READY:-}" \
+            || -z "${EXECUTOR_INSTALL_TEST_CONFIG_PAUSE_RELEASE:-}" ]]; then
+            release_path_edit_lock
+            fail "config pause injection is incomplete"
+        fi
+        : > "$EXECUTOR_INSTALL_TEST_CONFIG_PAUSE_READY"
+        sync_with_label path-edit-test-pause \
+            || fail "could not publish config pause checkpoint"
+        while [[ ! -e "$EXECUTOR_INSTALL_TEST_CONFIG_PAUSE_RELEASE" ]]; do
+            sleep 0.01
+        done
+    fi
+    if ! perform_path_config_edit "$operation" "$config" "$command"; then
+        if ! release_path_edit_lock; then
+            path_edit_error="$path_edit_error; could not release shell-config edit lock"
+        fi
+        fail "$path_edit_error"
+    fi
+    release_path_edit_lock || fail "could not release shell-config edit lock"
+    if [[ "$path_edit_result" == "changed" ]]; then
+        path_edit_changed=true
+        if [[ "$operation" == "add" ]]; then
+            printf 'Added Executor to PATH in %s\n' "$config"
+        else
+            printf 'Removed Executor PATH entry from %s\n' "$config"
+        fi
+    fi
+}
+
+install_path_owner_mode() {
+    if stat -c '%u:%a' -- "$1" >/dev/null 2>&1; then
+        stat -c '%u:%a' -- "$1"
+    else
+        stat -f '%u:%Lp' "$1"
+    fi
+}
+
+validate_install_path_component() {
+    local path=$1 metadata uid mode numeric_mode
+    [[ -d "$path" && ! -L "$path" ]] \
+        || fail "install path component is not a real directory: $path"
+    metadata="$(install_path_owner_mode "$path")" \
+        || fail "could not inspect install path component: $path"
+    IFS=: read -r uid mode <<< "$metadata"
+    [[ "$uid" =~ ^[0-9]+$ && "$mode" =~ ^[0-7]+$ ]] \
+        || fail "install path component metadata is malformed: $path"
+    [[ "$uid" -eq 0 || "$uid" -eq "$EUID" ]] \
+        || fail "install path components must be owned by root or the current user: $path"
+    numeric_mode=$((8#$mode))
+    (( (numeric_mode & 0022) == 0 )) \
+        || fail "install path components cannot be group or world writable: $path"
+}
+
+assert_install_root() {
+    [[ -d "$install_root_parent" && ! -L "$install_root_parent" ]] \
+        || fail "install root parent changed after validation: $install_root_parent"
+    [[ "$(portable_file_identity "$install_root_parent")" \
+        == "$install_root_parent_identity" ]] \
+        || fail "install root parent changed after validation: $install_root_parent"
+    [[ -d "$INSTALL_DIR" && ! -L "$INSTALL_DIR" && -O "$INSTALL_DIR" ]] \
+        || fail "install root changed after validation: $INSTALL_DIR"
+    [[ "$(portable_file_identity "$INSTALL_DIR")" == "$install_root_identity" ]] \
+        || fail "install root changed after validation: $INSTALL_DIR"
+}
+
+prepare_install_root() {
+    local remainder component current
+    case "$INSTALL_DIR" in
+        */|*//*|*/./*|*/../*|*/.|*/..)
+            fail "EXECUTOR_INSTALL_DIR must be a normalized absolute path"
             ;;
     esac
 
-    # Apple Silicon under Rosetta reports x64 — install the native arm64 build.
-    if [[ "$os" == "darwin" && "$arch" == "x64" ]]; then
-        if [[ "$(sysctl -n sysctl.proc_translated 2>/dev/null || echo 0)" == "1" ]]; then
-            arch="arm64"
+    validate_install_path_component /
+    remainder="${INSTALL_DIR#/}"
+    current=""
+    while [[ -n "$remainder" ]]; do
+        component="${remainder%%/*}"
+        [[ -n "$component" && "$component" != "." && "$component" != ".." ]] \
+            || fail "EXECUTOR_INSTALL_DIR must be a normalized absolute path"
+        current="${current}/${component}"
+        if [[ ! -e "$current" && ! -L "$current" ]]; then
+            if ! mkdir -m 0700 -- "$current" 2>/dev/null; then
+                [[ -e "$current" || -L "$current" ]] \
+                    || fail "could not create install path component: $current"
+            fi
+        fi
+        validate_install_path_component "$current"
+        if [[ "$remainder" == "$component" ]]; then
+            remainder=""
+        else
+            remainder="${remainder#*/}"
         fi
+    done
+
+    [[ -O "$INSTALL_DIR" ]] \
+        || fail "install root must be owned by the current user: $INSTALL_DIR"
+    install_root_parent="$(dirname "$INSTALL_DIR")"
+    install_root_parent_identity="$(portable_file_identity "$install_root_parent")"
+    install_root_identity="$(portable_file_identity "$INSTALL_DIR")"
+    durability_barrier install-root-durable sync "$INSTALL_DIR"
+}
+
+read_install_lock() {
+    local lock=$1 before after line key value extra line_number=0
+    observed_lock_pid=""
+    observed_lock_process_identity=""
+    [[ -f "$lock" && ! -L "$lock" && -O "$lock" ]] \
+        || fail "install lock is not a regular current-user-owned file: $lock"
+    before="$(sha256_file "$lock")"
+    while IFS= read -r line || [[ -n "$line" ]]; do
+        line_number=$((line_number + 1))
+        if [[ "$line_number" -eq 1 ]]; then
+            [[ "$line" == "executor-install-lock-v1" ]] \
+                || fail "install lock has an unsupported format"
+            continue
+        fi
+        IFS=' ' read -r key value extra <<< "$line"
+        [[ -n "$key" && -n "$value" && -z "${extra:-}" ]] \
+            || fail "install lock contains a malformed entry"
+        case "$key" in
+            pid)
+                [[ -z "$observed_lock_pid" && "$value" =~ ^[1-9][0-9]*$ ]] \
+                    || fail "install lock contains an invalid pid"
+                observed_lock_pid="$value"
+                ;;
+            identity)
+                [[ -z "$observed_lock_process_identity" \
+                    && "$value" =~ ^[A-Za-z0-9:._-]+$ ]] \
+                    || fail "install lock contains an invalid process identity"
+                observed_lock_process_identity="$value"
+                ;;
+            *) fail "install lock contains an unsupported entry: $key" ;;
+        esac
+    done < "$lock"
+    [[ "$line_number" -eq 3 \
+        && -n "$observed_lock_pid" \
+        && -n "$observed_lock_process_identity" ]] \
+        || fail "install lock is incomplete"
+    after="$(sha256_file "$lock")"
+    [[ "$after" == "$before" ]] || fail "install lock changed while it was read"
+    observed_lock_digest="$after"
+    observed_lock_identity="$(portable_file_identity "$lock")"
+}
+
+reclaim_stale_install_lock() {
+    local lock=$1 expected_identity=$2 expected_digest=$3 candidate snapshot
+    assert_install_root
+    for candidate in "${lock}.owner."*; do
+        [[ -e "$candidate" || -L "$candidate" ]] || continue
+        if [[ -f "$candidate" && ! -L "$candidate" && -O "$candidate" ]] \
+            && [[ "$(portable_file_identity "$candidate")" == "$expected_identity" ]] \
+            && [[ "$(sha256_file "$candidate")" == "$expected_digest" ]]; then
+            rm -f -- "$candidate" || return 1
+        fi
+    done
+    durability_barrier stale-lock-owner-cleanup-durable sync "$INSTALL_DIR"
+    snapshot="$(mktemp "${INSTALL_DIR}/.${LOCK_NAME}.stale.XXXXXXXX")" || return 1
+    rm -f -- "$snapshot" || return 1
+    if ! ln "$lock" "$snapshot" 2>/dev/null; then
+        return 1
+    fi
+    if [[ ! -f "$lock" \
+        || -L "$lock" \
+        || "$(portable_file_identity "$lock")" != "$expected_identity" \
+        || "$(sha256_file "$lock")" != "$expected_digest" \
+        || "$(portable_file_identity "$snapshot")" != "$expected_identity" \
+        || "$(portable_link_count "$snapshot")" -ne 2 ]]; then
+        rm -f -- "$snapshot" || return 1
+        durability_barrier stale-lock-snapshot-cleanup sync "$INSTALL_DIR"
+        return 1
+    fi
+    assert_install_root
+    if ! rm -f -- "$lock"; then
+        rm -f -- "$snapshot" || return 1
+        return 1
+    fi
+    durability_barrier stale-lock-reclaimed sync "$INSTALL_DIR"
+    rm -f -- "$snapshot" || return 1
+    durability_barrier stale-lock-cleanup-durable sync "$INSTALL_DIR"
+}
+
+test_pause_if_requested() {
+    local point=$1
+    if [[ "${EXECUTOR_INSTALL_TEST_PAUSE_POINT:-}" != "$point" ]]; then
+        return 0
     fi
+    [[ -n "${EXECUTOR_INSTALL_TEST_PAUSE_READY:-}" \
+        && -n "${EXECUTOR_INSTALL_TEST_PAUSE_RELEASE:-}" ]] \
+        || fail "pause injection requires ready and release paths"
+    : > "$EXECUTOR_INSTALL_TEST_PAUSE_READY"
+    durability_barrier "test-pause-ready:$point" sync "$EXECUTOR_INSTALL_TEST_PAUSE_READY"
+    while [[ ! -e "$EXECUTOR_INSTALL_TEST_PAUSE_RELEASE" ]]; do
+        sleep 0.1
+    done
+}
 
-    is_musl=false
-    if [[ "$os" == "linux" ]]; then
-        if [[ -f /etc/alpine-release ]]; then
-            is_musl=true
-        elif command -v ldd >/dev/null 2>&1 && ldd --version 2>&1 | grep -qi musl; then
-            is_musl=true
+acquire_install_lock() {
+    local lock="${INSTALL_DIR}/${LOCK_NAME}" temporary owner_identity
+    local current_identity attempt
+    assert_install_root
+    owner_identity="$(process_identity "$$")" \
+        || fail "could not determine installer process identity"
+    for attempt in {1..8}; do
+        temporary="$(mktemp "${INSTALL_DIR}/.${LOCK_NAME}.owner.XXXXXXXX")" \
+            || fail "could not create install-lock owner record"
+        if ! {
+            printf 'executor-install-lock-v1\n'
+            printf 'pid %s\n' "$$"
+            printf 'identity %s\n' "$owner_identity"
+        } > "$temporary"; then
+            fail "could not write install-lock owner record"
         fi
+        chmod 0600 "$temporary" || fail "could not protect install-lock owner record"
+        durability_barrier lock-owner-record-durable sync "$temporary"
+        assert_install_root
+        if ln "$temporary" "$lock" 2>/dev/null; then
+            durability_barrier lock-acquired sync "$INSTALL_DIR"
+            install_lock_identity="$(portable_file_identity "$lock")"
+            install_lock_digest="$(sha256_file "$lock")"
+            install_lock_acquired=true
+            rm -f -- "$temporary" || fail "could not remove install-lock owner staging file"
+            durability_barrier lock-owner-temp-cleanup sync "$INSTALL_DIR"
+            test_pause_if_requested after-lock
+            return 0
+        fi
+        rm -f -- "$temporary" || fail "could not remove install-lock owner staging file"
+        durability_barrier lock-owner-temp-cleanup sync "$INSTALL_DIR"
+        if [[ ! -e "$lock" && ! -L "$lock" ]]; then
+            continue
+        fi
+        read_install_lock "$lock"
+        if kill -0 "$observed_lock_pid" 2>/dev/null; then
+            current_identity="$(process_identity "$observed_lock_pid" 2>/dev/null)" \
+                || fail "could not verify live install-lock owner pid $observed_lock_pid"
+            if [[ "$current_identity" == "$observed_lock_process_identity" ]]; then
+                fail "another Executor installer is active with pid $observed_lock_pid"
+            fi
+        elif current_identity="$(process_identity "$observed_lock_pid" 2>/dev/null)"; then
+            fail "install-lock owner pid $observed_lock_pid exists but cannot be signaled"
+        fi
+        if reclaim_stale_install_lock \
+            "$lock" \
+            "$observed_lock_identity" \
+            "$observed_lock_digest"; then
+            continue
+        fi
+    done
+    fail "could not acquire the Executor install lock after concurrent changes"
+}
+
+release_install_lock() {
+    local lock="${INSTALL_DIR}/${LOCK_NAME}"
+    if [[ "$install_lock_acquired" != "true" ]]; then
+        return 0
     fi
+    if [[ ! -f "$lock" \
+        || -L "$lock" \
+        || "$(portable_file_identity "$lock")" != "$install_lock_identity" \
+        || "$(sha256_file "$lock")" != "$install_lock_digest" ]]; then
+        printf 'Error: install lock changed while held\n' >&2
+        return 1
+    fi
+    assert_install_root
+    if ! rm -f -- "$lock"; then
+        printf 'Error: could not release install lock\n' >&2
+        return 1
+    fi
+    if ! sync_with_label install-lock-release; then
+        printf 'Error: could not durably release install lock\n' >&2
+        return 1
+    fi
+    if [[ -n "${EXECUTOR_INSTALL_TEST_DURABILITY_LOG:-}" ]]; then
+        printf 'lock-released\n' >> "$EXECUTOR_INSTALL_TEST_DURABILITY_LOG" || return 1
+    fi
+    install_lock_acquired=false
+}
 
-    target="${os}-${arch}"
-    if [[ "$is_musl" == "true" ]]; then
-        target="${target}-musl"
+installer_exit_cleanup() {
+    local status=$?
+    trap - EXIT
+    if declare -F cleanup_private_temp_directory >/dev/null 2>&1; then
+        cleanup_private_temp_directory || status=1
+    fi
+    if declare -F release_path_edit_lock >/dev/null 2>&1; then
+        release_path_edit_lock || status=1
     fi
+    release_install_lock || status=1
+    exit "$status"
+}
+
+manifest_hash_for() {
+    case "$1" in
+        executor) printf '%s\n' "$manifest_executor_hash" ;;
+        LICENSE) printf '%s\n' "$manifest_license_hash" ;;
+        THIRD_PARTY_LICENSES.html) printf '%s\n' "$manifest_rust_notices_hash" ;;
+        THIRD_PARTY_JAVASCRIPT_LICENSES.json)
+            printf '%s\n' "$manifest_javascript_notices_hash"
+            ;;
+        .executor-path-ownership) printf '%s\n' "$manifest_path_ownership_hash" ;;
+        *) fail "install manifest contains an unsupported file name: $1" ;;
+    esac
+}
 
-    archive_ext=".zip"
-    if [[ "$os" == "linux" ]]; then
-        archive_ext=".tar.gz"
+set_manifest_hash() {
+    local name=$1 hash=$2
+    case "$name" in
+        executor) manifest_executor_hash="$hash" ;;
+        LICENSE) manifest_license_hash="$hash" ;;
+        THIRD_PARTY_LICENSES.html) manifest_rust_notices_hash="$hash" ;;
+        THIRD_PARTY_JAVASCRIPT_LICENSES.json)
+            manifest_javascript_notices_hash="$hash"
+            ;;
+        .executor-path-ownership) manifest_path_ownership_hash="$hash" ;;
+        *) fail "install manifest contains an unsupported file name: $name" ;;
+    esac
+}
+
+verify_owned_file() {
+    local name=$1 expected=$2 path actual
+    path="${INSTALL_DIR}/${name}"
+    [[ -f "$path" && ! -L "$path" ]] \
+        || fail "installer-owned file is missing or not regular: $path"
+    actual="$(sha256_file "$path")"
+    [[ "$actual" == "$expected" ]] \
+        || fail "installer-owned file was replaced after installation: $path"
+}
+
+load_install_manifest() {
+    local manifest="${INSTALL_DIR}/${MANIFEST_NAME}"
+    local allow_missing=${1:-false}
+    local line hash name extra existing before_digest after_digest
+    local line_number=0 entry_count=0
+    manifest_present=false
+    manifest_digest=""
+    manifest_executor_hash=""
+    manifest_license_hash=""
+    manifest_rust_notices_hash=""
+    manifest_javascript_notices_hash=""
+    manifest_path_ownership_hash=""
+
+    if [[ ! -e "$manifest" && ! -L "$manifest" ]]; then
+        return 0
     fi
+    [[ -f "$manifest" && ! -L "$manifest" && -O "$manifest" ]] \
+        || fail "install manifest is not a regular owned file: $manifest"
+    before_digest="$(sha256_file "$manifest")"
+    while IFS= read -r line || [[ -n "$line" ]]; do
+        line_number=$((line_number + 1))
+        if [[ "$line_number" -eq 1 ]]; then
+            [[ "$line" == "executor-install-manifest-v1" ]] \
+                || fail "install manifest has an unsupported format"
+            continue
+        fi
+        IFS=' ' read -r hash name extra <<< "$line"
+        [[ -n "$hash" && -n "$name" && -z "${extra:-}" && "$line" == "$hash $name" ]] \
+            || fail "install manifest contains a malformed entry"
+        [[ "$hash" =~ ^[0-9a-f]{64}$ ]] \
+            || fail "install manifest contains a malformed SHA-256"
+        existing="$(manifest_hash_for "$name")"
+        [[ -z "$existing" ]] || fail "install manifest contains a duplicate entry: $name"
+        set_manifest_hash "$name" "$hash"
+        entry_count=$((entry_count + 1))
+    done < "$manifest"
+    [[ "$line_number" -gt 1 && "$entry_count" -gt 0 ]] \
+        || fail "install manifest contains no owned files"
+    after_digest="$(sha256_file "$manifest")"
+    [[ "$after_digest" == "$before_digest" ]] \
+        || fail "install manifest changed while it was being read"
+    manifest_present=true
+    manifest_digest="$after_digest"
 
-    filename="${APP}-${target}${archive_ext}"
+    for name in \
+        executor \
+        LICENSE \
+        THIRD_PARTY_LICENSES.html \
+        THIRD_PARTY_JAVASCRIPT_LICENSES.json \
+        .executor-path-ownership; do
+        hash="$(manifest_hash_for "$name")"
+        if [[ -n "$hash" ]]; then
+            if [[ -e "${INSTALL_DIR}/${name}" || -L "${INSTALL_DIR}/${name}" ]]; then
+                verify_owned_file "$name" "$hash"
+            elif [[ "$allow_missing" != "true" ]]; then
+                fail "installer-owned file is missing: ${INSTALL_DIR}/${name}"
+            fi
+        fi
+    done
+}
 
-    if [[ "$os" == "linux" ]]; then
-        if ! command -v tar >/dev/null 2>&1; then
-            print_message error "Error: 'tar' is required but not installed."
-            exit 1
+prepare_install_ownership() {
+    local name expected path
+    load_install_manifest
+    for name in "$@"; do
+        path="${INSTALL_DIR}/${name}"
+        expected="$(manifest_hash_for "$name")"
+        if [[ -e "$path" || -L "$path" ]]; then
+            [[ -n "$expected" ]] \
+                || fail "refusing to overwrite a file not owned by this installer: $path"
         fi
+    done
+}
+
+install_source_for() {
+    case "$1" in
+        executor) printf '%s\n' "$install_source_executor" ;;
+        LICENSE) printf '%s\n' "$install_source_license" ;;
+        THIRD_PARTY_LICENSES.html) printf '%s\n' "$install_source_rust_notices" ;;
+        THIRD_PARTY_JAVASCRIPT_LICENSES.json)
+            printf '%s\n' "$install_source_javascript_notices"
+            ;;
+        *) fail "unsupported install transaction file: $1" ;;
+    esac
+}
+
+install_mode_for() {
+    if [[ "$1" == "executor" ]]; then
+        printf '0755\n'
+    elif [[ "$1" == ".executor-path-ownership" ]]; then
+        printf '0600\n'
     else
-        if ! command -v unzip >/dev/null 2>&1; then
-            print_message error "Error: 'unzip' is required but not installed."
-            exit 1
-        fi
+        printf '0644\n'
     fi
+}
 
-    if [[ -z "$requested_version" ]]; then
-        url="https://github.com/${REPO}/releases/latest/download/${filename}"
-        specific_version=$(
-            curl -s "https://api.github.com/repos/${REPO}/releases/latest" \
-                | sed -n 's/.*"tag_name": *"v\([^"]*\)".*/\1/p'
-        )
-        if [[ -z "$specific_version" ]]; then
-            print_message error "Failed to fetch latest version metadata"
-            exit 1
+set_recovery_hashes() {
+    local name=$1 old=$2 new=$3
+    case "$name" in
+        executor)
+            recovery_executor_old="$old"
+            recovery_executor_new="$new"
+            ;;
+        LICENSE)
+            recovery_license_old="$old"
+            recovery_license_new="$new"
+            ;;
+        THIRD_PARTY_LICENSES.html)
+            recovery_rust_notices_old="$old"
+            recovery_rust_notices_new="$new"
+            ;;
+        THIRD_PARTY_JAVASCRIPT_LICENSES.json)
+            recovery_javascript_notices_old="$old"
+            recovery_javascript_notices_new="$new"
+            ;;
+        .executor-path-ownership)
+            recovery_path_ownership_old="$old"
+            recovery_path_ownership_new="$new"
+            ;;
+        *) fail "install recovery contains an unsupported file name: $name" ;;
+    esac
+}
+
+recovery_old_for() {
+    case "$1" in
+        executor) printf '%s\n' "$recovery_executor_old" ;;
+        LICENSE) printf '%s\n' "$recovery_license_old" ;;
+        THIRD_PARTY_LICENSES.html) printf '%s\n' "$recovery_rust_notices_old" ;;
+        THIRD_PARTY_JAVASCRIPT_LICENSES.json)
+            printf '%s\n' "$recovery_javascript_notices_old"
+            ;;
+        .executor-path-ownership) printf '%s\n' "$recovery_path_ownership_old" ;;
+        *) fail "install recovery contains an unsupported file name: $1" ;;
+    esac
+}
+
+recovery_new_for() {
+    case "$1" in
+        executor) printf '%s\n' "$recovery_executor_new" ;;
+        LICENSE) printf '%s\n' "$recovery_license_new" ;;
+        THIRD_PARTY_LICENSES.html) printf '%s\n' "$recovery_rust_notices_new" ;;
+        THIRD_PARTY_JAVASCRIPT_LICENSES.json)
+            printf '%s\n' "$recovery_javascript_notices_new"
+            ;;
+        .executor-path-ownership) printf '%s\n' "$recovery_path_ownership_new" ;;
+        *) fail "install recovery contains an unsupported file name: $1" ;;
+    esac
+}
+
+copy_file_atomically() {
+    local source=$1 destination=$2 label=$3 temporary parent
+    assert_install_root
+    parent="$(dirname "$destination")"
+    temporary="$(mktemp "${destination}.recovery.XXXXXXXX")" \
+        || fail "could not create rollback staging file"
+    trap 'rm -f "$temporary"' RETURN
+    cp -p "$source" "$temporary" || fail "could not stage rollback file"
+    durability_barrier "staged-restore-durable:$label" sync "$temporary"
+    assert_install_root
+    mv -f "$temporary" "$destination" || fail "could not publish rollback file"
+    durability_barrier "$label" sync "$destination" "$parent"
+    trap - RETURN
+}
+
+retire_install_recovery() {
+    local label=$1 recovery="${INSTALL_DIR}/${RECOVERY_NAME}" retired
+    assert_install_root
+    [[ -d "$recovery" && ! -L "$recovery" ]] \
+        || fail "install recovery directory disappeared"
+    retired="$(mktemp -d "${INSTALL_DIR}/.${RECOVERY_NAME}.retired.XXXXXXXX")" \
+        || fail "could not create recovery retirement directory"
+    assert_install_root
+    mv "$recovery" "${retired}/state" || fail "could not retire install recovery"
+    durability_barrier "recovery-retired:$label" sync "$retired" "$INSTALL_DIR"
+    rm -rf "$retired" || fail "could not remove retired install recovery"
+    durability_barrier "recovery-cleanup-durable:$label" sync "$INSTALL_DIR"
+}
+
+create_path_ownership_state() {
+    local output=$1 existing="${INSTALL_DIR}/${PATH_OWNERSHIP_NAME}"
+    local line tracked_config tracked_command extra line_number=0 entry_count=0
+    local already_recorded=false
+    printf 'executor-path-ownership-v1\n' > "$output"
+    if [[ -n "$manifest_path_ownership_hash" ]]; then
+        while IFS= read -r line || [[ -n "$line" ]]; do
+            line_number=$((line_number + 1))
+            if [[ "$line_number" -eq 1 ]]; then
+                [[ "$line" == "executor-path-ownership-v1" ]] \
+                    || fail "PATH ownership state has an unsupported format"
+                continue
+            fi
+            IFS=$'\t' read -r tracked_config tracked_command extra <<< "$line"
+            [[ -n "$tracked_config" \
+                && -n "$tracked_command" \
+                && -z "${extra:-}" \
+                && "$tracked_config" == /* \
+                && "$line" == "$tracked_config"$'\t'"$tracked_command" ]] \
+                || fail "PATH ownership state has a malformed entry"
+            printf '%s\t%s\n' "$tracked_config" "$tracked_command" >> "$output"
+            if [[ "$tracked_config" == "$recorded_config_file" \
+                && "$tracked_command" == "$recorded_path_command" ]]; then
+                already_recorded=true
+            fi
+            entry_count=$((entry_count + 1))
+        done < "$existing"
+        [[ "$line_number" -gt 1 && "$entry_count" -gt 0 ]] \
+            || fail "PATH ownership state contains no entries"
+    fi
+    if [[ "$already_recorded" != "true" ]]; then
+        printf '%s\t%s\n' \
+            "$recorded_config_file" \
+            "$recorded_path_command" \
+            >> "$output"
+    fi
+    chmod 0600 "$output"
+}
+
+remove_recorded_path_entries() {
+    local state="${INSTALL_DIR}/${PATH_OWNERSHIP_NAME}"
+    local line tracked_config tracked_command extra line_number=0 entry_count=0
+    [[ -e "$state" || -L "$state" ]] || return 0
+    [[ -f "$state" && ! -L "$state" && -O "$state" ]] \
+        || fail "PATH ownership state is not a regular owned file"
+
+    while IFS= read -r line || [[ -n "$line" ]]; do
+        line_number=$((line_number + 1))
+        if [[ "$line_number" -eq 1 ]]; then
+            [[ "$line" == "executor-path-ownership-v1" ]] \
+                || fail "PATH ownership state has an unsupported format"
+            continue
+        fi
+        IFS=$'\t' read -r tracked_config tracked_command extra <<< "$line"
+        [[ -n "$tracked_config" \
+            && -n "$tracked_command" \
+            && -z "${extra:-}" \
+            && "$tracked_config" == /* \
+            && "$line" == "$tracked_config"$'\t'"$tracked_command" ]] \
+            || fail "PATH ownership state has a malformed entry"
+        entry_count=$((entry_count + 1))
+    done < "$state"
+    [[ "$line_number" -gt 1 && "$entry_count" -gt 0 ]] \
+        || fail "PATH ownership state contains no entries"
+
+    line_number=0
+    while IFS= read -r line || [[ -n "$line" ]]; do
+        line_number=$((line_number + 1))
+        if [[ "$line_number" -eq 1 ]]; then
+            continue
         fi
+        IFS=$'\t' read -r tracked_config tracked_command extra <<< "$line"
+        remove_path_entry "$tracked_config" "$tracked_command"
+    done < "$state"
+}
+
+begin_install_transaction() {
+    local recovery="${INSTALL_DIR}/${RECOVERY_NAME}" temporary plan_entries
+    local manifest="${INSTALL_DIR}/${MANIFEST_NAME}"
+    local transaction_label=$1
+    local old_manifest new_manifest name source mode old_hash new_hash hash
+    assert_install_root
+    prepare_install_ownership "$@"
+    mkdir -p "$INSTALL_DIR"
+    durability_barrier "install-directory-durable:$transaction_label" chain "$INSTALL_DIR"
+    [[ ! -e "$recovery" && ! -L "$recovery" ]] \
+        || fail "an install recovery transaction is already present"
+
+    temporary="$(mktemp -d "${INSTALL_DIR}/.${RECOVERY_NAME}.XXXXXXXX")" \
+        || fail "could not create install recovery staging directory"
+    trap 'rm -rf "$temporary"' RETURN
+    chmod 0700 "$temporary"
+    mkdir "${temporary}/backup" "${temporary}/new"
+    plan_entries="${temporary}/plan.entries"
+    : > "$plan_entries"
+    chmod 0600 "$plan_entries"
+
+    if [[ "$manifest_present" == "true" ]]; then
+        cp -p "$manifest" "${temporary}/backup/${MANIFEST_NAME}"
+        old_manifest="$manifest_digest"
     else
-        requested_version="${requested_version#v}"
-        url="https://github.com/${REPO}/releases/download/v${requested_version}/${filename}"
-        specific_version="$requested_version"
+        old_manifest=absent
+    fi
 
-        http_status=$(curl -sI -o /dev/null -w "%{http_code}" \
-            "https://github.com/${REPO}/releases/tag/v${requested_version}")
-        if [[ "$http_status" == "404" ]]; then
-            print_message error "Error: release v${requested_version} not found"
-            print_message info "${MUTED}Available releases: https://github.com/${REPO}/releases${NC}"
-            exit 1
+    for name in "$@"; do
+        mode="$(install_mode_for "$name")"
+        old_hash="$(manifest_hash_for "$name")"
+        if [[ -n "$old_hash" ]]; then
+            cp -p "${INSTALL_DIR}/${name}" "${temporary}/backup/${name}"
+        else
+            old_hash=absent
+        fi
+        if [[ "$name" == "$PATH_OWNERSHIP_NAME" ]]; then
+            create_path_ownership_state "${temporary}/new/${name}"
+        else
+            source="$(install_source_for "$name")"
+            [[ -f "$source" && ! -L "$source" ]] \
+                || fail "install source is missing or not regular: $source"
+            cp "$source" "${temporary}/new/${name}"
+            chmod "$mode" "${temporary}/new/${name}"
         fi
+        new_hash="$(sha256_file "${temporary}/new/${name}")"
+        set_manifest_hash "$name" "$new_hash"
+        printf 'file %s %s %s\n' "$old_hash" "$new_hash" "$name" >> "$plan_entries"
+    done
+
+    new_manifest="${temporary}/new/${MANIFEST_NAME}"
+    printf 'executor-install-manifest-v1\n' > "$new_manifest"
+    for name in \
+        executor \
+        LICENSE \
+        THIRD_PARTY_LICENSES.html \
+        THIRD_PARTY_JAVASCRIPT_LICENSES.json \
+        .executor-path-ownership; do
+        hash="$(manifest_hash_for "$name")"
+        if [[ -n "$hash" ]]; then
+            printf '%s %s\n' "$hash" "$name" >> "$new_manifest"
+        fi
+    done
+    chmod 0600 "$new_manifest"
+    new_manifest="$(sha256_file "$new_manifest")"
+
+    {
+        printf 'executor-install-recovery-v1\n'
+        printf 'manifest %s %s\n' "$old_manifest" "$new_manifest"
+        cat "$plan_entries"
+    } > "${temporary}/plan"
+    chmod 0600 "${temporary}/plan"
+    rm -f "$plan_entries" || fail "could not finalize install recovery plan"
+    durability_barrier "recovery-tree-durable:$transaction_label" tree "$temporary"
+    assert_install_root
+    mv "$temporary" "$recovery" || fail "could not publish install recovery"
+    durability_barrier "recovery-durable:$transaction_label" sync "$recovery" "$INSTALL_DIR"
+    trap - RETURN
+}
+
+recover_install_transaction() {
+    local recovery="${INSTALL_DIR}/${RECOVERY_NAME}" plan manifest
+    local line kind old_hash new_hash name extra current_hash
+    local old_manifest="" new_manifest="" line_number=0 entry_count=0
+    assert_install_root
+    recovery_executor_old=""
+    recovery_executor_new=""
+    recovery_license_old=""
+    recovery_license_new=""
+    recovery_rust_notices_old=""
+    recovery_rust_notices_new=""
+    recovery_javascript_notices_old=""
+    recovery_javascript_notices_new=""
+    recovery_path_ownership_old=""
+    recovery_path_ownership_new=""
+
+    if [[ ! -e "$recovery" && ! -L "$recovery" ]]; then
+        return 0
     fi
-fi
+    [[ -d "$recovery" && ! -L "$recovery" && -O "$recovery" ]] \
+        || fail "install recovery is not a private owned directory"
+    plan="${recovery}/plan"
+    [[ -f "$plan" && ! -L "$plan" && -O "$plan" ]] \
+        || fail "install recovery plan is not a regular owned file"
 
-check_existing_version() {
-    if command -v executor >/dev/null 2>&1; then
-        local installed
-        installed=$(executor --version 2>/dev/null || echo "")
-        if [[ "$installed" == "$specific_version" ]]; then
-            print_message info "${MUTED}Version ${NC}${specific_version}${MUTED} already installed${NC}"
-            exit 0
+    while IFS= read -r line || [[ -n "$line" ]]; do
+        line_number=$((line_number + 1))
+        if [[ "$line_number" -eq 1 ]]; then
+            [[ "$line" == "executor-install-recovery-v1" ]] \
+                || fail "install recovery has an unsupported format"
+            continue
+        fi
+        if [[ "$line_number" -eq 2 ]]; then
+            IFS=' ' read -r kind old_manifest new_manifest extra <<< "$line"
+            [[ "$kind" == "manifest" && -z "${extra:-}" ]] \
+                || fail "install recovery has a malformed manifest entry"
+            [[ "$old_manifest" == "absent" || "$old_manifest" =~ ^[0-9a-f]{64}$ ]] \
+                || fail "install recovery has a malformed old manifest hash"
+            [[ "$new_manifest" =~ ^[0-9a-f]{64}$ ]] \
+                || fail "install recovery has a malformed new manifest hash"
+            continue
         fi
-        print_message info "${MUTED}Replacing installed version ${NC}${installed}"
+        IFS=' ' read -r kind old_hash new_hash name extra <<< "$line"
+        [[ "$kind" == "file" && -n "$name" && -z "${extra:-}" ]] \
+            || fail "install recovery has a malformed file entry"
+        [[ "$old_hash" == "absent" || "$old_hash" =~ ^[0-9a-f]{64}$ ]] \
+            || fail "install recovery has a malformed old file hash"
+        [[ "$new_hash" =~ ^[0-9a-f]{64}$ ]] \
+            || fail "install recovery has a malformed new file hash"
+        [[ -z "$(recovery_new_for "$name")" ]] \
+            || fail "install recovery has a duplicate file entry: $name"
+        set_recovery_hashes "$name" "$old_hash" "$new_hash"
+        entry_count=$((entry_count + 1))
+    done < "$plan"
+    [[ "$line_number" -gt 2 && "$entry_count" -gt 0 ]] \
+        || fail "install recovery contains no files"
+
+    manifest="${recovery}/new/${MANIFEST_NAME}"
+    [[ -f "$manifest" && ! -L "$manifest" ]] \
+        || fail "install recovery is missing the new manifest"
+    [[ "$(sha256_file "$manifest")" == "$new_manifest" ]] \
+        || fail "install recovery new manifest hash does not match"
+    if [[ "$old_manifest" != "absent" ]]; then
+        manifest="${recovery}/backup/${MANIFEST_NAME}"
+        [[ -f "$manifest" && ! -L "$manifest" ]] \
+            || fail "install recovery is missing the old manifest"
+        [[ "$(sha256_file "$manifest")" == "$old_manifest" ]] \
+            || fail "install recovery old manifest hash does not match"
     fi
-}
 
-download_and_install() {
-    print_message info "\n${MUTED}Installing ${NC}${APP} ${MUTED}version: ${NC}${specific_version}"
-    local tmp_dir
-    tmp_dir=$(mktemp -d "${TMPDIR:-/tmp}/${APP}_install_XXXXXXXXXX")
-    trap 'rm -rf "$tmp_dir"' RETURN
+    for name in \
+        executor \
+        LICENSE \
+        THIRD_PARTY_LICENSES.html \
+        THIRD_PARTY_JAVASCRIPT_LICENSES.json \
+        .executor-path-ownership; do
+        new_hash="$(recovery_new_for "$name")"
+        if [[ -z "$new_hash" ]]; then
+            continue
+        fi
+        old_hash="$(recovery_old_for "$name")"
+        [[ -f "${recovery}/new/${name}" && ! -L "${recovery}/new/${name}" ]] \
+            || fail "install recovery is missing a staged file: $name"
+        [[ "$(sha256_file "${recovery}/new/${name}")" == "$new_hash" ]] \
+            || fail "install recovery staged file hash does not match: $name"
+        if [[ "$old_hash" != "absent" ]]; then
+            [[ -f "${recovery}/backup/${name}" && ! -L "${recovery}/backup/${name}" ]] \
+                || fail "install recovery is missing a backup file: $name"
+            [[ "$(sha256_file "${recovery}/backup/${name}")" == "$old_hash" ]] \
+                || fail "install recovery backup hash does not match: $name"
+        elif [[ -e "${recovery}/backup/${name}" || -L "${recovery}/backup/${name}" ]]; then
+            fail "install recovery has an unexpected backup file: $name"
+        fi
+
+        if [[ -e "${INSTALL_DIR}/${name}" || -L "${INSTALL_DIR}/${name}" ]]; then
+            [[ -f "${INSTALL_DIR}/${name}" && ! -L "${INSTALL_DIR}/${name}" ]] \
+                || fail "install destination was replaced during recovery: $name"
+            current_hash="$(sha256_file "${INSTALL_DIR}/${name}")"
+            [[ "$current_hash" == "$new_hash" \
+                || "$old_hash" != "absent" && "$current_hash" == "$old_hash" ]] \
+                || fail "install destination changed outside the recovery transaction: $name"
+        fi
+    done
 
-    curl -# -L -o "${tmp_dir}/${filename}" "$url"
+    manifest="${INSTALL_DIR}/${MANIFEST_NAME}"
+    if [[ -e "$manifest" || -L "$manifest" ]]; then
+        [[ -f "$manifest" && ! -L "$manifest" && -O "$manifest" ]] \
+            || fail "install manifest was replaced during recovery"
+        current_hash="$(sha256_file "$manifest")"
+        [[ "$current_hash" == "$new_manifest" \
+            || "$old_manifest" != "absent" && "$current_hash" == "$old_manifest" ]] \
+            || fail "install manifest changed outside the recovery transaction"
+    fi
 
-    if [[ "$os" == "linux" ]]; then
-        tar -xzf "${tmp_dir}/${filename}" -C "$tmp_dir"
+    assert_install_root
+    for name in \
+        executor \
+        LICENSE \
+        THIRD_PARTY_LICENSES.html \
+        THIRD_PARTY_JAVASCRIPT_LICENSES.json \
+        .executor-path-ownership; do
+        new_hash="$(recovery_new_for "$name")"
+        if [[ -z "$new_hash" ]]; then
+            continue
+        fi
+        old_hash="$(recovery_old_for "$name")"
+        if [[ "$old_hash" == "absent" ]]; then
+            assert_install_root
+            rm -f -- "${INSTALL_DIR}/${name}" \
+                || fail "could not remove interrupted install file: $name"
+            durability_barrier "rollback-managed-durable:$name" sync "$INSTALL_DIR"
+        else
+            copy_file_atomically \
+                "${recovery}/backup/${name}" \
+                "${INSTALL_DIR}/${name}" \
+                "rollback-managed-durable:$name"
+        fi
+    done
+    if [[ "$old_manifest" == "absent" ]]; then
+        assert_install_root
+        rm -f -- "${INSTALL_DIR}/${MANIFEST_NAME}" \
+            || fail "could not remove interrupted install manifest"
+        durability_barrier "rollback-manifest-durable" sync "$INSTALL_DIR"
     else
-        unzip -q "${tmp_dir}/${filename}" -d "$tmp_dir"
+        copy_file_atomically \
+            "${recovery}/backup/${MANIFEST_NAME}" \
+            "${INSTALL_DIR}/${MANIFEST_NAME}" \
+            "rollback-manifest-durable"
     fi
+    retire_install_recovery rollback
+    printf 'Recovered an interrupted Executor installation\n'
+}
 
-    # The archive is flat — the binary plus sidecars (emscripten-module.wasm,
-    # keyring.node) sit at the root. Copy them all into INSTALL_DIR so the
-    # binary's relative-path lookups still resolve.
-    rm -f "${tmp_dir}/${filename}"
-    cp -R "${tmp_dir}/." "${INSTALL_DIR}/"
+commit_install_transaction() {
+    local recovery="${INSTALL_DIR}/${RECOVERY_NAME}" transaction_label=$1
+    local name mode count=0
+    assert_install_root
+    for name in "$@"; do
+        mode="$(install_mode_for "$name")"
+        install_file \
+            "${recovery}/new/${name}" \
+            "$name" \
+            "$mode" \
+            "managed-file-durable:$name"
+        count=$((count + 1))
+        test_pause_if_requested "after-install-file-$count"
+        if [[ "${EXECUTOR_INSTALL_TEST_FAIL_AFTER_INSTALL_FILE:-}" == "$count" ]]; then
+            fail "injected failure after publishing install file $count"
+        fi
+    done
+    if [[ "${EXECUTOR_INSTALL_TEST_FAIL_MANIFEST:-}" == "1" ]]; then
+        fail "injected install manifest publication failure"
+    fi
+    install_file \
+        "${recovery}/new/${MANIFEST_NAME}" \
+        "$MANIFEST_NAME" \
+        0600 \
+        "manifest-durable:$transaction_label"
+    retire_install_recovery "$transaction_label"
+}
 
-    chmod 755 "${INSTALL_DIR}/${APP}"
-    rm -rf "$tmp_dir"
-    trap - RETURN
+remove_owned_file() {
+    local name=$1 expected=$2
+    assert_install_root
+    if [[ -e "${INSTALL_DIR}/${name}" || -L "${INSTALL_DIR}/${name}" ]]; then
+        verify_owned_file "$name" "$expected"
+        assert_install_root
+        rm -f -- "${INSTALL_DIR}/${name}" \
+            || fail "could not remove installer-owned file: $name"
+    fi
+    durability_barrier "uninstall-file-durable:$name" sync "$INSTALL_DIR"
 }
 
-install_from_binary() {
-    print_message info "\n${MUTED}Installing ${NC}${APP} ${MUTED}from: ${NC}${binary_path}"
-    cp "$binary_path" "${INSTALL_DIR}/${APP}"
-    chmod 755 "${INSTALL_DIR}/${APP}"
+uninstall_executor() {
+    local name hash manifest="${INSTALL_DIR}/${MANIFEST_NAME}"
+    local removed_count=0 seen_existing_owned_file=false
+    load_install_manifest true
+    if [[ "$manifest_present" != "true" ]]; then
+        for name in \
+            executor \
+            LICENSE \
+            THIRD_PARTY_LICENSES.html \
+            THIRD_PARTY_JAVASCRIPT_LICENSES.json \
+            .executor-path-ownership; do
+            if [[ -e "${INSTALL_DIR}/${name}" || -L "${INSTALL_DIR}/${name}" ]]; then
+                fail "refusing to remove files without an installer ownership manifest"
+            fi
+        done
+    fi
+
+    for name in \
+        executor \
+        LICENSE \
+        THIRD_PARTY_LICENSES.html \
+        THIRD_PARTY_JAVASCRIPT_LICENSES.json \
+        .executor-path-ownership; do
+        hash="$(manifest_hash_for "$name")"
+        if [[ -z "$hash" ]]; then
+            continue
+        fi
+        if [[ -e "${INSTALL_DIR}/${name}" || -L "${INSTALL_DIR}/${name}" ]]; then
+            seen_existing_owned_file=true
+        elif [[ "$seen_existing_owned_file" == "true" ]]; then
+            fail "installer-owned files are missing outside resumable uninstall order"
+        fi
+    done
+
+    if [[ "$no_modify_path" != "true" && -n "$manifest_path_ownership_hash" ]]; then
+        remove_recorded_path_entries
+    fi
+
+    if [[ "$manifest_present" == "true" ]]; then
+        for name in \
+            executor \
+            LICENSE \
+            THIRD_PARTY_LICENSES.html \
+            THIRD_PARTY_JAVASCRIPT_LICENSES.json \
+            .executor-path-ownership; do
+            hash="$(manifest_hash_for "$name")"
+            if [[ -n "$hash" ]]; then
+                remove_owned_file "$name" "$hash"
+                removed_count=$((removed_count + 1))
+                if [[ "${EXECUTOR_INSTALL_TEST_FAIL_AFTER_UNINSTALL_DELETE:-}" \
+                    == "$removed_count" ]]; then
+                    fail "injected failure after uninstall file $removed_count"
+                fi
+            fi
+        done
+        [[ "$(sha256_file "$manifest")" == "$manifest_digest" ]] \
+            || fail "install manifest changed during uninstall"
+        assert_install_root
+        rm -f -- "$manifest" || fail "could not remove install manifest"
+        durability_barrier "uninstall-manifest-durable" sync "$INSTALL_DIR"
+    fi
+    printf 'Removed Executor program files from %s\n' "$INSTALL_DIR"
+    printf 'Executor data, service definitions, and unrelated files were preserved.\n'
 }
 
+prepare_install_root
+trap installer_exit_cleanup EXIT
+test_pause_if_requested after-install-root
+acquire_install_lock
+recover_install_transaction
+
+if [[ "$uninstall" == "true" ]]; then
+    uninstall_executor
+    exit 0
+fi
+
+case "$REPOSITORY" in
+    ''|/*|*/|*/*/*|*[!A-Za-z0-9._/-]*)
+        fail "EXECUTOR_REPOSITORY must be an owner/repository name"
+        ;;
+esac
+
+case "${OSTYPE:-}" in
+    darwin*) platform="apple-darwin" ;;
+    linux*) platform="unknown-linux-gnu" ;;
+    *) fail "Executor release binaries support only Linux and macOS" ;;
+esac
+
+machine="$(uname -m)"
+case "$machine" in
+    x86_64|amd64) architecture="x86_64" ;;
+    arm64|aarch64) architecture="aarch64" ;;
+    *) fail "unsupported architecture: $machine" ;;
+esac
+
+if [[ "$platform" == "apple-darwin" && "$architecture" == "x86_64" ]]; then
+    if [[ "$(sysctl -n sysctl.proc_translated 2>/dev/null || printf '0')" == "1" ]]; then
+        architecture="aarch64"
+    fi
+fi
+
+target="${architecture}-${platform}"
+archive="${APP}-${target}.tar.gz"
 if [[ -n "$binary_path" ]]; then
-    install_from_binary
+    planned_install_files=(executor)
 else
-    check_existing_version
-    download_and_install
+    planned_install_files=(
+        executor
+        LICENSE
+        THIRD_PARTY_LICENSES.html
+        THIRD_PARTY_JAVASCRIPT_LICENSES.json
+    )
 fi
+prepare_path_config_tracking
 
-add_to_path() {
-    local config_file=$1 command=$2
-    if grep -Fxq "$command" "$config_file"; then
-        print_message info "${MUTED}Already in ${NC}${config_file}"
-    elif [[ -w "$config_file" ]]; then
-        echo -e "\n# executor" >> "$config_file"
-        echo "$command" >> "$config_file"
-        print_message info "${MUTED}Added ${NC}${APP} ${MUTED}to \$PATH in ${NC}${config_file}"
+path_identity() {
+    if [[ "$platform" == "apple-darwin" ]]; then
+        stat -f '%u:%Lp:%d:%i' "$1"
     else
-        print_message warning "Manually add to ${config_file}:"
-        print_message info "  $command"
+        stat -c '%u:%a:%d:%i' -- "$1"
     fi
 }
 
-XDG_CONFIG_HOME="${XDG_CONFIG_HOME:-$HOME/.config}"
-current_shell=$(basename "${SHELL:-bash}")
+validate_trusted_temp_component() {
+    local path=$1 identity uid mode device inode numeric_mode
+    [[ -d "$path" && ! -L "$path" ]] \
+        || fail "temporary-directory ancestor is not a real directory: $path"
+    identity="$(path_identity "$path")" \
+        || fail "could not inspect temporary-directory ancestor: $path"
+    IFS=: read -r uid mode device inode <<< "$identity"
+    [[ "$uid" =~ ^[0-9]+$ \
+        && "$mode" =~ ^[0-7]+$ \
+        && "$device" =~ ^[0-9]+$ \
+        && "$inode" =~ ^[0-9]+$ ]] \
+        || fail "temporary-directory ancestor metadata is malformed: $path"
+    numeric_mode=$((8#$mode))
+    if [[ "$uid" -eq 0 ]]; then
+        if (( (numeric_mode & 0022) != 0 && (numeric_mode & 01000) == 0 )); then
+            fail "writable root-owned temporary-directory ancestors must have the sticky bit: $path"
+        fi
+    elif [[ "$uid" -eq "$EUID" ]]; then
+        (( (numeric_mode & 0022) == 0 )) \
+            || fail "current-user temporary-directory ancestors cannot be group or world writable: $path"
+    else
+        fail "temporary-directory ancestors must be owned by root or the current user: $path"
+    fi
+}
 
-case "$current_shell" in
-    fish)
-        config_files="$HOME/.config/fish/config.fish"
-        ;;
-    zsh)
-        config_files="${ZDOTDIR:-$HOME}/.zshrc ${ZDOTDIR:-$HOME}/.zshenv $XDG_CONFIG_HOME/zsh/.zshrc $XDG_CONFIG_HOME/zsh/.zshenv"
-        ;;
-    bash)
-        config_files="$HOME/.bashrc $HOME/.bash_profile $HOME/.profile $XDG_CONFIG_HOME/bash/.bashrc $XDG_CONFIG_HOME/bash/.bash_profile"
-        ;;
-    *)
-        config_files="$HOME/.bashrc $HOME/.bash_profile $XDG_CONFIG_HOME/bash/.bashrc $XDG_CONFIG_HOME/bash/.bash_profile"
-        ;;
-esac
+prepare_trusted_temp_root() {
+    local raw_temp_root remainder component current
+    raw_temp_root="${TMPDIR:-/tmp}"
+    case "$raw_temp_root" in
+        ''|*$'\t'*|*$'\n'*|*$'\r'*) fail "TMPDIR must be a nonempty absolute path without control characters" ;;
+    esac
+    [[ "$raw_temp_root" == /* ]] || fail "TMPDIR must be an absolute path"
+    trusted_temp_root="$(cd -P -- "$raw_temp_root" 2>/dev/null && pwd -P)" \
+        || fail "TMPDIR does not resolve to an accessible directory"
+    [[ "$trusted_temp_root" != "/" ]] || fail "TMPDIR cannot be the filesystem root"
 
-if [[ "$no_modify_path" != "true" ]]; then
-    config_file=""
-    for file in $config_files; do
-        if [[ -f "$file" ]]; then
-            config_file=$file
-            break
+    validate_trusted_temp_component /
+    remainder="${trusted_temp_root#/}"
+    current=""
+    while [[ -n "$remainder" ]]; do
+        component="${remainder%%/*}"
+        [[ -n "$component" && "$component" != "." && "$component" != ".." ]] \
+            || fail "TMPDIR must be a normalized path without empty, dot, or dot-dot components"
+        current="${current}/${component}"
+        validate_trusted_temp_component "$current"
+        if [[ "$remainder" == "$component" ]]; then
+            remainder=""
+        else
+            remainder="${remainder#*/}"
         fi
     done
+    trusted_temp_root_identity="$(path_identity "$trusted_temp_root")"
+}
 
-    if [[ -z "$config_file" ]]; then
-        print_message warning "No config file found for ${current_shell}. Add manually:"
-        print_message info "  export PATH=${INSTALL_DIR}:\$PATH"
-    elif [[ ":$PATH:" != *":$INSTALL_DIR:"* ]]; then
-        case "$current_shell" in
-            fish) add_to_path "$config_file" "fish_add_path $INSTALL_DIR" ;;
-            *)    add_to_path "$config_file" "export PATH=$INSTALL_DIR:\$PATH" ;;
-        esac
+verify_private_temp_directory() {
+    local root_identity directory_identity uid mode device inode
+    [[ -n "$temporary_directory" ]] || fail "private temporary directory is not initialized"
+    [[ -d "$trusted_temp_root" && ! -L "$trusted_temp_root" ]] \
+        || fail "trusted temporary root was replaced"
+    root_identity="$(path_identity "$trusted_temp_root")" \
+        || fail "could not recheck trusted temporary root"
+    [[ "$root_identity" == "$trusted_temp_root_identity" ]] \
+        || fail "trusted temporary root changed during installation"
+    [[ -d "$temporary_directory" && ! -L "$temporary_directory" ]] \
+        || fail "private temporary directory was replaced"
+    directory_identity="$(path_identity "$temporary_directory")" \
+        || fail "could not inspect private temporary directory"
+    [[ "$directory_identity" == "$temporary_directory_identity" ]] \
+        || fail "private temporary directory changed during installation"
+    IFS=: read -r uid mode device inode <<< "$directory_identity"
+    [[ "$uid" -eq "$EUID" && "$mode" == "700" ]] \
+        || fail "private temporary directory must remain current-user owned with mode 0700"
+}
+
+cleanup_private_temp_directory() {
+    local current_identity
+    if [[ -n "$temporary_directory" \
+        && -d "$temporary_directory" \
+        && ! -L "$temporary_directory" ]] \
+        && current_identity="$(path_identity "$temporary_directory" 2>/dev/null)" \
+        && [[ "$current_identity" == "$temporary_directory_identity" ]]; then
+        rm -rf -- "$temporary_directory" || return 1
+    fi
+    if [[ -n "$test_swapped_temp_directory" \
+        && -d "$test_swapped_temp_directory" \
+        && ! -L "$test_swapped_temp_directory" ]] \
+        && current_identity="$(path_identity "$test_swapped_temp_directory" 2>/dev/null)" \
+        && [[ "$current_identity" == "$temporary_directory_identity" ]]; then
+        rm -rf -- "$test_swapped_temp_directory" || return 1
+    fi
+}
+
+make_temp_dir() {
+    local identity uid mode device inode
+    prepare_trusted_temp_root
+    temporary_directory="$(mktemp -d "${trusted_temp_root}/${APP}-install.XXXXXXXX")"
+    chmod 0700 "$temporary_directory"
+    [[ -d "$temporary_directory" && ! -L "$temporary_directory" ]] \
+        || fail "mktemp did not create a private directory"
+    identity="$(path_identity "$temporary_directory")" \
+        || fail "could not inspect the private temporary directory"
+    IFS=: read -r uid mode device inode <<< "$identity"
+    [[ "$uid" -eq "$EUID" && "$mode" == "700" ]] \
+        || fail "mktemp directory is not current-user owned with mode 0700"
+    temporary_directory_identity="$identity"
+    verify_private_temp_directory
+}
+
+inject_temp_directory_swap_for_test() {
+    if [[ "${EXECUTOR_INSTALL_TEST_SWAP_TEMP_DIRECTORY:-}" != "1" ]]; then
+        return 0
+    fi
+    test_swapped_temp_directory="${temporary_directory}.original"
+    mv "$temporary_directory" "$test_swapped_temp_directory"
+    mkdir -m 0700 "$temporary_directory"
+}
+
+verify_checksum() {
+    local checksum_file=$1 archive_path=$2 expected actual
+    expected="$(awk 'NF { print $1; exit }' "$checksum_file")"
+    [[ "$expected" =~ ^[[:xdigit:]]{64}$ ]] || fail "release checksum is malformed"
+    actual="$(sha256_file "$archive_path")"
+    [[ "$actual" == "$expected" ]] || fail "release checksum verification failed"
+}
+
+install_file() {
+    local source=$1 destination=$2 mode=$3 label=$4 temporary
+    assert_install_root
+    mkdir -p "$INSTALL_DIR"
+    temporary="$(mktemp "${INSTALL_DIR}/.${destination}.XXXXXXXX")" \
+        || fail "could not create install staging file: $destination"
+    trap 'rm -f "$temporary"' RETURN
+    cp "$source" "$temporary" || fail "could not stage install file: $destination"
+    chmod "$mode" "$temporary" || fail "could not set install file mode: $destination"
+    durability_barrier "staged-file-durable:$destination" sync "$temporary"
+    assert_install_root
+    mv -f "$temporary" "${INSTALL_DIR}/${destination}" \
+        || fail "could not publish install file: $destination"
+    durability_barrier "$label" sync "${INSTALL_DIR}/${destination}" "$INSTALL_DIR"
+    trap - RETURN
+}
+
+if [[ -n "$binary_path" ]]; then
+    [[ -f "$binary_path" ]] || fail "binary not found at $binary_path"
+    install_source_executor="$binary_path"
+else
+    command -v tar >/dev/null 2>&1 || fail "tar is required"
+
+    make_temp_dir
+    trap installer_exit_cleanup EXIT
+    if [[ -n "$local_archive_path" ]]; then
+        local_archive_source="$local_archive_path"
+        local_checksum_source="${local_checksum_path:-${local_archive_path}.sha256}"
+        [[ -f "$local_archive_source" && ! -L "$local_archive_source" ]] \
+            || fail "archive is not a regular non-symlink file: $local_archive_source"
+        [[ -f "$local_checksum_source" && ! -L "$local_checksum_source" ]] \
+            || fail "checksum is not a regular non-symlink file: $local_checksum_source"
+        archive_path="${temporary_directory}/${archive}"
+        checksum_path="${archive_path}.sha256"
+        verify_private_temp_directory
+        (
+            ulimit -f 524288
+            cp "$local_archive_source" "$archive_path"
+        )
+        (
+            ulimit -f 2048
+            cp "$local_checksum_source" "$checksum_path"
+        )
+        chmod 0600 "$archive_path" "$checksum_path"
+        verify_private_temp_directory
+        if [[ "${EXECUTOR_INSTALL_TEST_REMOVE_SOURCE_AFTER_STAGE:-}" == "1" ]]; then
+            rm -f -- "$local_archive_source" "$local_checksum_source"
+        fi
+    else
+        command -v curl >/dev/null 2>&1 || fail "curl is required"
+        requested_version="${requested_version#v}"
+        if [[ -n "$requested_version" ]]; then
+            case "$requested_version" in
+                *[!A-Za-z0-9._-]*) fail "the requested version contains unsafe characters" ;;
+            esac
+            release_base="https://github.com/${REPOSITORY}/releases/download/v${requested_version}"
+            version_label="v${requested_version}"
+        else
+            release_base="https://github.com/${REPOSITORY}/releases/latest/download"
+            version_label="latest"
+        fi
+        archive_path="${temporary_directory}/${archive}"
+        checksum_path="${archive_path}.sha256"
+
+        printf 'Downloading Executor %s for %s\n' "$version_label" "$target"
+        curl --fail --location --proto '=https' --proto-redir '=https' --tlsv1.2 \
+            --max-filesize 268435456 \
+            --output "$archive_path" "${release_base}/${archive}"
+        curl --fail --location --proto '=https' --proto-redir '=https' --tlsv1.2 \
+            --max-filesize 1048576 \
+            --output "$checksum_path" "${release_base}/${archive}.sha256"
+    fi
+    inject_temp_directory_swap_for_test
+    verify_private_temp_directory
+    [[ "$(wc -c < "$archive_path")" -le 268435456 ]] \
+        || fail "release archive exceeds 256 MiB"
+    [[ "$(wc -c < "$checksum_path")" -le 1048576 ]] \
+        || fail "release checksum exceeds 1 MiB"
+    verify_checksum "$checksum_path" "$archive_path"
+
+    members_path="${temporary_directory}/archive-members.txt"
+    verify_private_temp_directory
+    (
+        ulimit -f 2048
+        ulimit -t 30
+        tar -tzf "$archive_path" > "$members_path"
+    )
+    archive_members="$(< "$members_path")"
+    expected_members=$'executor\nLICENSE\nTHIRD_PARTY_LICENSES.html\nTHIRD_PARTY_JAVASCRIPT_LICENSES.json'
+    [[ "$archive_members" == "$expected_members" ]] \
+        || fail "release archive has unexpected members"
+    verbose_members_path="${temporary_directory}/archive-members-verbose.txt"
+    verify_private_temp_directory
+    (
+        ulimit -f 2048
+        ulimit -t 30
+        tar -tvzf "$archive_path" > "$verbose_members_path"
+    )
+    while IFS= read -r member; do
+        [[ "${member:0:1}" == "-" ]] \
+            || fail "release archive members must be regular files"
+    done < "$verbose_members_path"
+
+    extracted_directory="${temporary_directory}/extracted"
+    mkdir "$extracted_directory"
+    extract_member() {
+        local member=$1 file_blocks=$2
+        verify_private_temp_directory
+        (
+            ulimit -f "$file_blocks"
+            ulimit -t 60
+            tar -xOzf "$archive_path" "$member" \
+                > "${extracted_directory}/${member}"
+        )
+    }
+    extract_member executor 524288
+    extract_member LICENSE 4096
+    extract_member THIRD_PARTY_LICENSES.html 131072
+    extract_member THIRD_PARTY_JAVASCRIPT_LICENSES.json 131072
+    verify_private_temp_directory
+
+    extracted_binary="${extracted_directory}/${APP}"
+    [[ -f "$extracted_binary" && -s "$extracted_binary" && ! -L "$extracted_binary" ]] \
+        || fail "release archive does not contain a regular executor binary"
+    for support_file in \
+        LICENSE \
+        THIRD_PARTY_LICENSES.html \
+        THIRD_PARTY_JAVASCRIPT_LICENSES.json; do
+        [[ -s "${extracted_directory}/${support_file}" ]] \
+            || fail "release archive contains an empty support file"
+    done
+    install_source_executor="$extracted_binary"
+    install_source_license="${extracted_directory}/LICENSE"
+    install_source_rust_notices="${extracted_directory}/THIRD_PARTY_LICENSES.html"
+    install_source_javascript_notices="${extracted_directory}/THIRD_PARTY_JAVASCRIPT_LICENSES.json"
+fi
+
+if [[ -n "$temporary_directory" ]]; then
+    verify_private_temp_directory
+fi
+begin_install_transaction "${planned_install_files[@]}"
+commit_install_transaction "${planned_install_files[@]}"
+
+add_to_path() {
+    edit_path_config_portable add "$1" "$2"
+}
+
+if [[ "$path_update_requested" == "true" ]]; then
+    if [[ "$path_already_present" == "true" ]]; then
+        :
+    elif [[ "$record_path_config" == "true" ]]; then
+        begin_install_transaction "$PATH_OWNERSHIP_NAME"
+        commit_install_transaction "$PATH_OWNERSHIP_NAME"
+        add_to_path "$recorded_config_file" "$recorded_path_command"
+        if [[ "${EXECUTOR_INSTALL_TEST_FAIL_AFTER_PATH_CONFIG:-}" == "1" ]]; then
+            fail "injected failure after PATH configuration update"
+        fi
+    else
+        print_manual_path_change add "$recorded_config_file" "$recorded_path_command"
     fi
 fi
 
-if [[ -n "${GITHUB_ACTIONS-}" && "${GITHUB_ACTIONS}" == "true" ]]; then
-    echo "$INSTALL_DIR" >> "$GITHUB_PATH"
-    print_message info "${MUTED}Added ${NC}${INSTALL_DIR}${MUTED} to \$GITHUB_PATH${NC}"
+if [[ "${GITHUB_ACTIONS:-}" == "true" ]]; then
+    printf '%s\n' "$INSTALL_DIR" >> "$GITHUB_PATH"
 fi
 
-print_message info ""
-print_message info "${MUTED}Installed ${NC}${APP} ${MUTED}to ${NC}${INSTALL_DIR}/${APP}"
-print_message info ""
-print_message info "${MUTED}Get started:${NC}"
-print_message info "  ${APP} web"
-print_message info ""
+printf '\nInstalled Executor at %s\n' "${INSTALL_DIR}/${APP}"
+printf 'Start it with: executor server\n'
diff --git a/scripts/lib/install-systemd-master-key.sh b/scripts/lib/install-systemd-master-key.sh
new file mode 100644
index 000000000..52f6157af
--- /dev/null
+++ b/scripts/lib/install-systemd-master-key.sh
@@ -0,0 +1,743 @@
+#!/usr/bin/env bash
+
+executor_installer_error() {
+    printf '%s\n' "$1" >&2
+    return 1
+}
+
+executor_paths_overlap() {
+    local left=${1%/}
+    local right=${2%/}
+
+    [[ -n ${left} ]] || left=/
+    [[ -n ${right} ]] || right=/
+    [[ ${left} == / || ${right} == / \
+        || ${left} == "${right}" \
+        || ${left} == "${right}/"* \
+        || ${right} == "${left}/"* ]]
+}
+
+executor_require_disjoint_paths() {
+    local left=$1
+    local left_description=$2
+    local right=$3
+    local right_description=$4
+
+    if executor_paths_overlap "${left}" "${right}"; then
+        executor_installer_error \
+            "${left_description} must not overlap ${right_description}: ${right}"
+        return
+    fi
+}
+
+executor_write_and_sync_master_key() {
+    local path=$1
+
+    dd if=/dev/urandom of="${path}" bs=32 count=1 \
+        iflag=fullblock oflag=nofollow conv=excl,fsync status=none
+}
+
+executor_sync_filesystem_path() {
+    sync -f -- "$1"
+}
+
+executor_require_filesystem_sync() {
+    local path=$1
+    local description=$2
+    local sync_status
+
+    if executor_sync_filesystem_path "${path}"; then
+        return 0
+    else
+        sync_status=$?
+    fi
+    executor_installer_error "could not sync ${description}: ${path}"
+    return "${sync_status}"
+}
+
+executor_master_key_path_digest() {
+    printf '%s' "$1" | sha256sum | awk '{print $1}'
+}
+
+executor_publish_master_key_recovery() {
+    local recovery_path=$1
+    local state=$2
+    local destination_digest=$3
+    local staging_name=$4
+    local expected_uid=$5
+    local expected_gid=$6
+    local device=${7:--}
+    local inode=${8:--}
+    local key_digest=${9:--}
+    local recovery_parent=${recovery_path%/*}
+    local temporary
+
+    if ! temporary=$(mktemp "${recovery_path}.XXXXXXXX"); then
+        executor_installer_error "could not create the master key recovery record"
+        return
+    fi
+    if ! chmod 0600 "${temporary}"; then
+        if ! rm -f -- "${temporary}"; then
+            executor_installer_error \
+                "could not clean the unsecured master key recovery record"
+        fi
+        executor_installer_error "could not secure the master key recovery record"
+        return
+    fi
+    if ! {
+        printf 'executor-master-key-recovery-v1\n'
+        printf 'state %s\n' "${state}"
+        printf 'destination %s\n' "${destination_digest}"
+        printf 'staging %s\n' "${staging_name}"
+        printf 'uid %s\n' "${expected_uid}"
+        printf 'gid %s\n' "${expected_gid}"
+        printf 'device %s\n' "${device}"
+        printf 'inode %s\n' "${inode}"
+        printf 'digest %s\n' "${key_digest}"
+    } > "${temporary}"; then
+        if ! rm -f -- "${temporary}"; then
+            executor_installer_error \
+                "could not clean the unwritten master key recovery record"
+        fi
+        executor_installer_error "could not write the master key recovery record"
+        return
+    fi
+    executor_require_filesystem_sync \
+        "${temporary}" "the master key recovery record" || {
+        local status=$?
+        if ! rm -f -- "${temporary}"; then
+            executor_installer_error \
+                "could not clean the unsynced master key recovery record"
+        fi
+        return "${status}"
+    }
+    if ! mv -f -- "${temporary}" "${recovery_path}"; then
+        if ! rm -f -- "${temporary}"; then
+            executor_installer_error \
+                "could not clean the unpublished master key recovery record"
+        fi
+        executor_installer_error "could not publish the master key recovery record"
+        return
+    fi
+    executor_require_filesystem_sync \
+        "${recovery_parent}" "the master key recovery directory"
+}
+
+executor_retire_master_key_recovery() {
+    local recovery_path=$1
+    local recovery_parent=${recovery_path%/*}
+
+    if ! rm -f -- "${recovery_path}"; then
+        executor_installer_error "could not retire the master key recovery record"
+        return
+    fi
+    executor_require_filesystem_sync \
+        "${recovery_parent}" "the retired master key recovery record"
+}
+
+executor_validate_master_key_recovery_file() {
+    local path=$1
+    local metadata file_type owner mode links size
+
+    if ! metadata=$(LC_ALL=C stat \
+        --format='%F|%u|%a|%h|%s' -- "${path}"); then
+        executor_installer_error \
+            "could not inspect the master key recovery record: ${path}"
+        return
+    fi
+    IFS='|' read -r file_type owner mode links size <<< "${metadata}"
+    if [[ ${file_type} != "regular file" \
+        || ${owner} != "${EUID}" \
+        || ${mode} != 600 \
+        || ${links} != 1 \
+        || ${size} -gt 4096 ]]; then
+        executor_installer_error \
+            "the master key recovery record has unsafe metadata: ${path}"
+        return
+    fi
+}
+
+executor_validate_recorded_master_key() {
+    local path=$1
+    local expected_device=$2
+    local expected_inode=$3
+    local expected_uid=$4
+    local expected_gid=$5
+    local expected_digest=$6
+    local expected_links=$7
+    local metadata file_type size links owner group mode device inode digest
+
+    if ! metadata=$(LC_ALL=C stat \
+        --format='%F|%s|%h|%u|%g|%a|%d|%i' -- "${path}"); then
+        executor_installer_error "could not inspect recorded master key: ${path}"
+        return
+    fi
+    IFS='|' read -r file_type size links owner group mode device inode <<< "${metadata}"
+    if [[ ${file_type} != "regular file" \
+        || ${size} != 32 \
+        || ${links} != "${expected_links}" \
+        || ${owner} != "${expected_uid}" \
+        || ${group} != "${expected_gid}" \
+        || ${mode} != 600 \
+        || ${device} != "${expected_device}" \
+        || ${inode} != "${expected_inode}" ]]; then
+        executor_installer_error \
+            "recorded master key metadata does not match recovery state: ${path}"
+        return
+    fi
+    if ! digest=$(sha256sum -- "${path}" | awk '{print $1}'); then
+        executor_installer_error "could not digest recorded master key: ${path}"
+        return
+    fi
+    if [[ ${digest} != "${expected_digest}" ]]; then
+        executor_installer_error \
+            "recorded master key digest does not match recovery state: ${path}"
+        return
+    fi
+}
+
+executor_validate_prepared_master_key() {
+    local path=$1
+    local expected_device=$2
+    local expected_uid=$3
+    local expected_gid=$4
+    local metadata file_type size links owner group mode device current_gid
+
+    if ! metadata=$(LC_ALL=C stat \
+        --format='%F|%s|%h|%u|%g|%a|%d' -- "${path}"); then
+        executor_installer_error "could not inspect prepared master key: ${path}"
+        return
+    fi
+    IFS='|' read -r file_type size links owner group mode device <<< "${metadata}"
+    if ! current_gid=$(id -g); then
+        executor_installer_error "could not inspect the installer group"
+        return
+    fi
+    if [[ ${file_type} != "regular file" \
+        || ${size} -gt 32 \
+        || ${links} != 1 \
+        || ${owner} != "${EUID}" && ${owner} != "${expected_uid}" \
+        || ${group} != "${current_gid}" && ${group} != "${expected_gid}" \
+        || ${mode} != 600 \
+        || ${device} != "${expected_device}" ]]; then
+        executor_installer_error \
+            "prepared master key metadata does not match recovery state: ${path}"
+        return
+    fi
+}
+
+executor_recover_master_key() {
+    local staging_parent=$1
+    local data_dir=$2
+    local path=$3
+    local expected_uid=$4
+    local expected_gid=$5
+    local recovery_path=$6
+    local destination_digest=$7
+    local staging_device=$8
+    local -a lines=()
+    local state recorded_destination staging_name recorded_uid recorded_gid
+    local recorded_device recorded_inode recorded_digest staging_dir key_tmp
+    local destination_exists=false alias_exists=false destination_metadata
+    local destination_device destination_inode
+
+    if [[ ! -e ${recovery_path} && ! -L ${recovery_path} ]]; then
+        return 0
+    fi
+    executor_validate_master_key_recovery_file "${recovery_path}" || return $?
+    if ! mapfile -t lines < "${recovery_path}"; then
+        executor_installer_error \
+            "could not read the master key recovery record: ${recovery_path}"
+        return
+    fi
+    if [[ ${#lines[@]} -ne 9 \
+        || ${lines[0]} != executor-master-key-recovery-v1 \
+        || ${lines[1]} != "state "* \
+        || ${lines[2]} != "destination "* \
+        || ${lines[3]} != "staging "* \
+        || ${lines[4]} != "uid "* \
+        || ${lines[5]} != "gid "* \
+        || ${lines[6]} != "device "* \
+        || ${lines[7]} != "inode "* \
+        || ${lines[8]} != "digest "* ]]; then
+        executor_installer_error \
+            "the master key recovery record is malformed: ${recovery_path}"
+        return
+    fi
+    state=${lines[1]#state }
+    recorded_destination=${lines[2]#destination }
+    staging_name=${lines[3]#staging }
+    recorded_uid=${lines[4]#uid }
+    recorded_gid=${lines[5]#gid }
+    recorded_device=${lines[6]#device }
+    recorded_inode=${lines[7]#inode }
+    recorded_digest=${lines[8]#digest }
+    if [[ ${recorded_destination} != "${destination_digest}" \
+        || ${recorded_uid} != "${expected_uid}" \
+        || ${recorded_gid} != "${expected_gid}" \
+        || ! ${staging_name} =~ ^\.executor-master-key\.[A-Za-z0-9]{8}$ \
+        || ! ${recorded_uid} =~ ^[0-9]+$ \
+        || ! ${recorded_gid} =~ ^[0-9]+$ ]]; then
+        executor_installer_error \
+            "the master key recovery record does not match this installation"
+        return
+    fi
+    if [[ ${state} == prepared ]]; then
+        if [[ ${recorded_device} != - \
+            || ${recorded_inode} != - \
+            || ${recorded_digest} != - ]]; then
+            executor_installer_error "the prepared master key recovery record is malformed"
+            return
+        fi
+    elif [[ ${state} == staged ]]; then
+        if [[ ! ${recorded_device} =~ ^[0-9]+$ \
+            || ! ${recorded_inode} =~ ^[0-9]+$ \
+            || ! ${recorded_digest} =~ ^[0-9a-f]{64}$ ]]; then
+            executor_installer_error "the staged master key recovery record is malformed"
+            return
+        fi
+    else
+        executor_installer_error "the master key recovery state is unsupported"
+        return
+    fi
+
+    staging_dir="${staging_parent}/${staging_name}"
+    key_tmp="${staging_dir}/master.key"
+    if [[ -e ${staging_dir} || -L ${staging_dir} ]]; then
+        local directory_metadata directory_type directory_owner directory_mode directory_device
+        if ! directory_metadata=$(LC_ALL=C stat \
+            --format='%F|%u|%a|%d' -- "${staging_dir}"); then
+            executor_installer_error \
+                "could not inspect the recorded master key staging directory"
+            return
+        fi
+        IFS='|' read -r directory_type directory_owner directory_mode directory_device \
+            <<< "${directory_metadata}"
+        if [[ ${directory_type} != directory \
+            || ${directory_owner} != "${EUID}" \
+            || ${directory_mode} != 700 \
+            || ${directory_device} != "${staging_device}" ]]; then
+            executor_installer_error \
+                "the recorded master key staging directory is unsafe: ${staging_dir}"
+            return
+        fi
+    fi
+    [[ -e ${path} || -L ${path} ]] && destination_exists=true
+    [[ -e ${key_tmp} || -L ${key_tmp} ]] && alias_exists=true
+
+    if [[ ${state} == prepared ]]; then
+        if [[ ${destination_exists} == true ]]; then
+            executor_installer_error \
+                "a destination key appeared before master key staging completed"
+            return
+        fi
+        if [[ ${alias_exists} == true ]]; then
+            executor_validate_prepared_master_key \
+                "${key_tmp}" "${staging_device}" \
+                "${expected_uid}" "${expected_gid}" || return $?
+            if ! rm -f -- "${key_tmp}"; then
+                executor_installer_error "could not remove the prepared master key"
+                return
+            fi
+        fi
+    elif [[ ${destination_exists} == true ]]; then
+        if ! destination_metadata=$(LC_ALL=C stat \
+            --format='%d|%i' -- "${path}"); then
+            executor_installer_error "could not inspect the recovered master key"
+            return
+        fi
+        IFS='|' read -r destination_device destination_inode \
+            <<< "${destination_metadata}"
+        if [[ ${destination_device} != "${recorded_device}" \
+            || ${destination_inode} != "${recorded_inode}" ]]; then
+            executor_installer_error \
+                "the destination master key does not match the recovery record"
+            return
+        fi
+        if [[ ${alias_exists} == true ]]; then
+            executor_validate_recorded_master_key \
+                "${path}" "${recorded_device}" "${recorded_inode}" \
+                "${expected_uid}" "${expected_gid}" \
+                "${recorded_digest}" 2 || return $?
+            executor_validate_recorded_master_key \
+                "${key_tmp}" "${recorded_device}" "${recorded_inode}" \
+                "${expected_uid}" "${expected_gid}" \
+                "${recorded_digest}" 2 || return $?
+                if ! rm -f -- "${key_tmp}"; then
+                    executor_installer_error \
+                        "could not remove the recovered master key alias"
+                    return
+                fi
+        else
+            executor_validate_recorded_master_key \
+                "${path}" "${recorded_device}" "${recorded_inode}" \
+                "${expected_uid}" "${expected_gid}" \
+                "${recorded_digest}" 1 || return $?
+        fi
+    elif [[ ${alias_exists} == true ]]; then
+        executor_validate_recorded_master_key \
+            "${key_tmp}" "${recorded_device}" "${recorded_inode}" \
+            "${expected_uid}" "${expected_gid}" \
+            "${recorded_digest}" 1 || return $?
+        if ! ln -T -- "${key_tmp}" "${path}"; then
+            executor_installer_error \
+                "the master key destination appeared during recovery"
+            return
+        fi
+        executor_require_filesystem_sync \
+            "${data_dir}" "the recovered published master key" || return $?
+        if ! rm -f -- "${key_tmp}"; then
+            executor_installer_error "could not remove the recovered master key alias"
+            return
+        fi
+    fi
+
+    if [[ -d ${staging_dir} && ! -L ${staging_dir} ]]; then
+        if ! rmdir -- "${staging_dir}"; then
+            executor_installer_error \
+                "could not remove the recovered master key staging directory"
+            return
+        fi
+    fi
+    executor_require_filesystem_sync \
+        "${staging_parent}" "the recovered master key staging parent" || return $?
+    executor_require_filesystem_sync \
+        "${data_dir}" "the recovered master key directory" || return $?
+    executor_retire_master_key_recovery "${recovery_path}"
+}
+
+executor_require_safe_directory() {
+    local path=$1
+
+    if [[ -L ${path} ]]; then
+        executor_installer_error "refusing symbolic link at managed directory: ${path}"
+        return
+    fi
+    if [[ -e ${path} && ! -d ${path} ]]; then
+        executor_installer_error "managed directory path is not a directory: ${path}"
+        return
+    fi
+}
+
+executor_require_regular_file_or_absent() {
+    local path=$1
+
+    if [[ -L ${path} ]]; then
+        executor_installer_error "refusing symbolic link at managed path: ${path}"
+        return
+    fi
+    if [[ -e ${path} && ! -f ${path} ]]; then
+        executor_installer_error "managed path is not a regular file: ${path}"
+        return
+    fi
+}
+
+executor_validate_master_key_staging_parent() {
+    local path=$1
+    local metadata file_type owner mode device
+
+    if [[ ! -e ${path} && ! -L ${path} ]]; then
+        executor_installer_error "master key staging parent does not exist: ${path}"
+        return
+    fi
+    if ! metadata=$(LC_ALL=C stat \
+        --format='%F|%u|%a|%d' -- "${path}"); then
+        executor_installer_error \
+            "could not inspect master key staging parent: ${path}"
+        return
+    fi
+    IFS='|' read -r file_type owner mode device <<< "${metadata}"
+
+    if [[ ${file_type} != "directory" ]]; then
+        executor_installer_error \
+            "master key staging parent must be a non-symlinked directory: ${path}"
+        return
+    fi
+    if [[ ${owner} != "${EUID}" ]]; then
+        executor_installer_error \
+            "master key staging parent must be owned by uid ${EUID}: ${path}"
+        return
+    fi
+    if (((8#${mode} & 0022) != 0)); then
+        executor_installer_error \
+            "master key staging parent must not be group or other writable: ${path}"
+        return
+    fi
+
+    printf '%s\n' "${device}"
+}
+
+executor_validate_master_key() {
+    local path=$1
+    local expected_uid=$2
+    local expected_gid=$3
+    local metadata file_type size links owner group mode
+
+    if [[ ! -e ${path} && ! -L ${path} ]]; then
+        executor_installer_error "master key does not exist: ${path}"
+        return
+    fi
+
+    # GNU stat inspects the directory entry itself unless -L is supplied.
+    # Keeping this non-dereferencing prevents validation from following links.
+    if ! metadata=$(LC_ALL=C stat \
+        --format='%F|%s|%h|%u|%g|%a' -- "${path}"); then
+        executor_installer_error "could not inspect master key metadata: ${path}"
+        return
+    fi
+    IFS='|' read -r file_type size links owner group mode <<< "${metadata}"
+
+    if [[ ${file_type} != "regular file" ]]; then
+        executor_installer_error "master key must be a regular file: ${path}"
+        return
+    fi
+    if [[ ${size} != 32 ]]; then
+        executor_installer_error "${path} must contain exactly 32 bytes"
+        return
+    fi
+    if [[ ${links} != 1 ]]; then
+        executor_installer_error "${path} must not have additional hard links"
+        return
+    fi
+    if [[ ${owner} != "${expected_uid}" || ${group} != "${expected_gid}" ]]; then
+        executor_installer_error \
+            "${path} must already be owned by uid ${expected_uid} and gid ${expected_gid}"
+        return
+    fi
+    if [[ ${mode} != 600 ]]; then
+        executor_installer_error "${path} must already have mode 0600"
+        return
+    fi
+}
+
+executor_create_master_key() (
+    local staging_parent=$1
+    local data_dir=$2
+    local path=$3
+    local expected_uid=$4
+    local expected_gid=$5
+    local staging_device data_device validation_status write_status
+    local recovery_path destination_digest staging_name key_metadata
+    local key_device key_inode key_digest
+    local staging_dir=""
+    local key_tmp=""
+
+    cleanup_master_key_temp() {
+        if [[ -n ${key_tmp} ]]; then
+            rm -f -- "${key_tmp}"
+        fi
+        if [[ -n ${staging_dir} ]]; then
+            rmdir -- "${staging_dir}" 2>/dev/null || true
+        fi
+    }
+    trap cleanup_master_key_temp EXIT
+
+    umask 0077
+    if ! staging_device=$(executor_validate_master_key_staging_parent \
+        "${staging_parent}"); then
+        return 1
+    fi
+    if ! data_device=$(LC_ALL=C stat --format='%d' -- "${data_dir}"); then
+        executor_installer_error "could not inspect master key data directory"
+        return
+    fi
+    if [[ ${staging_device} != "${data_device}" ]]; then
+        executor_installer_error \
+            "master key staging parent and data directory must share a filesystem"
+        return
+    fi
+    if ! staging_dir=$(mktemp -d \
+        "${staging_parent}/.executor-master-key.XXXXXXXX"); then
+        executor_installer_error "could not create the master key staging directory"
+        return
+    fi
+    if ! chmod 0700 "${staging_dir}"; then
+        executor_installer_error "could not secure the master key staging directory"
+        return
+    fi
+    staging_name=${staging_dir##*/}
+    key_tmp="${staging_dir}/master.key"
+    recovery_path="${staging_parent}/.executor-master-key.recovery"
+    if ! destination_digest=$(executor_master_key_path_digest "${path}"); then
+        executor_installer_error "could not identify the master key destination"
+        return
+    fi
+    executor_publish_master_key_recovery \
+        "${recovery_path}" prepared "${destination_digest}" \
+        "${staging_name}" "${expected_uid}" "${expected_gid}" || return $?
+    if executor_write_and_sync_master_key "${key_tmp}"; then
+        :
+    else
+        write_status=$?
+        executor_installer_error "could not generate the master key"
+        return "${write_status}"
+    fi
+    if ! chown "${expected_uid}:${expected_gid}" "${key_tmp}"; then
+        executor_installer_error "could not set temporary master key ownership"
+        return
+    fi
+    if ! chmod 0600 "${key_tmp}"; then
+        executor_installer_error "could not set temporary master key permissions"
+        return
+    fi
+    if executor_validate_master_key \
+        "${key_tmp}" "${expected_uid}" "${expected_gid}"; then
+        :
+    else
+        validation_status=$?
+        return "${validation_status}"
+    fi
+    executor_require_filesystem_sync \
+        "${key_tmp}" "the final master key metadata" || return $?
+    if ! key_metadata=$(LC_ALL=C stat --format='%d|%i' -- "${key_tmp}"); then
+        executor_installer_error "could not inspect the staged master key identity"
+        return
+    fi
+    IFS='|' read -r key_device key_inode <<< "${key_metadata}"
+    if ! key_digest=$(sha256sum -- "${key_tmp}" | awk '{print $1}'); then
+        executor_installer_error "could not digest the staged master key"
+        return
+    fi
+    executor_publish_master_key_recovery \
+        "${recovery_path}" staged "${destination_digest}" \
+        "${staging_name}" "${expected_uid}" "${expected_gid}" \
+        "${key_device}" "${key_inode}" "${key_digest}" || return $?
+    if [[ ${EXECUTOR_INSTALL_TEST_CRASH_AFTER_KEY_METADATA_SYNC:-} == 1 ]]; then
+        kill -KILL "${BASHPID}"
+    fi
+
+    # A hard-link publication is atomic and fails if any directory entry has
+    # appeared at the destination. The published path is never overwritten.
+    if ln -T -- "${key_tmp}" "${path}"; then
+        :
+    else
+        local publication_status=$?
+        if ! rm -f -- "${key_tmp}"; then
+            executor_installer_error \
+                "could not remove the failed master key staging file"
+            return
+        fi
+        key_tmp=""
+        if ! rmdir -- "${staging_dir}"; then
+            executor_installer_error \
+                "could not remove the failed master key staging directory"
+            return
+        fi
+        staging_dir=""
+        executor_require_filesystem_sync \
+            "${staging_parent}" "the failed master key staging cleanup" || return $?
+        executor_retire_master_key_recovery "${recovery_path}" || return $?
+        executor_installer_error \
+            "master key path appeared during installation; refusing to replace it"
+        return "${publication_status}"
+    fi
+    executor_require_filesystem_sync \
+        "${data_dir}" "the published master key directory" || return $?
+    if [[ ${EXECUTOR_INSTALL_TEST_CRASH_AFTER_KEY_DESTINATION_SYNC:-} == 1 ]]; then
+        kill -KILL "${BASHPID}"
+    fi
+    if ! rm -f -- "${key_tmp}"; then
+        executor_installer_error "could not remove the temporary master key link"
+        return
+    fi
+    key_tmp=""
+    if [[ ${EXECUTOR_INSTALL_TEST_CRASH_AFTER_KEY_ALIAS_UNLINK:-} == 1 ]]; then
+        kill -KILL "${BASHPID}"
+    fi
+    if ! rmdir -- "${staging_dir}"; then
+        executor_installer_error "could not remove the master key staging directory"
+        return
+    fi
+    staging_dir=""
+    executor_require_filesystem_sync \
+        "${staging_parent}" "the master key staging parent" || return $?
+    executor_require_filesystem_sync \
+        "${data_dir}" "the master key directory after publication" || return $?
+
+    executor_validate_master_key "${path}" "${expected_uid}" "${expected_gid}" || return $?
+    executor_retire_master_key_recovery "${recovery_path}"
+)
+
+executor_ensure_master_key() (
+    local staging_parent=$1
+    local data_dir=$2
+    local path=$3
+    local expected_uid=$4
+    local expected_gid=$5
+    local recovery_path="${staging_parent}/.executor-master-key.recovery"
+    local lock_path="${staging_parent}/.executor-master-key.lock"
+    local destination_digest staging_device lock_fd lock_metadata fd_identity
+    local lock_type lock_owner lock_mode lock_links lock_size lock_device lock_inode
+
+    if ! command -v flock >/dev/null 2>&1; then
+        executor_installer_error "flock is required for master key installation"
+        return
+    fi
+    if ! staging_device=$(executor_validate_master_key_staging_parent \
+        "${staging_parent}"); then
+        return 1
+    fi
+    umask 0077
+    if [[ ! -e ${lock_path} && ! -L ${lock_path} ]]; then
+        if ! (set -o noclobber; : > "${lock_path}") 2>/dev/null \
+            && [[ ! -e ${lock_path} || -L ${lock_path} ]]; then
+            executor_installer_error "could not create the master key installation lock"
+            return
+        fi
+    fi
+    if ! lock_metadata=$(LC_ALL=C stat \
+        --format='%F|%u|%a|%h|%s|%d|%i' -- "${lock_path}"); then
+        executor_installer_error "could not inspect the master key installation lock"
+        return
+    fi
+    IFS='|' read -r lock_type lock_owner lock_mode lock_links lock_size \
+        lock_device lock_inode <<< "${lock_metadata}"
+    if [[ ${lock_type} != "regular empty file" \
+        || ${lock_owner} != "${EUID}" \
+        || ${lock_mode} != 600 \
+        || ${lock_links} != 1 \
+        || ${lock_size} != 0 \
+        || ${lock_device} != "${staging_device}" ]]; then
+        executor_installer_error \
+            "the master key installation lock has unsafe metadata"
+        return
+    fi
+    if ! exec {lock_fd}<>"${lock_path}"; then
+        executor_installer_error "could not open the master key installation lock"
+        return
+    fi
+    if ! fd_identity=$(LC_ALL=C stat -L \
+        --format='%d|%i' -- "/proc/self/fd/${lock_fd}") \
+        || [[ ${fd_identity} != "${lock_device}|${lock_inode}" ]]; then
+        executor_installer_error "the master key installation lock changed while opening"
+        return
+    fi
+    executor_require_filesystem_sync \
+        "${lock_path}" "the master key installation lock" || return $?
+    executor_require_filesystem_sync \
+        "${staging_parent}" "the master key lock directory" || return $?
+    if ! flock -n -x "${lock_fd}"; then
+        executor_installer_error "another master key installation is already active"
+        return
+    fi
+    if ! destination_digest=$(executor_master_key_path_digest "${path}"); then
+        executor_installer_error "could not identify the master key destination"
+        return
+    fi
+    executor_recover_master_key \
+        "${staging_parent}" "${data_dir}" "${path}" \
+        "${expected_uid}" "${expected_gid}" "${recovery_path}" \
+        "${destination_digest}" "${staging_device}" || return $?
+
+    if [[ -e ${path} || -L ${path} ]]; then
+        executor_validate_master_key \
+            "${path}" "${expected_uid}" "${expected_gid}" || return $?
+        executor_require_filesystem_sync \
+            "${data_dir}" "the existing master key directory" || return $?
+        return 0
+    fi
+
+    executor_create_master_key \
+        "${staging_parent}" "${data_dir}" "${path}" \
+        "${expected_uid}" "${expected_gid}"
+)
diff --git a/scripts/migrate-schema-class.ts b/scripts/migrate-schema-class.ts
index 6eb10c46b..e98ccc574 100644
--- a/scripts/migrate-schema-class.ts
+++ b/scripts/migrate-schema-class.ts
@@ -29,7 +29,6 @@ const IGNORE_DIRS = new Set([
   "dist",
   "build",
   ".local",
-  ".changeset",
 ]);
 
 // Files we intentionally leave alone — they contain `Schema.Class` strings as
diff --git a/scripts/oxlint-plugin-executor/rules/no-cross-package-relative-imports.js b/scripts/oxlint-plugin-executor/rules/no-cross-package-relative-imports.js
index 0c34fe6be..78e250ffe 100644
--- a/scripts/oxlint-plugin-executor/rules/no-cross-package-relative-imports.js
+++ b/scripts/oxlint-plugin-executor/rules/no-cross-package-relative-imports.js
@@ -50,7 +50,7 @@ function findPackageRoot(absolutePath) {
 
 function collectPackageRoots() {
   const roots = [];
-  for (const root of ["packages", "apps", "examples"]) {
+  for (const root of ["packages", "apps", "legacy", "examples"]) {
     collectPackageRootsFrom(path.join(repoRoot, root), roots);
   }
   return roots;
diff --git a/scripts/oxlint-plugin-executor/rules/no-direct-cloud-executor-schema-import.js b/scripts/oxlint-plugin-executor/rules/no-direct-cloud-executor-schema-import.js
index 75ca1db1e..bcbf88555 100644
--- a/scripts/oxlint-plugin-executor/rules/no-direct-cloud-executor-schema-import.js
+++ b/scripts/oxlint-plugin-executor/rules/no-direct-cloud-executor-schema-import.js
@@ -3,9 +3,12 @@ import { getPropertyName, isIdentifier, toRepoRelative, unwrapExpression } from
 const message =
   "Do not access cloud executor tables directly outside DB schema wiring. Executor-domain table access must go through the scoped SDK adapter so scope_id filtering cannot be skipped.";
 
-const allowedFiles = new Set(["apps/cloud/src/db/db.ts", "apps/cloud/src/db/db.schema.test.ts"]);
+const allowedFiles = new Set([
+  "legacy/cloud/src/db/db.ts",
+  "legacy/cloud/src/db/db.schema.test.ts",
+]);
 
-const isCloudSource = (filename) => toRepoRelative(filename).startsWith("apps/cloud/src/");
+const isCloudSource = (filename) => toRepoRelative(filename).startsWith("legacy/cloud/src/");
 
 const isDirectExecutorSchemaImport = (specifier) =>
   specifier === "./executor-schema" ||
diff --git a/scripts/package-release-archive.py b/scripts/package-release-archive.py
new file mode 100755
index 000000000..97b4bf919
--- /dev/null
+++ b/scripts/package-release-archive.py
@@ -0,0 +1,57 @@
+#!/usr/bin/env python3
+import argparse
+import gzip
+import pathlib
+import tarfile
+
+
+ARCHIVE_MEMBERS = (
+    ("executor", 0o755),
+    ("LICENSE", 0o644),
+    ("THIRD_PARTY_LICENSES.html", 0o644),
+    ("THIRD_PARTY_JAVASCRIPT_LICENSES.json", 0o644),
+)
+
+
+def parse_args() -> argparse.Namespace:
+    parser = argparse.ArgumentParser(description="Create a deterministic Executor release archive")
+    parser.add_argument("--source", type=pathlib.Path, required=True)
+    parser.add_argument("--output", type=pathlib.Path, required=True)
+    parser.add_argument("--epoch", type=int, required=True)
+    return parser.parse_args()
+
+
+def main() -> None:
+    args = parse_args()
+    if args.epoch < 0:
+        raise SystemExit("--epoch must be a non-negative Unix timestamp")
+
+    expected = {name for name, _ in ARCHIVE_MEMBERS}
+    actual = {path.name for path in args.source.iterdir()}
+    if actual != expected:
+        raise SystemExit(
+            f"release archive staging members differ: expected {sorted(expected)}, got {sorted(actual)}"
+        )
+
+    args.output.parent.mkdir(parents=True, exist_ok=True)
+    with args.output.open("wb") as raw_output:
+        with gzip.GzipFile(filename="", mode="wb", fileobj=raw_output, mtime=args.epoch) as compressed:
+            with tarfile.open(fileobj=compressed, mode="w", format=tarfile.USTAR_FORMAT) as archive:
+                for name, mode in ARCHIVE_MEMBERS:
+                    source = args.source / name
+                    if not source.is_file() or source.is_symlink():
+                        raise SystemExit(f"release archive member must be a regular file: {source}")
+                    info = tarfile.TarInfo(name)
+                    info.size = source.stat().st_size
+                    info.mtime = args.epoch
+                    info.mode = mode
+                    info.uid = 0
+                    info.gid = 0
+                    info.uname = ""
+                    info.gname = ""
+                    with source.open("rb") as contents:
+                        archive.addfile(info, contents)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/scripts/publish-packages.ts b/scripts/publish-packages.ts
deleted file mode 100644
index 1fa543439..000000000
--- a/scripts/publish-packages.ts
+++ /dev/null
@@ -1,394 +0,0 @@
-#!/usr/bin/env bun
-/**
- * Publishes the public @executor-js/* workspace packages to npm.
- *
- * Walks a hard-coded list of publishable package directories, determines the
- * dist-tag from the version string (anything containing `-` is treated as beta),
- * and packs + publishes each package whose current version is not already on npm.
- *
- * Invoked from `.github/workflows/release.yml` via the `publish:` input on
- * changesets/action after the Version Packages PR has been merged, and locally
- * via `bun run release:publish:packages` (or `--dry-run`).
- */
-import { $ } from "bun";
-import { existsSync } from "node:fs";
-import { readdir, readFile, rm, writeFile } from "node:fs/promises";
-import { dirname, join, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-
-type Channel = "latest" | "beta";
-
-const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
-
-const PACKAGE_SCOPE = "@executor-js";
-
-/**
- * Workspace-relative paths of the public packages. Kept explicit so a new
- * directory under `packages/plugins/` does not accidentally ship to npm.
- */
-const PUBLIC_PACKAGE_DIRS = [
-  "packages/core/fumadb",
-  "packages/kernel/core",
-  "packages/kernel/runtime-quickjs",
-  "packages/core/sdk",
-  "packages/core/config",
-  "packages/core/execution",
-  "packages/core/cli",
-  "packages/plugins/example",
-  "packages/plugins/file-secrets",
-  "packages/plugins/graphql",
-  "packages/plugins/keychain",
-  "packages/plugins/mcp",
-  "packages/plugins/onepassword",
-  "packages/plugins/openapi",
-] as const;
-
-const parseArgs = (argv: ReadonlyArray<string>): { dryRun: boolean; prepareOnly: boolean } => {
-  let dryRun = false;
-  let prepareOnly = false;
-  for (const arg of argv) {
-    if (arg === "--dry-run") {
-      dryRun = true;
-      continue;
-    }
-    if (arg === "--prepare-only") {
-      prepareOnly = true;
-      continue;
-    }
-    throw new Error(`Unknown argument: ${arg}`);
-  }
-  return { dryRun, prepareOnly };
-};
-
-const resolveChannel = (version: string): Channel => (version.includes("-") ? "beta" : "latest");
-
-const readPackageMeta = async (pkgDir: string) => {
-  const pkgJsonPath = join(pkgDir, "package.json");
-  const pkg = (await Bun.file(pkgJsonPath).json()) as {
-    name?: string;
-    version?: string;
-    private?: boolean;
-  };
-
-  if (!pkg.name || !pkg.version) {
-    throw new Error(`Missing name/version in ${pkgJsonPath}`);
-  }
-  if (pkg.private === true) {
-    throw new Error(`${pkg.name} is marked private and cannot be published`);
-  }
-
-  return { name: pkg.name, version: pkg.version };
-};
-
-const packageAlreadyPublished = async (name: string, version: string): Promise<boolean> => {
-  const proc = Bun.spawn(["npm", "view", `${name}@${version}`, "version"], {
-    stdio: ["ignore", "ignore", "ignore"],
-  });
-  return (await proc.exited) === 0;
-};
-
-type DependencyBlock = Record<string, string>;
-type PeerDependenciesMeta = Record<string, { optional?: boolean }>;
-type MutablePackageJson = {
-  name?: string;
-  dependencies?: DependencyBlock;
-  devDependencies?: DependencyBlock;
-  peerDependencies?: DependencyBlock;
-  peerDependenciesMeta?: PeerDependenciesMeta;
-  optionalDependencies?: DependencyBlock;
-  [key: string]: unknown;
-};
-
-/**
- * Resolves `workspace:*` dependencies between public packages to concrete
- * versions before packing. Returns a restore function that reverts package.json.
- *
- * Workspace-only `@executor-js/*` peer deps (e.g. `@executor-js/api`,
- * `@executor-js/react`) that aren't in `publishable` are stripped from
- * `peerDependencies` (and `peerDependenciesMeta`) entirely — they don't
- * exist on npm, so leaving them in the packed manifest would emit
- * install-time warnings for unresolvable packages.
- */
-const applyWorkspaceVersions = async (
-  pkgDir: string,
-  publishable: ReadonlySet<string>,
-  publishableVersions: ReadonlyMap<string, string>,
-): Promise<() => Promise<void>> => {
-  const isInternalScope = (key: string): boolean => key.startsWith(`${PACKAGE_SCOPE}/`);
-
-  const renameDepBlock = (block: DependencyBlock | undefined): DependencyBlock | undefined => {
-    if (!block) return block;
-    const next: DependencyBlock = {};
-    let mutated = false;
-    for (const [key, value] of Object.entries(block)) {
-      if (publishable.has(key) && value.startsWith("workspace:")) {
-        next[key] = publishableVersions.get(key) ?? value;
-        mutated = true;
-      } else if (isInternalScope(key) && !publishable.has(key)) {
-        // Workspace-only `@executor-js/*` regular dep that we don't
-        // publish (e.g. `@executor-js/api`). Strip it: it's not in the
-        // shipped runtime entries (those imports live in
-        // `src/api/*` / `src/react/*` which don't make it into the
-        // packed dist), and leaving it in would 404 at install time.
-        mutated = true;
-      } else {
-        next[key] = value;
-      }
-    }
-    return mutated ? next : block;
-  };
-
-  /**
-   * Peer-deps variant of `renameDepBlock`: resolve workspace specifiers for
-   * publishable peers, but DROP non-publishable `@executor-js/*` peers.
-   * They reference workspace-only packages (`@executor-js/api`,
-   * `@executor-js/react`) that don't exist on npm, so leaving them in
-   * the packed manifest emits install-time warnings for unresolvable
-   * packages. Non-`@executor-js` peers (`react`, `@tanstack/*`,
-   * `@effect-atom/*`, etc.) are real npm packages and pass through
-   * unchanged.
-   */
-  const renamePeerDepBlock = (block: DependencyBlock | undefined): DependencyBlock | undefined => {
-    if (!block) return block;
-    const next: DependencyBlock = {};
-    let mutated = false;
-    for (const [key, value] of Object.entries(block)) {
-      if (publishable.has(key)) {
-        next[key] = value.startsWith("workspace:")
-          ? (publishableVersions.get(key) ?? value)
-          : value;
-        if (next[key] !== value) mutated = true;
-      } else if (isInternalScope(key)) {
-        // Workspace-only `@executor-js/*` peer that we don't publish —
-        // strip it so the packed tarball doesn't reference an
-        // npm package that doesn't exist.
-        mutated = true;
-      } else {
-        next[key] = value;
-      }
-    }
-    return mutated ? next : block;
-  };
-
-  /**
-   * Strips `peerDependenciesMeta` entries that target an
-   * `@executor-js/*` peer we don't publish, mirroring `renamePeerDepBlock`
-   * so the meta block can't drift out of sync with the deps block.
-   */
-  const renamePeerMetaBlock = (
-    block: PeerDependenciesMeta | undefined,
-  ): PeerDependenciesMeta | undefined => {
-    if (!block) return block;
-    const next: PeerDependenciesMeta = {};
-    let mutated = false;
-    for (const [key, value] of Object.entries(block)) {
-      if (publishable.has(key)) {
-        next[key] = value;
-      } else if (isInternalScope(key)) {
-        mutated = true;
-      } else {
-        next[key] = value;
-      }
-    }
-    return mutated ? next : block;
-  };
-
-  const pkgJsonPath = join(pkgDir, "package.json");
-  const original = await readFile(pkgJsonPath, "utf8");
-  const pkg = JSON.parse(original) as MutablePackageJson;
-  pkg.dependencies = renameDepBlock(pkg.dependencies);
-  pkg.devDependencies = renameDepBlock(pkg.devDependencies);
-  pkg.peerDependencies = renamePeerDepBlock(pkg.peerDependencies);
-  pkg.peerDependenciesMeta = renamePeerMetaBlock(pkg.peerDependenciesMeta);
-  pkg.optionalDependencies = renameDepBlock(pkg.optionalDependencies);
-  const pkgNext = `${JSON.stringify(pkg, null, 2)}\n`;
-  if (pkgNext !== original) {
-    await writeFile(pkgJsonPath, pkgNext);
-    return async () => {
-      await writeFile(pkgJsonPath, original);
-    };
-  }
-  return async () => {};
-};
-
-/**
- * Applies `publishConfig` field overrides to package.json in place, returning a
- * function that restores the original file. `bun pm pack` does not substitute
- * `publishConfig.exports` / `publishConfig.main` etc at pack time (npm does,
- * but only for a subset of fields and only for `npm pack`), so we rewrite the
- * file ourselves so the packed tarball has the correct `exports` pointing at
- * `dist/` instead of the dev-time `src/index.ts`.
- */
-const applyPublishConfig = async (pkgDir: string): Promise<() => Promise<void>> => {
-  const pkgJsonPath = join(pkgDir, "package.json");
-  const original = await readFile(pkgJsonPath, "utf8");
-  const parsed = JSON.parse(original) as {
-    publishConfig?: Record<string, unknown>;
-    [key: string]: unknown;
-  };
-
-  const publishConfig = parsed.publishConfig;
-  if (!publishConfig || typeof publishConfig !== "object") {
-    return async () => {};
-  }
-
-  // Fields we allow publishConfig to override. `access`/`tag`/`registry` are
-  // real npm publish-time config keys — they must NOT be hoisted into the
-  // top-level manifest.
-  const overridable = new Set([
-    "exports",
-    "main",
-    "module",
-    "types",
-    "typings",
-    "bin",
-    "browser",
-    "files",
-  ]);
-
-  const nextPublishConfig: Record<string, unknown> = {};
-  let mutated = false;
-  for (const [key, value] of Object.entries(publishConfig)) {
-    if (overridable.has(key)) {
-      parsed[key] = value;
-      mutated = true;
-    } else {
-      nextPublishConfig[key] = value;
-    }
-  }
-
-  if (!mutated) {
-    return async () => {};
-  }
-
-  if (Object.keys(nextPublishConfig).length === 0) {
-    delete parsed.publishConfig;
-  } else {
-    parsed.publishConfig = nextPublishConfig;
-  }
-
-  await writeFile(pkgJsonPath, `${JSON.stringify(parsed, null, 2)}\n`);
-  return async () => {
-    await writeFile(pkgJsonPath, original);
-  };
-};
-
-const publishPackage = async (
-  pkgDir: string,
-  dryRun: boolean,
-  publishable: ReadonlySet<string>,
-  publishableVersions: ReadonlyMap<string, string>,
-) => {
-  const { name, version } = await readPackageMeta(pkgDir);
-  const channel = resolveChannel(version);
-
-  if (!existsSync(join(pkgDir, "dist"))) {
-    throw new Error(`Missing dist/ in ${pkgDir}. Did you run 'bun run build:packages'?`);
-  }
-
-  console.log(`[pack] ${name}@${version} (${channel})${dryRun ? " [dry-run]" : ""}`);
-
-  // Clean any stale tarballs from previous runs so our readdir finds exactly
-  // the archive produced by the pack below.
-  const stale = (await readdir(pkgDir)).filter((entry) => entry.endsWith(".tgz"));
-  for (const entry of stale) {
-    await rm(join(pkgDir, entry), { force: true });
-  }
-
-  const restoreWorkspaceVersions = await applyWorkspaceVersions(
-    pkgDir,
-    publishable,
-    publishableVersions,
-  );
-  const restorePublishConfig = await applyPublishConfig(pkgDir);
-  try {
-    await $`bun pm pack`.cwd(pkgDir);
-  } finally {
-    await restorePublishConfig();
-    await restoreWorkspaceVersions();
-  }
-
-  const produced = (await readdir(pkgDir)).filter((entry) => entry.endsWith(".tgz"));
-  if (produced.length !== 1) {
-    throw new Error(
-      `Expected exactly 1 .tgz in ${pkgDir}, found ${produced.length}: ${produced.join(", ")}`,
-    );
-  }
-  const tarball = produced[0]!;
-
-  if (dryRun) {
-    return;
-  }
-
-  // Skip publishing already-shipped versions. The pack still ran above so
-  // smoke tests / pkg-pr-new previews always have a fresh tarball.
-  if (await packageAlreadyPublished(name, version)) {
-    console.log(`[skip] ${name}@${version} already on npm`);
-    return;
-  }
-
-  console.log(`[publish] ${name}@${version} (${channel})`);
-
-  const args = ["publish", tarball, "--access", "public", "--tag", channel];
-  if (process.env.GITHUB_ACTIONS === "true") {
-    args.push("--provenance");
-  }
-  await $`npm ${args}`.cwd(pkgDir);
-};
-
-/**
- * Rewrite-in-place mode for the pkg.pr.new preview workflow. pkg-pr-new runs
- * `bun pm pack` against each workspace package directly, which can't see our
- * `publishConfig.exports` overrides or resolve `workspace:*` references. This
- * walks every public package, applies the same rewrites `publishPackage`
- * does, and intentionally leaves them mutated — the CI job is ephemeral and
- * the workflow tears down right after pkg-pr-new finishes.
- */
-const prepareOnePackage = async (
-  pkgDir: string,
-  publishable: ReadonlySet<string>,
-  publishableVersions: ReadonlyMap<string, string>,
-) => {
-  const { name, version } = await readPackageMeta(pkgDir);
-  if (!existsSync(join(pkgDir, "dist"))) {
-    throw new Error(`Missing dist/ in ${pkgDir}. Did you run 'bun run build:packages'?`);
-  }
-  console.log(`[prepare] ${name}@${version}`);
-  await applyWorkspaceVersions(pkgDir, publishable, publishableVersions);
-  await applyPublishConfig(pkgDir);
-};
-
-const main = async () => {
-  const { dryRun, prepareOnly } = parseArgs(process.argv.slice(2));
-
-  // Each package's own version determines its dist-tag (pre-release versions
-  // with `-` publish to `beta`, everything else to `latest`). Packages are
-  // only skipped when their current version is already on npm.
-  const mode = prepareOnly ? " [prepare-only]" : dryRun ? " [dry-run]" : "";
-  console.log(`Publishing ${PACKAGE_SCOPE} packages${mode}`);
-
-  await $`bun run build:packages`.cwd(repoRoot);
-
-  // Snapshot the public package names and versions up front so public
-  // workspace dependencies can be written as exact versions in packed tarballs.
-  const publishable = new Set<string>();
-  const publishableVersions = new Map<string, string>();
-  for (const relDir of PUBLIC_PACKAGE_DIRS) {
-    const pkg = await readPackageMeta(join(repoRoot, relDir));
-    publishable.add(pkg.name);
-    publishableVersions.set(pkg.name, pkg.version);
-  }
-
-  if (prepareOnly) {
-    for (const relDir of PUBLIC_PACKAGE_DIRS) {
-      await prepareOnePackage(join(repoRoot, relDir), publishable, publishableVersions);
-    }
-    return;
-  }
-
-  for (const relDir of PUBLIC_PACKAGE_DIRS) {
-    await publishPackage(join(repoRoot, relDir), dryRun, publishable, publishableVersions);
-  }
-};
-
-await main();
diff --git a/scripts/reap-dev-servers.ts b/scripts/reap-dev-servers.ts
index 5a9aa9c62..1fd312bae 100644
--- a/scripts/reap-dev-servers.ts
+++ b/scripts/reap-dev-servers.ts
@@ -31,7 +31,7 @@ for (const line of ps.split("\n")) {
   if (Number(pidText) === process.pid) continue;
   // The checkout root is whatever absolute path prefixes node_modules/ or a
   // workspace dir in the command line.
-  const pathMatch = command!.match(/(\/[^ ]*?)\/(?:node_modules|apps|packages|e2e)\//);
+  const pathMatch = command!.match(/(\/[^ ]*?)\/(?:node_modules|apps|legacy|packages|e2e)\//);
   const checkout = pathMatch?.[1];
   const orphan = checkout !== undefined && !existsSync(checkout);
   candidates.push({ pid: Number(pidText), command: command!.slice(0, 160), checkout, orphan });
diff --git a/scripts/run-local-e2e.ts b/scripts/run-local-e2e.ts
new file mode 100644
index 000000000..ec453202b
--- /dev/null
+++ b/scripts/run-local-e2e.ts
@@ -0,0 +1,22 @@
+import { execFileSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+
+const root = fileURLToPath(new URL("..", import.meta.url));
+
+execFileSync("bun", ["run", "build"], {
+  cwd: fileURLToPath(new URL("../web", import.meta.url)),
+  stdio: "inherit",
+});
+execFileSync("cargo", ["build", "--bin", "executor"], {
+  cwd: root,
+  env: { ...process.env, EXECUTOR_WEB_ASSETS_DIR: "web/build" },
+  stdio: "inherit",
+});
+execFileSync("bun", ["run", "test:unit"], {
+  cwd: fileURLToPath(new URL("../e2e", import.meta.url)),
+  stdio: "inherit",
+});
+execFileSync("bun", ["run", "test"], {
+  cwd: fileURLToPath(new URL("../e2e", import.meta.url)),
+  stdio: "inherit",
+});
diff --git a/scripts/smoke-docs-install.ts b/scripts/smoke-docs-install.ts
deleted file mode 100644
index 0a74fcd9a..000000000
--- a/scripts/smoke-docs-install.ts
+++ /dev/null
@@ -1,97 +0,0 @@
-#!/usr/bin/env bun
-/**
- * Verifies the SDK install command shown in docs resolves to a package we can
- * actually publish and consume.
- *
- * This intentionally installs the packed tarball under the documented package
- * name (`@executor-js/sdk`) instead of relying on workspace resolution.
- */
-import { $ } from "bun";
-import { existsSync, readdirSync } from "node:fs";
-import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { dirname, join, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-
-const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
-const documentedPackages = ["@executor-js/sdk", "@executor-js/plugin-openapi"] as const;
-const publicPackageDirs = [
-  "packages/core/fumadb",
-  "packages/core/sdk",
-  "packages/core/config",
-  "packages/plugins/openapi",
-] as const;
-
-const readPackageName = async (pkgDir: string): Promise<string> => {
-  const raw = await readFile(join(pkgDir, "package.json"), "utf8");
-  return (JSON.parse(raw) as { name: string }).name;
-};
-
-const findTarball = (pkgDir: string, packageName: string): string => {
-  const tarball = readdirSync(pkgDir).find((entry) => entry.endsWith(".tgz"));
-  if (!tarball) {
-    throw new Error(`No packed tarball found for ${packageName}`);
-  }
-  return join(pkgDir, tarball);
-};
-
-console.log(`[docs-smoke] packing documented SDK packages`);
-await $`bun run scripts/publish-packages.ts --dry-run`.cwd(repoRoot);
-
-const tarballs = new Map<string, string>();
-for (const relDir of publicPackageDirs) {
-  const pkgDir = join(repoRoot, relDir);
-  const name = await readPackageName(pkgDir);
-  tarballs.set(name, findTarball(pkgDir, name));
-}
-
-const tmp = await mkdtemp(join(tmpdir(), "executor-docs-install-"));
-
-try {
-  const dependencies: Record<string, string> = {};
-  const overrides: Record<string, string> = {};
-  for (const [name, tarball] of tarballs) {
-    overrides[name] = `file:${tarball}`;
-  }
-  for (const name of documentedPackages) {
-    const tarball = tarballs.get(name);
-    if (!tarball) {
-      throw new Error(`No packed tarball found for documented package ${name}`);
-    }
-    dependencies[name] = `file:${tarball}`;
-  }
-
-  const fixture = {
-    name: "executor-docs-install-smoke",
-    version: "0.0.0",
-    private: true,
-    type: "module",
-    dependencies,
-    overrides,
-  };
-
-  await writeFile(join(tmp, "package.json"), `${JSON.stringify(fixture, null, 2)}\n`);
-
-  console.log(`[docs-smoke] npm install ${documentedPackages.join(" ")}`);
-  await $`npm install --no-audit --no-fund --legacy-peer-deps`.cwd(tmp);
-
-  for (const packageName of documentedPackages) {
-    const installedManifest = join(tmp, "node_modules", ...packageName.split("/"), "package.json");
-    if (!existsSync(installedManifest)) {
-      throw new Error(`Expected ${packageName} to be installed at ${installedManifest}`);
-    }
-    const manifest = await import(installedManifest, { with: { type: "json" } });
-    if (manifest.default.name !== packageName) {
-      throw new Error(
-        `Expected installed package name to be ${packageName}, got ${manifest.default.name}`,
-      );
-    }
-  }
-
-  console.log(`[docs-smoke] import documented SDK packages`);
-  await $`node --input-type=module --eval ${`const sdk = await import("@executor-js/sdk"); const openapi = await import("@executor-js/plugin-openapi"); if (typeof sdk.createExecutor !== "function") throw new Error("missing createExecutor"); if (typeof openapi.openApiPlugin !== "function") throw new Error("missing openApiPlugin");`}`.cwd(
-    tmp,
-  );
-} finally {
-  await rm(tmp, { recursive: true, force: true });
-}
diff --git a/scripts/smoke-release-container.sh b/scripts/smoke-release-container.sh
new file mode 100755
index 000000000..f8f057359
--- /dev/null
+++ b/scripts/smoke-release-container.sh
@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+image="${1:?container image is required}"
+canonical_web_dir="${2:?canonical web directory is required}"
+container_name="${3:?container name is required}"
+volume_name="${4:?volume name is required}"
+log_file=""
+
+cleanup() {
+    local status=$1
+    trap - EXIT
+    if docker inspect "$container_name" >/dev/null 2>&1; then
+        if [[ "$status" -ne 0 ]]; then
+            docker logs "$container_name" >&2 || true
+        fi
+        docker rm --force "$container_name" >/dev/null 2>&1 || true
+    fi
+    docker volume rm --force "$volume_name" >/dev/null 2>&1 || true
+    if [[ -n "$log_file" ]]; then
+        rm -f "$log_file"
+    fi
+    exit "$status"
+}
+trap 'cleanup "$?"' EXIT
+
+docker volume create "$volume_name" >/dev/null
+docker run --detach \
+    --name "$container_name" \
+    --pull=never \
+    --init \
+    --read-only \
+    --cap-drop ALL \
+    --security-opt no-new-privileges \
+    --memory 2g \
+    --pids-limit 512 \
+    --tmpfs /tmp:rw,noexec,nosuid,nodev,size=64m \
+    --mount "source=${volume_name},target=/var/lib/executor" \
+    --publish 127.0.0.1::4788 \
+    "$image" >/dev/null
+
+endpoint="$(docker port "$container_name" 4788/tcp)"
+port="${endpoint##*:}"
+[[ "$port" =~ ^[0-9]+$ ]] \
+    || { printf 'could not resolve mapped container port from %s\n' "$endpoint" >&2; exit 1; }
+base_url="http://127.0.0.1:${port}"
+
+ready=false
+for _ in {1..120}; do
+    if curl --fail --silent --show-error "${base_url}/healthz" >/dev/null 2>&1; then
+        ready=true
+        break
+    fi
+    if [[ "$(docker inspect --format '{{.State.Status}}' "$container_name")" == "exited" ]]; then
+        break
+    fi
+    sleep 1
+done
+[[ "$ready" == true ]] \
+    || { printf 'release container did not become healthy\n' >&2; exit 1; }
+
+log_file="$(mktemp "${TMPDIR:-/tmp}/executor-container-smoke.XXXXXXXX")"
+docker logs "$container_name" > "$log_file" 2>&1
+grep -F 'Complete first-boot setup at:' "$log_file" >/dev/null
+grep -E 'http://127\.0\.0\.1:4788/setup#token=.+' "$log_file" >/dev/null
+rm -f "$log_file"
+log_file=""
+
+"$(dirname "${BASH_SOURCE[0]}")/smoke-release-server.sh" \
+    "$base_url" \
+    "$canonical_web_dir"
+
+docker stop --time 120 "$container_name" >/dev/null
+[[ "$(docker inspect --format '{{.State.ExitCode}}' "$container_name")" == "0" ]]
diff --git a/scripts/smoke-release-server.sh b/scripts/smoke-release-server.sh
new file mode 100755
index 000000000..f0a7225e5
--- /dev/null
+++ b/scripts/smoke-release-server.sh
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+base_url="${1:?base URL is required}"
+canonical_web_dir="${2:?canonical web directory is required}"
+
+[[ -f "${canonical_web_dir}/index.html" ]] \
+    || { printf 'missing canonical index.html in %s\n' "$canonical_web_dir" >&2; exit 1; }
+
+response_dir="$(mktemp -d "${TMPDIR:-/tmp}/executor-web-smoke.XXXXXXXX")"
+trap 'rm -rf "$response_dir"' EXIT
+
+curl --fail --globoff --silent --show-error "${base_url}/healthz" >/dev/null
+curl --fail --globoff --silent --show-error --output "${response_dir}/root" "${base_url}/"
+cmp "${canonical_web_dir}/index.html" "${response_dir}/root"
+
+asset_list="${response_dir}/assets"
+find "$canonical_web_dir" -type f | LC_ALL=C sort > "$asset_list"
+asset_index=0
+while IFS= read -r asset; do
+    relative="${asset#${canonical_web_dir}/}"
+    case "$relative" in
+        *$'\n'*|*$'\r'*|*' '*|*'?'*|*'#'*|*'%'*)
+            printf 'canonical web asset has an unsafe URL path: %s\n' "$relative" >&2
+            exit 1
+            ;;
+    esac
+    asset_index=$((asset_index + 1))
+    served="${response_dir}/served-${asset_index}"
+    curl --fail --globoff --silent --show-error \
+        --output "$served" \
+        "${base_url}/${relative}"
+    cmp "$asset" "$served"
+done < "$asset_list"
+
+[[ "$asset_index" -gt 1 ]] \
+    || { printf 'canonical web payload must contain more than index.html\n' >&2; exit 1; }
+
+printf 'verified %s canonical web assets from %s\n' "$asset_index" "$base_url"
diff --git a/scripts/smoke-test-packed.ts b/scripts/smoke-test-packed.ts
deleted file mode 100644
index 4b87c603e..000000000
--- a/scripts/smoke-test-packed.ts
+++ /dev/null
@@ -1,233 +0,0 @@
-#!/usr/bin/env bun
-/**
- * Pack-and-import smoke test for the public `@executor-js/*` packages.
- *
- * Reproduces what an external npm consumer experiences:
- *
- *   1. Pack each publishable workspace via `publish-packages.ts
- *      --dry-run`, so `publishConfig.exports` and `workspace:*` rewrites
- *      are applied to the tarball.
- *   2. For each package, install the tarball into a fresh temp dir
- *      with npm `overrides` pointing every other `@executor-js/*`
- *      transitive dep at its local tarball — otherwise npm pulls the
- *      currently-published version from the registry, which masks any
- *      internal-API mismatch this branch introduced.
- *   3. Read the installed package.json (the post-`publishConfig` view)
- *      and dynamically `import()` every subpath in its `exports` map.
- *
- * Failures for `@executor-js/*` package not-found are hard failures —
- * that's the regression class where private workspace packages leak
- * into a public bundle. Failures for other peers (`react`, `effect`,
- * `@tanstack/*`, etc.) are downgraded to warnings, since they reflect
- * a missing peer in the smoke environment, not a bug in the bundle.
- *
- * Invoke via `bun run release:smoke:packages`.
- */
-import { $ } from "bun";
-import { existsSync, readdirSync } from "node:fs";
-import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { dirname, join, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-
-const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
-
-const PUBLIC_PACKAGE_DIRS = [
-  "packages/core/fumadb",
-  "packages/kernel/core",
-  "packages/kernel/runtime-quickjs",
-  "packages/core/sdk",
-  "packages/core/config",
-  "packages/core/execution",
-  "packages/core/cli",
-  "packages/plugins/example",
-  "packages/plugins/file-secrets",
-  "packages/plugins/graphql",
-  "packages/plugins/keychain",
-  "packages/plugins/mcp",
-  "packages/plugins/onepassword",
-  "packages/plugins/openapi",
-] as const;
-
-type PackageJson = {
-  name: string;
-  version: string;
-  exports?: Record<string, unknown>;
-};
-
-const readPackageJson = async (pkgDir: string): Promise<PackageJson> => {
-  const raw = await readFile(join(pkgDir, "package.json"), "utf8");
-  return JSON.parse(raw) as PackageJson;
-};
-
-const findTarball = (pkgDir: string): string | null => {
-  const tgz = readdirSync(pkgDir).find((entry) => entry.endsWith(".tgz"));
-  return tgz ? join(pkgDir, tgz) : null;
-};
-
-const subpathsToTest = (pkg: PackageJson): readonly string[] => Object.keys(pkg.exports ?? {});
-
-const importSpecifier = (pkgName: string, subpath: string): string =>
-  subpath === "." ? pkgName : `${pkgName}${subpath.slice(1)}`;
-
-type SmokeFailure = {
-  readonly pkg: string;
-  readonly subpath: string;
-  readonly reason: string;
-};
-
-const PRIVATE_PACKAGE_RE = /Cannot find package '(@executor-js\/[^']+)'/;
-
-const firstMeaningfulLine = (stderr: string): string => {
-  const lines = stderr
-    .split("\n")
-    .map((line) => line.trim())
-    .filter(Boolean);
-  const errorLine = lines.find((line) => /^(\w*Error|Cannot find)/i.test(line));
-  if (errorLine) return errorLine;
-  for (const line of lines) {
-    if (line.startsWith("node:")) continue;
-    if (line.startsWith("file://")) continue;
-    if (line.startsWith("at ")) continue;
-    if (line.startsWith("import ")) continue;
-    if (line.startsWith("throw ")) continue;
-    if (line === "^" || /^\^+$/.test(line)) continue;
-    return line;
-  }
-  return lines[0] ?? "(no stderr)";
-};
-
-type Tarballs = ReadonlyMap<string, string>;
-
-const smokeTestPackage = async (
-  pkgDir: string,
-  tarballs: Tarballs,
-  failures: SmokeFailure[],
-): Promise<void> => {
-  const pkg = await readPackageJson(pkgDir);
-  const tarballPath = tarballs.get(pkg.name);
-  if (!tarballPath) {
-    failures.push({ pkg: pkg.name, subpath: "", reason: "no tarball produced" });
-    return;
-  }
-
-  const tmp = await mkdtemp(join(tmpdir(), "executor-smoke-"));
-  try {
-    // npm `overrides` forces transitive `@executor-js/*` deps to resolve
-    // to their local tarball instead of whatever's published on npm.
-    // Without this, a plugin built against an unreleased symbol in
-    // `@executor-js/sdk` would silently install the published `sdk`
-    // and fail at import — a real bug, but not the bundle bug we're
-    // here to catch.
-    const overrides: Record<string, string> = {};
-    for (const [name, path] of tarballs) {
-      overrides[name] = `file:${path}`;
-    }
-    const fixture = {
-      name: "executor-smoke-fixture",
-      version: "0.0.0",
-      private: true,
-      type: "module",
-      dependencies: { [pkg.name]: `file:${tarballPath}` },
-      overrides,
-    };
-    await writeFile(join(tmp, "package.json"), `${JSON.stringify(fixture, null, 2)}\n`);
-
-    const install = await $`npm install --no-audit --no-fund --legacy-peer-deps`
-      .cwd(tmp)
-      .quiet()
-      .nothrow();
-    if (install.exitCode !== 0) {
-      failures.push({
-        pkg: pkg.name,
-        subpath: "<install>",
-        reason: install.stderr.toString().trim().split("\n").slice(-3).join("\n"),
-      });
-      return;
-    }
-
-    // Read the installed manifest — that's the real published view
-    // (publishConfig.exports applied, workspace specifiers resolved).
-    const installedPkg = await readPackageJson(join(tmp, "node_modules", ...pkg.name.split("/")));
-    const subpaths = subpathsToTest(installedPkg);
-    if (subpaths.length === 0) {
-      failures.push({
-        pkg: pkg.name,
-        subpath: "",
-        reason: "no exports declared in published manifest",
-      });
-      return;
-    }
-
-    for (const subpath of subpaths) {
-      const spec = importSpecifier(pkg.name, subpath);
-      const probe =
-        await $`node --input-type=module --eval ${`await import(${JSON.stringify(spec)});`}`
-          .cwd(tmp)
-          .quiet()
-          .nothrow();
-      if (probe.exitCode === 0) {
-        console.log(`  ok  ${spec}`);
-        continue;
-      }
-      const stderr = probe.stderr.toString();
-      const privateMatch = stderr.match(PRIVATE_PACKAGE_RE);
-      if (privateMatch) {
-        const offending = privateMatch[1];
-        failures.push({
-          pkg: pkg.name,
-          subpath,
-          reason: `published bundle imports private workspace package '${offending}'`,
-        });
-        console.log(`  FAIL ${spec} — references private '${offending}'`);
-        continue;
-      }
-      const peerMatch =
-        stderr.match(/Cannot find package '([^']+)'/) ??
-        stderr.match(/Cannot find module '([^']+)'/);
-      const detail = peerMatch ? `missing peer '${peerMatch[1]}'` : firstMeaningfulLine(stderr);
-      console.log(`  skip ${spec} — ${detail}`);
-    }
-  } finally {
-    await rm(tmp, { recursive: true, force: true });
-  }
-};
-
-const main = async () => {
-  console.log("[smoke] packing public packages via publish-packages.ts --dry-run");
-  await $`bun run scripts/publish-packages.ts --dry-run`.cwd(repoRoot);
-
-  const tarballs = new Map<string, string>();
-  for (const relDir of PUBLIC_PACKAGE_DIRS) {
-    const pkgDir = join(repoRoot, relDir);
-    if (!existsSync(pkgDir)) continue;
-    const pkg = await readPackageJson(pkgDir);
-    const tarball = findTarball(pkgDir);
-    if (tarball) tarballs.set(pkg.name, tarball);
-  }
-
-  const failures: SmokeFailure[] = [];
-  for (const relDir of PUBLIC_PACKAGE_DIRS) {
-    const pkgDir = join(repoRoot, relDir);
-    if (!existsSync(pkgDir)) {
-      failures.push({ pkg: relDir, subpath: "", reason: "missing dir" });
-      continue;
-    }
-    const pkg = await readPackageJson(pkgDir);
-    console.log(`[smoke] ${pkg.name}`);
-    await smokeTestPackage(pkgDir, tarballs, failures);
-  }
-
-  if (failures.length === 0) {
-    console.log("[smoke] all packages OK");
-    return;
-  }
-
-  console.error(`\n[smoke] ${failures.length} failure(s):`);
-  for (const f of failures) {
-    console.error(`  - ${f.pkg}${f.subpath ? ` (${f.subpath})` : ""}: ${f.reason}`);
-  }
-  process.exit(1);
-};
-
-await main();
diff --git a/scripts/test-bounded-log.sh b/scripts/test-bounded-log.sh
new file mode 100755
index 000000000..61a933060
--- /dev/null
+++ b/scripts/test-bounded-log.sh
@@ -0,0 +1,102 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+readonly SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)
+readonly REPOSITORY_ROOT=$(cd -- "${SCRIPT_DIR}/.." && pwd -P)
+readonly LOGGER="${REPOSITORY_ROOT}/packaging/launchd/bounded-log.sh"
+readonly MIB=$((1024 * 1024))
+
+test_root=$(mktemp -d)
+trap 'rm -rf -- "${test_root}"' EXIT
+test_number=0
+
+pass() {
+    test_number=$((test_number + 1))
+    printf 'ok %s - %s\n' "${test_number}" "$1"
+}
+
+fail() {
+    printf 'not ok %s - %s\n' "$((test_number + 1))" "$1" >&2
+    exit 1
+}
+
+file_mode() {
+    if stat -f '%Lp' "$1" >/dev/null 2>&1; then
+        stat -f '%Lp' "$1"
+    else
+        stat --format='%a' -- "$1"
+    fi
+}
+
+normal_log="${test_root}/normal.log"
+normal_expected="${test_root}/normal.expected"
+printf 'first line\nsecond line\nthird line without newline' > "$normal_expected"
+"$LOGGER" "$normal_log" < "$normal_expected"
+if ! cmp -s "$normal_expected" "$normal_log"; then
+    fail "normal line input was not preserved exactly"
+fi
+if [[ "$(file_mode "$normal_log")" != 600 ]]; then
+    fail "normal log does not have mode 0600"
+fi
+pass "normal lines and a final partial line are preserved"
+
+symlink_target="${test_root}/symlink-target"
+printf 'do not touch' > "$symlink_target"
+symlink_log="${test_root}/symlink.log"
+ln -s "$symlink_target" "$symlink_log"
+if "$LOGGER" "$symlink_log" < "$normal_expected" 2>/dev/null; then
+    fail "symbolic-link log path was accepted"
+fi
+if [[ "$(cat "$symlink_target")" != 'do not touch' ]]; then
+    fail "symbolic-link log target was changed"
+fi
+pass "symbolic-link log path is rejected without touching its target"
+
+large_input="${test_root}/large.input"
+segment_c="${test_root}/segment-C"
+segment_d="${test_root}/segment-D"
+segment_e="${test_root}/segment-E"
+segment_f="${test_root}/segment-F"
+: > "$large_input"
+for letter in A B C D E; do
+    segment="${test_root}/segment-${letter}"
+    dd if=/dev/zero bs="$MIB" count=1 2>/dev/null \
+        | tr '\000' "$letter" > "$segment"
+    cat "$segment" >> "$large_input"
+done
+dd if=/dev/zero bs=123 count=1 2>/dev/null \
+    | tr '\000' F > "$segment_f"
+cat "$segment_f" >> "$large_input"
+
+large_log="${test_root}/large.log"
+"$LOGGER" "$large_log" < "$large_input"
+if ! cmp -s "$segment_f" "$large_log"; then
+    fail "current log does not contain the final partial generation"
+fi
+if ! cmp -s "$segment_e" "${large_log}.1"; then
+    fail "first rotated generation is incorrect"
+fi
+if ! cmp -s "$segment_d" "${large_log}.2"; then
+    fail "second rotated generation is incorrect"
+fi
+if ! cmp -s "$segment_c" "${large_log}.3"; then
+    fail "third rotated generation is incorrect"
+fi
+if [[ -e "${large_log}.4" ]]; then
+    fail "logger retained more than three rotated generations"
+fi
+for retained_log in \
+    "$large_log" \
+    "${large_log}.1" \
+    "${large_log}.2" \
+    "${large_log}.3"; do
+    if [[ "$(wc -c < "$retained_log")" -gt "$MIB" ]]; then
+        fail "retained log exceeds 1 MiB: ${retained_log}"
+    fi
+    if [[ "$(file_mode "$retained_log")" != 600 ]]; then
+        fail "retained log does not have mode 0600: ${retained_log}"
+    fi
+done
+pass "large newline-free input stays within four secure bounded files"
+
+printf '1..%s\n' "$test_number"
diff --git a/scripts/test-install-launchd-safety.sh b/scripts/test-install-launchd-safety.sh
new file mode 100755
index 000000000..7aaa6af55
--- /dev/null
+++ b/scripts/test-install-launchd-safety.sh
@@ -0,0 +1,673 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+readonly REPOSITORY_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)"
+readonly INSTALLER="${REPOSITORY_ROOT}/scripts/install-launchd.sh"
+readonly TEST_ROOT="$(mktemp -d)"
+
+cleanup() {
+    rm -rf "$TEST_ROOT"
+}
+trap cleanup EXIT
+
+test_number=0
+run_case() {
+    local name=$1
+
+    CASE_ROOT="${TEST_ROOT}/${name}"
+    HOME_DIR="${CASE_ROOT}/home"
+    DATA_DIR="${HOME_DIR}/Library/Application Support/Executor"
+    PLIST_DIR="${HOME_DIR}/Library/LaunchAgents"
+    SERVICE_DIR="${HOME_DIR}/.executor/service"
+    STUB_DIR="${CASE_ROOT}/bin"
+    EXECUTOR_BINARY="${CASE_ROOT}/executor"
+    OUTPUT="${CASE_ROOT}/output"
+    mkdir -p "$DATA_DIR" "$PLIST_DIR" "$STUB_DIR"
+    printf '#!/bin/sh\nprintf "Darwin\\n"\n' > "${STUB_DIR}/uname"
+    chmod 0700 "${STUB_DIR}/uname"
+    printf '#!/bin/sh\nexit 0\n' > "$EXECUTOR_BINARY"
+    chmod 0700 "$EXECUTOR_BINARY"
+}
+
+expect_rejected() {
+    if HOME="$HOME_DIR" PATH="${STUB_DIR}:$PATH" \
+        bash "$INSTALLER" --binary "$EXECUTOR_BINARY" --no-start \
+        >"$OUTPUT" 2>&1; then
+        printf 'not ok %s - unsafe launchd destination was accepted\n' "$test_number"
+        cat "$OUTPUT"
+        exit 1
+    fi
+}
+
+private_file_metadata() {
+    if stat --version >/dev/null 2>&1; then
+        stat -c '%u|%a|%h' "$1"
+    else
+        stat -f '%u|%Lp|%l' "$1"
+    fi
+}
+
+test_number=$((test_number + 1))
+run_case dangling-template
+victim="${CASE_ROOT}/victim"
+ln -s "$victim" "${DATA_DIR}/mcp-stdio-templates.json"
+expect_rejected
+if [[ ! -e "$victim" && -L "${DATA_DIR}/mcp-stdio-templates.json" ]]; then
+    printf 'ok %s - dangling template symlink is rejected without creating its target\n' \
+        "$test_number"
+else
+    printf 'not ok %s - dangling template symlink changed its target\n' "$test_number"
+    exit 1
+fi
+
+test_number=$((test_number + 1))
+run_case wrapper-symlink
+victim="${CASE_ROOT}/victim-directory"
+mkdir "$victim"
+mkdir -p "$SERVICE_DIR"
+ln -s "$victim" "${SERVICE_DIR}/run-launchd.sh"
+expect_rejected
+if [[ -L "${SERVICE_DIR}/run-launchd.sh" \
+    && ! -e "${DATA_DIR}/mcp-stdio-templates.json" \
+    && -z "$(find "$victim" -mindepth 1 -print -quit)" ]]; then
+    printf 'ok %s - wrapper symlink-to-directory fails before managed writes\n' "$test_number"
+else
+    printf 'not ok %s - wrapper symlink redirected or allowed managed writes\n' "$test_number"
+    exit 1
+fi
+
+test_number=$((test_number + 1))
+run_case logger-directory
+mkdir -p "$SERVICE_DIR"
+mkdir "${SERVICE_DIR}/bounded-log.sh"
+expect_rejected
+if [[ -d "${SERVICE_DIR}/bounded-log.sh" \
+    && ! -e "${DATA_DIR}/mcp-stdio-templates.json" ]]; then
+    printf 'ok %s - nonregular logger destination fails before managed writes\n' "$test_number"
+else
+    printf 'not ok %s - nonregular logger destination was modified\n' "$test_number"
+    exit 1
+fi
+
+test_number=$((test_number + 1))
+run_case plist-symlink
+victim="${CASE_ROOT}/victim-directory"
+mkdir "$victim"
+ln -s "$victim" "${PLIST_DIR}/dev.executor.gateway.plist"
+expect_rejected
+if [[ -L "${PLIST_DIR}/dev.executor.gateway.plist" \
+    && ! -e "${DATA_DIR}/mcp-stdio-templates.json" \
+    && -z "$(find "$victim" -mindepth 1 -print -quit)" ]]; then
+    printf 'ok %s - plist symlink-to-directory fails before managed writes\n' "$test_number"
+else
+    printf 'not ok %s - plist symlink redirected or allowed managed writes\n' "$test_number"
+    exit 1
+fi
+
+test_number=$((test_number + 1))
+run_case manifest-publication-failure
+ledger="${CASE_ROOT}/launchctl-ledger"
+real_mktemp="$(command -v mktemp)"
+printf '#!/bin/sh\ncase "$1" in *\/.service-install.*) exit 1 ;; esac\nexec %s "$@"\n' \
+    "$real_mktemp" > "${STUB_DIR}/mktemp"
+printf '#!/bin/sh\nexit 0\n' > "${STUB_DIR}/plutil"
+printf '#!/bin/sh\nprintf "%%s\\n" "$*" >> %q\nexit 0\n' \
+    "$ledger" > "${STUB_DIR}/launchctl"
+chmod 0700 "${STUB_DIR}/mktemp" "${STUB_DIR}/plutil" "${STUB_DIR}/launchctl"
+if HOME="$HOME_DIR" PATH="${STUB_DIR}:$PATH" \
+    bash "$INSTALLER" --binary "$EXECUTOR_BINARY" >"$OUTPUT" 2>&1; then
+    printf 'not ok %s - manifest publication failure was accepted\n' "$test_number"
+    exit 1
+fi
+if [[ -f "${PLIST_DIR}/dev.executor.gateway.plist" \
+    && ! -e "${HOME_DIR}/.executor/service/service-install.manifest" \
+    && -f "${HOME_DIR}/.executor/service/service-install.recovery" \
+    && ! -s "$ledger" ]]; then
+    rm -f "${STUB_DIR}/mktemp"
+    HOME="$HOME_DIR" PATH="${STUB_DIR}:$PATH" \
+        bash "$INSTALLER" --binary "$EXECUTOR_BINARY" --no-start \
+        >>"$OUTPUT" 2>&1
+    if [[ -f "${HOME_DIR}/.executor/service/service-install.manifest" \
+        && ! -e "${HOME_DIR}/.executor/service/service-install.recovery" ]]; then
+        printf 'ok %s - manifest failure stays stopped and a clean rerun recovers\n' \
+            "$test_number"
+    else
+        printf 'not ok %s - rerun did not recover manifest publication\n' "$test_number"
+        cat "$OUTPUT"
+        exit 1
+    fi
+else
+    printf 'not ok %s - launchctl ran before the ownership manifest committed\n' "$test_number"
+    cat "$OUTPUT"
+    exit 1
+fi
+
+test_number=$((test_number + 1))
+run_case template-link-crash
+printf '#!/bin/sh\nexit 0\n' > "${STUB_DIR}/plutil"
+printf '#!/bin/sh\nexit 0\n' > "${STUB_DIR}/launchctl"
+chmod 0700 "${STUB_DIR}/plutil" "${STUB_DIR}/launchctl"
+template_path="${DATA_DIR}/.executor-templates.ABCDEFGH"
+if HOME="$HOME_DIR" PATH="${STUB_DIR}:$PATH" \
+    EXECUTOR_INSTALL_TEST_CRASH_AFTER_TEMPLATE_LINK=1 \
+    EXECUTOR_MCP_STDIO_TEMPLATES_FILE="$template_path" \
+    bash "$INSTALLER" --binary "$EXECUTOR_BINARY" --no-start \
+    >"$OUTPUT" 2>&1; then
+    printf 'not ok %s - template link crash injection reported success\n' "$test_number"
+    exit 1
+fi
+template_copy="${CASE_ROOT}/template.copy"
+cp "$template_path" "$template_copy"
+if [[ "$(private_file_metadata "$template_path")" != "$(id -u)|600|2" \
+    || ! -f "${SERVICE_DIR}/service-install.recovery" ]]; then
+    printf 'not ok %s - template link crash did not leave recoverable state\n' \
+        "$test_number"
+    exit 1
+fi
+HOME="$HOME_DIR" PATH="${STUB_DIR}:$PATH" \
+    EXECUTOR_MCP_STDIO_TEMPLATES_FILE="$template_path" \
+    bash "$INSTALLER" --binary "$EXECUTOR_BINARY" --no-start \
+    >>"$OUTPUT" 2>&1
+if cmp -s "$template_copy" "$template_path" \
+    && [[ "$(private_file_metadata "$template_path")" == "$(id -u)|600|1" \
+        && ! -e "${SERVICE_DIR}/service-install.recovery" ]] \
+    && [[ "$(find "$DATA_DIR" -maxdepth 1 -type f \
+        -name '.executor-templates.*' ! -path "$template_path" | wc -l)" -eq 0 ]]; then
+    printf 'ok %s - template basename crash recovers only the same-inode alias\n' \
+        "$test_number"
+else
+    printf 'not ok %s - template link crash recovery changed or stranded state\n' \
+        "$test_number"
+    cat "$OUTPUT"
+    exit 1
+fi
+
+test_number=$((test_number + 1))
+run_case template-unlink-crash
+printf '#!/bin/sh\nexit 0\n' > "${STUB_DIR}/plutil"
+printf '#!/bin/sh\nexit 0\n' > "${STUB_DIR}/launchctl"
+chmod 0700 "${STUB_DIR}/plutil" "${STUB_DIR}/launchctl"
+template_path="${DATA_DIR}/mcp-stdio-templates.json"
+if HOME="$HOME_DIR" PATH="${STUB_DIR}:$PATH" \
+    EXECUTOR_INSTALL_TEST_CRASH_AFTER_TEMPLATE_UNLINK=1 \
+    bash "$INSTALLER" --binary "$EXECUTOR_BINARY" --no-start \
+    >"$OUTPUT" 2>&1; then
+    printf 'not ok %s - template unlink crash injection reported success\n' "$test_number"
+    exit 1
+fi
+template_copy="${CASE_ROOT}/template.copy"
+cp "$template_path" "$template_copy"
+HOME="$HOME_DIR" PATH="${STUB_DIR}:$PATH" \
+    bash "$INSTALLER" --binary "$EXECUTOR_BINARY" --no-start \
+    >>"$OUTPUT" 2>&1
+if cmp -s "$template_copy" "$template_path" \
+    && [[ "$(private_file_metadata "$template_path")" == "$(id -u)|600|1" \
+        && ! -e "${SERVICE_DIR}/service-install.recovery" ]]; then
+    printf 'ok %s - template unlink crash resumes with the original file\n' \
+        "$test_number"
+else
+    printf 'not ok %s - template unlink crash did not resume safely\n' "$test_number"
+    cat "$OUTPUT"
+    exit 1
+fi
+
+test_number=$((test_number + 1))
+run_case template-alias-substitution
+printf '#!/bin/sh\nexit 0\n' > "${STUB_DIR}/plutil"
+printf '#!/bin/sh\nexit 0\n' > "${STUB_DIR}/launchctl"
+chmod 0700 "${STUB_DIR}/plutil" "${STUB_DIR}/launchctl"
+template_path="${DATA_DIR}/mcp-stdio-templates.json"
+if HOME="$HOME_DIR" PATH="${STUB_DIR}:$PATH" \
+    EXECUTOR_INSTALL_TEST_CRASH_AFTER_TEMPLATE_LINK=1 \
+    bash "$INSTALLER" --binary "$EXECUTOR_BINARY" --no-start \
+    >"$OUTPUT" 2>&1; then
+    printf 'not ok %s - template substitution crash injection reported success\n' \
+        "$test_number"
+    exit 1
+fi
+template_alias="$(compgen -G "${DATA_DIR}/.executor-templates.*")"
+unknown_alias="${CASE_ROOT}/unknown-template-alias"
+rm -f "$template_alias"
+ln "$template_path" "$unknown_alias"
+printf '{\n  "templates": []\n}\n' > "$template_alias"
+chmod 0600 "$template_alias"
+if HOME="$HOME_DIR" PATH="${STUB_DIR}:$PATH" \
+    bash "$INSTALLER" --binary "$EXECUTOR_BINARY" --no-start \
+    >>"$OUTPUT" 2>&1; then
+    printf 'not ok %s - substituted template recovery alias was accepted\n' \
+        "$test_number"
+    exit 1
+fi
+if [[ -f "$template_alias" && -f "$unknown_alias" \
+    && "$(private_file_metadata "$template_path")" == "$(id -u)|600|2" ]]; then
+    rm -f "$template_alias" "$unknown_alias"
+    HOME="$HOME_DIR" PATH="${STUB_DIR}:$PATH" \
+        bash "$INSTALLER" --binary "$EXECUTOR_BINARY" --no-start \
+        >>"$OUTPUT" 2>&1
+    printf 'ok %s - substituted and unknown template aliases remain rejected\n' \
+        "$test_number"
+else
+    printf 'not ok %s - failed template recovery mutated attacker state\n' \
+        "$test_number"
+    exit 1
+fi
+
+test_number=$((test_number + 1))
+run_case template-destination-basename
+template_path="${DATA_DIR}/.executor-templates.ABCDEFGH"
+unknown_alias="${CASE_ROOT}/unknown-template-alias"
+printf '{\n  "templates": []\n}\n' > "$template_path"
+chmod 0600 "$template_path"
+ln "$template_path" "$unknown_alias"
+template_copy="${CASE_ROOT}/template.copy"
+cp "$template_path" "$template_copy"
+if HOME="$HOME_DIR" PATH="${STUB_DIR}:$PATH" \
+    EXECUTOR_MCP_STDIO_TEMPLATES_FILE="$template_path" \
+    bash "$INSTALLER" --binary "$EXECUTOR_BINARY" --no-start \
+    >"$OUTPUT" 2>&1; then
+    printf 'not ok %s - destination basename was mistaken for a recovery alias\n' \
+        "$test_number"
+    exit 1
+fi
+if cmp -s "$template_copy" "$template_path" \
+    && [[ -f "$unknown_alias" \
+        && "$(private_file_metadata "$template_path")" == "$(id -u)|600|2" \
+        && ! -e "$SERVICE_DIR" ]]; then
+    printf 'ok %s - template destination basename never identifies itself as an alias\n' \
+        "$test_number"
+else
+    printf 'not ok %s - basename recovery changed the destination or unknown alias\n' \
+        "$test_number"
+    exit 1
+fi
+
+test_number=$((test_number + 1))
+for corruption in zero truncated; do
+    run_case "template-${corruption}-crash"
+    printf '#!/bin/sh\nexit 0\n' > "${STUB_DIR}/plutil"
+    printf '#!/bin/sh\nexit 0\n' > "${STUB_DIR}/launchctl"
+    chmod 0700 "${STUB_DIR}/plutil" "${STUB_DIR}/launchctl"
+    template_path="${DATA_DIR}/mcp-stdio-templates.json"
+    if HOME="$HOME_DIR" PATH="${STUB_DIR}:$PATH" \
+        EXECUTOR_INSTALL_TEST_CRASH_AFTER_TEMPLATE_LINK=1 \
+        bash "$INSTALLER" --binary "$EXECUTOR_BINARY" --no-start \
+        >"$OUTPUT" 2>&1; then
+        printf 'not ok %s - %s template crash injection reported success\n' \
+            "$test_number" "$corruption"
+        exit 1
+    fi
+    if [[ "$corruption" == zero ]]; then
+        : > "$template_path"
+    else
+        printf '{}' > "$template_path"
+    fi
+    template_copy="${CASE_ROOT}/template.copy"
+    cp "$template_path" "$template_copy"
+    if HOME="$HOME_DIR" PATH="${STUB_DIR}:$PATH" \
+        bash "$INSTALLER" --binary "$EXECUTOR_BINARY" --no-start \
+        >>"$OUTPUT" 2>&1; then
+        printf 'not ok %s - %s crash template was accepted during recovery\n' \
+            "$test_number" "$corruption"
+        exit 1
+    fi
+    if ! cmp -s "$template_copy" "$template_path" \
+        || [[ "$(private_file_metadata "$template_path")" != "$(id -u)|600|2" \
+            || ! -e "${SERVICE_DIR}/service-install.recovery" ]]; then
+        printf 'not ok %s - %s crash recovery mutated invalid template state\n' \
+            "$test_number" "$corruption"
+        exit 1
+    fi
+done
+printf 'ok %s - zero and truncated template crash states fail closed\n' "$test_number"
+
+test_number=$((test_number + 1))
+run_case persisted-configuration
+printf '#!/bin/sh\nexit 0\n' > "${STUB_DIR}/plutil"
+printf '#!/bin/sh\nexit 0\n' > "${STUB_DIR}/launchctl"
+chmod 0700 "${STUB_DIR}/plutil" "${STUB_DIR}/launchctl"
+custom_data="${HOME_DIR}/Custom Executor Data"
+custom_templates="${HOME_DIR}/Custom Templates/stdio templates.json"
+service_root="${HOME_DIR}/.executor/service"
+config="${service_root}/service-config"
+wrapper="${service_root}/run-launchd.sh"
+HOME="$HOME_DIR" PATH="${STUB_DIR}:$PATH" \
+    EXECUTOR_DATA_DIR="$custom_data" \
+    EXECUTOR_MCP_STDIO_TEMPLATES_FILE="$custom_templates" \
+    EXECUTOR_PUBLIC_ORIGIN="https://executor.example.test" \
+    EXECUTOR_TRUSTED_PROXIES="127.0.0.1/32,::1/128" \
+    bash "$INSTALLER" --binary "$EXECUTOR_BINARY" --no-start \
+    >"$OUTPUT" 2>&1
+config_metadata="$(private_file_metadata "$config")"
+escaped_custom_data="$(printf '%q' "$custom_data")"
+escaped_custom_templates="$(printf '%q' "$custom_templates")"
+if [[ "$config_metadata" != "$(id -u)|600|1" \
+    || ! -f "${service_root}/bounded-log.sh" \
+    || -e "${custom_data}/bounded-log.sh" \
+    || -e "${custom_data}/run-launchd.sh" ]] \
+    || ! grep -F -- "--data-dir ${escaped_custom_data}" "$wrapper" >/dev/null \
+    || ! grep -F -- "--mcp-stdio-templates ${escaped_custom_templates}" \
+        "$wrapper" >/dev/null; then
+    printf 'not ok %s - persisted configuration metadata is not private\n' \
+        "$test_number"
+    exit 1
+fi
+cp "$config" "${CASE_ROOT}/initial-config"
+cp "$wrapper" "${CASE_ROOT}/initial-wrapper"
+HOME="$HOME_DIR" PATH="${STUB_DIR}:$PATH" \
+    bash "$INSTALLER" --binary "$EXECUTOR_BINARY" --no-start \
+    >>"$OUTPUT" 2>&1
+if ! cmp -s "$config" "${CASE_ROOT}/initial-config" \
+    || ! cmp -s "$wrapper" "${CASE_ROOT}/initial-wrapper"; then
+    printf 'not ok %s - reinstall without overrides reset persisted settings\n' \
+        "$test_number"
+    cat "$OUTPUT"
+    exit 1
+fi
+initial_data_line="$(grep '^data_dir_hex=' "$config")"
+initial_templates_line="$(grep '^templates_file_hex=' "$config")"
+initial_proxies="$(grep '^trusted_proxy_hex=' "$config")"
+HOME="$HOME_DIR" PATH="${STUB_DIR}:$PATH" \
+    EXECUTOR_PUBLIC_ORIGIN="https://new.example.test" \
+    bash "$INSTALLER" --binary "$EXECUTOR_BINARY" --no-start \
+    >>"$OUTPUT" 2>&1
+if [[ "$(grep '^data_dir_hex=' "$config")" != "$initial_data_line" \
+    || "$(grep '^templates_file_hex=' "$config")" != "$initial_templates_line" \
+    || "$(grep '^trusted_proxy_hex=' "$config")" != "$initial_proxies" ]] \
+    || ! grep -F -- '--public-origin https://new.example.test' "$wrapper" >/dev/null; then
+    printf 'not ok %s - one-field override reset unrelated persisted settings\n' \
+        "$test_number"
+    cat "$OUTPUT"
+    exit 1
+fi
+HOME="$HOME_DIR" PATH="${STUB_DIR}:$PATH" \
+    EXECUTOR_PUBLIC_ORIGIN="" EXECUTOR_TRUSTED_PROXIES="" \
+    bash "$INSTALLER" --binary "$EXECUTOR_BINARY" --no-start \
+    >>"$OUTPUT" 2>&1
+if [[ "$(grep '^data_dir_hex=' "$config")" == "$initial_data_line" \
+    && "$(grep '^templates_file_hex=' "$config")" == "$initial_templates_line" \
+    && -z "$(grep '^trusted_proxy_hex=' "$config" || true)" ]] \
+    && ! grep -F -- '--public-origin' "$wrapper" >/dev/null \
+    && ! grep -F -- '--trusted-proxy' "$wrapper" >/dev/null; then
+    printf 'ok %s - reinstall preserves settings and explicit empty overrides clear them\n' \
+        "$test_number"
+else
+    printf 'not ok %s - explicit empty overrides did not clear persisted settings\n' \
+        "$test_number"
+    cat "$OUTPUT"
+    exit 1
+fi
+
+test_number=$((test_number + 1))
+run_case unsafe-config-symlink
+victim="${CASE_ROOT}/config-victim"
+mkdir -p "${HOME_DIR}/.executor/service"
+printf 'keep me\n' > "$victim"
+ln -s "$victim" "${HOME_DIR}/.executor/service/service-config"
+expect_rejected
+if [[ "$(cat "$victim")" == "keep me" \
+    && -L "${HOME_DIR}/.executor/service/service-config" \
+    && ! -e "${DATA_DIR}/mcp-stdio-templates.json" ]]; then
+    printf 'ok %s - persisted configuration symlinks are rejected before managed writes\n' \
+        "$test_number"
+else
+    printf 'not ok %s - unsafe persisted configuration was modified\n' "$test_number"
+    exit 1
+fi
+
+test_number=$((test_number + 1))
+run_case unsafe-custom-ancestor
+unsafe_parent="${HOME_DIR}/unsafe-parent"
+mkdir "$unsafe_parent"
+chmod 0777 "$unsafe_parent"
+if HOME="$HOME_DIR" PATH="${STUB_DIR}:$PATH" \
+    EXECUTOR_DATA_DIR="${unsafe_parent}/data" \
+    bash "$INSTALLER" --binary "$EXECUTOR_BINARY" --no-start \
+    >"$OUTPUT" 2>&1; then
+    printf 'not ok %s - world-writable custom data ancestry was accepted\n' \
+        "$test_number"
+    exit 1
+fi
+if [[ ! -e "${unsafe_parent}/data" \
+    && ! -e "${HOME_DIR}/.executor/service/service-config" \
+    && ! -e "${HOME_DIR}/.executor/service/service-install.recovery" ]]; then
+    printf 'ok %s - unsafe custom data ancestry fails before managed writes\n' \
+        "$test_number"
+else
+    printf 'not ok %s - unsafe custom data ancestry allowed managed writes\n' \
+        "$test_number"
+    exit 1
+fi
+
+test_number=$((test_number + 1))
+run_case symlinked-custom-ancestor
+victim="${CASE_ROOT}/custom-data-victim"
+mkdir "$victim"
+ln -s "$victim" "${HOME_DIR}/custom-data-link"
+if HOME="$HOME_DIR" PATH="${STUB_DIR}:$PATH" \
+    EXECUTOR_DATA_DIR="${HOME_DIR}/custom-data-link/data" \
+    bash "$INSTALLER" --binary "$EXECUTOR_BINARY" --no-start \
+    >"$OUTPUT" 2>&1; then
+    printf 'not ok %s - symlinked custom data ancestry was accepted\n' \
+        "$test_number"
+    exit 1
+fi
+if [[ -L "${HOME_DIR}/custom-data-link" \
+    && -z "$(find "$victim" -mindepth 1 -print -quit)" \
+    && ! -e "${HOME_DIR}/.executor/service/service-config" ]]; then
+    printf 'ok %s - symlinked custom data ancestry cannot redirect writes\n' \
+        "$test_number"
+else
+    printf 'not ok %s - symlinked custom data ancestry redirected writes\n' \
+        "$test_number"
+    exit 1
+fi
+
+test_number=$((test_number + 1))
+run_case unsafe-template-ancestor
+unsafe_parent="${HOME_DIR}/unsafe-templates"
+mkdir "$unsafe_parent"
+chmod 0777 "$unsafe_parent"
+if HOME="$HOME_DIR" PATH="${STUB_DIR}:$PATH" \
+    EXECUTOR_MCP_STDIO_TEMPLATES_FILE="${unsafe_parent}/templates.json" \
+    bash "$INSTALLER" --binary "$EXECUTOR_BINARY" --no-start \
+    >"$OUTPUT" 2>&1; then
+    printf 'not ok %s - world-writable template ancestry was accepted\n' \
+        "$test_number"
+    exit 1
+fi
+if [[ ! -e "${unsafe_parent}/templates.json" \
+    && ! -e "${HOME_DIR}/.executor/service/service-config" \
+    && ! -e "${HOME_DIR}/.executor/service/service-install.recovery" ]]; then
+    printf 'ok %s - unsafe template ancestry fails before managed writes\n' \
+        "$test_number"
+else
+    printf 'not ok %s - unsafe template ancestry allowed managed writes\n' \
+        "$test_number"
+    exit 1
+fi
+
+test_number=$((test_number + 1))
+run_case relative-custom-path
+if HOME="$HOME_DIR" PATH="${STUB_DIR}:$PATH" EXECUTOR_DATA_DIR="relative-data" \
+    bash "$INSTALLER" --binary "$EXECUTOR_BINARY" --no-start \
+    >"$OUTPUT" 2>&1; then
+    printf 'not ok %s - relative custom data path was accepted\n' "$test_number"
+    exit 1
+fi
+if [[ ! -e "${HOME_DIR}/.executor/service/service-config" \
+    && ! -e "${HOME_DIR}/.executor/service/service-install.recovery" ]]; then
+    printf 'ok %s - relative custom paths fail before managed writes\n' "$test_number"
+else
+    printf 'not ok %s - relative custom path allowed managed writes\n' "$test_number"
+    exit 1
+fi
+
+test_number=$((test_number + 1))
+collision_case_number=0
+for collision_name in \
+    service-binary \
+    service-config \
+    manifest \
+    recovery \
+    wrapper \
+    logger \
+    plist \
+    data-directory \
+    master-key \
+    database \
+    database-journal \
+    private-log \
+    rotated-log \
+    case-folded-master-key \
+    nested-service-path; do
+    collision_case_number=$((collision_case_number + 1))
+    run_case "reserved-collision-${collision_case_number}"
+    case "$collision_name" in
+        service-binary) collision_path="${SERVICE_DIR}/bin/executor" ;;
+        service-config) collision_path="${SERVICE_DIR}/service-config" ;;
+        manifest) collision_path="${SERVICE_DIR}/service-install.manifest" ;;
+        recovery) collision_path="${SERVICE_DIR}/service-install.recovery" ;;
+        wrapper) collision_path="${SERVICE_DIR}/run-launchd.sh" ;;
+        logger) collision_path="${SERVICE_DIR}/bounded-log.sh" ;;
+        plist) collision_path="${PLIST_DIR}/dev.executor.gateway.plist" ;;
+        data-directory) collision_path="$DATA_DIR" ;;
+        master-key)
+            collision_path="${DATA_DIR}/master.key"
+            printf 'existing master key sentinel\n' > "$collision_path"
+            chmod 0600 "$collision_path"
+            ;;
+        database) collision_path="${DATA_DIR}/executor.db" ;;
+        database-journal) collision_path="${DATA_DIR}/executor.db-journal" ;;
+        private-log) collision_path="${DATA_DIR}/executor.log" ;;
+        rotated-log) collision_path="${DATA_DIR}/executor.log.2" ;;
+        case-folded-master-key) collision_path="${DATA_DIR}/MASTER.KEY" ;;
+        nested-service-path) collision_path="${SERVICE_DIR}/custom/templates.json" ;;
+        *) exit 1 ;;
+    esac
+    if HOME="$HOME_DIR" PATH="${STUB_DIR}:$PATH" \
+        EXECUTOR_MCP_STDIO_TEMPLATES_FILE="$collision_path" \
+        bash "$INSTALLER" --binary "$EXECUTOR_BINARY" --no-start \
+        >"$OUTPUT" 2>&1; then
+        printf 'not ok %s - reserved template collision %s was accepted\n' \
+            "$test_number" "$collision_name"
+        exit 1
+    fi
+    if [[ -e "$SERVICE_DIR" \
+        || -e "${PLIST_DIR}/dev.executor.gateway.plist" \
+        || -e "${DATA_DIR}/mcp-stdio-templates.json" ]]; then
+        printf 'not ok %s - collision %s wrote managed files before rejection\n' \
+            "$test_number" "$collision_name"
+        cat "$OUTPUT"
+        exit 1
+    fi
+    if [[ "$collision_name" == master-key \
+        && "$(cat "$collision_path")" != "existing master key sentinel" ]]; then
+        printf 'not ok %s - master key collision changed the existing sentinel\n' \
+            "$test_number"
+        exit 1
+    fi
+done
+printf 'ok %s - template collisions with every reserved path fail before writes\n' \
+    "$test_number"
+
+test_number=$((test_number + 1))
+for collision_name in case-folded-service-root plist-parent; do
+    run_case "data-collision-${collision_name}"
+    case "$collision_name" in
+        case-folded-service-root) collision_path="${HOME_DIR}/.EXECUTOR" ;;
+        plist-parent) collision_path="$PLIST_DIR" ;;
+        *) exit 1 ;;
+    esac
+    if HOME="$HOME_DIR" PATH="${STUB_DIR}:$PATH" \
+        EXECUTOR_DATA_DIR="$collision_path" \
+        bash "$INSTALLER" --binary "$EXECUTOR_BINARY" --no-start \
+        >"$OUTPUT" 2>&1; then
+        printf 'not ok %s - data collision %s was accepted\n' \
+            "$test_number" "$collision_name"
+        exit 1
+    fi
+    if [[ -e "$SERVICE_DIR" \
+        || -e "${PLIST_DIR}/dev.executor.gateway.plist" ]]; then
+        printf 'not ok %s - data collision %s wrote managed files\n' \
+            "$test_number" "$collision_name"
+        exit 1
+    fi
+done
+printf 'ok %s - data paths cannot contain service-owned paths\n' "$test_number"
+
+test_number=$((test_number + 1))
+run_case collision-reinstall-preservation
+printf '#!/bin/sh\nexit 0\n' > "${STUB_DIR}/plutil"
+printf '#!/bin/sh\nexit 0\n' > "${STUB_DIR}/launchctl"
+chmod 0700 "${STUB_DIR}/plutil" "${STUB_DIR}/launchctl"
+HOME="$HOME_DIR" PATH="${STUB_DIR}:$PATH" \
+    bash "$INSTALLER" --binary "$EXECUTOR_BINARY" --no-start \
+    >"$OUTPUT" 2>&1
+snapshot="${CASE_ROOT}/snapshot"
+mkdir "$snapshot"
+cp "${SERVICE_DIR}/service-config" "${snapshot}/service-config"
+cp "${SERVICE_DIR}/service-install.manifest" "${snapshot}/service-install.manifest"
+cp "${SERVICE_DIR}/run-launchd.sh" "${snapshot}/run-launchd.sh"
+cp "${SERVICE_DIR}/bounded-log.sh" "${snapshot}/bounded-log.sh"
+cp "${PLIST_DIR}/dev.executor.gateway.plist" "${snapshot}/launchd.plist"
+cp "${DATA_DIR}/mcp-stdio-templates.json" "${snapshot}/templates.json"
+if HOME="$HOME_DIR" PATH="${STUB_DIR}:$PATH" \
+    EXECUTOR_MCP_STDIO_TEMPLATES_FILE="${SERVICE_DIR}/service-config" \
+    bash "$INSTALLER" --binary "$EXECUTOR_BINARY" --no-start \
+    >>"$OUTPUT" 2>&1; then
+    printf 'not ok %s - colliding reinstall was accepted\n' "$test_number"
+    exit 1
+fi
+if cmp -s "${SERVICE_DIR}/service-config" "${snapshot}/service-config" \
+    && cmp -s "${SERVICE_DIR}/service-install.manifest" \
+        "${snapshot}/service-install.manifest" \
+    && cmp -s "${SERVICE_DIR}/run-launchd.sh" "${snapshot}/run-launchd.sh" \
+    && cmp -s "${SERVICE_DIR}/bounded-log.sh" "${snapshot}/bounded-log.sh" \
+    && cmp -s "${PLIST_DIR}/dev.executor.gateway.plist" "${snapshot}/launchd.plist" \
+    && cmp -s "${DATA_DIR}/mcp-stdio-templates.json" "${snapshot}/templates.json" \
+    && [[ ! -e "${SERVICE_DIR}/service-install.recovery" ]]; then
+    printf 'ok %s - rejected collision preserves an existing installation byte-for-byte\n' \
+        "$test_number"
+else
+    printf 'not ok %s - rejected collision changed an existing installation\n' \
+        "$test_number"
+    exit 1
+fi
+
+test_number=$((test_number + 1))
+run_case unsafe-config-hardlink
+victim="${CASE_ROOT}/config-victim"
+mkdir -p "${HOME_DIR}/.executor/service"
+printf 'keep me\n' > "$victim"
+chmod 0600 "$victim"
+ln "$victim" "${HOME_DIR}/.executor/service/service-config"
+expect_rejected
+if [[ "$(cat "$victim")" == "keep me" \
+    && "$(private_file_metadata "$victim")" == "$(id -u)|600|2" \
+    && ! -e "${DATA_DIR}/mcp-stdio-templates.json" ]]; then
+    printf 'ok %s - hard-linked persisted configuration is rejected without mutation\n' \
+        "$test_number"
+else
+    printf 'not ok %s - hard-linked persisted configuration was modified\n' \
+        "$test_number"
+    exit 1
+fi
+
+test_number=$((test_number + 1))
+run_case malformed-config
+mkdir -p "${HOME_DIR}/.executor/service"
+printf 'executor-launchd-config-v1\nunknown_hex=00\n' \
+    > "${HOME_DIR}/.executor/service/service-config"
+chmod 0600 "${HOME_DIR}/.executor/service/service-config"
+expect_rejected
+if [[ ! -e "${DATA_DIR}/mcp-stdio-templates.json" \
+    && ! -e "${HOME_DIR}/.executor/service/service-install.recovery" ]]; then
+    printf 'ok %s - malformed persisted configuration fails before managed writes\n' \
+        "$test_number"
+else
+    printf 'not ok %s - malformed persisted configuration allowed managed writes\n' \
+        "$test_number"
+    exit 1
+fi
+
+printf '1..%s\n' "$test_number"
diff --git a/scripts/test-install-release-archive.sh b/scripts/test-install-release-archive.sh
new file mode 100755
index 000000000..5835acf50
--- /dev/null
+++ b/scripts/test-install-release-archive.sh
@@ -0,0 +1,1142 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)"
+fixture="$(mktemp -d "${HOME}/.executor-release-fixture.XXXXXXXX")"
+trap 'rm -rf "$fixture"' EXIT
+
+event_line() {
+    local log=$1 event=$2
+    awk -v expected="$event" '
+        $0 == expected { line = NR }
+        END { if (line == 0) exit 1; print line }
+    ' "$log"
+}
+
+assert_event_before() {
+    local log=$1 first=$2 second=$3 first_line second_line
+    first_line="$(event_line "$log" "$first")" \
+        || { printf 'missing durability event: %s\n' "$first" >&2; exit 1; }
+    second_line="$(event_line "$log" "$second")" \
+        || { printf 'missing durability event: %s\n' "$second" >&2; exit 1; }
+    if [[ "$first_line" -ge "$second_line" ]]; then
+        printf 'durability event %s did not precede %s\n' "$first" "$second" >&2
+        exit 1
+    fi
+}
+
+wait_for_file() {
+    local path=$1 process=$2 attempt
+    for attempt in {1..100}; do
+        [[ -e "$path" ]] && return 0
+        if ! kill -0 "$process" 2>/dev/null; then
+            printf 'process %s exited before creating %s\n' "$process" "$path" >&2
+            return 1
+        fi
+        sleep 0.1
+    done
+    printf 'timed out waiting for %s\n' "$path" >&2
+    return 1
+}
+
+default_help="$(env -u EXECUTOR_REPOSITORY "${repo_root}/scripts/install.sh" --help)"
+[[ "$default_help" == *"raw.githubusercontent.com/davis7dotsh/executor-fork-testing/"* ]]
+override_help="$(EXECUTOR_REPOSITORY=owner/repository "${repo_root}/scripts/install.sh" --help)"
+[[ "$override_help" == *"raw.githubusercontent.com/owner/repository/"* ]]
+
+stage="${fixture}/stage"
+mkdir "$stage"
+printf '#!/bin/sh\nexit 0\n' > "${stage}/executor"
+chmod 0755 "${stage}/executor"
+printf 'MIT fixture\n' > "${stage}/LICENSE"
+printf '<html>Rust license fixture</html>\n' > "${stage}/THIRD_PARTY_LICENSES.html"
+printf '[{"name":"Svelte","identifier":"MIT","text":"fixture"}]\n' \
+    > "${stage}/THIRD_PARTY_JAVASCRIPT_LICENSES.json"
+
+archive="${fixture}/executor-fixture.tar.gz"
+archive_retry="${fixture}/executor-fixture-retry.tar.gz"
+"${repo_root}/scripts/package-release-archive.py" \
+    --source "$stage" \
+    --output "$archive" \
+    --epoch 1700000000
+touch "${stage}"/*
+"${repo_root}/scripts/package-release-archive.py" \
+    --source "$stage" \
+    --output "$archive_retry" \
+    --epoch 1700000000
+cmp "$archive" "$archive_retry"
+if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum "$archive" > "${archive}.sha256"
+else
+    shasum -a 256 "$archive" > "${archive}.sha256"
+fi
+if command -v shasum >/dev/null 2>&1; then
+    shasum -a 256 --check "${archive}.sha256" >/dev/null
+fi
+
+failure_tools="${fixture}/failure-tools"
+mkdir "$failure_tools"
+printf '%s\n' \
+    '#!/bin/sh' \
+    'last_argument=' \
+    'for argument in "$@"; do last_argument=$argument; done' \
+    'if [ -n "${EXECUTOR_INSTALL_TEST_FAIL_REAL_MV_PATH:-}" ] && [ "$last_argument" = "$EXECUTOR_INSTALL_TEST_FAIL_REAL_MV_PATH" ]; then exit 73; fi' \
+    'exec "$EXECUTOR_INSTALL_TEST_REAL_MV" "$@"' \
+    > "${failure_tools}/mv"
+printf '%s\n' \
+    '#!/bin/sh' \
+    'last_argument=' \
+    'for argument in "$@"; do last_argument=$argument; done' \
+    'if [ -n "${EXECUTOR_INSTALL_TEST_FAIL_REAL_RM_PATH:-}" ] && [ "$last_argument" = "$EXECUTOR_INSTALL_TEST_FAIL_REAL_RM_PATH" ]; then exit 74; fi' \
+    'exec "$EXECUTOR_INSTALL_TEST_REAL_RM" "$@"' \
+    > "${failure_tools}/rm"
+printf '%s\n' \
+    '#!/bin/sh' \
+    'if [ "${EXECUTOR_INSTALL_SYNC_LABEL:-}" = "${EXECUTOR_INSTALL_TEST_FAIL_REAL_SYNC_LABEL:-}" ]; then exit 75; fi' \
+    'exec "$EXECUTOR_INSTALL_TEST_REAL_SYNC" "$@"' \
+    > "${failure_tools}/sync"
+chmod 0755 "${failure_tools}/mv" "${failure_tools}/rm" "${failure_tools}/sync"
+real_mv="$(type -P mv)"
+real_rm="$(type -P rm)"
+real_sync="$(type -P sync)"
+
+install_dir="${fixture}/installed"
+install_durability_log="${fixture}/install-durability.log"
+EXECUTOR_INSTALL_DIR="$install_dir" \
+    EXECUTOR_INSTALL_TEST_DURABILITY_LOG="$install_durability_log" \
+    "${repo_root}/scripts/install.sh" \
+    --archive "$archive" \
+    --no-modify-path >/dev/null
+
+for installed in \
+    executor \
+    LICENSE \
+    THIRD_PARTY_LICENSES.html \
+    THIRD_PARTY_JAVASCRIPT_LICENSES.json; do
+    [[ -s "${install_dir}/${installed}" ]]
+done
+[[ -x "${install_dir}/executor" ]]
+assert_event_before \
+    "$install_durability_log" \
+    'recovery-durable:executor' \
+    'managed-file-durable:executor'
+assert_event_before \
+    "$install_durability_log" \
+    'managed-file-durable:executor' \
+    'manifest-durable:executor'
+assert_event_before \
+    "$install_durability_log" \
+    'manifest-durable:executor' \
+    'recovery-retired:executor'
+EXECUTOR_INSTALL_DIR="$install_dir" \
+    EXECUTOR_INSTALL_TEST_DURABILITY_LOG="$install_durability_log" \
+    "${repo_root}/scripts/install.sh" \
+    --uninstall \
+    --no-modify-path >/dev/null
+assert_event_before \
+    "$install_durability_log" \
+    'uninstall-file-durable:executor' \
+    'uninstall-manifest-durable'
+
+no_python_tools="${fixture}/no-python-tools"
+no_python_home="${fixture}/no-python-home"
+mkdir "$no_python_tools" "$no_python_home"
+no_python_commands=(
+    awk
+    bash
+    basename
+    cat
+    chmod
+    cksum
+    cp
+    dirname
+    gzip
+    ln
+    mkdir
+    mktemp
+    mv
+    ps
+    rm
+    sleep
+    stat
+    sync
+    sysctl
+    tail
+    tar
+    uname
+    wc
+)
+if command -v sha256sum >/dev/null 2>&1; then
+    no_python_commands+=(sha256sum)
+else
+    no_python_commands+=(shasum)
+fi
+for command_name in "${no_python_commands[@]}"; do
+    command_path="$(command -v "$command_name")"
+    ln -s "$command_path" "${no_python_tools}/${command_name}"
+done
+printf '# no Python fixture\n' > "${no_python_home}/.bashrc"
+PATH="$no_python_tools" \
+    HOME="$no_python_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    "${repo_root}/scripts/install.sh" \
+    --archive "$archive" > "${fixture}/no-python-install.log"
+[[ -x "${no_python_home}/.executor/bin/executor" ]]
+[[ -s "${no_python_home}/.executor/bin/.executor-path-ownership" ]]
+no_python_path_command="export PATH=${no_python_home}/.executor/bin:\$PATH"
+grep -Fqx '# Executor' "${no_python_home}/.bashrc"
+grep -Fqx "$no_python_path_command" "${no_python_home}/.bashrc"
+if grep -F 'Add this to' "${fixture}/no-python-install.log" >/dev/null; then
+    printf 'Python-free installer fell back to a manual PATH edit\n' >&2
+    exit 1
+fi
+PATH="$no_python_tools" \
+    HOME="$no_python_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    "${repo_root}/scripts/install.sh" \
+    --uninstall >/dev/null
+if grep -Fqx '# Executor' "${no_python_home}/.bashrc"; then
+    printf 'Python-free uninstall left its PATH marker behind\n' >&2
+    exit 1
+fi
+
+real_failure_home="${fixture}/real-failure-home"
+real_failure_config="${real_failure_home}/.bashrc"
+mkdir "$real_failure_home"
+printf '# real failure fixture\n' > "$real_failure_config"
+cp "$real_failure_config" "${fixture}/real-failure-config-before"
+if HOME="$real_failure_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    EXECUTOR_INSTALL_TEST_FAIL_REAL_CONFIG_WRITE=1 \
+    "${repo_root}/scripts/install.sh" \
+    --archive "$archive" > "${fixture}/real-write-failure.log" 2>&1; then
+    printf 'installer ignored a real shell-config write failure\n' >&2
+    exit 1
+fi
+cmp "$real_failure_config" "${fixture}/real-failure-config-before"
+[[ -x "${real_failure_home}/.executor/bin/executor" ]]
+[[ -s "${real_failure_home}/.executor/bin/.executor-install-manifest" ]]
+[[ -s "${real_failure_home}/.executor/bin/.executor-path-ownership" ]]
+[[ ! -e "${real_failure_config}.executor-edit-lock" ]]
+HOME="$real_failure_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    "${repo_root}/scripts/install.sh" \
+    --archive "$archive" >/dev/null
+cp "$real_failure_config" "${fixture}/real-failure-config-with-path"
+if PATH="${failure_tools}:$PATH" \
+    HOME="$real_failure_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    EXECUTOR_INSTALL_TEST_FAIL_REAL_MV_PATH="$real_failure_config" \
+    EXECUTOR_INSTALL_TEST_REAL_MV="$real_mv" \
+    EXECUTOR_INSTALL_TEST_REAL_RM="$real_rm" \
+    EXECUTOR_INSTALL_TEST_REAL_SYNC="$real_sync" \
+    "${repo_root}/scripts/install.sh" \
+    --uninstall > "${fixture}/real-move-failure.log" 2>&1; then
+    printf 'uninstaller ignored a real shell-config move failure\n' >&2
+    exit 1
+fi
+cmp "$real_failure_config" "${fixture}/real-failure-config-with-path"
+[[ -x "${real_failure_home}/.executor/bin/executor" ]]
+[[ -s "${real_failure_home}/.executor/bin/.executor-install-manifest" ]]
+[[ ! -e "${real_failure_config}.executor-edit-lock" ]]
+if PATH="${failure_tools}:$PATH" \
+    HOME="$real_failure_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    EXECUTOR_INSTALL_TEST_FAIL_REAL_RM_PATH="${real_failure_config}.executor-edit-lock" \
+    EXECUTOR_INSTALL_TEST_REAL_MV="$real_mv" \
+    EXECUTOR_INSTALL_TEST_REAL_RM="$real_rm" \
+    EXECUTOR_INSTALL_TEST_REAL_SYNC="$real_sync" \
+    "${repo_root}/scripts/install.sh" \
+    --uninstall > "${fixture}/real-unlink-failure.log" 2>&1; then
+    printf 'uninstaller ignored a real shell-config lock unlink failure\n' >&2
+    exit 1
+fi
+[[ -x "${real_failure_home}/.executor/bin/executor" ]]
+[[ -s "${real_failure_home}/.executor/bin/.executor-install-manifest" ]]
+[[ -s "${real_failure_config}.executor-edit-lock" ]]
+if grep -Fqx '# Executor' "$real_failure_config"; then
+    printf 'real unlink failure did not reach the config-lock release boundary\n' >&2
+    exit 1
+fi
+HOME="$real_failure_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    "${repo_root}/scripts/install.sh" \
+    --uninstall >/dev/null
+[[ ! -e "${real_failure_config}.executor-edit-lock" ]]
+
+real_sync_home="${fixture}/real-sync-home"
+mkdir "$real_sync_home"
+if PATH="${failure_tools}:$PATH" \
+    HOME="$real_sync_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    EXECUTOR_INSTALL_TEST_FAIL_REAL_SYNC_LABEL='manifest-durable:executor' \
+    EXECUTOR_INSTALL_TEST_REAL_MV="$real_mv" \
+    EXECUTOR_INSTALL_TEST_REAL_RM="$real_rm" \
+    EXECUTOR_INSTALL_TEST_REAL_SYNC="$real_sync" \
+    "${repo_root}/scripts/install.sh" \
+    --archive "$archive" \
+    --no-modify-path > "${fixture}/real-sync-failure.log" 2>&1; then
+    printf 'installer ignored a real durability sync failure\n' >&2
+    exit 1
+fi
+[[ -d "${real_sync_home}/.executor/bin/.executor-install-recovery" ]]
+[[ -s "${real_sync_home}/.executor/bin/.executor-install-manifest" ]]
+HOME="$real_sync_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    "${repo_root}/scripts/install.sh" \
+    --archive "$archive" \
+    --no-modify-path >/dev/null
+[[ ! -e "${real_sync_home}/.executor/bin/.executor-install-recovery" ]]
+HOME="$real_sync_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    "${repo_root}/scripts/install.sh" \
+    --uninstall \
+    --no-modify-path >/dev/null
+
+printf 'unexpected\n' > "${stage}/extra"
+invalid_archive="${fixture}/invalid.tar.gz"
+tar -C "$stage" -czf "$invalid_archive" \
+    executor LICENSE THIRD_PARTY_LICENSES.html \
+    THIRD_PARTY_JAVASCRIPT_LICENSES.json extra
+if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum "$invalid_archive" > "${invalid_archive}.sha256"
+else
+    shasum -a 256 "$invalid_archive" > "${invalid_archive}.sha256"
+fi
+
+if EXECUTOR_INSTALL_DIR="${fixture}/rejected" \
+    "${repo_root}/scripts/install.sh" \
+    --archive "$invalid_archive" \
+    --no-modify-path >/dev/null 2>&1; then
+    printf 'installer accepted an archive with an unexpected member\n' >&2
+    exit 1
+fi
+
+unsafe_tmp="${fixture}/unsafe-tmp"
+mkdir "$unsafe_tmp"
+chmod 1777 "$unsafe_tmp"
+if TMPDIR="$unsafe_tmp" \
+    EXECUTOR_INSTALL_DIR="${fixture}/unsafe-tmp-install" \
+    "${repo_root}/scripts/install.sh" \
+    --archive "$archive" \
+    --no-modify-path >/dev/null 2>&1; then
+    printf 'installer accepted a current-user-owned world-writable TMPDIR\n' >&2
+    exit 1
+fi
+[[ ! -e "${fixture}/unsafe-tmp-install/executor" ]]
+
+canonical_tmp="${fixture}/canonical-tmp"
+canonical_tmp_alias="${fixture}/canonical-tmp-alias"
+canonical_tmp_install="${fixture}/canonical-tmp-install"
+mkdir "$canonical_tmp"
+chmod 0700 "$canonical_tmp"
+ln -s "$canonical_tmp" "$canonical_tmp_alias"
+TMPDIR="$canonical_tmp_alias" \
+    EXECUTOR_INSTALL_DIR="$canonical_tmp_install" \
+    "${repo_root}/scripts/install.sh" \
+    --archive "$archive" \
+    --no-modify-path >/dev/null
+[[ -x "${canonical_tmp_install}/executor" ]]
+EXECUTOR_INSTALL_DIR="$canonical_tmp_install" \
+    "${repo_root}/scripts/install.sh" \
+    --uninstall \
+    --no-modify-path >/dev/null
+
+swap_tmp="${fixture}/swap-tmp"
+mkdir "$swap_tmp"
+chmod 0700 "$swap_tmp"
+if TMPDIR="$swap_tmp" \
+    EXECUTOR_INSTALL_DIR="${fixture}/swapped-tmp-install" \
+    EXECUTOR_INSTALL_TEST_SWAP_TEMP_DIRECTORY=1 \
+    "${repo_root}/scripts/install.sh" \
+    --archive "$archive" \
+    --no-modify-path >/dev/null 2>&1; then
+    printf 'installer accepted a replaced private temporary directory\n' >&2
+    exit 1
+fi
+[[ ! -e "${fixture}/swapped-tmp-install/executor" ]]
+
+staged_source_tmp="${fixture}/staged-source-tmp"
+staged_source_install="${fixture}/staged-source-install"
+staged_source_archive="${fixture}/staged-source.tar.gz"
+mkdir "$staged_source_tmp"
+chmod 0700 "$staged_source_tmp"
+cp "$archive" "$staged_source_archive"
+cp "${archive}.sha256" "${staged_source_archive}.sha256"
+TMPDIR="$staged_source_tmp" \
+    EXECUTOR_INSTALL_DIR="$staged_source_install" \
+    EXECUTOR_INSTALL_TEST_REMOVE_SOURCE_AFTER_STAGE=1 \
+    "${repo_root}/scripts/install.sh" \
+    --archive "$staged_source_archive" \
+    --no-modify-path >/dev/null
+[[ ! -e "$staged_source_archive" ]]
+[[ ! -e "${staged_source_archive}.sha256" ]]
+[[ -x "${staged_source_install}/executor" ]]
+EXECUTOR_INSTALL_DIR="$staged_source_install" \
+    "${repo_root}/scripts/install.sh" \
+    --uninstall \
+    --no-modify-path >/dev/null
+
+shared_install_dir="${fixture}/shared-bin"
+mkdir -p "$shared_install_dir"
+printf 'unrelated license sentinel\n' > "${shared_install_dir}/LICENSE"
+if EXECUTOR_INSTALL_DIR="$shared_install_dir" \
+    "${repo_root}/scripts/install.sh" \
+    --archive "$archive" \
+    --no-modify-path >/dev/null 2>&1; then
+    printf 'installer overwrote an unowned shared-directory file\n' >&2
+    exit 1
+fi
+grep -Fqx 'unrelated license sentinel' "${shared_install_dir}/LICENSE"
+[[ ! -e "${shared_install_dir}/executor" ]]
+[[ ! -e "${shared_install_dir}/.executor-install-manifest" ]]
+
+umask_install_dir="${fixture}/umask-install-parent/bin"
+(
+    umask 0002
+    EXECUTOR_INSTALL_DIR="$umask_install_dir" \
+        "${repo_root}/scripts/install.sh" \
+        --archive "$archive" \
+        --no-modify-path >/dev/null
+)
+[[ -x "${umask_install_dir}/executor" ]]
+EXECUTOR_INSTALL_DIR="$umask_install_dir" \
+    "${repo_root}/scripts/install.sh" \
+    --uninstall \
+    --no-modify-path >/dev/null
+
+unsafe_install_parent="${fixture}/unsafe-install-parent"
+mkdir "$unsafe_install_parent"
+chmod 0777 "$unsafe_install_parent"
+if EXECUTOR_INSTALL_DIR="${unsafe_install_parent}/bin" \
+    "${repo_root}/scripts/install.sh" \
+    --archive "$archive" \
+    --no-modify-path > "${fixture}/unsafe-install-parent.log" 2>&1; then
+    printf 'installer accepted a writable install-path ancestor\n' >&2
+    exit 1
+fi
+grep -F 'install path components cannot be group or world writable' \
+    "${fixture}/unsafe-install-parent.log" >/dev/null
+[[ ! -e "${unsafe_install_parent}/bin" ]]
+chmod 0700 "$unsafe_install_parent"
+
+symlink_install_target="${fixture}/symlink-install-target"
+symlink_install_component="${fixture}/symlink-install-component"
+mkdir "$symlink_install_target"
+ln -s "$symlink_install_target" "$symlink_install_component"
+if EXECUTOR_INSTALL_DIR="${symlink_install_component}/bin" \
+    "${repo_root}/scripts/install.sh" \
+    --archive "$archive" \
+    --no-modify-path > "${fixture}/symlink-install-component.log" 2>&1; then
+    printf 'installer accepted a symlinked install-path component\n' >&2
+    exit 1
+fi
+grep -F 'install path component is not a real directory' \
+    "${fixture}/symlink-install-component.log" >/dev/null
+[[ ! -e "${symlink_install_target}/bin" ]]
+
+ancestor_swap_parent="${fixture}/ancestor-swap-parent"
+ancestor_swap_original="${fixture}/ancestor-swap-original"
+ancestor_swap_ready="${fixture}/ancestor-swap-ready"
+ancestor_swap_release="${fixture}/ancestor-swap-release"
+mkdir "$ancestor_swap_parent"
+EXECUTOR_INSTALL_DIR="${ancestor_swap_parent}/bin" \
+    EXECUTOR_INSTALL_TEST_PAUSE_POINT=after-install-root \
+    EXECUTOR_INSTALL_TEST_PAUSE_READY="$ancestor_swap_ready" \
+    EXECUTOR_INSTALL_TEST_PAUSE_RELEASE="$ancestor_swap_release" \
+    "${repo_root}/scripts/install.sh" \
+    --archive "$archive" \
+    --no-modify-path > "${fixture}/ancestor-swap.log" 2>&1 &
+ancestor_swap_pid=$!
+wait_for_file "$ancestor_swap_ready" "$ancestor_swap_pid"
+mv "$ancestor_swap_parent" "$ancestor_swap_original"
+mkdir -p "${ancestor_swap_parent}/bin"
+touch "$ancestor_swap_release"
+if wait "$ancestor_swap_pid"; then
+    printf 'installer accepted a swapped install-path ancestor\n' >&2
+    exit 1
+fi
+grep -F 'install root parent changed after validation' \
+    "${fixture}/ancestor-swap.log" >/dev/null
+[[ ! -e "${ancestor_swap_parent}/bin/executor" ]]
+
+service_home="${fixture}/service-preservation-home"
+service_root="${service_home}/.executor/service"
+mkdir -p "${service_root}/bin"
+printf '#!/bin/sh\nprintf "service copy\\n"\n' > "${service_root}/bin/executor"
+chmod 0755 "${service_root}/bin/executor"
+printf 'service-install-manifest-v1\nfixture\n' > "${service_root}/service-install.manifest"
+printf 'service configuration fixture\n' > "${service_root}/service-config"
+cp -R "$service_root" "${fixture}/expected-service-root"
+HOME="$service_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    "${repo_root}/scripts/install.sh" \
+    --archive "$archive" \
+    --no-modify-path >/dev/null
+HOME="$service_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    "${repo_root}/scripts/install.sh" \
+    --archive "$archive" \
+    --no-modify-path >/dev/null
+HOME="$service_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    "${repo_root}/scripts/install.sh" \
+    --uninstall \
+    --no-modify-path >/dev/null
+diff -r "${fixture}/expected-service-root" "$service_root"
+
+concurrent_home="${fixture}/concurrent-home"
+concurrent_ready="${fixture}/concurrent-ready"
+concurrent_release="${fixture}/concurrent-release"
+mkdir -p "$concurrent_home"
+HOME="$concurrent_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    EXECUTOR_INSTALL_TEST_PAUSE_POINT=after-lock \
+    EXECUTOR_INSTALL_TEST_PAUSE_READY="$concurrent_ready" \
+    EXECUTOR_INSTALL_TEST_PAUSE_RELEASE="$concurrent_release" \
+    "${repo_root}/scripts/install.sh" \
+    --archive "$archive" \
+    --no-modify-path > "${fixture}/concurrent-first.log" 2>&1 &
+concurrent_pid=$!
+wait_for_file "$concurrent_ready" "$concurrent_pid"
+if HOME="$concurrent_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    "${repo_root}/scripts/install.sh" \
+    --archive "$archive" \
+    --no-modify-path > "${fixture}/concurrent-second.log" 2>&1; then
+    printf 'a concurrent installer acquired a live install lock\n' >&2
+    exit 1
+fi
+grep -F 'another Executor installer is active' "${fixture}/concurrent-second.log" >/dev/null
+if HOME="$concurrent_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    EXECUTOR_INSTALL_TEST_FAIL_PROCESS_IDENTITY_PID="$concurrent_pid" \
+    "${repo_root}/scripts/install.sh" \
+    --archive "$archive" \
+    --no-modify-path > "${fixture}/concurrent-identity-failure.log" 2>&1; then
+    printf 'installer reclaimed a live lock after an identity lookup failure\n' >&2
+    exit 1
+fi
+grep -F 'could not verify live install-lock owner pid' \
+    "${fixture}/concurrent-identity-failure.log" >/dev/null
+if HOME="$concurrent_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    "${repo_root}/scripts/install.sh" \
+    --uninstall \
+    --no-modify-path > "${fixture}/concurrent-uninstall.log" 2>&1; then
+    printf 'a concurrent uninstall acquired a live install lock\n' >&2
+    exit 1
+fi
+grep -F 'another Executor installer is active' "${fixture}/concurrent-uninstall.log" >/dev/null
+touch "$concurrent_release"
+wait "$concurrent_pid"
+[[ -x "${concurrent_home}/.executor/bin/executor" ]]
+[[ ! -e "${concurrent_home}/.executor/bin/.executor-install-lock" ]]
+HOME="$concurrent_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    "${repo_root}/scripts/install.sh" \
+    --uninstall \
+    --no-modify-path >/dev/null
+
+crashed_home="${fixture}/crashed-home"
+crashed_ready="${fixture}/crashed-ready"
+crashed_release="${fixture}/crashed-release"
+mkdir -p "$crashed_home"
+HOME="$crashed_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    EXECUTOR_INSTALL_TEST_PAUSE_POINT=after-install-file-1 \
+    EXECUTOR_INSTALL_TEST_PAUSE_READY="$crashed_ready" \
+    EXECUTOR_INSTALL_TEST_PAUSE_RELEASE="$crashed_release" \
+    "${repo_root}/scripts/install.sh" \
+    --archive "$archive" \
+    --no-modify-path > "${fixture}/crashed-first.log" 2>&1 &
+crashed_pid=$!
+wait_for_file "$crashed_ready" "$crashed_pid"
+[[ -x "${crashed_home}/.executor/bin/executor" ]]
+[[ -d "${crashed_home}/.executor/bin/.executor-install-recovery" ]]
+if HOME="$crashed_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    "${repo_root}/scripts/install.sh" \
+    --archive "$archive" \
+    --no-modify-path > "${fixture}/crashed-second.log" 2>&1; then
+    printf 'a concurrent installer rolled back a live mid-commit transaction\n' >&2
+    exit 1
+fi
+grep -F 'another Executor installer is active' "${fixture}/crashed-second.log" >/dev/null
+[[ -x "${crashed_home}/.executor/bin/executor" ]]
+[[ -d "${crashed_home}/.executor/bin/.executor-install-recovery" ]]
+kill -KILL "$crashed_pid"
+if wait "$crashed_pid" 2>/dev/null; then
+    printf 'killed installer exited successfully\n' >&2
+    exit 1
+fi
+[[ -s "${crashed_home}/.executor/bin/.executor-install-lock" ]]
+HOME="$crashed_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    "${repo_root}/scripts/install.sh" \
+    --archive "$archive" \
+    --no-modify-path >/dev/null
+[[ -x "${crashed_home}/.executor/bin/executor" ]]
+[[ -s "${crashed_home}/.executor/bin/.executor-install-manifest" ]]
+[[ ! -e "${crashed_home}/.executor/bin/.executor-install-recovery" ]]
+[[ ! -e "${crashed_home}/.executor/bin/.executor-install-lock" ]]
+HOME="$crashed_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    "${repo_root}/scripts/install.sh" \
+    --uninstall \
+    --no-modify-path >/dev/null
+
+reused_pid_install="${fixture}/reused-pid-install"
+mkdir -p "$reused_pid_install"
+chmod 0700 "$reused_pid_install"
+printf 'executor-install-lock-v1\npid %s\nidentity ps:0:0\n' "$$" \
+    > "${reused_pid_install}/.executor-install-lock"
+chmod 0600 "${reused_pid_install}/.executor-install-lock"
+EXECUTOR_INSTALL_DIR="$reused_pid_install" \
+    "${repo_root}/scripts/install.sh" \
+    --archive "$archive" \
+    --no-modify-path >/dev/null
+[[ -x "${reused_pid_install}/executor" ]]
+[[ ! -e "${reused_pid_install}/.executor-install-lock" ]]
+EXECUTOR_INSTALL_DIR="$reused_pid_install" \
+    "${repo_root}/scripts/install.sh" \
+    --uninstall \
+    --no-modify-path >/dev/null
+
+recovery_home="${fixture}/recovery-home"
+recovery_durability_log="${fixture}/recovery-durability.log"
+mkdir -p "$recovery_home"
+if HOME="$recovery_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    EXECUTOR_INSTALL_TEST_FAIL_AFTER_INSTALL_FILE=1 \
+    EXECUTOR_INSTALL_TEST_DURABILITY_LOG="$recovery_durability_log" \
+    "${repo_root}/scripts/install.sh" \
+    --archive "$archive" \
+    --no-modify-path >/dev/null 2>&1; then
+    printf 'installer ignored an injected mid-install failure\n' >&2
+    exit 1
+fi
+[[ -d "${recovery_home}/.executor/bin/.executor-install-recovery" ]]
+[[ -x "${recovery_home}/.executor/bin/executor" ]]
+[[ ! -e "${recovery_home}/.executor/bin/.executor-install-manifest" ]]
+assert_event_before \
+    "$recovery_durability_log" \
+    'recovery-durable:executor' \
+    'managed-file-durable:executor'
+if HOME="$recovery_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    EXECUTOR_INSTALL_TEST_DURABILITY_LOG="$recovery_durability_log" \
+    EXECUTOR_INSTALL_TEST_FAIL_DURABILITY_POINT='rollback-managed-durable:executor' \
+    "${repo_root}/scripts/install.sh" \
+    --archive "$archive" \
+    --no-modify-path >/dev/null 2>&1; then
+    printf 'installer ignored an injected rollback durability failure\n' >&2
+    exit 1
+fi
+[[ -d "${recovery_home}/.executor/bin/.executor-install-recovery" ]]
+HOME="$recovery_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    EXECUTOR_INSTALL_TEST_DURABILITY_LOG="$recovery_durability_log" \
+    "${repo_root}/scripts/install.sh" \
+    --archive "$archive" \
+    --no-modify-path >/dev/null
+[[ -s "${recovery_home}/.executor/bin/.executor-install-manifest" ]]
+[[ ! -e "${recovery_home}/.executor/bin/.executor-install-recovery" ]]
+assert_event_before \
+    "$recovery_durability_log" \
+    'rollback-managed-durable:executor' \
+    'rollback-manifest-durable'
+assert_event_before \
+    "$recovery_durability_log" \
+    'rollback-manifest-durable' \
+    'recovery-retired:rollback'
+HOME="$recovery_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    "${repo_root}/scripts/install.sh" \
+    --uninstall \
+    --no-modify-path >/dev/null
+
+unowned_path_home="${fixture}/unowned-path-home"
+mkdir -p "$unowned_path_home"
+unowned_path_command="export PATH=${unowned_path_home}/.executor/bin:\$PATH"
+printf '# Executor\n%s\n' "$unowned_path_command" > "${unowned_path_home}/.bashrc"
+HOME="$unowned_path_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    "${repo_root}/scripts/install.sh" \
+    --uninstall >/dev/null
+grep -Fqx '# Executor' "${unowned_path_home}/.bashrc"
+grep -Fqx "$unowned_path_command" "${unowned_path_home}/.bashrc"
+
+preexisting_path_home="${fixture}/preexisting-path-home"
+mkdir -p "$preexisting_path_home"
+preexisting_path_command="export PATH=${preexisting_path_home}/.executor/bin:\$PATH"
+printf '# preexisting fixture\n# Executor\n%s\n' \
+    "$preexisting_path_command" \
+    > "${preexisting_path_home}/.bashrc"
+HOME="$preexisting_path_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    "${repo_root}/scripts/install.sh" \
+    --archive "$archive" >/dev/null
+[[ ! -e "${preexisting_path_home}/.executor/bin/.executor-path-ownership" ]]
+HOME="$preexisting_path_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    "${repo_root}/scripts/install.sh" \
+    --uninstall >/dev/null
+grep -Fqx '# Executor' "${preexisting_path_home}/.bashrc"
+grep -Fqx "$preexisting_path_command" "${preexisting_path_home}/.bashrc"
+
+path_failure_home="${fixture}/path-failure-home"
+path_durability_log="${fixture}/path-durability.log"
+mkdir -p "$path_failure_home"
+printf '# path failure fixture\n' > "${path_failure_home}/.bashrc"
+if HOME="$path_failure_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    EXECUTOR_INSTALL_TEST_FAIL_AFTER_PATH_CONFIG=1 \
+    EXECUTOR_INSTALL_TEST_DURABILITY_LOG="$path_durability_log" \
+    "${repo_root}/scripts/install.sh" \
+    --archive "$archive" >/dev/null 2>&1; then
+    printf 'installer ignored an injected post-PATH-update failure\n' >&2
+    exit 1
+fi
+[[ -x "${path_failure_home}/.executor/bin/executor" ]]
+[[ -s "${path_failure_home}/.executor/bin/.executor-path-ownership" ]]
+[[ -s "${path_failure_home}/.executor/bin/.executor-install-manifest" ]]
+grep -Fqx '# Executor' "${path_failure_home}/.bashrc"
+assert_event_before \
+    "$path_durability_log" \
+    'managed-file-durable:.executor-path-ownership' \
+    'manifest-durable:.executor-path-ownership'
+assert_event_before \
+    "$path_durability_log" \
+    'manifest-durable:.executor-path-ownership' \
+    'recovery-retired:.executor-path-ownership'
+assert_event_before \
+    "$path_durability_log" \
+    'recovery-retired:.executor-path-ownership' \
+    'path-config-durable:add'
+HOME="$path_failure_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    EXECUTOR_INSTALL_TEST_DURABILITY_LOG="$path_durability_log" \
+    "${repo_root}/scripts/install.sh" \
+    --archive "$archive" >/dev/null
+HOME="$path_failure_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    EXECUTOR_INSTALL_TEST_DURABILITY_LOG="$path_durability_log" \
+    "${repo_root}/scripts/install.sh" \
+    --uninstall >/dev/null
+assert_event_before \
+    "$path_durability_log" \
+    'path-config-durable:remove' \
+    'uninstall-file-durable:.executor-path-ownership'
+assert_event_before \
+    "$path_durability_log" \
+    'uninstall-file-durable:.executor-path-ownership' \
+    'uninstall-manifest-durable'
+if grep -Fqx '# Executor' "${path_failure_home}/.bashrc"; then
+    printf 'uninstaller left a PATH block after a recovered PATH update failure\n' >&2
+    exit 1
+fi
+
+cross_root_home="${fixture}/cross-root-home"
+cross_root_a="${fixture}/cross-root-a"
+cross_root_b="${fixture}/cross-root-b"
+cross_root_ready="${fixture}/cross-root-ready"
+cross_root_release="${fixture}/cross-root-release"
+mkdir "$cross_root_home"
+printf '# cross-root fixture\n' > "${cross_root_home}/.bashrc"
+HOME="$cross_root_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    EXECUTOR_INSTALL_DIR="$cross_root_a" \
+    EXECUTOR_INSTALL_TEST_CONFIG_PAUSE_READY="$cross_root_ready" \
+    EXECUTOR_INSTALL_TEST_CONFIG_PAUSE_RELEASE="$cross_root_release" \
+    "${repo_root}/scripts/install.sh" \
+    --archive "$archive" > "${fixture}/cross-root-a.log" 2>&1 &
+cross_root_a_pid=$!
+wait_for_file "$cross_root_ready" "$cross_root_a_pid"
+HOME="$cross_root_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    EXECUTOR_INSTALL_DIR="$cross_root_b" \
+    "${repo_root}/scripts/install.sh" \
+    --archive "$archive" > "${fixture}/cross-root-b.log" 2>&1 &
+cross_root_b_pid=$!
+wait_for_file "${cross_root_b}/.executor-path-ownership" "$cross_root_b_pid"
+touch "$cross_root_release"
+wait "$cross_root_a_pid"
+wait "$cross_root_b_pid"
+cross_root_a_command="export PATH=${cross_root_a}:\$PATH"
+cross_root_b_command="export PATH=${cross_root_b}:\$PATH"
+[[ "$(grep -Fxc '# Executor' "${cross_root_home}/.bashrc")" -eq 2 ]]
+[[ "$(grep -Fxc "$cross_root_a_command" "${cross_root_home}/.bashrc")" -eq 1 ]]
+[[ "$(grep -Fxc "$cross_root_b_command" "${cross_root_home}/.bashrc")" -eq 1 ]]
+HOME="$cross_root_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    EXECUTOR_INSTALL_DIR="$cross_root_a" \
+    "${repo_root}/scripts/install.sh" \
+    --uninstall >/dev/null
+HOME="$cross_root_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    EXECUTOR_INSTALL_DIR="$cross_root_b" \
+    "${repo_root}/scripts/install.sh" \
+    --uninstall >/dev/null
+if grep -Fqx '# Executor' "${cross_root_home}/.bashrc"; then
+    printf 'cross-root uninstall left an Executor PATH marker\n' >&2
+    exit 1
+fi
+
+no_modify_home="${fixture}/no-modify-home"
+mkdir -p "$no_modify_home"
+no_modify_path_command="export PATH=${no_modify_home}/.executor/bin:\$PATH"
+printf '# Executor\n%s\n' "$no_modify_path_command" > "${no_modify_home}/.bashrc"
+HOME="$no_modify_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    "${repo_root}/scripts/install.sh" \
+    --archive "$archive" \
+    --no-modify-path >/dev/null
+[[ ! -e "${no_modify_home}/.executor/bin/.executor-path-ownership" ]]
+HOME="$no_modify_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    "${repo_root}/scripts/install.sh" \
+    --uninstall >/dev/null
+grep -Fqx '# Executor' "${no_modify_home}/.bashrc"
+grep -Fqx "$no_modify_path_command" "${no_modify_home}/.bashrc"
+
+lost_state_home="${fixture}/lost-state-home"
+mkdir -p "$lost_state_home"
+printf '# lost state fixture\n' > "${lost_state_home}/.bashrc"
+HOME="$lost_state_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    "${repo_root}/scripts/install.sh" \
+    --archive "$archive" >/dev/null
+rm -f "${lost_state_home}/.executor/bin/.executor-path-ownership"
+if HOME="$lost_state_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    "${repo_root}/scripts/install.sh" \
+    --uninstall >/dev/null 2>&1; then
+    printf 'uninstaller accepted missing PATH ownership state out of delete order\n' >&2
+    exit 1
+fi
+grep -Fqx '# Executor' "${lost_state_home}/.bashrc"
+[[ -x "${lost_state_home}/.executor/bin/executor" ]]
+[[ -s "${lost_state_home}/.executor/bin/.executor-install-manifest" ]]
+
+corrupt_state_home="${fixture}/corrupt-state-home"
+mkdir -p "$corrupt_state_home"
+printf '# corrupt state fixture\n' > "${corrupt_state_home}/.bashrc"
+HOME="$corrupt_state_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    "${repo_root}/scripts/install.sh" \
+    --archive "$archive" >/dev/null
+printf 'corrupt ownership state\n' \
+    > "${corrupt_state_home}/.executor/bin/.executor-path-ownership"
+if HOME="$corrupt_state_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    "${repo_root}/scripts/install.sh" \
+    --uninstall >/dev/null 2>&1; then
+    printf 'uninstaller accepted corrupt PATH ownership state\n' >&2
+    exit 1
+fi
+grep -Fqx '# Executor' "${corrupt_state_home}/.bashrc"
+[[ -x "${corrupt_state_home}/.executor/bin/executor" ]]
+[[ -s "${corrupt_state_home}/.executor/bin/.executor-install-manifest" ]]
+
+shell_change_home="${fixture}/shell-change-home"
+shell_change_zdot="${shell_change_home}/original-zdot"
+mkdir -p "$shell_change_zdot"
+printf '# original zsh config\n' > "${shell_change_zdot}/.zshrc"
+printf '# untouched bash config\n' > "${shell_change_home}/.bashrc"
+HOME="$shell_change_home" \
+    SHELL=/bin/zsh \
+    ZDOTDIR="$shell_change_zdot" \
+    GITHUB_ACTIONS=false \
+    "${repo_root}/scripts/install.sh" \
+    --archive "$archive" >/dev/null
+grep -Fqx '# Executor' "${shell_change_zdot}/.zshrc"
+[[ -s "${shell_change_home}/.executor/bin/.executor-path-ownership" ]]
+HOME="$shell_change_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    "${repo_root}/scripts/install.sh" \
+    --archive "$archive" >/dev/null
+grep -Fqx '# Executor' "${shell_change_home}/.bashrc"
+[[ "$(grep -c $'^/' "${shell_change_home}/.executor/bin/.executor-path-ownership")" -eq 2 ]]
+HOME="$shell_change_home" \
+    SHELL=/bin/fish \
+    ZDOTDIR="${shell_change_home}/different-zdot" \
+    GITHUB_ACTIONS=false \
+    "${repo_root}/scripts/install.sh" \
+    --uninstall >/dev/null
+if grep -Fqx '# Executor' "${shell_change_zdot}/.zshrc"; then
+    printf 'uninstaller left a PATH block recorded under the original shell\n' >&2
+    exit 1
+fi
+if grep -Fqx '# Executor' "${shell_change_home}/.bashrc"; then
+    printf 'uninstaller left a second recorded shell PATH block\n' >&2
+    exit 1
+fi
+grep -Fqx '# original zsh config' "${shell_change_zdot}/.zshrc"
+grep -Fqx '# untouched bash config' "${shell_change_home}/.bashrc"
+
+lifecycle_home="${fixture}/home"
+lifecycle_install_dir="${lifecycle_home}/.executor/bin"
+lifecycle_config="${lifecycle_home}/.bashrc"
+mkdir -p "$lifecycle_home"
+printf '# fixture shell config\n' > "$lifecycle_config"
+chmod 0640 "$lifecycle_config"
+config_metadata="$(
+    python3 - "$lifecycle_config" <<'PY'
+import os
+import stat
+import sys
+
+metadata = os.stat(sys.argv[1], follow_symlinks=False)
+print(f"{stat.S_IMODE(metadata.st_mode)}:{metadata.st_uid}:{metadata.st_gid}")
+PY
+)"
+HOME="$lifecycle_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    "${repo_root}/scripts/install.sh" \
+    --archive "$archive" >/dev/null
+HOME="$lifecycle_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    "${repo_root}/scripts/install.sh" \
+    --archive "$archive" >/dev/null
+
+path_command="export PATH=${lifecycle_install_dir}:\$PATH"
+[[ "$(grep -Fxc '# Executor' "$lifecycle_config")" -eq 1 ]]
+[[ "$(grep -Fxc "$path_command" "$lifecycle_config")" -eq 1 ]]
+[[ -s "${lifecycle_install_dir}/.executor-install-manifest" ]]
+[[ "$(
+    python3 - "${lifecycle_install_dir}/.executor-install-manifest" <<'PY'
+import os
+import stat
+import sys
+
+print(stat.S_IMODE(os.stat(sys.argv[1], follow_symlinks=False).st_mode))
+PY
+)" -eq 384 ]]
+[[ "$(
+    python3 - "$lifecycle_config" <<'PY'
+import os
+import stat
+import sys
+
+metadata = os.stat(sys.argv[1], follow_symlinks=False)
+print(f"{stat.S_IMODE(metadata.st_mode)}:{metadata.st_uid}:{metadata.st_gid}")
+PY
+)" == "$config_metadata" ]]
+mkdir -p "${lifecycle_home}/.executor/data"
+printf 'preserve data\n' > "${lifecycle_home}/.executor/data/database.fixture"
+printf 'preserve unrelated file\n' > "${lifecycle_install_dir}/user-owned.fixture"
+cp "$lifecycle_config" "${fixture}/expected-shell-config"
+
+if HOME="$lifecycle_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    EXECUTOR_INSTALL_TEST_FAIL_CONFIG_WRITE=1 \
+    "${repo_root}/scripts/install.sh" \
+    --uninstall >/dev/null 2>&1; then
+    printf 'uninstaller ignored an injected shell-config write failure\n' >&2
+    exit 1
+fi
+cmp "$lifecycle_config" "${fixture}/expected-shell-config"
+[[ -x "${lifecycle_install_dir}/executor" ]]
+[[ -s "${lifecycle_install_dir}/.executor-install-manifest" ]]
+
+if HOME="$lifecycle_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    EXECUTOR_INSTALL_TEST_FAIL_CONFIG_RENAME=1 \
+    "${repo_root}/scripts/install.sh" \
+    --uninstall >/dev/null 2>&1; then
+    printf 'uninstaller ignored an injected shell-config rename failure\n' >&2
+    exit 1
+fi
+cmp "$lifecycle_config" "${fixture}/expected-shell-config"
+[[ -x "${lifecycle_install_dir}/executor" ]]
+[[ -s "${lifecycle_install_dir}/.executor-install-manifest" ]]
+[[ -z "$(find "$lifecycle_home" -maxdepth 1 -name '.bashrc.executor-*' -print -quit)" ]]
+
+upgrade_binary="${fixture}/executor-upgrade"
+printf '#!/bin/sh\nprintf "upgraded\\n"\n' > "$upgrade_binary"
+chmod 0755 "$upgrade_binary"
+if HOME="$lifecycle_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    EXECUTOR_INSTALL_TEST_FAIL_MANIFEST=1 \
+    "${repo_root}/scripts/install.sh" \
+    --binary "$upgrade_binary" >/dev/null 2>&1; then
+    printf 'installer ignored an injected manifest publication failure\n' >&2
+    exit 1
+fi
+cmp "$upgrade_binary" "${lifecycle_install_dir}/executor"
+[[ -d "${lifecycle_install_dir}/.executor-install-recovery" ]]
+HOME="$lifecycle_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    "${repo_root}/scripts/install.sh" \
+    --binary "$upgrade_binary" >/dev/null
+cmp "$upgrade_binary" "${lifecycle_install_dir}/executor"
+[[ -s "${lifecycle_install_dir}/THIRD_PARTY_LICENSES.html" ]]
+[[ -s "${lifecycle_install_dir}/.executor-install-manifest" ]]
+[[ ! -e "${lifecycle_install_dir}/.executor-install-recovery" ]]
+
+printf 'replacement sentinel\n' > "${lifecycle_install_dir}/LICENSE"
+if HOME="$lifecycle_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    "${repo_root}/scripts/install.sh" \
+    --archive "$archive" >/dev/null 2>&1; then
+    printf 'installer overwrote a replaced installer-owned file\n' >&2
+    exit 1
+fi
+grep -Fqx 'replacement sentinel' "${lifecycle_install_dir}/LICENSE"
+if HOME="$lifecycle_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    "${repo_root}/scripts/install.sh" \
+    --uninstall >/dev/null 2>&1; then
+    printf 'uninstaller removed a replaced installer-owned file\n' >&2
+    exit 1
+fi
+grep -Fqx 'replacement sentinel' "${lifecycle_install_dir}/LICENSE"
+cmp "$lifecycle_config" "${fixture}/expected-shell-config"
+[[ -x "${lifecycle_install_dir}/executor" ]]
+[[ -s "${lifecycle_install_dir}/.executor-install-manifest" ]]
+cp "${stage}/LICENSE" "${lifecycle_install_dir}/LICENSE"
+
+uninstall_durability_log="${fixture}/uninstall-durability.log"
+if HOME="$lifecycle_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    EXECUTOR_INSTALL_TEST_FAIL_AFTER_UNINSTALL_DELETE=1 \
+    EXECUTOR_INSTALL_TEST_DURABILITY_LOG="$uninstall_durability_log" \
+    "${repo_root}/scripts/install.sh" \
+    --uninstall >/dev/null 2>&1; then
+    printf 'uninstaller ignored an injected partial-delete failure\n' >&2
+    exit 1
+fi
+[[ ! -e "${lifecycle_install_dir}/executor" ]]
+[[ -s "${lifecycle_install_dir}/LICENSE" ]]
+[[ -s "${lifecycle_install_dir}/.executor-install-manifest" ]]
+[[ -s "${lifecycle_home}/.executor/data/database.fixture" ]]
+[[ -s "${lifecycle_install_dir}/user-owned.fixture" ]]
+event_line "$uninstall_durability_log" 'uninstall-file-durable:executor' >/dev/null
+if event_line "$uninstall_durability_log" 'uninstall-manifest-durable' >/dev/null 2>&1; then
+    printf 'partial uninstall published the manifest deletion too early\n' >&2
+    exit 1
+fi
+
+HOME="$lifecycle_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    EXECUTOR_INSTALL_TEST_DURABILITY_LOG="$uninstall_durability_log" \
+    "${repo_root}/scripts/install.sh" \
+    --uninstall >/dev/null
+assert_event_before \
+    "$uninstall_durability_log" \
+    'uninstall-file-durable:executor' \
+    'uninstall-file-durable:LICENSE'
+assert_event_before \
+    "$uninstall_durability_log" \
+    'uninstall-file-durable:.executor-path-ownership' \
+    'uninstall-manifest-durable'
+
+for removed in \
+    executor \
+    LICENSE \
+    THIRD_PARTY_LICENSES.html \
+    THIRD_PARTY_JAVASCRIPT_LICENSES.json \
+    .executor-path-ownership \
+    .executor-install-manifest; do
+    [[ ! -e "${lifecycle_install_dir}/${removed}" ]]
+done
+[[ -s "${lifecycle_home}/.executor/data/database.fixture" ]]
+[[ -s "${lifecycle_install_dir}/user-owned.fixture" ]]
+grep -Fqx '# fixture shell config' "$lifecycle_config"
+[[ "$(
+    python3 - "$lifecycle_config" <<'PY'
+import os
+import stat
+import sys
+
+metadata = os.stat(sys.argv[1], follow_symlinks=False)
+print(f"{stat.S_IMODE(metadata.st_mode)}:{metadata.st_uid}:{metadata.st_gid}")
+PY
+)" == "$config_metadata" ]]
+if grep -Fqx '# Executor' "$lifecycle_config"; then
+    printf 'uninstaller left its shell marker behind\n' >&2
+    exit 1
+fi
+if grep -Fqx "$path_command" "$lifecycle_config"; then
+    printf 'uninstaller left its PATH entry behind\n' >&2
+    exit 1
+fi
+
+HOME="$lifecycle_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    "${repo_root}/scripts/install.sh" \
+    --uninstall >/dev/null
+
+empty_home="${fixture}/empty-home"
+mkdir -p "$empty_home"
+HOME="$empty_home" \
+    SHELL=/bin/zsh \
+    GITHUB_ACTIONS=false \
+    "${repo_root}/scripts/install.sh" \
+    --uninstall >/dev/null
+if HOME="$lifecycle_home" \
+    SHELL=/bin/bash \
+    GITHUB_ACTIONS=false \
+    "${repo_root}/scripts/install.sh" \
+    --uninstall \
+    --archive "$archive" >/dev/null 2>&1; then
+    printf 'uninstaller accepted an install source option\n' >&2
+    exit 1
+fi
+
+printf 'release archive installer fixture passed\n'
diff --git a/scripts/test-install-systemd-master-key.sh b/scripts/test-install-systemd-master-key.sh
new file mode 100755
index 000000000..950b8a423
--- /dev/null
+++ b/scripts/test-install-systemd-master-key.sh
@@ -0,0 +1,823 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+readonly SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)
+source "${SCRIPT_DIR}/lib/install-systemd-master-key.sh"
+
+readonly CURRENT_UID=$(id -u)
+readonly CURRENT_GID=$(id -g)
+TEST_NUMBER=0
+test_root=$(mktemp -d)
+trap 'rm -rf -- "${test_root}"' EXIT
+staging_parent="${test_root}/staging-parent"
+mkdir "${staging_parent}"
+chmod 0700 "${staging_parent}"
+
+pass() {
+    TEST_NUMBER=$((TEST_NUMBER + 1))
+    printf 'ok %s - %s\n' "${TEST_NUMBER}" "$1"
+}
+
+fail() {
+    printf 'not ok %s - %s\n' "$((TEST_NUMBER + 1))" "$1" >&2
+    exit 1
+}
+
+assert() {
+    local description=$1
+    shift
+    if ! "$@"; then
+        fail "${description}"
+    fi
+}
+
+layout_dir="${test_root}/layout"
+mkdir "${layout_dir}"
+layout_sentinel="${layout_dir}/managed-unit"
+printf 'managed unit sentinel\n' > "${layout_sentinel}"
+if executor_require_disjoint_paths \
+    "${layout_sentinel}" "persistent state" \
+    "${layout_sentinel}" "managed unit" 2>/dev/null; then
+    fail "equal persistent and managed paths were accepted"
+fi
+if executor_require_disjoint_paths \
+    "${layout_dir}" "persistent state" \
+    "${layout_sentinel}" "managed unit" 2>/dev/null; then
+    fail "nested persistent and managed paths were accepted"
+fi
+executor_require_disjoint_paths \
+    "${layout_dir}/master.key" "persistent state" \
+    "${test_root}/systemd/executor.service" "managed unit"
+assert "path-layout rejection changed the managed sentinel" test \
+    "$(cat "${layout_sentinel}")" = "managed unit sentinel"
+pass "systemd persistent and managed paths stay disjoint without mutation"
+
+valid_dir="${test_root}/valid"
+mkdir "${valid_dir}"
+valid_key="${valid_dir}/master.key"
+printf '0123456789abcdef0123456789abcdef' > "${valid_key}"
+chmod 0600 "${valid_key}"
+valid_copy="${test_root}/valid-key.copy"
+cp "${valid_key}" "${valid_copy}"
+valid_inode=$(stat --format='%i' -- "${valid_key}")
+executor_ensure_master_key \
+    "${staging_parent}" "${valid_dir}" "${valid_key}" \
+    "${CURRENT_UID}" "${CURRENT_GID}"
+assert "valid key bytes changed" cmp -s "${valid_copy}" "${valid_key}"
+assert "valid key inode changed" test \
+    "$(stat --format='%i' -- "${valid_key}")" = "${valid_inode}"
+pass "valid existing key is preserved byte-for-byte"
+
+mode_dir="${test_root}/wrong-mode"
+mkdir "${mode_dir}"
+mode_key="${mode_dir}/master.key"
+printf '89abcdef0123456789abcdef01234567' > "${mode_key}"
+chmod 0640 "${mode_key}"
+if executor_ensure_master_key \
+    "${staging_parent}" "${mode_dir}" "${mode_key}" \
+    "${CURRENT_UID}" "${CURRENT_GID}" 2>/dev/null; then
+    fail "wrong-mode key was accepted"
+fi
+assert "wrong-mode key permissions were changed" test \
+    "$(stat --format='%a' -- "${mode_key}")" = 640
+assert "wrong-mode key bytes were changed" test \
+    "$(cat "${mode_key}")" = '89abcdef0123456789abcdef01234567'
+pass "existing key with unsafe mode is rejected without repair"
+
+symlink_dir="${test_root}/symlink"
+mkdir "${symlink_dir}"
+symlink_target="${symlink_dir}/target"
+printf 'fedcba9876543210fedcba9876543210' > "${symlink_target}"
+chmod 0600 "${symlink_target}"
+ln -s "${symlink_target}" "${symlink_dir}/master.key"
+if executor_ensure_master_key \
+    "${staging_parent}" "${symlink_dir}" "${symlink_dir}/master.key" \
+    "${CURRENT_UID}" "${CURRENT_GID}" 2>/dev/null; then
+    fail "symbolic-link key was accepted"
+fi
+assert "symbolic-link target changed" test \
+    "$(cat "${symlink_target}")" = 'fedcba9876543210fedcba9876543210'
+pass "symbolic-link key is rejected without touching its target"
+
+hardlink_dir="${test_root}/hardlink"
+mkdir "${hardlink_dir}"
+hardlink_key="${hardlink_dir}/master.key"
+printf '00112233445566778899aabbccddeeff' > "${hardlink_key}"
+chmod 0600 "${hardlink_key}"
+ln "${hardlink_key}" "${hardlink_dir}/alias"
+if executor_ensure_master_key \
+    "${staging_parent}" "${hardlink_dir}" "${hardlink_key}" \
+    "${CURRENT_UID}" "${CURRENT_GID}" 2>/dev/null; then
+    fail "hard-linked key was accepted"
+fi
+assert "hard-linked key was mutated" test \
+    "$(cat "${hardlink_dir}/alias")" = '00112233445566778899aabbccddeeff'
+pass "hard-linked key is rejected without mutation"
+
+directory_target="${test_root}/directory-target"
+mkdir "${directory_target}"
+ln -s "${directory_target}" "${test_root}/directory-link"
+if executor_require_safe_directory "${test_root}/directory-link" 2>/dev/null; then
+    fail "symbolic-link managed directory was accepted"
+fi
+pass "symbolic-link managed directory is rejected"
+
+new_dir="${test_root}/new"
+mkdir "${new_dir}"
+new_key="${new_dir}/master.key"
+executor_ensure_master_key \
+    "${staging_parent}" "${new_dir}" "${new_key}" \
+    "${CURRENT_UID}" "${CURRENT_GID}"
+assert "new key has the wrong size" test \
+    "$(stat --format='%s' -- "${new_key}")" = 32
+assert "new key has the wrong link count" test \
+    "$(stat --format='%h' -- "${new_key}")" = 1
+assert "new key has the wrong mode" test \
+    "$(stat --format='%a' -- "${new_key}")" = 600
+pass "new key is safely published with validated metadata"
+
+unsafe_staging_parent="${test_root}/unsafe-staging-parent"
+unsafe_staging_data="${test_root}/unsafe-staging-data"
+mkdir "${unsafe_staging_parent}" "${unsafe_staging_data}"
+chmod 0770 "${unsafe_staging_parent}"
+if executor_ensure_master_key \
+    "${unsafe_staging_parent}" "${unsafe_staging_data}" \
+    "${unsafe_staging_data}/master.key" \
+    "${CURRENT_UID}" "${CURRENT_GID}" 2>/dev/null; then
+    fail "group-writable staging parent was accepted"
+fi
+pass "staging parent must exclude unprivileged writers"
+
+contention_dir="${test_root}/lock-contention"
+mkdir "${contention_dir}"
+contention_key="${contention_dir}/master.key"
+printf 'contention-key-must-stay-intact!' > "${contention_key}"
+chmod 0600 "${contention_key}"
+contention_copy="${test_root}/contention-key.copy"
+cp "${contention_key}" "${contention_copy}"
+lock_path="${staging_parent}/.executor-master-key.lock"
+exec {held_lock_fd}<>"${lock_path}"
+flock -n -x "${held_lock_fd}"
+if executor_ensure_master_key \
+    "${staging_parent}" "${contention_dir}" "${contention_key}" \
+    "${CURRENT_UID}" "${CURRENT_GID}" 2>/dev/null; then
+    fail "a live master key installation lock was ignored"
+fi
+assert "lock contention changed the existing master key" cmp -s \
+    "${contention_copy}" "${contention_key}"
+flock -u "${held_lock_fd}"
+exec {held_lock_fd}>&-
+executor_ensure_master_key \
+    "${staging_parent}" "${contention_dir}" "${contention_key}" \
+    "${CURRENT_UID}" "${CURRENT_GID}"
+pass "master key installation lock rejects contention without blocking"
+
+spoof_staging_parent="${test_root}/spoof-staging-parent"
+spoof_data_dir="${test_root}/spoof-data"
+mkdir "${spoof_staging_parent}" "${spoof_data_dir}"
+chmod 0700 "${spoof_staging_parent}"
+spoof_lock="${spoof_staging_parent}/.executor-master-key.lock"
+spoof_victim="${test_root}/spoof-lock-victim"
+printf 'victim must remain unchanged\n' > "${spoof_victim}"
+ln -s "${spoof_victim}" "${spoof_lock}"
+if executor_ensure_master_key \
+    "${spoof_staging_parent}" "${spoof_data_dir}" \
+    "${spoof_data_dir}/master.key" "${CURRENT_UID}" "${CURRENT_GID}" \
+    2>/dev/null; then
+    fail "symbolic-link master key lock was accepted"
+fi
+assert "symbolic-link lock changed its victim" test \
+    "$(cat "${spoof_victim}")" = "victim must remain unchanged"
+rm -f -- "${spoof_lock}"
+: > "${spoof_lock}"
+chmod 0644 "${spoof_lock}"
+if executor_ensure_master_key \
+    "${spoof_staging_parent}" "${spoof_data_dir}" \
+    "${spoof_data_dir}/master.key" "${CURRENT_UID}" "${CURRENT_GID}" \
+    2>/dev/null; then
+    fail "broad-mode master key lock was accepted"
+fi
+chmod 0600 "${spoof_lock}"
+spoof_lock_alias="${test_root}/spoof-lock-alias"
+ln "${spoof_lock}" "${spoof_lock_alias}"
+if executor_ensure_master_key \
+    "${spoof_staging_parent}" "${spoof_data_dir}" \
+    "${spoof_data_dir}/master.key" "${CURRENT_UID}" "${CURRENT_GID}" \
+    2>/dev/null; then
+    fail "hard-linked master key lock was accepted"
+fi
+assert "hard-linked lock was mutated" test \
+    "$(stat --format='%a:%h:%s' -- "${spoof_lock}")" = 600:2:0
+pass "master key installation lock rejects spoofed inodes"
+
+recovery_publish_dir="${test_root}/recovery-publish-failure"
+recovery_publish_shim="${test_root}/recovery-publish-shim"
+mkdir "${recovery_publish_dir}" "${recovery_publish_shim}"
+recovery_publish_key="${recovery_publish_dir}/master.key"
+real_mv=$(command -v mv)
+printf '%s\n' \
+    '#!/usr/bin/env bash' \
+    'set -euo pipefail' \
+    'destination=${!#}' \
+    'case "${destination}" in' \
+    '    */.executor-master-key.recovery) exit 76 ;;' \
+    'esac' \
+    'exec "${REAL_MV}" "$@"' > "${recovery_publish_shim}/mv"
+chmod 0700 "${recovery_publish_shim}/mv"
+if PATH="${recovery_publish_shim}:${PATH}" REAL_MV="${real_mv}" \
+    executor_ensure_master_key \
+        "${staging_parent}" "${recovery_publish_dir}" \
+        "${recovery_publish_key}" "${CURRENT_UID}" "${CURRENT_GID}" \
+        2>/dev/null; then
+    fail "recovery record publication failure was ignored"
+fi
+assert "key was published without a durable recovery record" test \
+    ! -e "${recovery_publish_key}"
+if compgen -G "${staging_parent}/.executor-master-key.recovery*" >/dev/null; then
+    fail "failed recovery publication left temporary control state"
+fi
+executor_ensure_master_key \
+    "${staging_parent}" "${recovery_publish_dir}" "${recovery_publish_key}" \
+    "${CURRENT_UID}" "${CURRENT_GID}"
+pass "recovery record publication failure stops key mutation"
+
+recovery_retire_dir="${test_root}/recovery-retire-failure"
+recovery_retire_shim="${test_root}/recovery-retire-shim"
+mkdir "${recovery_retire_dir}" "${recovery_retire_shim}"
+recovery_retire_key="${recovery_retire_dir}/master.key"
+real_rm=$(command -v rm)
+printf '%s\n' \
+    '#!/usr/bin/env bash' \
+    'set -euo pipefail' \
+    'target=${!#}' \
+    'case "${target}" in' \
+    '    */.executor-master-key.recovery) exit 77 ;;' \
+    'esac' \
+    'exec "${REAL_RM}" "$@"' > "${recovery_retire_shim}/rm"
+chmod 0700 "${recovery_retire_shim}/rm"
+if PATH="${recovery_retire_shim}:${PATH}" REAL_RM="${real_rm}" \
+    executor_ensure_master_key \
+        "${staging_parent}" "${recovery_retire_dir}" \
+        "${recovery_retire_key}" "${CURRENT_UID}" "${CURRENT_GID}" \
+        2>/dev/null; then
+    fail "recovery record retirement failure was ignored"
+fi
+assert "retirement failure removed the recovery record" test \
+    -e "${staging_parent}/.executor-master-key.recovery"
+assert "retirement failure lost the published key" test -e "${recovery_retire_key}"
+recovery_retire_copy="${test_root}/recovery-retire-key.copy"
+cp "${recovery_retire_key}" "${recovery_retire_copy}"
+executor_ensure_master_key \
+    "${staging_parent}" "${recovery_retire_dir}" "${recovery_retire_key}" \
+    "${CURRENT_UID}" "${CURRENT_GID}"
+assert "retirement retry changed the published key" cmp -s \
+    "${recovery_retire_copy}" "${recovery_retire_key}"
+pass "recovery retirement failure remains safely retryable"
+
+status_dir="${test_root}/validation-status"
+mkdir "${status_dir}"
+status_key="${status_dir}/master.key"
+validator_definition=$(declare -f executor_validate_master_key)
+executor_validate_master_key() {
+    return 73
+}
+create_succeeded=false
+validation_status=0
+if executor_create_master_key \
+    "${staging_parent}" "${status_dir}" "${status_key}" \
+    "${CURRENT_UID}" "${CURRENT_GID}"; then
+    create_succeeded=true
+else
+    validation_status=$?
+fi
+eval "${validator_definition}"
+if [[ ${create_succeeded} == true ]]; then
+    fail "temporary key validation failure was reported as success"
+fi
+assert "temporary key validation status was not propagated" test \
+    "${validation_status}" = 73
+assert "failed temporary key was published" test ! -e "${status_key}"
+executor_ensure_master_key \
+    "${staging_parent}" "${status_dir}" "${status_key}" \
+    "${CURRENT_UID}" "${CURRENT_GID}"
+pass "temporary key validation status is propagated"
+
+file_sync_dir="${test_root}/file-sync-failure"
+mkdir "${file_sync_dir}"
+file_sync_key="${file_sync_dir}/master.key"
+writer_definition=$(declare -f executor_write_and_sync_master_key)
+executor_write_and_sync_master_key() {
+    printf '0123456789abcdef0123456789abcdef' > "$1"
+    return 73
+}
+file_sync_succeeded=false
+file_sync_status=0
+if executor_ensure_master_key \
+    "${staging_parent}" "${file_sync_dir}" "${file_sync_key}" \
+    "${CURRENT_UID}" "${CURRENT_GID}" 2>/dev/null; then
+    file_sync_succeeded=true
+else
+    file_sync_status=$?
+fi
+eval "${writer_definition}"
+if [[ ${file_sync_succeeded} == true ]]; then
+    fail "staged key fsync failure was reported as success"
+fi
+assert "staged key fsync status was not propagated" test \
+    "${file_sync_status}" = 73
+assert "key was published after staged file fsync failure" test ! -e "${file_sync_key}"
+executor_ensure_master_key \
+    "${staging_parent}" "${file_sync_dir}" "${file_sync_key}" \
+    "${CURRENT_UID}" "${CURRENT_GID}"
+pass "staged master key fsync failure prevents publication"
+
+directory_sync_dir="${test_root}/directory-sync-failure"
+mkdir "${directory_sync_dir}"
+directory_sync_key="${directory_sync_dir}/master.key"
+directory_sync_ledger="${test_root}/directory-sync-ledger"
+sync_definition=$(declare -f executor_sync_filesystem_path)
+executor_sync_filesystem_path() {
+    if [[ $1 == "${directory_sync_dir}" ]]; then
+        printf '%s\n' "$1" >> "${directory_sync_ledger}"
+        return 74
+    fi
+    command sync -f -- "$1"
+}
+directory_sync_succeeded=false
+directory_sync_status=0
+if executor_ensure_master_key \
+    "${staging_parent}" "${directory_sync_dir}" "${directory_sync_key}" \
+    "${CURRENT_UID}" "${CURRENT_GID}" 2>/dev/null; then
+    directory_sync_succeeded=true
+else
+    directory_sync_status=$?
+fi
+eval "${sync_definition}"
+if [[ ${directory_sync_succeeded} == true ]]; then
+    fail "published key directory sync failure was reported as success"
+fi
+assert "published key directory sync status was not propagated" test \
+    "${directory_sync_status}" = 74
+assert "directory sync did not run on the destination data directory" test \
+    "$(cat "${directory_sync_ledger}")" = "${directory_sync_dir}"
+assert "atomically published key disappeared after sync failure" test \
+    -e "${directory_sync_key}"
+directory_sync_copy="${test_root}/directory-sync-key.copy"
+cp "${directory_sync_key}" "${directory_sync_copy}"
+executor_ensure_master_key \
+    "${staging_parent}" "${directory_sync_dir}" "${directory_sync_key}" \
+    "${CURRENT_UID}" "${CURRENT_GID}"
+assert "retry changed the published key after sync failure" cmp -s \
+    "${directory_sync_copy}" "${directory_sync_key}"
+pass "directory sync failures stop installation and recover on retry"
+
+sync_order_dir="${test_root}/sync-order"
+mkdir "${sync_order_dir}"
+sync_order_key="${sync_order_dir}/master.key"
+sync_order_ledger="${test_root}/sync-order-ledger"
+writer_definition=$(declare -f executor_write_and_sync_master_key)
+sync_definition=$(declare -f executor_sync_filesystem_path)
+executor_write_and_sync_master_key() {
+    printf 'file-sync|destination=%s\n' "$(test -e "${sync_order_key}" && printf present || printf absent)" \
+        >> "${sync_order_ledger}"
+    dd if=/dev/urandom of="$1" bs=32 count=1 \
+        iflag=fullblock oflag=nofollow conv=fsync status=none
+}
+executor_sync_filesystem_path() {
+    if [[ $1 == "${staging_parent}"/.executor-master-key.*/master.key ]]; then
+        printf 'metadata-sync|destination=%s\n' \
+            "$(test -e "${sync_order_key}" && printf present || printf absent)" \
+            >> "${sync_order_ledger}"
+    elif [[ $1 == "${sync_order_dir}" \
+        || $1 == "${staging_parent}" \
+            && -e ${sync_order_key} \
+            && -e ${staging_parent}/.executor-master-key.recovery ]]; then
+        printf 'directory-sync|%s|destination=%s\n' "$1" \
+            "$(test -e "${sync_order_key}" && printf present || printf absent)" \
+            >> "${sync_order_ledger}"
+    fi
+    command sync -f -- "$1"
+}
+executor_ensure_master_key \
+    "${staging_parent}" "${sync_order_dir}" "${sync_order_key}" \
+    "${CURRENT_UID}" "${CURRENT_GID}"
+eval "${writer_definition}"
+eval "${sync_definition}"
+first_sync_event=$(sed -n '1p' "${sync_order_ledger}")
+metadata_sync_event=$(sed -n '2p' "${sync_order_ledger}")
+first_directory_event=$(sed -n '3p' "${sync_order_ledger}")
+assert "file fsync did not happen before publication" test \
+    "${first_sync_event}" = "file-sync|destination=absent"
+assert "final key metadata was not synced before publication" test \
+    "${metadata_sync_event}" = "metadata-sync|destination=absent"
+assert "destination directory sync did not happen after publication" test \
+    "${first_directory_event}" = \
+    "directory-sync|${sync_order_dir}|destination=present"
+assert "publication cleanup did not receive all required directory syncs" test \
+    "$(wc -l < "${sync_order_ledger}" | tr -d ' ')" = 5
+pass "master key file and directory sync ordering is explicit"
+
+metadata_crash_dir="${test_root}/metadata-sync-crash"
+mkdir "${metadata_crash_dir}"
+metadata_crash_key="${metadata_crash_dir}/master.key"
+if EXECUTOR_INSTALL_TEST_CRASH_AFTER_KEY_METADATA_SYNC=1 \
+    executor_ensure_master_key \
+        "${staging_parent}" "${metadata_crash_dir}" "${metadata_crash_key}" \
+        "${CURRENT_UID}" "${CURRENT_GID}" 2>/dev/null; then
+    fail "metadata-sync crash injection reported success"
+fi
+recovery_path="${staging_parent}/.executor-master-key.recovery"
+metadata_staging_name=$(awk '$1 == "staging" { print $2 }' "${recovery_path}")
+metadata_recorded_alias="${staging_parent}/${metadata_staging_name}/master.key"
+metadata_recorded_copy="${test_root}/metadata-recorded-key.copy"
+cp "${metadata_recorded_alias}" "${metadata_recorded_copy}"
+assert "metadata-sync crash exposed the destination before publication" test \
+    ! -e "${metadata_crash_key}"
+assert "metadata-sync crash did not preserve final staged metadata" test \
+    "$(stat --format='%u:%g:%a:%s:%h' -- "${metadata_recorded_alias}")" = \
+    "${CURRENT_UID}:${CURRENT_GID}:600:32:1"
+chmod 0640 "${metadata_recorded_alias}"
+if executor_ensure_master_key \
+    "${staging_parent}" "${metadata_crash_dir}" "${metadata_crash_key}" \
+    "${CURRENT_UID}" "${CURRENT_GID}" 2>/dev/null; then
+    fail "recovery accepted staged metadata that differed from its record"
+fi
+assert "metadata mismatch retired the recovery record" test -e "${recovery_path}"
+chmod 0600 "${metadata_recorded_alias}"
+executor_ensure_master_key \
+    "${staging_parent}" "${metadata_crash_dir}" "${metadata_crash_key}" \
+    "${CURRENT_UID}" "${CURRENT_GID}"
+assert "metadata-sync recovery did not publish the exact staged key" cmp -s \
+    "${metadata_recorded_copy}" "${metadata_crash_key}"
+pass "metadata-sync crash recovers only the exact final key metadata"
+
+destination_crash_dir="${test_root}/destination-sync-crash"
+mkdir "${destination_crash_dir}"
+destination_crash_key="${destination_crash_dir}/master.key"
+if EXECUTOR_INSTALL_TEST_CRASH_AFTER_KEY_DESTINATION_SYNC=1 \
+    executor_ensure_master_key \
+        "${staging_parent}" "${destination_crash_dir}" \
+        "${destination_crash_key}" "${CURRENT_UID}" "${CURRENT_GID}" \
+        2>/dev/null; then
+    fail "destination-sync crash injection reported success"
+fi
+assert "destination-sync crash did not publish the key" test \
+    -e "${destination_crash_key}"
+assert "destination-sync crash did not leave the recorded two-link state" test \
+    "$(stat --format='%h' -- "${destination_crash_key}")" = 2
+destination_crash_copy="${test_root}/destination-sync-crash.copy"
+cp "${destination_crash_key}" "${destination_crash_copy}"
+executor_ensure_master_key \
+    "${staging_parent}" "${destination_crash_dir}" \
+    "${destination_crash_key}" "${CURRENT_UID}" "${CURRENT_GID}"
+assert "destination-sync recovery changed the key" cmp -s \
+    "${destination_crash_copy}" "${destination_crash_key}"
+assert "destination-sync recovery did not retire the staging alias" test \
+    "$(stat --format='%h' -- "${destination_crash_key}")" = 1
+pass "destination-sync crash recovers the exact staged key"
+
+alias_cleanup_dir="${test_root}/alias-cleanup-failure"
+alias_cleanup_shim="${test_root}/alias-cleanup-shim"
+mkdir "${alias_cleanup_dir}" "${alias_cleanup_shim}"
+alias_cleanup_key="${alias_cleanup_dir}/master.key"
+if EXECUTOR_INSTALL_TEST_CRASH_AFTER_KEY_DESTINATION_SYNC=1 \
+    executor_ensure_master_key \
+        "${staging_parent}" "${alias_cleanup_dir}" "${alias_cleanup_key}" \
+        "${CURRENT_UID}" "${CURRENT_GID}" 2>/dev/null; then
+    fail "alias cleanup crash injection reported success"
+fi
+alias_cleanup_copy="${test_root}/alias-cleanup-key.copy"
+cp "${alias_cleanup_key}" "${alias_cleanup_copy}"
+printf '%s\n' \
+    '#!/usr/bin/env bash' \
+    'set -euo pipefail' \
+    'target=${!#}' \
+    'case "${target}" in' \
+    '    */.executor-master-key.????????/master.key) exit 78 ;;' \
+    'esac' \
+    'exec "${REAL_RM}" "$@"' > "${alias_cleanup_shim}/rm"
+chmod 0700 "${alias_cleanup_shim}/rm"
+if PATH="${alias_cleanup_shim}:${PATH}" REAL_RM="${real_rm}" \
+    executor_ensure_master_key \
+        "${staging_parent}" "${alias_cleanup_dir}" "${alias_cleanup_key}" \
+        "${CURRENT_UID}" "${CURRENT_GID}" 2>/dev/null; then
+    fail "recorded alias cleanup failure was ignored"
+fi
+assert "alias cleanup failure removed the recovery record" test \
+    -e "${staging_parent}/.executor-master-key.recovery"
+assert "alias cleanup failure changed the two-link key" test \
+    "$(stat --format='%h' -- "${alias_cleanup_key}")" = 2
+executor_ensure_master_key \
+    "${staging_parent}" "${alias_cleanup_dir}" "${alias_cleanup_key}" \
+    "${CURRENT_UID}" "${CURRENT_GID}"
+assert "alias cleanup retry changed the published key" cmp -s \
+    "${alias_cleanup_copy}" "${alias_cleanup_key}"
+pass "recorded alias cleanup failure remains safely retryable"
+
+alias_unlink_crash_dir="${test_root}/alias-unlink-crash"
+mkdir "${alias_unlink_crash_dir}"
+alias_unlink_crash_key="${alias_unlink_crash_dir}/master.key"
+if EXECUTOR_INSTALL_TEST_CRASH_AFTER_KEY_ALIAS_UNLINK=1 \
+    executor_ensure_master_key \
+        "${staging_parent}" "${alias_unlink_crash_dir}" \
+        "${alias_unlink_crash_key}" "${CURRENT_UID}" "${CURRENT_GID}" \
+        2>/dev/null; then
+    fail "alias-unlink crash injection reported success"
+fi
+assert "alias-unlink crash did not leave the published key" test \
+    -e "${alias_unlink_crash_key}"
+assert "alias-unlink crash left an additional key link" test \
+    "$(stat --format='%h' -- "${alias_unlink_crash_key}")" = 1
+alias_unlink_crash_copy="${test_root}/alias-unlink-crash.copy"
+cp "${alias_unlink_crash_key}" "${alias_unlink_crash_copy}"
+executor_ensure_master_key \
+    "${staging_parent}" "${alias_unlink_crash_dir}" \
+    "${alias_unlink_crash_key}" "${CURRENT_UID}" "${CURRENT_GID}"
+assert "alias-unlink recovery changed the key" cmp -s \
+    "${alias_unlink_crash_copy}" "${alias_unlink_crash_key}"
+pass "alias-unlink crash retires the durable recovery record"
+
+substitution_dir="${test_root}/recovery-substitution"
+mkdir "${substitution_dir}"
+substitution_key="${substitution_dir}/master.key"
+if EXECUTOR_INSTALL_TEST_CRASH_AFTER_KEY_DESTINATION_SYNC=1 \
+    executor_ensure_master_key \
+        "${staging_parent}" "${substitution_dir}" "${substitution_key}" \
+        "${CURRENT_UID}" "${CURRENT_GID}" 2>/dev/null; then
+    fail "substitution crash injection reported success"
+fi
+recovery_path="${staging_parent}/.executor-master-key.recovery"
+substitution_staging_name=$(awk '$1 == "staging" { print $2 }' "${recovery_path}")
+substitution_alias="${staging_parent}/${substitution_staging_name}/master.key"
+substitution_unknown_alias="${test_root}/unknown-master-key-alias"
+substitution_copy="${test_root}/recovery-substitution.copy"
+cp "${substitution_key}" "${substitution_copy}"
+rm -f -- "${substitution_alias}"
+ln "${substitution_key}" "${substitution_unknown_alias}"
+printf 'attacker-substitution-must-stay!' > "${substitution_alias}"
+chmod 0600 "${substitution_alias}"
+substitution_alias_copy="${test_root}/recovery-substitution-alias.copy"
+cp "${substitution_alias}" "${substitution_alias_copy}"
+if executor_ensure_master_key \
+    "${staging_parent}" "${substitution_dir}" "${substitution_key}" \
+    "${CURRENT_UID}" "${CURRENT_GID}" 2>/dev/null; then
+    fail "mismatched recorded staging alias was accepted"
+fi
+assert "failed substitution recovery changed the destination key" cmp -s \
+    "${substitution_copy}" "${substitution_key}"
+assert "failed substitution recovery changed the attacker file" cmp -s \
+    "${substitution_alias_copy}" "${substitution_alias}"
+assert "failed substitution recovery removed an unknown hard link" test \
+    -e "${substitution_unknown_alias}"
+rm -f -- "${substitution_alias}" "${substitution_unknown_alias}"
+executor_ensure_master_key \
+    "${staging_parent}" "${substitution_dir}" "${substitution_key}" \
+    "${CURRENT_UID}" "${CURRENT_GID}"
+assert "cleanup retry changed the destination key" cmp -s \
+    "${substitution_copy}" "${substitution_key}"
+pass "recovery rejects substituted and unknown master key aliases"
+
+foreign_with_alias_dir="${test_root}/foreign-destination-with-alias"
+mkdir "${foreign_with_alias_dir}"
+foreign_with_alias_key="${foreign_with_alias_dir}/master.key"
+if EXECUTOR_INSTALL_TEST_CRASH_AFTER_KEY_DESTINATION_SYNC=1 \
+    executor_ensure_master_key \
+        "${staging_parent}" "${foreign_with_alias_dir}" \
+        "${foreign_with_alias_key}" "${CURRENT_UID}" "${CURRENT_GID}" \
+        2>/dev/null; then
+    fail "foreign-destination alias crash injection reported success"
+fi
+recovery_path="${staging_parent}/.executor-master-key.recovery"
+foreign_staging_name=$(awk '$1 == "staging" { print $2 }' "${recovery_path}")
+foreign_recorded_alias="${staging_parent}/${foreign_staging_name}/master.key"
+foreign_recorded_copy="${test_root}/foreign-recorded-key.copy"
+cp "${foreign_recorded_alias}" "${foreign_recorded_copy}"
+rm -f -- "${foreign_with_alias_key}"
+printf 'foreign-destination-must-stay!!!' > "${foreign_with_alias_key}"
+chmod 0600 "${foreign_with_alias_key}"
+foreign_destination_copy="${test_root}/foreign-destination.copy"
+cp "${foreign_with_alias_key}" "${foreign_destination_copy}"
+if executor_ensure_master_key \
+    "${staging_parent}" "${foreign_with_alias_dir}" \
+    "${foreign_with_alias_key}" "${CURRENT_UID}" "${CURRENT_GID}" \
+    2>/dev/null; then
+    fail "foreign destination was accepted while the recorded alias existed"
+fi
+assert "foreign destination changed after failed recovery" cmp -s \
+    "${foreign_destination_copy}" "${foreign_with_alias_key}"
+assert "recorded alias changed after failed recovery" cmp -s \
+    "${foreign_recorded_copy}" "${foreign_recorded_alias}"
+assert "recovery record was retired after destination substitution" test \
+    -e "${recovery_path}"
+rm -f -- "${foreign_with_alias_key}"
+ln "${foreign_recorded_alias}" "${foreign_with_alias_key}"
+executor_ensure_master_key \
+    "${staging_parent}" "${foreign_with_alias_dir}" \
+    "${foreign_with_alias_key}" "${CURRENT_UID}" "${CURRENT_GID}"
+assert "restored recorded key changed during recovery" cmp -s \
+    "${foreign_recorded_copy}" "${foreign_with_alias_key}"
+pass "recovery preserves a recorded alias when the destination is foreign"
+
+foreign_without_alias_dir="${test_root}/foreign-destination-without-alias"
+mkdir "${foreign_without_alias_dir}"
+foreign_without_alias_key="${foreign_without_alias_dir}/master.key"
+if EXECUTOR_INSTALL_TEST_CRASH_AFTER_KEY_DESTINATION_SYNC=1 \
+    executor_ensure_master_key \
+        "${staging_parent}" "${foreign_without_alias_dir}" \
+        "${foreign_without_alias_key}" "${CURRENT_UID}" "${CURRENT_GID}" \
+        2>/dev/null; then
+    fail "foreign-destination no-alias crash injection reported success"
+fi
+recovery_path="${staging_parent}/.executor-master-key.recovery"
+foreign_staging_name=$(awk '$1 == "staging" { print $2 }' "${recovery_path}")
+foreign_recorded_alias="${staging_parent}/${foreign_staging_name}/master.key"
+rm -f -- "${foreign_without_alias_key}" "${foreign_recorded_alias}"
+printf 'foreign-destination-must-stay!!!' > "${foreign_without_alias_key}"
+chmod 0600 "${foreign_without_alias_key}"
+foreign_destination_copy="${test_root}/foreign-no-alias-destination.copy"
+cp "${foreign_without_alias_key}" "${foreign_destination_copy}"
+if executor_ensure_master_key \
+    "${staging_parent}" "${foreign_without_alias_dir}" \
+    "${foreign_without_alias_key}" "${CURRENT_UID}" "${CURRENT_GID}" \
+    2>/dev/null; then
+    fail "foreign destination was accepted after the recorded alias disappeared"
+fi
+assert "foreign no-alias destination changed after failed recovery" cmp -s \
+    "${foreign_destination_copy}" "${foreign_without_alias_key}"
+assert "no-alias recovery record was retired after substitution" test \
+    -e "${recovery_path}"
+rm -f -- "${foreign_without_alias_key}"
+executor_ensure_master_key \
+    "${staging_parent}" "${foreign_without_alias_dir}" \
+    "${foreign_without_alias_key}" "${CURRENT_UID}" "${CURRENT_GID}"
+assert "cleanup retry did not create a valid key" test \
+    "$(stat --format='%s:%h:%a' -- "${foreign_without_alias_key}")" = 32:1:600
+pass "recovery preserves state when a foreign destination has no recorded alias"
+
+attack_dir="${test_root}/temp-swap"
+attack_shim_dir="${test_root}/temp-swap-shim"
+mkdir "${attack_dir}" "${attack_shim_dir}"
+attack_key="${attack_dir}/master.key"
+attack_victim="${test_root}/temp-swap-victim"
+attack_victim_copy="${test_root}/temp-swap-victim.copy"
+printf 'victim-must-remain-byte-for-byte!' > "${attack_victim}"
+cp "${attack_victim}" "${attack_victim_copy}"
+real_dd=$(command -v dd)
+real_ln=$(command -v ln)
+printf '%s\n' \
+    '#!/usr/bin/env bash' \
+    'set -euo pipefail' \
+    'output_path=""' \
+    'for argument in "$@"; do' \
+    '    case "${argument}" in' \
+    '        of=*) output_path=${argument#of=} ;;' \
+    '    esac' \
+    'done' \
+    'printf seen > "${DD_SEEN}"' \
+    'case "${output_path}" in' \
+    '    "${ATTACKER_DATA_DIR}"/.master.key.*)' \
+    '        printf attacked > "${ATTACK_TRIGGER}"' \
+    '        rm -f -- "${output_path}"' \
+    '        "${REAL_LN}" -s -- "${ATTACKER_VICTIM}" "${output_path}"' \
+    '        ;;' \
+    'esac' \
+    'exec "${REAL_DD}" "$@"' > "${attack_shim_dir}/dd"
+printf '%s\n' \
+    '#!/usr/bin/env bash' \
+    'set -euo pipefail' \
+    'source_path=""' \
+    'destination=""' \
+    'for argument in "$@"; do' \
+    '    source_path=${destination}' \
+    '    destination=${argument}' \
+    'done' \
+    'printf seen > "${LN_SEEN}"' \
+    'case "${source_path}" in' \
+    '    "${ATTACKER_DATA_DIR}"/.master.key.*)' \
+    '        printf attacked > "${ATTACK_TRIGGER}"' \
+    '        rm -f -- "${source_path}"' \
+    '        "${REAL_LN}" -s -- "${ATTACKER_VICTIM}" "${source_path}"' \
+    '        ;;' \
+    'esac' \
+    'exec "${REAL_LN}" "$@"' > "${attack_shim_dir}/ln"
+chmod 0700 "${attack_shim_dir}/dd" "${attack_shim_dir}/ln"
+attack_trigger="${test_root}/temp-swap-trigger"
+dd_seen="${test_root}/temp-swap-dd-seen"
+ln_seen="${test_root}/temp-swap-ln-seen"
+PATH="${attack_shim_dir}:${PATH}" \
+    ATTACKER_DATA_DIR="${attack_dir}" \
+    ATTACKER_VICTIM="${attack_victim}" \
+    ATTACK_TRIGGER="${attack_trigger}" \
+    DD_SEEN="${dd_seen}" \
+    LN_SEEN="${ln_seen}" \
+    REAL_DD="${real_dd}" \
+    REAL_LN="${real_ln}" \
+    executor_ensure_master_key \
+        "${staging_parent}" "${attack_dir}" "${attack_key}" \
+        "${CURRENT_UID}" "${CURRENT_GID}"
+assert "adversarial dd shim did not run" test -e "${dd_seen}"
+assert "adversarial ln shim did not run" test -e "${ln_seen}"
+assert "attacker reached a temporary key in the data directory" test \
+    ! -e "${attack_trigger}"
+assert "temporary key swap changed the victim" cmp -s \
+    "${attack_victim_copy}" "${attack_victim}"
+assert "staged key was not published" test -e "${attack_key}"
+pass "temporary key stays outside the executor-owned data directory"
+
+directory_race_dir="${test_root}/directory-race"
+directory_race_target="${test_root}/directory-race-target"
+directory_race_shim="${test_root}/directory-race-shim"
+mkdir "${directory_race_dir}" "${directory_race_target}" \
+    "${directory_race_shim}"
+directory_race_key="${directory_race_dir}/master.key"
+printf '%s\n' \
+    '#!/usr/bin/env bash' \
+    'set -euo pipefail' \
+    'destination=${!#}' \
+    '"${REAL_LN}" -s -- "${RACE_DIRECTORY}" "${destination}"' \
+    'exec "${REAL_LN}" "$@"' > "${directory_race_shim}/ln"
+chmod 0700 "${directory_race_shim}/ln"
+if PATH="${directory_race_shim}:${PATH}" \
+    REAL_LN="${real_ln}" \
+    RACE_DIRECTORY="${directory_race_target}" \
+    executor_ensure_master_key \
+        "${staging_parent}" "${directory_race_dir}" \
+        "${directory_race_key}" "${CURRENT_UID}" "${CURRENT_GID}" \
+        2>/dev/null; then
+    fail "destination symlink to a directory was accepted"
+fi
+assert "directory-race destination is not a symlink" test \
+    -L "${directory_race_key}"
+if find "${directory_race_target}" -mindepth 1 -print -quit | read -r _; then
+    fail "key was linked inside a racing destination directory"
+fi
+pass "destination symlink to a directory cannot redirect publication"
+
+sentinel_dir="${test_root}/sentinel"
+shim_dir="${test_root}/shim"
+mkdir "${sentinel_dir}" "${shim_dir}"
+printf '%s\n' \
+    '#!/usr/bin/env bash' \
+    'set -euo pipefail' \
+    'destination=${!#}' \
+    'printf sentinel > "${destination}"' \
+    'exec "${REAL_LN}" "$@"' > "${shim_dir}/ln"
+chmod 0700 "${shim_dir}/ln"
+sentinel_key="${sentinel_dir}/master.key"
+if PATH="${shim_dir}:${PATH}" REAL_LN="${real_ln}" \
+    executor_ensure_master_key \
+        "${staging_parent}" "${sentinel_dir}" "${sentinel_key}" \
+        "${CURRENT_UID}" "${CURRENT_GID}" 2>/dev/null; then
+    fail "racing sentinel was overwritten"
+fi
+assert "racing sentinel content changed" test \
+    "$(cat "${sentinel_key}")" = sentinel
+if compgen -G "${sentinel_dir}/.master.key.*" >/dev/null; then
+    fail "temporary key remained after publication race"
+fi
+pass "racing sentinel is preserved and temporary key is removed"
+
+if [[ ${EUID} -eq 0 ]]; then
+    wrong_owner_dir="${test_root}/wrong-owner"
+    mkdir "${wrong_owner_dir}"
+    wrong_owner_key="${wrong_owner_dir}/master.key"
+    printf '76543210fedcba9876543210fedcba98' > "${wrong_owner_key}"
+    chmod 0600 "${wrong_owner_key}"
+    if executor_ensure_master_key \
+        "${staging_parent}" "${wrong_owner_dir}" \
+        "${wrong_owner_key}" 65534 65534 \
+        2>/dev/null; then
+        fail "wrong-owner key was accepted"
+    fi
+    assert "wrong-owner key ownership was changed" test \
+        "$(stat --format='%u:%g' -- "${wrong_owner_key}")" = 0:0
+    pass "root does not repair an existing key's ownership"
+
+    alternate_dir="${test_root}/alternate-owner"
+    mkdir "${alternate_dir}"
+    alternate_key="${alternate_dir}/master.key"
+    executor_ensure_master_key \
+        "${staging_parent}" "${alternate_dir}" \
+        "${alternate_key}" 65534 65534
+    assert "root-created key has the wrong owner" test \
+        "$(stat --format='%u:%g' -- "${alternate_key}")" = 65534:65534
+    pass "root publishes ownership before exposing the key"
+else
+    TEST_NUMBER=$((TEST_NUMBER + 1))
+    printf 'ok %s - root leaves wrong ownership unchanged # SKIP requires root\n' \
+        "${TEST_NUMBER}"
+    TEST_NUMBER=$((TEST_NUMBER + 1))
+    printf 'ok %s - root publishes alternate ownership # SKIP requires root\n' \
+        "${TEST_NUMBER}"
+fi
+
+if find "${staging_parent}" -mindepth 1 \
+    ! -name '.executor-master-key.lock' -print -quit | read -r _; then
+    fail "private master key staging directory was not cleaned up"
+fi
+assert "persistent master key lock has unsafe metadata" test \
+    "$(stat --format='%F:%u:%a:%h:%s' -- \
+        "${staging_parent}/.executor-master-key.lock")" = \
+    "regular empty file:${CURRENT_UID}:600:1:0"
+
+printf '1..%s\n' "${TEST_NUMBER}"
diff --git a/scripts/verify-apple-toolchain.sh b/scripts/verify-apple-toolchain.sh
new file mode 100644
index 000000000..9bfc1f49a
--- /dev/null
+++ b/scripts/verify-apple-toolchain.sh
@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ "$#" -ne 6 ]]; then
+    printf 'Usage: %s <developer-dir> <xcode-version> <xcode-build> <sdk-version> <clang-version> <ld-version>\n' "$0" >&2
+    exit 2
+fi
+
+developer_dir=$1
+expected_xcode_version=$2
+expected_xcode_build=$3
+expected_sdk_version=$4
+expected_clang_version=$5
+expected_ld_version=$6
+
+[[ -d "$developer_dir" && ! -L "$developer_dir" ]] \
+    || { printf 'Pinned Xcode developer directory is unavailable: %s\n' "$developer_dir" >&2; exit 1; }
+
+export DEVELOPER_DIR="$developer_dir"
+
+xcode_info="$(xcodebuild -version)"
+expected_xcode_info="$(printf 'Xcode %s\nBuild version %s' \
+    "$expected_xcode_version" \
+    "$expected_xcode_build")"
+[[ "$xcode_info" == "$expected_xcode_info" ]] \
+    || { printf 'Unexpected Xcode identity:\n%s\n' "$xcode_info" >&2; exit 1; }
+
+sdk_version="$(xcrun --sdk macosx --show-sdk-version)"
+[[ "$sdk_version" == "$expected_sdk_version" ]] \
+    || { printf 'Unexpected macOS SDK version: %s\n' "$sdk_version" >&2; exit 1; }
+sdk_path="$(xcrun --sdk macosx --show-sdk-path)"
+[[ "$sdk_path" == */"MacOSX${expected_sdk_version}.sdk" ]] \
+    || { printf 'Unexpected macOS SDK path: %s\n' "$sdk_path" >&2; exit 1; }
+
+clang_info="$(xcrun clang --version)"
+clang_banner="${clang_info%%$'\n'*}"
+[[ "$clang_banner" == "$expected_clang_version" ]] \
+    || { printf 'Unexpected Apple clang version: %s\n' "$clang_banner" >&2; exit 1; }
+
+ld_info="$(xcrun ld -v 2>&1)"
+ld_banner="${ld_info%%$'\n'*}"
+[[ "$ld_banner" == "@(#)PROGRAM:ld PROJECT:ld-${expected_ld_version}" ]] \
+    || { printf 'Unexpected Apple ld version: %s\n' "$ld_banner" >&2; exit 1; }
+
+toolchain_bin="${developer_dir}/Toolchains/XcodeDefault.xctoolchain/usr/bin"
+[[ "$(xcrun --find clang)" == "${toolchain_bin}/clang" ]] \
+    || { printf 'xcrun resolved clang outside the pinned Xcode toolchain\n' >&2; exit 1; }
+[[ "$(xcrun --find ld)" == "${toolchain_bin}/ld" ]] \
+    || { printf 'xcrun resolved ld outside the pinned Xcode toolchain\n' >&2; exit 1; }
+
+printf 'Verified Xcode %s (%s), macOS SDK %s, %s, and ld-%s\n' \
+    "$expected_xcode_version" \
+    "$expected_xcode_build" \
+    "$expected_sdk_version" \
+    "$expected_clang_version" \
+    "$expected_ld_version"
diff --git a/scripts/verify-release-index.py b/scripts/verify-release-index.py
new file mode 100644
index 000000000..44d9e9b19
--- /dev/null
+++ b/scripts/verify-release-index.py
@@ -0,0 +1,59 @@
+#!/usr/bin/env python3
+import argparse
+import json
+import sys
+
+
+EXPECTED_PLATFORMS = {
+    ("linux", "amd64"),
+    ("linux", "arm64"),
+}
+VERSION_ANNOTATION = "org.opencontainers.image.version"
+
+
+def parse_args():
+    parser = argparse.ArgumentParser(
+        description="Verify the release OCI index platforms and version annotation"
+    )
+    parser.add_argument("--version", required=True)
+    return parser.parse_args()
+
+
+def main():
+    args = parse_args()
+    try:
+        index = json.load(sys.stdin)
+    except json.JSONDecodeError as error:
+        raise SystemExit(f"release index is not valid JSON: {error}") from error
+    if not isinstance(index, dict):
+        raise SystemExit("release index must be a JSON object")
+
+    annotations = index.get("annotations")
+    if not isinstance(annotations, dict):
+        raise SystemExit("release index has no annotations object")
+    if annotations.get(VERSION_ANNOTATION) != args.version:
+        raise SystemExit(
+            f"release index version annotation does not equal {args.version}"
+        )
+
+    manifests = index.get("manifests")
+    if not isinstance(manifests, list):
+        raise SystemExit("release index has no manifests array")
+    platforms = []
+    for manifest in manifests:
+        if not isinstance(manifest, dict) or not isinstance(manifest.get("platform"), dict):
+            raise SystemExit("release index contains a manifest without a platform")
+        platform = manifest["platform"]
+        operating_system = platform.get("os")
+        architecture = platform.get("architecture")
+        if not isinstance(operating_system, str) or not isinstance(architecture, str):
+            raise SystemExit("release index contains an invalid platform")
+        platforms.append((operating_system, architecture))
+    if len(platforms) != len(EXPECTED_PLATFORMS) or set(platforms) != EXPECTED_PLATFORMS:
+        raise SystemExit(f"release index has unexpected platforms: {platforms}")
+
+    print(f"verified release index for {args.version}")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/src/actor.rs b/src/actor.rs
new file mode 100644
index 000000000..d54fee5b3
--- /dev/null
+++ b/src/actor.rs
@@ -0,0 +1,109 @@
+use serde::Serialize;
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum ActorKind {
+    ApiToken,
+    Admin,
+    System,
+}
+
+impl ActorKind {
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::ApiToken => "api_token",
+            Self::Admin => "admin",
+            Self::System => "system",
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum SystemActor {
+    LocalCli,
+}
+
+impl SystemActor {
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::LocalCli => "local_cli",
+        }
+    }
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub enum ToolActor {
+    ApiToken {
+        id: String,
+        name_snapshot: Option<String>,
+    },
+    Admin {
+        id: i64,
+    },
+    System(SystemActor),
+}
+
+impl ToolActor {
+    pub fn api_token(id: impl Into<String>, name_snapshot: Option<String>) -> Self {
+        Self::ApiToken {
+            id: id.into(),
+            name_snapshot,
+        }
+    }
+
+    pub const fn admin(id: i64) -> Self {
+        Self::Admin { id }
+    }
+
+    pub const fn local_cli() -> Self {
+        Self::System(SystemActor::LocalCli)
+    }
+
+    pub const fn kind(&self) -> ActorKind {
+        match self {
+            Self::ApiToken { .. } => ActorKind::ApiToken,
+            Self::Admin { .. } => ActorKind::Admin,
+            Self::System(_) => ActorKind::System,
+        }
+    }
+
+    pub fn id(&self) -> String {
+        match self {
+            Self::ApiToken { id, .. } => id.clone(),
+            Self::Admin { id } => id.to_string(),
+            Self::System(actor) => actor.as_str().to_owned(),
+        }
+    }
+
+    pub fn name_snapshot(&self) -> Option<&str> {
+        match self {
+            Self::ApiToken { name_snapshot, .. } => name_snapshot.as_deref(),
+            Self::Admin { .. } | Self::System(_) => None,
+        }
+    }
+
+    pub fn api_token_id(&self) -> Option<&str> {
+        match self {
+            Self::ApiToken { id, .. } => Some(id),
+            Self::Admin { .. } | Self::System(_) => None,
+        }
+    }
+
+    pub(crate) fn from_stored(
+        kind: &str,
+        id: String,
+        api_token_id: Option<String>,
+        name_snapshot: Option<String>,
+    ) -> Option<Self> {
+        match kind {
+            "api_token" if api_token_id.as_deref() == Some(id.as_str()) => {
+                Some(Self::ApiToken { id, name_snapshot })
+            }
+            "admin" if api_token_id.is_none() => id.parse().ok().map(|id| Self::Admin { id }),
+            "system" if api_token_id.is_none() && id == SystemActor::LocalCli.as_str() => {
+                Some(Self::System(SystemActor::LocalCli))
+            }
+            _ => None,
+        }
+    }
+}
diff --git a/src/api.rs b/src/api.rs
new file mode 100644
index 000000000..91942ee16
--- /dev/null
+++ b/src/api.rs
@@ -0,0 +1,1712 @@
+use std::{
+    collections::{HashMap, VecDeque},
+    future::Future,
+    net::{IpAddr, SocketAddr},
+    sync::{Arc, Mutex},
+    time::{Duration, Instant},
+};
+
+use axum::{
+    Json, Router,
+    extract::{
+        ConnectInfo, DefaultBodyLimit, Extension, FromRequestParts, Path, State,
+        rejection::JsonRejection,
+    },
+    http::{HeaderMap, HeaderValue, Method, StatusCode, Uri, header, request::Parts},
+    middleware::{self, Next},
+    response::{IntoResponse, Response},
+    routing::{delete, get, post},
+};
+use ipnet::IpNet;
+use serde::{Deserialize, Serialize};
+use subtle::ConstantTimeEq;
+use tokio::sync::{OwnedSemaphorePermit, Semaphore, oneshot};
+use uuid::Uuid;
+
+use crate::{
+    AppConfig,
+    catalog::CatalogStore,
+    crypto::{generate_secret, hash_password, verify_password},
+    database::{Database, SETUP_TOKEN_TTL_SECONDS},
+    execution::ExecutionService,
+    invocation::ToolCallService,
+    mcp::downstream::McpState,
+    oauth::OAuthService,
+    protocols::SourceService,
+    request_logs::RequestLogSink,
+    tasks::TaskTracker,
+    unix_timestamp,
+};
+
+mod approvals;
+mod catalog;
+mod oauth;
+pub(crate) mod openapi;
+mod protocols;
+mod token_delivery;
+
+const SESSION_COOKIE: &str = "executor_session";
+const CSRF_COOKIE: &str = "executor_csrf";
+const CSRF_HEADER: &str = "x-executor-csrf";
+const MAX_API_BODY_BYTES: usize = 16 * 1024;
+const PASSWORD_HASH_CONCURRENCY: usize = 2;
+const MAX_USERNAME_CHARACTERS: usize = 64;
+const MAX_USERNAME_BYTES: usize = 256;
+const MIN_PASSWORD_CHARACTERS: usize = 12;
+const MAX_PASSWORD_BYTES: usize = 1024;
+const MAX_SETUP_TOKEN_BYTES: usize = 128;
+const MAX_TOKEN_NAME_CHARACTERS: usize = 80;
+const MAX_TOKEN_NAME_BYTES: usize = 320;
+const LOGIN_ATTEMPT_LIMIT: usize = 5;
+const LOGIN_ATTEMPT_WINDOW: Duration = Duration::from_secs(60);
+const MAX_LOGIN_RATE_LIMIT_CLIENTS: usize = 4096;
+const MAX_FORWARDED_FOR_HOPS: usize = 64;
+const MAX_FORWARDED_FOR_BYTES: usize = 4 * 1024;
+const X_FORWARDED_FOR: &str = "x-forwarded-for";
+const IDEMPOTENCY_KEY: &str = "idempotency-key";
+const IDEMPOTENCY_REPLAYED: &str = "idempotency-replayed";
+const REVOKE_RECONCILED: &str = "revoke-reconciled";
+const TOKEN_LAST_USED_WRITE_INTERVAL_SECONDS: i64 = 60;
+const TOKEN_LAST_USED_WRITE_INTERVAL: Duration = Duration::from_secs(60);
+const MAX_TOKEN_LAST_USED_ATTEMPTS: usize = 4096;
+
+#[derive(Clone)]
+struct AppState {
+    database: Database,
+    catalog: CatalogStore,
+    sources: SourceService,
+    tool_calls: ToolCallService,
+    execution: ExecutionService,
+    mcp: McpState,
+    oauth: OAuthService,
+    request_logs: RequestLogSink,
+    origin: Arc<str>,
+    session_ttl_seconds: i64,
+    secure_cookies: bool,
+    password_hash_slots: Arc<Semaphore>,
+    gateway_search_slots: Arc<Semaphore>,
+    dummy_password_hash: Arc<str>,
+    login_rate_limiter: Arc<LoginRateLimiter>,
+    token_last_used_tracker: Arc<TokenLastUsedTracker>,
+    trusted_proxies: Arc<[IpNet]>,
+    background_tasks: TaskTracker,
+    source_creation_supervisors: protocols::SourceCreationSupervisorRegistry,
+}
+
+#[derive(Clone)]
+struct RequestId(String);
+
+#[derive(Clone, Hash, Eq, PartialEq)]
+enum LoginClientKey {
+    PeerIp(IpAddr),
+    InProcess,
+    InvalidForwardedChain(&'static str),
+}
+
+struct LoginRateLimiter {
+    attempts: Mutex<HashMap<LoginClientKey, VecDeque<Instant>>>,
+}
+
+struct TokenLastUsedTracker {
+    attempts: Mutex<HashMap<String, Instant>>,
+    write_slot: Arc<Semaphore>,
+}
+
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+struct ErrorEnvelope {
+    error: ErrorDetail,
+}
+
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+struct ErrorDetail {
+    code: &'static str,
+    message: String,
+    request_id: String,
+}
+
+struct ApiError {
+    status: StatusCode,
+    code: &'static str,
+    message: String,
+    request_id: String,
+    retry_after_seconds: Option<u64>,
+}
+
+impl ApiError {
+    fn new(
+        request_id: &RequestId,
+        status: StatusCode,
+        code: &'static str,
+        message: impl Into<String>,
+    ) -> Self {
+        Self {
+            status,
+            code,
+            message: message.into(),
+            request_id: request_id.0.clone(),
+            retry_after_seconds: None,
+        }
+    }
+
+    fn unauthorized(request_id: &RequestId, message: impl Into<String>) -> Self {
+        Self::new(
+            request_id,
+            StatusCode::UNAUTHORIZED,
+            "unauthorized",
+            message,
+        )
+    }
+
+    fn internal(request_id: &RequestId) -> Self {
+        Self::new(
+            request_id,
+            StatusCode::INTERNAL_SERVER_ERROR,
+            "internal_error",
+            "The request could not be completed.",
+        )
+    }
+
+    fn internal_logged(request_id: &RequestId, error: impl std::fmt::Display) -> Self {
+        tracing::error!(request_id = %request_id.0, error = %error, "control API request failed");
+        Self::internal(request_id)
+    }
+
+    fn password_work_saturated(request_id: &RequestId) -> Self {
+        Self::new(
+            request_id,
+            StatusCode::TOO_MANY_REQUESTS,
+            "password_work_saturated",
+            "Password verification is busy. Try again shortly.",
+        )
+        .with_retry_after(1)
+    }
+
+    fn login_rate_limited(request_id: &RequestId, retry_after_seconds: u64) -> Self {
+        Self::new(
+            request_id,
+            StatusCode::TOO_MANY_REQUESTS,
+            "login_rate_limited",
+            "Too many login attempts. Try again later.",
+        )
+        .with_retry_after(retry_after_seconds)
+    }
+
+    fn with_retry_after(mut self, retry_after_seconds: u64) -> Self {
+        self.retry_after_seconds = Some(retry_after_seconds);
+        self
+    }
+}
+
+impl IntoResponse for ApiError {
+    fn into_response(self) -> Response {
+        let retry_after_seconds = self.retry_after_seconds;
+        let mut response = (
+            self.status,
+            Json(ErrorEnvelope {
+                error: ErrorDetail {
+                    code: self.code,
+                    message: self.message,
+                    request_id: self.request_id,
+                },
+            }),
+        )
+            .into_response();
+        if let Some(retry_after_seconds) = retry_after_seconds {
+            response.headers_mut().insert(
+                header::RETRY_AFTER,
+                HeaderValue::from_str(&retry_after_seconds.to_string())
+                    .expect("retry delays are valid header values"),
+            );
+        }
+        response
+    }
+}
+
+impl LoginRateLimiter {
+    fn new() -> Self {
+        Self {
+            attempts: Mutex::new(HashMap::new()),
+        }
+    }
+
+    fn check(&self, client: &LoginClientKey) -> Result<(), u64> {
+        let now = Instant::now();
+        let cutoff = now.checked_sub(LOGIN_ATTEMPT_WINDOW).unwrap_or(now);
+        let mut attempts_by_client = self
+            .attempts
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+
+        attempts_by_client.retain(|_, attempts| {
+            while attempts.front().is_some_and(|attempt| *attempt <= cutoff) {
+                attempts.pop_front();
+            }
+            !attempts.is_empty()
+        });
+
+        if !attempts_by_client.contains_key(client)
+            && attempts_by_client.len() >= MAX_LOGIN_RATE_LIMIT_CLIENTS
+        {
+            let oldest_client = attempts_by_client
+                .iter()
+                .filter_map(|(client, attempts)| attempts.front().map(|attempt| (client, attempt)))
+                .min_by_key(|(_, attempt)| *attempt)
+                .map(|(client, _)| client.clone());
+            if let Some(oldest_client) = oldest_client {
+                attempts_by_client.remove(&oldest_client);
+            }
+        }
+
+        let attempts = attempts_by_client.entry(client.clone()).or_default();
+        if attempts.len() >= LOGIN_ATTEMPT_LIMIT {
+            let oldest = attempts.front().copied().unwrap_or(now);
+            let remaining = LOGIN_ATTEMPT_WINDOW.saturating_sub(now.duration_since(oldest));
+            return Err(remaining.as_secs().max(1));
+        }
+        attempts.push_back(now);
+        Ok(())
+    }
+
+    fn clear(&self, client: &LoginClientKey) {
+        self.attempts
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+            .remove(client);
+    }
+}
+
+impl TokenLastUsedTracker {
+    fn new() -> Self {
+        Self {
+            attempts: Mutex::new(HashMap::new()),
+            write_slot: Arc::new(Semaphore::new(1)),
+        }
+    }
+
+    fn schedule(
+        self: &Arc<Self>,
+        database: Database,
+        token_id: String,
+        used_at: i64,
+        request_id: String,
+        background_tasks: &TaskTracker,
+    ) {
+        let attempted_at = Instant::now();
+        let mut attempts = self
+            .attempts
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        attempts.retain(|_, previous_attempt| {
+            attempted_at.saturating_duration_since(*previous_attempt)
+                < TOKEN_LAST_USED_WRITE_INTERVAL
+        });
+        if attempts.contains_key(&token_id) {
+            return;
+        }
+        let Ok(permit) = self.write_slot.clone().try_acquire_owned() else {
+            return;
+        };
+        if attempts.len() >= MAX_TOKEN_LAST_USED_ATTEMPTS
+            && let Some(oldest) = attempts
+                .iter()
+                .min_by_key(|(_, attempted_at)| *attempted_at)
+                .map(|(token_id, _)| token_id.clone())
+        {
+            attempts.remove(&oldest);
+        }
+        attempts.insert(token_id.clone(), attempted_at);
+        drop(attempts);
+
+        let tracker = Arc::clone(self);
+        background_tasks.spawn(async move {
+            let _permit = permit;
+            let database_guard = database;
+            let result = sqlx::query(
+                "UPDATE api_tokens SET last_used_at = ? WHERE id = ? AND revoked_at IS NULL \
+                 AND (last_used_at IS NULL OR last_used_at <= ?)",
+            )
+            .bind(used_at)
+            .bind(&token_id)
+            .bind(used_at - TOKEN_LAST_USED_WRITE_INTERVAL_SECONDS)
+            .execute(&database_guard.pool)
+            .await;
+            if let Err(error) = result {
+                tracker.clear_failed_attempt(&token_id, attempted_at);
+                tracing::warn!(request_id, error = %error, "API token last-used update failed");
+            }
+            drop(database_guard);
+        });
+    }
+
+    fn clear_failed_attempt(&self, token_id: &str, attempted_at: Instant) {
+        let mut attempts = self
+            .attempts
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        if attempts.get(token_id) == Some(&attempted_at) {
+            attempts.remove(token_id);
+        }
+    }
+}
+
+#[derive(Serialize)]
+struct HealthResponse {
+    status: &'static str,
+}
+
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+struct BootstrapResponse {
+    setup_required: bool,
+    authenticated: bool,
+}
+
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct SetupRequest {
+    setup_token: String,
+    username: String,
+    password: String,
+}
+
+#[derive(Deserialize)]
+struct LoginRequest {
+    username: String,
+    password: String,
+}
+
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+struct SessionResponse {
+    username: String,
+    csrf_token: Option<String>,
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct CreateTokenRequest {
+    name: String,
+}
+
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+struct CreatedTokenResponse {
+    id: String,
+    name: String,
+    token: String,
+    created_at: i64,
+}
+
+#[derive(Serialize, sqlx::FromRow)]
+#[serde(rename_all = "camelCase")]
+struct TokenMetadata {
+    id: String,
+    name: String,
+    masked_token: String,
+    created_at: i64,
+    last_used_at: Option<i64>,
+    revoked_at: Option<i64>,
+}
+
+#[derive(Serialize)]
+struct TokenListResponse {
+    tokens: Vec<TokenMetadata>,
+}
+
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+struct GatewayIdentityResponse {
+    token_id: String,
+    token_name: String,
+}
+
+struct GatewayIdentity {
+    token_id: String,
+    token_name: String,
+}
+
+struct AdminMutation(i64);
+
+struct AdminAuthentication(i64);
+
+struct GatewayAuthentication(GatewayIdentity);
+
+pub(crate) struct ApiServices {
+    sources: SourceService,
+    tool_calls: ToolCallService,
+    execution: ExecutionService,
+    mcp: McpState,
+    oauth: OAuthService,
+}
+
+impl ApiServices {
+    pub(crate) fn new(
+        sources: SourceService,
+        tool_calls: ToolCallService,
+        execution: ExecutionService,
+        mcp: McpState,
+        oauth: OAuthService,
+    ) -> Self {
+        Self {
+            sources,
+            tool_calls,
+            execution,
+            mcp,
+            oauth,
+        }
+    }
+}
+
+struct AdminSession {
+    id: i64,
+    username: String,
+    session_digest: Vec<u8>,
+    csrf_digest: Vec<u8>,
+}
+
+impl FromRequestParts<AppState> for AdminMutation {
+    type Rejection = ApiError;
+
+    async fn from_request_parts(
+        parts: &mut Parts,
+        state: &AppState,
+    ) -> Result<Self, Self::Rejection> {
+        let request_id = parts
+            .extensions
+            .get::<RequestId>()
+            .expect("request ID middleware runs before authentication")
+            .clone();
+        let admin = require_admin_mutation(&request_id, state, &parts.headers).await?;
+        Ok(Self(admin.id))
+    }
+}
+
+impl FromRequestParts<AppState> for AdminAuthentication {
+    type Rejection = ApiError;
+
+    async fn from_request_parts(
+        parts: &mut Parts,
+        state: &AppState,
+    ) -> Result<Self, Self::Rejection> {
+        let request_id = parts
+            .extensions
+            .get::<RequestId>()
+            .expect("request ID middleware runs before authentication")
+            .clone();
+        let admin = require_admin(&request_id, state, &parts.headers).await?;
+        Ok(Self(admin.id))
+    }
+}
+
+impl FromRequestParts<AppState> for GatewayAuthentication {
+    type Rejection = ApiError;
+
+    async fn from_request_parts(
+        parts: &mut Parts,
+        state: &AppState,
+    ) -> Result<Self, Self::Rejection> {
+        let request_id = parts
+            .extensions
+            .get::<RequestId>()
+            .expect("request ID middleware runs before authentication")
+            .clone();
+        let identity = require_gateway_token(&request_id, state, &parts.headers).await?;
+        Ok(Self(identity))
+    }
+}
+
+pub(crate) fn router(
+    database: Database,
+    catalog: CatalogStore,
+    services: ApiServices,
+    request_logs: RequestLogSink,
+    background_tasks: TaskTracker,
+    config: &AppConfig,
+    dummy_password_hash: String,
+) -> Router {
+    let gateway_search_slots = services.tool_calls.discovery_slots();
+    let state = AppState {
+        database,
+        catalog,
+        sources: services.sources,
+        tool_calls: services.tool_calls,
+        execution: services.execution,
+        mcp: services.mcp,
+        oauth: services.oauth,
+        request_logs,
+        origin: Arc::from(config.public_origin()),
+        session_ttl_seconds: config.session_ttl_seconds,
+        secure_cookies: config.origin.scheme() == "https",
+        password_hash_slots: Arc::new(Semaphore::new(PASSWORD_HASH_CONCURRENCY)),
+        gateway_search_slots,
+        dummy_password_hash: Arc::from(dummy_password_hash),
+        login_rate_limiter: Arc::new(LoginRateLimiter::new()),
+        token_last_used_tracker: Arc::new(TokenLastUsedTracker::new()),
+        trusted_proxies: config.trusted_proxies.clone(),
+        background_tasks,
+        source_creation_supervisors: protocols::SourceCreationSupervisorRegistry::default(),
+    };
+    let middleware_state = state.clone();
+
+    Router::new()
+        .route("/healthz", get(health))
+        .route("/api/v1/bootstrap", get(bootstrap))
+        .route("/api/v1/setup", post(setup))
+        .route("/api/v1/session", post(login).get(session).delete(logout))
+        .route("/api/v1/tokens", get(list_tokens).post(create_token))
+        .route("/api/v1/tokens/{id}", delete(revoke_token))
+        .route("/api/v1/gateway/whoami", get(gateway_whoami))
+        .merge(catalog::router())
+        .merge(approvals::router())
+        .merge(protocols::router())
+        .merge(openapi::router())
+        .merge(oauth::router())
+        .merge(crate::mcp::downstream::router(state.mcp.clone()))
+        .fallback(not_found)
+        .method_not_allowed_fallback(method_not_allowed)
+        .with_state(state)
+        .layer(DefaultBodyLimit::max(MAX_API_BODY_BYTES))
+        .layer(middleware::from_fn_with_state(
+            middleware_state,
+            request_id_middleware,
+        ))
+}
+
+async fn request_id_middleware(
+    State(state): State<AppState>,
+    mut request: axum::extract::Request,
+    next: Next,
+) -> Response {
+    let request_id = RequestId(Uuid::new_v4().to_string());
+    let peer_ip = request
+        .extensions()
+        .get::<ConnectInfo<SocketAddr>>()
+        .map(|ConnectInfo(peer)| canonical_ip(peer.ip()));
+    let login_client = login_client_key(peer_ip, request.headers(), &state.trusted_proxies);
+    request.extensions_mut().insert(request_id.clone());
+    request.extensions_mut().insert(login_client);
+    let mut response = next.run(request).await;
+    response.headers_mut().insert(
+        "x-request-id",
+        HeaderValue::from_str(&request_id.0).expect("UUID request IDs are valid headers"),
+    );
+    response
+        .headers_mut()
+        .entry(header::CACHE_CONTROL)
+        .or_insert(HeaderValue::from_static("no-store"));
+    response
+}
+
+fn login_client_key(
+    peer_ip: Option<IpAddr>,
+    headers: &HeaderMap,
+    trusted_proxies: &[IpNet],
+) -> LoginClientKey {
+    let Some(peer_ip) = peer_ip else {
+        return LoginClientKey::InProcess;
+    };
+    if !is_trusted_proxy(peer_ip, trusted_proxies) {
+        return LoginClientKey::PeerIp(peer_ip);
+    }
+
+    let forwarded_for = match forwarded_for_chain(headers) {
+        Ok(forwarded_for) => forwarded_for,
+        Err(reason) => return LoginClientKey::InvalidForwardedChain(reason),
+    };
+    let mut client_ip = peer_ip;
+    for forwarded_ip in forwarded_for.into_iter().rev() {
+        if !is_trusted_proxy(client_ip, trusted_proxies) {
+            return LoginClientKey::PeerIp(client_ip);
+        }
+        let Ok(forwarded_ip) = forwarded_ip.parse() else {
+            return LoginClientKey::InvalidForwardedChain("malformed X-Forwarded-For address");
+        };
+        client_ip = canonical_ip(forwarded_ip);
+    }
+    if is_trusted_proxy(client_ip, trusted_proxies) {
+        LoginClientKey::InvalidForwardedChain("no untrusted client address in X-Forwarded-For")
+    } else {
+        LoginClientKey::PeerIp(client_ip)
+    }
+}
+
+fn forwarded_for_chain(headers: &HeaderMap) -> Result<Vec<&str>, &'static str> {
+    let mut chain = Vec::new();
+    let mut total_bytes = 0_usize;
+    for value in headers.get_all(X_FORWARDED_FOR).iter() {
+        let value = value
+            .to_str()
+            .map_err(|_| "X-Forwarded-For is not valid text")?;
+        total_bytes = total_bytes
+            .checked_add(value.len())
+            .filter(|length| *length <= MAX_FORWARDED_FOR_BYTES)
+            .ok_or("X-Forwarded-For is too large")?;
+        for address in value.split(',') {
+            if chain.len() >= MAX_FORWARDED_FOR_HOPS {
+                return Err("X-Forwarded-For has too many hops");
+            }
+            chain.push(address.trim());
+        }
+    }
+    if chain.is_empty() {
+        Err("X-Forwarded-For is missing")
+    } else {
+        Ok(chain)
+    }
+}
+
+fn is_trusted_proxy(address: IpAddr, trusted_proxies: &[IpNet]) -> bool {
+    trusted_proxies
+        .iter()
+        .any(|network| network.contains(&address))
+}
+
+fn canonical_ip(address: IpAddr) -> IpAddr {
+    match address {
+        IpAddr::V6(address) => address
+            .to_ipv4_mapped()
+            .map(IpAddr::V4)
+            .unwrap_or(IpAddr::V6(address)),
+        address => address,
+    }
+}
+
+async fn health() -> Json<HealthResponse> {
+    Json(HealthResponse { status: "ok" })
+}
+
+async fn bootstrap(
+    Extension(request_id): Extension<RequestId>,
+    State(state): State<AppState>,
+    headers: HeaderMap,
+) -> Result<Json<BootstrapResponse>, ApiError> {
+    let setup_required =
+        sqlx::query_scalar::<_, i64>("SELECT NOT EXISTS(SELECT 1 FROM admins WHERE id = 1)")
+            .fetch_one(&state.database.pool)
+            .await
+            .map_err(|error| ApiError::internal_logged(&request_id, error))?
+            != 0;
+    let authenticated = optional_admin_session(&state, &headers)
+        .await
+        .map_err(|error| ApiError::internal_logged(&request_id, error))?
+        .is_some();
+    Ok(Json(BootstrapResponse {
+        setup_required,
+        authenticated,
+    }))
+}
+
+async fn setup(
+    Extension(request_id): Extension<RequestId>,
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    payload: Result<Json<SetupRequest>, JsonRejection>,
+) -> Result<impl IntoResponse, ApiError> {
+    require_origin(&request_id, &state, &headers)?;
+    let Json(payload) = parse_json(&request_id, payload)?;
+    let username = validate_username(&request_id, &payload.username)?;
+    validate_setup_password(&request_id, &payload.password)?;
+    if payload.setup_token.is_empty() || payload.setup_token.len() > MAX_SETUP_TOKEN_BYTES {
+        return Err(ApiError::unauthorized(
+            &request_id,
+            "The setup token is invalid or has expired.",
+        ));
+    }
+
+    let digest = state
+        .database
+        .keyring
+        .digest("setup-token", payload.setup_token.as_bytes());
+    let now = unix_timestamp();
+    let setup_status = sqlx::query_scalar::<_, i64>(
+        "SELECT CASE \
+         WHEN EXISTS(SELECT 1 FROM admins WHERE id = 1) THEN 2 \
+         WHEN EXISTS(SELECT 1 FROM setup_state WHERE id = 1 AND used_at IS NULL \
+         AND token_digest = ? AND created_at >= ?) THEN 1 \
+         ELSE 0 END",
+    )
+    .bind(digest.to_vec())
+    .bind(now - SETUP_TOKEN_TTL_SECONDS)
+    .fetch_one(&state.database.pool)
+    .await
+    .map_err(|error| ApiError::internal_logged(&request_id, error))?;
+    match setup_status {
+        2 => {
+            return Err(ApiError::new(
+                &request_id,
+                StatusCode::CONFLICT,
+                "setup_complete",
+                "This Executor instance is already configured.",
+            ));
+        }
+        1 => {}
+        _ => {
+            return Err(ApiError::unauthorized(
+                &request_id,
+                "The setup token is invalid or has expired.",
+            ));
+        }
+    }
+
+    let permit = acquire_password_slot(&request_id, &state)?;
+    let password = payload.password;
+    let password_hash = tokio::task::spawn_blocking(move || {
+        let _permit = permit;
+        hash_password(&password)
+    })
+    .await
+    .map_err(|error| ApiError::internal_logged(&request_id, error))?
+    .map_err(|error| ApiError::internal_logged(&request_id, error))?;
+    let claim_time = unix_timestamp();
+    let mut transaction = state
+        .database
+        .pool
+        .begin()
+        .await
+        .map_err(|error| ApiError::internal_logged(&request_id, error))?;
+    let inserted = sqlx::query(
+        "INSERT OR IGNORE INTO admins (id, username, password_hash, created_at) \
+         SELECT 1, ?, ?, ? FROM setup_state \
+         WHERE id = 1 AND used_at IS NULL AND token_digest = ? AND created_at >= ?",
+    )
+    .bind(&username)
+    .bind(password_hash)
+    .bind(claim_time)
+    .bind(digest.to_vec())
+    .bind(claim_time - SETUP_TOKEN_TTL_SECONDS)
+    .execute(&mut *transaction)
+    .await
+    .map_err(|error| ApiError::internal_logged(&request_id, error))?
+    .rows_affected();
+
+    if inserted == 0 {
+        let setup_complete =
+            sqlx::query_scalar::<_, i64>("SELECT EXISTS(SELECT 1 FROM admins WHERE id = 1)")
+                .fetch_one(&mut *transaction)
+                .await
+                .map_err(|error| ApiError::internal_logged(&request_id, error))?
+                != 0;
+        transaction
+            .rollback()
+            .await
+            .map_err(|error| ApiError::internal_logged(&request_id, error))?;
+        return if setup_complete {
+            Err(ApiError::new(
+                &request_id,
+                StatusCode::CONFLICT,
+                "setup_complete",
+                "This Executor instance is already configured.",
+            ))
+        } else {
+            Err(ApiError::unauthorized(
+                &request_id,
+                "The setup token is invalid or has expired.",
+            ))
+        };
+    }
+
+    sqlx::query("UPDATE setup_state SET used_at = ? WHERE id = 1")
+        .bind(claim_time)
+        .execute(&mut *transaction)
+        .await
+        .map_err(|error| ApiError::internal_logged(&request_id, error))?;
+    transaction
+        .commit()
+        .await
+        .map_err(|error| ApiError::internal_logged(&request_id, error))?;
+
+    Ok((
+        StatusCode::CREATED,
+        Json(SessionResponse {
+            username,
+            csrf_token: None,
+        }),
+    ))
+}
+
+async fn login(
+    Extension(request_id): Extension<RequestId>,
+    Extension(login_client): Extension<LoginClientKey>,
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    payload: Result<Json<LoginRequest>, JsonRejection>,
+) -> Result<Response, ApiError> {
+    require_origin(&request_id, &state, &headers)?;
+    let Json(payload) = parse_json(&request_id, payload)?;
+    let requested_username = validate_username(&request_id, &payload.username)?;
+    validate_login_password(&request_id, &payload.password)?;
+    if let LoginClientKey::InvalidForwardedChain(reason) = &login_client {
+        tracing::warn!(request_id = %request_id.0, reason, "trusted proxy chain rejected");
+        return Err(ApiError::unauthorized(
+            &request_id,
+            "The request could not be authenticated.",
+        ));
+    }
+    state
+        .login_rate_limiter
+        .check(&login_client)
+        .map_err(|retry_after| ApiError::login_rate_limited(&request_id, retry_after))?;
+    let admin = sqlx::query_as::<_, (i64, String, String)>(
+        "SELECT id, username, password_hash FROM admins WHERE username = ?",
+    )
+    .bind(&requested_username)
+    .fetch_optional(&state.database.pool)
+    .await
+    .map_err(|error| ApiError::internal_logged(&request_id, error))?;
+    let (admin_id, username, password_hash, admin_exists) = match admin {
+        Some((admin_id, username, password_hash)) => (admin_id, username, password_hash, true),
+        None => (
+            0,
+            requested_username,
+            state.dummy_password_hash.to_string(),
+            false,
+        ),
+    };
+    let permit = acquire_password_slot(&request_id, &state)?;
+    let password = payload.password;
+    let verified = tokio::task::spawn_blocking(move || {
+        let _permit = permit;
+        verify_password(&password, &password_hash)
+    })
+    .await
+    .map_err(|error| ApiError::internal_logged(&request_id, error))?;
+    if !admin_exists || !verified {
+        return Err(ApiError::unauthorized(
+            &request_id,
+            "The username or password is incorrect.",
+        ));
+    }
+
+    let session_token = generate_secret("ses_");
+    let csrf_token = generate_secret("csrf_");
+    let session_digest = state
+        .database
+        .keyring
+        .digest("admin-session", session_token.as_bytes());
+    let csrf_digest = state
+        .database
+        .keyring
+        .digest("csrf-token", csrf_token.as_bytes());
+    let now = unix_timestamp();
+    let expires_at = now + state.session_ttl_seconds;
+    sqlx::query("DELETE FROM admin_sessions WHERE expires_at <= ?")
+        .bind(now)
+        .execute(&state.database.pool)
+        .await
+        .map_err(|error| ApiError::internal_logged(&request_id, error))?;
+    sqlx::query(
+        "INSERT INTO admin_sessions \
+         (session_digest, admin_id, csrf_digest, created_at, expires_at) \
+         VALUES (?, ?, ?, ?, ?)",
+    )
+    .bind(session_digest.to_vec())
+    .bind(admin_id)
+    .bind(csrf_digest.to_vec())
+    .bind(now)
+    .bind(expires_at)
+    .execute(&state.database.pool)
+    .await
+    .map_err(|error| ApiError::internal_logged(&request_id, error))?;
+    state.login_rate_limiter.clear(&login_client);
+
+    let mut response = Json(SessionResponse {
+        username,
+        csrf_token: Some(csrf_token.clone()),
+    })
+    .into_response();
+    append_set_cookie(
+        response.headers_mut(),
+        session_cookie(&state, &session_token),
+    );
+    append_set_cookie(response.headers_mut(), csrf_cookie(&state, &csrf_token));
+    Ok(response)
+}
+
+async fn session(
+    Extension(request_id): Extension<RequestId>,
+    State(state): State<AppState>,
+    headers: HeaderMap,
+) -> Result<Json<SessionResponse>, ApiError> {
+    let admin = require_admin(&request_id, &state, &headers).await?;
+    Ok(Json(SessionResponse {
+        username: admin.username,
+        csrf_token: None,
+    }))
+}
+
+async fn logout(
+    Extension(request_id): Extension<RequestId>,
+    State(state): State<AppState>,
+    headers: HeaderMap,
+) -> Result<Response, ApiError> {
+    let admin = require_admin_mutation(&request_id, &state, &headers).await?;
+    sqlx::query("DELETE FROM admin_sessions WHERE session_digest = ?")
+        .bind(admin.session_digest)
+        .execute(&state.database.pool)
+        .await
+        .map_err(|error| ApiError::internal_logged(&request_id, error))?;
+
+    let mut response = StatusCode::NO_CONTENT.into_response();
+    append_set_cookie(response.headers_mut(), clear_cookie(SESSION_COOKIE));
+    append_set_cookie(response.headers_mut(), clear_cookie(CSRF_COOKIE));
+    Ok(response)
+}
+
+async fn create_token(
+    Extension(request_id): Extension<RequestId>,
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    payload: Result<Json<CreateTokenRequest>, JsonRejection>,
+) -> Result<Response, ApiError> {
+    let admin = require_admin_mutation(&request_id, &state, &headers).await?;
+    let idempotency_key = required_idempotency_key(&request_id, &headers)?;
+    let Json(payload) = parse_json(&request_id, payload)?;
+    let name = payload.name.trim();
+    if name.is_empty()
+        || name.chars().count() > MAX_TOKEN_NAME_CHARACTERS
+        || name.len() > MAX_TOKEN_NAME_BYTES
+    {
+        return Err(ApiError::new(
+            &request_id,
+            StatusCode::BAD_REQUEST,
+            "invalid_token_name",
+            "Token names must contain between 1 and 80 characters.",
+        ));
+    }
+
+    let claim = token_delivery::claim_token_creation(
+        &state.database.pool,
+        &state.database.keyring,
+        admin.id,
+        name,
+        idempotency_key,
+        unix_timestamp(),
+    )
+    .await
+    .map_err(|error| token_delivery_error(&request_id, error))?;
+
+    match claim {
+        token_delivery::TokenCreationClaim::Fresh(token) => {
+            Ok(created_token_response(token, false))
+        }
+        token_delivery::TokenCreationClaim::Replay(token) => {
+            Ok(created_token_response(token, true))
+        }
+        token_delivery::TokenCreationClaim::Mismatch => Err(ApiError::new(
+            &request_id,
+            StatusCode::CONFLICT,
+            "idempotency_mismatch",
+            "The Idempotency-Key is already bound to a different token creation request.",
+        )),
+        token_delivery::TokenCreationClaim::Revoked => {
+            let mut response = ApiError::new(
+                &request_id,
+                StatusCode::CONFLICT,
+                "idempotency_replay_revoked",
+                "The token created by this Idempotency-Key has been revoked.",
+            )
+            .into_response();
+            response
+                .headers_mut()
+                .insert(IDEMPOTENCY_REPLAYED, HeaderValue::from_static("true"));
+            Ok(response)
+        }
+    }
+}
+
+fn required_idempotency_key<'a>(
+    request_id: &RequestId,
+    headers: &'a HeaderMap,
+) -> Result<&'a str, ApiError> {
+    let mut values = headers.get_all(IDEMPOTENCY_KEY).iter();
+    let Some(value) = values.next() else {
+        return Err(ApiError::new(
+            request_id,
+            StatusCode::BAD_REQUEST,
+            "idempotency_key_required",
+            "An Idempotency-Key header is required when creating an API token.",
+        ));
+    };
+    if values.next().is_some() {
+        return Err(ApiError::new(
+            request_id,
+            StatusCode::BAD_REQUEST,
+            "invalid_idempotency_key",
+            "The Idempotency-Key header is invalid.",
+        ));
+    }
+    let key = value.to_str().map_err(|_| {
+        ApiError::new(
+            request_id,
+            StatusCode::BAD_REQUEST,
+            "invalid_idempotency_key",
+            "The Idempotency-Key header is invalid.",
+        )
+    })?;
+    token_delivery::validate_idempotency_key(key).map_err(|_| {
+        ApiError::new(
+            request_id,
+            StatusCode::BAD_REQUEST,
+            "invalid_idempotency_key",
+            "The Idempotency-Key header is invalid.",
+        )
+    })?;
+    Ok(key)
+}
+
+fn token_delivery_error(
+    request_id: &RequestId,
+    error: token_delivery::TokenDeliveryError,
+) -> ApiError {
+    match error {
+        token_delivery::TokenDeliveryError::InvalidKey => ApiError::new(
+            request_id,
+            StatusCode::BAD_REQUEST,
+            "invalid_idempotency_key",
+            "The Idempotency-Key header is invalid.",
+        ),
+        error @ (token_delivery::TokenDeliveryError::Database(_)
+        | token_delivery::TokenDeliveryError::CorruptData) => {
+            ApiError::internal_logged(request_id, error)
+        }
+    }
+}
+
+fn created_token_response(token: token_delivery::DeliveredToken, replayed: bool) -> Response {
+    let mut response = (
+        StatusCode::CREATED,
+        Json(CreatedTokenResponse {
+            id: token.id,
+            name: token.name,
+            token: token.token,
+            created_at: token.created_at,
+        }),
+    )
+        .into_response();
+    if replayed {
+        response
+            .headers_mut()
+            .insert(IDEMPOTENCY_REPLAYED, HeaderValue::from_static("true"));
+    }
+    response
+}
+
+async fn list_tokens(
+    Extension(request_id): Extension<RequestId>,
+    State(state): State<AppState>,
+    headers: HeaderMap,
+) -> Result<Json<TokenListResponse>, ApiError> {
+    require_admin(&request_id, &state, &headers).await?;
+    let tokens = sqlx::query_as::<_, TokenMetadata>(
+        "SELECT id, name, token_prefix || '...' || token_suffix AS masked_token, \
+         created_at, last_used_at, revoked_at \
+         FROM api_tokens ORDER BY created_at DESC, id DESC",
+    )
+    .fetch_all(&state.database.pool)
+    .await
+    .map_err(|error| ApiError::internal_logged(&request_id, error))?;
+    Ok(Json(TokenListResponse { tokens }))
+}
+
+async fn revoke_token(
+    Extension(request_id): Extension<RequestId>,
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    Path(token_id): Path<String>,
+) -> Result<Response, ApiError> {
+    require_admin_mutation(&request_id, &state, &headers).await?;
+    let cleanup_state = state.clone();
+    let cleanup_request_id = request_id.clone();
+    let cleanup = async move {
+        revoke_token_and_cleanup(&cleanup_request_id, &cleanup_state, &token_id).await
+    };
+    let result = spawn_supervised_result(&state.background_tasks, cleanup).ok_or_else(|| {
+        ApiError::new(
+            &request_id,
+            StatusCode::SERVICE_UNAVAILABLE,
+            "shutting_down",
+            "Executor is shutting down.",
+        )
+    })?;
+    let reconciled = result
+        .await
+        .map_err(|error| ApiError::internal_logged(&request_id, error))??;
+    let mut response = StatusCode::NO_CONTENT.into_response();
+    if reconciled {
+        response
+            .headers_mut()
+            .insert(REVOKE_RECONCILED, HeaderValue::from_static("true"));
+    }
+    Ok(response)
+}
+
+async fn revoke_token_and_cleanup(
+    request_id: &RequestId,
+    state: &AppState,
+    token_id: &str,
+) -> Result<bool, ApiError> {
+    let changed = state
+        .tool_calls
+        .revoke_owner_token(token_id)
+        .await
+        .map_err(|error| ApiError::internal_logged(request_id, error))?;
+    let reconciled = if changed {
+        false
+    } else {
+        let state =
+            sqlx::query_as::<_, (Option<i64>,)>("SELECT revoked_at FROM api_tokens WHERE id = ?")
+                .bind(token_id)
+                .fetch_optional(&state.database.pool)
+                .await
+                .map_err(|error| ApiError::internal_logged(request_id, error))?;
+        match state {
+            None => {
+                return Err(ApiError::new(
+                    request_id,
+                    StatusCode::NOT_FOUND,
+                    "token_not_found",
+                    "The API token was not found.",
+                ));
+            }
+            Some((Some(_),)) => true,
+            Some((None,)) => {
+                return Err(ApiError::internal_logged(
+                    request_id,
+                    "an active API token could not be revoked",
+                ));
+            }
+        }
+    };
+    state.mcp.revoke_token(token_id);
+    state.execution.revoke_owner(token_id).await;
+    Ok(reconciled)
+}
+
+fn spawn_supervised_result<T, F>(
+    background_tasks: &TaskTracker,
+    future: F,
+) -> Option<oneshot::Receiver<T>>
+where
+    T: Send + 'static,
+    F: Future<Output = T> + Send + 'static,
+{
+    let (sender, receiver) = oneshot::channel();
+    background_tasks
+        .spawn_supervised(move |shutdown| async move {
+            let _shutdown = shutdown;
+            let _ = sender.send(future.await);
+        })
+        .then_some(receiver)
+}
+
+async fn gateway_whoami(
+    Extension(request_id): Extension<RequestId>,
+    State(state): State<AppState>,
+    headers: HeaderMap,
+) -> Result<Json<GatewayIdentityResponse>, ApiError> {
+    let identity = require_gateway_token(&request_id, &state, &headers).await?;
+    Ok(Json(GatewayIdentityResponse {
+        token_id: identity.token_id,
+        token_name: identity.token_name,
+    }))
+}
+
+async fn require_gateway_token(
+    request_id: &RequestId,
+    state: &AppState,
+    headers: &HeaderMap,
+) -> Result<GatewayIdentity, ApiError> {
+    let token = bearer_token(headers).ok_or_else(|| {
+        ApiError::unauthorized(request_id, "A valid Executor API token is required.")
+    })?;
+    let digest = state.database.keyring.digest("api-token", token.as_bytes());
+    let identity = sqlx::query_as::<_, (String, String, Option<i64>)>(
+        "SELECT id, name, last_used_at FROM api_tokens \
+         WHERE token_digest = ? AND revoked_at IS NULL",
+    )
+    .bind(digest.to_vec())
+    .fetch_optional(&state.database.pool)
+    .await
+    .map_err(|error| ApiError::internal_logged(request_id, error))?
+    .ok_or_else(|| ApiError::unauthorized(request_id, "A valid Executor API token is required."))?;
+    let now = unix_timestamp();
+    if identity
+        .2
+        .is_none_or(|last_used_at| last_used_at <= now - TOKEN_LAST_USED_WRITE_INTERVAL_SECONDS)
+    {
+        state.token_last_used_tracker.schedule(
+            state.database.clone(),
+            identity.0.clone(),
+            now,
+            request_id.0.clone(),
+            &state.background_tasks,
+        );
+    }
+    Ok(GatewayIdentity {
+        token_id: identity.0,
+        token_name: identity.1,
+    })
+}
+
+async fn not_found(
+    Extension(request_id): Extension<RequestId>,
+    method: Method,
+    uri: Uri,
+    headers: HeaderMap,
+) -> Response {
+    if let Some(response) = crate::web_assets::response(&method, &uri, &headers) {
+        return response;
+    }
+    ApiError::new(
+        &request_id,
+        StatusCode::NOT_FOUND,
+        "not_found",
+        "The requested resource does not exist.",
+    )
+    .into_response()
+}
+
+async fn method_not_allowed(Extension(request_id): Extension<RequestId>) -> ApiError {
+    ApiError::new(
+        &request_id,
+        StatusCode::METHOD_NOT_ALLOWED,
+        "method_not_allowed",
+        "The request method is not allowed for this resource.",
+    )
+}
+
+fn parse_json<T>(
+    request_id: &RequestId,
+    payload: Result<Json<T>, JsonRejection>,
+) -> Result<Json<T>, ApiError> {
+    payload.map_err(|rejection| {
+        if rejection.status() == StatusCode::PAYLOAD_TOO_LARGE {
+            ApiError::new(
+                request_id,
+                StatusCode::PAYLOAD_TOO_LARGE,
+                "payload_too_large",
+                "The request body exceeds the allowed size.",
+            )
+        } else {
+            ApiError::new(
+                request_id,
+                StatusCode::BAD_REQUEST,
+                "invalid_json",
+                "The request body must be valid JSON with the expected fields.",
+            )
+        }
+    })
+}
+
+fn validate_username(request_id: &RequestId, username: &str) -> Result<String, ApiError> {
+    let username = username.trim();
+    let username_length = username.chars().count();
+    if !(1..=MAX_USERNAME_CHARACTERS).contains(&username_length)
+        || username.len() > MAX_USERNAME_BYTES
+    {
+        return Err(ApiError::new(
+            request_id,
+            StatusCode::BAD_REQUEST,
+            "invalid_username",
+            "Usernames must contain between 1 and 64 characters.",
+        ));
+    }
+    Ok(username.to_owned())
+}
+
+fn validate_setup_password(request_id: &RequestId, password: &str) -> Result<(), ApiError> {
+    if password.chars().count() < MIN_PASSWORD_CHARACTERS || password.len() > MAX_PASSWORD_BYTES {
+        return Err(ApiError::new(
+            request_id,
+            StatusCode::BAD_REQUEST,
+            "invalid_password",
+            "Passwords must contain at least 12 characters.",
+        ));
+    }
+    Ok(())
+}
+
+fn validate_login_password(request_id: &RequestId, password: &str) -> Result<(), ApiError> {
+    if password.len() > MAX_PASSWORD_BYTES {
+        return Err(ApiError::new(
+            request_id,
+            StatusCode::BAD_REQUEST,
+            "invalid_password",
+            "The password exceeds the allowed size.",
+        ));
+    }
+    Ok(())
+}
+
+fn acquire_password_slot(
+    request_id: &RequestId,
+    state: &AppState,
+) -> Result<OwnedSemaphorePermit, ApiError> {
+    state
+        .password_hash_slots
+        .clone()
+        .try_acquire_owned()
+        .map_err(|_| ApiError::password_work_saturated(request_id))
+}
+
+fn require_origin(
+    request_id: &RequestId,
+    state: &AppState,
+    headers: &HeaderMap,
+) -> Result<(), ApiError> {
+    let origin_matches = headers
+        .get(header::ORIGIN)
+        .and_then(|value| value.to_str().ok())
+        .is_some_and(|origin| origin == state.origin.as_ref());
+    if origin_matches {
+        Ok(())
+    } else {
+        Err(ApiError::new(
+            request_id,
+            StatusCode::FORBIDDEN,
+            "invalid_origin",
+            "The request Origin does not match this Executor instance.",
+        ))
+    }
+}
+
+async fn require_admin(
+    request_id: &RequestId,
+    state: &AppState,
+    headers: &HeaderMap,
+) -> Result<AdminSession, ApiError> {
+    optional_admin_session(state, headers)
+        .await
+        .map_err(|error| ApiError::internal_logged(request_id, error))?
+        .ok_or_else(|| ApiError::unauthorized(request_id, "An administrator session is required."))
+}
+
+async fn optional_admin_session(
+    state: &AppState,
+    headers: &HeaderMap,
+) -> Result<Option<AdminSession>, sqlx::Error> {
+    let Some(token) = cookie_value(headers, SESSION_COOKIE) else {
+        return Ok(None);
+    };
+    let digest = state
+        .database
+        .keyring
+        .digest("admin-session", token.as_bytes());
+    sqlx::query_as::<_, (i64, String, Vec<u8>, Vec<u8>)>(
+        "SELECT admins.id, admins.username, admin_sessions.session_digest, admin_sessions.csrf_digest \
+         FROM admin_sessions JOIN admins ON admins.id = admin_sessions.admin_id \
+         WHERE admin_sessions.session_digest = ? AND admin_sessions.expires_at > ?",
+    )
+    .bind(digest.to_vec())
+    .bind(unix_timestamp())
+    .fetch_optional(&state.database.pool)
+    .await
+    .map(|row| {
+        row.map(|(id, username, session_digest, csrf_digest)| AdminSession {
+            id,
+            username,
+            session_digest,
+            csrf_digest,
+        })
+    })
+}
+
+async fn require_admin_mutation(
+    request_id: &RequestId,
+    state: &AppState,
+    headers: &HeaderMap,
+) -> Result<AdminSession, ApiError> {
+    require_origin(request_id, state, headers)?;
+    let admin = require_admin(request_id, state, headers).await?;
+    let csrf_header = headers
+        .get(CSRF_HEADER)
+        .and_then(|value| value.to_str().ok())
+        .ok_or_else(|| {
+            ApiError::new(
+                request_id,
+                StatusCode::FORBIDDEN,
+                "invalid_csrf",
+                "A valid CSRF token is required.",
+            )
+        })?;
+    let csrf_cookie = cookie_value(headers, CSRF_COOKIE).ok_or_else(|| {
+        ApiError::new(
+            request_id,
+            StatusCode::FORBIDDEN,
+            "invalid_csrf",
+            "A valid CSRF token is required.",
+        )
+    })?;
+    let same_token: bool = csrf_header.as_bytes().ct_eq(csrf_cookie.as_bytes()).into();
+    let valid_digest = state.database.keyring.digest_matches(
+        "csrf-token",
+        csrf_header.as_bytes(),
+        &admin.csrf_digest,
+    );
+    if !same_token || !valid_digest {
+        return Err(ApiError::new(
+            request_id,
+            StatusCode::FORBIDDEN,
+            "invalid_csrf",
+            "A valid CSRF token is required.",
+        ));
+    }
+    Ok(admin)
+}
+
+fn cookie_value(headers: &HeaderMap, name: &str) -> Option<String> {
+    headers
+        .get_all(header::COOKIE)
+        .iter()
+        .filter_map(|value| value.to_str().ok())
+        .flat_map(|value| value.split(';'))
+        .filter_map(|cookie| cookie.trim().split_once('='))
+        .find_map(|(cookie_name, value)| (cookie_name == name).then(|| value.to_owned()))
+}
+
+fn bearer_token(headers: &HeaderMap) -> Option<&str> {
+    let value = headers
+        .get(header::AUTHORIZATION)
+        .and_then(|value| value.to_str().ok())?;
+    let mut parts = value.split_ascii_whitespace();
+    let scheme = parts.next()?;
+    let token = parts.next()?;
+    (scheme.eq_ignore_ascii_case("bearer") && parts.next().is_none()).then_some(token)
+}
+
+fn append_set_cookie(headers: &mut HeaderMap, cookie: String) {
+    headers.append(
+        header::SET_COOKIE,
+        HeaderValue::from_str(&cookie).expect("generated cookies contain only safe characters"),
+    );
+}
+
+fn session_cookie(state: &AppState, token: &str) -> String {
+    let secure = if state.secure_cookies { "; Secure" } else { "" };
+    format!(
+        "{SESSION_COOKIE}={token}; Path=/; HttpOnly; SameSite=Lax; Max-Age={}{secure}",
+        state.session_ttl_seconds
+    )
+}
+
+fn csrf_cookie(state: &AppState, token: &str) -> String {
+    let secure = if state.secure_cookies { "; Secure" } else { "" };
+    format!(
+        "{CSRF_COOKIE}={token}; Path=/; SameSite=Lax; Max-Age={}{secure}",
+        state.session_ttl_seconds
+    )
+}
+
+fn clear_cookie(name: &str) -> String {
+    format!("{name}=; Path=/; SameSite=Lax; Max-Age=0")
+}
+
+#[cfg(test)]
+mod tests {
+    use std::{
+        sync::{
+            Arc,
+            atomic::{AtomicBool, Ordering},
+        },
+        time::{Duration, Instant},
+    };
+
+    use tempfile::TempDir;
+    use tokio::{sync::oneshot, time::timeout};
+
+    use super::{TokenLastUsedTracker, spawn_supervised_result};
+    use crate::{
+        AppConfig,
+        database::{Database, DatabaseError, OpenedDatabase},
+        tasks::TaskTracker,
+    };
+
+    async fn open_database() -> (TempDir, AppConfig, Database) {
+        let directory = tempfile::tempdir().expect("temporary data directory");
+        let config = AppConfig::new(directory.path().into());
+        let OpenedDatabase { database, .. } =
+            Database::open(&config).await.expect("test database opens");
+        (directory, config, database)
+    }
+
+    async fn insert_token(database: &Database, token_id: &str) {
+        sqlx::query(
+            "INSERT INTO api_tokens \
+             (id, name, token_digest, token_prefix, token_suffix, created_at) \
+             VALUES (?, ?, ?, ?, ?, ?)",
+        )
+        .bind(token_id)
+        .bind(token_id)
+        .bind(format!("digest-{token_id}").into_bytes())
+        .bind("exr_test")
+        .bind("test")
+        .bind(1_i64)
+        .execute(&database.pool)
+        .await
+        .expect("test API token is inserted");
+    }
+
+    async fn wait_for_token_write(tracker: &Arc<TokenLastUsedTracker>) {
+        let permit = timeout(
+            Duration::from_secs(2),
+            tracker.write_slot.clone().acquire_owned(),
+        )
+        .await
+        .expect("token last-used write completes")
+        .expect("token last-used write semaphore remains open");
+        drop(permit);
+    }
+
+    #[tokio::test]
+    async fn dropping_token_revoke_waiter_does_not_cancel_supervised_cleanup() {
+        let background_tasks = TaskTracker::default();
+        let cleaned = Arc::new(AtomicBool::new(false));
+        let task_cleaned = cleaned.clone();
+        let (started_sender, started_receiver) = oneshot::channel();
+        let (release_sender, release_receiver) = oneshot::channel();
+        let waiter = spawn_supervised_result(&background_tasks, async move {
+            let _ = started_sender.send(());
+            let _ = release_receiver.await;
+            task_cleaned.store(true, Ordering::Release);
+        })
+        .expect("token revoke cleanup is supervised");
+
+        started_receiver.await.expect("cleanup task starts");
+        drop(waiter);
+        background_tasks.abort_all();
+        release_sender.send(()).expect("cleanup task releases");
+        background_tasks.shutdown().await;
+
+        assert!(cleaned.load(Ordering::Acquire));
+    }
+
+    #[tokio::test]
+    async fn failed_token_last_used_write_clears_only_its_matching_attempt_and_retries() {
+        let (_directory, _config, database) = open_database().await;
+        insert_token(&database, "retry-token").await;
+        sqlx::query(
+            "CREATE TRIGGER reject_token_last_used \
+             BEFORE UPDATE OF last_used_at ON api_tokens \
+             BEGIN SELECT RAISE(FAIL, 'forced token last-used failure'); END",
+        )
+        .execute(&database.pool)
+        .await
+        .expect("failure trigger is installed");
+
+        let tracker = Arc::new(TokenLastUsedTracker::new());
+        let background_tasks = TaskTracker::default();
+        let unrelated_attempt = Instant::now();
+        tracker
+            .attempts
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+            .insert("unrelated-token".to_owned(), unrelated_attempt);
+
+        let replaced_attempt = Instant::now();
+        let replacement_attempt = replaced_attempt + Duration::from_secs(1);
+        tracker
+            .attempts
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+            .insert("replacement-token".to_owned(), replacement_attempt);
+        tracker.clear_failed_attempt("replacement-token", replaced_attempt);
+
+        tracker.schedule(
+            database.clone(),
+            "retry-token".to_owned(),
+            1_750_000_000,
+            "failed-request".to_owned(),
+            &background_tasks,
+        );
+        wait_for_token_write(&tracker).await;
+
+        {
+            let attempts = tracker
+                .attempts
+                .lock()
+                .unwrap_or_else(std::sync::PoisonError::into_inner);
+            assert!(!attempts.contains_key("retry-token"));
+            assert_eq!(attempts.get("unrelated-token"), Some(&unrelated_attempt));
+            assert_eq!(
+                attempts.get("replacement-token"),
+                Some(&replacement_attempt)
+            );
+        }
+
+        sqlx::query("DROP TRIGGER reject_token_last_used")
+            .execute(&database.pool)
+            .await
+            .expect("failure trigger is removed");
+        tracker.schedule(
+            database.clone(),
+            "retry-token".to_owned(),
+            1_750_000_001,
+            "retry-request".to_owned(),
+            &background_tasks,
+        );
+        wait_for_token_write(&tracker).await;
+
+        let last_used = sqlx::query_scalar::<_, Option<i64>>(
+            "SELECT last_used_at FROM api_tokens WHERE id = 'retry-token'",
+        )
+        .fetch_one(&database.pool)
+        .await
+        .expect("last-used timestamp is readable");
+        assert_eq!(last_used, Some(1_750_000_001));
+        background_tasks.shutdown().await;
+    }
+
+    #[tokio::test]
+    async fn token_last_used_background_write_retains_the_instance_lock() {
+        let (_directory, config, database) = open_database().await;
+        insert_token(&database, "guarded-token").await;
+        let mut writer = database
+            .pool
+            .acquire()
+            .await
+            .expect("test writer connection is acquired");
+        sqlx::query("BEGIN IMMEDIATE")
+            .execute(&mut *writer)
+            .await
+            .expect("test writer holds the SQLite write lock");
+
+        let tracker = Arc::new(TokenLastUsedTracker::new());
+        let background_tasks = TaskTracker::default();
+        tracker.schedule(
+            database.clone(),
+            "guarded-token".to_owned(),
+            1_750_000_000,
+            "guarded-request".to_owned(),
+            &background_tasks,
+        );
+        drop(database);
+
+        let second_open = Database::open(&config).await;
+        assert!(matches!(second_open, Err(DatabaseError::AlreadyRunning(_))));
+
+        sqlx::query("COMMIT")
+            .execute(&mut *writer)
+            .await
+            .expect("test writer releases the SQLite write lock");
+        drop(writer);
+        wait_for_token_write(&tracker).await;
+
+        let reopened = timeout(Duration::from_secs(2), async {
+            loop {
+                match Database::open(&config).await {
+                    Ok(opened) => break opened.database,
+                    Err(DatabaseError::AlreadyRunning(_)) => {
+                        tokio::time::sleep(Duration::from_millis(10)).await;
+                    }
+                    Err(error) => panic!("database should reopen after the write: {error}"),
+                }
+            }
+        })
+        .await
+        .expect("background write releases its instance-lock guard");
+        reopened.pool.close().await;
+        background_tasks.shutdown().await;
+    }
+}
diff --git a/src/api/approvals.rs b/src/api/approvals.rs
new file mode 100644
index 000000000..03bee27ce
--- /dev/null
+++ b/src/api/approvals.rs
@@ -0,0 +1,333 @@
+use axum::{
+    Json, Router,
+    extract::{Extension, Path, Query, State, rejection::JsonRejection, rejection::QueryRejection},
+    http::{HeaderMap, StatusCode},
+    routing::get,
+};
+use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+
+use super::{
+    AdminMutation, ApiError, AppState, GatewayAuthentication, RequestId, parse_json,
+    protocols::approval_error, require_admin,
+};
+use crate::approval::{
+    ApprovalAdminDetail, ApprovalDecision, ApprovalListQuery, ApprovalRecord, ApprovalStatus,
+};
+
+pub(super) fn router() -> Router<AppState> {
+    Router::new()
+        .route("/api/v1/approvals", get(list))
+        .route("/api/v1/approvals/{id}", get(admin_detail))
+        .route(
+            "/api/v1/approvals/{id}/decision",
+            axum::routing::post(decide),
+        )
+        .route(
+            "/api/v1/gateway/approvals/{id}",
+            get(owner_detail).delete(cancel),
+        )
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields, rename_all = "camelCase")]
+struct ListQuery {
+    status: Option<ApprovalStatus>,
+    cursor: Option<String>,
+    #[serde(default = "default_limit")]
+    limit: u32,
+}
+
+const fn default_limit() -> u32 {
+    50
+}
+
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+struct ApprovalListResponse {
+    items: Vec<ApprovalSummary>,
+    next_cursor: Option<String>,
+}
+
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+struct ApprovalSummary {
+    id: String,
+    status: ApprovalStatus,
+    revision: i64,
+    source_id: String,
+    tool_id: String,
+    path: String,
+    source_display_name: Option<String>,
+    tool_display_name: Option<String>,
+    actor_kind: crate::actor::ActorKind,
+    actor_id: String,
+    actor_name: Option<String>,
+    actor_label: String,
+    actor_api_token_id: Option<String>,
+    actor_token_name: Option<String>,
+    surface: crate::catalog::RequestSurface,
+    mode: &'static str,
+    provenance: crate::catalog::ModeProvenance,
+    execution_id: String,
+    call_id: String,
+    created_at: i64,
+    updated_at: i64,
+    expires_at: i64,
+    decided_at: Option<i64>,
+    started_at: Option<i64>,
+    completed_at: Option<i64>,
+    decision: Option<ApprovalDecision>,
+    failure_code: Option<String>,
+}
+
+impl From<ApprovalRecord> for ApprovalSummary {
+    fn from(record: ApprovalRecord) -> Self {
+        let actor_label = match record.actor_kind {
+            crate::actor::ActorKind::ApiToken => record
+                .actor_name_snapshot
+                .clone()
+                .unwrap_or_else(|| "API token".to_owned()),
+            crate::actor::ActorKind::Admin => format!("Admin {}", record.actor_id),
+            crate::actor::ActorKind::System => match record.actor_id.as_str() {
+                "local_cli" => "Local CLI".to_owned(),
+                _ => "System".to_owned(),
+            },
+        };
+        Self {
+            id: record.id,
+            status: record.status,
+            revision: record.revision,
+            source_id: record.revisions.source_id,
+            tool_id: record.revisions.tool_id,
+            path: record.callable_path_snapshot,
+            source_display_name: record.source_display_name,
+            tool_display_name: record.tool_display_name,
+            actor_kind: record.actor_kind,
+            actor_id: record.actor_id,
+            actor_name: record.actor_name_snapshot.clone(),
+            actor_label,
+            actor_api_token_id: record.actor_api_token_id,
+            actor_token_name: record.actor_name_snapshot,
+            surface: record.surface,
+            mode: "ask",
+            provenance: record.mode_provenance,
+            execution_id: record.execution_id,
+            call_id: record.call_id,
+            created_at: record.created_at,
+            updated_at: record.updated_at,
+            expires_at: record.expires_at,
+            decided_at: record.decided_at,
+            started_at: record.execution_started_at,
+            completed_at: record.completed_at,
+            decision: record.decision,
+            failure_code: record.failure_code,
+        }
+    }
+}
+
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+struct AdminDetailResponse {
+    #[serde(flatten)]
+    summary: ApprovalSummary,
+    redacted_arguments: Value,
+    input_schema: Value,
+}
+
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+struct OwnerDetailResponse {
+    id: String,
+    status: ApprovalStatus,
+    revision: i64,
+    path: String,
+    created_at: i64,
+    updated_at: i64,
+    expires_at: i64,
+    failure_code: Option<String>,
+    result: Option<Value>,
+}
+
+async fn list(
+    Extension(request_id): Extension<RequestId>,
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    query: Result<Query<ListQuery>, QueryRejection>,
+) -> Result<Json<ApprovalListResponse>, ApiError> {
+    require_admin(&request_id, &state, &headers).await?;
+    let Query(query) = query.map_err(|_| invalid_query(&request_id))?;
+    let before_sequence = query
+        .cursor
+        .as_deref()
+        .map(|cursor| decode_cursor(&request_id, cursor))
+        .transpose()?;
+    state
+        .tool_calls
+        .expire_approvals()
+        .await
+        .map_err(|error| approval_error(&request_id, error))?;
+    let page = state
+        .tool_calls
+        .approvals()
+        .list_admin(ApprovalListQuery {
+            before_sequence,
+            limit: query.limit,
+            status: query.status,
+        })
+        .await
+        .map_err(|error| approval_error(&request_id, error))?;
+    Ok(Json(ApprovalListResponse {
+        items: page.items.into_iter().map(ApprovalSummary::from).collect(),
+        next_cursor: page.next_cursor.map(encode_cursor),
+    }))
+}
+
+async fn admin_detail(
+    Extension(request_id): Extension<RequestId>,
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    Path(approval_id): Path<String>,
+) -> Result<Json<AdminDetailResponse>, ApiError> {
+    require_admin(&request_id, &state, &headers).await?;
+    state
+        .tool_calls
+        .expire_approvals()
+        .await
+        .map_err(|error| approval_error(&request_id, error))?;
+    let detail = state
+        .tool_calls
+        .approvals()
+        .get_admin(&approval_id)
+        .await
+        .map_err(|error| approval_error(&request_id, error))?
+        .ok_or_else(|| approval_error(&request_id, crate::approval::ApprovalError::NotFound))?;
+    Ok(Json(admin_response(detail)))
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields, rename_all = "camelCase")]
+struct DecisionRequest {
+    decision: ApprovalDecision,
+    expected_revision: i64,
+}
+
+async fn decide(
+    Extension(request_id): Extension<RequestId>,
+    State(state): State<AppState>,
+    AdminMutation(admin_id): AdminMutation,
+    Path(approval_id): Path<String>,
+    payload: Result<Json<DecisionRequest>, JsonRejection>,
+) -> Result<(StatusCode, Json<AdminDetailResponse>), ApiError> {
+    let Json(payload) = parse_json(&request_id, payload)?;
+    let detail = state
+        .tool_calls
+        .decide(
+            &approval_id,
+            &request_id.0,
+            payload.expected_revision,
+            payload.decision,
+            admin_id,
+        )
+        .await
+        .map_err(|error| approval_error(&request_id, error))?;
+    let status = if detail.record.status.is_terminal() {
+        StatusCode::OK
+    } else {
+        StatusCode::ACCEPTED
+    };
+    Ok((status, Json(admin_response(detail))))
+}
+
+async fn owner_detail(
+    Extension(request_id): Extension<RequestId>,
+    State(state): State<AppState>,
+    GatewayAuthentication(identity): GatewayAuthentication,
+    Path(approval_id): Path<String>,
+) -> Result<Json<OwnerDetailResponse>, ApiError> {
+    state
+        .tool_calls
+        .expire_approvals()
+        .await
+        .map_err(|error| approval_error(&request_id, error))?;
+    let detail = state
+        .tool_calls
+        .approvals()
+        .get_for_token(&approval_id, &identity.token_id)
+        .await
+        .map_err(|error| approval_error(&request_id, error))?
+        .ok_or_else(|| approval_error(&request_id, crate::approval::ApprovalError::NotFound))?;
+    Ok(Json(OwnerDetailResponse {
+        id: detail.record.id,
+        status: detail.record.status,
+        revision: detail.record.revision,
+        path: detail.record.callable_path_snapshot,
+        created_at: detail.record.created_at,
+        updated_at: detail.record.updated_at,
+        expires_at: detail.record.expires_at,
+        failure_code: detail.record.failure_code,
+        result: detail.result,
+    }))
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields, rename_all = "camelCase")]
+struct CancelQuery {
+    expected_revision: i64,
+}
+
+async fn cancel(
+    Extension(request_id): Extension<RequestId>,
+    State(state): State<AppState>,
+    GatewayAuthentication(identity): GatewayAuthentication,
+    Path(approval_id): Path<String>,
+    query: Result<Query<CancelQuery>, QueryRejection>,
+) -> Result<Json<OwnerDetailResponse>, ApiError> {
+    let Query(query) = query.map_err(|_| invalid_query(&request_id))?;
+    state
+        .tool_calls
+        .cancel_approval(&approval_id, &identity.token_id, query.expected_revision)
+        .await
+        .map_err(|error| approval_error(&request_id, error))?;
+    owner_detail(
+        Extension(request_id),
+        State(state),
+        GatewayAuthentication(identity),
+        Path(approval_id),
+    )
+    .await
+}
+
+fn admin_response(detail: ApprovalAdminDetail) -> AdminDetailResponse {
+    AdminDetailResponse {
+        summary: ApprovalSummary::from(detail.record),
+        redacted_arguments: detail.redacted_arguments,
+        input_schema: detail.input_schema,
+    }
+}
+
+fn encode_cursor(sequence: i64) -> String {
+    URL_SAFE_NO_PAD.encode(sequence.to_be_bytes())
+}
+
+fn decode_cursor(request_id: &RequestId, cursor: &str) -> Result<i64, ApiError> {
+    let bytes = URL_SAFE_NO_PAD
+        .decode(cursor)
+        .map_err(|_| invalid_query(request_id))?;
+    let bytes: [u8; 8] = bytes.try_into().map_err(|_| invalid_query(request_id))?;
+    let sequence = i64::from_be_bytes(bytes);
+    if sequence <= 0 {
+        return Err(invalid_query(request_id));
+    }
+    Ok(sequence)
+}
+
+fn invalid_query(request_id: &RequestId) -> ApiError {
+    ApiError::new(
+        request_id,
+        StatusCode::BAD_REQUEST,
+        "invalid_query",
+        "The approval query is invalid.",
+    )
+}
diff --git a/src/api/catalog.rs b/src/api/catalog.rs
new file mode 100644
index 000000000..3cfca1634
--- /dev/null
+++ b/src/api/catalog.rs
@@ -0,0 +1,823 @@
+use axum::{
+    Json, Router,
+    extract::{
+        Extension, Path, Query, State,
+        rejection::{PathRejection, QueryRejection},
+    },
+    http::{HeaderMap, StatusCode},
+    routing::{get, patch, post},
+};
+use serde::{Deserialize, Serialize};
+use std::{future::Future, sync::Arc, time::Instant};
+use tokio::sync::Semaphore;
+
+use super::{
+    ApiError, AppState, RequestId, parse_json, require_admin, require_admin_mutation,
+    require_gateway_token,
+};
+use crate::{
+    catalog::{
+        AuditContext, CatalogError, ListToolsFilter, NewRequestLog, RequestOutcome, RequestSurface,
+        ToolMode,
+    },
+    unix_timestamp,
+};
+
+const MAX_QUERY_CHARACTERS: usize = 256;
+
+pub(super) fn router() -> Router<AppState> {
+    Router::new()
+        .route("/api/v1/sources", get(list_sources))
+        .route(
+            "/api/v1/sources/{id}",
+            get(source_detail).delete(delete_source),
+        )
+        .route("/api/v1/sources/{id}/mode", patch(set_source_mode))
+        .route("/api/v1/tools", get(list_tools))
+        .route("/api/v1/tools/modes", patch(bulk_set_tool_modes))
+        .route("/api/v1/tools/{id}", get(tool_detail))
+        .route("/api/v1/tools/{id}/mode", patch(set_tool_mode))
+        .route("/api/v1/request-logs", get(list_request_logs))
+        .route("/api/v1/request-logs/{id}", get(request_log_detail))
+        .route("/api/v1/gateway/tools/search", post(gateway_search))
+        .route("/api/v1/gateway/tools/describe", post(gateway_describe))
+        .route("/api/v1/gateway/tools/lookup", post(gateway_lookup))
+}
+
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+struct SourceListResponse {
+    sources: Vec<crate::catalog::SourceRecord>,
+    catalog_revision: i64,
+}
+
+async fn list_sources(
+    Extension(request_id): Extension<RequestId>,
+    State(state): State<AppState>,
+    headers: HeaderMap,
+) -> Result<Json<SourceListResponse>, ApiError> {
+    require_admin(&request_id, &state, &headers).await?;
+    let (sources, catalog_revision) = state
+        .catalog
+        .list_sources_snapshot()
+        .await
+        .map_err(|error| catalog_error(&request_id, error))?;
+    Ok(Json(SourceListResponse {
+        sources,
+        catalog_revision,
+    }))
+}
+
+async fn source_detail(
+    Extension(request_id): Extension<RequestId>,
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    path: Result<Path<String>, PathRejection>,
+) -> Result<Json<crate::catalog::SourceRecord>, ApiError> {
+    require_admin(&request_id, &state, &headers).await?;
+    let Path(source_id) = parse_path(&request_id, path)?;
+    state
+        .catalog
+        .source(&source_id)
+        .await
+        .map(Json)
+        .map_err(|error| catalog_error(&request_id, error))
+}
+
+async fn delete_source(
+    Extension(request_id): Extension<RequestId>,
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    path: Result<Path<String>, PathRejection>,
+) -> Result<StatusCode, ApiError> {
+    let admin = require_admin_mutation(&request_id, &state, &headers).await?;
+    let Path(source_id) = parse_path(&request_id, path)?;
+    state
+        .sources
+        .delete(&source_id, AuditContext::admin(&request_id.0, admin.id))
+        .await
+        .map_err(|error| super::protocols::protocol_error(&request_id, error))?;
+    Ok(StatusCode::NO_CONTENT)
+}
+
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct SetModeRequest {
+    mode: serde_json::Value,
+    expected_revision: i64,
+}
+
+async fn set_source_mode(
+    Extension(request_id): Extension<RequestId>,
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    path: Result<Path<String>, PathRejection>,
+    payload: Result<Json<SetModeRequest>, axum::extract::rejection::JsonRejection>,
+) -> Result<Json<crate::catalog::SourceRecord>, ApiError> {
+    let admin = require_admin_mutation(&request_id, &state, &headers).await?;
+    let Path(source_id) = parse_path(&request_id, path)?;
+    let Json(payload) = parse_json(&request_id, payload)?;
+    let mode = parse_mode(&request_id, payload.mode)?;
+    state
+        .sources
+        .set_source_mode(
+            &source_id,
+            mode,
+            payload.expected_revision,
+            AuditContext::admin(&request_id.0, admin.id),
+        )
+        .await
+        .map(Json)
+        .map_err(|error| super::protocols::protocol_error(&request_id, error))
+}
+
+#[derive(Default, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct ListToolsQuery {
+    query: Option<String>,
+    source_id: Option<String>,
+    mode: Option<ToolMode>,
+    include_tombstoned: Option<bool>,
+    limit: Option<u32>,
+    offset: Option<u32>,
+}
+
+async fn list_tools(
+    Extension(request_id): Extension<RequestId>,
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    query: Result<Query<ListToolsQuery>, QueryRejection>,
+) -> Result<Json<crate::catalog::ToolPage>, ApiError> {
+    require_admin(&request_id, &state, &headers).await?;
+    let Query(query) = parse_query(&request_id, query)?;
+    validate_query(&request_id, query.query.as_deref())?;
+    state
+        .catalog
+        .list_tools(ListToolsFilter {
+            query: query.query,
+            source_id: query.source_id,
+            effective_mode: query.mode,
+            include_tombstoned: query.include_tombstoned.unwrap_or(false),
+            limit: query.limit.unwrap_or(50),
+            offset: query.offset.unwrap_or(0),
+        })
+        .await
+        .map(Json)
+        .map_err(|error| catalog_error(&request_id, error))
+}
+
+async fn tool_detail(
+    Extension(request_id): Extension<RequestId>,
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    path: Result<Path<String>, PathRejection>,
+) -> Result<Json<crate::catalog::ToolRecord>, ApiError> {
+    require_admin(&request_id, &state, &headers).await?;
+    let Path(tool_id) = parse_path(&request_id, path)?;
+    state
+        .catalog
+        .tool(&tool_id)
+        .await
+        .map(Json)
+        .map_err(|error| catalog_error(&request_id, error))
+}
+
+async fn set_tool_mode(
+    Extension(request_id): Extension<RequestId>,
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    path: Result<Path<String>, PathRejection>,
+    payload: Result<Json<SetModeRequest>, axum::extract::rejection::JsonRejection>,
+) -> Result<Json<crate::catalog::ToolRecord>, ApiError> {
+    let admin = require_admin_mutation(&request_id, &state, &headers).await?;
+    let Path(tool_id) = parse_path(&request_id, path)?;
+    let Json(payload) = parse_json(&request_id, payload)?;
+    let mode = parse_mode(&request_id, payload.mode)?;
+    state
+        .sources
+        .set_tool_mode(
+            &tool_id,
+            mode,
+            payload.expected_revision,
+            AuditContext::admin(&request_id.0, admin.id),
+        )
+        .await
+        .map(Json)
+        .map_err(|error| super::protocols::protocol_error(&request_id, error))
+}
+
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct BulkModeRequest {
+    selection: BulkModeSelection,
+    mode: serde_json::Value,
+}
+
+#[derive(Deserialize)]
+#[serde(
+    tag = "type",
+    rename_all = "snake_case",
+    rename_all_fields = "camelCase"
+)]
+enum BulkModeSelection {
+    Source {
+        source_id: String,
+        expected_source_revision: i64,
+    },
+    ToolIds {
+        tool_ids: Vec<String>,
+        expected_catalog_revision: i64,
+    },
+}
+
+async fn bulk_set_tool_modes(
+    Extension(request_id): Extension<RequestId>,
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    payload: Result<Json<BulkModeRequest>, axum::extract::rejection::JsonRejection>,
+) -> Result<Json<crate::catalog::BulkToolModeResult>, ApiError> {
+    let admin = require_admin_mutation(&request_id, &state, &headers).await?;
+    let Json(payload) = parse_json(&request_id, payload)?;
+    let mode = parse_mode(&request_id, payload.mode)?;
+    let result = match payload.selection {
+        BulkModeSelection::Source {
+            source_id,
+            expected_source_revision,
+        } => {
+            state
+                .sources
+                .bulk_set_source_tool_modes(
+                    &source_id,
+                    mode,
+                    expected_source_revision,
+                    AuditContext::admin(&request_id.0, admin.id),
+                )
+                .await
+        }
+        BulkModeSelection::ToolIds {
+            tool_ids,
+            expected_catalog_revision,
+        } => {
+            state
+                .sources
+                .bulk_set_tool_modes(
+                    &tool_ids,
+                    mode,
+                    expected_catalog_revision,
+                    AuditContext::admin(&request_id.0, admin.id),
+                )
+                .await
+        }
+    }
+    .map_err(|error| super::protocols::protocol_error(&request_id, error))?;
+    Ok(Json(result))
+}
+
+#[derive(Default, Deserialize)]
+struct RequestLogQuery {
+    cursor: Option<String>,
+    limit: Option<u32>,
+}
+
+async fn list_request_logs(
+    Extension(request_id): Extension<RequestId>,
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    query: Result<Query<RequestLogQuery>, QueryRejection>,
+) -> Result<Json<crate::catalog::RequestLogPage>, ApiError> {
+    require_admin(&request_id, &state, &headers).await?;
+    let Query(query) = parse_query(&request_id, query)?;
+    state
+        .catalog
+        .list_request_logs(query.cursor.as_deref(), query.limit.unwrap_or(50))
+        .await
+        .map(Json)
+        .map_err(|error| catalog_error(&request_id, error))
+}
+
+async fn request_log_detail(
+    Extension(request_id): Extension<RequestId>,
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    path: Result<Path<String>, PathRejection>,
+) -> Result<Json<crate::catalog::RequestLogRecord>, ApiError> {
+    require_admin(&request_id, &state, &headers).await?;
+    let Path(log_id) = parse_path(&request_id, path)?;
+    state
+        .catalog
+        .request_log(&log_id)
+        .await
+        .map(Json)
+        .map_err(|error| catalog_error(&request_id, error))
+}
+
+#[derive(Deserialize)]
+struct SearchRequest {
+    query: String,
+    namespace: Option<String>,
+    limit: Option<u32>,
+    offset: Option<u32>,
+}
+
+async fn gateway_search(
+    Extension(request_id): Extension<RequestId>,
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    payload: Result<Json<SearchRequest>, axum::extract::rejection::JsonRejection>,
+) -> Result<Json<crate::catalog::DiscoveryPage>, ApiError> {
+    let identity = require_gateway_token(&request_id, &state, &headers).await?;
+    let Json(payload) = parse_json(&request_id, payload)?;
+    validate_query(&request_id, Some(&payload.query))?;
+    let started = Instant::now();
+    let catalog = state.catalog.clone();
+    let query = payload.query;
+    let namespace = payload.namespace;
+    let limit = payload.limit.unwrap_or(12);
+    let offset = payload.offset.unwrap_or(0);
+    let result =
+        match with_gateway_search_slot(&request_id, &state.gateway_search_slots, async move {
+            catalog
+                .search_tools(&query, namespace.as_deref(), limit, offset)
+                .await
+        })
+        .await
+        {
+            Ok(result) => result,
+            Err(error) => {
+                record_gateway_busy(&state, &request_id, &identity.token_id, started);
+                return Err(error);
+            }
+        };
+    record_gateway_result(
+        &state,
+        &request_id,
+        &identity.token_id,
+        "tools.search",
+        None,
+        None,
+        started,
+        &result,
+    );
+    result
+        .map(Json)
+        .map_err(|error| catalog_error(&request_id, error))
+}
+
+async fn with_gateway_search_slot<T>(
+    request_id: &RequestId,
+    slots: &Arc<Semaphore>,
+    search: impl Future<Output = T> + Send + 'static,
+) -> Result<T, ApiError>
+where
+    T: Send + 'static,
+{
+    let permit = slots.clone().try_acquire_owned().map_err(|_| {
+        ApiError::new(
+            request_id,
+            StatusCode::TOO_MANY_REQUESTS,
+            "search_busy",
+            "Tool search is busy. Try again shortly.",
+        )
+        .with_retry_after(1)
+    })?;
+    let search = tokio::spawn(async move {
+        let result = search.await;
+        drop(permit);
+        result
+    });
+    Ok(search
+        .await
+        .expect("the gateway search task must run to completion"))
+}
+
+fn record_gateway_busy(state: &AppState, request_id: &RequestId, token_id: &str, started: Instant) {
+    let duration_ms = u64::try_from(started.elapsed().as_millis()).unwrap_or(u64::MAX);
+    state.request_logs.try_record(NewRequestLog {
+        request_id: request_id.0.clone(),
+        actor_api_token_id: Some(token_id.to_owned()),
+        surface: RequestSurface::Gateway,
+        source_id: None,
+        tool_id: None,
+        path_snapshot: Some("tools.search".to_owned()),
+        outcome: RequestOutcome::Failed,
+        error_code: Some("search_busy".to_owned()),
+        duration_ms,
+        approval_id: None,
+        created_at: unix_timestamp(),
+    });
+}
+
+#[derive(Deserialize)]
+struct PathRequest {
+    path: String,
+}
+
+async fn gateway_describe(
+    Extension(request_id): Extension<RequestId>,
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    payload: Result<Json<PathRequest>, axum::extract::rejection::JsonRejection>,
+) -> Result<Json<crate::catalog::DescribedTool>, ApiError> {
+    let identity = require_gateway_token(&request_id, &state, &headers).await?;
+    let Json(payload) = parse_json(&request_id, payload)?;
+    validate_path(&request_id, &payload.path)?;
+    let started = Instant::now();
+    let result = state.catalog.describe_tool(&payload.path).await;
+    record_gateway_result(
+        &state,
+        &request_id,
+        &identity.token_id,
+        &callable_snapshot(&payload.path),
+        None,
+        None,
+        started,
+        &result,
+    );
+    result
+        .map(Json)
+        .map_err(|error| catalog_error(&request_id, error))
+}
+
+async fn gateway_lookup(
+    Extension(request_id): Extension<RequestId>,
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    payload: Result<Json<PathRequest>, axum::extract::rejection::JsonRejection>,
+) -> Result<Json<crate::catalog::InvocationLookup>, ApiError> {
+    let identity = require_gateway_token(&request_id, &state, &headers).await?;
+    let Json(payload) = parse_json(&request_id, payload)?;
+    validate_path(&request_id, &payload.path)?;
+    let started = Instant::now();
+    let result = state.catalog.guard_invocation(&payload.path).await;
+    let source_id = result.as_ref().ok().map(|lookup| lookup.source_id.as_str());
+    let tool_id = result.as_ref().ok().map(|lookup| lookup.tool_id.as_str());
+    let path = result
+        .as_ref()
+        .ok()
+        .map(|lookup| lookup.callable_path.clone())
+        .unwrap_or_else(|| callable_snapshot(&payload.path));
+    record_gateway_result(
+        &state,
+        &request_id,
+        &identity.token_id,
+        &path,
+        source_id,
+        tool_id,
+        started,
+        &result,
+    );
+    result
+        .map(Json)
+        .map_err(|error| catalog_error(&request_id, error))
+}
+
+#[allow(clippy::too_many_arguments)]
+fn record_gateway_result<T>(
+    state: &AppState,
+    request_id: &RequestId,
+    token_id: &str,
+    path_snapshot: &str,
+    source_id: Option<&str>,
+    tool_id: Option<&str>,
+    started: Instant,
+    result: &Result<T, CatalogError>,
+) {
+    let (outcome, error_code) = match result {
+        Ok(_) => (RequestOutcome::Succeeded, None),
+        Err(CatalogError::ToolDisabled { .. }) => (RequestOutcome::Denied, Some("tool_disabled")),
+        Err(error) => (RequestOutcome::Failed, Some(catalog_error_code(error))),
+    };
+    let duration_ms = u64::try_from(started.elapsed().as_millis()).unwrap_or(u64::MAX);
+    state.request_logs.try_record(NewRequestLog {
+        request_id: request_id.0.clone(),
+        actor_api_token_id: Some(token_id.to_owned()),
+        surface: RequestSurface::Gateway,
+        source_id: source_id.map(str::to_owned),
+        tool_id: tool_id.map(str::to_owned),
+        path_snapshot: Some(path_snapshot.to_owned()),
+        outcome,
+        error_code: error_code.map(str::to_owned),
+        duration_ms,
+        approval_id: None,
+        created_at: unix_timestamp(),
+    });
+}
+
+fn catalog_error_code(error: &CatalogError) -> &'static str {
+    match error {
+        CatalogError::Validation { code, .. } => code,
+        CatalogError::NotFound { entity: "source" } => "source_not_found",
+        CatalogError::NotFound {
+            entity: "request log",
+        } => "request_log_not_found",
+        CatalogError::NotFound { .. } | CatalogError::ToolNotFound { .. } => "tool_not_found",
+        CatalogError::ToolDisabled { .. } => "tool_disabled",
+        CatalogError::RevisionConflict { .. } => "revision_conflict",
+        CatalogError::Database(_)
+        | CatalogError::Crypto(_)
+        | CatalogError::Json(_)
+        | CatalogError::CorruptData(_) => "internal_error",
+    }
+}
+
+fn callable_snapshot(path: &str) -> String {
+    if path.starts_with("tools.") {
+        path.to_owned()
+    } else {
+        format!("tools.{path}")
+    }
+}
+
+fn parse_query<T>(
+    request_id: &RequestId,
+    query: Result<Query<T>, QueryRejection>,
+) -> Result<Query<T>, ApiError> {
+    query.map_err(|_| {
+        ApiError::new(
+            request_id,
+            StatusCode::BAD_REQUEST,
+            "invalid_query",
+            "The query parameters are invalid.",
+        )
+    })
+}
+
+fn parse_path<T>(
+    request_id: &RequestId,
+    path: Result<Path<T>, PathRejection>,
+) -> Result<Path<T>, ApiError> {
+    path.map_err(|_| {
+        ApiError::new(
+            request_id,
+            StatusCode::BAD_REQUEST,
+            "invalid_path",
+            "The path parameters are invalid.",
+        )
+    })
+}
+
+fn parse_mode(
+    request_id: &RequestId,
+    value: serde_json::Value,
+) -> Result<Option<ToolMode>, ApiError> {
+    if value.is_null() {
+        return Ok(None);
+    }
+    serde_json::from_value(value).map(Some).map_err(|_| {
+        ApiError::new(
+            request_id,
+            StatusCode::BAD_REQUEST,
+            "invalid_tool_mode",
+            "Tool mode must be enabled, ask, disabled, or null.",
+        )
+    })
+}
+
+fn validate_query(request_id: &RequestId, query: Option<&str>) -> Result<(), ApiError> {
+    if query.is_some_and(|query| query.chars().count() > MAX_QUERY_CHARACTERS) {
+        Err(ApiError::new(
+            request_id,
+            StatusCode::BAD_REQUEST,
+            "invalid_query",
+            "Search queries may contain at most 256 characters.",
+        ))
+    } else {
+        Ok(())
+    }
+}
+
+fn validate_path(request_id: &RequestId, path: &str) -> Result<(), ApiError> {
+    let sandbox_path = path.strip_prefix("tools.").unwrap_or(path);
+    let mut segments = sandbox_path.split('.');
+    let valid = segments.next().is_some_and(valid_path_segment)
+        && segments.next().is_some_and(valid_path_segment)
+        && segments.next().is_none()
+        && callable_snapshot(path).len() <= 512;
+    if !valid {
+        Err(ApiError::new(
+            request_id,
+            StatusCode::BAD_REQUEST,
+            "invalid_tool_path",
+            "A valid tool path is required.",
+        ))
+    } else {
+        Ok(())
+    }
+}
+
+fn valid_path_segment(segment: &str) -> bool {
+    let mut characters = segment.chars();
+    characters
+        .next()
+        .is_some_and(|character| character.is_ascii_lowercase())
+        && characters.all(|character| {
+            character.is_ascii_lowercase() || character.is_ascii_digit() || character == '_'
+        })
+}
+
+fn catalog_error(request_id: &RequestId, error: CatalogError) -> ApiError {
+    match error {
+        CatalogError::Validation { code, message } => {
+            ApiError::new(request_id, StatusCode::BAD_REQUEST, code, message)
+        }
+        CatalogError::NotFound { entity: "source" } => ApiError::new(
+            request_id,
+            StatusCode::NOT_FOUND,
+            "source_not_found",
+            "The requested source does not exist.",
+        ),
+        CatalogError::NotFound {
+            entity: "request log",
+        } => ApiError::new(
+            request_id,
+            StatusCode::NOT_FOUND,
+            "request_log_not_found",
+            "The requested request log does not exist.",
+        ),
+        CatalogError::NotFound { .. } | CatalogError::ToolNotFound { .. } => ApiError::new(
+            request_id,
+            StatusCode::NOT_FOUND,
+            "tool_not_found",
+            "The requested tool does not exist.",
+        ),
+        CatalogError::ToolDisabled { .. } => ApiError::new(
+            request_id,
+            StatusCode::FORBIDDEN,
+            "tool_disabled",
+            "The requested tool is disabled.",
+        ),
+        CatalogError::RevisionConflict { .. } => ApiError::new(
+            request_id,
+            StatusCode::CONFLICT,
+            "revision_conflict",
+            "The catalog changed. Refresh and retry the update.",
+        ),
+        error => ApiError::internal_logged(request_id, error),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::{
+        sync::{
+            Arc,
+            atomic::{AtomicBool, Ordering},
+        },
+        time::Duration,
+    };
+
+    use axum::{http::header, response::IntoResponse};
+    use http_body_util::BodyExt;
+    use serde_json::Value;
+    use tokio::{
+        sync::{Notify, Semaphore},
+        time::timeout,
+    };
+
+    use super::{RequestId, with_gateway_search_slot};
+
+    #[tokio::test]
+    async fn broad_gateway_search_rejects_excess_without_waiting_and_then_recovers() {
+        let slots = Arc::new(Semaphore::new(1));
+        let broad_started = Arc::new(Notify::new());
+        let release_broad = Arc::new(Notify::new());
+        let broad_slots = Arc::clone(&slots);
+        let broad_started_signal = Arc::clone(&broad_started);
+        let broad_release_signal = Arc::clone(&release_broad);
+        let broad_search = tokio::spawn(async move {
+            with_gateway_search_slot(
+                &RequestId("broad-search".to_owned()),
+                &broad_slots,
+                async move {
+                    broad_started_signal.notify_one();
+                    broad_release_signal.notified().await;
+                    "broad-result"
+                },
+            )
+            .await
+        });
+        broad_started.notified().await;
+
+        let excess_polled = Arc::new(AtomicBool::new(false));
+        let excess_polled_inside = Arc::clone(&excess_polled);
+        let busy = timeout(
+            Duration::from_millis(100),
+            with_gateway_search_slot(&RequestId("excess-search".to_owned()), &slots, async move {
+                excess_polled_inside.store(true, Ordering::SeqCst);
+                "must-not-run"
+            }),
+        )
+        .await
+        .expect("an excess search must fail without waiting")
+        .expect_err("the occupied global search slot must reject excess work");
+        assert!(!excess_polled.load(Ordering::SeqCst));
+
+        let response = busy.into_response();
+        assert_eq!(response.status(), axum::http::StatusCode::TOO_MANY_REQUESTS);
+        assert_eq!(
+            response.headers().get(header::RETRY_AFTER),
+            Some(&axum::http::HeaderValue::from_static("1"))
+        );
+        let body = response
+            .into_body()
+            .collect()
+            .await
+            .expect("busy response body should collect")
+            .to_bytes();
+        let body: Value = serde_json::from_slice(&body).expect("busy response should contain JSON");
+        assert_eq!(body["error"]["code"], "search_busy");
+        assert_eq!(body["error"]["requestId"], "excess-search");
+
+        release_broad.notify_one();
+        let broad_result = broad_search
+            .await
+            .expect("broad search task should not panic");
+        let Ok(broad_result) = broad_result else {
+            panic!("broad search should own the slot");
+        };
+        assert_eq!(broad_result, "broad-result");
+        let recovered =
+            with_gateway_search_slot(&RequestId("recovered-search".to_owned()), &slots, async {
+                "recovered-result"
+            })
+            .await;
+        let Ok(recovered) = recovered else {
+            panic!("the global search slot should recover after completion");
+        };
+        assert_eq!(recovered, "recovered-result");
+    }
+
+    #[tokio::test]
+    async fn aborted_search_waiter_keeps_slot_until_underlying_search_completes() {
+        let slots = Arc::new(Semaphore::new(1));
+        let search_started = Arc::new(Notify::new());
+        let release_search = Arc::new(Notify::new());
+        let search_completed = Arc::new(Notify::new());
+        let waiter_slots = Arc::clone(&slots);
+        let started_signal = Arc::clone(&search_started);
+        let release_signal = Arc::clone(&release_search);
+        let completed_signal = Arc::clone(&search_completed);
+        let waiter = tokio::spawn(async move {
+            with_gateway_search_slot(
+                &RequestId("cancelled-search".to_owned()),
+                &waiter_slots,
+                async move {
+                    started_signal.notify_one();
+                    release_signal.notified().await;
+                    completed_signal.notify_one();
+                    "cancelled-waiter-result"
+                },
+            )
+            .await
+        });
+        search_started.notified().await;
+
+        waiter.abort();
+        let waiter_error = match waiter.await {
+            Err(error) => error,
+            Ok(_) => panic!("the request-side waiter should be cancelled"),
+        };
+        assert!(waiter_error.is_cancelled());
+
+        let excess_polled = Arc::new(AtomicBool::new(false));
+        let excess_polled_inside = Arc::clone(&excess_polled);
+        let busy = with_gateway_search_slot(
+            &RequestId("cancelled-search-excess".to_owned()),
+            &slots,
+            async move {
+                excess_polled_inside.store(true, Ordering::SeqCst);
+                "must-not-run"
+            },
+        )
+        .await
+        .expect_err("the detached underlying search must continue owning the slot");
+        assert!(!excess_polled.load(Ordering::SeqCst));
+        assert_eq!(
+            busy.into_response().status(),
+            axum::http::StatusCode::TOO_MANY_REQUESTS
+        );
+
+        release_search.notify_one();
+        timeout(Duration::from_secs(1), search_completed.notified())
+            .await
+            .expect("the detached underlying search should finish");
+        timeout(Duration::from_secs(1), async {
+            while slots.available_permits() == 0 {
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .expect("the slot should be released after underlying completion");
+
+        let recovered = with_gateway_search_slot(
+            &RequestId("cancelled-search-recovered".to_owned()),
+            &slots,
+            async { "recovered-result" },
+        )
+        .await;
+        let Ok(recovered) = recovered else {
+            panic!("search admission should recover after underlying completion");
+        };
+        assert_eq!(recovered, "recovered-result");
+    }
+}
diff --git a/src/api/oauth.rs b/src/api/oauth.rs
new file mode 100644
index 000000000..b85aa1090
--- /dev/null
+++ b/src/api/oauth.rs
@@ -0,0 +1,623 @@
+use std::collections::HashSet;
+
+use axum::{
+    Json, Router,
+    extract::{
+        Extension, FromRequestParts, Path, Query, State, rejection::JsonRejection,
+        rejection::QueryRejection,
+    },
+    http::{HeaderMap, HeaderValue, StatusCode, header, request::Parts},
+    response::{IntoResponse, Redirect, Response},
+    routing::{get, post},
+};
+use percent_encoding::{NON_ALPHANUMERIC, utf8_percent_encode};
+use serde::{Deserialize, Serialize};
+
+use super::protocols::protocol_error;
+use super::{
+    AdminAuthentication, AdminSession, ApiError, AppState, RequestId, parse_json, require_admin,
+    require_admin_mutation,
+};
+use crate::catalog::AuditContext;
+use crate::oauth::{
+    CallbackRequest, ConnectionView, OAuthClientInput, OAuthDiscoveryInput, OAuthError,
+    SaveConnectionRequest,
+};
+use crate::protocols::AvailableOAuthCredential;
+
+const CALLBACK_UI_PATH: &str = "/sources";
+
+#[derive(Clone, Copy)]
+enum CallbackOutcome {
+    Failed,
+    Success,
+    SuccessRefreshFailed,
+}
+
+impl CallbackOutcome {
+    const fn as_str(self) -> &'static str {
+        match self {
+            Self::Failed => "failed",
+            Self::Success => "success",
+            Self::SuccessRefreshFailed => "success_refresh_failed",
+        }
+    }
+}
+
+pub(super) fn router() -> Router<AppState> {
+    Router::new()
+        .route("/api/v1/sources/{sourceId}/oauth", get(list_connections))
+        .route(
+            "/api/v1/sources/{sourceId}/oauth/{credentialKey}",
+            axum::routing::put(save_connection).delete(delete_connection),
+        )
+        .route(
+            "/api/v1/sources/{sourceId}/oauth/{credentialKey}/authorize",
+            post(begin_authorization),
+        )
+        .route(
+            "/api/v1/sources/{sourceId}/oauth/{credentialKey}/disconnect",
+            post(disconnect),
+        )
+        .route(
+            "/api/v1/oauth/callback/{connectionId}",
+            get(complete_callback),
+        )
+}
+
+struct OAuthAdminMutation(AdminSession);
+
+impl FromRequestParts<AppState> for OAuthAdminMutation {
+    type Rejection = ApiError;
+
+    async fn from_request_parts(
+        parts: &mut Parts,
+        state: &AppState,
+    ) -> Result<Self, Self::Rejection> {
+        let request_id = parts
+            .extensions
+            .get::<RequestId>()
+            .expect("request ID middleware runs before authentication")
+            .clone();
+        let admin = require_admin_mutation(&request_id, state, &parts.headers).await?;
+        Ok(Self(admin))
+    }
+}
+
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct SaveConnectionBody {
+    expected_revision: i64,
+    discovery: OAuthDiscoveryInput,
+    client: OAuthClientInput,
+    scopes: Vec<String>,
+}
+
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct RevisionBody {
+    expected_revision: i64,
+}
+
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct RevisionQuery {
+    expected_revision: i64,
+}
+
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+struct ConnectionListResponse {
+    connections: Vec<ConnectionListItem>,
+    available_credentials: Vec<AvailableOAuthCredential>,
+}
+
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+struct ConnectionListItem {
+    #[serde(flatten)]
+    connection: ConnectionView,
+    #[serde(rename = "managedOAuthEligible")]
+    managed_oauth_eligible: bool,
+}
+
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+struct AuthorizationStartResponse {
+    authorization_url: String,
+}
+
+#[derive(Deserialize)]
+struct CallbackQuery {
+    state: String,
+    code: Option<String>,
+    error: Option<String>,
+}
+
+async fn list_connections(
+    Extension(request_id): Extension<RequestId>,
+    State(state): State<AppState>,
+    _admin: AdminAuthentication,
+    Path(source_id): Path<String>,
+) -> Result<Json<ConnectionListResponse>, ApiError> {
+    let connections = state
+        .oauth
+        .list_connections(&source_id)
+        .await
+        .map_err(|error| oauth_error(&request_id, error))?;
+    let configured_keys = connections
+        .iter()
+        .map(|connection| connection.credential_key.clone())
+        .collect::<HashSet<_>>();
+    let credential_options = state
+        .sources
+        .available_oauth_credentials(&source_id)
+        .await
+        .map_err(|error| protocol_error(&request_id, error))?;
+    let eligible_keys = credential_options
+        .iter()
+        .filter(|credential| credential.managed_oauth_eligible)
+        .map(|credential| credential.credential_key.as_str())
+        .collect::<HashSet<_>>();
+    let connections = connections
+        .into_iter()
+        .map(|connection| ConnectionListItem {
+            managed_oauth_eligible: eligible_keys.contains(connection.credential_key.as_str()),
+            connection,
+        })
+        .collect();
+    let available_credentials = credential_options
+        .into_iter()
+        .filter(|credential| !configured_keys.contains(credential.credential_key.as_str()))
+        .collect();
+    Ok(Json(ConnectionListResponse {
+        connections,
+        available_credentials,
+    }))
+}
+
+async fn save_connection(
+    Extension(request_id): Extension<RequestId>,
+    State(state): State<AppState>,
+    OAuthAdminMutation(admin): OAuthAdminMutation,
+    Path((source_id, credential_key)): Path<(String, String)>,
+    payload: Result<Json<SaveConnectionBody>, JsonRejection>,
+) -> Result<Json<ConnectionListItem>, ApiError> {
+    let Json(payload) = parse_json(&request_id, payload)?;
+    require_eligible_credential(&request_id, &state, &source_id, &credential_key).await?;
+    state
+        .sources
+        .ensure_managed_oauth_origin_bound(
+            &source_id,
+            &credential_key,
+            AuditContext::admin(&request_id.0, admin.id),
+        )
+        .await
+        .map_err(|error| protocol_error(&request_id, error))?;
+    let connection = state
+        .oauth
+        .save_connection(
+            &source_id,
+            &credential_key,
+            SaveConnectionRequest {
+                expected_revision: payload.expected_revision,
+                discovery: payload.discovery,
+                client: payload.client,
+                scopes: payload.scopes,
+            },
+        )
+        .await
+        .map_err(|error| oauth_error(&request_id, error))?;
+    Ok(Json(ConnectionListItem {
+        connection,
+        managed_oauth_eligible: true,
+    }))
+}
+
+async fn begin_authorization(
+    Extension(request_id): Extension<RequestId>,
+    State(state): State<AppState>,
+    OAuthAdminMutation(admin): OAuthAdminMutation,
+    Path((source_id, credential_key)): Path<(String, String)>,
+    payload: Result<Json<RevisionBody>, JsonRejection>,
+) -> Result<Json<AuthorizationStartResponse>, ApiError> {
+    let Json(payload) = parse_json(&request_id, payload)?;
+    require_eligible_credential(&request_id, &state, &source_id, &credential_key).await?;
+    state
+        .sources
+        .ensure_managed_oauth_origin_bound(
+            &source_id,
+            &credential_key,
+            AuditContext::admin(&request_id.0, admin.id),
+        )
+        .await
+        .map_err(|error| protocol_error(&request_id, error))?;
+    let authorization = state
+        .oauth
+        .begin_authorization(
+            &source_id,
+            &credential_key,
+            payload.expected_revision,
+            admin.id,
+            &admin.session_digest,
+        )
+        .await
+        .map_err(|error| oauth_error(&request_id, error))?;
+    Ok(Json(AuthorizationStartResponse {
+        authorization_url: authorization.authorization_url,
+    }))
+}
+
+async fn require_eligible_credential(
+    request_id: &RequestId,
+    state: &AppState,
+    source_id: &str,
+    credential_key: &str,
+) -> Result<(), ApiError> {
+    let eligible = credential_is_eligible(request_id, state, source_id, credential_key).await?;
+    if eligible {
+        Ok(())
+    } else {
+        Err(ApiError::new(
+            request_id,
+            StatusCode::BAD_REQUEST,
+            "oauth_credential_ineligible",
+            "The selected source credential does not support managed OAuth.",
+        ))
+    }
+}
+
+async fn credential_is_eligible(
+    request_id: &RequestId,
+    state: &AppState,
+    source_id: &str,
+    credential_key: &str,
+) -> Result<bool, ApiError> {
+    Ok(state
+        .sources
+        .available_oauth_credentials(source_id)
+        .await
+        .map_err(|error| protocol_error(request_id, error))?
+        .into_iter()
+        .any(|credential| {
+            credential.managed_oauth_eligible && credential.credential_key == credential_key
+        }))
+}
+
+async fn disconnect(
+    Extension(request_id): Extension<RequestId>,
+    State(state): State<AppState>,
+    OAuthAdminMutation(_admin): OAuthAdminMutation,
+    Path((source_id, credential_key)): Path<(String, String)>,
+    payload: Result<Json<RevisionBody>, JsonRejection>,
+) -> Result<Json<ConnectionListItem>, ApiError> {
+    let Json(payload) = parse_json(&request_id, payload)?;
+    let managed_oauth_eligible =
+        credential_is_eligible(&request_id, &state, &source_id, &credential_key).await?;
+    let connection = state
+        .oauth
+        .disconnect(&source_id, &credential_key, payload.expected_revision)
+        .await
+        .map_err(|error| oauth_error(&request_id, error))?;
+    Ok(Json(ConnectionListItem {
+        connection,
+        managed_oauth_eligible,
+    }))
+}
+
+async fn delete_connection(
+    Extension(request_id): Extension<RequestId>,
+    State(state): State<AppState>,
+    OAuthAdminMutation(admin): OAuthAdminMutation,
+    Path((source_id, credential_key)): Path<(String, String)>,
+    query: Result<Query<RevisionQuery>, QueryRejection>,
+) -> Result<StatusCode, ApiError> {
+    let Query(query) = query.map_err(|_| invalid_revision(&request_id))?;
+    match state
+        .oauth
+        .delete_connection(&source_id, &credential_key, query.expected_revision)
+        .await
+    {
+        Ok(()) | Err(OAuthError::NotFound) => {}
+        Err(error) => return Err(oauth_error(&request_id, error)),
+    }
+    state
+        .sources
+        .retire_managed_oauth_origin(
+            &source_id,
+            &credential_key,
+            AuditContext::admin(&request_id.0, admin.id),
+        )
+        .await
+        .map_err(|error| protocol_error(&request_id, error))?;
+    Ok(StatusCode::NO_CONTENT)
+}
+
+async fn complete_callback(
+    Extension(request_id): Extension<RequestId>,
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    Path(connection_id): Path<String>,
+    query: Result<Query<CallbackQuery>, QueryRejection>,
+) -> Response {
+    let response =
+        match complete_callback_result(&request_id, &state, &headers, connection_id.clone(), query)
+            .await
+        {
+            Ok(redirect) => redirect.into_response(),
+            Err(_) => {
+                callback_redirect(&state, CallbackOutcome::Failed, &connection_id).into_response()
+            }
+        };
+    with_callback_headers(response)
+}
+
+async fn complete_callback_result(
+    request_id: &RequestId,
+    state: &AppState,
+    headers: &HeaderMap,
+    connection_id: String,
+    query: Result<Query<CallbackQuery>, QueryRejection>,
+) -> Result<Redirect, ApiError> {
+    let admin = require_admin(request_id, state, headers).await?;
+    let Query(query) = query.map_err(|_| invalid_callback(request_id))?;
+    let result = match state
+        .oauth
+        .complete_callback(
+            CallbackRequest {
+                connection_id,
+                state: query.state,
+                code: query.code,
+                error: query.error,
+            },
+            admin.id,
+            &admin.session_digest,
+        )
+        .await
+    {
+        Ok(result) => result,
+        Err(OAuthError::AuthorizationDenied { connection_id }) => {
+            return Ok(callback_redirect(
+                state,
+                CallbackOutcome::Failed,
+                &connection_id,
+            ));
+        }
+        Err(error) => return Err(oauth_error(request_id, error)),
+    };
+    let outcome = match state
+        .sources
+        .refresh(
+            &result.source_id,
+            AuditContext::admin(&request_id.0, admin.id),
+        )
+        .await
+    {
+        Ok(_) => CallbackOutcome::Success,
+        Err(_) => CallbackOutcome::SuccessRefreshFailed,
+    };
+    Ok(callback_redirect(state, outcome, &result.connection_id))
+}
+
+fn callback_redirect(state: &AppState, outcome: CallbackOutcome, connection_id: &str) -> Redirect {
+    Redirect::to(&callback_target(
+        state.origin.as_ref(),
+        outcome,
+        connection_id,
+    ))
+}
+
+fn callback_target(origin: &str, outcome: CallbackOutcome, connection_id: &str) -> String {
+    let connection_id = utf8_percent_encode(connection_id, NON_ALPHANUMERIC);
+    let result = outcome.as_str();
+    format!("{origin}{CALLBACK_UI_PATH}?oauth={connection_id}&result={result}")
+}
+
+fn with_callback_headers(mut response: Response) -> Response {
+    response.headers_mut().insert(
+        header::REFERRER_POLICY,
+        HeaderValue::from_static("no-referrer"),
+    );
+    response
+}
+
+fn invalid_revision(request_id: &RequestId) -> ApiError {
+    ApiError::new(
+        request_id,
+        StatusCode::BAD_REQUEST,
+        "invalid_revision",
+        "A valid expectedRevision query parameter is required.",
+    )
+}
+
+fn invalid_callback(request_id: &RequestId) -> ApiError {
+    ApiError::new(
+        request_id,
+        StatusCode::BAD_REQUEST,
+        "invalid_oauth_callback",
+        "The OAuth callback parameters are invalid.",
+    )
+}
+
+fn oauth_error(request_id: &RequestId, error: OAuthError) -> ApiError {
+    match error {
+        OAuthError::Validation { code, message } => {
+            ApiError::new(request_id, StatusCode::BAD_REQUEST, code, message)
+        }
+        OAuthError::NotFound => ApiError::new(
+            request_id,
+            StatusCode::NOT_FOUND,
+            "oauth_connection_not_found",
+            "The OAuth connection does not exist.",
+        ),
+        OAuthError::Conflict { code, message } => {
+            ApiError::new(request_id, StatusCode::CONFLICT, code, message)
+        }
+        OAuthError::UnauthorizedTransaction => ApiError::new(
+            request_id,
+            StatusCode::BAD_REQUEST,
+            "invalid_oauth_transaction",
+            "The OAuth transaction is invalid for this administrator session.",
+        ),
+        OAuthError::AuthorizationDenied { .. } => ApiError::new(
+            request_id,
+            StatusCode::BAD_REQUEST,
+            "oauth_authorization_denied",
+            "OAuth authorization was denied.",
+        ),
+        OAuthError::Upstream { .. } => ApiError::new(
+            request_id,
+            StatusCode::BAD_GATEWAY,
+            "oauth_upstream_failed",
+            "The OAuth provider could not complete the request.",
+        ),
+        OAuthError::Internal => ApiError::internal(request_id),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use axum::{
+        http::{HeaderValue, StatusCode, header},
+        response::{IntoResponse, Redirect},
+    };
+
+    use super::{
+        CallbackOutcome, ConnectionListItem, callback_target, oauth_error, with_callback_headers,
+    };
+    use crate::{
+        api::RequestId,
+        oauth::{ClientAuthentication, ConnectionStatus, ConnectionView, OAuthError},
+    };
+
+    #[test]
+    fn callback_target_uses_only_the_configured_origin_and_fixed_ui_path() {
+        assert_eq!(
+            callback_target(
+                "https://executor.example",
+                CallbackOutcome::Failed,
+                "connection&result=success#fragment",
+            ),
+            "https://executor.example/sources?oauth=connection%26result%3Dsuccess%23fragment&result=failed"
+        );
+    }
+
+    #[test]
+    fn callback_target_allows_the_partial_success_outcome() {
+        assert_eq!(
+            callback_target(
+                "https://executor.example",
+                CallbackOutcome::SuccessRefreshFailed,
+                "connection",
+            ),
+            "https://executor.example/sources?oauth=connection&result=success_refresh_failed"
+        );
+    }
+
+    #[test]
+    fn callback_responses_never_forward_callback_secrets_as_referrers() {
+        let response = with_callback_headers(
+            Redirect::to("https://executor.example/sources?oauth=connection&result=success")
+                .into_response(),
+        );
+        assert_eq!(
+            response.headers().get(header::REFERRER_POLICY),
+            Some(&HeaderValue::from_static("no-referrer"))
+        );
+    }
+
+    #[test]
+    fn oauth_errors_have_exhaustive_status_and_redaction_contracts() {
+        let cases = [
+            (
+                OAuthError::Validation {
+                    code: "invalid_oauth_input",
+                    message: "The OAuth input is invalid.",
+                },
+                StatusCode::BAD_REQUEST,
+                "invalid_oauth_input",
+                "The OAuth input is invalid.",
+            ),
+            (
+                OAuthError::NotFound,
+                StatusCode::NOT_FOUND,
+                "oauth_connection_not_found",
+                "The OAuth connection does not exist.",
+            ),
+            (
+                OAuthError::Conflict {
+                    code: "oauth_binding_changed",
+                    message: "The OAuth binding changed.",
+                },
+                StatusCode::CONFLICT,
+                "oauth_binding_changed",
+                "The OAuth binding changed.",
+            ),
+            (
+                OAuthError::UnauthorizedTransaction,
+                StatusCode::BAD_REQUEST,
+                "invalid_oauth_transaction",
+                "The OAuth transaction is invalid for this administrator session.",
+            ),
+            (
+                OAuthError::AuthorizationDenied {
+                    connection_id: "secret-connection-id".to_owned(),
+                },
+                StatusCode::BAD_REQUEST,
+                "oauth_authorization_denied",
+                "OAuth authorization was denied.",
+            ),
+            (
+                OAuthError::Upstream {
+                    code: "provider_secret_marker",
+                },
+                StatusCode::BAD_GATEWAY,
+                "oauth_upstream_failed",
+                "The OAuth provider could not complete the request.",
+            ),
+            (
+                OAuthError::Internal,
+                StatusCode::INTERNAL_SERVER_ERROR,
+                "internal_error",
+                "The request could not be completed.",
+            ),
+        ];
+        for (source, status, code, message) in cases {
+            let error = oauth_error(&RequestId("request-id".to_owned()), source);
+            assert_eq!(error.status, status);
+            assert_eq!(error.code, code);
+            assert_eq!(error.message, message);
+            assert!(!error.message.contains("provider_secret_marker"));
+            assert!(!error.message.contains("secret-connection-id"));
+        }
+    }
+
+    #[test]
+    fn configured_connections_expose_current_managed_oauth_eligibility() {
+        let value = serde_json::to_value(ConnectionListItem {
+            connection: ConnectionView {
+                id: "connection".to_owned(),
+                credential_key: "default".to_owned(),
+                revision: 1,
+                status: ConnectionStatus::Connected,
+                issuer: "https://issuer.example".to_owned(),
+                client_id: "client".to_owned(),
+                client_auth_method: ClientAuthentication::None,
+                callback_url: "https://executor.example/api/v1/oauth/callback/connection"
+                    .to_owned(),
+                requested_scopes: vec!["read".to_owned()],
+                granted_scopes: vec!["read".to_owned()],
+                has_client_secret: false,
+                has_refresh_token: true,
+                access_expires_at: None,
+                authorized_at: Some(1),
+                last_refreshed_at: None,
+                error_code: None,
+            },
+            managed_oauth_eligible: false,
+        })
+        .expect("connection serializes");
+        assert_eq!(value["managedOAuthEligible"], false);
+        assert!(value.get("managedOauthEligible").is_none());
+    }
+}
diff --git a/src/api/openapi.rs b/src/api/openapi.rs
new file mode 100644
index 000000000..3fd535896
--- /dev/null
+++ b/src/api/openapi.rs
@@ -0,0 +1,40 @@
+use axum::{
+    Json, Router,
+    extract::{DefaultBodyLimit, Extension, State, rejection::JsonRejection},
+    routing::post,
+};
+use serde::Deserialize;
+
+use super::{AdminMutation, ApiError, AppState, RequestId, parse_json, protocols::protocol_error};
+use crate::protocols::{OpenApiPreview, OpenApiSpecInput};
+
+const MAX_SPEC_BYTES: usize = 16 * 1024 * 1024;
+
+pub(super) fn router() -> Router<AppState> {
+    Router::new()
+        .route("/api/v1/sources/openapi/preview", post(preview))
+        .layer(DefaultBodyLimit::max(MAX_SPEC_BYTES + 64 * 1024))
+}
+
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct PreviewRequest {
+    spec: OpenApiSpecInput,
+    #[serde(default)]
+    allow_private_network: bool,
+}
+
+async fn preview(
+    Extension(request_id): Extension<RequestId>,
+    State(state): State<AppState>,
+    AdminMutation(_admin_id): AdminMutation,
+    payload: Result<Json<PreviewRequest>, JsonRejection>,
+) -> Result<Json<OpenApiPreview>, ApiError> {
+    let Json(payload) = parse_json(&request_id, payload)?;
+    let preview = state
+        .sources
+        .preview_openapi(&payload.spec, payload.allow_private_network)
+        .await
+        .map_err(|error| protocol_error(&request_id, error))?;
+    Ok(Json(preview))
+}
diff --git a/src/api/protocols.rs b/src/api/protocols.rs
new file mode 100644
index 000000000..c4b7b4240
--- /dev/null
+++ b/src/api/protocols.rs
@@ -0,0 +1,2461 @@
+use std::{
+    collections::{BTreeMap, HashMap},
+    sync::{
+        Arc, Mutex,
+        atomic::{AtomicBool, Ordering},
+    },
+    time::Duration,
+};
+
+use axum::{
+    Json, Router,
+    body::Body,
+    extract::{
+        DefaultBodyLimit, Extension, Path, Query, State,
+        rejection::{JsonRejection, QueryRejection},
+    },
+    http::{HeaderMap, HeaderName, HeaderValue, StatusCode, header},
+    response::{IntoResponse, Response},
+    routing::{get, post},
+};
+use serde::{Deserialize, Serialize};
+use serde_json::{Map, Value};
+
+use super::{
+    AdminAuthentication, AdminMutation, ApiError, AppState, ErrorDetail, ErrorEnvelope,
+    GatewayAuthentication, RequestId, parse_json,
+};
+use crate::{
+    actor::ToolActor,
+    approval::ApprovalError,
+    catalog::{
+        AuditContext, CatalogError, RequestSurface, SourceKind,
+        source_idempotency::{
+            SOURCE_CREATION_ROUTE, SourceCreationIdempotencyClaim, SourceCreationIdempotencyError,
+            SourceCreationIdempotencyStatus, SourceCreationIdempotencyStore, SourceCreationReplay,
+            SourceCreationReservation, SourceCreationResponse, SourceCreationResponseKind,
+            source_creation_idempotency_key_is_valid,
+        },
+    },
+    execution::{ExecuteCodeRequest, ExecutionServiceError},
+    invocation::{
+        GatewayInvokeError, GatewayInvokeResponse, ToolCall, ToolCallAdapterErrorCode,
+        ToolCallError, ToolCallOAuthError, ToolCallSubmission, ToolDiscoveryError,
+        gateway_idempotency_key_is_valid,
+    },
+    outbound::OutboundError,
+    protocols::{CredentialMetadata, ProtocolError, ProtocolErrorCategory},
+    runtime::RuntimeFailure,
+};
+
+const MAX_SOURCE_BODY_BYTES: usize = 16 * 1024 * 1024 + 64 * 1024;
+const MAX_INVOKE_BODY_BYTES: usize = crate::invocation::MAX_ARGUMENT_BYTES + 64 * 1024;
+const MAX_EXECUTE_BODY_BYTES: usize = crate::runtime::MAX_SOURCE_BYTES + 64 * 1024;
+const DEFAULT_EXECUTION_TIMEOUT_MILLIS: u64 = 30_000;
+const MAX_EXECUTION_TIMEOUT_MILLIS: u64 = 300_000;
+const IDEMPOTENCY_KEY_HEADER: &str = "idempotency-key";
+const SOURCE_CREATION_RECOVERY_ATTEMPTS: usize = 4;
+
+#[derive(Clone, Default)]
+pub(super) struct SourceCreationSupervisorRegistry {
+    active: Arc<Mutex<HashMap<SourceCreationSupervisorKey, Arc<SourceCreationCompletion>>>>,
+}
+
+#[derive(Clone, Copy, Hash, Eq, PartialEq)]
+struct SourceCreationSupervisorKey {
+    admin_id: i64,
+    key_digest: [u8; 32],
+}
+
+struct SourceCreationCompletion {
+    finished: AtomicBool,
+    notify: tokio::sync::Notify,
+}
+
+struct SourceCreationSupervisorGuard {
+    registry: SourceCreationSupervisorRegistry,
+    key: SourceCreationSupervisorKey,
+    completion: Arc<SourceCreationCompletion>,
+}
+
+impl SourceCreationSupervisorRegistry {
+    fn register(&self, key: SourceCreationSupervisorKey) -> SourceCreationSupervisorGuard {
+        let completion = Arc::new(SourceCreationCompletion {
+            finished: AtomicBool::new(false),
+            notify: tokio::sync::Notify::new(),
+        });
+        self.active
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+            .insert(key, completion.clone());
+        SourceCreationSupervisorGuard {
+            registry: self.clone(),
+            key,
+            completion,
+        }
+    }
+
+    async fn wait_if_active(&self, key: SourceCreationSupervisorKey) {
+        let completion = self
+            .active
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+            .get(&key)
+            .cloned();
+        if let Some(completion) = completion {
+            completion.wait().await;
+        }
+    }
+}
+
+impl SourceCreationCompletion {
+    async fn wait(&self) {
+        loop {
+            let finished = self.notify.notified();
+            if self.finished.load(Ordering::Acquire) {
+                return;
+            }
+            finished.await;
+        }
+    }
+}
+
+impl Drop for SourceCreationSupervisorGuard {
+    fn drop(&mut self) {
+        self.completion.finished.store(true, Ordering::Release);
+        self.completion.notify.notify_waiters();
+        let mut active = self
+            .registry
+            .active
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        if active
+            .get(&self.key)
+            .is_some_and(|completion| Arc::ptr_eq(completion, &self.completion))
+        {
+            active.remove(&self.key);
+        }
+    }
+}
+
+pub(super) fn router() -> Router<AppState> {
+    Router::new()
+        .route("/api/v1/sources", post(create_source))
+        .route("/api/v1/sources/idempotency", get(source_creation_status))
+        .route(
+            "/api/v1/sources/idempotency/seal",
+            post(seal_missing_source_creation),
+        )
+        .layer(DefaultBodyLimit::max(MAX_SOURCE_BODY_BYTES))
+        .merge(
+            Router::new()
+                .route("/api/v1/sources/{id}/refresh", post(refresh_source))
+                .route("/api/v1/mcp/stdio/templates", get(stdio_templates))
+                .route(
+                    "/api/v1/sources/{id}/credentials",
+                    get(get_credentials)
+                        .put(put_credentials)
+                        .delete(delete_credentials),
+                ),
+        )
+        .merge(
+            Router::new()
+                .route("/api/v1/gateway/tools/invoke", post(invoke))
+                .route("/api/v1/gateway/sources", get(gateway_sources))
+                .layer(DefaultBodyLimit::max(MAX_INVOKE_BODY_BYTES)),
+        )
+        .merge(
+            Router::new()
+                .route("/api/v1/gateway/execute", post(execute))
+                .layer(DefaultBodyLimit::max(MAX_EXECUTE_BODY_BYTES)),
+        )
+}
+
+#[derive(Serialize)]
+struct StdioTemplatesResponse {
+    templates: Vec<crate::mcp::upstream::stdio::StdioTemplateDescriptor>,
+}
+
+async fn stdio_templates(
+    _admin: AdminAuthentication,
+    State(state): State<AppState>,
+) -> Json<StdioTemplatesResponse> {
+    Json(StdioTemplatesResponse {
+        templates: state.sources.stdio_template_descriptors(),
+    })
+}
+
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+struct GatewaySourcesResponse {
+    sources: Vec<GatewaySourceResponse>,
+}
+
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+struct GatewaySourceResponse {
+    slug: String,
+    display_name: String,
+    description: Option<String>,
+    kind: SourceKind,
+    tool_count: usize,
+}
+
+async fn gateway_sources(
+    Extension(request_id): Extension<RequestId>,
+    State(state): State<AppState>,
+    GatewayAuthentication(identity): GatewayAuthentication,
+) -> Result<Json<GatewaySourcesResponse>, ApiError> {
+    let call = ToolCall {
+        request_id: request_id.0.clone(),
+        actor: ToolActor::api_token(identity.token_id, Some(identity.token_name)),
+        surface: RequestSurface::Gateway,
+        execution_id: request_id.0.clone(),
+        call_id: "gateway.sources".to_owned(),
+        worker_generation: 0,
+        path: "executor.sources".to_owned(),
+        arguments: Value::Object(Map::new()),
+    };
+    let discovered = state
+        .tool_calls
+        .discover_sources(&call)
+        .await
+        .map_err(|error| discovery_error(&request_id, error))?;
+    let Value::Array(items) = discovered else {
+        return Err(ApiError::internal_logged(
+            &request_id,
+            "source discovery returned an invalid payload",
+        ));
+    };
+    let mut sources = Vec::with_capacity(items.len());
+    for item in items {
+        let Some(item) = item.as_object() else {
+            return Err(ApiError::internal(&request_id));
+        };
+        let source = GatewaySourceResponse {
+            slug: required_string(item, "slug").ok_or_else(|| ApiError::internal(&request_id))?,
+            display_name: required_string(item, "displayName")
+                .ok_or_else(|| ApiError::internal(&request_id))?,
+            description: item
+                .get("description")
+                .and_then(Value::as_str)
+                .map(str::to_owned),
+            kind: serde_json::from_value(
+                item.get("kind")
+                    .cloned()
+                    .ok_or_else(|| ApiError::internal(&request_id))?,
+            )
+            .map_err(|_| ApiError::internal(&request_id))?,
+            tool_count: item
+                .get("toolCount")
+                .and_then(Value::as_u64)
+                .and_then(|count| usize::try_from(count).ok())
+                .ok_or_else(|| ApiError::internal(&request_id))?,
+        };
+        sources.push(source);
+    }
+    Ok(Json(GatewaySourcesResponse { sources }))
+}
+
+fn required_string(item: &Map<String, Value>, field: &str) -> Option<String> {
+    item.get(field).and_then(Value::as_str).map(str::to_owned)
+}
+
+fn discovery_error(request_id: &RequestId, error: ToolDiscoveryError) -> ApiError {
+    match error {
+        ToolDiscoveryError::Busy => ApiError::new(
+            request_id,
+            StatusCode::TOO_MANY_REQUESTS,
+            "search_busy",
+            "Tool discovery is busy. Try again shortly.",
+        )
+        .with_retry_after(1),
+        ToolDiscoveryError::Catalog(error) => catalog_error(request_id, error),
+        ToolDiscoveryError::Interrupted => ApiError::new(
+            request_id,
+            StatusCode::SERVICE_UNAVAILABLE,
+            "discovery_interrupted",
+            "Tool discovery was interrupted. Try again.",
+        ),
+    }
+}
+
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct ExecuteRequest {
+    code: String,
+    timeout_ms: Option<u64>,
+}
+
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+struct ExecuteResponse {
+    execution_id: String,
+    result: Value,
+    emits: Vec<Value>,
+    console: Vec<crate::runtime::ConsoleEntry>,
+    calls: Vec<crate::runtime::ToolCallRecord>,
+}
+
+async fn execute(
+    Extension(request_id): Extension<RequestId>,
+    State(state): State<AppState>,
+    GatewayAuthentication(identity): GatewayAuthentication,
+    headers: HeaderMap,
+    payload: Result<Json<ExecuteRequest>, JsonRejection>,
+) -> Result<Json<ExecuteResponse>, ApiError> {
+    if headers.contains_key(IDEMPOTENCY_KEY_HEADER) {
+        return Err(ApiError::new(
+            &request_id,
+            StatusCode::BAD_REQUEST,
+            "idempotency_not_supported",
+            "Idempotency-Key is not supported for whole TypeScript executions yet.",
+        ));
+    }
+    let Json(payload) = match parse_json(&request_id, payload) {
+        Ok(payload) => payload,
+        Err(error) => {
+            state.tool_calls.record_rejected_request(
+                &request_id.0,
+                &identity.token_id,
+                RequestSurface::Gateway,
+                "executor.execute",
+                error.code,
+            );
+            return Err(error);
+        }
+    };
+    let timeout_ms = payload
+        .timeout_ms
+        .unwrap_or(DEFAULT_EXECUTION_TIMEOUT_MILLIS);
+    let output = state
+        .execution
+        .execute(ExecuteCodeRequest {
+            request_id: request_id.0.clone(),
+            actor: ToolActor::api_token(identity.token_id, Some(identity.token_name)),
+            surface: RequestSurface::Gateway,
+            code: payload.code,
+            timeout: std::time::Duration::from_millis(timeout_ms),
+        })
+        .await
+        .map_err(|error| execution_error(&request_id, error))?;
+    Ok(Json(ExecuteResponse {
+        execution_id: output.execution_id,
+        result: output.result,
+        emits: output.emits,
+        console: output.console,
+        calls: output.calls,
+    }))
+}
+
+fn execution_error(request_id: &RequestId, error: ExecutionServiceError) -> ApiError {
+    match error {
+        ExecutionServiceError::SourceTooLarge => ApiError::new(
+            request_id,
+            StatusCode::PAYLOAD_TOO_LARGE,
+            "source_too_large",
+            "TypeScript source exceeds 1 MiB.",
+        ),
+        ExecutionServiceError::InvalidTimeout => ApiError::new(
+            request_id,
+            StatusCode::BAD_REQUEST,
+            "invalid_timeout",
+            format!(
+                "Execution timeout must be between 1 and {MAX_EXECUTION_TIMEOUT_MILLIS} milliseconds."
+            ),
+        ),
+        ExecutionServiceError::ShuttingDown => ApiError::new(
+            request_id,
+            StatusCode::SERVICE_UNAVAILABLE,
+            "runtime_shutting_down",
+            "The TypeScript runtime is shutting down.",
+        ),
+        ExecutionServiceError::OwnerRevoked => {
+            ApiError::unauthorized(request_id, "The API token is no longer active.")
+        }
+        ExecutionServiceError::ActorFailed => {
+            tracing::error!(request_id = request_id.0, "runtime execution task failed");
+            ApiError::internal(request_id)
+        }
+        ExecutionServiceError::Runtime(failure) => runtime_error(request_id, failure),
+    }
+}
+
+fn runtime_error(request_id: &RequestId, failure: RuntimeFailure) -> ApiError {
+    let status = match failure.code.as_str() {
+        "source_too_large" | "result_too_large" => StatusCode::PAYLOAD_TOO_LARGE,
+        "runtime_busy" => StatusCode::TOO_MANY_REQUESTS,
+        "execution_timeout" => StatusCode::REQUEST_TIMEOUT,
+        "execution_cancelled" => StatusCode::CONFLICT,
+        "invalid_timeout"
+        | "typescript_invalid"
+        | "typescript_unsupported"
+        | "transformed_source_too_large"
+        | "execution_failed"
+        | "result_not_json"
+        | "argument_too_large"
+        | "tool_call_limit_exceeded"
+        | "tool_path_invalid" => StatusCode::BAD_REQUEST,
+        _ => StatusCode::INTERNAL_SERVER_ERROR,
+    };
+    let code: &'static str = match failure.code.as_str() {
+        "source_too_large" => "source_too_large",
+        "result_too_large" => "result_too_large",
+        "runtime_busy" => "runtime_busy",
+        "execution_timeout" => "execution_timeout",
+        "execution_cancelled" => "execution_cancelled",
+        "invalid_timeout" => "invalid_timeout",
+        "typescript_invalid" => "typescript_invalid",
+        "typescript_unsupported" => "typescript_unsupported",
+        "transformed_source_too_large" => "transformed_source_too_large",
+        "execution_failed" => "execution_failed",
+        "result_not_json" => "result_not_json",
+        "argument_too_large" => "argument_too_large",
+        "tool_call_limit_exceeded" => "tool_call_limit_exceeded",
+        "tool_path_invalid" => "tool_path_invalid",
+        _ => "runtime_failed",
+    };
+    let message = if failure.internal {
+        "The TypeScript execution could not be completed safely.".to_owned()
+    } else {
+        failure.message
+    };
+    let error = ApiError::new(request_id, status, code, message);
+    if code == "runtime_busy" {
+        error.with_retry_after(1)
+    } else {
+        error
+    }
+}
+
+#[derive(Clone, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase")]
+struct CreateSourceRequest {
+    kind: SourceKind,
+    #[serde(flatten)]
+    protocol: Map<String, Value>,
+}
+
+async fn create_source(
+    Extension(request_id): Extension<RequestId>,
+    State(state): State<AppState>,
+    AdminMutation(admin_id): AdminMutation,
+    headers: HeaderMap,
+    payload: Result<Json<Value>, JsonRejection>,
+) -> Result<Response, ApiError> {
+    let idempotency_key = parse_source_creation_idempotency_key(&request_id, &headers)?;
+    let Json(payload) = parse_json(&request_id, payload)?;
+    let payload: CreateSourceRequest = serde_json::from_value(payload).map_err(|_| {
+        ApiError::new(
+            &request_id,
+            StatusCode::BAD_REQUEST,
+            "invalid_json",
+            "The request body must be valid JSON with the expected fields.",
+        )
+    })?;
+    let canonical_request = serde_json::to_value(&payload)
+        .map_err(|error| ApiError::internal_logged(&request_id, error))?;
+    let Some(idempotency_key) = idempotency_key else {
+        let source = state
+            .sources
+            .create(
+                payload.kind,
+                Value::Object(payload.protocol),
+                AuditContext::admin(&request_id.0, admin_id),
+            )
+            .await
+            .map_err(|error| protocol_error(&request_id, error))?;
+        return Ok((StatusCode::CREATED, Json(source)).into_response());
+    };
+
+    let idempotency = state.sources.source_creation_idempotency();
+    let active_key = source_creation_supervisor_key(&state, admin_id, &idempotency_key);
+    let claim = idempotency
+        .claim(
+            admin_id,
+            SOURCE_CREATION_ROUTE,
+            &idempotency_key,
+            &canonical_request,
+        )
+        .await
+        .map_err(|error| source_creation_idempotency_error(&request_id, error))?;
+    match claim {
+        SourceCreationIdempotencyClaim::Fresh(reservation) => {
+            start_source_creation(
+                &request_id,
+                &state,
+                admin_id,
+                idempotency_key,
+                payload,
+                idempotency,
+                reservation,
+                active_key,
+            )
+            .await
+        }
+        SourceCreationIdempotencyClaim::Replay(replay) => {
+            state
+                .source_creation_supervisors
+                .wait_if_active(active_key)
+                .await;
+            exact_source_creation_response(&request_id, replay.response, true)
+        }
+        SourceCreationIdempotencyClaim::InProgress => Err(source_creation_in_progress(&request_id)),
+        SourceCreationIdempotencyClaim::Mismatch => Err(ApiError::new(
+            &request_id,
+            StatusCode::CONFLICT,
+            "idempotency_key_mismatch",
+            "This Idempotency-Key was already used for a different source creation request.",
+        )),
+        SourceCreationIdempotencyClaim::Abandoned => {
+            Err(source_creation_terminal_error(&request_id, "abandoned"))
+        }
+        SourceCreationIdempotencyClaim::Interrupted => {
+            Err(source_creation_terminal_error(&request_id, "interrupted"))
+        }
+        SourceCreationIdempotencyClaim::Expired => Err(source_creation_terminal_error(
+            &request_id,
+            "expired_unknown",
+        )),
+    }
+}
+
+async fn source_creation_status(
+    Extension(request_id): Extension<RequestId>,
+    State(state): State<AppState>,
+    AdminAuthentication(admin_id): AdminAuthentication,
+    headers: HeaderMap,
+) -> Result<Response, ApiError> {
+    let key = require_source_creation_idempotency_key(&request_id, &headers)?;
+    let active_key = source_creation_supervisor_key(&state, admin_id, &key);
+    let status = state
+        .sources
+        .source_creation_idempotency()
+        .lookup(admin_id, SOURCE_CREATION_ROUTE, &key)
+        .await
+        .map_err(|error| source_creation_idempotency_error(&request_id, error))?;
+    match status {
+        None => source_creation_status_response(&request_id, "missing"),
+        Some(SourceCreationIdempotencyStatus::InProgress) => {
+            source_creation_status_response(&request_id, "in_progress")
+        }
+        Some(SourceCreationIdempotencyStatus::Replay(replay)) => {
+            state
+                .source_creation_supervisors
+                .wait_if_active(active_key)
+                .await;
+            exact_source_creation_response(&request_id, replay.response, true)
+        }
+        Some(SourceCreationIdempotencyStatus::Abandoned) => {
+            source_creation_status_response(&request_id, "abandoned")
+        }
+        Some(SourceCreationIdempotencyStatus::Interrupted) => {
+            source_creation_status_response(&request_id, "interrupted")
+        }
+        Some(SourceCreationIdempotencyStatus::Expired) => {
+            source_creation_status_response(&request_id, "expired_unknown")
+        }
+    }
+}
+
+async fn seal_missing_source_creation(
+    Extension(request_id): Extension<RequestId>,
+    State(state): State<AppState>,
+    AdminMutation(admin_id): AdminMutation,
+    headers: HeaderMap,
+) -> Result<Response, ApiError> {
+    let key = require_source_creation_idempotency_key(&request_id, &headers)?;
+    let active_key = source_creation_supervisor_key(&state, admin_id, &key);
+    let status = state
+        .sources
+        .source_creation_idempotency()
+        .seal_missing(admin_id, SOURCE_CREATION_ROUTE, &key)
+        .await
+        .map_err(|error| source_creation_idempotency_error(&request_id, error))?;
+    match status {
+        SourceCreationIdempotencyStatus::Abandoned => {
+            source_creation_status_response(&request_id, "abandoned")
+        }
+        SourceCreationIdempotencyStatus::InProgress => {
+            Err(source_creation_in_progress(&request_id))
+        }
+        SourceCreationIdempotencyStatus::Replay(replay) => {
+            state
+                .source_creation_supervisors
+                .wait_if_active(active_key)
+                .await;
+            exact_source_creation_response(&request_id, replay.response, true)
+        }
+        SourceCreationIdempotencyStatus::Interrupted => {
+            Err(source_creation_terminal_error(&request_id, "interrupted"))
+        }
+        SourceCreationIdempotencyStatus::Expired => Err(source_creation_terminal_error(
+            &request_id,
+            "expired_unknown",
+        )),
+    }
+}
+
+#[allow(clippy::too_many_arguments)]
+async fn start_source_creation(
+    request_id: &RequestId,
+    state: &AppState,
+    admin_id: i64,
+    idempotency_key: String,
+    payload: CreateSourceRequest,
+    idempotency: SourceCreationIdempotencyStore,
+    reservation: SourceCreationReservation,
+    active_key: SourceCreationSupervisorKey,
+) -> Result<Response, ApiError> {
+    let (result_sender, result_receiver) = tokio::sync::oneshot::channel();
+    let supervisor_request_id = request_id.0.clone();
+    let supervisor_sources = state.sources.clone();
+    let supervisor_idempotency = idempotency.clone();
+    let supervisor_key = idempotency_key.clone();
+    let supervisor_reservation = reservation.clone();
+    let supervisor_database = state.database.clone();
+    let supervisor_kind = payload.kind;
+    let supervisor_guard = state.source_creation_supervisors.register(active_key);
+    let spawned = state
+        .background_tasks
+        .spawn_supervised(|shutdown| async move {
+            let _database_guard = supervisor_database;
+            let _supervisor_guard = supervisor_guard;
+            let result = supervise_source_creation(
+                supervisor_request_id,
+                supervisor_sources,
+                admin_id,
+                supervisor_key,
+                payload,
+                supervisor_idempotency,
+                supervisor_reservation,
+                shutdown,
+            )
+            .await;
+            let _ = result_sender.send(result);
+        });
+    if !spawned {
+        let _ = recover_interrupted_source_creation(
+            request_id,
+            &state.sources,
+            admin_id,
+            &idempotency_key,
+            &idempotency,
+            &reservation,
+            Some(supervisor_kind),
+        )
+        .await;
+        return Err(ApiError::new(
+            request_id,
+            StatusCode::SERVICE_UNAVAILABLE,
+            "source_creation_unavailable",
+            "Source creation is unavailable while Executor is shutting down.",
+        ));
+    }
+
+    match result_receiver.await {
+        Ok(Ok(response)) => exact_source_creation_response(request_id, response, false),
+        Ok(Err(error)) => Err(error),
+        Err(_) => recover_interrupted_source_creation(
+            request_id,
+            &state.sources,
+            admin_id,
+            &idempotency_key,
+            &idempotency,
+            &reservation,
+            None,
+        )
+        .await
+        .and_then(|response| exact_source_creation_response(request_id, response, false)),
+    }
+}
+
+#[allow(clippy::too_many_arguments)]
+async fn supervise_source_creation(
+    request_id: String,
+    sources: crate::protocols::SourceService,
+    admin_id: i64,
+    idempotency_key: String,
+    payload: CreateSourceRequest,
+    idempotency: SourceCreationIdempotencyStore,
+    reservation: SourceCreationReservation,
+    mut shutdown: tokio::sync::oneshot::Receiver<()>,
+) -> Result<SourceCreationResponse, ApiError> {
+    let kind = payload.kind;
+    let mut job = tokio::spawn(source_creation_job(
+        request_id.clone(),
+        sources.clone(),
+        admin_id,
+        idempotency_key.clone(),
+        payload,
+        idempotency.clone(),
+        reservation.clone(),
+    ));
+    tokio::select! {
+        result = &mut job => match result {
+            Ok(Ok(response)) => Ok(response),
+            Ok(Err(error)) => {
+                tracing::error!(
+                    request_id,
+                    status = error.status.as_u16(),
+                    code = error.code,
+                    "source creation worker did not settle cleanly"
+                );
+                recover_interrupted_source_creation(
+                    &RequestId(request_id),
+                    &sources,
+                    admin_id,
+                    &idempotency_key,
+                    &idempotency,
+                    &reservation,
+                    Some(kind),
+                )
+                .await
+            }
+            Err(_) => {
+                tracing::error!(
+                    request_id,
+                    "source creation worker terminated unexpectedly"
+                );
+                recover_interrupted_source_creation(
+                    &RequestId(request_id),
+                    &sources,
+                    admin_id,
+                    &idempotency_key,
+                    &idempotency,
+                    &reservation,
+                    Some(kind),
+                )
+                .await
+            }
+        },
+        _ = &mut shutdown => {
+            job.abort();
+            let _ = job.await;
+            recover_interrupted_source_creation(
+                &RequestId(request_id),
+                &sources,
+                admin_id,
+                &idempotency_key,
+                &idempotency,
+                &reservation,
+                Some(kind),
+            )
+            .await
+        }
+    }
+}
+
+async fn source_creation_job(
+    request_id: String,
+    sources: crate::protocols::SourceService,
+    admin_id: i64,
+    idempotency_key: String,
+    payload: CreateSourceRequest,
+    idempotency: SourceCreationIdempotencyStore,
+    reservation: SourceCreationReservation,
+) -> Result<SourceCreationResponse, ApiError> {
+    let operation_request_id = RequestId(request_id.clone());
+    #[cfg(test)]
+    if sources.source_creation_panics_at(crate::protocols::SourceCreationPanic::BeforeCreate) {
+        panic!("injected source creation panic before commit");
+    }
+    let outcome = sources
+        .create(
+            payload.kind,
+            Value::Object(payload.protocol),
+            AuditContext::admin(&request_id, admin_id)
+                .with_source_creation_idempotency(&reservation),
+        )
+        .await;
+    #[cfg(test)]
+    if outcome.is_ok()
+        && sources.source_creation_panics_at(crate::protocols::SourceCreationPanic::AfterCreate)
+    {
+        panic!("injected source creation panic after commit");
+    }
+    settle_source_creation(
+        &operation_request_id,
+        &sources,
+        admin_id,
+        &idempotency_key,
+        payload.kind,
+        outcome,
+        &idempotency,
+        &reservation,
+    )
+    .await
+}
+
+#[allow(clippy::too_many_arguments)]
+async fn settle_source_creation(
+    request_id: &RequestId,
+    sources: &crate::protocols::SourceService,
+    admin_id: i64,
+    idempotency_key: &str,
+    kind: SourceKind,
+    outcome: Result<crate::catalog::SourceRecord, ProtocolError>,
+    idempotency: &SourceCreationIdempotencyStore,
+    reservation: &SourceCreationReservation,
+) -> Result<SourceCreationResponse, ApiError> {
+    let source_id = outcome.as_ref().ok().map(|source| source.id.as_str());
+    let status = idempotency
+        .lookup(admin_id, SOURCE_CREATION_ROUTE, idempotency_key)
+        .await
+        .map_err(|error| source_creation_idempotency_error(request_id, error))?;
+    match status {
+        Some(SourceCreationIdempotencyStatus::Replay(replay)) => {
+            finish_completed_source_creation(request_id, sources, kind, source_id, replay).await
+        }
+        Some(SourceCreationIdempotencyStatus::InProgress) => match outcome {
+            Ok(_) => {
+                let _ = idempotency.interrupt(reservation).await;
+                Err(ApiError::internal_logged(
+                    request_id,
+                    "source creation committed without completing its reservation",
+                ))
+            }
+            Err(error) => {
+                let response = source_creation_api_error_response(
+                    request_id,
+                    protocol_error(request_id, error),
+                )?;
+                let status = idempotency
+                    .fail(reservation, &response)
+                    .await
+                    .map_err(|error| source_creation_idempotency_error(request_id, error))?;
+                source_creation_settlement_response(request_id, sources, kind, status).await
+            }
+        },
+        Some(SourceCreationIdempotencyStatus::Abandoned) => {
+            Err(source_creation_terminal_error(request_id, "abandoned"))
+        }
+        Some(SourceCreationIdempotencyStatus::Interrupted) => {
+            Err(source_creation_terminal_error(request_id, "interrupted"))
+        }
+        Some(SourceCreationIdempotencyStatus::Expired) => Err(source_creation_terminal_error(
+            request_id,
+            "expired_unknown",
+        )),
+        None => Err(ApiError::internal_logged(
+            request_id,
+            "source creation reservation disappeared before settlement",
+        )),
+    }
+}
+
+async fn source_creation_settlement_response(
+    request_id: &RequestId,
+    sources: &crate::protocols::SourceService,
+    kind: SourceKind,
+    status: SourceCreationIdempotencyStatus,
+) -> Result<SourceCreationResponse, ApiError> {
+    match status {
+        SourceCreationIdempotencyStatus::Replay(replay) => {
+            finish_completed_source_creation(request_id, sources, kind, None, replay).await
+        }
+        SourceCreationIdempotencyStatus::InProgress => Err(source_creation_in_progress(request_id)),
+        SourceCreationIdempotencyStatus::Abandoned => {
+            Err(source_creation_terminal_error(request_id, "abandoned"))
+        }
+        SourceCreationIdempotencyStatus::Interrupted => {
+            Err(source_creation_terminal_error(request_id, "interrupted"))
+        }
+        SourceCreationIdempotencyStatus::Expired => Err(source_creation_terminal_error(
+            request_id,
+            "expired_unknown",
+        )),
+    }
+}
+
+async fn finish_completed_source_creation(
+    request_id: &RequestId,
+    sources: &crate::protocols::SourceService,
+    kind: SourceKind,
+    source_id: Option<&str>,
+    replay: SourceCreationReplay,
+) -> Result<SourceCreationResponse, ApiError> {
+    if replay.kind == SourceCreationResponseKind::Completed {
+        let source_id = source_id
+            .map(str::to_owned)
+            .or_else(|| source_id_from_creation_response(&replay.response));
+        let source_id = source_id.ok_or_else(|| {
+            ApiError::internal_logged(request_id, "stored source creation response is invalid")
+        })?;
+        sources.finish_source_creation(kind, &source_id).await;
+    }
+    Ok(replay.response)
+}
+
+#[allow(clippy::too_many_arguments)]
+async fn recover_interrupted_source_creation(
+    request_id: &RequestId,
+    sources: &crate::protocols::SourceService,
+    admin_id: i64,
+    idempotency_key: &str,
+    idempotency: &SourceCreationIdempotencyStore,
+    reservation: &SourceCreationReservation,
+    kind: Option<SourceKind>,
+) -> Result<SourceCreationResponse, ApiError> {
+    let mut last_error = None;
+    for attempt in 0..SOURCE_CREATION_RECOVERY_ATTEMPTS {
+        match idempotency
+            .lookup(admin_id, SOURCE_CREATION_ROUTE, idempotency_key)
+            .await
+        {
+            Ok(Some(SourceCreationIdempotencyStatus::Replay(replay))) => {
+                if replay.kind == SourceCreationResponseKind::Completed {
+                    let Some(kind) =
+                        kind.or_else(|| source_kind_from_creation_response(&replay.response))
+                    else {
+                        return Err(ApiError::internal_logged(
+                            request_id,
+                            "stored source creation response is invalid",
+                        ));
+                    };
+                    return finish_completed_source_creation(
+                        request_id, sources, kind, None, replay,
+                    )
+                    .await;
+                }
+                return Ok(replay.response);
+            }
+            Ok(Some(SourceCreationIdempotencyStatus::InProgress)) => {
+                match idempotency.interrupt(reservation).await {
+                    Ok(SourceCreationIdempotencyStatus::Replay(replay)) => {
+                        if replay.kind == SourceCreationResponseKind::Completed {
+                            let Some(kind) = kind
+                                .or_else(|| source_kind_from_creation_response(&replay.response))
+                            else {
+                                return Err(ApiError::internal_logged(
+                                    request_id,
+                                    "stored source creation response is invalid",
+                                ));
+                            };
+                            return finish_completed_source_creation(
+                                request_id, sources, kind, None, replay,
+                            )
+                            .await;
+                        }
+                        return Ok(replay.response);
+                    }
+                    Ok(SourceCreationIdempotencyStatus::Abandoned) => {
+                        return Err(source_creation_terminal_error(request_id, "abandoned"));
+                    }
+                    Ok(SourceCreationIdempotencyStatus::Interrupted) => {
+                        return Err(source_creation_terminal_error(request_id, "interrupted"));
+                    }
+                    Ok(SourceCreationIdempotencyStatus::Expired) => {
+                        return Err(source_creation_terminal_error(
+                            request_id,
+                            "expired_unknown",
+                        ));
+                    }
+                    Ok(SourceCreationIdempotencyStatus::InProgress) => {}
+                    Err(error) => last_error = Some(error),
+                }
+            }
+            Ok(Some(SourceCreationIdempotencyStatus::Abandoned)) => {
+                return Err(source_creation_terminal_error(request_id, "abandoned"));
+            }
+            Ok(Some(SourceCreationIdempotencyStatus::Interrupted)) => {
+                return Err(source_creation_terminal_error(request_id, "interrupted"));
+            }
+            Ok(Some(SourceCreationIdempotencyStatus::Expired)) => {
+                return Err(source_creation_terminal_error(
+                    request_id,
+                    "expired_unknown",
+                ));
+            }
+            Ok(None) => {}
+            Err(error) => last_error = Some(error),
+        }
+        if attempt + 1 < SOURCE_CREATION_RECOVERY_ATTEMPTS {
+            tokio::time::sleep(Duration::from_millis(10 * (attempt as u64 + 1))).await;
+        }
+    }
+    if let Some(error) = last_error {
+        Err(source_creation_idempotency_error(request_id, error))
+    } else {
+        Err(ApiError::internal_logged(
+            request_id,
+            "source creation recovery could not locate or terminalize its reservation",
+        ))
+    }
+}
+
+fn source_id_from_creation_response(response: &SourceCreationResponse) -> Option<String> {
+    serde_json::from_slice::<Value>(&response.body)
+        .ok()?
+        .as_object()?
+        .get("id")?
+        .as_str()
+        .map(str::to_owned)
+}
+
+fn source_kind_from_creation_response(response: &SourceCreationResponse) -> Option<SourceKind> {
+    serde_json::from_slice::<Value>(&response.body)
+        .ok()?
+        .as_object()?
+        .get("kind")
+        .cloned()
+        .and_then(|kind| serde_json::from_value(kind).ok())
+}
+
+fn source_creation_supervisor_key(
+    state: &AppState,
+    admin_id: i64,
+    key: &str,
+) -> SourceCreationSupervisorKey {
+    SourceCreationSupervisorKey {
+        admin_id,
+        key_digest: state
+            .database
+            .keyring
+            .digest("source-creation-supervisor", key.as_bytes()),
+    }
+}
+
+fn parse_source_creation_idempotency_key(
+    request_id: &RequestId,
+    headers: &HeaderMap,
+) -> Result<Option<String>, ApiError> {
+    parse_single_idempotency_key(
+        request_id,
+        headers,
+        source_creation_idempotency_key_is_valid,
+    )
+}
+
+fn require_source_creation_idempotency_key(
+    request_id: &RequestId,
+    headers: &HeaderMap,
+) -> Result<String, ApiError> {
+    parse_source_creation_idempotency_key(request_id, headers)?.ok_or_else(|| {
+        ApiError::new(
+            request_id,
+            StatusCode::BAD_REQUEST,
+            "idempotency_key_required",
+            "Idempotency-Key is required for this endpoint.",
+        )
+    })
+}
+
+fn source_creation_api_error_response(
+    request_id: &RequestId,
+    error: ApiError,
+) -> Result<SourceCreationResponse, ApiError> {
+    let body = serde_json::to_vec(&ErrorEnvelope {
+        error: ErrorDetail {
+            code: error.code,
+            message: error.message,
+            request_id: error.request_id,
+        },
+    })
+    .map_err(|encoding_error| ApiError::internal_logged(request_id, encoding_error))?;
+    let mut headers = BTreeMap::from([
+        ("cache-control".to_owned(), "no-store".to_owned()),
+        ("content-type".to_owned(), "application/json".to_owned()),
+    ]);
+    if let Some(retry_after_seconds) = error.retry_after_seconds {
+        headers.insert("retry-after".to_owned(), retry_after_seconds.to_string());
+    }
+    Ok(SourceCreationResponse {
+        status: error.status.as_u16(),
+        headers,
+        body,
+    })
+}
+
+fn exact_source_creation_response(
+    request_id: &RequestId,
+    output: SourceCreationResponse,
+    replayed: bool,
+) -> Result<Response, ApiError> {
+    let mut response = Response::builder()
+        .status(output.status)
+        .body(Body::from(output.body))
+        .map_err(|_| ApiError::internal(request_id))?;
+    for (name, value) in output.headers {
+        let name = HeaderName::try_from(name).map_err(|_| ApiError::internal(request_id))?;
+        let value = HeaderValue::try_from(value).map_err(|_| ApiError::internal(request_id))?;
+        response.headers_mut().insert(name, value);
+    }
+    response
+        .headers_mut()
+        .insert(header::CACHE_CONTROL, HeaderValue::from_static("no-store"));
+    if replayed {
+        response.headers_mut().insert(
+            HeaderName::from_static("idempotency-replayed"),
+            HeaderValue::from_static("true"),
+        );
+    }
+    Ok(response)
+}
+
+#[derive(Serialize)]
+struct SourceCreationStatusResponse {
+    status: &'static str,
+}
+
+fn source_creation_status_response(
+    request_id: &RequestId,
+    status: &'static str,
+) -> Result<Response, ApiError> {
+    let body = serde_json::to_vec(&SourceCreationStatusResponse { status })
+        .map_err(|error| ApiError::internal_logged(request_id, error))?;
+    Response::builder()
+        .status(StatusCode::OK)
+        .header(header::CONTENT_TYPE, "application/json")
+        .header(header::CACHE_CONTROL, "no-store")
+        .body(Body::from(body))
+        .map_err(|_| ApiError::internal(request_id))
+}
+
+fn source_creation_in_progress(request_id: &RequestId) -> ApiError {
+    ApiError::new(
+        request_id,
+        StatusCode::CONFLICT,
+        "idempotency_in_progress",
+        "The source creation for this Idempotency-Key is still in progress.",
+    )
+    .with_retry_after(1)
+}
+
+fn source_creation_terminal_error(request_id: &RequestId, status: &'static str) -> ApiError {
+    match status {
+        "abandoned" => ApiError::new(
+            request_id,
+            StatusCode::CONFLICT,
+            "idempotency_abandoned",
+            "This Idempotency-Key was sealed before source creation began.",
+        ),
+        "interrupted" => ApiError::new(
+            request_id,
+            StatusCode::CONFLICT,
+            "idempotency_interrupted",
+            "Source creation was interrupted and cannot be retried with this Idempotency-Key.",
+        ),
+        "expired_unknown" => ApiError::new(
+            request_id,
+            StatusCode::GONE,
+            "idempotency_expired_unknown",
+            "The retained source creation response expired and its outcome must be verified manually.",
+        ),
+        _ => ApiError::internal(request_id),
+    }
+}
+
+fn source_creation_idempotency_error(
+    request_id: &RequestId,
+    error: SourceCreationIdempotencyError,
+) -> ApiError {
+    match error {
+        SourceCreationIdempotencyError::InvalidKey => invalid_idempotency_key(request_id),
+        SourceCreationIdempotencyError::PayloadTooLarge => ApiError::new(
+            request_id,
+            StatusCode::PAYLOAD_TOO_LARGE,
+            "payload_too_large",
+            "The request body exceeds the allowed size.",
+        ),
+        SourceCreationIdempotencyError::Capacity => ApiError::new(
+            request_id,
+            StatusCode::TOO_MANY_REQUESTS,
+            "idempotency_capacity",
+            "Source creation idempotency capacity has been reached. Retry later.",
+        )
+        .with_retry_after(1),
+        error => ApiError::internal_logged(request_id, error),
+    }
+}
+
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct PutCredentialsRequest {
+    expected_revision: i64,
+    credential: Value,
+}
+
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct DeleteCredentialsQuery {
+    expected_revision: i64,
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct RefreshSourceRequest {}
+
+async fn refresh_source(
+    Extension(request_id): Extension<RequestId>,
+    State(state): State<AppState>,
+    AdminMutation(admin_id): AdminMutation,
+    Path(source_id): Path<String>,
+    payload: Result<Json<RefreshSourceRequest>, JsonRejection>,
+) -> Result<Json<crate::catalog::CatalogSyncResult>, ApiError> {
+    let Json(_payload) = parse_json(&request_id, payload)?;
+    let refreshed = state
+        .sources
+        .refresh(&source_id, AuditContext::admin(&request_id.0, admin_id))
+        .await
+        .map_err(|error| protocol_error(&request_id, error))?;
+    Ok(Json(refreshed))
+}
+
+async fn get_credentials(
+    Extension(request_id): Extension<RequestId>,
+    State(state): State<AppState>,
+    _admin: AdminAuthentication,
+    Path(source_id): Path<String>,
+) -> Result<Json<CredentialMetadata>, ApiError> {
+    let metadata = state
+        .sources
+        .credential_metadata(&source_id)
+        .await
+        .map_err(|error| protocol_error(&request_id, error))?;
+    Ok(Json(metadata))
+}
+
+async fn put_credentials(
+    Extension(request_id): Extension<RequestId>,
+    State(state): State<AppState>,
+    AdminMutation(admin_id): AdminMutation,
+    Path(source_id): Path<String>,
+    payload: Result<Json<PutCredentialsRequest>, JsonRejection>,
+) -> Result<Json<CredentialMetadata>, ApiError> {
+    let Json(payload) = parse_json(&request_id, payload)?;
+    let metadata = state
+        .sources
+        .replace_credentials(
+            &source_id,
+            payload.expected_revision,
+            payload.credential,
+            AuditContext::admin(&request_id.0, admin_id),
+        )
+        .await
+        .map_err(|error| protocol_error(&request_id, error))?;
+    Ok(Json(metadata))
+}
+
+async fn delete_credentials(
+    Extension(request_id): Extension<RequestId>,
+    State(state): State<AppState>,
+    AdminMutation(admin_id): AdminMutation,
+    Path(source_id): Path<String>,
+    query: Result<Query<DeleteCredentialsQuery>, QueryRejection>,
+) -> Result<Json<CredentialMetadata>, ApiError> {
+    let Query(query) = query.map_err(|_| invalid_query(&request_id))?;
+    let metadata = state
+        .sources
+        .clear_credentials(
+            &source_id,
+            query.expected_revision,
+            AuditContext::admin(&request_id.0, admin_id),
+        )
+        .await
+        .map_err(|error| protocol_error(&request_id, error))?;
+    Ok(Json(metadata))
+}
+
+fn invalid_query(request_id: &RequestId) -> ApiError {
+    ApiError::new(
+        request_id,
+        StatusCode::BAD_REQUEST,
+        "invalid_query",
+        "The query parameters are invalid.",
+    )
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct InvokeRequest {
+    path: String,
+    #[serde(default = "empty_object")]
+    arguments: Value,
+}
+
+fn empty_object() -> Value {
+    Value::Object(Map::new())
+}
+
+fn parse_idempotency_key(
+    request_id: &RequestId,
+    headers: &HeaderMap,
+) -> Result<Option<String>, ApiError> {
+    parse_single_idempotency_key(request_id, headers, gateway_idempotency_key_is_valid)
+}
+
+fn parse_single_idempotency_key(
+    request_id: &RequestId,
+    headers: &HeaderMap,
+    is_valid: impl FnOnce(&str) -> bool,
+) -> Result<Option<String>, ApiError> {
+    let mut values = headers.get_all(IDEMPOTENCY_KEY_HEADER).iter();
+    let Some(value) = values.next() else {
+        return Ok(None);
+    };
+    if values.next().is_some() {
+        return Err(invalid_idempotency_key(request_id));
+    }
+    let value = value
+        .to_str()
+        .map_err(|_| invalid_idempotency_key(request_id))?;
+    if !is_valid(value) {
+        return Err(invalid_idempotency_key(request_id));
+    }
+    Ok(Some(value.to_owned()))
+}
+
+fn invalid_idempotency_key(request_id: &RequestId) -> ApiError {
+    ApiError::new(
+        request_id,
+        StatusCode::BAD_REQUEST,
+        "invalid_idempotency_key",
+        "Idempotency-Key must contain between 1 and 255 visible ASCII bytes.",
+    )
+}
+
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+struct ApprovalRequiredResponse {
+    status: &'static str,
+    approval: PendingApprovalResponse,
+}
+
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+struct PendingApprovalResponse {
+    id: String,
+    status: crate::approval::ApprovalStatus,
+    revision: i64,
+    path: String,
+    created_at: i64,
+    expires_at: i64,
+    status_url: String,
+}
+
+async fn invoke(
+    Extension(request_id): Extension<RequestId>,
+    State(state): State<AppState>,
+    GatewayAuthentication(identity): GatewayAuthentication,
+    headers: HeaderMap,
+    payload: Result<Json<InvokeRequest>, JsonRejection>,
+) -> Result<Response, ApiError> {
+    let idempotency_key = parse_idempotency_key(&request_id, &headers)?;
+    let Json(payload) = match parse_json(&request_id, payload) {
+        Ok(payload) => payload,
+        Err(error) => {
+            state.tool_calls.record_rejected_request(
+                &request_id.0,
+                &identity.token_id,
+                RequestSurface::Gateway,
+                "tools.invoke",
+                error.code,
+            );
+            return Err(error);
+        }
+    };
+    let call = ToolCall {
+        request_id: request_id.0.clone(),
+        actor: ToolActor::api_token(identity.token_id, Some(identity.token_name)),
+        surface: RequestSurface::Gateway,
+        execution_id: request_id.0.clone(),
+        call_id: "gateway".to_owned(),
+        worker_generation: 0,
+        path: payload.path,
+        arguments: payload.arguments,
+    };
+    if let Some(idempotency_key) = idempotency_key {
+        let response = state
+            .tool_calls
+            .submit_gateway_idempotent(call, &idempotency_key)
+            .await
+            .map_err(|error| gateway_invoke_error(&request_id, error))?;
+        return exact_gateway_response(&request_id, response);
+    }
+    let submission = state
+        .tool_calls
+        .submit(call)
+        .await
+        .map_err(|error| tool_call_error(&request_id, error))?;
+    match submission {
+        ToolCallSubmission::Completed(result) => Ok(Json(result).into_response()),
+        ToolCallSubmission::ApprovalRequired(approval) => Ok((
+            StatusCode::ACCEPTED,
+            Json(ApprovalRequiredResponse {
+                status: "approval_required",
+                approval: PendingApprovalResponse {
+                    status_url: format!("/api/v1/gateway/approvals/{}", approval.id),
+                    id: approval.id.clone(),
+                    status: approval.status,
+                    revision: approval.revision,
+                    path: approval.callable_path_snapshot.clone(),
+                    created_at: approval.created_at,
+                    expires_at: approval.expires_at,
+                },
+            }),
+        )
+            .into_response()),
+    }
+}
+
+fn exact_gateway_response(
+    request_id: &RequestId,
+    output: GatewayInvokeResponse,
+) -> Result<Response, ApiError> {
+    let mut response = Response::builder().status(output.response.status);
+    for (name, value) in output.response.headers {
+        let name = HeaderName::try_from(name).map_err(|_| ApiError::internal(request_id))?;
+        let value = HeaderValue::try_from(value).map_err(|_| ApiError::internal(request_id))?;
+        response = response.header(name, value);
+    }
+    if output.replayed {
+        response = response.header("idempotency-replayed", "true");
+    }
+    response
+        .body(Body::from(output.response.body))
+        .map_err(|_| ApiError::internal(request_id))
+}
+
+fn gateway_invoke_error(request_id: &RequestId, error: GatewayInvokeError) -> ApiError {
+    match error {
+        GatewayInvokeError::ToolCall(error) => tool_call_error(request_id, error),
+        GatewayInvokeError::InvalidKey => invalid_idempotency_key(request_id),
+        GatewayInvokeError::Capacity => ApiError::new(
+            request_id,
+            StatusCode::TOO_MANY_REQUESTS,
+            "idempotency_capacity",
+            "Gateway idempotency capacity has been reached. Retry later.",
+        )
+        .with_retry_after(1),
+        GatewayInvokeError::KeyMismatch => ApiError::new(
+            request_id,
+            StatusCode::CONFLICT,
+            "idempotency_key_mismatch",
+            "This Idempotency-Key was already used for a different invocation.",
+        ),
+        GatewayInvokeError::InProgress => ApiError::new(
+            request_id,
+            StatusCode::CONFLICT,
+            "idempotency_in_progress",
+            "The invocation for this Idempotency-Key is still in progress.",
+        )
+        .with_retry_after(1),
+        GatewayInvokeError::OutcomeUnknown => ApiError::new(
+            request_id,
+            StatusCode::CONFLICT,
+            "idempotency_outcome_unknown",
+            "The invocation may have reached the upstream service, so it will not be retried.",
+        ),
+        GatewayInvokeError::Canceled => ApiError::new(
+            request_id,
+            StatusCode::CONFLICT,
+            "idempotency_in_progress",
+            "The invocation is still in progress.",
+        )
+        .with_retry_after(1),
+        GatewayInvokeError::Idempotency(error) => ApiError::internal_logged(request_id, error),
+    }
+}
+
+pub(super) fn tool_call_error(request_id: &RequestId, error: ToolCallError) -> ApiError {
+    match error {
+        ToolCallError::Approval(error) => approval_error(request_id, error),
+        ToolCallError::Catalog(error) => catalog_error(request_id, error),
+        ToolCallError::Adapter { code, message } => adapter_error(request_id, code, message),
+        ToolCallError::OAuth(error) => tool_call_oauth_error(request_id, error),
+        ToolCallError::ArgumentsTooLarge => ApiError::new(
+            request_id,
+            StatusCode::PAYLOAD_TOO_LARGE,
+            "arguments_too_large",
+            "Tool arguments exceed the allowed size.",
+        ),
+        ToolCallError::InvalidArguments => ApiError::new(
+            request_id,
+            StatusCode::BAD_REQUEST,
+            "invalid_tool_arguments",
+            "The tool arguments do not match the imported input schema.",
+        ),
+        ToolCallError::Protocol(error) => protocol_error(request_id, error),
+        ToolCallError::Stale => ApiError::new(
+            request_id,
+            StatusCode::CONFLICT,
+            "invocation_stale",
+            "The tool changed before invocation. Retry with the current catalog.",
+        ),
+        ToolCallError::Outbound(error) => outbound_error(request_id, error),
+        ToolCallError::ResultTooLarge => ApiError::new(
+            request_id,
+            StatusCode::PAYLOAD_TOO_LARGE,
+            "result_too_large",
+            "The upstream tool result exceeds the allowed size.",
+        ),
+    }
+}
+
+fn tool_call_oauth_error(request_id: &RequestId, error: ToolCallOAuthError) -> ApiError {
+    let code = error.code();
+    match error {
+        ToolCallOAuthError::Validation { .. } => ApiError::new(
+            request_id,
+            StatusCode::BAD_REQUEST,
+            code,
+            "The managed OAuth configuration is invalid.",
+        ),
+        ToolCallOAuthError::ConnectionRequired => ApiError::new(
+            request_id,
+            StatusCode::CONFLICT,
+            code,
+            "A managed OAuth connection is required before this tool can run.",
+        ),
+        ToolCallOAuthError::Conflict { .. } => ApiError::new(
+            request_id,
+            StatusCode::CONFLICT,
+            code,
+            "The managed OAuth connection changed. Retry with its current configuration.",
+        ),
+        ToolCallOAuthError::UnauthorizedTransaction => ApiError::new(
+            request_id,
+            StatusCode::UNAUTHORIZED,
+            code,
+            "The managed OAuth transaction is not authorized for this session.",
+        ),
+        ToolCallOAuthError::AuthorizationDenied => ApiError::new(
+            request_id,
+            StatusCode::CONFLICT,
+            code,
+            "Managed OAuth authorization was denied.",
+        ),
+        ToolCallOAuthError::Upstream { .. } => ApiError::new(
+            request_id,
+            StatusCode::BAD_GATEWAY,
+            code,
+            "The OAuth provider request failed.",
+        ),
+        ToolCallOAuthError::Internal => {
+            ApiError::internal_logged(request_id, "managed OAuth failed internally")
+        }
+    }
+}
+
+fn adapter_error(
+    request_id: &RequestId,
+    code: ToolCallAdapterErrorCode,
+    message: String,
+) -> ApiError {
+    let status = match code {
+        ToolCallAdapterErrorCode::ApprovalPersistenceUnavailable
+        | ToolCallAdapterErrorCode::ApprovalPersistenceInterrupted
+        | ToolCallAdapterErrorCode::McpShuttingDown
+        | ToolCallAdapterErrorCode::McpCapacity => StatusCode::SERVICE_UNAVAILABLE,
+        ToolCallAdapterErrorCode::OAuthConnectionFailed
+        | ToolCallAdapterErrorCode::OAuthBindingChanged
+        | ToolCallAdapterErrorCode::InvocationOutcomeUnknown
+        | ToolCallAdapterErrorCode::OpenApiOutcomeUnknown
+        | ToolCallAdapterErrorCode::GraphqlOutcomeUnknown
+        | ToolCallAdapterErrorCode::McpOutcomeUnknown
+        | ToolCallAdapterErrorCode::McpSessionConflict => StatusCode::CONFLICT,
+        ToolCallAdapterErrorCode::McpProtocolUnavailable
+        | ToolCallAdapterErrorCode::McpUpstreamUnauthorized
+        | ToolCallAdapterErrorCode::McpUpstreamForbidden => StatusCode::BAD_GATEWAY,
+        ToolCallAdapterErrorCode::McpMessageTooLarge => StatusCode::PAYLOAD_TOO_LARGE,
+        ToolCallAdapterErrorCode::IdempotencyMetadataInvalid
+        | ToolCallAdapterErrorCode::IdempotencyFailed => StatusCode::INTERNAL_SERVER_ERROR,
+    };
+    let error = ApiError::new(request_id, status, code.as_str(), message);
+    if code == ToolCallAdapterErrorCode::McpCapacity {
+        error.with_retry_after(1)
+    } else {
+        error
+    }
+}
+
+pub(super) fn approval_error(request_id: &RequestId, error: ApprovalError) -> ApiError {
+    match error {
+        ApprovalError::NotFound => ApiError::new(
+            request_id,
+            StatusCode::NOT_FOUND,
+            "approval_not_found",
+            "The requested approval does not exist.",
+        ),
+        ApprovalError::Expired => ApiError::new(
+            request_id,
+            StatusCode::GONE,
+            "approval_expired",
+            "The approval has expired.",
+        ),
+        ApprovalError::RevisionConflict { .. } | ApprovalError::DecisionConflict => ApiError::new(
+            request_id,
+            StatusCode::CONFLICT,
+            "revision_conflict",
+            "The approval changed. Refresh it and retry.",
+        ),
+        ApprovalError::InvalidTransition { .. } => ApiError::new(
+            request_id,
+            StatusCode::CONFLICT,
+            "approval_not_cancelable",
+            "The approval can no longer be canceled or changed.",
+        ),
+        ApprovalError::OwnerTokenInactive => ApiError::unauthorized(
+            request_id,
+            "The API token that created this approval is no longer active.",
+        ),
+        ApprovalError::Capacity { .. } => ApiError::new(
+            request_id,
+            StatusCode::TOO_MANY_REQUESTS,
+            "approval_capacity",
+            "Too many approvals are active. Resolve an existing approval and retry.",
+        )
+        .with_retry_after(1),
+        ApprovalError::CorrelationConflict => ApiError::new(
+            request_id,
+            StatusCode::CONFLICT,
+            "duplicate_tool_call",
+            "The execution call conflicts with an existing approval.",
+        ),
+        ApprovalError::CorrelationRetired => ApiError::new(
+            request_id,
+            StatusCode::CONFLICT,
+            "approval_stale",
+            "The correlated approval is no longer retained.",
+        ),
+        ApprovalError::WorkerGenerationConflict => ApiError::new(
+            request_id,
+            StatusCode::CONFLICT,
+            "approval_stale",
+            "The approval belongs to an older execution generation.",
+        ),
+        ApprovalError::PayloadTooLarge { .. } => ApiError::new(
+            request_id,
+            StatusCode::PAYLOAD_TOO_LARGE,
+            "approval_payload_too_large",
+            "The approval payload exceeds the allowed size.",
+        ),
+        ApprovalError::Validation { code, message } => {
+            ApiError::new(request_id, StatusCode::BAD_REQUEST, code, message)
+        }
+        error => ApiError::internal_logged(request_id, error),
+    }
+}
+
+fn catalog_error(request_id: &RequestId, error: CatalogError) -> ApiError {
+    match error {
+        CatalogError::Validation {
+            code: "oauth_binding_changed",
+            message,
+        } => ApiError::new(
+            request_id,
+            StatusCode::CONFLICT,
+            "oauth_binding_changed",
+            message,
+        ),
+        CatalogError::Validation { code, message } => {
+            ApiError::new(request_id, StatusCode::BAD_REQUEST, code, message)
+        }
+        CatalogError::NotFound { entity: "source" } => ApiError::new(
+            request_id,
+            StatusCode::NOT_FOUND,
+            "source_not_found",
+            "The requested source does not exist.",
+        ),
+        CatalogError::NotFound { .. } | CatalogError::ToolNotFound { .. } => ApiError::new(
+            request_id,
+            StatusCode::NOT_FOUND,
+            "tool_not_found",
+            "The requested tool does not exist.",
+        ),
+        CatalogError::ToolDisabled { .. } => ApiError::new(
+            request_id,
+            StatusCode::FORBIDDEN,
+            "tool_disabled",
+            "The requested tool is disabled.",
+        ),
+        CatalogError::RevisionConflict { .. } => ApiError::new(
+            request_id,
+            StatusCode::CONFLICT,
+            "revision_conflict",
+            "The source changed. Refresh and retry the update.",
+        ),
+        error => ApiError::internal_logged(request_id, error),
+    }
+}
+
+pub(super) fn protocol_error(request_id: &RequestId, error: ProtocolError) -> ApiError {
+    if matches!(
+        error.category,
+        ProtocolErrorCategory::CorruptData | ProtocolErrorCategory::Internal
+    ) {
+        return ApiError::internal_logged(request_id, error);
+    }
+    let status = match error.category {
+        ProtocolErrorCategory::InvalidInput if error.code == "oauth_binding_changed" => {
+            StatusCode::CONFLICT
+        }
+        ProtocolErrorCategory::InvalidInput => match error.code {
+            "private_network_denied" | "forbidden_network_target" => StatusCode::FORBIDDEN,
+            "outbound_headers_too_large"
+            | "outbound_request_too_large"
+            | "upstream_headers_too_large"
+            | "upstream_response_too_large"
+            | "openapi_document_too_large" => StatusCode::PAYLOAD_TOO_LARGE,
+            _ => StatusCode::BAD_REQUEST,
+        },
+        ProtocolErrorCategory::NotFound => StatusCode::NOT_FOUND,
+        ProtocolErrorCategory::Conflict => StatusCode::CONFLICT,
+        ProtocolErrorCategory::Unsupported => StatusCode::BAD_REQUEST,
+        ProtocolErrorCategory::Upstream if error.code == "upstream_timeout" => {
+            StatusCode::GATEWAY_TIMEOUT
+        }
+        ProtocolErrorCategory::Upstream => StatusCode::BAD_GATEWAY,
+        ProtocolErrorCategory::CorruptData | ProtocolErrorCategory::Internal => {
+            unreachable!("non-public protocol errors return above")
+        }
+    };
+    ApiError::new(request_id, status, error.code, error.message)
+}
+
+pub(super) fn outbound_error(request_id: &RequestId, error: OutboundError) -> ApiError {
+    let status = match error {
+        OutboundError::InvalidUrl
+        | OutboundError::InsecureTransport
+        | OutboundError::UnsupportedScheme
+        | OutboundError::CredentialsNotAllowed
+        | OutboundError::FragmentNotAllowed
+        | OutboundError::MissingHost
+        | OutboundError::MissingPort
+        | OutboundError::ForbiddenHeader
+        | OutboundError::ForbiddenMethod => StatusCode::BAD_REQUEST,
+        OutboundError::PrivateAddress | OutboundError::ForbiddenAddress => StatusCode::FORBIDDEN,
+        OutboundError::ResponseBodyTooLarge
+        | OutboundError::ResponseHeadersTooLarge
+        | OutboundError::RequestBodyTooLarge
+        | OutboundError::RequestHeadersTooLarge => StatusCode::PAYLOAD_TOO_LARGE,
+        OutboundError::ClientInitialization => StatusCode::SERVICE_UNAVAILABLE,
+        OutboundError::Timeout => StatusCode::GATEWAY_TIMEOUT,
+        OutboundError::Connection
+        | OutboundError::Request
+        | OutboundError::DnsResolution
+        | OutboundError::UnsupportedContentEncoding
+        | OutboundError::InvalidRedirect
+        | OutboundError::RedirectDowngrade
+        | OutboundError::RedirectLoop
+        | OutboundError::TooManyRedirects
+        | OutboundError::UpstreamStatus { .. } => StatusCode::BAD_GATEWAY,
+    };
+    ApiError::new(
+        request_id,
+        status,
+        error.code(),
+        "The upstream request could not be completed safely.",
+    )
+}
+
+#[cfg(test)]
+mod tests {
+    use std::{collections::BTreeMap, path::PathBuf, sync::Arc};
+
+    use serde_json::json;
+    use sqlx::sqlite::SqlitePoolOptions;
+
+    use super::*;
+
+    fn request_id() -> RequestId {
+        RequestId("protocol-error-test".to_owned())
+    }
+
+    #[test]
+    fn adapter_error_statuses_are_typed_and_exhaustive() {
+        use ToolCallAdapterErrorCode as Code;
+
+        let cases = [
+            (
+                Code::ApprovalPersistenceUnavailable,
+                StatusCode::SERVICE_UNAVAILABLE,
+                None,
+            ),
+            (
+                Code::ApprovalPersistenceInterrupted,
+                StatusCode::SERVICE_UNAVAILABLE,
+                None,
+            ),
+            (
+                Code::IdempotencyMetadataInvalid,
+                StatusCode::INTERNAL_SERVER_ERROR,
+                None,
+            ),
+            (
+                Code::IdempotencyFailed,
+                StatusCode::INTERNAL_SERVER_ERROR,
+                None,
+            ),
+            (Code::OAuthConnectionFailed, StatusCode::CONFLICT, None),
+            (Code::OAuthBindingChanged, StatusCode::CONFLICT, None),
+            (Code::InvocationOutcomeUnknown, StatusCode::CONFLICT, None),
+            (Code::OpenApiOutcomeUnknown, StatusCode::CONFLICT, None),
+            (Code::GraphqlOutcomeUnknown, StatusCode::CONFLICT, None),
+            (Code::McpOutcomeUnknown, StatusCode::CONFLICT, None),
+            (Code::McpProtocolUnavailable, StatusCode::BAD_GATEWAY, None),
+            (Code::McpUpstreamUnauthorized, StatusCode::BAD_GATEWAY, None),
+            (Code::McpUpstreamForbidden, StatusCode::BAD_GATEWAY, None),
+            (Code::McpSessionConflict, StatusCode::CONFLICT, None),
+            (Code::McpShuttingDown, StatusCode::SERVICE_UNAVAILABLE, None),
+            (Code::McpCapacity, StatusCode::SERVICE_UNAVAILABLE, Some(1)),
+            (
+                Code::McpMessageTooLarge,
+                StatusCode::PAYLOAD_TOO_LARGE,
+                None,
+            ),
+        ];
+        for (code, status, retry_after_seconds) in cases {
+            let error = adapter_error(&request_id(), code, "A safe public message.".to_owned());
+            assert_eq!(error.status, status, "wrong status for {}", code.as_str());
+            assert_eq!(error.code, code.as_str());
+            assert_eq!(error.retry_after_seconds, retry_after_seconds);
+            assert_eq!(error.message, "A safe public message.");
+        }
+    }
+
+    #[test]
+    fn gateway_outcome_unknown_is_non_retryable() {
+        let error = gateway_invoke_error(&request_id(), GatewayInvokeError::OutcomeUnknown);
+        assert_eq!(error.status, StatusCode::CONFLICT);
+        assert_eq!(error.code, "idempotency_outcome_unknown");
+        assert_eq!(error.retry_after_seconds, None);
+
+        let response = error.into_response();
+        assert_eq!(response.status(), StatusCode::CONFLICT);
+        assert!(!response.headers().contains_key(header::RETRY_AFTER));
+    }
+
+    #[test]
+    fn oauth_error_statuses_preserve_typed_failure_categories() {
+        let cases = [
+            (
+                ToolCallOAuthError::Validation {
+                    code: "oauth_scope_invalid",
+                },
+                StatusCode::BAD_REQUEST,
+                "oauth_scope_invalid",
+            ),
+            (
+                ToolCallOAuthError::ConnectionRequired,
+                StatusCode::CONFLICT,
+                "oauth_connection_required",
+            ),
+            (
+                ToolCallOAuthError::Conflict {
+                    code: "oauth_binding_changed",
+                },
+                StatusCode::CONFLICT,
+                "oauth_binding_changed",
+            ),
+            (
+                ToolCallOAuthError::UnauthorizedTransaction,
+                StatusCode::UNAUTHORIZED,
+                "oauth_transaction_unauthorized",
+            ),
+            (
+                ToolCallOAuthError::AuthorizationDenied,
+                StatusCode::CONFLICT,
+                "oauth_authorization_denied",
+            ),
+            (
+                ToolCallOAuthError::Upstream {
+                    code: "oauth_provider_timeout",
+                },
+                StatusCode::BAD_GATEWAY,
+                "oauth_provider_timeout",
+            ),
+            (
+                ToolCallOAuthError::Internal,
+                StatusCode::INTERNAL_SERVER_ERROR,
+                "internal_error",
+            ),
+        ];
+        for (source, expected_status, expected_code) in cases {
+            let error = tool_call_oauth_error(&request_id(), source);
+            assert_eq!(error.status, expected_status);
+            assert_eq!(error.code, expected_code);
+        }
+    }
+
+    #[test]
+    fn outbound_error_statuses_are_typed_and_exhaustive() {
+        let cases = vec![
+            (OutboundError::InvalidUrl, StatusCode::BAD_REQUEST),
+            (OutboundError::InsecureTransport, StatusCode::BAD_REQUEST),
+            (OutboundError::UnsupportedScheme, StatusCode::BAD_REQUEST),
+            (
+                OutboundError::CredentialsNotAllowed,
+                StatusCode::BAD_REQUEST,
+            ),
+            (OutboundError::FragmentNotAllowed, StatusCode::BAD_REQUEST),
+            (OutboundError::MissingHost, StatusCode::BAD_REQUEST),
+            (OutboundError::MissingPort, StatusCode::BAD_REQUEST),
+            (OutboundError::PrivateAddress, StatusCode::FORBIDDEN),
+            (OutboundError::ForbiddenAddress, StatusCode::FORBIDDEN),
+            (OutboundError::DnsResolution, StatusCode::BAD_GATEWAY),
+            (OutboundError::ForbiddenHeader, StatusCode::BAD_REQUEST),
+            (OutboundError::ForbiddenMethod, StatusCode::BAD_REQUEST),
+            (
+                OutboundError::RequestHeadersTooLarge,
+                StatusCode::PAYLOAD_TOO_LARGE,
+            ),
+            (
+                OutboundError::RequestBodyTooLarge,
+                StatusCode::PAYLOAD_TOO_LARGE,
+            ),
+            (
+                OutboundError::ClientInitialization,
+                StatusCode::SERVICE_UNAVAILABLE,
+            ),
+            (OutboundError::Timeout, StatusCode::GATEWAY_TIMEOUT),
+            (OutboundError::Connection, StatusCode::BAD_GATEWAY),
+            (OutboundError::Request, StatusCode::BAD_GATEWAY),
+            (
+                OutboundError::ResponseHeadersTooLarge,
+                StatusCode::PAYLOAD_TOO_LARGE,
+            ),
+            (
+                OutboundError::ResponseBodyTooLarge,
+                StatusCode::PAYLOAD_TOO_LARGE,
+            ),
+            (
+                OutboundError::UnsupportedContentEncoding,
+                StatusCode::BAD_GATEWAY,
+            ),
+            (OutboundError::InvalidRedirect, StatusCode::BAD_GATEWAY),
+            (OutboundError::RedirectDowngrade, StatusCode::BAD_GATEWAY),
+            (OutboundError::RedirectLoop, StatusCode::BAD_GATEWAY),
+            (OutboundError::TooManyRedirects, StatusCode::BAD_GATEWAY),
+            (
+                OutboundError::UpstreamStatus {
+                    status: reqwest::StatusCode::SERVICE_UNAVAILABLE,
+                },
+                StatusCode::BAD_GATEWAY,
+            ),
+        ];
+        for (source, expected_status) in cases {
+            let expected_code = source.code();
+            let error = outbound_error(&request_id(), source);
+            assert_eq!(
+                error.status, expected_status,
+                "wrong status for {expected_code}"
+            );
+            assert_eq!(error.code, expected_code);
+            assert_eq!(
+                error.message,
+                "The upstream request could not be completed safely."
+            );
+            assert_eq!(error.retry_after_seconds, None);
+        }
+    }
+
+    #[test]
+    fn protocol_error_categories_map_without_exposing_non_public_failures() {
+        use ProtocolErrorCategory as Category;
+
+        let public_cases = [
+            (
+                Category::InvalidInput,
+                "invalid_tool_arguments",
+                StatusCode::BAD_REQUEST,
+            ),
+            (
+                Category::InvalidInput,
+                "oauth_binding_changed",
+                StatusCode::CONFLICT,
+            ),
+            (
+                Category::NotFound,
+                "source_not_found",
+                StatusCode::NOT_FOUND,
+            ),
+            (
+                Category::Conflict,
+                "revision_conflict",
+                StatusCode::CONFLICT,
+            ),
+            (
+                Category::Conflict,
+                "insecure_openapi_transport",
+                StatusCode::CONFLICT,
+            ),
+            (
+                Category::Unsupported,
+                "unsupported_protocol",
+                StatusCode::BAD_REQUEST,
+            ),
+            (
+                Category::Upstream,
+                "upstream_timeout",
+                StatusCode::GATEWAY_TIMEOUT,
+            ),
+            (
+                Category::Upstream,
+                "upstream_connection_failed",
+                StatusCode::BAD_GATEWAY,
+            ),
+            (
+                Category::InvalidInput,
+                "private_network_denied",
+                StatusCode::FORBIDDEN,
+            ),
+            (
+                Category::InvalidInput,
+                "invalid_mcp_endpoint",
+                StatusCode::BAD_REQUEST,
+            ),
+            (
+                Category::InvalidInput,
+                "upstream_response_too_large",
+                StatusCode::PAYLOAD_TOO_LARGE,
+            ),
+        ];
+        for (category, code, status) in public_cases {
+            let error = protocol_error(
+                &request_id(),
+                ProtocolError::new(category, code, "A safe public message."),
+            );
+            assert_eq!(error.status, status, "wrong status for {code}");
+            assert_eq!(error.code, code);
+            assert_eq!(error.message, "A safe public message.");
+            assert_eq!(error.retry_after_seconds, None);
+        }
+        for category in [Category::CorruptData, Category::Internal] {
+            let error = protocol_error(
+                &request_id(),
+                ProtocolError::new(category, "private_failure", "secret upstream detail"),
+            );
+            assert_eq!(error.status, StatusCode::INTERNAL_SERVER_ERROR);
+            assert_eq!(error.code, "internal_error");
+            assert!(!error.message.contains("secret upstream detail"));
+        }
+    }
+
+    #[test]
+    fn caller_and_catalog_failures_keep_their_http_contracts() {
+        let missing = tool_call_error(
+            &request_id(),
+            ToolCallError::Catalog(CatalogError::ToolNotFound {
+                path: "missing.tool".to_owned(),
+            }),
+        );
+        assert_eq!(
+            (missing.status, missing.code),
+            (StatusCode::NOT_FOUND, "tool_not_found")
+        );
+
+        let disabled = tool_call_error(
+            &request_id(),
+            ToolCallError::Catalog(CatalogError::ToolDisabled {
+                path: "disabled.tool".to_owned(),
+            }),
+        );
+        assert_eq!(
+            (disabled.status, disabled.code),
+            (StatusCode::FORBIDDEN, "tool_disabled")
+        );
+
+        let oauth_binding_changed = catalog_error(
+            &request_id(),
+            CatalogError::Validation {
+                code: "oauth_binding_changed",
+                message: "The managed OAuth binding changed.".to_owned(),
+            },
+        );
+        assert_eq!(
+            (oauth_binding_changed.status, oauth_binding_changed.code),
+            (StatusCode::CONFLICT, "oauth_binding_changed")
+        );
+
+        let invalid = tool_call_error(&request_id(), ToolCallError::InvalidArguments);
+        assert_eq!(
+            (invalid.status, invalid.code),
+            (StatusCode::BAD_REQUEST, "invalid_tool_arguments")
+        );
+
+        let revoked = tool_call_error(
+            &request_id(),
+            ToolCallError::Approval(ApprovalError::OwnerTokenInactive),
+        );
+        assert_eq!(
+            (revoked.status, revoked.code),
+            (StatusCode::UNAUTHORIZED, "unauthorized")
+        );
+    }
+
+    struct SourceCreationFixture {
+        pool: sqlx::SqlitePool,
+        connections: Arc<crate::mcp::manager::McpConnectionManager>,
+        sources: crate::protocols::SourceService,
+        idempotency: SourceCreationIdempotencyStore,
+    }
+
+    async fn source_creation_fixture() -> SourceCreationFixture {
+        let pool = SqlitePoolOptions::new()
+            .max_connections(1)
+            .connect("sqlite::memory:")
+            .await
+            .expect("test database opens");
+        sqlx::migrate!("./migrations")
+            .run(&pool)
+            .await
+            .expect("migrations apply");
+        sqlx::query(
+            "INSERT INTO admins (id, username, password_hash, created_at) \
+             VALUES (1, 'admin', 'test-password-hash', 1)",
+        )
+        .execute(&pool)
+        .await
+        .expect("test administrator inserts");
+        let keyring =
+            crate::crypto::Keyring::from_master_key([87; 32]).expect("test keyring derives");
+        let catalog = crate::catalog::CatalogStore::new(pool.clone(), keyring.clone());
+        let templates = crate::mcp::upstream::stdio::StdioTemplateRegistry::new(vec![
+            crate::mcp::upstream::stdio::StdioTemplate {
+                name: "deferred".to_owned(),
+                executable: PathBuf::from("/bin/sh"),
+                cwd: None,
+                arguments: vec!["-c".to_owned(), "exit 1".to_owned()],
+                environment: BTreeMap::new(),
+                secret_environment: vec!["API_TOKEN".to_owned()],
+            },
+        ])
+        .expect("test stdio template validates");
+        let connections = Arc::new(crate::mcp::manager::McpConnectionManager::new(templates));
+        let oauth = crate::oauth::OAuthService::new(
+            pool.clone(),
+            keyring,
+            "http://127.0.0.1:4788".to_owned(),
+            crate::outbound::OutboundPolicy::default(),
+        );
+        SourceCreationFixture {
+            pool,
+            connections: connections.clone(),
+            sources: crate::protocols::SourceService::new(catalog.clone(), connections, oauth),
+            idempotency: catalog.source_creation_idempotency(),
+        }
+    }
+
+    fn deferred_source_request() -> (Value, CreateSourceRequest) {
+        let request = json!({
+            "kind": "mcp_stdio",
+            "displayName": "Deferred stdio",
+            "templateName": "deferred",
+            "secretValues": {}
+        });
+        let payload = CreateSourceRequest {
+            kind: SourceKind::McpStdio,
+            protocol: request
+                .as_object()
+                .expect("request is an object")
+                .iter()
+                .filter(|(name, _)| name.as_str() != "kind")
+                .map(|(name, value)| (name.clone(), value.clone()))
+                .collect(),
+        };
+        (request, payload)
+    }
+
+    async fn reserve_source_creation(
+        fixture: &SourceCreationFixture,
+        key: &str,
+        request: &Value,
+    ) -> SourceCreationReservation {
+        let SourceCreationIdempotencyClaim::Fresh(reservation) = fixture
+            .idempotency
+            .claim(1, SOURCE_CREATION_ROUTE, key, request)
+            .await
+            .expect("source creation reservation succeeds")
+        else {
+            panic!("source creation reservation must be fresh");
+        };
+        reservation
+    }
+
+    async fn close_source_creation_fixture(fixture: SourceCreationFixture) {
+        fixture.connections.shutdown().await;
+        fixture.pool.close().await;
+    }
+
+    #[tokio::test]
+    async fn source_creation_job_waits_for_post_commit_mcp_reconciliation() {
+        let mut fixture = source_creation_fixture().await;
+        let pause = fixture.sources.pause_source_creation_finish();
+        let key = "post-commit-reconciliation";
+        let (request, payload) = deferred_source_request();
+        let reservation = reserve_source_creation(&fixture, key, &request).await;
+        let registry = SourceCreationSupervisorRegistry::default();
+        let active_key = SourceCreationSupervisorKey {
+            admin_id: 1,
+            key_digest: [11; 32],
+        };
+        let supervisor_guard = registry.register(active_key);
+        let replay_waiter = tokio::spawn({
+            let registry = registry.clone();
+            async move { registry.wait_if_active(active_key).await }
+        });
+        let job = tokio::spawn(source_creation_job(
+            "source-create-test".to_owned(),
+            fixture.sources.clone(),
+            1,
+            key.to_owned(),
+            payload,
+            fixture.idempotency.clone(),
+            reservation,
+        ));
+
+        pause.reached().await;
+        assert!(
+            !job.is_finished(),
+            "the HTTP result must wait for post-commit reconciliation"
+        );
+        assert!(
+            !replay_waiter.is_finished(),
+            "replay must wait for the active post-commit reconciliation"
+        );
+        assert!(matches!(
+            fixture
+                .idempotency
+                .lookup(1, SOURCE_CREATION_ROUTE, key)
+                .await
+                .expect("completed reservation reads"),
+            Some(SourceCreationIdempotencyStatus::Replay(
+                SourceCreationReplay {
+                    kind: SourceCreationResponseKind::Completed,
+                    ..
+                }
+            ))
+        ));
+        pause.release();
+        let response = match job.await.expect("source creation task joins") {
+            Ok(response) => response,
+            Err(error) => panic!(
+                "source creation should succeed, got {} ({})",
+                error.code, error.status
+            ),
+        };
+        assert_eq!(response.status, StatusCode::CREATED.as_u16());
+        drop(supervisor_guard);
+        replay_waiter.await.expect("replay barrier waiter joins");
+        assert_eq!(
+            sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM sources")
+                .fetch_one(&fixture.pool)
+                .await
+                .expect("source count reads"),
+            1
+        );
+        close_source_creation_fixture(fixture).await;
+    }
+
+    #[tokio::test]
+    async fn supervised_shutdown_after_commit_recovers_reconciliation_and_stored_success() {
+        let mut fixture = source_creation_fixture().await;
+        let pause = fixture.sources.pause_source_creation_finish();
+        let key = "shutdown-after-commit";
+        let (request, payload) = deferred_source_request();
+        let reservation = reserve_source_creation(&fixture, key, &request).await;
+        let tracker = crate::tasks::TaskTracker::default();
+        let (result_sender, result_receiver) = tokio::sync::oneshot::channel();
+        let sources = fixture.sources.clone();
+        let idempotency = fixture.idempotency.clone();
+        assert!(tracker.spawn_supervised(|shutdown| async move {
+            let result = supervise_source_creation(
+                "shutdown-after-commit-request".to_owned(),
+                sources,
+                1,
+                key.to_owned(),
+                payload,
+                idempotency,
+                reservation,
+                shutdown,
+            )
+            .await;
+            let _ = result_sender.send(result);
+        }));
+
+        pause.reached().await;
+        assert!(matches!(
+            fixture
+                .idempotency
+                .lookup(1, SOURCE_CREATION_ROUTE, key)
+                .await
+                .expect("completed reservation reads"),
+            Some(SourceCreationIdempotencyStatus::Replay(
+                SourceCreationReplay {
+                    kind: SourceCreationResponseKind::Completed,
+                    ..
+                }
+            ))
+        ));
+        tracker.shutdown().await;
+        let response = match result_receiver
+            .await
+            .expect("supervisor reports its shutdown result")
+        {
+            Ok(response) => response,
+            Err(error) => panic!(
+                "completed source creation should recover, got {} ({})",
+                error.code, error.status
+            ),
+        };
+        assert_eq!(response.status, StatusCode::CREATED.as_u16());
+        assert_eq!(
+            sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM sources")
+                .fetch_one(&fixture.pool)
+                .await
+                .expect("source count reads"),
+            1
+        );
+        close_source_creation_fixture(fixture).await;
+    }
+
+    #[tokio::test]
+    async fn worker_panic_before_commit_interrupts_the_reservation() {
+        let mut fixture = source_creation_fixture().await;
+        fixture
+            .sources
+            .panic_source_creation_at(crate::protocols::SourceCreationPanic::BeforeCreate);
+        let key = "panic-before-commit";
+        let (request, payload) = deferred_source_request();
+        let reservation = reserve_source_creation(&fixture, key, &request).await;
+        let (shutdown_sender, shutdown) = tokio::sync::oneshot::channel();
+        let result = supervise_source_creation(
+            "panic-before-commit-request".to_owned(),
+            fixture.sources.clone(),
+            1,
+            key.to_owned(),
+            payload,
+            fixture.idempotency.clone(),
+            reservation,
+            shutdown,
+        )
+        .await;
+        drop(shutdown_sender);
+        let Err(error) = result else {
+            panic!("a pre-commit panic must not produce a source response");
+        };
+        assert_eq!(error.code, "idempotency_interrupted");
+        assert!(matches!(
+            fixture
+                .idempotency
+                .lookup(1, SOURCE_CREATION_ROUTE, key)
+                .await
+                .expect("interrupted reservation reads"),
+            Some(SourceCreationIdempotencyStatus::Interrupted)
+        ));
+        assert_eq!(
+            sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM sources")
+                .fetch_one(&fixture.pool)
+                .await
+                .expect("source count reads"),
+            0
+        );
+        close_source_creation_fixture(fixture).await;
+    }
+
+    #[tokio::test]
+    async fn worker_panic_after_commit_recovers_the_exact_success() {
+        let mut fixture = source_creation_fixture().await;
+        fixture
+            .sources
+            .panic_source_creation_at(crate::protocols::SourceCreationPanic::AfterCreate);
+        let key = "panic-after-commit";
+        let (request, payload) = deferred_source_request();
+        let reservation = reserve_source_creation(&fixture, key, &request).await;
+        let (shutdown_sender, shutdown) = tokio::sync::oneshot::channel();
+        let result = supervise_source_creation(
+            "panic-after-commit-request".to_owned(),
+            fixture.sources.clone(),
+            1,
+            key.to_owned(),
+            payload,
+            fixture.idempotency.clone(),
+            reservation,
+            shutdown,
+        )
+        .await;
+        drop(shutdown_sender);
+        let response = match result {
+            Ok(response) => response,
+            Err(error) => panic!(
+                "a post-commit panic should recover, got {} ({})",
+                error.code, error.status
+            ),
+        };
+        assert_eq!(response.status, StatusCode::CREATED.as_u16());
+        assert!(matches!(
+            fixture
+                .idempotency
+                .lookup(1, SOURCE_CREATION_ROUTE, key)
+                .await
+                .expect("completed reservation reads"),
+            Some(SourceCreationIdempotencyStatus::Replay(
+                SourceCreationReplay {
+                    kind: SourceCreationResponseKind::Completed,
+                    ..
+                }
+            ))
+        ));
+        assert_eq!(
+            sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM sources")
+                .fetch_one(&fixture.pool)
+                .await
+                .expect("source count reads"),
+            1
+        );
+        close_source_creation_fixture(fixture).await;
+    }
+
+    #[tokio::test]
+    async fn transient_settlement_lookup_failure_retries_and_recovers_committed_success() {
+        let fixture = source_creation_fixture().await;
+        let key = "transient-settlement-lookup";
+        let (request, payload) = deferred_source_request();
+        let reservation = reserve_source_creation(&fixture, key, &request).await;
+        fixture.idempotency.fail_next_lookup_for_test();
+        let (shutdown_sender, shutdown) = tokio::sync::oneshot::channel();
+        let result = supervise_source_creation(
+            "transient-settlement-lookup-request".to_owned(),
+            fixture.sources.clone(),
+            1,
+            key.to_owned(),
+            payload,
+            fixture.idempotency.clone(),
+            reservation,
+            shutdown,
+        )
+        .await;
+        drop(shutdown_sender);
+        let response = match result {
+            Ok(response) => response,
+            Err(error) => panic!(
+                "a transient lookup failure should recover, got {} ({})",
+                error.code, error.status
+            ),
+        };
+        assert_eq!(response.status, StatusCode::CREATED.as_u16());
+        assert!(matches!(
+            fixture
+                .idempotency
+                .lookup(1, SOURCE_CREATION_ROUTE, key)
+                .await
+                .expect("completed reservation reads"),
+            Some(SourceCreationIdempotencyStatus::Replay(
+                SourceCreationReplay {
+                    kind: SourceCreationResponseKind::Completed,
+                    ..
+                }
+            ))
+        ));
+        assert_eq!(
+            sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM sources")
+                .fetch_one(&fixture.pool)
+                .await
+                .expect("source count reads"),
+            1
+        );
+        close_source_creation_fixture(fixture).await;
+    }
+}
diff --git a/src/api/token_delivery.rs b/src/api/token_delivery.rs
new file mode 100644
index 000000000..6c207f0e8
--- /dev/null
+++ b/src/api/token_delivery.rs
@@ -0,0 +1,263 @@
+use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
+use sqlx::{FromRow, SqlitePool};
+use subtle::ConstantTimeEq;
+use thiserror::Error;
+use uuid::Uuid;
+
+use crate::crypto::Keyring;
+
+pub(crate) const IDEMPOTENCY_KEY_MAX_BYTES: usize = 255;
+
+const KEY_DIGEST_PURPOSE: &str = "api-token-create-idempotency-key-v1";
+const REQUEST_DIGEST_PURPOSE: &str = "api-token-create-request-v1";
+const SECRET_DERIVATION_PURPOSE: &str = "api-token-create-secret-v1";
+const TOKEN_DIGEST_PURPOSE: &str = "api-token";
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub(crate) struct DeliveredToken {
+    pub(crate) id: String,
+    pub(crate) name: String,
+    pub(crate) token: String,
+    pub(crate) created_at: i64,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub(crate) enum TokenCreationClaim {
+    Fresh(DeliveredToken),
+    Replay(DeliveredToken),
+    Mismatch,
+    Revoked,
+}
+
+#[derive(Debug, Error)]
+pub(crate) enum TokenDeliveryError {
+    #[error("API token delivery storage failed: {0}")]
+    Database(#[from] sqlx::Error),
+    #[error("stored API token delivery metadata is invalid")]
+    CorruptData,
+    #[error("the Idempotency-Key must contain between 1 and 255 visible ASCII bytes")]
+    InvalidKey,
+}
+
+#[derive(FromRow)]
+struct TokenCreationRow {
+    record_id: String,
+    admin_id: i64,
+    key_digest: Vec<u8>,
+    request_digest: Vec<u8>,
+    token_id: String,
+    created_at: i64,
+    token_created_at: i64,
+    name: String,
+    token_digest: Vec<u8>,
+    token_prefix: String,
+    token_suffix: String,
+    revoked_at: Option<i64>,
+}
+
+pub(crate) fn validate_idempotency_key(key: &str) -> Result<(), TokenDeliveryError> {
+    if key.is_empty()
+        || key.len() > IDEMPOTENCY_KEY_MAX_BYTES
+        || !key.bytes().all(|byte| byte.is_ascii_graphic())
+    {
+        return Err(TokenDeliveryError::InvalidKey);
+    }
+    Ok(())
+}
+
+pub(crate) async fn claim_token_creation(
+    pool: &SqlitePool,
+    keyring: &Keyring,
+    admin_id: i64,
+    name: &str,
+    key: &str,
+    observed_now: i64,
+) -> Result<TokenCreationClaim, TokenDeliveryError> {
+    validate_idempotency_key(key)?;
+    if admin_id <= 0 || name.is_empty() {
+        return Err(TokenDeliveryError::CorruptData);
+    }
+
+    let key_digest = keyring.digest(KEY_DIGEST_PURPOSE, key.as_bytes());
+    let request_digest = request_digest(keyring, admin_id, name);
+    let mut transaction = pool.begin_with("BEGIN IMMEDIATE").await?;
+    let existing = sqlx::query_as::<_, TokenCreationRow>(
+        "SELECT creation.record_id, creation.admin_id, creation.key_digest, \
+         creation.request_digest, creation.token_id, creation.created_at, \
+         token.created_at AS token_created_at, token.name, \
+         token.token_digest, token.token_prefix, token.token_suffix, token.revoked_at \
+         FROM api_token_creation_idempotency AS creation \
+         JOIN api_tokens AS token ON token.id = creation.token_id \
+         WHERE creation.admin_id = ? AND creation.key_digest = ?",
+    )
+    .bind(admin_id)
+    .bind(key_digest.to_vec())
+    .fetch_optional(&mut *transaction)
+    .await?;
+
+    if let Some(existing) = existing {
+        let claim = replay_claim(keyring, existing, name, key, &key_digest, &request_digest)?;
+        transaction.commit().await?;
+        return Ok(claim);
+    }
+
+    let record_id = Uuid::new_v4().to_string();
+    let token_id = Uuid::new_v4().to_string();
+    let created_at = observed_now.max(0);
+    let token = derive_token(
+        keyring,
+        admin_id,
+        key,
+        &record_id,
+        &token_id,
+        &request_digest,
+        created_at,
+    );
+    let token_digest = keyring.digest(TOKEN_DIGEST_PURPOSE, token.as_bytes());
+    let (token_prefix, token_suffix) = token_mask_parts(&token);
+
+    sqlx::query(
+        "INSERT INTO api_tokens \
+         (id, name, token_digest, token_prefix, token_suffix, created_at) \
+         VALUES (?, ?, ?, ?, ?, ?)",
+    )
+    .bind(&token_id)
+    .bind(name)
+    .bind(token_digest.to_vec())
+    .bind(&token_prefix)
+    .bind(&token_suffix)
+    .bind(created_at)
+    .execute(&mut *transaction)
+    .await?;
+    sqlx::query(
+        "INSERT INTO api_token_creation_idempotency \
+         (record_id, admin_id, key_digest, request_digest, token_id, created_at) \
+         VALUES (?, ?, ?, ?, ?, ?)",
+    )
+    .bind(&record_id)
+    .bind(admin_id)
+    .bind(key_digest.to_vec())
+    .bind(request_digest.to_vec())
+    .bind(&token_id)
+    .bind(created_at)
+    .execute(&mut *transaction)
+    .await?;
+    transaction.commit().await?;
+
+    Ok(TokenCreationClaim::Fresh(DeliveredToken {
+        id: token_id,
+        name: name.to_owned(),
+        token,
+        created_at,
+    }))
+}
+
+fn replay_claim(
+    keyring: &Keyring,
+    row: TokenCreationRow,
+    name: &str,
+    key: &str,
+    key_digest: &[u8; 32],
+    request_digest: &[u8; 32],
+) -> Result<TokenCreationClaim, TokenDeliveryError> {
+    if row.admin_id <= 0
+        || row.created_at < 0
+        || row.token_created_at != row.created_at
+        || row.record_id.is_empty()
+        || row.token_id.is_empty()
+        || row.key_digest.len() != 32
+        || row.request_digest.len() != 32
+        || row.token_digest.len() != 32
+        || !bool::from(row.key_digest.as_slice().ct_eq(key_digest.as_slice()))
+    {
+        return Err(TokenDeliveryError::CorruptData);
+    }
+    if !bool::from(
+        row.request_digest
+            .as_slice()
+            .ct_eq(request_digest.as_slice()),
+    ) {
+        return Ok(TokenCreationClaim::Mismatch);
+    }
+    if row.name != name {
+        return Err(TokenDeliveryError::CorruptData);
+    }
+    if row.revoked_at.is_some() {
+        return Ok(TokenCreationClaim::Revoked);
+    }
+
+    let token = derive_token(
+        keyring,
+        row.admin_id,
+        key,
+        &row.record_id,
+        &row.token_id,
+        request_digest,
+        row.created_at,
+    );
+    let expected_digest = keyring.digest(TOKEN_DIGEST_PURPOSE, token.as_bytes());
+    let (expected_prefix, expected_suffix) = token_mask_parts(&token);
+    if !bool::from(
+        row.token_digest
+            .as_slice()
+            .ct_eq(expected_digest.as_slice()),
+    ) || row.token_prefix != expected_prefix
+        || row.token_suffix != expected_suffix
+    {
+        return Err(TokenDeliveryError::CorruptData);
+    }
+
+    Ok(TokenCreationClaim::Replay(DeliveredToken {
+        id: row.token_id,
+        name: row.name,
+        token,
+        created_at: row.created_at,
+    }))
+}
+
+fn request_digest(keyring: &Keyring, admin_id: i64, name: &str) -> [u8; 32] {
+    let mut binding = Vec::with_capacity(24 + name.len());
+    binding.extend_from_slice(b"executor-api-token-create-request-v1");
+    binding.extend_from_slice(&admin_id.to_be_bytes());
+    append_length_prefixed(&mut binding, name.as_bytes());
+    keyring.digest(REQUEST_DIGEST_PURPOSE, &binding)
+}
+
+fn derive_token(
+    keyring: &Keyring,
+    admin_id: i64,
+    key: &str,
+    record_id: &str,
+    token_id: &str,
+    request_digest: &[u8; 32],
+    created_at: i64,
+) -> String {
+    let mut binding = Vec::with_capacity(128 + key.len() + record_id.len() + token_id.len());
+    binding.extend_from_slice(b"executor-api-token-create-secret-v1");
+    binding.extend_from_slice(&admin_id.to_be_bytes());
+    append_length_prefixed(&mut binding, key.as_bytes());
+    append_length_prefixed(&mut binding, record_id.as_bytes());
+    append_length_prefixed(&mut binding, token_id.as_bytes());
+    append_length_prefixed(&mut binding, request_digest);
+    binding.extend_from_slice(&created_at.to_be_bytes());
+    let secret = keyring.digest(SECRET_DERIVATION_PURPOSE, &binding);
+    format!("exr_{}", URL_SAFE_NO_PAD.encode(secret))
+}
+
+fn token_mask_parts(token: &str) -> (String, String) {
+    let prefix = token.chars().take(8).collect();
+    let suffix = token
+        .chars()
+        .rev()
+        .take(4)
+        .collect::<String>()
+        .chars()
+        .rev()
+        .collect();
+    (prefix, suffix)
+}
+
+fn append_length_prefixed(encoded: &mut Vec<u8>, value: &[u8]) {
+    encoded.extend_from_slice(&(value.len() as u64).to_be_bytes());
+    encoded.extend_from_slice(value);
+}
diff --git a/src/approval/mod.rs b/src/approval/mod.rs
new file mode 100644
index 000000000..5beae3d1a
--- /dev/null
+++ b/src/approval/mod.rs
@@ -0,0 +1,2097 @@
+use std::{
+    fmt,
+    str::FromStr,
+    sync::Arc,
+    time::{SystemTime, UNIX_EPOCH},
+};
+
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+use sqlx::{FromRow, Sqlite, SqlitePool, Transaction};
+use thiserror::Error;
+use uuid::Uuid;
+
+use crate::{
+    actor::{ActorKind, ToolActor},
+    catalog::{InvocationRevisionToken, ModeProvenance, NewRequestLog, RequestSurface},
+    crypto::{CryptoError, Keyring},
+};
+
+#[path = "../invocation/mod.rs"]
+pub mod invocation;
+
+const APPROVAL_TTL_SECONDS: i64 = 10 * 60;
+#[cfg(test)]
+const APPROVAL_CORRELATION_TTL_SECONDS: i64 = 24 * 60 * 60;
+const MAX_APPROVAL_ARGUMENT_BYTES: usize = 8 * 1024 * 1024;
+const MAX_APPROVAL_SCHEMA_BYTES: usize = 2 * 1024 * 1024;
+const MAX_APPROVAL_SNAPSHOT_BYTES: usize = 8 * 1024 * 1024;
+const MAX_APPROVAL_RESULT_BYTES: usize = 8 * 1024 * 1024;
+const MAX_APPROVAL_PAGE_LIMIT: u32 = 100;
+const MAX_ACTIVE_APPROVALS: i64 = 1_024;
+const MAX_ACTIVE_APPROVALS_PER_OWNER: i64 = 128;
+const MAX_ACTIVE_APPROVAL_CIPHERTEXT_BYTES: i64 = 64 * 1024 * 1024;
+const MAX_TERMINAL_APPROVAL_CIPHERTEXT_BYTES: i64 = 64 * 1024 * 1024;
+const MAX_APPROVAL_DELIVERY_PINS: i64 = 128;
+const MAX_APPROVAL_DELIVERY_PIN_REFS: i64 = 128;
+const MAX_PINNED_SNAPSHOT_CIPHERTEXT_BYTES: i64 = 64 * 1024 * 1024;
+const MAX_APPROVAL_CORRELATIONS: i64 = 100_000;
+
+const TERMINAL_RETENTION: i64 = 10_000;
+
+trait Clock: Send + Sync + 'static {
+    fn now(&self) -> i64;
+}
+
+#[derive(Clone, Copy, Debug, Default)]
+struct SystemClock;
+
+impl Clock for SystemClock {
+    fn now(&self) -> i64 {
+        SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .expect("system time must be after the Unix epoch")
+            .as_secs() as i64
+    }
+}
+
+#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum ApprovalStatus {
+    Pending,
+    Approved,
+    Denied,
+    Expired,
+    Canceled,
+    Executing,
+    Succeeded,
+    Failed,
+    Stale,
+    Interrupted,
+}
+
+impl ApprovalStatus {
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::Pending => "pending",
+            Self::Approved => "approved",
+            Self::Denied => "denied",
+            Self::Expired => "expired",
+            Self::Canceled => "canceled",
+            Self::Executing => "executing",
+            Self::Succeeded => "succeeded",
+            Self::Failed => "failed",
+            Self::Stale => "stale",
+            Self::Interrupted => "interrupted",
+        }
+    }
+
+    pub const fn is_terminal(self) -> bool {
+        matches!(
+            self,
+            Self::Denied
+                | Self::Expired
+                | Self::Canceled
+                | Self::Succeeded
+                | Self::Failed
+                | Self::Stale
+                | Self::Interrupted
+        )
+    }
+}
+
+impl fmt::Display for ApprovalStatus {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(self.as_str())
+    }
+}
+
+impl FromStr for ApprovalStatus {
+    type Err = ApprovalError;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        match value {
+            "pending" => Ok(Self::Pending),
+            "approved" => Ok(Self::Approved),
+            "denied" => Ok(Self::Denied),
+            "expired" => Ok(Self::Expired),
+            "canceled" => Ok(Self::Canceled),
+            "executing" => Ok(Self::Executing),
+            "succeeded" => Ok(Self::Succeeded),
+            "failed" => Ok(Self::Failed),
+            "stale" => Ok(Self::Stale),
+            "interrupted" => Ok(Self::Interrupted),
+            _ => Err(ApprovalError::CorruptData("unknown approval status")),
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum ApprovalDecision {
+    Approve,
+    Deny,
+}
+
+impl ApprovalDecision {
+    const fn as_str(self) -> &'static str {
+        match self {
+            Self::Approve => "approve",
+            Self::Deny => "deny",
+        }
+    }
+
+    const fn status(self) -> ApprovalStatus {
+        match self {
+            Self::Approve => ApprovalStatus::Approved,
+            Self::Deny => ApprovalStatus::Denied,
+        }
+    }
+}
+
+impl FromStr for ApprovalDecision {
+    type Err = ApprovalError;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        match value {
+            "approve" => Ok(Self::Approve),
+            "deny" => Ok(Self::Deny),
+            _ => Err(ApprovalError::CorruptData("unknown approval decision")),
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+enum ExecutionOutcome {
+    Succeeded,
+    Failed,
+    Interrupted,
+}
+
+impl ExecutionOutcome {
+    const fn status(self) -> ApprovalStatus {
+        match self {
+            Self::Succeeded => ApprovalStatus::Succeeded,
+            Self::Failed => ApprovalStatus::Failed,
+            Self::Interrupted => ApprovalStatus::Interrupted,
+        }
+    }
+}
+
+#[derive(Clone, Debug)]
+struct NewApproval {
+    pub execution_id: String,
+    pub call_id: String,
+    pub worker_generation: u64,
+    pub actor: ToolActor,
+    pub surface: RequestSurface,
+    pub callable_path_snapshot: String,
+    pub source_display_name_snapshot: Option<String>,
+    pub tool_display_name_snapshot: Option<String>,
+    pub mode_provenance: ModeProvenance,
+    pub revisions: InvocationRevisionToken,
+    pub arguments: Value,
+    pub input_schema: Value,
+    pub output_schema: Option<Value>,
+    pub invocation_snapshot: Value,
+}
+
+#[derive(Clone, Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ApprovalRecord {
+    pub sequence: i64,
+    pub id: String,
+    pub execution_id: String,
+    pub call_id: String,
+    pub worker_generation: u64,
+    pub actor_kind: ActorKind,
+    pub actor_id: String,
+    pub actor_api_token_id: Option<String>,
+    pub actor_name_snapshot: Option<String>,
+    pub surface: RequestSurface,
+    pub callable_path_snapshot: String,
+    pub source_display_name: Option<String>,
+    pub tool_display_name: Option<String>,
+    pub mode_provenance: ModeProvenance,
+    pub revisions: InvocationRevisionTokenSnapshot,
+    pub status: ApprovalStatus,
+    pub revision: i64,
+    pub decision_id: Option<String>,
+    pub decision: Option<ApprovalDecision>,
+    pub decided_by_admin_id: Option<i64>,
+    pub failure_code: Option<String>,
+    pub created_at: i64,
+    pub updated_at: i64,
+    pub expires_at: i64,
+    pub decided_at: Option<i64>,
+    pub execution_started_at: Option<i64>,
+    pub completed_at: Option<i64>,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct InvocationRevisionTokenSnapshot {
+    pub source_id: String,
+    pub tool_id: String,
+    pub source_revision: i64,
+    pub catalog_revision: i64,
+    pub tool_revision: i64,
+    pub binding_revision: i64,
+    pub credential_revision: Option<i64>,
+}
+
+impl From<&InvocationRevisionToken> for InvocationRevisionTokenSnapshot {
+    fn from(value: &InvocationRevisionToken) -> Self {
+        Self {
+            source_id: value.source_id.clone(),
+            tool_id: value.tool_id.clone(),
+            source_revision: value.source_revision,
+            catalog_revision: value.catalog_revision,
+            tool_revision: value.tool_revision,
+            binding_revision: value.binding_revision,
+            credential_revision: value.credential_revision,
+        }
+    }
+}
+
+impl From<InvocationRevisionTokenSnapshot> for InvocationRevisionToken {
+    fn from(value: InvocationRevisionTokenSnapshot) -> Self {
+        Self {
+            source_id: value.source_id,
+            tool_id: value.tool_id,
+            source_revision: value.source_revision,
+            catalog_revision: value.catalog_revision,
+            tool_revision: value.tool_revision,
+            binding_revision: value.binding_revision,
+            credential_revision: value.credential_revision,
+        }
+    }
+}
+
+#[derive(Clone, Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ApprovalAdminDetail {
+    #[serde(flatten)]
+    pub record: ApprovalRecord,
+    pub redacted_arguments: Value,
+    pub input_schema: Value,
+}
+
+#[derive(Clone, Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ApprovalOwnerDetail {
+    #[serde(flatten)]
+    pub record: ApprovalRecord,
+    pub result: Option<Value>,
+}
+
+#[derive(Clone, Debug)]
+#[allow(dead_code)]
+struct ApprovalExecutionSnapshot {
+    pub record: ApprovalRecord,
+    pub arguments: Value,
+    pub input_schema: Value,
+    pub output_schema: Option<Value>,
+    pub invocation_snapshot: Value,
+    pub result: Option<Value>,
+}
+
+#[derive(Clone, Debug, Default)]
+pub struct ApprovalListQuery {
+    pub before_sequence: Option<i64>,
+    pub limit: u32,
+    pub status: Option<ApprovalStatus>,
+}
+
+#[derive(Clone, Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ApprovalPage {
+    pub items: Vec<ApprovalRecord>,
+    pub next_cursor: Option<i64>,
+}
+
+#[derive(Clone, Debug)]
+struct DecisionResult {
+    pub record: ApprovalRecord,
+    pub idempotent: bool,
+}
+
+#[derive(Clone, Debug)]
+struct ApprovalCreateResult {
+    pub record: ApprovalRecord,
+    pub delivery_pin: bool,
+    #[cfg(test)]
+    pub redacted_arguments: Value,
+    #[cfg(test)]
+    pub input_schema: Value,
+    #[cfg(test)]
+    pub reused: bool,
+}
+
+#[derive(Clone, Debug)]
+pub(crate) struct ApprovalDeliveryIdentity {
+    pub approval_id: String,
+    pub actor: ToolActor,
+    pub execution_id: String,
+    pub call_id: String,
+}
+
+impl ApprovalCreateResult {
+    fn from_detail(detail: ApprovalAdminDetail, reused: bool, delivery_pin: bool) -> Self {
+        #[cfg(not(test))]
+        let _ = reused;
+        Self {
+            record: detail.record,
+            delivery_pin,
+            #[cfg(test)]
+            redacted_arguments: detail.redacted_arguments,
+            #[cfg(test)]
+            input_schema: detail.input_schema,
+            #[cfg(test)]
+            reused,
+        }
+    }
+}
+
+#[derive(Clone, Debug, Default)]
+struct StartupRecovery {
+    #[cfg(test)]
+    pub interrupted_count: u64,
+    pub approved_ids: Vec<String>,
+}
+
+#[derive(Clone)]
+struct ApprovalStore {
+    pool: SqlitePool,
+    keyring: Keyring,
+    clock: Arc<dyn Clock>,
+    transition_slot: Arc<tokio::sync::Semaphore>,
+}
+
+struct Transition<'a> {
+    from: ApprovalStatus,
+    to: ApprovalStatus,
+    failure_code: Option<&'a str>,
+    result_ciphertext: Option<Vec<u8>>,
+}
+
+impl ApprovalStore {
+    #[cfg(test)]
+    fn new(pool: SqlitePool, keyring: Keyring, clock: Arc<dyn Clock>) -> Self {
+        Self {
+            pool,
+            keyring,
+            clock,
+            transition_slot: Arc::new(tokio::sync::Semaphore::new(1)),
+        }
+    }
+
+    fn system(pool: SqlitePool, keyring: Keyring) -> Self {
+        Self {
+            pool,
+            keyring,
+            clock: Arc::new(SystemClock),
+            transition_slot: Arc::new(tokio::sync::Semaphore::new(1)),
+        }
+    }
+
+    async fn invocation_snapshot(&self, approval_id: &str) -> Result<Option<Value>, ApprovalError> {
+        let ciphertext = sqlx::query_scalar::<_, Vec<u8>>(
+            "SELECT invocation_snapshot_ciphertext FROM approvals WHERE id = ?",
+        )
+        .bind(approval_id)
+        .fetch_optional(&self.pool)
+        .await?;
+        ciphertext
+            .map(|ciphertext| {
+                decrypt_json(
+                    &self.keyring,
+                    "approval-invocation-snapshot",
+                    approval_id,
+                    &ciphertext,
+                )
+            })
+            .transpose()
+    }
+
+    async fn create(&self, new: NewApproval) -> Result<ApprovalCreateResult, ApprovalError> {
+        validate_new(&new)?;
+        let observed_now = self.advance_clock().await?;
+        let id = Uuid::new_v4().to_string();
+        let arguments = encode_json("arguments", &new.arguments, MAX_APPROVAL_ARGUMENT_BYTES)?;
+        let redacted_arguments = encode_json(
+            "redacted arguments",
+            &redact_arguments(&new.arguments, &new.input_schema),
+            MAX_APPROVAL_ARGUMENT_BYTES,
+        )?;
+        let input_schema =
+            encode_json("input schema", &new.input_schema, MAX_APPROVAL_SCHEMA_BYTES)?;
+        let output_schema = new
+            .output_schema
+            .as_ref()
+            .map(|value| encode_json("output schema", value, MAX_APPROVAL_SCHEMA_BYTES))
+            .transpose()?;
+        let invocation_snapshot = encode_json(
+            "invocation snapshot",
+            &new.invocation_snapshot,
+            MAX_APPROVAL_SNAPSHOT_BYTES,
+        )?;
+        let canonical_arguments = canonical_json_bytes(&new.arguments)?;
+        let arguments_digest = self
+            .keyring
+            .digest("approval-arguments", &canonical_arguments)
+            .to_vec();
+        let arguments_ciphertext = self
+            .keyring
+            .encrypt("approval-arguments", &id, &arguments)?;
+        let redacted_arguments_ciphertext =
+            self.keyring
+                .encrypt("approval-redacted-arguments", &id, &redacted_arguments)?;
+        let input_schema_ciphertext =
+            self.keyring
+                .encrypt("approval-input-schema", &id, &input_schema)?;
+        let output_schema_ciphertext = output_schema
+            .as_deref()
+            .map(|value| self.keyring.encrypt("approval-output-schema", &id, value))
+            .transpose()?;
+        let invocation_snapshot_ciphertext =
+            self.keyring
+                .encrypt("approval-invocation-snapshot", &id, &invocation_snapshot)?;
+        let worker_generation =
+            i64::try_from(new.worker_generation).map_err(|_| ApprovalError::Validation {
+                code: "invalid_worker_generation",
+                message: "worker generation exceeds the supported range".to_owned(),
+            })?;
+        let actor_kind = new.actor.kind().as_str();
+        let actor_id = new.actor.id();
+        let actor_api_token_id = new.actor.api_token_id();
+        let actor_name_snapshot = new.actor.name_snapshot();
+        let new_ciphertext_bytes = [
+            arguments_ciphertext.len(),
+            redacted_arguments_ciphertext.len(),
+            input_schema_ciphertext.len(),
+            output_schema_ciphertext.as_ref().map_or(0, Vec::len),
+            invocation_snapshot_ciphertext.len(),
+        ]
+        .into_iter()
+        .try_fold(0_i64, |total, length| {
+            i64::try_from(length)
+                .ok()
+                .and_then(|length| total.checked_add(length))
+        })
+        .ok_or(ApprovalError::Capacity {
+            scope: "active_bytes",
+        })?;
+
+        let mut transaction = self.pool.begin().await?;
+        let now = effective_now_in(&mut transaction, observed_now).await?;
+        let expires_at =
+            now.checked_add(APPROVAL_TTL_SECONDS)
+                .ok_or(ApprovalError::Validation {
+                    code: "invalid_approval_ttl",
+                    message: "approval expiry exceeds the supported timestamp range".to_owned(),
+                })?;
+        expire_pending_in(&mut transaction, now).await?;
+        enforce_retention(&mut transaction).await?;
+        reclaim_expired_correlations_in(&mut transaction, now).await?;
+        if let Some(correlation) = fetch_correlation_in(
+            &mut transaction,
+            actor_kind,
+            &actor_id,
+            &new.execution_id,
+            &new.call_id,
+        )
+        .await?
+        {
+            ensure_same_correlation(
+                &correlation,
+                actor_kind,
+                &actor_id,
+                new.surface,
+                worker_generation,
+                &new.callable_path_snapshot,
+                &arguments_digest,
+            )?;
+            let existing = fetch_row_in(&mut transaction, &correlation.approval_id)
+                .await?
+                .ok_or(ApprovalError::CorrelationRetired)?;
+            let delivery_pin = if new.worker_generation > 0 {
+                add_delivery_pin_in(
+                    &mut transaction,
+                    &correlation.approval_id,
+                    existing_ciphertext_bytes(&existing)?,
+                    now,
+                )
+                .await?;
+                true
+            } else {
+                false
+            };
+            let detail = self.decode_admin_detail(existing)?;
+            transaction.commit().await?;
+            return Ok(ApprovalCreateResult::from_detail(
+                detail,
+                true,
+                delivery_pin,
+            ));
+        }
+        let correlation_count = sqlx::query_scalar::<_, i64>(
+            "SELECT correlation_count FROM approval_correlation_state WHERE id = 1",
+        )
+        .fetch_one(&mut *transaction)
+        .await?;
+        if correlation_count >= MAX_APPROVAL_CORRELATIONS {
+            return Err(ApprovalError::Capacity {
+                scope: "correlations",
+            });
+        }
+        let global_active = active_count_in(&mut transaction, None).await?;
+        if global_active >= MAX_ACTIVE_APPROVALS {
+            return Err(ApprovalError::Capacity { scope: "global" });
+        }
+        let owner_active = active_count_in(&mut transaction, Some((actor_kind, &actor_id))).await?;
+        if owner_active >= MAX_ACTIVE_APPROVALS_PER_OWNER {
+            return Err(ApprovalError::Capacity { scope: "owner" });
+        }
+        let active_ciphertext_bytes = active_ciphertext_bytes_in(&mut transaction).await?;
+        if active_ciphertext_bytes
+            .checked_add(new_ciphertext_bytes)
+            .is_none_or(|total| total > MAX_ACTIVE_APPROVAL_CIPHERTEXT_BYTES)
+        {
+            return Err(ApprovalError::Capacity {
+                scope: "active_bytes",
+            });
+        }
+
+        let inserted = sqlx::query(
+            "INSERT INTO approvals (id, execution_id, call_id, worker_generation, \
+             actor_kind, actor_id, actor_api_token_id, actor_name_snapshot, surface, source_id, tool_id, \
+             callable_path_snapshot, source_display_name_snapshot, tool_display_name_snapshot, \
+             mode_provenance, \
+             source_revision, catalog_revision, tool_revision, binding_revision, credential_revision, \
+             arguments_digest, arguments_ciphertext, redacted_arguments_ciphertext, input_schema_ciphertext, \
+             output_schema_ciphertext, invocation_snapshot_ciphertext, status, revision, \
+             created_at, updated_at, expires_at) \
+             SELECT ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, \
+             'pending', 0, ?, ?, ? WHERE (? <> 'api_token' OR EXISTS (SELECT 1 FROM api_tokens \
+             WHERE id = ? AND revoked_at IS NULL)) \
+             AND NOT EXISTS (SELECT 1 FROM approval_correlations \
+             WHERE actor_kind = ? AND actor_id = ? AND execution_id = ? AND call_id = ?) \
+             ON CONFLICT(actor_kind, actor_id, execution_id, call_id) DO NOTHING",
+        )
+        .bind(&id)
+        .bind(&new.execution_id)
+        .bind(&new.call_id)
+        .bind(worker_generation)
+        .bind(actor_kind)
+        .bind(&actor_id)
+        .bind(actor_api_token_id)
+        .bind(actor_name_snapshot)
+        .bind(new.surface.as_str())
+        .bind(&new.revisions.source_id)
+        .bind(&new.revisions.tool_id)
+        .bind(&new.callable_path_snapshot)
+        .bind(new.source_display_name_snapshot)
+        .bind(new.tool_display_name_snapshot)
+        .bind(mode_provenance_str(new.mode_provenance))
+        .bind(new.revisions.source_revision)
+        .bind(new.revisions.catalog_revision)
+        .bind(new.revisions.tool_revision)
+        .bind(new.revisions.binding_revision)
+        .bind(new.revisions.credential_revision)
+        .bind(&arguments_digest)
+        .bind(arguments_ciphertext)
+        .bind(redacted_arguments_ciphertext)
+        .bind(input_schema_ciphertext)
+        .bind(output_schema_ciphertext)
+        .bind(invocation_snapshot_ciphertext)
+        .bind(now)
+        .bind(now)
+        .bind(expires_at)
+        .bind(actor_kind)
+        .bind(actor_api_token_id)
+        .bind(actor_kind)
+        .bind(&actor_id)
+        .bind(&new.execution_id)
+        .bind(&new.call_id)
+        .execute(&mut *transaction)
+        .await?;
+        if inserted.rows_affected() != 1 {
+            if let Some(correlation) = fetch_correlation_in(
+                &mut transaction,
+                actor_kind,
+                &actor_id,
+                &new.execution_id,
+                &new.call_id,
+            )
+            .await?
+            {
+                ensure_same_correlation(
+                    &correlation,
+                    actor_kind,
+                    &actor_id,
+                    new.surface,
+                    worker_generation,
+                    &new.callable_path_snapshot,
+                    &arguments_digest,
+                )?;
+                let existing = fetch_row_in(&mut transaction, &correlation.approval_id)
+                    .await?
+                    .ok_or(ApprovalError::CorrelationRetired)?;
+                let delivery_pin = if new.worker_generation > 0 {
+                    add_delivery_pin_in(
+                        &mut transaction,
+                        &correlation.approval_id,
+                        existing_ciphertext_bytes(&existing)?,
+                        now,
+                    )
+                    .await?;
+                    true
+                } else {
+                    false
+                };
+                let detail = self.decode_admin_detail(existing)?;
+                transaction.commit().await?;
+                return Ok(ApprovalCreateResult::from_detail(
+                    detail,
+                    true,
+                    delivery_pin,
+                ));
+            }
+            return Err(ApprovalError::OwnerTokenInactive);
+        }
+        let row = fetch_row_in(&mut transaction, &id)
+            .await?
+            .ok_or(ApprovalError::NotFound)?;
+        let delivery_pin = if new.worker_generation > 0 {
+            add_delivery_pin_in(&mut transaction, &id, new_ciphertext_bytes, now).await?;
+            true
+        } else {
+            false
+        };
+        let detail = self.decode_admin_detail(row)?;
+        transaction.commit().await?;
+        Ok(ApprovalCreateResult::from_detail(
+            detail,
+            false,
+            delivery_pin,
+        ))
+    }
+
+    async fn get_admin(&self, id: &str) -> Result<Option<ApprovalAdminDetail>, ApprovalError> {
+        let row = fetch_row(&self.pool, id).await?;
+        row.map(|row| self.decode_admin_detail(row)).transpose()
+    }
+
+    async fn release_delivery_pin(
+        &self,
+        identity: &ApprovalDeliveryIdentity,
+    ) -> Result<bool, ApprovalError> {
+        let mut transaction = self.pool.begin_with("BEGIN IMMEDIATE").await?;
+        let pin = sqlx::query_scalar::<_, i64>(
+            "SELECT pins.ref_count FROM approval_delivery_pins AS pins \
+             JOIN approvals ON approvals.id = pins.approval_id \
+             WHERE pins.approval_id = ? AND approvals.actor_kind = ? \
+             AND approvals.actor_id = ? AND approvals.execution_id = ? AND approvals.call_id = ?",
+        )
+        .bind(&identity.approval_id)
+        .bind(identity.actor.kind().as_str())
+        .bind(identity.actor.id())
+        .bind(&identity.execution_id)
+        .bind(&identity.call_id)
+        .fetch_optional(&mut *transaction)
+        .await?;
+        let released = match pin {
+            Some(1) => {
+                sqlx::query("DELETE FROM approval_delivery_pins WHERE approval_id = ?")
+                    .bind(&identity.approval_id)
+                    .execute(&mut *transaction)
+                    .await?;
+                true
+            }
+            Some(_) => {
+                sqlx::query(
+                    "UPDATE approval_delivery_pins SET ref_count = ref_count - 1 \
+                     WHERE approval_id = ?",
+                )
+                .bind(&identity.approval_id)
+                .execute(&mut *transaction)
+                .await?;
+                true
+            }
+            None => false,
+        };
+        enforce_retention(&mut transaction).await?;
+        transaction.commit().await?;
+        Ok(released)
+    }
+
+    async fn delivery_pin_exists(&self, id: &str) -> Result<bool, ApprovalError> {
+        Ok(sqlx::query_scalar::<_, i64>(
+            "SELECT EXISTS(SELECT 1 FROM approval_delivery_pins WHERE approval_id = ?)",
+        )
+        .bind(id)
+        .fetch_one(&self.pool)
+        .await?
+            != 0)
+    }
+
+    async fn clear_delivery_pins(&self) -> Result<u64, ApprovalError> {
+        let mut transaction = self.pool.begin_with("BEGIN IMMEDIATE").await?;
+        let affected = sqlx::query("DELETE FROM approval_delivery_pins")
+            .execute(&mut *transaction)
+            .await?
+            .rows_affected();
+        enforce_retention(&mut transaction).await?;
+        transaction.commit().await?;
+        Ok(affected)
+    }
+
+    async fn get_for_token(
+        &self,
+        id: &str,
+        actor_api_token_id: &str,
+    ) -> Result<Option<ApprovalOwnerDetail>, ApprovalError> {
+        let row = sqlx::query_as::<_, ApprovalRow>(&format!(
+            "{} WHERE id = ? AND actor_kind = 'api_token' AND actor_api_token_id = ?",
+            APPROVAL_SELECT
+        ))
+        .bind(id)
+        .bind(actor_api_token_id)
+        .fetch_optional(&self.pool)
+        .await?;
+        row.map(|row| self.decode_owner_detail(row)).transpose()
+    }
+
+    async fn get_for_actor(
+        &self,
+        id: &str,
+        actor: &ToolActor,
+    ) -> Result<Option<ApprovalOwnerDetail>, ApprovalError> {
+        let row = sqlx::query_as::<_, ApprovalRow>(&format!(
+            "{} WHERE id = ? AND actor_kind = ? AND actor_id = ?",
+            APPROVAL_SELECT
+        ))
+        .bind(id)
+        .bind(actor.kind().as_str())
+        .bind(actor.id())
+        .fetch_optional(&self.pool)
+        .await?;
+        row.map(|row| self.decode_owner_detail(row)).transpose()
+    }
+
+    async fn list_admin(&self, query: ApprovalListQuery) -> Result<ApprovalPage, ApprovalError> {
+        let limit = if query.limit == 0 {
+            50
+        } else {
+            query.limit.min(MAX_APPROVAL_PAGE_LIMIT)
+        };
+        let before = query.before_sequence.unwrap_or(i64::MAX);
+        if before <= 0 {
+            return Err(ApprovalError::Validation {
+                code: "invalid_approval_cursor",
+                message: "approval cursor must be a positive integer".to_owned(),
+            });
+        }
+        let fetch_limit = i64::from(limit) + 1;
+        let rows = if let Some(status) = query.status {
+            sqlx::query_as::<_, ApprovalRow>(&format!(
+                "{} WHERE sequence < ? AND status = ? ORDER BY sequence DESC LIMIT ?",
+                APPROVAL_SELECT
+            ))
+            .bind(before)
+            .bind(status.as_str())
+            .bind(fetch_limit)
+            .fetch_all(&self.pool)
+            .await?
+        } else {
+            sqlx::query_as::<_, ApprovalRow>(&format!(
+                "{} WHERE sequence < ? ORDER BY sequence DESC LIMIT ?",
+                APPROVAL_SELECT
+            ))
+            .bind(before)
+            .bind(fetch_limit)
+            .fetch_all(&self.pool)
+            .await?
+        };
+        let has_more = rows.len() > limit as usize;
+        let mut items = rows
+            .into_iter()
+            .take(limit as usize)
+            .map(|row| row.record())
+            .collect::<Result<Vec<_>, _>>()?;
+        let next_cursor = has_more
+            .then(|| items.last().map(|item| item.sequence))
+            .flatten();
+        items.shrink_to_fit();
+        Ok(ApprovalPage { items, next_cursor })
+    }
+
+    async fn log_outbox(&self, limit: u32) -> Result<Vec<NewRequestLog>, ApprovalError> {
+        let limit = i64::from(limit.clamp(1, 256));
+        let rows = sqlx::query_as::<_, ApprovalLogOutboxRow>(
+            "SELECT outbox.request_id, outbox.approval_id, outbox.actor_api_token_id, \
+             outbox.surface, \
+             CASE WHEN EXISTS(SELECT 1 FROM sources WHERE id = outbox.source_id) \
+                  THEN outbox.source_id ELSE NULL END AS source_id, \
+             CASE WHEN EXISTS(SELECT 1 FROM tools WHERE id = outbox.tool_id) \
+                  THEN outbox.tool_id ELSE NULL END AS tool_id, \
+             outbox.path_snapshot, outbox.outcome, outbox.error_code, outbox.created_at \
+             FROM approval_log_outbox AS outbox ORDER BY rowid LIMIT ?",
+        )
+        .bind(limit)
+        .fetch_all(&self.pool)
+        .await?;
+        rows.into_iter()
+            .map(|row| {
+                Ok(NewRequestLog {
+                    request_id: row.request_id,
+                    actor_api_token_id: row.actor_api_token_id,
+                    surface: row
+                        .surface
+                        .parse()
+                        .map_err(|_| ApprovalError::CorruptData("approval log surface"))?,
+                    source_id: row.source_id,
+                    tool_id: row.tool_id,
+                    path_snapshot: Some(row.path_snapshot),
+                    outcome: row
+                        .outcome
+                        .parse()
+                        .map_err(|_| ApprovalError::CorruptData("approval log outcome"))?,
+                    error_code: row.error_code,
+                    duration_ms: 0,
+                    approval_id: Some(row.approval_id),
+                    created_at: row.created_at,
+                })
+            })
+            .collect()
+    }
+
+    async fn acknowledge_log_outbox(&self, request_id: &str) -> Result<(), ApprovalError> {
+        validate_identifier("request ID", request_id, 128)?;
+        sqlx::query("DELETE FROM approval_log_outbox WHERE request_id = ?")
+            .bind(request_id)
+            .execute(&self.pool)
+            .await?;
+        Ok(())
+    }
+
+    async fn decide(
+        &self,
+        id: &str,
+        decision_id: &str,
+        expected_revision: i64,
+        decision: ApprovalDecision,
+        admin_id: i64,
+    ) -> Result<DecisionResult, ApprovalError> {
+        validate_identifier("decision ID", decision_id, 128)?;
+        if expected_revision < 0 || admin_id <= 0 {
+            return Err(ApprovalError::Validation {
+                code: "invalid_approval_decision",
+                message: "approval decision metadata is invalid".to_owned(),
+            });
+        }
+        self.expire_pending().await?;
+        let observed_now = self.advance_clock().await?;
+        let mut transaction = self.pool.begin().await?;
+        let now = effective_now_in(&mut transaction, observed_now).await?;
+
+        let current = fetch_row_in(&mut transaction, id)
+            .await?
+            .ok_or(ApprovalError::NotFound)?;
+        if let Some(existing) = current.decision.as_deref() {
+            let existing: ApprovalDecision = existing.parse()?;
+            if existing == decision {
+                enforce_retention(&mut transaction).await?;
+                transaction.commit().await?;
+                return Ok(DecisionResult {
+                    record: current.record()?,
+                    idempotent: true,
+                });
+            }
+            return Err(ApprovalError::DecisionConflict);
+        }
+        let current_status: ApprovalStatus = current.status.parse()?;
+        if current_status == ApprovalStatus::Expired {
+            return Err(ApprovalError::Expired);
+        }
+        if current_status != ApprovalStatus::Pending {
+            return Err(ApprovalError::DecisionConflict);
+        }
+        if current.revision != expected_revision {
+            return Err(ApprovalError::RevisionConflict {
+                expected: expected_revision,
+                actual: current.revision,
+            });
+        }
+        let completed_at = (decision == ApprovalDecision::Deny).then_some(now);
+        let updated = sqlx::query(
+            "UPDATE approvals SET status = ?, revision = revision + 1, decision_id = ?, \
+             decision = ?, decided_by_admin_id = ?, decided_at = ?, updated_at = ?, completed_at = ? \
+             WHERE id = ? AND status = 'pending' AND revision = ? AND expires_at > ?",
+        )
+        .bind(decision.status().as_str())
+        .bind(decision_id)
+        .bind(decision.as_str())
+        .bind(admin_id)
+        .bind(now)
+        .bind(now)
+        .bind(completed_at)
+        .bind(id)
+        .bind(expected_revision)
+        .bind(now)
+        .execute(&mut *transaction)
+        .await?;
+        if updated.rows_affected() != 1 {
+            if fetch_row_in(&mut transaction, id)
+                .await?
+                .is_some_and(|row| row.status == "pending" && row.expires_at <= now)
+            {
+                expire_pending_in(&mut transaction, now).await?;
+                enforce_retention(&mut transaction).await?;
+                transaction.commit().await?;
+                return Err(ApprovalError::Expired);
+            }
+            return Err(classify_cas_failure(&mut transaction, id, expected_revision).await?);
+        }
+        let audit_id = Uuid::new_v4().to_string();
+        let audit_metadata = serde_json::to_string(&serde_json::json!({
+            "approvalId": id,
+            "from": ApprovalStatus::Pending.as_str(),
+            "to": decision.status().as_str(),
+            "revision": expected_revision + 1,
+        }))?;
+        sqlx::query(
+            "INSERT INTO audit_events (id, request_id, actor_admin_id, action, source_id, tool_id, \
+             target_path_snapshot, metadata_json, created_at) SELECT ?, ?, ?, ?, \
+             CASE WHEN EXISTS (SELECT 1 FROM sources WHERE id = ?) THEN ? ELSE NULL END, \
+             CASE WHEN EXISTS (SELECT 1 FROM tools WHERE id = ?) THEN ? ELSE NULL END, \
+             callable_path_snapshot, ?, ? FROM approvals WHERE id = ?",
+        )
+        .bind(audit_id)
+        .bind(decision_id)
+        .bind(admin_id)
+        .bind(match decision {
+            ApprovalDecision::Approve => "approval.approve",
+            ApprovalDecision::Deny => "approval.deny",
+        })
+        .bind(&current.source_id)
+        .bind(&current.source_id)
+        .bind(&current.tool_id)
+        .bind(&current.tool_id)
+        .bind(audit_metadata)
+        .bind(now)
+        .bind(id)
+        .execute(&mut *transaction)
+        .await?;
+        enforce_audit_retention(&mut transaction).await?;
+        let record = fetch_row_in(&mut transaction, id)
+            .await?
+            .ok_or(ApprovalError::NotFound)?
+            .record()?;
+        enforce_retention(&mut transaction).await?;
+        transaction.commit().await?;
+        Ok(DecisionResult {
+            record,
+            idempotent: false,
+        })
+    }
+
+    async fn claim_execution(
+        &self,
+        id: &str,
+        worker_generation: u64,
+        expected_revision: i64,
+    ) -> Result<ApprovalExecutionSnapshot, ApprovalError> {
+        let worker_generation =
+            i64::try_from(worker_generation).map_err(|_| ApprovalError::Validation {
+                code: "invalid_worker_generation",
+                message: "worker generation exceeds the supported range".to_owned(),
+            })?;
+        self.expire_pending().await?;
+        let observed_now = self.advance_clock().await?;
+        let mut transaction = self.pool.begin().await?;
+        let now = effective_now_in(&mut transaction, observed_now).await?;
+        let updated = sqlx::query(
+            "UPDATE approvals SET status = 'executing', revision = revision + 1, \
+             updated_at = ?, execution_started_at = ? WHERE id = ? \
+             AND worker_generation = ? AND status = 'approved' AND revision = ? \
+             AND (actor_kind <> 'api_token' OR EXISTS ( \
+                 SELECT 1 FROM api_tokens WHERE api_tokens.id = approvals.actor_api_token_id \
+                 AND api_tokens.revoked_at IS NULL))",
+        )
+        .bind(now)
+        .bind(now)
+        .bind(id)
+        .bind(worker_generation)
+        .bind(expected_revision)
+        .execute(&mut *transaction)
+        .await?;
+        if updated.rows_affected() != 1 {
+            let row = fetch_row_in(&mut transaction, id)
+                .await?
+                .ok_or(ApprovalError::NotFound)?;
+            if row.worker_generation != worker_generation {
+                return Err(ApprovalError::WorkerGenerationConflict);
+            }
+            if row.revision == expected_revision
+                && row.status == ApprovalStatus::Approved.as_str()
+                && row.actor_kind == ActorKind::ApiToken.as_str()
+                && !token_active_in(
+                    &mut transaction,
+                    row.actor_api_token_id
+                        .as_deref()
+                        .ok_or(ApprovalError::CorruptData("missing actor token ID"))?,
+                )
+                .await?
+            {
+                return Err(ApprovalError::OwnerTokenInactive);
+            }
+            return Err(classify_row_cas_failure(&row, expected_revision));
+        }
+        let row = fetch_row_in(&mut transaction, id)
+            .await?
+            .ok_or(ApprovalError::NotFound)?;
+        let snapshot = self.decode_execution_snapshot(row)?;
+        transaction.commit().await?;
+        Ok(snapshot)
+    }
+
+    async fn mark_stale(
+        &self,
+        id: &str,
+        expected_revision: i64,
+        failure_code: &str,
+    ) -> Result<ApprovalRecord, ApprovalError> {
+        validate_failure_code(failure_code)?;
+        self.transition(
+            id,
+            expected_revision,
+            Transition {
+                from: ApprovalStatus::Approved,
+                to: ApprovalStatus::Stale,
+                failure_code: Some(failure_code),
+                result_ciphertext: None,
+            },
+        )
+        .await
+    }
+
+    async fn finish(
+        &self,
+        id: &str,
+        expected_revision: i64,
+        outcome: ExecutionOutcome,
+        result: &Value,
+        failure_code: Option<&str>,
+    ) -> Result<ApprovalRecord, ApprovalError> {
+        let _transition_permit = self
+            .transition_slot
+            .acquire()
+            .await
+            .expect("approval transition semaphore is never closed");
+        if let Some(code) = failure_code {
+            validate_failure_code(code)?;
+        }
+        if outcome == ExecutionOutcome::Succeeded && failure_code.is_some() {
+            return Err(ApprovalError::Validation {
+                code: "invalid_approval_result",
+                message: "a successful approval execution cannot have a failure code".to_owned(),
+            });
+        }
+        let encoded = encode_json("result", result, MAX_APPROVAL_RESULT_BYTES)?;
+        let ciphertext = self.keyring.encrypt("approval-result", id, &encoded)?;
+        self.transition_inner(
+            id,
+            expected_revision,
+            Transition {
+                from: ApprovalStatus::Executing,
+                to: outcome.status(),
+                failure_code,
+                result_ciphertext: Some(ciphertext),
+            },
+        )
+        .await
+    }
+
+    async fn expire_pending(&self) -> Result<u64, ApprovalError> {
+        let observed_now = self.advance_clock().await?;
+        let mut transaction = self.pool.begin().await?;
+        let now = effective_now_in(&mut transaction, observed_now).await?;
+        let affected = expire_pending_in(&mut transaction, now).await?;
+        enforce_retention(&mut transaction).await?;
+        transaction.commit().await?;
+        Ok(affected)
+    }
+
+    async fn cancel_token_owner(
+        &self,
+        id: &str,
+        actor_api_token_id: &str,
+        expected_revision: i64,
+    ) -> Result<ApprovalRecord, ApprovalError> {
+        self.expire_pending().await?;
+        let observed_now = self.advance_clock().await?;
+        let mut transaction = self.pool.begin().await?;
+        let now = effective_now_in(&mut transaction, observed_now).await?;
+        let updated = sqlx::query(
+            "UPDATE approvals SET status = 'canceled', revision = revision + 1, \
+             updated_at = ?, completed_at = ? \
+             WHERE id = ? AND actor_kind = 'api_token' AND actor_api_token_id = ? AND revision = ? \
+             AND status IN ('pending', 'approved')",
+        )
+        .bind(now)
+        .bind(now)
+        .bind(id)
+        .bind(actor_api_token_id)
+        .bind(expected_revision)
+        .execute(&mut *transaction)
+        .await?;
+        if updated.rows_affected() != 1 {
+            let row = fetch_row_in(&mut transaction, id)
+                .await?
+                .ok_or(ApprovalError::NotFound)?;
+            if row.actor_kind != ActorKind::ApiToken.as_str()
+                || row.actor_api_token_id.as_deref() != Some(actor_api_token_id)
+            {
+                return Err(ApprovalError::NotFound);
+            }
+            if row.status == ApprovalStatus::Canceled.as_str() {
+                let record = row.record()?;
+                transaction.commit().await?;
+                return Ok(record);
+            }
+            return Err(classify_row_cas_failure(&row, expected_revision));
+        }
+        let record = fetch_row_in(&mut transaction, id)
+            .await?
+            .ok_or(ApprovalError::NotFound)?
+            .record()?;
+        enforce_retention(&mut transaction).await?;
+        transaction.commit().await?;
+        Ok(record)
+    }
+
+    async fn cancel_execution(&self, execution_id: &str) -> Result<u64, ApprovalError> {
+        validate_identifier("execution ID", execution_id, 128)?;
+        self.cancel_where("execution_id", execution_id, true).await
+    }
+
+    #[cfg(test)]
+    async fn cancel_token(&self, actor_api_token_id: &str) -> Result<u64, ApprovalError> {
+        validate_identifier("owner token ID", actor_api_token_id, 128)?;
+        self.cancel_where("actor_api_token_id", actor_api_token_id, false)
+            .await
+    }
+
+    async fn revoke_owner_token(&self, actor_api_token_id: &str) -> Result<bool, ApprovalError> {
+        validate_identifier("owner token ID", actor_api_token_id, 128)?;
+        let mut transaction = self.pool.begin_with("BEGIN IMMEDIATE").await?;
+        let now = effective_now_in(&mut transaction, self.clock.now()).await?;
+        let revoked =
+            sqlx::query("UPDATE api_tokens SET revoked_at = ? WHERE id = ? AND revoked_at IS NULL")
+                .bind(now)
+                .bind(actor_api_token_id)
+                .execute(&mut *transaction)
+                .await?;
+        if revoked.rows_affected() == 0 {
+            transaction.commit().await?;
+            return Ok(false);
+        }
+        sqlx::query(
+            "UPDATE approvals SET status = 'canceled', revision = revision + 1, \
+             updated_at = ?, completed_at = ? WHERE actor_kind = 'api_token' \
+             AND actor_api_token_id = ? \
+             AND status IN ('pending', 'approved')",
+        )
+        .bind(now)
+        .bind(now)
+        .bind(actor_api_token_id)
+        .execute(&mut *transaction)
+        .await?;
+        enforce_retention(&mut transaction).await?;
+        transaction.commit().await?;
+        Ok(true)
+    }
+
+    async fn recover_startup(&self) -> Result<StartupRecovery, ApprovalError> {
+        let observed_now = self.advance_clock().await?;
+        let mut transaction = self.pool.begin().await?;
+        let now = effective_now_in(&mut transaction, observed_now).await?;
+        expire_pending_in(&mut transaction, now).await?;
+        sqlx::query(
+            "UPDATE approvals SET status = 'canceled', revision = revision + 1, \
+             updated_at = ?, completed_at = ? WHERE status IN ('pending', 'approved') \
+             AND actor_kind = 'api_token' \
+             AND EXISTS (SELECT 1 FROM api_tokens WHERE api_tokens.id = approvals.actor_api_token_id \
+                         AND api_tokens.revoked_at IS NOT NULL)",
+        )
+        .bind(now)
+        .bind(now)
+        .execute(&mut *transaction)
+        .await?;
+        let _interrupted_count = sqlx::query(
+            "UPDATE approvals SET status = 'interrupted', revision = revision + 1, \
+             failure_code = 'server_restart', updated_at = ?, completed_at = ? \
+             WHERE status = 'executing'",
+        )
+        .bind(now)
+        .bind(now)
+        .execute(&mut *transaction)
+        .await?
+        .rows_affected();
+        sqlx::query(
+            "UPDATE approvals SET status = 'canceled', revision = revision + 1, \
+             failure_code = 'continuation_lost', updated_at = ?, completed_at = ? \
+             WHERE status = 'pending' AND worker_generation > 0",
+        )
+        .bind(now)
+        .bind(now)
+        .execute(&mut *transaction)
+        .await?;
+        sqlx::query(
+            "UPDATE approvals SET status = 'stale', revision = revision + 1, \
+             failure_code = 'continuation_lost', updated_at = ?, completed_at = ? \
+             WHERE status = 'approved' AND worker_generation > 0",
+        )
+        .bind(now)
+        .bind(now)
+        .execute(&mut *transaction)
+        .await?;
+        let approved_ids = sqlx::query_scalar::<_, String>(
+            "SELECT id FROM approvals WHERE status = 'approved' AND worker_generation = 0 \
+             ORDER BY sequence ASC",
+        )
+        .fetch_all(&mut *transaction)
+        .await?;
+        sqlx::query("DELETE FROM approval_delivery_pins")
+            .execute(&mut *transaction)
+            .await?;
+        enforce_retention(&mut transaction).await?;
+        transaction.commit().await?;
+        Ok(StartupRecovery {
+            #[cfg(test)]
+            interrupted_count: _interrupted_count,
+            approved_ids,
+        })
+    }
+
+    async fn transition(
+        &self,
+        id: &str,
+        expected_revision: i64,
+        transition: Transition<'_>,
+    ) -> Result<ApprovalRecord, ApprovalError> {
+        let _transition_permit = self
+            .transition_slot
+            .acquire()
+            .await
+            .expect("approval transition semaphore is never closed");
+        self.transition_inner(id, expected_revision, transition)
+            .await
+    }
+
+    async fn transition_inner(
+        &self,
+        id: &str,
+        expected_revision: i64,
+        transition: Transition<'_>,
+    ) -> Result<ApprovalRecord, ApprovalError> {
+        if expected_revision < 0 {
+            return Err(ApprovalError::Validation {
+                code: "invalid_approval_revision",
+                message: "approval revision cannot be negative".to_owned(),
+            });
+        }
+        self.expire_pending().await?;
+        let observed_now = self.advance_clock().await?;
+        let mut transaction = self.pool.begin().await?;
+        let now = effective_now_in(&mut transaction, observed_now).await?;
+        let completed_at = transition.to.is_terminal().then_some(now);
+        let updated = sqlx::query(
+            "UPDATE approvals SET status = ?, revision = revision + 1, failure_code = ?, \
+             result_ciphertext = COALESCE(?, result_ciphertext), updated_at = ?, \
+             completed_at = ? WHERE id = ? AND status = ? AND revision = ?",
+        )
+        .bind(transition.to.as_str())
+        .bind(transition.failure_code)
+        .bind(transition.result_ciphertext)
+        .bind(now)
+        .bind(completed_at)
+        .bind(id)
+        .bind(transition.from.as_str())
+        .bind(expected_revision)
+        .execute(&mut *transaction)
+        .await?;
+        if updated.rows_affected() != 1 {
+            return Err(classify_cas_failure(&mut transaction, id, expected_revision).await?);
+        }
+        let record = fetch_row_in(&mut transaction, id)
+            .await?
+            .ok_or(ApprovalError::NotFound)?
+            .record()?;
+        enforce_retention(&mut transaction).await?;
+        transaction.commit().await?;
+        Ok(record)
+    }
+
+    async fn cancel_where(
+        &self,
+        column: &'static str,
+        value: &str,
+        release_delivery_pins: bool,
+    ) -> Result<u64, ApprovalError> {
+        let observed_now = self.advance_clock().await?;
+        let mut transaction = self.pool.begin().await?;
+        let now = effective_now_in(&mut transaction, observed_now).await?;
+        expire_pending_in(&mut transaction, now).await?;
+        if release_delivery_pins {
+            sqlx::query(&format!(
+                "DELETE FROM approval_delivery_pins WHERE approval_id IN ( \
+                     SELECT id FROM approvals WHERE {column} = ? \
+                     AND status IN ('pending', 'approved') \
+                 )"
+            ))
+            .bind(value)
+            .execute(&mut *transaction)
+            .await?;
+        }
+        let result = sqlx::query(&format!(
+            "UPDATE approvals SET status = 'canceled', revision = revision + 1, \
+             updated_at = ?, completed_at = ? WHERE {column} = ? \
+             AND status IN ('pending', 'approved')"
+        ))
+        .bind(now)
+        .bind(now)
+        .bind(value)
+        .execute(&mut *transaction)
+        .await?;
+        enforce_retention(&mut transaction).await?;
+        transaction.commit().await?;
+        Ok(result.rows_affected())
+    }
+
+    async fn advance_clock(&self) -> Result<i64, ApprovalError> {
+        let mut transaction = self.pool.begin().await?;
+        let now = effective_now_in(&mut transaction, self.clock.now()).await?;
+        transaction.commit().await?;
+        Ok(now)
+    }
+
+    fn decode_admin_detail(&self, row: ApprovalRow) -> Result<ApprovalAdminDetail, ApprovalError> {
+        let redacted_arguments = decrypt_json(
+            &self.keyring,
+            "approval-redacted-arguments",
+            &row.id,
+            &row.redacted_arguments_ciphertext,
+        )?;
+        let input_schema = decrypt_json(
+            &self.keyring,
+            "approval-input-schema",
+            &row.id,
+            &row.input_schema_ciphertext,
+        )?;
+        let record = row.record()?;
+        Ok(ApprovalAdminDetail {
+            record,
+            redacted_arguments,
+            input_schema,
+        })
+    }
+
+    fn decode_owner_detail(&self, row: ApprovalRow) -> Result<ApprovalOwnerDetail, ApprovalError> {
+        let result = row
+            .result_ciphertext
+            .as_deref()
+            .map(|sealed| decrypt_json(&self.keyring, "approval-result", &row.id, sealed))
+            .transpose()?;
+        let record = row.record()?;
+        Ok(ApprovalOwnerDetail { record, result })
+    }
+
+    fn decode_execution_snapshot(
+        &self,
+        row: ApprovalRow,
+    ) -> Result<ApprovalExecutionSnapshot, ApprovalError> {
+        let arguments = decrypt_json(
+            &self.keyring,
+            "approval-arguments",
+            &row.id,
+            &row.arguments_ciphertext,
+        )?;
+        let input_schema = decrypt_json(
+            &self.keyring,
+            "approval-input-schema",
+            &row.id,
+            &row.input_schema_ciphertext,
+        )?;
+        let output_schema = row
+            .output_schema_ciphertext
+            .as_deref()
+            .map(|sealed| decrypt_json(&self.keyring, "approval-output-schema", &row.id, sealed))
+            .transpose()?;
+        let invocation_snapshot = decrypt_json(
+            &self.keyring,
+            "approval-invocation-snapshot",
+            &row.id,
+            &row.invocation_snapshot_ciphertext,
+        )?;
+        let result = row
+            .result_ciphertext
+            .as_deref()
+            .map(|sealed| decrypt_json(&self.keyring, "approval-result", &row.id, sealed))
+            .transpose()?;
+        let record = row.record()?;
+        Ok(ApprovalExecutionSnapshot {
+            record,
+            arguments,
+            input_schema,
+            output_schema,
+            invocation_snapshot,
+            result,
+        })
+    }
+}
+
+#[derive(FromRow)]
+struct ApprovalRow {
+    sequence: i64,
+    id: String,
+    execution_id: String,
+    call_id: String,
+    worker_generation: i64,
+    actor_kind: String,
+    actor_id: String,
+    actor_api_token_id: Option<String>,
+    actor_name_snapshot: Option<String>,
+    surface: String,
+    source_id: String,
+    tool_id: String,
+    callable_path_snapshot: String,
+    source_display_name_snapshot: Option<String>,
+    tool_display_name_snapshot: Option<String>,
+    mode_provenance: String,
+    source_revision: i64,
+    catalog_revision: i64,
+    tool_revision: i64,
+    binding_revision: i64,
+    credential_revision: Option<i64>,
+    arguments_ciphertext: Vec<u8>,
+    redacted_arguments_ciphertext: Vec<u8>,
+    input_schema_ciphertext: Vec<u8>,
+    output_schema_ciphertext: Option<Vec<u8>>,
+    invocation_snapshot_ciphertext: Vec<u8>,
+    result_ciphertext: Option<Vec<u8>>,
+    status: String,
+    revision: i64,
+    decision_id: Option<String>,
+    decision: Option<String>,
+    decided_by_admin_id: Option<i64>,
+    failure_code: Option<String>,
+    created_at: i64,
+    updated_at: i64,
+    expires_at: i64,
+    decided_at: Option<i64>,
+    execution_started_at: Option<i64>,
+    completed_at: Option<i64>,
+}
+
+#[derive(FromRow)]
+struct ApprovalLogOutboxRow {
+    request_id: String,
+    approval_id: String,
+    actor_api_token_id: Option<String>,
+    surface: String,
+    source_id: Option<String>,
+    tool_id: Option<String>,
+    path_snapshot: String,
+    outcome: String,
+    error_code: Option<String>,
+    created_at: i64,
+}
+
+#[derive(FromRow)]
+struct ApprovalCorrelationRow {
+    approval_id: String,
+    actor_kind: String,
+    actor_id: String,
+    surface: String,
+    worker_generation: i64,
+    callable_path: String,
+    arguments_digest: Vec<u8>,
+}
+
+impl ApprovalRow {
+    fn record(&self) -> Result<ApprovalRecord, ApprovalError> {
+        let actor = ToolActor::from_stored(
+            &self.actor_kind,
+            self.actor_id.clone(),
+            self.actor_api_token_id.clone(),
+            self.actor_name_snapshot.clone(),
+        )
+        .ok_or(ApprovalError::CorruptData("invalid approval actor"))?;
+        Ok(ApprovalRecord {
+            sequence: self.sequence,
+            id: self.id.clone(),
+            execution_id: self.execution_id.clone(),
+            call_id: self.call_id.clone(),
+            worker_generation: u64::try_from(self.worker_generation)
+                .map_err(|_| ApprovalError::CorruptData("negative worker generation"))?,
+            actor_kind: actor.kind(),
+            actor_id: actor.id(),
+            actor_api_token_id: actor.api_token_id().map(str::to_owned),
+            actor_name_snapshot: actor.name_snapshot().map(str::to_owned),
+            surface: self
+                .surface
+                .parse()
+                .map_err(|_| ApprovalError::CorruptData("unknown approval surface"))?,
+            callable_path_snapshot: self.callable_path_snapshot.clone(),
+            source_display_name: self.source_display_name_snapshot.clone(),
+            tool_display_name: self.tool_display_name_snapshot.clone(),
+            mode_provenance: parse_mode_provenance(&self.mode_provenance)?,
+            revisions: InvocationRevisionTokenSnapshot {
+                source_id: self.source_id.clone(),
+                tool_id: self.tool_id.clone(),
+                source_revision: self.source_revision,
+                catalog_revision: self.catalog_revision,
+                tool_revision: self.tool_revision,
+                binding_revision: self.binding_revision,
+                credential_revision: self.credential_revision,
+            },
+            status: self.status.parse()?,
+            revision: self.revision,
+            decision_id: self.decision_id.clone(),
+            decision: self.decision.as_deref().map(str::parse).transpose()?,
+            decided_by_admin_id: self.decided_by_admin_id,
+            failure_code: self.failure_code.clone(),
+            created_at: self.created_at,
+            updated_at: self.updated_at,
+            expires_at: self.expires_at,
+            decided_at: self.decided_at,
+            execution_started_at: self.execution_started_at,
+            completed_at: self.completed_at,
+        })
+    }
+}
+
+const APPROVAL_SELECT: &str = "SELECT sequence, id, execution_id, call_id, worker_generation, \
+    actor_kind, actor_id, actor_api_token_id, actor_name_snapshot, surface, source_id, tool_id, callable_path_snapshot, \
+    source_display_name_snapshot, tool_display_name_snapshot, mode_provenance, source_revision, catalog_revision, \
+    tool_revision, binding_revision, credential_revision, arguments_ciphertext, redacted_arguments_ciphertext, \
+    input_schema_ciphertext, output_schema_ciphertext, invocation_snapshot_ciphertext, \
+    result_ciphertext, status, revision, decision_id, decision, decided_by_admin_id, failure_code, \
+    created_at, updated_at, expires_at, decided_at, execution_started_at, completed_at FROM approvals";
+
+async fn fetch_row(pool: &SqlitePool, id: &str) -> Result<Option<ApprovalRow>, sqlx::Error> {
+    sqlx::query_as::<_, ApprovalRow>(&format!("{} WHERE id = ?", APPROVAL_SELECT))
+        .bind(id)
+        .fetch_optional(pool)
+        .await
+}
+
+async fn fetch_row_in(
+    transaction: &mut Transaction<'_, Sqlite>,
+    id: &str,
+) -> Result<Option<ApprovalRow>, sqlx::Error> {
+    sqlx::query_as::<_, ApprovalRow>(&format!("{} WHERE id = ?", APPROVAL_SELECT))
+        .bind(id)
+        .fetch_optional(&mut **transaction)
+        .await
+}
+
+async fn fetch_correlation_in(
+    transaction: &mut Transaction<'_, Sqlite>,
+    actor_kind: &str,
+    actor_id: &str,
+    execution_id: &str,
+    call_id: &str,
+) -> Result<Option<ApprovalCorrelationRow>, sqlx::Error> {
+    sqlx::query_as::<_, ApprovalCorrelationRow>(
+        "SELECT approval_id, actor_kind, actor_id, surface, worker_generation, \
+         callable_path, arguments_digest FROM approval_correlations \
+         WHERE actor_kind = ? AND actor_id = ? AND execution_id = ? AND call_id = ?",
+    )
+    .bind(actor_kind)
+    .bind(actor_id)
+    .bind(execution_id)
+    .bind(call_id)
+    .fetch_optional(&mut **transaction)
+    .await
+}
+
+fn ensure_same_correlation(
+    existing: &ApprovalCorrelationRow,
+    actor_kind: &str,
+    actor_id: &str,
+    surface: RequestSurface,
+    worker_generation: i64,
+    callable_path: &str,
+    arguments_digest: &[u8],
+) -> Result<(), ApprovalError> {
+    if existing.actor_kind == actor_kind
+        && existing.actor_id == actor_id
+        && existing.surface == surface.as_str()
+        && existing.worker_generation == worker_generation
+        && existing.callable_path == callable_path
+        && existing.arguments_digest == arguments_digest
+    {
+        Ok(())
+    } else {
+        Err(ApprovalError::CorrelationConflict)
+    }
+}
+
+async fn effective_now_in(
+    transaction: &mut Transaction<'_, Sqlite>,
+    observed_now: i64,
+) -> Result<i64, sqlx::Error> {
+    sqlx::query("UPDATE approval_clock SET effective_now = MAX(effective_now, ?) WHERE id = 1")
+        .bind(observed_now.max(0))
+        .execute(&mut **transaction)
+        .await?;
+    sqlx::query_scalar("SELECT effective_now FROM approval_clock WHERE id = 1")
+        .fetch_one(&mut **transaction)
+        .await
+}
+
+async fn active_count_in(
+    transaction: &mut Transaction<'_, Sqlite>,
+    actor: Option<(&str, &str)>,
+) -> Result<i64, sqlx::Error> {
+    if let Some((actor_kind, actor_id)) = actor {
+        sqlx::query_scalar(
+            "SELECT COUNT(*) FROM approvals WHERE status IN ('pending', 'approved', 'executing') \
+             AND actor_kind = ? AND actor_id = ?",
+        )
+        .bind(actor_kind)
+        .bind(actor_id)
+        .fetch_one(&mut **transaction)
+        .await
+    } else {
+        sqlx::query_scalar(
+            "SELECT COUNT(*) FROM approvals WHERE status IN ('pending', 'approved', 'executing')",
+        )
+        .fetch_one(&mut **transaction)
+        .await
+    }
+}
+
+async fn active_ciphertext_bytes_in(
+    transaction: &mut Transaction<'_, Sqlite>,
+) -> Result<i64, sqlx::Error> {
+    sqlx::query_scalar(
+        "SELECT COALESCE(SUM( \
+             length(arguments_ciphertext) + length(redacted_arguments_ciphertext) \
+             + length(input_schema_ciphertext) + COALESCE(length(output_schema_ciphertext), 0) \
+             + length(invocation_snapshot_ciphertext) + COALESCE(length(result_ciphertext), 0) \
+         ), 0) FROM approvals WHERE status IN ('pending', 'approved', 'executing')",
+    )
+    .fetch_one(&mut **transaction)
+    .await
+}
+
+fn existing_ciphertext_bytes(row: &ApprovalRow) -> Result<i64, ApprovalError> {
+    [
+        row.arguments_ciphertext.len(),
+        row.redacted_arguments_ciphertext.len(),
+        row.input_schema_ciphertext.len(),
+        row.output_schema_ciphertext.as_ref().map_or(0, Vec::len),
+        row.invocation_snapshot_ciphertext.len(),
+    ]
+    .into_iter()
+    .try_fold(0_i64, |total, length| {
+        i64::try_from(length)
+            .ok()
+            .and_then(|length| total.checked_add(length))
+    })
+    .ok_or(ApprovalError::Capacity {
+        scope: "delivery_pin_bytes",
+    })
+}
+
+async fn add_delivery_pin_in(
+    transaction: &mut Transaction<'_, Sqlite>,
+    approval_id: &str,
+    snapshot_ciphertext_bytes: i64,
+    now: i64,
+) -> Result<(), ApprovalError> {
+    let (pin_count, ref_count, pinned_bytes) = sqlx::query_as::<_, (i64, i64, i64)>(
+        "SELECT COUNT(*), COALESCE(SUM(ref_count), 0), \
+         COALESCE(SUM(snapshot_ciphertext_bytes), 0) FROM approval_delivery_pins",
+    )
+    .fetch_one(&mut **transaction)
+    .await?;
+    let existing = sqlx::query_as::<_, (i64, i64)>(
+        "SELECT ref_count, snapshot_ciphertext_bytes FROM approval_delivery_pins \
+         WHERE approval_id = ?",
+    )
+    .bind(approval_id)
+    .fetch_optional(&mut **transaction)
+    .await?;
+    if ref_count >= MAX_APPROVAL_DELIVERY_PIN_REFS {
+        return Err(ApprovalError::Capacity {
+            scope: "delivery_pins",
+        });
+    }
+    if let Some((approval_refs, stored_bytes)) = existing {
+        if approval_refs >= MAX_APPROVAL_DELIVERY_PIN_REFS
+            || stored_bytes != snapshot_ciphertext_bytes
+        {
+            return Err(ApprovalError::Capacity {
+                scope: "delivery_pins",
+            });
+        }
+        sqlx::query(
+            "UPDATE approval_delivery_pins SET ref_count = ref_count + 1 WHERE approval_id = ?",
+        )
+        .bind(approval_id)
+        .execute(&mut **transaction)
+        .await?;
+        return Ok(());
+    }
+    if pin_count >= MAX_APPROVAL_DELIVERY_PINS
+        || pinned_bytes
+            .checked_add(snapshot_ciphertext_bytes)
+            .is_none_or(|bytes| bytes > MAX_PINNED_SNAPSHOT_CIPHERTEXT_BYTES)
+    {
+        return Err(ApprovalError::Capacity {
+            scope: "delivery_pins",
+        });
+    }
+    sqlx::query(
+        "INSERT INTO approval_delivery_pins \
+         (approval_id, ref_count, snapshot_ciphertext_bytes, created_at) VALUES (?, 1, ?, ?)",
+    )
+    .bind(approval_id)
+    .bind(snapshot_ciphertext_bytes)
+    .bind(now)
+    .execute(&mut **transaction)
+    .await?;
+    Ok(())
+}
+
+async fn token_active_in(
+    transaction: &mut Transaction<'_, Sqlite>,
+    actor_api_token_id: &str,
+) -> Result<bool, sqlx::Error> {
+    sqlx::query_scalar::<_, i64>(
+        "SELECT EXISTS(SELECT 1 FROM api_tokens WHERE id = ? AND revoked_at IS NULL)",
+    )
+    .bind(actor_api_token_id)
+    .fetch_one(&mut **transaction)
+    .await
+    .map(|active| active != 0)
+}
+
+async fn expire_pending_in(
+    transaction: &mut Transaction<'_, Sqlite>,
+    now: i64,
+) -> Result<u64, sqlx::Error> {
+    sqlx::query(
+        "UPDATE approvals SET status = 'expired', revision = revision + 1, \
+         updated_at = ?, completed_at = ? WHERE status = 'pending' AND expires_at <= ?",
+    )
+    .bind(now)
+    .bind(now)
+    .bind(now)
+    .execute(&mut **transaction)
+    .await
+    .map(|result| result.rows_affected())
+}
+
+async fn reclaim_expired_correlations_in(
+    transaction: &mut Transaction<'_, Sqlite>,
+    now: i64,
+) -> Result<u64, sqlx::Error> {
+    sqlx::query(
+        "DELETE FROM approval_correlations \
+         WHERE expires_at IS NOT NULL AND expires_at <= ? \
+           AND NOT EXISTS ( \
+               SELECT 1 FROM approval_delivery_pins \
+               WHERE approval_delivery_pins.approval_id = approval_correlations.approval_id \
+           ) \
+           AND NOT EXISTS ( \
+               SELECT 1 FROM gateway_invocation_idempotency \
+               WHERE gateway_invocation_idempotency.approval_correlation_id = approval_correlations.approval_id \
+                 AND (gateway_invocation_idempotency.expires_at IS NULL \
+                      OR gateway_invocation_idempotency.expires_at > ?) \
+           ) \
+           AND NOT EXISTS ( \
+               SELECT 1 FROM gateway_invocation_idempotency \
+               WHERE gateway_invocation_idempotency.state IN ('reserved', 'executing') \
+                 AND gateway_invocation_idempotency.owner_api_token_id = approval_correlations.actor_id \
+                 AND approval_correlations.actor_kind = 'api_token' \
+                 AND approval_correlations.call_id = 'gateway' \
+                 AND approval_correlations.execution_id = \
+                     'gateway-idempotency:' || gateway_invocation_idempotency.id \
+           )",
+    )
+    .bind(now)
+    .bind(now)
+    .execute(&mut **transaction)
+    .await
+    .map(|result| result.rows_affected())
+}
+
+async fn enforce_retention(transaction: &mut Transaction<'_, Sqlite>) -> Result<(), sqlx::Error> {
+    sqlx::query(
+        "INSERT OR IGNORE INTO approval_terminal_order (approval_id) \
+         SELECT id FROM approvals WHERE status IN ( \
+             'denied', 'expired', 'canceled', 'succeeded', 'failed', 'stale', 'interrupted' \
+         ) ORDER BY completed_at, sequence",
+    )
+    .execute(&mut **transaction)
+    .await?;
+    sqlx::query(
+        "DELETE FROM approvals WHERE id IN ( \
+             SELECT approvals.id FROM approvals \
+             JOIN approval_terminal_order ON approval_terminal_order.approval_id = approvals.id \
+             WHERE NOT EXISTS (SELECT 1 FROM approval_delivery_pins \
+                               WHERE approval_delivery_pins.approval_id = approvals.id) \
+             ORDER BY approval_terminal_order.sequence DESC LIMIT -1 OFFSET ? \
+         )",
+    )
+    .bind(TERMINAL_RETENTION)
+    .execute(&mut **transaction)
+    .await?;
+    sqlx::query(
+        "WITH terminal_usage AS ( \
+             SELECT approvals.id, SUM( \
+                 length(arguments_ciphertext) + length(redacted_arguments_ciphertext) \
+                 + length(input_schema_ciphertext) + COALESCE(length(output_schema_ciphertext), 0) \
+                 + length(invocation_snapshot_ciphertext) + COALESCE(length(result_ciphertext), 0) \
+             ) OVER (ORDER BY approval_terminal_order.sequence DESC \
+                     ROWS BETWEEN UNBOUNDED PRECEDING AND CURRENT ROW) AS retained_bytes \
+             FROM approvals JOIN approval_terminal_order \
+               ON approval_terminal_order.approval_id = approvals.id \
+             WHERE NOT EXISTS (SELECT 1 FROM approval_delivery_pins \
+                               WHERE approval_delivery_pins.approval_id = approvals.id) \
+         ) DELETE FROM approvals WHERE id IN ( \
+             SELECT id FROM terminal_usage WHERE retained_bytes > ? \
+         )",
+    )
+    .bind(MAX_TERMINAL_APPROVAL_CIPHERTEXT_BYTES)
+    .execute(&mut **transaction)
+    .await?;
+    Ok(())
+}
+
+async fn enforce_audit_retention(
+    transaction: &mut Transaction<'_, Sqlite>,
+) -> Result<(), sqlx::Error> {
+    sqlx::query(
+        "DELETE FROM audit_events WHERE rowid IN (SELECT rowid FROM audit_events \
+         ORDER BY rowid DESC LIMIT -1 OFFSET ?)",
+    )
+    .bind(TERMINAL_RETENTION)
+    .execute(&mut **transaction)
+    .await?;
+    Ok(())
+}
+
+async fn classify_cas_failure(
+    transaction: &mut Transaction<'_, Sqlite>,
+    id: &str,
+    expected_revision: i64,
+) -> Result<ApprovalError, sqlx::Error> {
+    let Some(row) = fetch_row_in(transaction, id).await? else {
+        return Ok(ApprovalError::NotFound);
+    };
+    Ok(classify_row_cas_failure(&row, expected_revision))
+}
+
+fn classify_row_cas_failure(row: &ApprovalRow, expected_revision: i64) -> ApprovalError {
+    if row.revision != expected_revision {
+        ApprovalError::RevisionConflict {
+            expected: expected_revision,
+            actual: row.revision,
+        }
+    } else {
+        match row.status.parse() {
+            Ok(status) => ApprovalError::InvalidTransition { status },
+            Err(error) => error,
+        }
+    }
+}
+
+fn mode_provenance_str(provenance: ModeProvenance) -> &'static str {
+    match provenance {
+        ModeProvenance::ToolOverride => "tool_override",
+        ModeProvenance::SourceOverride => "source_override",
+        ModeProvenance::Intrinsic => "intrinsic",
+    }
+}
+
+fn parse_mode_provenance(value: &str) -> Result<ModeProvenance, ApprovalError> {
+    match value {
+        "tool_override" => Ok(ModeProvenance::ToolOverride),
+        "source_override" => Ok(ModeProvenance::SourceOverride),
+        "intrinsic" => Ok(ModeProvenance::Intrinsic),
+        _ => Err(ApprovalError::CorruptData("unknown mode provenance")),
+    }
+}
+
+fn validate_new(new: &NewApproval) -> Result<(), ApprovalError> {
+    validate_identifier("execution ID", &new.execution_id, 128)?;
+    validate_identifier("call ID", &new.call_id, 128)?;
+    validate_identifier("actor ID", &new.actor.id(), 128)?;
+    if new.surface == RequestSurface::Admin {
+        return Err(ApprovalError::Validation {
+            code: "invalid_approval_surface",
+            message: "admin requests cannot own tool approvals".to_owned(),
+        });
+    }
+    if let Some(name) = new.actor.name_snapshot() {
+        validate_identifier("actor name snapshot", name, 200)?;
+    }
+    validate_identifier("source ID", &new.revisions.source_id, 128)?;
+    validate_identifier("tool ID", &new.revisions.tool_id, 128)?;
+    validate_identifier("callable path snapshot", &new.callable_path_snapshot, 512)?;
+    if let Some(name) = &new.source_display_name_snapshot {
+        validate_identifier("source display name snapshot", name, 300)?;
+    }
+    if let Some(name) = &new.tool_display_name_snapshot {
+        validate_identifier("tool display name snapshot", name, 300)?;
+    }
+    if [
+        new.revisions.source_revision,
+        new.revisions.catalog_revision,
+        new.revisions.tool_revision,
+        new.revisions.binding_revision,
+    ]
+    .into_iter()
+    .any(|revision| revision < 0)
+        || new
+            .revisions
+            .credential_revision
+            .is_some_and(|revision| revision < 0)
+    {
+        return Err(ApprovalError::Validation {
+            code: "invalid_invocation_revision",
+            message: "invocation revisions cannot be negative".to_owned(),
+        });
+    }
+    Ok(())
+}
+
+fn redact_arguments(arguments: &Value, schema: &Value) -> Value {
+    match (arguments, schema.get("type").and_then(Value::as_str)) {
+        (Value::Object(arguments), Some("object")) => {
+            let properties = schema.get("properties").and_then(Value::as_object);
+            Value::Object(
+                properties
+                    .into_iter()
+                    .flat_map(|properties| properties.iter())
+                    .filter_map(|(name, property_schema)| {
+                        arguments
+                            .get(name)
+                            .map(|value| (name.clone(), redact_arguments(value, property_schema)))
+                    })
+                    .collect(),
+            )
+        }
+        (Value::Array(arguments), Some("array")) => {
+            let item_schema = schema.get("items").unwrap_or(&Value::Null);
+            Value::Array(
+                arguments
+                    .iter()
+                    .map(|value| redact_arguments(value, item_schema))
+                    .collect(),
+            )
+        }
+        (Value::Null, _) => Value::Null,
+        _ => Value::String("[redacted]".to_owned()),
+    }
+}
+
+fn validate_identifier(label: &'static str, value: &str, max: usize) -> Result<(), ApprovalError> {
+    if value.is_empty() || value.len() > max || value.contains('\0') {
+        return Err(ApprovalError::Validation {
+            code: "invalid_approval_metadata",
+            message: format!("{label} must contain between 1 and {max} safe bytes"),
+        });
+    }
+    Ok(())
+}
+
+fn validate_failure_code(code: &str) -> Result<(), ApprovalError> {
+    validate_identifier("failure code", code, 128)
+}
+
+fn encode_json(label: &'static str, value: &Value, limit: usize) -> Result<Vec<u8>, ApprovalError> {
+    let encoded = serde_json::to_vec(value)?;
+    if encoded.len() > limit {
+        return Err(ApprovalError::PayloadTooLarge { label, limit });
+    }
+    Ok(encoded)
+}
+
+fn canonical_json_bytes(value: &Value) -> Result<Vec<u8>, ApprovalError> {
+    fn canonicalize(value: &Value) -> Value {
+        match value {
+            Value::Array(values) => Value::Array(values.iter().map(canonicalize).collect()),
+            Value::Object(values) => {
+                let mut entries = values.iter().collect::<Vec<_>>();
+                entries.sort_unstable_by_key(|(key, _)| *key);
+                Value::Object(
+                    entries
+                        .into_iter()
+                        .map(|(key, value)| (key.clone(), canonicalize(value)))
+                        .collect(),
+                )
+            }
+            scalar => scalar.clone(),
+        }
+    }
+
+    serde_json::to_vec(&canonicalize(value)).map_err(ApprovalError::Json)
+}
+
+fn decrypt_json(
+    keyring: &Keyring,
+    purpose: &str,
+    id: &str,
+    ciphertext: &[u8],
+) -> Result<Value, ApprovalError> {
+    let plaintext = keyring.decrypt(purpose, id, ciphertext)?;
+    serde_json::from_slice(&plaintext).map_err(ApprovalError::Json)
+}
+
+#[derive(Debug, Error)]
+pub enum ApprovalError {
+    #[error("approval storage failed: {0}")]
+    Database(#[from] sqlx::Error),
+    #[error("approval protection failed: {0}")]
+    Crypto(#[from] CryptoError),
+    #[error("approval JSON failed: {0}")]
+    Json(#[from] serde_json::Error),
+    #[error("{message}")]
+    Validation { code: &'static str, message: String },
+    #[error("approval {label} exceeds the {limit}-byte limit")]
+    PayloadTooLarge { label: &'static str, limit: usize },
+    #[error("approval was not found")]
+    NotFound,
+    #[error("approval has expired")]
+    Expired,
+    #[error("the approval owner token is missing or revoked")]
+    OwnerTokenInactive,
+    #[error("the {scope} active approval capacity has been reached")]
+    Capacity { scope: &'static str },
+    #[error("the execution call is already correlated with a different approval request")]
+    CorrelationConflict,
+    #[error("the execution call is correlated with an approval outside the retention window")]
+    CorrelationRetired,
+    #[error("approval worker generation does not match")]
+    WorkerGenerationConflict,
+    #[error("approval revision conflict: expected {expected}, found {actual}")]
+    RevisionConflict { expected: i64, actual: i64 },
+    #[error("approval has already received a conflicting decision")]
+    DecisionConflict,
+    #[error("approval cannot transition from {status}")]
+    InvalidTransition { status: ApprovalStatus },
+    #[error("stored approval data is invalid: {0}")]
+    CorruptData(&'static str),
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/src/approval/tests.rs b/src/approval/tests.rs
new file mode 100644
index 000000000..d2dda65cf
--- /dev/null
+++ b/src/approval/tests.rs
@@ -0,0 +1,1781 @@
+use std::sync::{
+    Arc,
+    atomic::{AtomicI64, Ordering},
+};
+
+use crate::{
+    AppConfig, ExecutorApp,
+    actor::ToolActor,
+    catalog::{InvocationRevisionToken, ModeProvenance, RequestSurface},
+    crypto::Keyring,
+};
+use serde_json::json;
+
+use super::{
+    ApprovalDecision, ApprovalError, ApprovalListQuery, ApprovalStatus, ApprovalStore, Clock,
+    ExecutionOutcome, NewApproval,
+};
+
+struct TestClock(AtomicI64);
+
+impl TestClock {
+    fn new(now: i64) -> Self {
+        Self(AtomicI64::new(now))
+    }
+
+    fn set(&self, now: i64) {
+        self.0.store(now, Ordering::SeqCst);
+    }
+}
+
+impl Clock for TestClock {
+    fn now(&self) -> i64 {
+        self.0.load(Ordering::SeqCst)
+    }
+}
+
+async fn approval_store() -> (
+    tempfile::TempDir,
+    ExecutorApp,
+    ApprovalStore,
+    Arc<TestClock>,
+) {
+    let directory = tempfile::tempdir().expect("temporary directory should be created");
+    let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+        .await
+        .expect("Executor should open");
+    sqlx::query(
+        "INSERT INTO admins (id, username, password_hash, created_at) VALUES (1, 'admin', 'hash', 1)",
+    )
+    .execute(app.pool())
+    .await
+    .expect("admin fixture should insert");
+    sqlx::query(
+        "INSERT INTO api_tokens (id, name, token_digest, token_prefix, token_suffix, created_at) \
+         VALUES ('token-1', 'Automation', ?, 'exe_test', 'last', 1)",
+    )
+    .bind(vec![7_u8; 32])
+    .execute(app.pool())
+    .await
+    .expect("token fixture should insert");
+    sqlx::query("UPDATE approval_clock SET effective_now = 0 WHERE id = 1")
+        .execute(app.pool())
+        .await
+        .expect("test clock high-water should reset");
+    let clock = Arc::new(TestClock::new(1_000));
+    let store = ApprovalStore::new(
+        app.pool().clone(),
+        Keyring::random().expect("test keyring should generate"),
+        clock.clone(),
+    );
+    (directory, app, store, clock)
+}
+
+fn new_approval(execution_id: &str, call_id: &str) -> NewApproval {
+    NewApproval {
+        execution_id: execution_id.to_owned(),
+        call_id: call_id.to_owned(),
+        worker_generation: 0,
+        actor: ToolActor::api_token("token-1", Some("Automation".to_owned())),
+        surface: RequestSurface::Gateway,
+        callable_path_snapshot: "weather.delete_forecast".to_owned(),
+        source_display_name_snapshot: Some("Weather".to_owned()),
+        tool_display_name_snapshot: Some("Delete forecast".to_owned()),
+        mode_provenance: ModeProvenance::Intrinsic,
+        revisions: InvocationRevisionToken {
+            source_id: "source-1".to_owned(),
+            tool_id: "tool-1".to_owned(),
+            source_revision: 11,
+            catalog_revision: 12,
+            tool_revision: 13,
+            binding_revision: 14,
+            credential_revision: Some(15),
+        },
+        arguments: json!({ "location": "secret-location" }),
+        input_schema: json!({
+            "type": "object",
+            "required": ["location"],
+            "properties": { "location": { "type": "string" } }
+        }),
+        output_schema: Some(json!({ "type": "object" })),
+        invocation_snapshot: json!({ "binding": "exact-secret-binding" }),
+    }
+}
+
+fn local_approval(execution_id: &str, call_id: &str, actor: ToolActor) -> NewApproval {
+    let mut approval = new_approval(execution_id, call_id);
+    approval.actor = actor;
+    approval.surface = RequestSurface::Cli;
+    approval
+}
+
+async fn wait_for_terminal_log(app: &ExecutorApp, approval_id: &str, error_code: &str) {
+    tokio::time::timeout(std::time::Duration::from_secs(2), async {
+        loop {
+            let (found, pending) = sqlx::query_as::<_, (i64, i64)>(
+                "SELECT \
+                 EXISTS(SELECT 1 FROM request_logs WHERE approval_id = ? AND error_code = ?), \
+                 EXISTS(SELECT 1 FROM approval_log_outbox WHERE approval_id = ?)",
+            )
+            .bind(approval_id)
+            .bind(error_code)
+            .bind(approval_id)
+            .fetch_one(app.pool())
+            .await
+            .expect("request log should read");
+            if found != 0 && pending == 0 {
+                break;
+            }
+            tokio::task::yield_now().await;
+        }
+    })
+    .await
+    .unwrap_or_else(|_| panic!("terminal approval log {error_code} should be stored"));
+}
+
+#[tokio::test]
+async fn snapshots_are_encrypted_bounded_and_exposed_only_through_the_right_views() {
+    let (directory, app, store, _clock) = approval_store().await;
+    let created = store
+        .create(new_approval("execution-1", "call-1"))
+        .await
+        .expect("approval should persist");
+
+    assert_eq!(created.record.status, ApprovalStatus::Pending);
+    assert_eq!(created.record.expires_at, 1_600);
+    assert_eq!(created.record.revisions.source_revision, 11);
+    assert_eq!(
+        created.redacted_arguments,
+        json!({ "location": "[redacted]" })
+    );
+    assert_eq!(created.input_schema["required"], json!(["location"]));
+    assert!(
+        store
+            .get_for_token(&created.record.id, "another-token")
+            .await
+            .expect("owner lookup should read")
+            .is_none()
+    );
+
+    let approved = store
+        .decide(
+            &created.record.id,
+            "decision-snapshot",
+            created.record.revision,
+            ApprovalDecision::Approve,
+            1,
+        )
+        .await
+        .expect("snapshot approval should be accepted");
+    let execution = store
+        .claim_execution(&created.record.id, 0, approved.record.revision)
+        .await
+        .expect("execution snapshot should be claimed");
+    assert_eq!(
+        execution.arguments,
+        json!({ "location": "secret-location" })
+    );
+    assert_eq!(execution.output_schema, Some(json!({ "type": "object" })));
+    assert_eq!(
+        execution.invocation_snapshot["binding"],
+        "exact-secret-binding"
+    );
+    let stored = sqlx::query_as::<_, (Vec<u8>, Vec<u8>, Vec<u8>, Vec<u8>)>(
+        "SELECT arguments_ciphertext, redacted_arguments_ciphertext, \
+         input_schema_ciphertext, invocation_snapshot_ciphertext FROM approvals WHERE id = ?",
+    )
+    .bind(&created.record.id)
+    .fetch_one(app.pool())
+    .await
+    .expect("ciphertexts should read");
+    for ciphertext in [stored.0, stored.1, stored.2, stored.3] {
+        assert!(
+            !ciphertext
+                .windows(b"secret-location".len())
+                .any(|part| part == b"secret-location")
+        );
+        assert!(
+            !ciphertext
+                .windows(b"exact-secret-binding".len())
+                .any(|part| part == b"exact-secret-binding")
+        );
+    }
+    for name in ["executor.db", "executor.db-wal", "executor.db-shm"] {
+        let path = directory.path().join(name);
+        if path.exists() {
+            let bytes = std::fs::read(path).expect("SQLite storage should be readable");
+            assert!(
+                !bytes
+                    .windows(b"secret-location".len())
+                    .any(|part| part == b"secret-location")
+            );
+            assert!(
+                !bytes
+                    .windows(b"exact-secret-binding".len())
+                    .any(|part| part == b"exact-secret-binding")
+            );
+        }
+    }
+
+    let oversized = "x".repeat(8 * 1024 * 1024 + 1);
+    let mut approval = new_approval("execution-big", "call-big");
+    approval.arguments = json!(oversized);
+    assert!(matches!(
+        store.create(approval).await,
+        Err(ApprovalError::PayloadTooLarge {
+            label: "arguments",
+            ..
+        })
+    ));
+}
+
+#[tokio::test]
+async fn decisions_are_cas_guarded_idempotent_and_follow_the_legal_transition_graph() {
+    let (_directory, app, store, _clock) = approval_store().await;
+    let created = store
+        .create(new_approval("execution-2", "call-2"))
+        .await
+        .expect("approval should persist");
+    let approved = store
+        .decide(
+            &created.record.id,
+            "decision-retry-with-new-id",
+            created.record.revision,
+            ApprovalDecision::Approve,
+            1,
+        )
+        .await
+        .expect("approval should be accepted");
+    assert!(!approved.idempotent);
+    assert_eq!(approved.record.status, ApprovalStatus::Approved);
+
+    let replay = store
+        .decide(
+            &created.record.id,
+            "decision-1",
+            created.record.revision,
+            ApprovalDecision::Approve,
+            1,
+        )
+        .await
+        .expect("identical decision should replay");
+    assert!(replay.idempotent);
+    assert_eq!(replay.record.revision, approved.record.revision);
+    let audits = sqlx::query_as::<_, (String, String, i64, String, String)>(
+        "SELECT request_id, action, actor_admin_id, target_path_snapshot, metadata_json \
+         FROM audit_events WHERE action = 'approval.approve'",
+    )
+    .fetch_all(app.pool())
+    .await
+    .expect("approval audit should read");
+    assert_eq!(audits.len(), 1);
+    assert_eq!(audits[0].0, "decision-retry-with-new-id");
+    assert_eq!(audits[0].1, "approval.approve");
+    assert_eq!(audits[0].2, 1);
+    assert_eq!(audits[0].3, "weather.delete_forecast");
+    let metadata: serde_json::Value =
+        serde_json::from_str(&audits[0].4).expect("audit metadata should be JSON");
+    assert_eq!(metadata["approvalId"], created.record.id);
+    assert_eq!(metadata["from"], "pending");
+    assert_eq!(metadata["to"], "approved");
+    assert_eq!(metadata["revision"], 1);
+    assert!(!audits[0].4.contains("secret-location"));
+    assert!(matches!(
+        store
+            .decide(
+                &created.record.id,
+                "decision-2",
+                approved.record.revision,
+                ApprovalDecision::Deny,
+                1,
+            )
+            .await,
+        Err(ApprovalError::DecisionConflict)
+    ));
+
+    let executing = store
+        .claim_execution(&created.record.id, 0, approved.record.revision)
+        .await
+        .expect("approved call should enter executing");
+    assert!(matches!(
+        store
+            .cancel_token_owner(&created.record.id, "token-1", executing.record.revision)
+            .await,
+        Err(ApprovalError::InvalidTransition {
+            status: ApprovalStatus::Executing
+        })
+    ));
+    let completed = store
+        .finish(
+            &created.record.id,
+            executing.record.revision,
+            ExecutionOutcome::Succeeded,
+            &json!({ "ok": true, "secretResult": "private" }),
+            None,
+        )
+        .await
+        .expect("execution should complete");
+    assert_eq!(completed.status, ApprovalStatus::Succeeded);
+    let terminal_replay = store
+        .decide(
+            &created.record.id,
+            "decision-after-completion",
+            0,
+            ApprovalDecision::Approve,
+            1,
+        )
+        .await
+        .expect("the same decision should remain idempotent after completion");
+    assert!(terminal_replay.idempotent);
+    assert_eq!(terminal_replay.record.status, ApprovalStatus::Succeeded);
+    let owner = store
+        .get_for_token(&created.record.id, "token-1")
+        .await
+        .expect("owner lookup should read")
+        .expect("owner lookup should exist");
+    assert_eq!(
+        owner.result,
+        Some(json!({ "ok": true, "secretResult": "private" }))
+    );
+    let admin = store
+        .get_admin(&created.record.id)
+        .await
+        .expect("admin lookup should read")
+        .expect("admin lookup should exist");
+    let serialized = serde_json::to_string(&admin).expect("admin detail should serialize");
+    assert!(!serialized.contains("secretResult"));
+    assert!(!serialized.contains("private"));
+}
+
+#[tokio::test]
+async fn owner_cancellation_is_idempotent_and_decision_races_have_one_winner() {
+    let (_directory, _app, store, _clock) = approval_store().await;
+    let canceled = store
+        .create(new_approval("execution-cancel", "call-cancel"))
+        .await
+        .expect("cancelable approval should persist");
+    let duplicate = store
+        .create(new_approval("execution-cancel", "call-cancel"))
+        .await
+        .expect("identical duplicate should recover the approval");
+    assert!(duplicate.reused);
+    assert_eq!(duplicate.record.id, canceled.record.id);
+    let canceled = store
+        .cancel_token_owner(&canceled.record.id, "token-1", 0)
+        .await
+        .expect("owner cancellation should succeed");
+    let replay = store
+        .cancel_token_owner(&canceled.id, "token-1", 0)
+        .await
+        .expect("owner cancellation replay should be idempotent");
+    assert_eq!(replay.status, ApprovalStatus::Canceled);
+    assert_eq!(replay.revision, canceled.revision);
+
+    let raced = store
+        .create(new_approval("execution-race", "call-race"))
+        .await
+        .expect("raced approval should persist");
+    let approve_store = store.clone();
+    let approve_id = raced.record.id.clone();
+    let approve = tokio::spawn(async move {
+        approve_store
+            .decide(&approve_id, "race-approve", 0, ApprovalDecision::Approve, 1)
+            .await
+    });
+    let deny_store = store.clone();
+    let deny_id = raced.record.id;
+    let deny = tokio::spawn(async move {
+        deny_store
+            .decide(&deny_id, "race-deny", 0, ApprovalDecision::Deny, 1)
+            .await
+    });
+    let outcomes = [
+        approve.await.expect("approve task should join"),
+        deny.await.expect("deny task should join"),
+    ];
+    assert_eq!(outcomes.iter().filter(|outcome| outcome.is_ok()).count(), 1);
+    assert_eq!(
+        outcomes
+            .iter()
+            .filter(|outcome| matches!(outcome, Err(ApprovalError::DecisionConflict)))
+            .count(),
+        1
+    );
+}
+
+#[tokio::test]
+async fn concurrent_identical_creates_recover_one_correlated_approval() {
+    let (_directory, app, store, _clock) = approval_store().await;
+    let first_store = store.clone();
+    let second_store = store.clone();
+    let (first, second) = tokio::join!(
+        first_store.create(new_approval("execution-create-race", "call-create-race")),
+        second_store.create(new_approval("execution-create-race", "call-create-race")),
+    );
+    let first = first.expect("first concurrent create should resolve");
+    let second = second.expect("second concurrent create should resolve");
+
+    assert_eq!(first.record.id, second.record.id);
+    assert_ne!(first.reused, second.reused);
+    assert_eq!(
+        sqlx::query_scalar::<_, i64>(
+            "SELECT COUNT(*) FROM approvals WHERE execution_id = ? AND call_id = ?",
+        )
+        .bind("execution-create-race")
+        .bind("call-create-race")
+        .fetch_one(app.pool())
+        .await
+        .expect("approval count should read"),
+        1
+    );
+}
+
+#[tokio::test]
+async fn duplicate_correlation_requires_matching_request_identity_without_catalog_revisions() {
+    let (_directory, _app, store, _clock) = approval_store().await;
+    let created = store
+        .create(new_approval("execution-correlation", "call-correlation"))
+        .await
+        .expect("approval should persist");
+
+    let mut catalog_changed = new_approval("execution-correlation", "call-correlation");
+    catalog_changed.revisions.source_revision += 100;
+    catalog_changed.revisions.catalog_revision += 100;
+    catalog_changed.revisions.tool_revision += 100;
+    catalog_changed.revisions.binding_revision += 100;
+    catalog_changed.revisions.credential_revision = Some(500);
+    let recovered = store
+        .create(catalog_changed)
+        .await
+        .expect("catalog changes should not break caller retry correlation");
+    assert!(recovered.reused);
+    assert_eq!(recovered.record.id, created.record.id);
+
+    let mut different_arguments = new_approval("execution-correlation", "call-correlation");
+    different_arguments.arguments = json!({ "location": "different" });
+    assert!(matches!(
+        store.create(different_arguments).await,
+        Err(ApprovalError::CorrelationConflict)
+    ));
+
+    let mut different_path = new_approval("execution-correlation", "call-correlation");
+    different_path.callable_path_snapshot = "weather.create_forecast".to_owned();
+    assert!(matches!(
+        store.create(different_path).await,
+        Err(ApprovalError::CorrelationConflict)
+    ));
+
+    let mut different_surface = new_approval("execution-correlation", "call-correlation");
+    different_surface.surface = RequestSurface::Mcp;
+    assert!(matches!(
+        store.create(different_surface).await,
+        Err(ApprovalError::CorrelationConflict)
+    ));
+
+    let mut different_generation = new_approval("execution-correlation", "call-correlation");
+    different_generation.worker_generation += 1;
+    assert!(matches!(
+        store.create(different_generation).await,
+        Err(ApprovalError::CorrelationConflict)
+    ));
+}
+
+#[tokio::test]
+async fn duplicate_correlation_is_actor_typed_and_never_returns_another_actors_record() {
+    let (_directory, app, store, _clock) = approval_store().await;
+    sqlx::query(
+        "INSERT INTO api_tokens (id, name, token_digest, token_prefix, token_suffix, created_at) \
+         VALUES ('1', 'Other actor', ?, 'exe_other', 'last', 1)",
+    )
+    .bind(vec![8_u8; 32])
+    .execute(app.pool())
+    .await
+    .expect("second token fixture should insert");
+    let mut original = new_approval("execution-cross-actor", "call-cross-actor");
+    original.actor = ToolActor::admin(1);
+    let created = store
+        .create(original)
+        .await
+        .expect("admin approval should persist");
+    let mut cross_actor = new_approval("execution-cross-actor", "call-cross-actor");
+    cross_actor.actor = ToolActor::api_token("1", Some("Other actor".to_owned()));
+    let cross_actor = store
+        .create(cross_actor)
+        .await
+        .expect("another actor should have an isolated correlation namespace");
+    assert!(!cross_actor.reused);
+    assert_ne!(cross_actor.record.id, created.record.id);
+    assert!(
+        store
+            .get_for_actor(
+                &created.record.id,
+                &ToolActor::api_token("1", Some("Other actor".to_owned())),
+            )
+            .await
+            .expect("cross-actor lookup should read")
+            .is_none()
+    );
+    assert!(
+        store
+            .get_for_actor(&cross_actor.record.id, &ToolActor::admin(1))
+            .await
+            .expect("reverse cross-actor lookup should read")
+            .is_none()
+    );
+}
+
+#[tokio::test]
+async fn duplicate_correlation_uses_canonical_argument_object_order() {
+    let (_directory, _app, store, _clock) = approval_store().await;
+    let mut first = new_approval("execution-canonical", "call-canonical");
+    first.arguments =
+        serde_json::from_str(r#"{"b":2,"a":{"y":2,"x":1}}"#).expect("first arguments should parse");
+    let created = store.create(first).await.expect("approval should persist");
+    let mut reordered = new_approval("execution-canonical", "call-canonical");
+    reordered.arguments = serde_json::from_str(r#"{"a":{"x":1,"y":2},"b":2}"#)
+        .expect("reordered arguments should parse");
+    let recovered = store
+        .create(reordered)
+        .await
+        .expect("equivalent arguments should recover the approval");
+
+    assert!(recovered.reused);
+    assert_eq!(recovered.record.id, created.record.id);
+
+    let mut integer = new_approval("execution-number-type", "call-number-type");
+    integer.arguments =
+        serde_json::from_str(r#"{"value":1}"#).expect("integer arguments should parse");
+    store
+        .create(integer)
+        .await
+        .expect("integer approval should persist");
+    let mut decimal = new_approval("execution-number-type", "call-number-type");
+    decimal.arguments =
+        serde_json::from_str(r#"{"value":1.0}"#).expect("decimal arguments should parse");
+    assert!(matches!(
+        store.create(decimal).await,
+        Err(ApprovalError::CorrelationConflict)
+    ));
+}
+
+#[tokio::test]
+async fn retained_correlation_prevents_recreation_after_approval_payload_retention() {
+    let (_directory, app, store, _clock) = approval_store().await;
+    let created = store
+        .create(new_approval("execution-retired", "call-retired"))
+        .await
+        .expect("approval should persist");
+    store
+        .decide(
+            &created.record.id,
+            "deny-before-payload-retention",
+            created.record.revision,
+            ApprovalDecision::Deny,
+            1,
+        )
+        .await
+        .expect("approval should become terminal before payload retention");
+    sqlx::query("DELETE FROM approvals WHERE id = ?")
+        .bind(&created.record.id)
+        .execute(app.pool())
+        .await
+        .expect("retention simulation should remove approval payload");
+
+    assert!(matches!(
+        store
+            .create(new_approval("execution-retired", "call-retired"))
+            .await,
+        Err(ApprovalError::CorrelationRetired)
+    ));
+    assert_eq!(
+        sqlx::query_scalar::<_, i64>(
+            "SELECT COUNT(*) FROM approvals WHERE actor_kind = 'api_token' AND actor_id = 'token-1' \
+             AND execution_id = ? AND call_id = ?",
+        )
+        .bind("execution-retired")
+        .bind("call-retired")
+        .fetch_one(app.pool())
+        .await
+        .expect("approval count should read"),
+        0
+    );
+}
+
+#[tokio::test]
+async fn terminal_correlation_is_retained_for_the_full_ttl_then_reclaimed() {
+    let (_directory, app, store, clock) = approval_store().await;
+    clock.set(2_000);
+    let created = store
+        .create(new_approval("execution-terminal-ttl", "call-terminal-ttl"))
+        .await
+        .expect("approval should persist");
+    store
+        .decide(
+            &created.record.id,
+            "deny-terminal-ttl",
+            created.record.revision,
+            ApprovalDecision::Deny,
+            1,
+        )
+        .await
+        .expect("approval should become terminal");
+    let expires_at = sqlx::query_scalar::<_, i64>(
+        "SELECT expires_at FROM approval_correlations WHERE approval_id = ?",
+    )
+    .bind(&created.record.id)
+    .fetch_one(app.pool())
+    .await
+    .expect("correlation expiry should read");
+    assert_eq!(expires_at, 2_000 + super::APPROVAL_CORRELATION_TTL_SECONDS);
+
+    clock.set(expires_at - 1);
+    let early_retry = store
+        .create(new_approval("execution-terminal-ttl", "call-terminal-ttl"))
+        .await
+        .expect("retry before correlation expiry should recover the approval");
+    assert!(early_retry.reused);
+    assert_eq!(early_retry.record.id, created.record.id);
+
+    clock.set(expires_at);
+    let reused_call = store
+        .create(new_approval("execution-terminal-ttl", "call-terminal-ttl"))
+        .await
+        .expect("call at correlation expiry should start a new approval");
+    assert!(!reused_call.reused);
+    assert_ne!(reused_call.record.id, created.record.id);
+    assert!(
+        store
+            .get_admin(&created.record.id)
+            .await
+            .expect("retired approval lookup should read")
+            .is_none()
+    );
+}
+
+#[tokio::test]
+async fn expired_terminal_correlation_waits_for_delivery_pin_release_before_reclamation() {
+    let (_directory, app, store, clock) = approval_store().await;
+    clock.set(3_000);
+    let mut request = new_approval("execution-pinned-correlation", "call-pinned-correlation");
+    request.worker_generation = 7;
+    let created = store
+        .create(request)
+        .await
+        .expect("pinned approval should persist");
+    store
+        .decide(
+            &created.record.id,
+            "deny-pinned-correlation",
+            created.record.revision,
+            ApprovalDecision::Deny,
+            1,
+        )
+        .await
+        .expect("pinned approval should become terminal");
+    let expires_at = sqlx::query_scalar::<_, i64>(
+        "SELECT expires_at FROM approval_correlations WHERE approval_id = ?",
+    )
+    .bind(&created.record.id)
+    .fetch_one(app.pool())
+    .await
+    .expect("pinned correlation expiry should read");
+
+    clock.set(expires_at);
+    store
+        .create(new_approval(
+            "execution-pinned-cleanup-before",
+            "call-pinned-cleanup-before",
+        ))
+        .await
+        .expect("cleanup should skip the pinned terminal correlation");
+    assert_eq!(
+        sqlx::query_scalar::<_, i64>(
+            "SELECT COUNT(*) FROM approval_correlations WHERE approval_id = ?",
+        )
+        .bind(&created.record.id)
+        .fetch_one(app.pool())
+        .await
+        .expect("pinned correlation should read"),
+        1
+    );
+
+    store
+        .release_delivery_pin(&super::ApprovalDeliveryIdentity {
+            approval_id: created.record.id.clone(),
+            actor: ToolActor::api_token("token-1", Some("Automation".to_owned())),
+            execution_id: created.record.execution_id.clone(),
+            call_id: created.record.call_id.clone(),
+        })
+        .await
+        .expect("delivery pin should release after terminal result delivery");
+    store
+        .create(new_approval(
+            "execution-pinned-cleanup-after",
+            "call-pinned-cleanup-after",
+        ))
+        .await
+        .expect("cleanup should reclaim the unpinned expired correlation");
+    assert_eq!(
+        sqlx::query_scalar::<_, i64>(
+            "SELECT COUNT(*) FROM approval_correlations WHERE approval_id = ?",
+        )
+        .bind(&created.record.id)
+        .fetch_one(app.pool())
+        .await
+        .expect("reclaimed correlation should read"),
+        0
+    );
+    assert!(
+        store
+            .get_admin(&created.record.id)
+            .await
+            .expect("reclaimed approval should read")
+            .is_none()
+    );
+}
+
+#[tokio::test]
+async fn nonterminal_correlation_never_expires_or_gets_reclaimed() {
+    let (_directory, app, store, clock) = approval_store().await;
+    let created = store
+        .create(new_approval(
+            "execution-active-correlation",
+            "call-active-correlation",
+        ))
+        .await
+        .expect("approval should persist");
+    let approved = store
+        .decide(
+            &created.record.id,
+            "approve-active-correlation",
+            created.record.revision,
+            ApprovalDecision::Approve,
+            1,
+        )
+        .await
+        .expect("approval should remain nonterminal");
+    assert!(
+        sqlx::query_scalar::<_, Option<i64>>(
+            "SELECT expires_at FROM approval_correlations WHERE approval_id = ?",
+        )
+        .bind(&approved.record.id)
+        .fetch_one(app.pool())
+        .await
+        .expect("active correlation expiry should read")
+        .is_none()
+    );
+
+    clock.set(1_000 + super::APPROVAL_CORRELATION_TTL_SECONDS * 2);
+    store
+        .create(new_approval(
+            "execution-active-cleanup-trigger",
+            "call-active-cleanup-trigger",
+        ))
+        .await
+        .expect("unrelated create should run correlation cleanup");
+    let retry = store
+        .create(new_approval(
+            "execution-active-correlation",
+            "call-active-correlation",
+        ))
+        .await
+        .expect("active correlation should remain recoverable");
+    assert!(retry.reused);
+    assert_eq!(retry.record.id, approved.record.id);
+}
+
+#[tokio::test]
+async fn live_gateway_idempotency_retention_extends_correlation_protection() {
+    let (_directory, app, store, clock) = approval_store().await;
+    let created = store
+        .create(new_approval(
+            "execution-idempotency-guard",
+            "call-idempotency-guard",
+        ))
+        .await
+        .expect("approval should persist");
+    store
+        .decide(
+            &created.record.id,
+            "deny-idempotency-guard",
+            created.record.revision,
+            ApprovalDecision::Deny,
+            1,
+        )
+        .await
+        .expect("approval should become terminal");
+    let correlation_expiry = 1_000 + super::APPROVAL_CORRELATION_TTL_SECONDS;
+    let idempotency_expiry = correlation_expiry + 60;
+    sqlx::query(
+        "INSERT INTO gateway_invocation_idempotency ( \
+             id, owner_api_token_id, key_digest, request_digest, state, approval_id, \
+             created_at, updated_at, completed_at, expires_at \
+         ) VALUES (?, 'token-1', ?, ?, 'indeterminate', ?, 1000, 1000, 1000, ?)",
+    )
+    .bind("idempotency-correlation-guard")
+    .bind(vec![3_u8; 32])
+    .bind(vec![4_u8; 32])
+    .bind(&created.record.id)
+    .bind(idempotency_expiry)
+    .execute(app.pool())
+    .await
+    .expect("idempotency retention fixture should insert");
+
+    clock.set(correlation_expiry);
+    let protected = store
+        .create(new_approval(
+            "execution-idempotency-guard",
+            "call-idempotency-guard",
+        ))
+        .await
+        .expect("live idempotency should preserve the correlation");
+    assert!(protected.reused);
+    assert_eq!(protected.record.id, created.record.id);
+
+    clock.set(idempotency_expiry);
+    let reclaimed = store
+        .create(new_approval(
+            "execution-idempotency-guard",
+            "call-idempotency-guard",
+        ))
+        .await
+        .expect("expired idempotency should release the correlation");
+    assert!(!reclaimed.reused);
+    assert_ne!(reclaimed.record.id, created.record.id);
+}
+
+#[tokio::test]
+async fn reserved_gateway_idempotency_linkage_prevents_correlation_reclamation() {
+    let (_directory, app, store, clock) = approval_store().await;
+    let mut approval = new_approval("gateway-idempotency:reserved-correlation-guard", "gateway");
+    approval.worker_generation = 0;
+    let created = store
+        .create(approval.clone())
+        .await
+        .expect("approval should persist");
+    store
+        .decide(
+            &created.record.id,
+            "deny-reserved-correlation-guard",
+            created.record.revision,
+            ApprovalDecision::Deny,
+            1,
+        )
+        .await
+        .expect("approval should become terminal");
+    sqlx::query(
+        "INSERT INTO gateway_invocation_idempotency ( \
+             id, owner_api_token_id, key_digest, request_digest, state, \
+             created_at, updated_at \
+         ) VALUES (?, 'token-1', ?, ?, 'reserved', 1000, 1000)",
+    )
+    .bind("reserved-correlation-guard")
+    .bind(vec![5_u8; 32])
+    .bind(vec![6_u8; 32])
+    .execute(app.pool())
+    .await
+    .expect("reserved idempotency fixture should insert");
+
+    clock.set(1_000 + super::APPROVAL_CORRELATION_TTL_SECONDS);
+    let protected = store
+        .create(approval.clone())
+        .await
+        .expect("reserved idempotency should preserve its execution-linked correlation");
+    assert!(protected.reused);
+    assert_eq!(protected.record.id, created.record.id);
+
+    sqlx::query("DELETE FROM gateway_invocation_idempotency WHERE id = ?")
+        .bind("reserved-correlation-guard")
+        .execute(app.pool())
+        .await
+        .expect("reserved idempotency fixture should clear");
+    let reclaimed = store
+        .create(approval)
+        .await
+        .expect("released reservation should permit correlation reclamation");
+    assert!(!reclaimed.reused);
+    assert_ne!(reclaimed.record.id, created.record.id);
+}
+
+#[tokio::test]
+async fn correlation_capacity_fails_closed_without_blocking_existing_retries() {
+    let (_directory, app, store, _clock) = approval_store().await;
+    let existing = store
+        .create(new_approval("execution-cap-existing", "call-cap-existing"))
+        .await
+        .expect("existing correlation should persist");
+    sqlx::query("UPDATE approval_correlation_state SET correlation_count = 100000 WHERE id = 1")
+        .execute(app.pool())
+        .await
+        .expect("correlation capacity fixture should update");
+
+    let recovered = store
+        .create(new_approval("execution-cap-existing", "call-cap-existing"))
+        .await
+        .expect("existing correlation should remain recoverable at capacity");
+    assert!(recovered.reused);
+    assert_eq!(recovered.record.id, existing.record.id);
+    assert!(matches!(
+        store
+            .create(new_approval("execution-cap-new", "call-cap-new"))
+            .await,
+        Err(ApprovalError::Capacity {
+            scope: "correlations"
+        })
+    ));
+}
+
+#[tokio::test]
+async fn expired_terminal_correlation_recovers_capacity_before_new_insert() {
+    let (_directory, app, store, clock) = approval_store().await;
+    let created = store
+        .create(new_approval("execution-cap-reclaim", "call-cap-reclaim"))
+        .await
+        .expect("approval should persist");
+    store
+        .decide(
+            &created.record.id,
+            "deny-cap-reclaim",
+            created.record.revision,
+            ApprovalDecision::Deny,
+            1,
+        )
+        .await
+        .expect("approval should become terminal");
+    sqlx::query("UPDATE approval_correlation_state SET correlation_count = 100000 WHERE id = 1")
+        .execute(app.pool())
+        .await
+        .expect("correlation capacity fixture should update");
+    clock.set(1_000 + super::APPROVAL_CORRELATION_TTL_SECONDS);
+
+    let created_after_reclaim = store
+        .create(new_approval(
+            "execution-cap-after-reclaim",
+            "call-cap-after-reclaim",
+        ))
+        .await
+        .expect("expired terminal correlation should reclaim capacity first");
+    assert!(!created_after_reclaim.reused);
+    assert_eq!(
+        sqlx::query_scalar::<_, i64>(
+            "SELECT correlation_count FROM approval_correlation_state WHERE id = 1",
+        )
+        .fetch_one(app.pool())
+        .await
+        .expect("correlation count should read"),
+        100_000
+    );
+}
+
+#[tokio::test]
+async fn terminal_log_ids_are_unique_for_sibling_calls_in_one_execution() {
+    let (_directory, _app, store, _clock) = approval_store().await;
+    let first = store
+        .create(new_approval("shared-execution", "first-call"))
+        .await
+        .expect("first sibling approval should persist");
+    let second = store
+        .create(new_approval("shared-execution", "second-call"))
+        .await
+        .expect("second sibling approval should persist");
+    for (index, approval) in [first, second].into_iter().enumerate() {
+        store
+            .decide(
+                &approval.record.id,
+                &format!("sibling-deny-{index}"),
+                approval.record.revision,
+                ApprovalDecision::Deny,
+                1,
+            )
+            .await
+            .expect("sibling approval should be denied");
+    }
+    let events = store
+        .log_outbox(10)
+        .await
+        .expect("approval log outbox should read");
+    let unique_ids = events
+        .iter()
+        .map(|event| event.request_id.as_str())
+        .collect::<std::collections::HashSet<_>>();
+    assert_eq!(events.len(), 2);
+    assert_eq!(unique_ids.len(), 2);
+}
+
+#[tokio::test]
+async fn token_activity_caps_and_monotonic_clock_are_enforced_at_storage_boundaries() {
+    let (_directory, app, store, clock) = approval_store().await;
+    clock.set(5_000);
+    let first = store
+        .create(new_approval("execution-clock-1", "call-clock-1"))
+        .await
+        .expect("first clock approval should persist");
+    clock.set(100);
+    let second = store
+        .create(new_approval("execution-clock-2", "call-clock-2"))
+        .await
+        .expect("backward clock approval should persist");
+    assert_eq!(first.record.created_at, 5_000);
+    assert_eq!(second.record.created_at, 5_000);
+    assert_eq!(second.record.expires_at, 5_600);
+    clock.set(5_599);
+    assert_eq!(store.expire_pending().await.expect("expiry should run"), 0);
+    clock.set(5_600);
+    assert_eq!(store.expire_pending().await.expect("expiry should run"), 2);
+
+    clock.set(6_000);
+    let approved = store
+        .create(new_approval("execution-revoke-race", "call-revoke-race"))
+        .await
+        .expect("approval should persist");
+    let approved = store
+        .decide(
+            &approved.record.id,
+            "approve-before-revoke",
+            0,
+            ApprovalDecision::Approve,
+            1,
+        )
+        .await
+        .expect("approval should be accepted");
+    assert!(matches!(
+        store
+            .claim_execution(&approved.record.id, 4, approved.record.revision,)
+            .await,
+        Err(ApprovalError::WorkerGenerationConflict)
+    ));
+    sqlx::query("UPDATE api_tokens SET revoked_at = 6_001 WHERE id = 'token-1'")
+        .execute(app.pool())
+        .await
+        .expect("token should revoke");
+    assert!(matches!(
+        store
+            .claim_execution(&approved.record.id, 0, approved.record.revision,)
+            .await,
+        Err(ApprovalError::OwnerTokenInactive)
+    ));
+    assert!(matches!(
+        store
+            .create(new_approval("execution-after-revoke", "call-after-revoke"))
+            .await,
+        Err(ApprovalError::OwnerTokenInactive)
+    ));
+
+    sqlx::query("UPDATE api_tokens SET revoked_at = NULL WHERE id = 'token-1'")
+        .execute(app.pool())
+        .await
+        .expect("token should reactivate for capacity fixture");
+    store
+        .cancel_token("token-1")
+        .await
+        .expect("active approvals should clear");
+    for index in 0..128 {
+        store
+            .create(new_approval(
+                &format!("execution-cap-{index}"),
+                &format!("call-cap-{index}"),
+            ))
+            .await
+            .expect("approval below the owner cap should persist");
+    }
+    assert!(matches!(
+        store
+            .create(new_approval("execution-over-cap", "call-over-cap"))
+            .await,
+        Err(ApprovalError::Capacity { scope: "owner" })
+    ));
+    clock.set(6_600);
+    store
+        .create(new_approval(
+            "execution-after-cap-expiry",
+            "call-after-cap-expiry",
+        ))
+        .await
+        .expect("create should reclaim expired capacity in the same transaction");
+}
+
+#[tokio::test]
+async fn local_actors_are_isolated_from_gateway_ownership_and_token_revocation() {
+    let (_directory, app, store, _clock) = approval_store().await;
+    let admin = store
+        .create(local_approval(
+            "execution-admin",
+            "call-admin",
+            ToolActor::admin(1),
+        ))
+        .await
+        .expect("admin-owned approval should persist without a synthetic token");
+    let system = store
+        .create(local_approval(
+            "execution-system",
+            "call-system",
+            ToolActor::local_cli(),
+        ))
+        .await
+        .expect("system-owned approval should persist without a synthetic token");
+    let token = store
+        .create(new_approval("execution-token", "call-token"))
+        .await
+        .expect("token-owned approval should persist");
+
+    assert_eq!(admin.record.actor_kind, crate::actor::ActorKind::Admin);
+    assert_eq!(admin.record.actor_api_token_id, None);
+    assert_eq!(system.record.actor_kind, crate::actor::ActorKind::System);
+    assert_eq!(system.record.actor_api_token_id, None);
+    assert!(
+        store
+            .get_for_token(&admin.record.id, "token-1")
+            .await
+            .expect("gateway lookup should read")
+            .is_none()
+    );
+    assert_eq!(
+        sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM api_tokens")
+            .fetch_one(app.pool())
+            .await
+            .expect("token count should read"),
+        1
+    );
+
+    assert!(
+        store
+            .revoke_owner_token("token-1")
+            .await
+            .expect("token revocation should run")
+    );
+    assert_eq!(
+        store
+            .get_admin(&token.record.id)
+            .await
+            .expect("token approval should read")
+            .expect("token approval should exist")
+            .record
+            .status,
+        ApprovalStatus::Canceled
+    );
+    for local in [&admin, &system] {
+        assert_eq!(
+            store
+                .get_admin(&local.record.id)
+                .await
+                .expect("local approval should read")
+                .expect("local approval should exist")
+                .record
+                .status,
+            ApprovalStatus::Pending
+        );
+    }
+
+    let approved = store
+        .decide(
+            &admin.record.id,
+            "approve-admin",
+            admin.record.revision,
+            ApprovalDecision::Approve,
+            1,
+        )
+        .await
+        .expect("admin-owned approval should be approved");
+    store
+        .claim_execution(&admin.record.id, 0, approved.record.revision)
+        .await
+        .expect("admin-owned approval should execute without a token check");
+    let denied = store
+        .decide(
+            &system.record.id,
+            "deny-system",
+            system.record.revision,
+            ApprovalDecision::Deny,
+            1,
+        )
+        .await
+        .expect("system-owned approval should be denied");
+    assert_eq!(denied.record.status, ApprovalStatus::Denied);
+    assert!(
+        store
+            .log_outbox(256)
+            .await
+            .expect("outbox should read")
+            .iter()
+            .any(|event| {
+                event.approval_id.as_deref() == Some(system.record.id.as_str())
+                    && event.actor_api_token_id.is_none()
+            })
+    );
+}
+
+#[tokio::test]
+async fn aggregate_ciphertext_caps_bound_active_and_terminal_disk_usage() {
+    let (_directory, _app, store, _clock) = approval_store().await;
+    let large = "x".repeat(7 * 1024 * 1024);
+    let mut ids = Vec::new();
+    for index in 0..4 {
+        let mut approval = new_approval(
+            &format!("execution-bytes-{index}"),
+            &format!("call-bytes-{index}"),
+        );
+        approval.arguments = json!({ "location": large });
+        approval.invocation_snapshot = json!(large);
+        let created = store
+            .create(approval)
+            .await
+            .expect("approval below aggregate byte cap should persist");
+        ids.push(created.record.id);
+    }
+    let mut over_cap = new_approval("execution-bytes-over", "call-bytes-over");
+    over_cap.arguments = json!({ "location": large });
+    over_cap.invocation_snapshot = json!(large);
+    assert!(matches!(
+        store.create(over_cap).await,
+        Err(ApprovalError::Capacity {
+            scope: "active_bytes"
+        })
+    ));
+
+    for (index, id) in ids.iter().enumerate().skip(1) {
+        store
+            .decide(
+                id,
+                &format!("deny-bytes-{index}"),
+                0,
+                ApprovalDecision::Deny,
+                1,
+            )
+            .await
+            .expect("large approval should be denied");
+    }
+    let mut newest = new_approval("execution-bytes-newest", "call-bytes-newest");
+    newest.arguments = json!({ "location": large });
+    newest.invocation_snapshot = json!(large);
+    let newest = store
+        .create(newest)
+        .await
+        .expect("terminal rows should not consume active byte capacity");
+    store
+        .decide(
+            &newest.record.id,
+            "deny-bytes-newest",
+            0,
+            ApprovalDecision::Deny,
+            1,
+        )
+        .await
+        .expect("newest large approval should be denied");
+    store
+        .decide(
+            &ids[0],
+            "deny-old-active-last",
+            0,
+            ApprovalDecision::Deny,
+            1,
+        )
+        .await
+        .expect("old active approval should be retained when it terminalizes last");
+    assert!(
+        store
+            .get_admin(&ids[1])
+            .await
+            .expect("oldest approval lookup should read")
+            .is_none()
+    );
+    assert!(
+        store
+            .get_admin(&ids[0])
+            .await
+            .expect("newly terminal old approval should read")
+            .is_some()
+    );
+    assert!(
+        store
+            .get_admin(&newest.record.id)
+            .await
+            .expect("newest approval lookup should read")
+            .is_some()
+    );
+    let outbox = store
+        .log_outbox(256)
+        .await
+        .expect("terminal log outbox should read");
+    assert!(
+        outbox
+            .iter()
+            .any(|event| event.approval_id.as_deref() == Some(ids[1].as_str())),
+        "terminal logging metadata must survive approval retention"
+    );
+}
+
+#[tokio::test]
+async fn delivery_pins_preserve_sixteen_large_results_until_each_waiter_copies_its_own_result() {
+    let (_directory, app, store, _clock) = approval_store().await;
+    let payload = "r".repeat(super::MAX_APPROVAL_RESULT_BYTES - 512);
+    let actor = ToolActor::api_token("token-1", Some("Automation".to_owned()));
+    let mut prepared = Vec::new();
+
+    for index in 0..16 {
+        let mut request = new_approval(
+            &format!("execution-large-result-{index}"),
+            &format!("call-large-result-{index}"),
+        );
+        request.worker_generation = 9;
+        let pending = store
+            .create(request)
+            .await
+            .expect("pinned approval should persist");
+        let approved = store
+            .decide(
+                &pending.record.id,
+                &format!("approve-large-result-{index}"),
+                pending.record.revision,
+                ApprovalDecision::Approve,
+                1,
+            )
+            .await
+            .expect("large result approval should be approved");
+        let executing = store
+            .claim_execution(&pending.record.id, 9, approved.record.revision)
+            .await
+            .expect("large result approval should execute");
+        let result = json!({ "index": index, "payload": payload });
+        prepared.push((pending.record, executing.record.revision, result));
+    }
+
+    let barrier = Arc::new(tokio::sync::Barrier::new(prepared.len() + 1));
+    let mut completions = Vec::new();
+    for (record, revision, result) in prepared {
+        let finish_store = store.clone();
+        let finish_barrier = barrier.clone();
+        completions.push(tokio::spawn(async move {
+            finish_barrier.wait().await;
+            finish_store
+                .finish(
+                    &record.id,
+                    revision,
+                    ExecutionOutcome::Succeeded,
+                    &result,
+                    None,
+                )
+                .await
+                .expect("concurrent large result should become terminal while pinned");
+            (record, result)
+        }));
+    }
+    barrier.wait().await;
+    let mut completed = Vec::new();
+    for completion in completions {
+        completed.push(
+            completion
+                .await
+                .expect("concurrent large result task should join"),
+        );
+    }
+
+    assert_eq!(
+        sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM approval_delivery_pins")
+            .fetch_one(app.pool())
+            .await
+            .expect("delivery pin count should read"),
+        16
+    );
+    for (record, expected) in &completed {
+        let copied = store
+            .get_for_actor(&record.id, &actor)
+            .await
+            .expect("pinned result should read")
+            .expect("pinned result must not be retained away");
+        assert_eq!(copied.result.as_ref(), Some(expected));
+    }
+    for (record, _) in &completed {
+        store
+            .release_delivery_pin(&super::ApprovalDeliveryIdentity {
+                approval_id: record.id.clone(),
+                actor: actor.clone(),
+                execution_id: record.execution_id.clone(),
+                call_id: record.call_id.clone(),
+            })
+            .await
+            .expect("copied result should become reclaimable");
+    }
+
+    assert_eq!(
+        sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM approval_delivery_pins")
+            .fetch_one(app.pool())
+            .await
+            .expect("delivery pins should read"),
+        0
+    );
+    let retained_bytes = sqlx::query_scalar::<_, i64>(
+        "SELECT COALESCE(SUM(length(arguments_ciphertext) \
+         + length(redacted_arguments_ciphertext) + length(input_schema_ciphertext) \
+         + COALESCE(length(output_schema_ciphertext), 0) \
+         + length(invocation_snapshot_ciphertext) + COALESCE(length(result_ciphertext), 0)), 0) \
+         FROM approvals WHERE status IN \
+         ('denied', 'expired', 'canceled', 'succeeded', 'failed', 'stale', 'interrupted')",
+    )
+    .fetch_one(app.pool())
+    .await
+    .expect("terminal ciphertext usage should read");
+    assert!(retained_bytes <= super::MAX_TERMINAL_APPROVAL_CIPHERTEXT_BYTES);
+    let mut evicted = 0;
+    for (record, _) in &completed {
+        if store
+            .get_admin(&record.id)
+            .await
+            .expect("reclaimed approval lookup should read")
+            .is_none()
+        {
+            evicted += 1;
+        }
+    }
+    assert!(evicted > 0);
+}
+
+#[tokio::test]
+async fn delivery_pin_retries_are_refcounted_bounded_and_cleared_by_recovery() {
+    let (_directory, app, store, _clock) = approval_store().await;
+    let actor = ToolActor::api_token("token-1", Some("Automation".to_owned()));
+    let mut retry_request = new_approval("execution-pin-retry", "call-pin-retry");
+    retry_request.worker_generation = 1;
+    let retried = store
+        .create(retry_request.clone())
+        .await
+        .expect("initial pinned approval should persist");
+    store
+        .create(retry_request)
+        .await
+        .expect("duplicate retry should acquire another delivery reference");
+    assert_eq!(
+        sqlx::query_scalar::<_, i64>(
+            "SELECT ref_count FROM approval_delivery_pins WHERE approval_id = ?",
+        )
+        .bind(&retried.record.id)
+        .fetch_one(app.pool())
+        .await
+        .expect("delivery refcount should read"),
+        2
+    );
+    let retry_identity = super::ApprovalDeliveryIdentity {
+        approval_id: retried.record.id.clone(),
+        actor: actor.clone(),
+        execution_id: retried.record.execution_id.clone(),
+        call_id: retried.record.call_id.clone(),
+    };
+    assert!(
+        store
+            .release_delivery_pin(&retry_identity)
+            .await
+            .expect("first retry reference should release")
+    );
+    assert!(
+        store
+            .release_delivery_pin(&retry_identity)
+            .await
+            .expect("second retry reference should release")
+    );
+    let mut pinned = Vec::new();
+    for index in 0..super::MAX_APPROVAL_DELIVERY_PINS {
+        let mut request = new_approval(
+            &format!("execution-pin-cap-{index}"),
+            &format!("call-pin-cap-{index}"),
+        );
+        request.worker_generation = 1;
+        let created = store
+            .create(request)
+            .await
+            .expect("approval below delivery pin cap should persist");
+        store
+            .decide(
+                &created.record.id,
+                &format!("deny-pin-cap-{index}"),
+                created.record.revision,
+                ApprovalDecision::Deny,
+                1,
+            )
+            .await
+            .expect("denial should free active approval capacity");
+        pinned.push(created.record);
+    }
+    let mut over_cap = new_approval("execution-pin-over-cap", "call-pin-over-cap");
+    over_cap.worker_generation = 1;
+    assert!(matches!(
+        store.create(over_cap).await,
+        Err(ApprovalError::Capacity {
+            scope: "delivery_pins"
+        })
+    ));
+
+    let first = &pinned[0];
+    let identity = super::ApprovalDeliveryIdentity {
+        approval_id: first.id.clone(),
+        actor,
+        execution_id: first.execution_id.clone(),
+        call_id: first.call_id.clone(),
+    };
+    assert!(
+        store
+            .release_delivery_pin(&identity)
+            .await
+            .expect("pin releases")
+    );
+    assert!(
+        !store
+            .release_delivery_pin(&identity)
+            .await
+            .expect("release replays")
+    );
+
+    store
+        .recover_startup()
+        .await
+        .expect("startup recovery should clear stale continuation pins");
+    assert_eq!(
+        sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM approval_delivery_pins")
+            .fetch_one(app.pool())
+            .await
+            .expect("delivery pins should read"),
+        0
+    );
+}
+
+#[tokio::test]
+async fn expiry_token_revocation_and_startup_recovery_are_durable() {
+    let (_directory, _app, store, clock) = approval_store().await;
+    let expiring = store
+        .create(new_approval("execution-expire", "call-expire"))
+        .await
+        .expect("expiring approval should persist");
+    clock.set(1_600);
+    assert_eq!(store.expire_pending().await.expect("expiry should run"), 1);
+    assert_eq!(
+        store
+            .get_admin(&expiring.record.id)
+            .await
+            .expect("approval should read")
+            .expect("approval should exist")
+            .record
+            .status,
+        ApprovalStatus::Expired
+    );
+    assert!(matches!(
+        store
+            .decide(
+                &expiring.record.id,
+                "decision-too-late",
+                expiring.record.revision,
+                ApprovalDecision::Approve,
+                1,
+            )
+            .await,
+        Err(ApprovalError::Expired)
+    ));
+
+    clock.set(2_000);
+    let mut interrupted_request = new_approval("execution-interrupted", "call-interrupted");
+    interrupted_request.worker_generation = 3;
+    let interrupted = store
+        .create(interrupted_request)
+        .await
+        .expect("interrupted approval should persist");
+    let interrupted = store
+        .decide(
+            &interrupted.record.id,
+            "decision-interrupted",
+            0,
+            ApprovalDecision::Approve,
+            1,
+        )
+        .await
+        .expect("approval should be accepted");
+    let interrupted = store
+        .claim_execution(&interrupted.record.id, 3, interrupted.record.revision)
+        .await
+        .expect("approval should execute");
+    let mut orphan_pending_request =
+        new_approval("execution-orphan-pending", "call-orphan-pending");
+    orphan_pending_request.worker_generation = 3;
+    let orphan_pending = store
+        .create(orphan_pending_request)
+        .await
+        .expect("orphan pending approval should persist");
+    let mut orphan_approved_request =
+        new_approval("execution-orphan-approved", "call-orphan-approved");
+    orphan_approved_request.worker_generation = 3;
+    let orphan_approved = store
+        .create(orphan_approved_request)
+        .await
+        .expect("orphan approved approval should persist");
+    let orphan_approved = store
+        .decide(
+            &orphan_approved.record.id,
+            "decision-orphan-approved",
+            0,
+            ApprovalDecision::Approve,
+            1,
+        )
+        .await
+        .expect("orphan approval should be accepted before restart");
+    let mut direct_approval = new_approval("execution-approved", "call-approved");
+    direct_approval.worker_generation = 0;
+    let recoverable = store
+        .create(direct_approval)
+        .await
+        .expect("recoverable approval should persist");
+    let recoverable = store
+        .decide(
+            &recoverable.record.id,
+            "decision-approved",
+            0,
+            ApprovalDecision::Approve,
+            1,
+        )
+        .await
+        .expect("approval should be accepted");
+    let recovery = store
+        .recover_startup()
+        .await
+        .expect("startup recovery should run");
+    assert_eq!(recovery.interrupted_count, 1);
+    assert_eq!(recovery.approved_ids, vec![recoverable.record.id.clone()]);
+    assert_eq!(
+        store
+            .get_admin(&orphan_pending.record.id)
+            .await
+            .expect("orphan pending should read")
+            .expect("orphan pending should exist")
+            .record
+            .status,
+        ApprovalStatus::Canceled
+    );
+    assert_eq!(
+        store
+            .get_admin(&orphan_approved.record.id)
+            .await
+            .expect("orphan approved should read")
+            .expect("orphan approved should exist")
+            .record
+            .status,
+        ApprovalStatus::Stale
+    );
+    assert_eq!(
+        store
+            .get_admin(&interrupted.record.id)
+            .await
+            .expect("approval should read")
+            .expect("approval should exist")
+            .record
+            .status,
+        ApprovalStatus::Interrupted
+    );
+
+    let revoked = store
+        .create(new_approval("execution-revoked", "call-revoked"))
+        .await
+        .expect("revoked-token approval should persist");
+    let retained = store
+        .create(new_approval("execution-retained", "call-retained"))
+        .await
+        .expect("executing approval should persist");
+    let retained = store
+        .decide(
+            &retained.record.id,
+            "decision-retained",
+            0,
+            ApprovalDecision::Approve,
+            1,
+        )
+        .await
+        .expect("executing approval should be accepted");
+    let retained = store
+        .claim_execution(&retained.record.id, 0, retained.record.revision)
+        .await
+        .expect("executing approval should start");
+    assert!(
+        store
+            .revoke_owner_token("token-1")
+            .await
+            .expect("atomic revocation should run")
+    );
+    assert!(
+        !store
+            .revoke_owner_token("token-1")
+            .await
+            .expect("repeat revocation should read")
+    );
+    assert_eq!(
+        store
+            .get_admin(&revoked.record.id)
+            .await
+            .expect("approval should read")
+            .expect("approval should exist")
+            .record
+            .status,
+        ApprovalStatus::Canceled
+    );
+    assert_eq!(
+        store
+            .get_admin(&retained.record.id)
+            .await
+            .expect("approval should read")
+            .expect("approval should exist")
+            .record
+            .status,
+        ApprovalStatus::Executing
+    );
+
+    let page = store
+        .list_admin(ApprovalListQuery {
+            limit: 2,
+            ..Default::default()
+        })
+        .await
+        .expect("approval page should list");
+    assert_eq!(page.items.len(), 2);
+    assert!(page.next_cursor.is_some());
+}
+
+#[tokio::test]
+async fn terminal_outbox_survives_restart_until_durable_log_acknowledgement() {
+    let (directory, app, store, _clock) = approval_store().await;
+    let pending = store
+        .create(new_approval("execution-restart-log", "call-restart-log"))
+        .await
+        .expect("restart approval should persist");
+    store
+        .decide(
+            &pending.record.id,
+            "direct-deny-before-restart",
+            pending.record.revision,
+            ApprovalDecision::Deny,
+            1,
+        )
+        .await
+        .expect("direct denial should commit its outbox event");
+    assert_eq!(
+        sqlx::query_scalar::<_, i64>(
+            "SELECT COUNT(*) FROM approval_log_outbox WHERE approval_id = ?",
+        )
+        .bind(&pending.record.id)
+        .fetch_one(app.pool())
+        .await
+        .expect("outbox count should read"),
+        1
+    );
+
+    drop(store);
+    drop(app);
+
+    let config = AppConfig::new(directory.path().to_path_buf());
+    let reopened = tokio::time::timeout(std::time::Duration::from_secs(2), async {
+        loop {
+            match ExecutorApp::open(config.clone()).await {
+                Ok(app) => break app,
+                Err(crate::DatabaseError::AlreadyRunning(_)) => {
+                    tokio::time::sleep(std::time::Duration::from_millis(10)).await;
+                }
+                Err(error) => panic!("Executor should reopen: {error}"),
+            }
+        }
+    })
+    .await
+    .expect("background request logger should release the instance lock");
+    wait_for_terminal_log(&reopened, &pending.record.id, "approval_denied").await;
+}
diff --git a/src/catalog/mod.rs b/src/catalog/mod.rs
new file mode 100644
index 000000000..c45c99dac
--- /dev/null
+++ b/src/catalog/mod.rs
@@ -0,0 +1,816 @@
+mod schema;
+mod search;
+pub(crate) mod source_idempotency;
+mod store;
+
+use std::{collections::BTreeMap, fmt, str::FromStr};
+
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+use thiserror::Error;
+
+use crate::crypto::CryptoError;
+use crate::graphql::GraphqlBindingV1;
+use crate::openapi::OpenApiBinding;
+
+pub use store::CatalogStore;
+
+pub const DEFAULT_PAGE_LIMIT: u32 = 50;
+pub const MAX_PAGE_LIMIT: u32 = 100;
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum AuditActor {
+    System,
+    Admin { id: i64 },
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct AuditContext<'a> {
+    request_id: Option<&'a str>,
+    actor: AuditActor,
+    source_creation_idempotency: Option<&'a source_idempotency::SourceCreationReservation>,
+}
+
+impl<'a> AuditContext<'a> {
+    pub const fn system(request_id: Option<&'a str>) -> Self {
+        Self {
+            request_id,
+            actor: AuditActor::System,
+            source_creation_idempotency: None,
+        }
+    }
+
+    pub const fn admin(request_id: &'a str, id: i64) -> Self {
+        Self {
+            request_id: Some(request_id),
+            actor: AuditActor::Admin { id },
+            source_creation_idempotency: None,
+        }
+    }
+
+    pub(crate) const fn with_source_creation_idempotency(
+        mut self,
+        reservation: &'a source_idempotency::SourceCreationReservation,
+    ) -> Self {
+        self.source_creation_idempotency = Some(reservation);
+        self
+    }
+
+    pub(crate) const fn request_id(self) -> Option<&'a str> {
+        self.request_id
+    }
+
+    pub(crate) const fn actor_admin_id(self) -> Option<i64> {
+        match self.actor {
+            AuditActor::System => None,
+            AuditActor::Admin { id } => Some(id),
+        }
+    }
+
+    pub(crate) const fn source_creation_idempotency(
+        self,
+    ) -> Option<&'a source_idempotency::SourceCreationReservation> {
+        self.source_creation_idempotency
+    }
+
+    pub(crate) fn source_creation_idempotency_id(self) -> Option<&'a str> {
+        self.source_creation_idempotency
+            .map(source_idempotency::SourceCreationReservation::id)
+    }
+}
+
+#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum SourceKind {
+    Openapi,
+    Graphql,
+    McpHttp,
+    McpStdio,
+}
+
+impl SourceKind {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::Openapi => "openapi",
+            Self::Graphql => "graphql",
+            Self::McpHttp => "mcp_http",
+            Self::McpStdio => "mcp_stdio",
+        }
+    }
+}
+
+impl fmt::Display for SourceKind {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(self.as_str())
+    }
+}
+
+impl FromStr for SourceKind {
+    type Err = CatalogError;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        match value {
+            "openapi" => Ok(Self::Openapi),
+            "graphql" => Ok(Self::Graphql),
+            "mcp_http" => Ok(Self::McpHttp),
+            "mcp_stdio" => Ok(Self::McpStdio),
+            _ => Err(CatalogError::CorruptData("unknown source kind")),
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum SourceHealth {
+    Unknown,
+    Healthy,
+    Error,
+}
+
+impl FromStr for SourceHealth {
+    type Err = CatalogError;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        match value {
+            "unknown" => Ok(Self::Unknown),
+            "healthy" => Ok(Self::Healthy),
+            "error" => Ok(Self::Error),
+            _ => Err(CatalogError::CorruptData("unknown source health")),
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum ArtifactKind {
+    OpenapiDocument,
+    GraphqlSchema,
+    McpCapabilities,
+    Metadata,
+}
+
+impl ArtifactKind {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::OpenapiDocument => "openapi_document",
+            Self::GraphqlSchema => "graphql_schema",
+            Self::McpCapabilities => "mcp_capabilities",
+            Self::Metadata => "metadata",
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum ToolMode {
+    Enabled,
+    Ask,
+    Disabled,
+}
+
+impl ToolMode {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::Enabled => "enabled",
+            Self::Ask => "ask",
+            Self::Disabled => "disabled",
+        }
+    }
+}
+
+impl fmt::Display for ToolMode {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(self.as_str())
+    }
+}
+
+impl FromStr for ToolMode {
+    type Err = CatalogError;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        match value {
+            "enabled" => Ok(Self::Enabled),
+            "ask" => Ok(Self::Ask),
+            "disabled" => Ok(Self::Disabled),
+            _ => Err(CatalogError::CorruptData("unknown tool mode")),
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum ModeProvenance {
+    ToolOverride,
+    SourceOverride,
+    Intrinsic,
+}
+
+#[derive(Clone, Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct EffectiveMode {
+    pub mode: ToolMode,
+    pub provenance: ModeProvenance,
+}
+
+#[derive(Clone, Debug)]
+pub struct CreateSource {
+    pub kind: SourceKind,
+    pub preferred_slug: String,
+    pub display_name: String,
+    pub description: Option<String>,
+    pub configuration: serde_json::Map<String, Value>,
+}
+
+#[derive(Clone, Debug)]
+pub struct UpdateSource {
+    pub display_name: String,
+    pub description: Option<String>,
+    pub configuration: serde_json::Map<String, Value>,
+    pub expected_revision: i64,
+}
+
+#[derive(Clone, Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SourceRecord {
+    pub id: String,
+    pub kind: SourceKind,
+    pub slug: String,
+    pub display_name: String,
+    pub description: Option<String>,
+    pub configuration: serde_json::Map<String, Value>,
+    pub mode_override: Option<ToolMode>,
+    pub health_status: SourceHealth,
+    pub health_error_code: Option<String>,
+    pub revision: i64,
+    pub catalog_revision: i64,
+    pub created_at: i64,
+    pub updated_at: i64,
+    pub last_refreshed_at: Option<i64>,
+    pub tool_count: i64,
+    pub tombstoned_tool_count: i64,
+}
+
+#[derive(Clone, Debug)]
+pub struct StagedTool {
+    pub stable_key: String,
+    pub preferred_name: String,
+    pub display_name: String,
+    pub description: Option<String>,
+    pub input_schema: Value,
+    pub output_schema: Option<Value>,
+    pub input_typescript: Option<String>,
+    pub output_typescript: Option<String>,
+    pub typescript_definitions: BTreeMap<String, String>,
+    pub intrinsic_mode: ToolMode,
+}
+
+#[derive(Clone, Debug)]
+pub struct InitialCatalogSnapshot {
+    pub artifacts: Vec<StagedArtifact>,
+    pub tools: Vec<StagedTool>,
+}
+
+#[derive(Clone, Debug)]
+pub struct CatalogSnapshot {
+    pub expected_source_revision: i64,
+    pub expected_credential_revision: Option<i64>,
+    pub artifacts: Vec<StagedArtifact>,
+    pub tools: Vec<StagedTool>,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub enum OAuthBindingExpectation {
+    Absent {
+        credential_key: String,
+    },
+    Exact {
+        credential_key: String,
+        connection_id: String,
+        config_revision: i64,
+    },
+}
+
+#[derive(Clone, Debug)]
+pub struct StagedArtifact {
+    pub kind: ArtifactKind,
+    pub stable_key: String,
+    pub content: Value,
+}
+
+#[derive(Clone, Debug)]
+pub struct StagedToolBinding {
+    pub stable_key: String,
+    pub binding: ToolBinding,
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(tag = "kind", content = "definition", rename_all = "snake_case")]
+pub enum ToolBinding {
+    OpenapiV1(OpenApiBinding),
+    GraphqlV1(GraphqlBindingV1),
+    McpHttpV1(McpToolBindingV1),
+    McpStdioV1(McpToolBindingV1),
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(deny_unknown_fields, rename_all = "camelCase")]
+pub struct McpToolBindingV1 {
+    pub version: u32,
+    pub tool_name: String,
+}
+
+impl ToolBinding {
+    pub const fn protocol(&self) -> &'static str {
+        match self {
+            Self::OpenapiV1(_) => "openapi",
+            Self::GraphqlV1(_) => "graphql",
+            Self::McpHttpV1(_) => "mcp_http",
+            Self::McpStdioV1(_) => "mcp_stdio",
+        }
+    }
+
+    pub const fn version(&self) -> i64 {
+        match self {
+            Self::OpenapiV1(_) => 1,
+            Self::GraphqlV1(_) | Self::McpHttpV1(_) | Self::McpStdioV1(_) => 1,
+        }
+    }
+
+    pub fn openapi(&self) -> Option<&OpenApiBinding> {
+        match self {
+            Self::OpenapiV1(binding) => Some(binding),
+            Self::GraphqlV1(_) | Self::McpHttpV1(_) | Self::McpStdioV1(_) => None,
+        }
+    }
+
+    pub fn graphql(&self) -> Option<&GraphqlBindingV1> {
+        match self {
+            Self::GraphqlV1(binding) => Some(binding),
+            Self::OpenapiV1(_) | Self::McpHttpV1(_) | Self::McpStdioV1(_) => None,
+        }
+    }
+
+    pub fn mcp(&self) -> Option<&McpToolBindingV1> {
+        match self {
+            Self::McpHttpV1(binding) | Self::McpStdioV1(binding) => Some(binding),
+            Self::OpenapiV1(_) | Self::GraphqlV1(_) => None,
+        }
+    }
+
+    pub(crate) fn decode(
+        protocol: &str,
+        version: i64,
+        definition_json: &str,
+    ) -> Result<Self, CatalogError> {
+        match (protocol, version) {
+            ("openapi", 1) => {
+                let binding: OpenApiBinding = serde_json::from_str(definition_json)?;
+                if binding.version != 1 {
+                    return Err(CatalogError::CorruptData(
+                        "unsupported OpenAPI binding version",
+                    ));
+                }
+                Ok(Self::OpenapiV1(binding))
+            }
+            ("graphql", 1) => {
+                let binding: GraphqlBindingV1 = serde_json::from_str(definition_json)?;
+                binding.validate().map_err(|_| {
+                    CatalogError::CorruptData("unsupported or invalid GraphQL binding")
+                })?;
+                Ok(Self::GraphqlV1(binding))
+            }
+            ("mcp_http", 1) | ("mcp_stdio", 1) => {
+                let binding: McpToolBindingV1 = serde_json::from_str(definition_json)?;
+                if !valid_mcp_binding(&binding) {
+                    return Err(CatalogError::CorruptData(
+                        "unsupported MCP binding version or tool name",
+                    ));
+                }
+                Ok(if protocol == "mcp_http" {
+                    Self::McpHttpV1(binding)
+                } else {
+                    Self::McpStdioV1(binding)
+                })
+            }
+            _ => Err(CatalogError::CorruptData(
+                "unknown tool binding protocol or version",
+            )),
+        }
+    }
+}
+
+fn valid_mcp_binding(binding: &McpToolBindingV1) -> bool {
+    binding.version == 1
+        && !binding.tool_name.is_empty()
+        && binding.tool_name.chars().count() <= 128
+        && binding.tool_name.trim() == binding.tool_name
+        && !binding.tool_name.chars().any(char::is_control)
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct StoredToolBinding {
+    pub tool_id: String,
+    pub source_id: String,
+    pub revision: i64,
+    pub binding: ToolBinding,
+}
+
+#[derive(Clone, Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct CatalogSyncResult {
+    pub source_id: String,
+    pub source_revision: i64,
+    pub catalog_revision: i64,
+    pub global_revision: i64,
+    pub active_tool_count: usize,
+    pub tombstoned_tool_count: usize,
+}
+
+#[derive(Clone, Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ToolSummary {
+    pub id: String,
+    pub source_id: String,
+    pub source_slug: String,
+    pub stable_key: String,
+    pub local_name: String,
+    pub callable_path: String,
+    pub sandbox_path: String,
+    pub display_name: String,
+    pub description: Option<String>,
+    pub intrinsic_mode: ToolMode,
+    pub mode_override: Option<ToolMode>,
+    pub effective_mode: EffectiveMode,
+    pub present: bool,
+    pub revision: i64,
+    pub created_at: i64,
+    pub updated_at: i64,
+    pub last_seen_at: i64,
+    pub tombstoned_at: Option<i64>,
+}
+
+#[derive(Clone, Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ToolRecord {
+    pub id: String,
+    pub source_id: String,
+    pub source_slug: String,
+    pub stable_key: String,
+    pub local_name: String,
+    pub callable_path: String,
+    pub sandbox_path: String,
+    pub display_name: String,
+    pub description: Option<String>,
+    pub input_schema: Value,
+    pub output_schema: Option<Value>,
+    pub input_typescript: Option<String>,
+    pub output_typescript: Option<String>,
+    pub typescript_definitions: BTreeMap<String, String>,
+    pub intrinsic_mode: ToolMode,
+    pub mode_override: Option<ToolMode>,
+    pub effective_mode: EffectiveMode,
+    pub present: bool,
+    pub revision: i64,
+    pub created_at: i64,
+    pub updated_at: i64,
+    pub last_seen_at: i64,
+    pub tombstoned_at: Option<i64>,
+}
+
+#[derive(Clone, Debug, Default)]
+pub struct ListToolsFilter {
+    pub query: Option<String>,
+    pub source_id: Option<String>,
+    pub effective_mode: Option<ToolMode>,
+    pub include_tombstoned: bool,
+    pub limit: u32,
+    pub offset: u32,
+}
+
+#[derive(Clone, Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ToolPage {
+    pub items: Vec<ToolSummary>,
+    pub total: usize,
+    pub has_more: bool,
+    pub next_offset: Option<usize>,
+    pub catalog_revision: i64,
+}
+
+#[derive(Clone, Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct BulkToolModeResult {
+    pub updated_count: usize,
+    pub catalog_revision: i64,
+    pub source_revisions: std::collections::BTreeMap<String, i64>,
+}
+
+#[derive(Clone, Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ToolDiscoveryResult {
+    pub path: String,
+    pub name: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub description: Option<String>,
+    pub integration: String,
+    pub score: i64,
+    pub effective_mode: ToolMode,
+    pub requires_approval: bool,
+}
+
+#[derive(Clone, Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct DiscoveryPage {
+    pub items: Vec<ToolDiscoveryResult>,
+    pub total: usize,
+    pub has_more: bool,
+    pub next_offset: Option<usize>,
+}
+
+#[derive(Clone, Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct DescribedTool {
+    pub path: String,
+    pub name: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub description: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub input_typescript: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub output_typescript: Option<String>,
+    pub type_script_definitions: BTreeMap<String, String>,
+    pub input_schema: Value,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub output_schema: Option<Value>,
+    pub effective_mode: EffectiveMode,
+}
+
+#[derive(Clone, Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct InvocationLookup {
+    pub tool_id: String,
+    pub source_id: String,
+    pub source_display_name: String,
+    pub tool_display_name: String,
+    pub callable_path: String,
+    pub sandbox_path: String,
+    pub effective_mode: ToolMode,
+    pub mode_provenance: ModeProvenance,
+    pub requires_approval: bool,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct InvocationRevisionToken {
+    pub source_id: String,
+    pub tool_id: String,
+    pub source_revision: i64,
+    pub catalog_revision: i64,
+    pub tool_revision: i64,
+    pub binding_revision: i64,
+    pub credential_revision: Option<i64>,
+}
+
+pub struct InvocationLease {
+    pub(crate) lookup: InvocationLookup,
+    pub(crate) revisions: InvocationRevisionToken,
+    pub(crate) source_kind: SourceKind,
+    pub(crate) binding: ToolBinding,
+    pub(crate) input_schema: Value,
+    pub(crate) input_validator: jsonschema::Validator,
+    pub(crate) source_configuration: serde_json::Map<String, Value>,
+    pub(crate) credential: Option<StoredCredential>,
+    pub(crate) _guard: tokio::sync::OwnedRwLockReadGuard<()>,
+}
+
+pub struct InvocationPreflight {
+    lookup: InvocationLookup,
+    revisions: InvocationRevisionToken,
+    input_schema: Value,
+    input_validator: jsonschema::Validator,
+    _guard: tokio::sync::OwnedRwLockReadGuard<()>,
+}
+
+impl InvocationPreflight {
+    pub fn lookup(&self) -> &InvocationLookup {
+        &self.lookup
+    }
+
+    pub fn revisions(&self) -> &InvocationRevisionToken {
+        &self.revisions
+    }
+
+    pub fn input_schema(&self) -> &Value {
+        &self.input_schema
+    }
+
+    pub fn arguments_are_valid(&self, arguments: &Value) -> bool {
+        self.input_validator.is_valid(arguments)
+    }
+}
+
+impl InvocationLease {
+    pub fn lookup(&self) -> &InvocationLookup {
+        &self.lookup
+    }
+
+    pub fn revisions(&self) -> &InvocationRevisionToken {
+        &self.revisions
+    }
+
+    pub const fn source_kind(&self) -> SourceKind {
+        self.source_kind
+    }
+
+    pub fn binding(&self) -> &ToolBinding {
+        &self.binding
+    }
+
+    pub fn input_schema(&self) -> &Value {
+        &self.input_schema
+    }
+
+    pub fn arguments_are_valid(&self, arguments: &Value) -> bool {
+        self.input_validator.is_valid(arguments)
+    }
+
+    pub fn source_configuration(&self) -> &serde_json::Map<String, Value> {
+        &self.source_configuration
+    }
+
+    pub fn credential(&self) -> Option<&StoredCredential> {
+        self.credential.as_ref()
+    }
+}
+
+impl Drop for InvocationLease {
+    fn drop(&mut self) {}
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct CredentialPayload {
+    pub schema_version: u32,
+    pub payload: Value,
+}
+
+#[derive(Clone, Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct StoredCredential {
+    pub revision: i64,
+    pub credential: CredentialPayload,
+}
+
+#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum RequestSurface {
+    Admin,
+    Gateway,
+    Cli,
+    Mcp,
+}
+
+impl RequestSurface {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::Admin => "admin",
+            Self::Gateway => "gateway",
+            Self::Cli => "cli",
+            Self::Mcp => "mcp",
+        }
+    }
+}
+
+impl FromStr for RequestSurface {
+    type Err = CatalogError;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        match value {
+            "admin" => Ok(Self::Admin),
+            "gateway" => Ok(Self::Gateway),
+            "cli" => Ok(Self::Cli),
+            "mcp" => Ok(Self::Mcp),
+            _ => Err(CatalogError::CorruptData("unknown request surface")),
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum RequestOutcome {
+    Succeeded,
+    Failed,
+    PendingApproval,
+    Denied,
+}
+
+impl RequestOutcome {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::Succeeded => "succeeded",
+            Self::Failed => "failed",
+            Self::PendingApproval => "pending_approval",
+            Self::Denied => "denied",
+        }
+    }
+}
+
+impl FromStr for RequestOutcome {
+    type Err = CatalogError;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        match value {
+            "succeeded" => Ok(Self::Succeeded),
+            "failed" => Ok(Self::Failed),
+            "pending_approval" => Ok(Self::PendingApproval),
+            "denied" => Ok(Self::Denied),
+            _ => Err(CatalogError::CorruptData("unknown request outcome")),
+        }
+    }
+}
+
+#[derive(Clone, Debug)]
+pub struct NewRequestLog {
+    pub request_id: String,
+    pub actor_api_token_id: Option<String>,
+    pub surface: RequestSurface,
+    pub source_id: Option<String>,
+    pub tool_id: Option<String>,
+    pub path_snapshot: Option<String>,
+    pub outcome: RequestOutcome,
+    pub error_code: Option<String>,
+    pub duration_ms: u64,
+    pub approval_id: Option<String>,
+    pub created_at: i64,
+}
+
+#[derive(Clone, Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct RequestLogRecord {
+    pub request_id: String,
+    pub actor_api_token_id: Option<String>,
+    pub surface: RequestSurface,
+    pub source_id: Option<String>,
+    pub tool_id: Option<String>,
+    pub path_snapshot: Option<String>,
+    pub outcome: RequestOutcome,
+    pub error_code: Option<String>,
+    pub duration_ms: i64,
+    pub approval_id: Option<String>,
+    pub created_at: i64,
+}
+
+#[derive(Clone, Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct RequestLogPage {
+    pub items: Vec<RequestLogRecord>,
+    pub next_cursor: Option<String>,
+}
+
+#[derive(Debug, Error)]
+pub enum CatalogError {
+    #[error("catalog storage failed: {0}")]
+    Database(#[from] sqlx::Error),
+    #[error("credential protection failed: {0}")]
+    Crypto(#[from] CryptoError),
+    #[error("catalog payload encoding failed: {0}")]
+    Json(#[from] serde_json::Error),
+    #[error("{message}")]
+    Validation { code: &'static str, message: String },
+    #[error("{entity} was not found")]
+    NotFound { entity: &'static str },
+    #[error("{scope} revision conflict: expected {expected}, found {actual}")]
+    RevisionConflict {
+        scope: &'static str,
+        expected: i64,
+        actual: i64,
+    },
+    #[error("tool not found: {path}")]
+    ToolNotFound { path: String },
+    #[error("tool disabled: {path}")]
+    ToolDisabled { path: String },
+    #[error("stored catalog data is invalid: {0}")]
+    CorruptData(&'static str),
+}
+
+pub(crate) fn effective_mode(
+    intrinsic: ToolMode,
+    source_override: Option<ToolMode>,
+    tool_override: Option<ToolMode>,
+) -> EffectiveMode {
+    if let Some(mode) = tool_override {
+        EffectiveMode {
+            mode,
+            provenance: ModeProvenance::ToolOverride,
+        }
+    } else if let Some(mode) = source_override {
+        EffectiveMode {
+            mode,
+            provenance: ModeProvenance::SourceOverride,
+        }
+    } else {
+        EffectiveMode {
+            mode: intrinsic,
+            provenance: ModeProvenance::Intrinsic,
+        }
+    }
+}
diff --git a/src/catalog/schema.rs b/src/catalog/schema.rs
new file mode 100644
index 000000000..0b84479b0
--- /dev/null
+++ b/src/catalog/schema.rs
@@ -0,0 +1,103 @@
+use std::error::Error;
+
+use jsonschema::{Draft, PatternOptions, Retrieve, Uri, Validator};
+use serde_json::Value;
+
+const REGEX_SIZE_LIMIT: usize = 1024 * 1024;
+const REGEX_DFA_SIZE_LIMIT: usize = 1024 * 1024;
+
+#[derive(Debug)]
+struct NoExternalSchemas;
+
+impl Retrieve for NoExternalSchemas {
+    fn retrieve(&self, uri: &Uri<String>) -> Result<Value, Box<dyn Error + Send + Sync>> {
+        Err(format!("external JSON Schema reference is disabled: {uri}").into())
+    }
+}
+
+pub(super) fn compile(schema: &Value) -> Result<Validator, ()> {
+    jsonschema::options()
+        .with_draft(Draft::Draft202012)
+        .with_retriever(NoExternalSchemas)
+        .with_pattern_options(
+            PatternOptions::regex()
+                .size_limit(REGEX_SIZE_LIMIT)
+                .dfa_size_limit(REGEX_DFA_SIZE_LIMIT),
+        )
+        .should_validate_formats(false)
+        .build(schema)
+        .map_err(|_| ())
+}
+
+#[cfg(test)]
+mod tests {
+    use serde_json::{Value, json};
+
+    use super::compile;
+
+    #[test]
+    fn validates_full_argument_constraints_and_openapi_nullable() {
+        let schema = json!({
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["name", "count", "mode", "tags", "maybe"],
+            "properties": {
+                "name": { "type": "string", "pattern": "^[A-Z][a-z]+$" },
+                "count": { "type": "integer" },
+                "mode": { "enum": ["safe", "fast"] },
+                "tags": { "type": "array", "items": { "type": "string" }, "uniqueItems": true },
+                "maybe": { "type": ["string", "null"] }
+            }
+        });
+        let validator = compile(&schema).expect("schema should compile");
+        assert!(validator.is_valid(&json!({
+            "name": "Ada", "count": 1.0, "mode": "safe", "tags": ["a", "b"], "maybe": null
+        })));
+        assert!(!validator.is_valid(&json!({
+            "name": "ada", "count": 1, "mode": "safe", "tags": ["a", "b"], "maybe": null
+        })));
+        assert!(!validator.is_valid(&json!({
+            "name": "Ada", "count": 1.5, "mode": "safe", "tags": ["a", "b"], "maybe": null
+        })));
+        assert!(!validator.is_valid(&json!({
+            "name": "Ada", "count": 1, "mode": "other", "tags": ["a", "b"], "maybe": null
+        })));
+        assert!(!validator.is_valid(&json!({
+            "name": "Ada", "count": 1, "mode": "safe", "tags": ["a", "a"], "maybe": null
+        })));
+        assert!(!validator.is_valid(&json!({
+            "name": "Ada", "count": 1, "mode": "safe", "tags": ["a"], "maybe": null, "extra": true
+        })));
+    }
+
+    #[test]
+    fn rejects_external_retrieval_and_handles_bounded_depth() {
+        assert!(compile(&json!({ "$ref": "https://schemas.example.test/external.json" })).is_err());
+
+        let mut schema = json!({ "type": "string" });
+        let mut instance = json!("leaf");
+        for _ in 0..64 {
+            schema = json!({ "type": "array", "items": schema, "maxItems": 1 });
+            instance = json!([instance]);
+        }
+        let validator = compile(&schema).expect("bounded imported schema depth should compile");
+        assert!(validator.is_valid(&instance));
+    }
+
+    #[test]
+    fn nullable_type_union_does_not_bypass_enum_constraints() {
+        let without_null = compile(&json!({
+            "type": ["string", "null"],
+            "enum": ["allowed"]
+        }))
+        .expect("schema should compile");
+        assert!(!without_null.is_valid(&Value::Null));
+
+        let with_null = compile(&json!({
+            "type": ["string", "null"],
+            "enum": ["allowed", null]
+        }))
+        .expect("schema should compile");
+        assert!(with_null.is_valid(&Value::Null));
+    }
+}
diff --git a/src/catalog/search.rs b/src/catalog/search.rs
new file mode 100644
index 000000000..aa393e937
--- /dev/null
+++ b/src/catalog/search.rs
@@ -0,0 +1,383 @@
+use std::collections::{BTreeSet, HashSet};
+
+use super::{DiscoveryPage, ToolDiscoveryResult, ToolSummary};
+
+const PATH_WEIGHT: i64 = 12;
+const INTEGRATION_WEIGHT: i64 = 8;
+const NAME_WEIGHT: i64 = 10;
+const DESCRIPTION_WEIGHT: i64 = 5;
+const MAX_GENERATED_TRIGRAM_TERMS: usize = 1_024;
+
+pub(super) struct CandidateExpressions {
+    pub(super) word: String,
+    pub(super) trigram: Option<String>,
+    pub(super) short_bigram: Option<String>,
+    pub(super) short_unigram: String,
+}
+
+pub(super) fn candidate_expressions(query: &str) -> Option<CandidateExpressions> {
+    let mut tokens = tokenize(query);
+    tokens.sort_unstable();
+    tokens.dedup();
+    if tokens.is_empty() {
+        return None;
+    }
+
+    let word = tokens
+        .iter()
+        .map(|token| format!(r#""{token}"*"#))
+        .collect::<Vec<_>>()
+        .join(" OR ");
+    let mut trigram_terms = BTreeSet::new();
+    let mut bigram_terms = BTreeSet::new();
+    let mut unigram_terms = BTreeSet::new();
+    for token in &tokens {
+        let bytes = token.as_bytes();
+        if let Some(first) = bytes.first() {
+            unigram_terms.insert(encode_short_gram(std::slice::from_ref(first)));
+        }
+        if bytes.len() >= 2 {
+            bigram_terms.insert(encode_short_gram(&bytes[..2]));
+        }
+        for end in 3..=bytes.len() {
+            if trigram_terms.len() == MAX_GENERATED_TRIGRAM_TERMS {
+                break;
+            }
+            trigram_terms.insert(token[..end].to_owned());
+        }
+    }
+
+    Some(CandidateExpressions {
+        word,
+        trigram: quoted_terms(trigram_terms),
+        short_bigram: quoted_terms(bigram_terms),
+        short_unigram: quoted_terms(unigram_terms).expect("a nonempty search token has a unigram"),
+    })
+}
+
+pub(super) fn namespace_prefix(namespace: Option<&str>) -> Option<String> {
+    let tokens = tokenize(namespace?);
+    (!tokens.is_empty()).then(|| tokens.join(" "))
+}
+
+pub(super) fn normalize_for_index(value: &str) -> String {
+    normalize(value)
+}
+
+pub(super) fn query_tokens(value: &str) -> Vec<String> {
+    tokenize(value)
+}
+
+pub(super) fn short_gram_document(values: &[&str]) -> String {
+    let mut grams = BTreeSet::new();
+    for value in values {
+        for token in tokenize(value) {
+            let bytes = token.as_bytes();
+            for byte in bytes {
+                grams.insert(encode_short_gram(std::slice::from_ref(byte)));
+            }
+            for gram in bytes.windows(2) {
+                grams.insert(encode_short_gram(gram));
+            }
+        }
+    }
+    grams.into_iter().collect::<Vec<_>>().join(" ")
+}
+
+fn quoted_terms(terms: BTreeSet<String>) -> Option<String> {
+    (!terms.is_empty()).then(|| {
+        terms
+            .into_iter()
+            .map(|term| format!(r#""{term}""#))
+            .collect::<Vec<_>>()
+            .join(" OR ")
+    })
+}
+
+fn encode_short_gram(gram: &[u8]) -> String {
+    const HEX: &[u8; 16] = b"0123456789abcdef";
+    let mut encoded = String::with_capacity(2 + gram.len() * 2);
+    encoded.push('g');
+    encoded.push(char::from(b'0' + gram.len() as u8));
+    for byte in gram {
+        encoded.push(char::from(HEX[usize::from(byte >> 4)]));
+        encoded.push(char::from(HEX[usize::from(byte & 0x0f)]));
+    }
+    encoded
+}
+
+struct PreparedField {
+    raw: String,
+    tokens: Vec<String>,
+}
+
+struct FieldScore {
+    score: i64,
+    matched_tokens: HashSet<String>,
+    exact_phrase_match: bool,
+}
+
+pub(super) fn search(
+    tools: &[ToolSummary],
+    query: &str,
+    namespace: Option<&str>,
+    limit: usize,
+    offset: usize,
+) -> DiscoveryPage {
+    let normalized_query = normalize(query);
+    let query_tokens = tokenize(query);
+    if normalized_query.is_empty() || query_tokens.is_empty() {
+        return DiscoveryPage {
+            items: Vec::new(),
+            total: 0,
+            has_more: false,
+            next_offset: None,
+        };
+    }
+
+    let mut ranked = tools
+        .iter()
+        .filter(|tool| namespace_matches(tool, namespace))
+        .filter_map(|tool| score_tool(tool, &normalized_query, &query_tokens))
+        .collect::<Vec<_>>();
+    ranked.sort_by(|left, right| {
+        right
+            .score
+            .cmp(&left.score)
+            .then_with(|| left.path.cmp(&right.path))
+    });
+
+    let total = ranked.len();
+    let start = offset.min(total);
+    let items = ranked
+        .into_iter()
+        .skip(start)
+        .take(limit)
+        .collect::<Vec<_>>();
+    let consumed = start + items.len();
+    let has_more = consumed < total;
+    DiscoveryPage {
+        items,
+        total,
+        has_more,
+        next_offset: has_more.then_some(consumed),
+    }
+}
+
+fn score_tool(
+    tool: &ToolSummary,
+    normalized_query: &str,
+    query_tokens: &[String],
+) -> Option<ToolDiscoveryResult> {
+    let path = prepare(&tool.sandbox_path);
+    let integration = prepare(&tool.source_slug);
+    let name = prepare(&tool.local_name);
+    let description = prepare(tool.description.as_deref().unwrap_or_default());
+    let fields = [
+        score_field(normalized_query, query_tokens, &path, PATH_WEIGHT),
+        score_field(
+            normalized_query,
+            query_tokens,
+            &integration,
+            INTEGRATION_WEIGHT,
+        ),
+        score_field(normalized_query, query_tokens, &name, NAME_WEIGHT),
+        score_field(
+            normalized_query,
+            query_tokens,
+            &description,
+            DESCRIPTION_WEIGHT,
+        ),
+    ];
+
+    let mut score = 0_i64;
+    let mut matched_tokens = HashSet::new();
+    let mut exact_phrase_match = false;
+    for field in fields {
+        score += field.score;
+        exact_phrase_match |= field.exact_phrase_match;
+        matched_tokens.extend(field.matched_tokens);
+    }
+    if matched_tokens.is_empty() {
+        return None;
+    }
+
+    let coverage = matched_tokens.len() as f64 / query_tokens.len() as f64;
+    let minimum_coverage = if query_tokens.len() <= 2 { 1.0 } else { 0.6 };
+    if coverage < minimum_coverage && !exact_phrase_match {
+        return None;
+    }
+    if coverage == 1.0 {
+        score += 25;
+    } else {
+        score += (coverage * 10.0).round() as i64;
+    }
+    if path.tokens.first() == query_tokens.first() || name.tokens.first() == query_tokens.first() {
+        score += 8;
+    }
+    if path.raw == normalized_query || name.raw == normalized_query {
+        score += 20;
+    }
+
+    Some(ToolDiscoveryResult {
+        path: tool.sandbox_path.clone(),
+        name: tool.local_name.clone(),
+        description: tool.description.clone(),
+        integration: tool.source_slug.clone(),
+        score,
+        effective_mode: tool.effective_mode.mode,
+        requires_approval: tool.effective_mode.mode == super::ToolMode::Ask,
+    })
+}
+
+fn score_field(
+    query: &str,
+    query_tokens: &[String],
+    field: &PreparedField,
+    weight: i64,
+) -> FieldScore {
+    if field.raw.is_empty() {
+        return FieldScore {
+            score: 0,
+            matched_tokens: HashSet::new(),
+            exact_phrase_match: false,
+        };
+    }
+
+    let mut score = 0_i64;
+    let mut matched_tokens = HashSet::new();
+    let exact_phrase_match = !query.is_empty() && field.raw.contains(query);
+    if !query.is_empty() {
+        if field.raw == query {
+            score += weight * 14;
+        } else if field.raw.starts_with(query) {
+            score += weight * 9;
+        } else if exact_phrase_match {
+            score += weight * 6;
+        }
+    }
+
+    for token in query_tokens {
+        if field.tokens.contains(token) {
+            score += weight * 4;
+            matched_tokens.insert(token.clone());
+        } else if field
+            .tokens
+            .iter()
+            .any(|candidate| candidate.starts_with(token) || token.starts_with(candidate))
+        {
+            score += weight * 2;
+            matched_tokens.insert(token.clone());
+        } else if field.raw.contains(token) {
+            score += weight;
+            matched_tokens.insert(token.clone());
+        }
+    }
+
+    FieldScore {
+        score,
+        matched_tokens,
+        exact_phrase_match,
+    }
+}
+
+fn namespace_matches(tool: &ToolSummary, namespace: Option<&str>) -> bool {
+    let Some(namespace) = namespace else {
+        return true;
+    };
+    if normalize(namespace).is_empty() {
+        return true;
+    }
+    let namespace_tokens = tokenize(namespace);
+    if namespace_tokens.is_empty() {
+        return true;
+    }
+
+    prefix_matches(&tokenize(&tool.source_slug), &namespace_tokens)
+        || prefix_matches(&tokenize(&tool.sandbox_path), &namespace_tokens)
+}
+
+fn prefix_matches(candidate: &[String], prefix: &[String]) -> bool {
+    prefix
+        .iter()
+        .enumerate()
+        .all(|(index, token)| candidate.get(index) == Some(token))
+}
+
+fn prepare(value: &str) -> PreparedField {
+    PreparedField {
+        raw: normalize(value),
+        tokens: tokenize(value),
+    }
+}
+
+fn tokenize(value: &str) -> Vec<String> {
+    normalize(value)
+        .split(|character: char| !character.is_ascii_lowercase() && !character.is_ascii_digit())
+        .filter(|token| !token.is_empty())
+        .map(str::to_owned)
+        .collect()
+}
+
+fn normalize(value: &str) -> String {
+    let mut normalized = String::with_capacity(value.len());
+    let mut previous: Option<char> = None;
+    let mut separator_run = false;
+    for character in value.chars() {
+        if character.is_ascii_uppercase()
+            && previous
+                .is_some_and(|previous| previous.is_ascii_lowercase() || previous.is_ascii_digit())
+        {
+            normalized.push(' ');
+        }
+        if matches!(character, '_' | '.' | '/' | ':' | '-') {
+            if !separator_run {
+                normalized.push(' ');
+            }
+            separator_run = true;
+        } else {
+            normalized.extend(character.to_lowercase());
+            separator_run = false;
+        }
+        previous = Some(character);
+    }
+    normalized.trim().to_owned()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{
+        candidate_expressions, namespace_prefix, normalize, short_gram_document, tokenize,
+    };
+
+    #[test]
+    fn normalization_matches_the_typescript_catalog_rules() {
+        assert_eq!(normalize("getHTTP/User-ID"), "get http user id");
+        assert_eq!(
+            tokenize("GitHub.getRepo:v2"),
+            ["git", "hub", "get", "repo", "v2"]
+        );
+    }
+
+    #[test]
+    fn sql_candidate_terms_are_normalized_and_escaped_as_tokens() {
+        let expressions = candidate_expressions("GetRepo repo").expect("tokens should compile");
+        assert_eq!(expressions.word, r#""get"* OR "repo"*"#);
+        assert_eq!(
+            expressions.trigram.as_deref(),
+            Some(r#""get" OR "rep" OR "repo""#)
+        );
+        assert_eq!(
+            expressions.short_bigram.as_deref(),
+            Some(r#""g26765" OR "g27265""#)
+        );
+        assert_eq!(expressions.short_unigram, r#""g167" OR "g172""#);
+        assert_eq!(
+            namespace_prefix(Some("GitHub/GetRepo")),
+            Some("git hub get repo".to_owned())
+        );
+        assert!(candidate_expressions("---").is_none());
+        assert_eq!(namespace_prefix(Some("---")), None);
+        assert!(short_gram_document(&["github"]).contains("g26974"));
+    }
+}
diff --git a/src/catalog/source_idempotency.rs b/src/catalog/source_idempotency.rs
new file mode 100644
index 000000000..f789bd496
--- /dev/null
+++ b/src/catalog/source_idempotency.rs
@@ -0,0 +1,2188 @@
+use std::{
+    collections::BTreeMap,
+    sync::Arc,
+    time::{SystemTime, UNIX_EPOCH},
+};
+
+#[cfg(test)]
+use std::sync::atomic::{AtomicBool, Ordering};
+
+use axum::http::{HeaderName, HeaderValue};
+use base64::{
+    Engine as _,
+    engine::general_purpose::{STANDARD, URL_SAFE_NO_PAD},
+};
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+use sqlx::{FromRow, Sqlite, SqlitePool, Transaction};
+use subtle::ConstantTimeEq;
+use thiserror::Error;
+use uuid::Uuid;
+
+use super::CatalogError;
+use crate::crypto::{CryptoError, Keyring};
+
+pub(crate) const SOURCE_CREATION_ROUTE: &str = "POST /api/v1/sources";
+pub(crate) const SOURCE_CREATION_IDEMPOTENCY_KEY_MAX_BYTES: usize = 255;
+pub(crate) const SOURCE_CREATION_IDEMPOTENCY_TTL_SECONDS: i64 = 24 * 60 * 60;
+const SOURCE_CREATION_TOMBSTONE_TTL_SECONDS: i64 = 7 * 24 * 60 * 60;
+const MAX_REQUEST_BYTES: usize = 16 * 1024 * 1024 + 64 * 1024;
+const MAX_RESPONSE_BODY_BYTES: usize = 16 * 1024 * 1024 + 64 * 1024;
+const MAX_RESPONSE_HEADER_BYTES: usize = 64 * 1024;
+const MAX_RESPONSE_HEADERS: usize = 64;
+const MAX_RESPONSE_CIPHERTEXT_BYTES: i64 = 24 * 1024 * 1024;
+const MAX_TOTAL_RESPONSE_CIPHERTEXT_BYTES: i64 = 64 * 1024 * 1024;
+const MAX_RECORDS: i64 = 10_000;
+const MAX_RECORDS_PER_ADMIN_ROUTE: i64 = 1_000;
+const PURGE_BATCH: i64 = 1_024;
+const KEY_DIGEST_PURPOSE: &str = "source-creation-idempotency-key-v1";
+const REQUEST_BODY_DIGEST_PURPOSE: &str = "source-creation-idempotency-request-body-v1";
+const REQUEST_DIGEST_PURPOSE: &str = "source-creation-idempotency-request-v1";
+const RESPONSE_PURPOSE: &str = "source-creation-idempotency-response-v1";
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+struct SourceCreationIdempotencyLimits {
+    records: i64,
+    records_per_admin_route: i64,
+    response_ciphertext_bytes: i64,
+}
+
+impl Default for SourceCreationIdempotencyLimits {
+    fn default() -> Self {
+        Self {
+            records: MAX_RECORDS,
+            records_per_admin_route: MAX_RECORDS_PER_ADMIN_ROUTE,
+            response_ciphertext_bytes: MAX_TOTAL_RESPONSE_CIPHERTEXT_BYTES,
+        }
+    }
+}
+
+trait IdempotencyClock: Send + Sync + 'static {
+    fn now(&self) -> i64;
+}
+
+#[derive(Clone, Copy, Default)]
+struct SystemClock;
+
+impl IdempotencyClock for SystemClock {
+    fn now(&self) -> i64 {
+        SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .expect("system time must be after the Unix epoch")
+            .as_secs() as i64
+    }
+}
+
+#[derive(Clone)]
+pub(crate) struct SourceCreationIdempotencyStore {
+    pool: SqlitePool,
+    keyring: Keyring,
+    clock: Arc<dyn IdempotencyClock>,
+    limits: SourceCreationIdempotencyLimits,
+    #[cfg(test)]
+    fail_next_lookup: Arc<AtomicBool>,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub(crate) struct SourceCreationReservation {
+    id: String,
+    admin_id: i64,
+    route: String,
+    key_digest: [u8; 32],
+    request_digest: [u8; 32],
+    created_at: i64,
+    limits: SourceCreationIdempotencyLimits,
+}
+
+impl SourceCreationReservation {
+    pub(crate) fn id(&self) -> &str {
+        &self.id
+    }
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub(crate) struct SourceCreationResponse {
+    pub(crate) status: u16,
+    pub(crate) headers: BTreeMap<String, String>,
+    pub(crate) body: Vec<u8>,
+}
+
+impl SourceCreationResponse {
+    pub(crate) fn json(status: u16, body: Vec<u8>) -> Self {
+        Self {
+            status,
+            headers: BTreeMap::from([("content-type".to_owned(), "application/json".to_owned())]),
+            body,
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub(crate) enum SourceCreationResponseKind {
+    Completed,
+    Failed,
+}
+
+impl SourceCreationResponseKind {
+    const fn as_str(self) -> &'static str {
+        match self {
+            Self::Completed => "completed",
+            Self::Failed => "failed",
+        }
+    }
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub(crate) struct SourceCreationReplay {
+    pub(crate) kind: SourceCreationResponseKind,
+    pub(crate) response: SourceCreationResponse,
+}
+
+#[derive(Clone, Debug)]
+pub(crate) enum SourceCreationIdempotencyClaim {
+    Fresh(SourceCreationReservation),
+    InProgress,
+    Replay(SourceCreationReplay),
+    Mismatch,
+    Abandoned,
+    Interrupted,
+    Expired,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub(crate) enum SourceCreationIdempotencyStatus {
+    InProgress,
+    Replay(SourceCreationReplay),
+    Abandoned,
+    Interrupted,
+    Expired,
+}
+
+#[derive(Clone, Copy, Debug, Default, Eq, PartialEq)]
+pub(crate) struct SourceCreationIdempotencyRecovery {
+    pub(crate) reservations_interrupted: u64,
+    pub(crate) tombstones_purged: u64,
+}
+
+#[derive(Debug, Error)]
+pub(crate) enum SourceCreationIdempotencyError {
+    #[error("source creation idempotency storage failed: {0}")]
+    Database(#[from] sqlx::Error),
+    #[error("source creation idempotency protection failed: {0}")]
+    Crypto(#[from] CryptoError),
+    #[error("source creation idempotency JSON failed: {0}")]
+    Json(#[from] serde_json::Error),
+    #[error("the Idempotency-Key must contain between 1 and 255 visible ASCII bytes")]
+    InvalidKey,
+    #[error("source creation idempotency metadata is invalid")]
+    InvalidMetadata,
+    #[error("the source creation idempotency payload exceeds the allowed size")]
+    PayloadTooLarge,
+    #[error("source creation idempotency capacity has been reached")]
+    Capacity,
+    #[error("stored source creation idempotency data is invalid")]
+    CorruptData,
+}
+
+#[derive(Clone, FromRow)]
+struct SourceCreationIdempotencyRow {
+    id: String,
+    admin_id: i64,
+    route: String,
+    key_digest: Vec<u8>,
+    request_digest: Option<Vec<u8>>,
+    state: String,
+    response_ciphertext: Option<Vec<u8>>,
+    created_at: i64,
+    updated_at: i64,
+    completed_at: Option<i64>,
+    expires_at: Option<i64>,
+    purge_at: Option<i64>,
+}
+
+#[derive(Deserialize, Serialize)]
+struct StoredResponse {
+    kind: SourceCreationResponseKind,
+    status: u16,
+    headers: BTreeMap<String, String>,
+    body_base64: String,
+}
+
+struct ResponseBinding<'a> {
+    id: &'a str,
+    admin_id: i64,
+    route: &'a str,
+    key_digest: &'a [u8],
+    request_digest: &'a [u8],
+    created_at: i64,
+    kind: SourceCreationResponseKind,
+    updated_at: i64,
+    completed_at: i64,
+    expires_at: i64,
+    purge_at: i64,
+}
+
+impl SourceCreationIdempotencyStore {
+    pub(crate) fn new(pool: SqlitePool, keyring: Keyring) -> Self {
+        Self {
+            pool,
+            keyring,
+            clock: Arc::new(SystemClock),
+            limits: SourceCreationIdempotencyLimits::default(),
+            #[cfg(test)]
+            fail_next_lookup: Arc::new(AtomicBool::new(false)),
+        }
+    }
+
+    #[cfg(test)]
+    fn with_clock(pool: SqlitePool, keyring: Keyring, clock: Arc<dyn IdempotencyClock>) -> Self {
+        Self {
+            pool,
+            keyring,
+            clock,
+            limits: SourceCreationIdempotencyLimits::default(),
+            fail_next_lookup: Arc::new(AtomicBool::new(false)),
+        }
+    }
+
+    #[cfg(test)]
+    fn with_limits(mut self, limits: SourceCreationIdempotencyLimits) -> Self {
+        self.limits = limits;
+        self
+    }
+
+    #[cfg(test)]
+    pub(crate) fn fail_next_lookup_for_test(&self) {
+        self.fail_next_lookup.store(true, Ordering::SeqCst);
+    }
+
+    pub(crate) async fn claim(
+        &self,
+        admin_id: i64,
+        route: &str,
+        key: &str,
+        request: &Value,
+    ) -> Result<SourceCreationIdempotencyClaim, SourceCreationIdempotencyError> {
+        validate_admin_id(admin_id)?;
+        validate_route(route)?;
+        validate_key(key)?;
+        let canonical_request = canonical_json(request)?;
+        if canonical_request.len() > MAX_REQUEST_BYTES {
+            return Err(SourceCreationIdempotencyError::PayloadTooLarge);
+        }
+        let key_digest = self.keyring.digest(KEY_DIGEST_PURPOSE, key.as_bytes());
+        let request_digest = request_digest(&self.keyring, admin_id, route, &canonical_request);
+        let observed_now = self.clock.now().max(0);
+        let mut transaction = self.pool.begin_with("BEGIN IMMEDIATE").await?;
+        let now = effective_now_in(&mut transaction, observed_now).await?;
+        purge_tombstones_for_admission_in(&mut transaction, admin_id, route, now, PURGE_BATCH)
+            .await?;
+        let id = Uuid::new_v4().to_string();
+        let inserted = sqlx::query(
+            "INSERT INTO source_creation_idempotency ( \
+                 id, admin_id, route, key_digest, request_digest, state, created_at, updated_at \
+             ) SELECT ?, ?, ?, ?, ?, 'reserved', ?, ? \
+             WHERE (SELECT COUNT(*) FROM source_creation_idempotency) < ? \
+               AND (SELECT COUNT(*) FROM source_creation_idempotency \
+                    WHERE admin_id = ? AND route = ?) < ? \
+             ON CONFLICT(admin_id, route, key_digest) DO NOTHING",
+        )
+        .bind(&id)
+        .bind(admin_id)
+        .bind(route)
+        .bind(key_digest.to_vec())
+        .bind(request_digest.to_vec())
+        .bind(now)
+        .bind(now)
+        .bind(self.limits.records)
+        .bind(admin_id)
+        .bind(route)
+        .bind(self.limits.records_per_admin_route)
+        .execute(&mut *transaction)
+        .await?;
+        if inserted.rows_affected() == 1 {
+            transaction.commit().await?;
+            return Ok(SourceCreationIdempotencyClaim::Fresh(
+                SourceCreationReservation {
+                    id,
+                    admin_id,
+                    route: route.to_owned(),
+                    key_digest,
+                    request_digest,
+                    created_at: now,
+                    limits: self.limits,
+                },
+            ));
+        }
+
+        let existing = fetch_by_key(&mut transaction, admin_id, route, &key_digest).await?;
+        let Some(existing) = existing else {
+            transaction.commit().await?;
+            return Err(SourceCreationIdempotencyError::Capacity);
+        };
+        validate_row_binding(&existing, admin_id, route, &key_digest)?;
+        if let Some(expected) = existing.request_digest.as_deref() {
+            if expected.len() != 32 {
+                return Err(SourceCreationIdempotencyError::CorruptData);
+            }
+            if !bool::from(expected.ct_eq(request_digest.as_slice())) {
+                transaction.commit().await?;
+                return Ok(SourceCreationIdempotencyClaim::Mismatch);
+            }
+        }
+        let status = classify_status(&self.keyring, &existing, now)?;
+        transaction.commit().await?;
+        Ok(match status {
+            SourceCreationIdempotencyStatus::InProgress => {
+                SourceCreationIdempotencyClaim::InProgress
+            }
+            SourceCreationIdempotencyStatus::Replay(replay) => {
+                SourceCreationIdempotencyClaim::Replay(replay)
+            }
+            SourceCreationIdempotencyStatus::Abandoned => SourceCreationIdempotencyClaim::Abandoned,
+            SourceCreationIdempotencyStatus::Interrupted => {
+                SourceCreationIdempotencyClaim::Interrupted
+            }
+            SourceCreationIdempotencyStatus::Expired => SourceCreationIdempotencyClaim::Expired,
+        })
+    }
+
+    pub(crate) async fn lookup(
+        &self,
+        admin_id: i64,
+        route: &str,
+        key: &str,
+    ) -> Result<Option<SourceCreationIdempotencyStatus>, SourceCreationIdempotencyError> {
+        validate_admin_id(admin_id)?;
+        validate_route(route)?;
+        validate_key(key)?;
+        #[cfg(test)]
+        if self.fail_next_lookup.swap(false, Ordering::SeqCst) {
+            return Err(SourceCreationIdempotencyError::Database(
+                sqlx::Error::Protocol("injected source creation lookup failure".into()),
+            ));
+        }
+        let key_digest = self.keyring.digest(KEY_DIGEST_PURPOSE, key.as_bytes());
+        let mut transaction = self.pool.begin_with("BEGIN IMMEDIATE").await?;
+        let now = effective_now_in(&mut transaction, self.clock.now().max(0)).await?;
+        purge_tombstones_in(&mut transaction, now, PURGE_BATCH).await?;
+        let existing = fetch_by_key(&mut transaction, admin_id, route, &key_digest).await?;
+        let status = existing
+            .as_ref()
+            .map(|row| {
+                validate_row_binding(row, admin_id, route, &key_digest)?;
+                classify_status(&self.keyring, row, now)
+            })
+            .transpose()?;
+        transaction.commit().await?;
+        Ok(status)
+    }
+
+    pub(crate) async fn seal_missing(
+        &self,
+        admin_id: i64,
+        route: &str,
+        key: &str,
+    ) -> Result<SourceCreationIdempotencyStatus, SourceCreationIdempotencyError> {
+        validate_admin_id(admin_id)?;
+        validate_route(route)?;
+        validate_key(key)?;
+        let key_digest = self.keyring.digest(KEY_DIGEST_PURPOSE, key.as_bytes());
+        let mut transaction = self.pool.begin_with("BEGIN IMMEDIATE").await?;
+        let now = effective_now_in(&mut transaction, self.clock.now().max(0)).await?;
+        purge_tombstones_for_admission_in(&mut transaction, admin_id, route, now, PURGE_BATCH)
+            .await?;
+        let expires_at = terminal_expiry(now)?;
+        let purge_at = tombstone_expiry(now)?;
+        sqlx::query(
+            "INSERT INTO source_creation_idempotency ( \
+                 id, admin_id, route, key_digest, request_digest, state, \
+                 created_at, updated_at, completed_at, expires_at, purge_at \
+             ) SELECT ?, ?, ?, ?, NULL, 'abandoned', ?, ?, ?, ?, ? \
+             WHERE (SELECT COUNT(*) FROM source_creation_idempotency) < ? \
+               AND (SELECT COUNT(*) FROM source_creation_idempotency \
+                    WHERE admin_id = ? AND route = ?) < ? \
+             ON CONFLICT(admin_id, route, key_digest) DO NOTHING",
+        )
+        .bind(Uuid::new_v4().to_string())
+        .bind(admin_id)
+        .bind(route)
+        .bind(key_digest.to_vec())
+        .bind(now)
+        .bind(now)
+        .bind(now)
+        .bind(expires_at)
+        .bind(purge_at)
+        .bind(self.limits.records)
+        .bind(admin_id)
+        .bind(route)
+        .bind(self.limits.records_per_admin_route)
+        .execute(&mut *transaction)
+        .await?;
+        let existing = fetch_by_key(&mut transaction, admin_id, route, &key_digest).await?;
+        let Some(existing) = existing else {
+            transaction.commit().await?;
+            return Err(SourceCreationIdempotencyError::Capacity);
+        };
+        validate_row_binding(&existing, admin_id, route, &key_digest)?;
+        let status = classify_status(&self.keyring, &existing, now)?;
+        transaction.commit().await?;
+        Ok(status)
+    }
+
+    pub(crate) async fn fail(
+        &self,
+        reservation: &SourceCreationReservation,
+        response: &SourceCreationResponse,
+    ) -> Result<SourceCreationIdempotencyStatus, SourceCreationIdempotencyError> {
+        validate_reservation(reservation)?;
+        if validate_response(response).is_err() {
+            return self.interrupt(reservation).await;
+        }
+        let mut transaction = self.pool.begin_with("BEGIN IMMEDIATE").await?;
+        let now = effective_now_in(&mut transaction, self.clock.now().max(0)).await?;
+        let expires_at = terminal_expiry(now)?;
+        let purge_at = tombstone_expiry(now)?;
+        let response_ciphertext = match encrypt_response(
+            &self.keyring,
+            reservation,
+            SourceCreationResponseKind::Failed,
+            now,
+            expires_at,
+            purge_at,
+            response,
+        ) {
+            Ok(ciphertext) => ciphertext,
+            Err(_) => {
+                interrupt_reservation_in(&mut transaction, reservation, now, expires_at, purge_at)
+                    .await?;
+                let row = fetch_by_id(&mut transaction, &reservation.id)
+                    .await?
+                    .ok_or(SourceCreationIdempotencyError::InvalidMetadata)?;
+                validate_reservation_row(&row, reservation)?;
+                let status = classify_status(&self.keyring, &row, now)?;
+                transaction.commit().await?;
+                return Ok(status);
+            }
+        };
+        let ciphertext_len = i64::try_from(response_ciphertext.len())
+            .map_err(|_| SourceCreationIdempotencyError::PayloadTooLarge)?;
+        let failed = sqlx::query(
+            "UPDATE source_creation_idempotency \
+             SET state = 'failed', response_ciphertext = ?, updated_at = ?, \
+                 completed_at = ?, expires_at = ?, purge_at = ? \
+             WHERE id = ? AND admin_id = ? AND route = ? AND key_digest = ? \
+               AND request_digest = ? AND created_at = ? AND state = 'reserved' \
+               AND ? <= ? - ( \
+                   SELECT COALESCE(SUM(length(response_ciphertext)), 0) \
+                   FROM source_creation_idempotency WHERE id <> ? \
+               )",
+        )
+        .bind(response_ciphertext)
+        .bind(now)
+        .bind(now)
+        .bind(expires_at)
+        .bind(purge_at)
+        .bind(&reservation.id)
+        .bind(reservation.admin_id)
+        .bind(&reservation.route)
+        .bind(reservation.key_digest.to_vec())
+        .bind(reservation.request_digest.to_vec())
+        .bind(reservation.created_at)
+        .bind(ciphertext_len)
+        .bind(reservation.limits.response_ciphertext_bytes)
+        .bind(&reservation.id)
+        .execute(&mut *transaction)
+        .await?
+        .rows_affected();
+        let mut row = fetch_by_id(&mut transaction, &reservation.id)
+            .await?
+            .ok_or(SourceCreationIdempotencyError::InvalidMetadata)?;
+        validate_reservation_row(&row, reservation)?;
+        if failed == 0 && row.state == "reserved" {
+            interrupt_reservation_in(&mut transaction, reservation, now, expires_at, purge_at)
+                .await?;
+            row = fetch_by_id(&mut transaction, &reservation.id)
+                .await?
+                .ok_or(SourceCreationIdempotencyError::InvalidMetadata)?;
+            validate_reservation_row(&row, reservation)?;
+        }
+        let status = classify_status(&self.keyring, &row, now)?;
+        transaction.commit().await?;
+        Ok(status)
+    }
+
+    pub(crate) async fn interrupt(
+        &self,
+        reservation: &SourceCreationReservation,
+    ) -> Result<SourceCreationIdempotencyStatus, SourceCreationIdempotencyError> {
+        validate_reservation(reservation)?;
+        let mut transaction = self.pool.begin_with("BEGIN IMMEDIATE").await?;
+        let now = effective_now_in(&mut transaction, self.clock.now().max(0)).await?;
+        interrupt_reservation_in(
+            &mut transaction,
+            reservation,
+            now,
+            terminal_expiry(now)?,
+            tombstone_expiry(now)?,
+        )
+        .await?;
+        let row = fetch_by_id(&mut transaction, &reservation.id)
+            .await?
+            .ok_or(SourceCreationIdempotencyError::InvalidMetadata)?;
+        validate_reservation_row(&row, reservation)?;
+        let status = classify_status(&self.keyring, &row, now)?;
+        transaction.commit().await?;
+        Ok(status)
+    }
+}
+
+pub(crate) async fn complete_source_creation_in(
+    transaction: &mut Transaction<'_, Sqlite>,
+    keyring: &Keyring,
+    reservation: &SourceCreationReservation,
+    response_body: &[u8],
+    observed_now: i64,
+) -> Result<(), CatalogError> {
+    let response = SourceCreationResponse::json(201, response_body.to_vec());
+    complete_in(transaction, keyring, reservation, &response, observed_now)
+        .await
+        .map_err(source_idempotency_catalog_error)
+}
+
+async fn complete_in(
+    transaction: &mut Transaction<'_, Sqlite>,
+    keyring: &Keyring,
+    reservation: &SourceCreationReservation,
+    response: &SourceCreationResponse,
+    observed_now: i64,
+) -> Result<(), SourceCreationIdempotencyError> {
+    validate_reservation(reservation)?;
+    let now = effective_now_in(transaction, observed_now.max(0)).await?;
+    let expires_at = terminal_expiry(now)?;
+    let purge_at = tombstone_expiry(now)?;
+    let response_ciphertext = encrypt_response(
+        keyring,
+        reservation,
+        SourceCreationResponseKind::Completed,
+        now,
+        expires_at,
+        purge_at,
+        response,
+    )?;
+    let ciphertext_len = i64::try_from(response_ciphertext.len())
+        .map_err(|_| SourceCreationIdempotencyError::PayloadTooLarge)?;
+    let completed = sqlx::query(
+        "UPDATE source_creation_idempotency \
+         SET state = 'completed', response_ciphertext = ?, updated_at = ?, \
+             completed_at = ?, expires_at = ?, purge_at = ? \
+         WHERE id = ? AND admin_id = ? AND route = ? AND key_digest = ? \
+           AND request_digest = ? AND created_at = ? AND state = 'reserved' \
+           AND ? <= ? - ( \
+               SELECT COALESCE(SUM(length(response_ciphertext)), 0) \
+               FROM source_creation_idempotency WHERE id <> ? \
+           )",
+    )
+    .bind(response_ciphertext)
+    .bind(now)
+    .bind(now)
+    .bind(expires_at)
+    .bind(purge_at)
+    .bind(&reservation.id)
+    .bind(reservation.admin_id)
+    .bind(&reservation.route)
+    .bind(reservation.key_digest.to_vec())
+    .bind(reservation.request_digest.to_vec())
+    .bind(reservation.created_at)
+    .bind(ciphertext_len)
+    .bind(reservation.limits.response_ciphertext_bytes)
+    .bind(&reservation.id)
+    .execute(&mut **transaction)
+    .await?;
+    if completed.rows_affected() == 1 {
+        Ok(())
+    } else {
+        Err(SourceCreationIdempotencyError::InvalidMetadata)
+    }
+}
+
+pub(crate) async fn recover_source_creation_idempotency(
+    pool: &SqlitePool,
+) -> Result<SourceCreationIdempotencyRecovery, sqlx::Error> {
+    recover_startup_at(pool, SystemClock.now().max(0)).await
+}
+
+async fn recover_startup_at(
+    pool: &SqlitePool,
+    observed_now: i64,
+) -> Result<SourceCreationIdempotencyRecovery, sqlx::Error> {
+    let mut transaction = pool.begin_with("BEGIN IMMEDIATE").await?;
+    let now = effective_now_in(&mut transaction, observed_now.max(0)).await?;
+    let tombstones_purged = purge_tombstones_in(&mut transaction, now, PURGE_BATCH).await?;
+    let expires_at =
+        terminal_expiry(now).map_err(|_| sqlx::Error::Protocol("clock overflow".into()))?;
+    let purge_at =
+        tombstone_expiry(now).map_err(|_| sqlx::Error::Protocol("clock overflow".into()))?;
+    let reservations_interrupted = sqlx::query(
+        "UPDATE source_creation_idempotency \
+         SET state = 'interrupted', updated_at = ?, completed_at = ?, expires_at = ?, purge_at = ? \
+         WHERE state = 'reserved'",
+    )
+    .bind(now)
+    .bind(now)
+    .bind(expires_at)
+    .bind(purge_at)
+    .execute(&mut *transaction)
+    .await?
+    .rows_affected();
+    transaction.commit().await?;
+    Ok(SourceCreationIdempotencyRecovery {
+        reservations_interrupted,
+        tombstones_purged,
+    })
+}
+
+pub(crate) fn source_creation_idempotency_key_is_valid(key: &str) -> bool {
+    validate_key(key).is_ok()
+}
+
+fn source_idempotency_catalog_error(error: SourceCreationIdempotencyError) -> CatalogError {
+    match error {
+        SourceCreationIdempotencyError::Database(error) => CatalogError::Database(error),
+        SourceCreationIdempotencyError::Crypto(error) => CatalogError::Crypto(error),
+        SourceCreationIdempotencyError::Json(error) => CatalogError::Json(error),
+        SourceCreationIdempotencyError::InvalidKey
+        | SourceCreationIdempotencyError::InvalidMetadata
+        | SourceCreationIdempotencyError::PayloadTooLarge
+        | SourceCreationIdempotencyError::Capacity
+        | SourceCreationIdempotencyError::CorruptData => {
+            CatalogError::CorruptData("source creation idempotency completion failed")
+        }
+    }
+}
+
+async fn fetch_by_key(
+    transaction: &mut Transaction<'_, Sqlite>,
+    admin_id: i64,
+    route: &str,
+    key_digest: &[u8],
+) -> Result<Option<SourceCreationIdempotencyRow>, sqlx::Error> {
+    sqlx::query_as::<_, SourceCreationIdempotencyRow>(
+        "SELECT id, admin_id, route, key_digest, request_digest, state, response_ciphertext, \
+                created_at, updated_at, completed_at, expires_at, purge_at \
+         FROM source_creation_idempotency \
+         WHERE admin_id = ? AND route = ? AND key_digest = ?",
+    )
+    .bind(admin_id)
+    .bind(route)
+    .bind(key_digest)
+    .fetch_optional(&mut **transaction)
+    .await
+}
+
+async fn fetch_by_id(
+    transaction: &mut Transaction<'_, Sqlite>,
+    id: &str,
+) -> Result<Option<SourceCreationIdempotencyRow>, sqlx::Error> {
+    sqlx::query_as::<_, SourceCreationIdempotencyRow>(
+        "SELECT id, admin_id, route, key_digest, request_digest, state, response_ciphertext, \
+                created_at, updated_at, completed_at, expires_at, purge_at \
+         FROM source_creation_idempotency WHERE id = ?",
+    )
+    .bind(id)
+    .fetch_optional(&mut **transaction)
+    .await
+}
+
+async fn effective_now_in(
+    transaction: &mut Transaction<'_, Sqlite>,
+    observed_now: i64,
+) -> Result<i64, sqlx::Error> {
+    sqlx::query(
+        "UPDATE source_creation_idempotency_clock \
+         SET effective_now = MAX(effective_now, ?) WHERE id = 1",
+    )
+    .bind(observed_now)
+    .execute(&mut **transaction)
+    .await?;
+    sqlx::query_scalar("SELECT effective_now FROM source_creation_idempotency_clock WHERE id = 1")
+        .fetch_one(&mut **transaction)
+        .await
+}
+
+async fn interrupt_reservation_in(
+    transaction: &mut Transaction<'_, Sqlite>,
+    reservation: &SourceCreationReservation,
+    now: i64,
+    expires_at: i64,
+    purge_at: i64,
+) -> Result<u64, sqlx::Error> {
+    sqlx::query(
+        "UPDATE source_creation_idempotency \
+         SET state = 'interrupted', updated_at = ?, completed_at = ?, expires_at = ?, purge_at = ? \
+         WHERE id = ? AND admin_id = ? AND route = ? AND key_digest = ? \
+           AND request_digest = ? AND created_at = ? AND state = 'reserved'",
+    )
+    .bind(now)
+    .bind(now)
+    .bind(expires_at)
+    .bind(purge_at)
+    .bind(&reservation.id)
+    .bind(reservation.admin_id)
+    .bind(&reservation.route)
+    .bind(reservation.key_digest.to_vec())
+    .bind(reservation.request_digest.to_vec())
+    .bind(reservation.created_at)
+    .execute(&mut **transaction)
+    .await
+    .map(|result| result.rows_affected())
+}
+
+async fn purge_tombstones_in(
+    transaction: &mut Transaction<'_, Sqlite>,
+    now: i64,
+    maximum_rows: i64,
+) -> Result<u64, sqlx::Error> {
+    sqlx::query(
+        "DELETE FROM source_creation_idempotency WHERE sequence IN ( \
+             SELECT sequence FROM source_creation_idempotency \
+             WHERE state <> 'reserved' AND purge_at <= ? \
+             ORDER BY purge_at, sequence LIMIT ? \
+         )",
+    )
+    .bind(now)
+    .bind(maximum_rows)
+    .execute(&mut **transaction)
+    .await
+    .map(|result| result.rows_affected())
+}
+
+async fn purge_tombstones_for_admission_in(
+    transaction: &mut Transaction<'_, Sqlite>,
+    admin_id: i64,
+    route: &str,
+    now: i64,
+    maximum_rows: i64,
+) -> Result<u64, sqlx::Error> {
+    sqlx::query(
+        "DELETE FROM source_creation_idempotency WHERE sequence IN ( \
+             SELECT sequence FROM source_creation_idempotency \
+             WHERE state <> 'reserved' AND purge_at <= ? \
+             ORDER BY CASE WHEN admin_id = ? AND route = ? THEN 0 ELSE 1 END, \
+                      purge_at, sequence LIMIT ? \
+         )",
+    )
+    .bind(now)
+    .bind(admin_id)
+    .bind(route)
+    .bind(maximum_rows)
+    .execute(&mut **transaction)
+    .await
+    .map(|result| result.rows_affected())
+}
+
+fn classify_status(
+    keyring: &Keyring,
+    row: &SourceCreationIdempotencyRow,
+    now: i64,
+) -> Result<SourceCreationIdempotencyStatus, SourceCreationIdempotencyError> {
+    if row.state != "reserved" && row.expires_at.is_some_and(|expires_at| expires_at <= now) {
+        return Ok(SourceCreationIdempotencyStatus::Expired);
+    }
+    match row.state.as_str() {
+        "reserved" if row.request_digest.is_some() && row.response_ciphertext.is_none() => {
+            Ok(SourceCreationIdempotencyStatus::InProgress)
+        }
+        "completed" => Ok(SourceCreationIdempotencyStatus::Replay(
+            SourceCreationReplay {
+                kind: SourceCreationResponseKind::Completed,
+                response: decrypt_response(keyring, row)?,
+            },
+        )),
+        "failed" => Ok(SourceCreationIdempotencyStatus::Replay(
+            SourceCreationReplay {
+                kind: SourceCreationResponseKind::Failed,
+                response: decrypt_response(keyring, row)?,
+            },
+        )),
+        "abandoned" if row.response_ciphertext.is_none() => {
+            Ok(SourceCreationIdempotencyStatus::Abandoned)
+        }
+        "interrupted" if row.request_digest.is_some() && row.response_ciphertext.is_none() => {
+            Ok(SourceCreationIdempotencyStatus::Interrupted)
+        }
+        _ => Err(SourceCreationIdempotencyError::CorruptData),
+    }
+}
+
+fn request_digest(
+    keyring: &Keyring,
+    admin_id: i64,
+    route: &str,
+    canonical_request: &[u8],
+) -> [u8; 32] {
+    let body_digest = keyring.digest(REQUEST_BODY_DIGEST_PURPOSE, canonical_request);
+    let mut input = Vec::with_capacity(route.len() + 80);
+    input.extend_from_slice(b"executor-source-creation-idempotency-request-v1");
+    append_field(&mut input, &admin_id.to_be_bytes());
+    append_field(&mut input, route.as_bytes());
+    append_field(&mut input, &body_digest);
+    keyring.digest(REQUEST_DIGEST_PURPOSE, &input)
+}
+
+fn validate_row_binding(
+    row: &SourceCreationIdempotencyRow,
+    admin_id: i64,
+    route: &str,
+    key_digest: &[u8; 32],
+) -> Result<(), SourceCreationIdempotencyError> {
+    if row.id.is_empty()
+        || row.id.len() > 128
+        || row.admin_id != admin_id
+        || row.route != route
+        || row.key_digest.len() != 32
+        || !bool::from(row.key_digest.as_slice().ct_eq(key_digest.as_slice()))
+        || row.created_at < 0
+        || row.purge_at.is_some_and(|purge_at| purge_at < 0)
+    {
+        return Err(SourceCreationIdempotencyError::CorruptData);
+    }
+    Ok(())
+}
+
+fn validate_reservation(
+    reservation: &SourceCreationReservation,
+) -> Result<(), SourceCreationIdempotencyError> {
+    validate_admin_id(reservation.admin_id)?;
+    validate_route(&reservation.route)?;
+    if reservation.id.is_empty()
+        || reservation.id.len() > 128
+        || reservation.id.contains('\0')
+        || reservation.created_at < 0
+        || reservation.limits.records <= 0
+        || reservation.limits.records_per_admin_route <= 0
+        || reservation.limits.response_ciphertext_bytes < 0
+    {
+        return Err(SourceCreationIdempotencyError::InvalidMetadata);
+    }
+    Ok(())
+}
+
+fn validate_reservation_row(
+    row: &SourceCreationIdempotencyRow,
+    reservation: &SourceCreationReservation,
+) -> Result<(), SourceCreationIdempotencyError> {
+    let Some(request_digest) = row.request_digest.as_deref() else {
+        return Err(SourceCreationIdempotencyError::InvalidMetadata);
+    };
+    if row.id != reservation.id
+        || row.admin_id != reservation.admin_id
+        || row.route != reservation.route
+        || row.created_at != reservation.created_at
+        || row.key_digest.len() != 32
+        || request_digest.len() != 32
+        || !bool::from(
+            row.key_digest
+                .as_slice()
+                .ct_eq(reservation.key_digest.as_slice()),
+        )
+        || !bool::from(request_digest.ct_eq(reservation.request_digest.as_slice()))
+    {
+        return Err(SourceCreationIdempotencyError::InvalidMetadata);
+    }
+    Ok(())
+}
+
+fn validate_admin_id(admin_id: i64) -> Result<(), SourceCreationIdempotencyError> {
+    if admin_id <= 0 {
+        return Err(SourceCreationIdempotencyError::InvalidMetadata);
+    }
+    Ok(())
+}
+
+fn validate_route(route: &str) -> Result<(), SourceCreationIdempotencyError> {
+    if route.is_empty() || route.len() > 200 || route.contains('\0') {
+        return Err(SourceCreationIdempotencyError::InvalidMetadata);
+    }
+    Ok(())
+}
+
+fn validate_key(key: &str) -> Result<(), SourceCreationIdempotencyError> {
+    let bytes = key.as_bytes();
+    if bytes.is_empty()
+        || bytes.len() > SOURCE_CREATION_IDEMPOTENCY_KEY_MAX_BYTES
+        || bytes.iter().any(|byte| !(0x21..=0x7e).contains(byte))
+    {
+        return Err(SourceCreationIdempotencyError::InvalidKey);
+    }
+    Ok(())
+}
+
+fn validate_response(
+    response: &SourceCreationResponse,
+) -> Result<(), SourceCreationIdempotencyError> {
+    if !(100..=599).contains(&response.status)
+        || response.body.len() > MAX_RESPONSE_BODY_BYTES
+        || response.headers.len() > MAX_RESPONSE_HEADERS
+    {
+        return Err(SourceCreationIdempotencyError::PayloadTooLarge);
+    }
+    let header_bytes = response
+        .headers
+        .iter()
+        .try_fold(0_usize, |total, (name, value)| {
+            if name.is_empty()
+                || name.contains(['\0', '\r', '\n'])
+                || value.contains(['\0', '\r', '\n'])
+                || HeaderName::try_from(name.as_str()).is_err()
+                || HeaderValue::try_from(value.as_str()).is_err()
+            {
+                return None;
+            }
+            total.checked_add(name.len())?.checked_add(value.len())
+        });
+    if header_bytes.is_none_or(|bytes| bytes > MAX_RESPONSE_HEADER_BYTES) {
+        return Err(SourceCreationIdempotencyError::PayloadTooLarge);
+    }
+    Ok(())
+}
+
+fn encrypt_response(
+    keyring: &Keyring,
+    reservation: &SourceCreationReservation,
+    kind: SourceCreationResponseKind,
+    completed_at: i64,
+    expires_at: i64,
+    purge_at: i64,
+    response: &SourceCreationResponse,
+) -> Result<Vec<u8>, SourceCreationIdempotencyError> {
+    validate_response(response)?;
+    let encoded = serde_json::to_vec(&StoredResponse {
+        kind,
+        status: response.status,
+        headers: response.headers.clone(),
+        body_base64: STANDARD.encode(&response.body),
+    })?;
+    let binding = ResponseBinding {
+        id: &reservation.id,
+        admin_id: reservation.admin_id,
+        route: &reservation.route,
+        key_digest: &reservation.key_digest,
+        request_digest: &reservation.request_digest,
+        created_at: reservation.created_at,
+        kind,
+        updated_at: completed_at,
+        completed_at,
+        expires_at,
+        purge_at,
+    };
+    let ciphertext = keyring.encrypt(RESPONSE_PURPOSE, &response_record_id(&binding), &encoded)?;
+    if ciphertext.len() > MAX_RESPONSE_CIPHERTEXT_BYTES as usize {
+        return Err(SourceCreationIdempotencyError::PayloadTooLarge);
+    }
+    Ok(ciphertext)
+}
+
+fn decrypt_response(
+    keyring: &Keyring,
+    row: &SourceCreationIdempotencyRow,
+) -> Result<SourceCreationResponse, SourceCreationIdempotencyError> {
+    let ciphertext = row
+        .response_ciphertext
+        .as_deref()
+        .ok_or(SourceCreationIdempotencyError::CorruptData)?;
+    if ciphertext.len() > MAX_RESPONSE_CIPHERTEXT_BYTES as usize {
+        return Err(SourceCreationIdempotencyError::CorruptData);
+    }
+    let binding = response_binding_from_row(row)?;
+    let plaintext = keyring.decrypt(RESPONSE_PURPOSE, &response_record_id(&binding), ciphertext)?;
+    let stored: StoredResponse = serde_json::from_slice(&plaintext)?;
+    if stored.kind != binding.kind {
+        return Err(SourceCreationIdempotencyError::CorruptData);
+    }
+    let response = SourceCreationResponse {
+        status: stored.status,
+        headers: stored.headers,
+        body: STANDARD
+            .decode(stored.body_base64)
+            .map_err(|_| SourceCreationIdempotencyError::CorruptData)?,
+    };
+    validate_response(&response)?;
+    Ok(response)
+}
+
+fn response_binding_from_row(
+    row: &SourceCreationIdempotencyRow,
+) -> Result<ResponseBinding<'_>, SourceCreationIdempotencyError> {
+    let kind = match row.state.as_str() {
+        "completed" => SourceCreationResponseKind::Completed,
+        "failed" => SourceCreationResponseKind::Failed,
+        _ => return Err(SourceCreationIdempotencyError::CorruptData),
+    };
+    let request_digest = row
+        .request_digest
+        .as_deref()
+        .ok_or(SourceCreationIdempotencyError::CorruptData)?;
+    let completed_at = row
+        .completed_at
+        .ok_or(SourceCreationIdempotencyError::CorruptData)?;
+    let expires_at = row
+        .expires_at
+        .ok_or(SourceCreationIdempotencyError::CorruptData)?;
+    let purge_at = row
+        .purge_at
+        .ok_or(SourceCreationIdempotencyError::CorruptData)?;
+    Ok(ResponseBinding {
+        id: &row.id,
+        admin_id: row.admin_id,
+        route: &row.route,
+        key_digest: &row.key_digest,
+        request_digest,
+        created_at: row.created_at,
+        kind,
+        updated_at: row.updated_at,
+        completed_at,
+        expires_at,
+        purge_at,
+    })
+}
+
+fn response_record_id(binding: &ResponseBinding<'_>) -> String {
+    let mut encoded = Vec::with_capacity(
+        160 + binding.id.len()
+            + binding.route.len()
+            + binding.key_digest.len()
+            + binding.request_digest.len(),
+    );
+    encoded.extend_from_slice(b"executor-source-creation-response-binding-v2");
+    append_field(&mut encoded, binding.id.as_bytes());
+    append_field(&mut encoded, &binding.admin_id.to_be_bytes());
+    append_field(&mut encoded, binding.route.as_bytes());
+    append_field(&mut encoded, binding.key_digest);
+    append_field(&mut encoded, binding.request_digest);
+    append_field(&mut encoded, &binding.created_at.to_be_bytes());
+    append_field(&mut encoded, binding.kind.as_str().as_bytes());
+    append_field(&mut encoded, &binding.updated_at.to_be_bytes());
+    append_field(&mut encoded, &binding.completed_at.to_be_bytes());
+    append_field(&mut encoded, &binding.expires_at.to_be_bytes());
+    append_field(&mut encoded, &binding.purge_at.to_be_bytes());
+    format!("v2:{}", URL_SAFE_NO_PAD.encode(encoded))
+}
+
+fn canonical_json(value: &Value) -> Result<Vec<u8>, SourceCreationIdempotencyError> {
+    fn sort(value: &Value) -> Value {
+        match value {
+            Value::Object(object) => {
+                let sorted = object
+                    .iter()
+                    .map(|(key, value)| (key.clone(), sort(value)))
+                    .collect::<BTreeMap<_, _>>();
+                Value::Object(sorted.into_iter().collect())
+            }
+            Value::Array(values) => Value::Array(values.iter().map(sort).collect()),
+            value => value.clone(),
+        }
+    }
+    serde_json::to_vec(&sort(value)).map_err(Into::into)
+}
+
+fn terminal_expiry(now: i64) -> Result<i64, SourceCreationIdempotencyError> {
+    now.checked_add(SOURCE_CREATION_IDEMPOTENCY_TTL_SECONDS)
+        .ok_or(SourceCreationIdempotencyError::InvalidMetadata)
+}
+
+fn tombstone_expiry(now: i64) -> Result<i64, SourceCreationIdempotencyError> {
+    now.checked_add(SOURCE_CREATION_TOMBSTONE_TTL_SECONDS)
+        .ok_or(SourceCreationIdempotencyError::InvalidMetadata)
+}
+
+fn append_field(target: &mut Vec<u8>, value: &[u8]) {
+    target.extend_from_slice(&(value.len() as u64).to_be_bytes());
+    target.extend_from_slice(value);
+}
+
+#[cfg(test)]
+mod tests {
+    use std::sync::{
+        Arc,
+        atomic::{AtomicI64, Ordering},
+    };
+
+    use base64::Engine as _;
+    use serde_json::{Value, json};
+
+    use super::{
+        IdempotencyClock, MAX_REQUEST_BYTES, MAX_RESPONSE_BODY_BYTES,
+        SOURCE_CREATION_IDEMPOTENCY_TTL_SECONDS, SOURCE_CREATION_ROUTE,
+        SOURCE_CREATION_TOMBSTONE_TTL_SECONDS, SourceCreationIdempotencyClaim,
+        SourceCreationIdempotencyError, SourceCreationIdempotencyLimits,
+        SourceCreationIdempotencyStatus, SourceCreationIdempotencyStore, SourceCreationReplay,
+        SourceCreationResponse, SourceCreationResponseKind, canonical_json, complete_in,
+        recover_startup_at, source_creation_idempotency_key_is_valid,
+    };
+    use crate::{
+        AppConfig,
+        catalog::{
+            AuditContext, CatalogError, CatalogStore, CreateSource, CredentialPayload,
+            InitialCatalogSnapshot, SourceKind,
+        },
+        database::Database,
+    };
+
+    struct TestClock(AtomicI64);
+
+    impl TestClock {
+        fn new(now: i64) -> Self {
+            Self(AtomicI64::new(now))
+        }
+
+        fn set(&self, now: i64) {
+            self.0.store(now, Ordering::SeqCst);
+        }
+    }
+
+    impl IdempotencyClock for TestClock {
+        fn now(&self) -> i64 {
+            self.0.load(Ordering::SeqCst)
+        }
+    }
+
+    async fn fixture() -> (
+        tempfile::TempDir,
+        crate::database::OpenedDatabase,
+        SourceCreationIdempotencyStore,
+        Arc<TestClock>,
+    ) {
+        let directory = tempfile::tempdir().expect("temporary directory should be created");
+        let opened = Database::open(&AppConfig::new(directory.path().to_path_buf()))
+            .await
+            .expect("test database should open");
+        sqlx::query(
+            "INSERT INTO admins (id, username, password_hash, created_at) \
+             VALUES (1, 'admin', 'test-password-hash', 1)",
+        )
+        .execute(&opened.database.pool)
+        .await
+        .expect("test admin should be inserted");
+        sqlx::query(
+            "UPDATE source_creation_idempotency_clock SET effective_now = 1000 WHERE id = 1",
+        )
+        .execute(&opened.database.pool)
+        .await
+        .expect("test clock should reset");
+        let clock = Arc::new(TestClock::new(1_000));
+        let store = SourceCreationIdempotencyStore::with_clock(
+            opened.database.pool.clone(),
+            opened.database.keyring.clone(),
+            clock.clone(),
+        );
+        (directory, opened, store, clock)
+    }
+
+    async fn complete(
+        store: &SourceCreationIdempotencyStore,
+        reservation: &super::SourceCreationReservation,
+        response: &SourceCreationResponse,
+    ) -> Result<(), SourceCreationIdempotencyError> {
+        let mut transaction = store.pool.begin_with("BEGIN IMMEDIATE").await?;
+        complete_in(
+            &mut transaction,
+            &store.keyring,
+            reservation,
+            response,
+            store.clock.now(),
+        )
+        .await?;
+        transaction.commit().await?;
+        Ok(())
+    }
+
+    async fn fresh(
+        store: &SourceCreationIdempotencyStore,
+        key: &str,
+        request: &Value,
+    ) -> super::SourceCreationReservation {
+        let SourceCreationIdempotencyClaim::Fresh(reservation) = store
+            .claim(1, SOURCE_CREATION_ROUTE, key, request)
+            .await
+            .expect("claim should succeed")
+        else {
+            panic!("claim should be fresh");
+        };
+        reservation
+    }
+
+    fn completed_replay(body: &[u8]) -> SourceCreationIdempotencyStatus {
+        SourceCreationIdempotencyStatus::Replay(SourceCreationReplay {
+            kind: SourceCreationResponseKind::Completed,
+            response: SourceCreationResponse::json(201, body.to_vec()),
+        })
+    }
+
+    async fn insert_purgeable_tombstones(
+        pool: &sqlx::SqlitePool,
+        id_prefix: &str,
+        route: &str,
+        count: usize,
+        purge_at: i64,
+    ) {
+        let mut transaction = pool
+            .begin_with("BEGIN IMMEDIATE")
+            .await
+            .expect("tombstone fixture transaction should begin");
+        for index in 0..count {
+            let mut key_digest = [0xff_u8; 32];
+            key_digest[24..].copy_from_slice(
+                &u64::try_from(index)
+                    .expect("fixture index should fit in u64")
+                    .to_be_bytes(),
+            );
+            sqlx::query(
+                "INSERT INTO source_creation_idempotency ( \
+                     id, admin_id, route, key_digest, request_digest, state, \
+                     created_at, updated_at, completed_at, expires_at, purge_at \
+                 ) VALUES (?, 1, ?, ?, NULL, 'abandoned', 1, 1, 1, 2, ?)",
+            )
+            .bind(format!("{id_prefix}-{index}"))
+            .bind(route)
+            .bind(key_digest.to_vec())
+            .bind(purge_at)
+            .execute(&mut *transaction)
+            .await
+            .expect("purgeable tombstone fixture should insert");
+        }
+        transaction
+            .commit()
+            .await
+            .expect("tombstone fixture transaction should commit");
+    }
+
+    async fn seed_admission_starvation(
+        pool: &sqlx::SqlitePool,
+        id_prefix: &str,
+        target_route: &str,
+    ) {
+        let unrelated_id_prefix = format!("{id_prefix}-older-unrelated");
+        let unrelated_route = format!("POST /unrelated-{id_prefix}");
+        insert_purgeable_tombstones(
+            pool,
+            &unrelated_id_prefix,
+            &unrelated_route,
+            usize::try_from(super::PURGE_BATCH + 1).expect("purge batch should fit usize"),
+            3,
+        )
+        .await;
+        let target_id_prefix = format!("{id_prefix}-target");
+        insert_purgeable_tombstones(
+            pool,
+            &target_id_prefix,
+            target_route,
+            usize::try_from(super::MAX_RECORDS_PER_ADMIN_ROUTE)
+                .expect("scope capacity should fit usize"),
+            4,
+        )
+        .await;
+        assert_eq!(
+            sqlx::query_scalar::<_, i64>(
+                "SELECT COUNT(*) FROM source_creation_idempotency \
+                 WHERE admin_id = 1 AND route = ?",
+            )
+            .bind(&unrelated_route)
+            .fetch_one(pool)
+            .await
+            .expect("unrelated backlog count should read"),
+            super::PURGE_BATCH + 1
+        );
+        assert_eq!(
+            sqlx::query_scalar::<_, i64>(
+                "SELECT COUNT(*) FROM source_creation_idempotency \
+                 WHERE admin_id = 1 AND route = ?",
+            )
+            .bind(target_route)
+            .fetch_one(pool)
+            .await
+            .expect("target scope count should read"),
+            super::MAX_RECORDS_PER_ADMIN_ROUTE
+        );
+    }
+
+    #[test]
+    fn keys_and_canonical_request_size_are_bounded_consistently_with_the_route() {
+        assert!(source_creation_idempotency_key_is_valid("a"));
+        assert!(source_creation_idempotency_key_is_valid(&"x".repeat(255)));
+        assert!(!source_creation_idempotency_key_is_valid(""));
+        assert!(!source_creation_idempotency_key_is_valid(&"x".repeat(256)));
+        assert!(!source_creation_idempotency_key_is_valid("contains space"));
+        assert!(!source_creation_idempotency_key_is_valid("non-ascii-é"));
+
+        let at_limit = Value::String("x".repeat(MAX_REQUEST_BYTES - 2));
+        assert_eq!(
+            canonical_json(&at_limit)
+                .expect("boundary request should encode")
+                .len(),
+            MAX_REQUEST_BYTES
+        );
+        let over_limit = Value::String("x".repeat(MAX_REQUEST_BYTES - 1));
+        assert!(
+            canonical_json(&over_limit)
+                .expect("oversized request should still encode")
+                .len()
+                > MAX_REQUEST_BYTES
+        );
+    }
+
+    #[tokio::test]
+    async fn injected_lookup_failure_is_clone_shared_one_shot_and_precedes_database_work() {
+        let (_directory, opened, store, clock) = fixture().await;
+        let cloned = store.clone();
+        clock.set(2_000);
+        store.fail_next_lookup_for_test();
+        assert!(matches!(
+            cloned
+                .lookup(1, SOURCE_CREATION_ROUTE, "injected-lookup")
+                .await,
+            Err(SourceCreationIdempotencyError::Database(
+                sqlx::Error::Protocol(message)
+            )) if message == "injected source creation lookup failure"
+        ));
+        assert_eq!(
+            sqlx::query_scalar::<_, i64>(
+                "SELECT effective_now FROM source_creation_idempotency_clock WHERE id = 1",
+            )
+            .fetch_one(&opened.database.pool)
+            .await
+            .expect("clock should read after injected lookup failure"),
+            1_000
+        );
+        assert_eq!(
+            store
+                .lookup(1, SOURCE_CREATION_ROUTE, "injected-lookup")
+                .await
+                .expect("second lookup should consume no fault"),
+            None
+        );
+        assert_eq!(
+            sqlx::query_scalar::<_, i64>(
+                "SELECT effective_now FROM source_creation_idempotency_clock WHERE id = 1",
+            )
+            .fetch_one(&opened.database.pool)
+            .await
+            .expect("clock should read after successful lookup"),
+            2_000
+        );
+    }
+
+    #[tokio::test]
+    async fn canonical_requests_match_while_secret_only_changes_conflict() {
+        let (_directory, _opened, store, _clock) = fixture().await;
+        let first = json!({
+            "kind": "openapi",
+            "credential": { "token": "secret-a" },
+            "displayName": "Example"
+        });
+        let reordered = json!({
+            "displayName": "Example",
+            "credential": { "token": "secret-a" },
+            "kind": "openapi"
+        });
+        let changed_secret = json!({
+            "displayName": "Example",
+            "credential": { "token": "secret-b" },
+            "kind": "openapi"
+        });
+        fresh(&store, "canonical-key", &first).await;
+        assert!(matches!(
+            store
+                .claim(1, SOURCE_CREATION_ROUTE, "canonical-key", &reordered)
+                .await
+                .expect("matching claim should classify"),
+            SourceCreationIdempotencyClaim::InProgress
+        ));
+        assert!(matches!(
+            store
+                .claim(1, SOURCE_CREATION_ROUTE, "canonical-key", &changed_secret)
+                .await
+                .expect("mismatch should classify"),
+            SourceCreationIdempotencyClaim::Mismatch
+        ));
+        assert!(matches!(
+            store
+                .claim(
+                    1,
+                    SOURCE_CREATION_ROUTE,
+                    "canonical-key",
+                    &json!({
+                        "displayName": "Example",
+                        "credential": { "token": "secret-a" },
+                        "kind": "graphql"
+                    }),
+                )
+                .await
+                .expect("kind mismatch should classify"),
+            SourceCreationIdempotencyClaim::Mismatch
+        ));
+        assert!(matches!(
+            store
+                .claim(1, "POST /different", "canonical-key", &first)
+                .await
+                .expect("different route should have an independent scope"),
+            SourceCreationIdempotencyClaim::Fresh(_)
+        ));
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+    async fn concurrent_claims_elect_exactly_one_owner() {
+        let (_directory, _opened, store, _clock) = fixture().await;
+        let barrier = Arc::new(tokio::sync::Barrier::new(17));
+        let mut tasks = Vec::new();
+        for _ in 0..16 {
+            let store = store.clone();
+            let barrier = barrier.clone();
+            tasks.push(tokio::spawn(async move {
+                let request = json!({ "kind": "graphql", "secret": "same" });
+                barrier.wait().await;
+                store
+                    .claim(1, SOURCE_CREATION_ROUTE, "concurrent-key", &request)
+                    .await
+            }));
+        }
+        barrier.wait().await;
+        let mut fresh = 0;
+        let mut in_progress = 0;
+        for task in tasks {
+            match task
+                .await
+                .expect("claim task should finish")
+                .expect("claim should succeed")
+            {
+                SourceCreationIdempotencyClaim::Fresh(_) => fresh += 1,
+                SourceCreationIdempotencyClaim::InProgress => in_progress += 1,
+                other => panic!("unexpected concurrent outcome: {other:?}"),
+            }
+        }
+        assert_eq!(fresh, 1);
+        assert_eq!(in_progress, 15);
+    }
+
+    #[tokio::test]
+    async fn concurrent_claim_and_missing_seal_elect_exactly_one_winner() {
+        let (_directory, opened, store, _clock) = fixture().await;
+        for index in 0..32 {
+            let key = format!("claim-seal-race-{index}");
+            let barrier = Arc::new(tokio::sync::Barrier::new(3));
+            let claim_store = store.clone();
+            let claim_barrier = barrier.clone();
+            let claim_key = key.clone();
+            let claim = tokio::spawn(async move {
+                let request = json!({ "kind": "mcp_http", "index": index });
+                claim_barrier.wait().await;
+                claim_store
+                    .claim(1, SOURCE_CREATION_ROUTE, &claim_key, &request)
+                    .await
+            });
+            let seal_store = store.clone();
+            let seal_barrier = barrier.clone();
+            let seal_key = key.clone();
+            let seal = tokio::spawn(async move {
+                seal_barrier.wait().await;
+                seal_store
+                    .seal_missing(1, SOURCE_CREATION_ROUTE, &seal_key)
+                    .await
+            });
+            barrier.wait().await;
+            let claim = claim
+                .await
+                .expect("claim task should finish")
+                .expect("claim should classify");
+            let seal = seal
+                .await
+                .expect("seal task should finish")
+                .expect("seal should classify");
+            match (claim, seal) {
+                (
+                    SourceCreationIdempotencyClaim::Fresh(_),
+                    SourceCreationIdempotencyStatus::InProgress,
+                )
+                | (
+                    SourceCreationIdempotencyClaim::Abandoned,
+                    SourceCreationIdempotencyStatus::Abandoned,
+                ) => {}
+                other => panic!("claim/seal race elected an invalid pair: {other:?}"),
+            }
+            let rows = sqlx::query_scalar::<_, i64>(
+                "SELECT COUNT(*) FROM source_creation_idempotency WHERE route = ?",
+            )
+            .bind(SOURCE_CREATION_ROUTE)
+            .fetch_one(&opened.database.pool)
+            .await
+            .expect("race row count should read");
+            assert_eq!(rows, i64::from(index + 1));
+        }
+    }
+
+    #[tokio::test]
+    async fn seal_does_not_cancel_an_active_owner_and_replays_after_completion() {
+        let (_directory, _opened, store, _clock) = fixture().await;
+        let request = json!({ "kind": "mcp_stdio" });
+        let reservation = fresh(&store, "active-seal", &request).await;
+        assert_eq!(
+            store
+                .seal_missing(1, SOURCE_CREATION_ROUTE, "active-seal")
+                .await
+                .expect("active seal should classify"),
+            SourceCreationIdempotencyStatus::InProgress
+        );
+        let body = br#"{"id":"active-source"}"#;
+        complete(
+            &store,
+            &reservation,
+            &SourceCreationResponse::json(201, body.to_vec()),
+        )
+        .await
+        .expect("active owner should still complete");
+        assert_eq!(
+            store
+                .seal_missing(1, SOURCE_CREATION_ROUTE, "active-seal")
+                .await
+                .expect("completed seal should replay"),
+            completed_replay(body)
+        );
+    }
+
+    #[tokio::test]
+    async fn startup_interrupts_reservations_and_fences_delayed_completion() {
+        let (_directory, opened, store, _clock) = fixture().await;
+        let request = json!({ "kind": "graphql" });
+        let reservation = fresh(&store, "restart-key", &request).await;
+        let recovery = recover_startup_at(&store.pool, 1_001)
+            .await
+            .expect("startup recovery should succeed");
+        assert_eq!(recovery.reservations_interrupted, 1);
+        assert!(matches!(
+            store
+                .claim(1, SOURCE_CREATION_ROUTE, "restart-key", &request)
+                .await
+                .expect("delayed claim should classify"),
+            SourceCreationIdempotencyClaim::Interrupted
+        ));
+
+        let catalog = CatalogStore::new(
+            opened.database.pool.clone(),
+            opened.database.keyring.clone(),
+        );
+        let error = create_empty_source(
+            &catalog,
+            &reservation,
+            "restart-fenced",
+            SourceKind::Graphql,
+        )
+        .await
+        .expect_err("interrupted reservation must fence catalog commit");
+        assert!(matches!(error, CatalogError::CorruptData(_)));
+        assert_eq!(
+            sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM sources")
+                .fetch_one(&opened.database.pool)
+                .await
+                .expect("source count should read"),
+            0
+        );
+    }
+
+    #[tokio::test]
+    async fn database_reopen_runs_interruption_recovery_under_the_instance_lock() {
+        let (directory, opened, store, _clock) = fixture().await;
+        let request = json!({ "kind": "mcp_http" });
+        fresh(&store, "real-restart-key", &request).await;
+        store.pool.close().await;
+        drop(store);
+        drop(opened);
+
+        let reopened = Database::open(&AppConfig::new(directory.path().to_path_buf()))
+            .await
+            .expect("database should reopen");
+        let restarted = SourceCreationIdempotencyStore::new(
+            reopened.database.pool.clone(),
+            reopened.database.keyring.clone(),
+        );
+        assert_eq!(
+            restarted
+                .lookup(1, SOURCE_CREATION_ROUTE, "real-restart-key")
+                .await
+                .expect("recovered key should read"),
+            Some(SourceCreationIdempotencyStatus::Interrupted)
+        );
+        reopened.database.pool.close().await;
+    }
+
+    #[tokio::test]
+    async fn definitive_failure_replays_exact_bytes_and_never_stores_plaintext() {
+        let (_directory, opened, store, _clock) = fixture().await;
+        let request = json!({
+            "kind": "openapi",
+            "credential": "request-secret-marker"
+        });
+        let reservation = fresh(&store, "raw-key-marker", &request).await;
+        let response = SourceCreationResponse {
+            status: 400,
+            headers: std::collections::BTreeMap::from([
+                ("content-type".to_owned(), "application/json".to_owned()),
+                ("x-safe".to_owned(), "stable".to_owned()),
+            ]),
+            body: br#"{"code":"definitive","marker":"response-secret-marker"}"#.to_vec(),
+        };
+        assert_eq!(
+            store
+                .fail(&reservation, &response)
+                .await
+                .expect("failure should persist"),
+            SourceCreationIdempotencyStatus::Replay(SourceCreationReplay {
+                kind: SourceCreationResponseKind::Failed,
+                response: response.clone(),
+            })
+        );
+        assert!(matches!(
+            store
+                .claim(1, SOURCE_CREATION_ROUTE, "raw-key-marker", &request)
+                .await
+                .expect("delayed duplicate should replay"),
+            SourceCreationIdempotencyClaim::Replay(SourceCreationReplay {
+                kind: SourceCreationResponseKind::Failed,
+                response: replayed,
+            }) if replayed == response
+        ));
+
+        let stored = sqlx::query_as::<_, (Vec<u8>, Vec<u8>, Vec<u8>)>(
+            "SELECT key_digest, request_digest, response_ciphertext \
+             FROM source_creation_idempotency WHERE id = ?",
+        )
+        .bind(reservation.id())
+        .fetch_one(&opened.database.pool)
+        .await
+        .expect("stored row should read");
+        let storage =
+            String::from_utf8_lossy(&[stored.0, stored.1, stored.2].concat()).into_owned();
+        assert!(!storage.contains("raw-key-marker"));
+        assert!(!storage.contains("request-secret-marker"));
+        assert!(!storage.contains("response-secret-marker"));
+    }
+
+    #[tokio::test]
+    async fn copied_ciphertext_cannot_cross_its_admin_route_record_aad_scope() {
+        let (_directory, opened, store, _clock) = fixture().await;
+        let request = json!({ "kind": "openapi" });
+        let reservation = fresh(&store, "aad-original", &request).await;
+        complete(
+            &store,
+            &reservation,
+            &SourceCreationResponse::json(201, br#"{"id":"aad-source"}"#.to_vec()),
+        )
+        .await
+        .expect("original response should complete");
+        let ciphertext = sqlx::query_scalar::<_, Vec<u8>>(
+            "SELECT response_ciphertext FROM source_creation_idempotency WHERE id = ?",
+        )
+        .bind(reservation.id())
+        .fetch_one(&opened.database.pool)
+        .await
+        .expect("original ciphertext should read");
+        let copied_key_digest = store
+            .keyring
+            .digest(super::KEY_DIGEST_PURPOSE, b"aad-copied");
+        sqlx::query(
+            "INSERT INTO source_creation_idempotency ( \
+                 id, admin_id, route, key_digest, request_digest, state, response_ciphertext, \
+                 created_at, updated_at, completed_at, expires_at, purge_at \
+             ) VALUES ( \
+                 'copied-response', 1, 'POST /different', ?, ?, 'completed', ?, \
+                 1000, 1000, 1000, 87400, 605800 \
+             )",
+        )
+        .bind(copied_key_digest.to_vec())
+        .bind(vec![7_u8; 32])
+        .bind(ciphertext)
+        .execute(&opened.database.pool)
+        .await
+        .expect("copied ciphertext fixture should insert");
+
+        assert!(matches!(
+            store.lookup(1, "POST /different", "aad-copied").await,
+            Err(SourceCreationIdempotencyError::Crypto(_))
+        ));
+        assert!(matches!(
+            store.lookup(1, "POST /different", "aad-copied").await,
+            Err(SourceCreationIdempotencyError::Crypto(_))
+        ));
+        assert_eq!(
+            sqlx::query_scalar::<_, i64>(
+                "SELECT COUNT(*) FROM source_creation_idempotency WHERE id = 'copied-response'",
+            )
+            .fetch_one(&opened.database.pool)
+            .await
+            .expect("copied row count should read"),
+            1
+        );
+    }
+
+    #[tokio::test]
+    async fn response_envelope_rejects_every_immutable_binding_and_kind_substitution() {
+        let (_directory, _opened, store, _clock) = fixture().await;
+        let request = json!({ "kind": "openapi", "secret": "bound" });
+        let reservation = fresh(&store, "full-aad-binding", &request).await;
+        let response = SourceCreationResponse::json(201, br#"{"id":"bound-source"}"#.to_vec());
+        complete(&store, &reservation, &response)
+            .await
+            .expect("bound response should complete");
+        let mut transaction = store
+            .pool
+            .begin()
+            .await
+            .expect("binding read transaction should begin");
+        let original = super::fetch_by_id(&mut transaction, reservation.id())
+            .await
+            .expect("bound row should read")
+            .expect("bound row should exist");
+        transaction
+            .commit()
+            .await
+            .expect("binding read transaction should commit");
+        assert_eq!(
+            super::decrypt_response(&store.keyring, &original)
+                .expect("untampered response should decrypt"),
+            response
+        );
+
+        let mut substitutions = Vec::new();
+        let mut row = original.clone();
+        row.id.push_str("-changed");
+        substitutions.push(("id", row));
+        let mut row = original.clone();
+        row.admin_id += 1;
+        substitutions.push(("admin_id", row));
+        let mut row = original.clone();
+        row.route.push_str("/changed");
+        substitutions.push(("route", row));
+        let mut row = original.clone();
+        row.key_digest[0] ^= 1;
+        substitutions.push(("key_digest", row));
+        let mut row = original.clone();
+        row.request_digest
+            .as_mut()
+            .expect("completed row has a request digest")[0] ^= 1;
+        substitutions.push(("request_digest", row));
+        let mut row = original.clone();
+        row.created_at += 1;
+        substitutions.push(("created_at", row));
+        let mut row = original.clone();
+        row.state = "failed".to_owned();
+        substitutions.push(("response_kind", row));
+        let mut row = original.clone();
+        row.updated_at += 1;
+        substitutions.push(("updated_at", row));
+        let mut row = original.clone();
+        *row.completed_at
+            .as_mut()
+            .expect("completed row has a completion time") += 1;
+        substitutions.push(("completed_at", row));
+        let mut row = original.clone();
+        *row.expires_at
+            .as_mut()
+            .expect("completed row has an expiry") += 1;
+        substitutions.push(("expires_at", row));
+        let mut row = original.clone();
+        *row.purge_at
+            .as_mut()
+            .expect("completed row has a purge time") += 1;
+        substitutions.push(("purge_at", row));
+        let mut row = original.clone();
+        row.response_ciphertext
+            .as_mut()
+            .expect("completed row has ciphertext")[0] ^= 1;
+        substitutions.push(("response_ciphertext", row));
+
+        for (field, row) in substitutions {
+            assert!(
+                super::decrypt_response(&store.keyring, &row).is_err(),
+                "tampered {field} must fail closed"
+            );
+        }
+
+        let binding = super::response_binding_from_row(&original)
+            .expect("completed row should produce a response binding");
+        let mismatched_envelope = serde_json::to_vec(&super::StoredResponse {
+            kind: SourceCreationResponseKind::Failed,
+            status: response.status,
+            headers: response.headers.clone(),
+            body_base64: super::STANDARD.encode(&response.body),
+        })
+        .expect("mismatched envelope should encode");
+        let mismatched_ciphertext = store
+            .keyring
+            .encrypt(
+                super::RESPONSE_PURPOSE,
+                &super::response_record_id(&binding),
+                &mismatched_envelope,
+            )
+            .expect("mismatched envelope fixture should encrypt");
+        let mut mismatched_row = original;
+        mismatched_row.response_ciphertext = Some(mismatched_ciphertext);
+        assert!(matches!(
+            super::decrypt_response(&store.keyring, &mismatched_row),
+            Err(SourceCreationIdempotencyError::CorruptData)
+        ));
+    }
+
+    #[tokio::test]
+    async fn uncacheable_failure_becomes_an_interrupted_tombstone() {
+        let (_directory, _opened, store, _clock) = fixture().await;
+        let request = json!({ "kind": "openapi" });
+        let reservation = fresh(&store, "oversized-failure", &request).await;
+        let oversized = SourceCreationResponse::json(500, vec![b'x'; MAX_RESPONSE_BODY_BYTES + 1]);
+        assert_eq!(
+            store
+                .fail(&reservation, &oversized)
+                .await
+                .expect("uncacheable failure should be fenced"),
+            SourceCreationIdempotencyStatus::Interrupted
+        );
+        assert!(matches!(
+            store
+                .claim(1, SOURCE_CREATION_ROUTE, "oversized-failure", &request)
+                .await
+                .expect("retry should remain fenced"),
+            SourceCreationIdempotencyClaim::Interrupted
+        ));
+    }
+
+    #[tokio::test]
+    async fn catalog_commit_is_atomic_correlated_and_replay_survives_source_deletion() {
+        let (_directory, opened, store, _clock) = fixture().await;
+        let request = json!({ "kind": "openapi", "displayName": "Atomic" });
+        let reservation = fresh(&store, "catalog-key", &request).await;
+        let catalog = CatalogStore::new(
+            opened.database.pool.clone(),
+            opened.database.keyring.clone(),
+        );
+        let (source, _) =
+            create_empty_source(&catalog, &reservation, "atomic", SourceKind::Openapi)
+                .await
+                .expect("source and replay should commit");
+        let expected_body = serde_json::to_vec(&source).expect("source should encode");
+        assert!(matches!(
+            store
+                .claim(1, SOURCE_CREATION_ROUTE, "catalog-key", &request)
+                .await
+                .expect("completed key should replay"),
+            SourceCreationIdempotencyClaim::Replay(SourceCreationReplay {
+                kind: SourceCreationResponseKind::Completed,
+                response,
+            }) if response == SourceCreationResponse::json(201, expected_body.clone())
+        ));
+        let audit_metadata = sqlx::query_scalar::<_, String>(
+            "SELECT metadata_json FROM audit_events \
+             WHERE action = 'source.created' AND source_id = ?",
+        )
+        .bind(&source.id)
+        .fetch_one(&opened.database.pool)
+        .await
+        .expect("creation audit should read");
+        let audit_metadata: Value =
+            serde_json::from_str(&audit_metadata).expect("audit metadata should decode");
+        assert_eq!(audit_metadata["idempotencyRecordId"], reservation.id());
+        assert!(!audit_metadata.to_string().contains("catalog-key"));
+        let audit_count_before_replay =
+            sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM audit_events")
+                .fetch_one(&opened.database.pool)
+                .await
+                .expect("audit count should read");
+        let revision_before_replay = catalog
+            .global_revision()
+            .await
+            .expect("catalog revision should read");
+        assert!(matches!(
+            store
+                .claim(1, SOURCE_CREATION_ROUTE, "catalog-key", &request)
+                .await
+                .expect("second replay should classify"),
+            SourceCreationIdempotencyClaim::Replay(_)
+        ));
+        assert_eq!(
+            sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM audit_events")
+                .fetch_one(&opened.database.pool)
+                .await
+                .expect("audit count should read"),
+            audit_count_before_replay
+        );
+        assert_eq!(
+            catalog
+                .global_revision()
+                .await
+                .expect("catalog revision should read"),
+            revision_before_replay
+        );
+
+        catalog
+            .delete_source(&source.id, AuditContext::admin("delete-source", 1))
+            .await
+            .expect("source should delete");
+        assert!(matches!(
+            store
+                .claim(1, SOURCE_CREATION_ROUTE, "catalog-key", &request)
+                .await
+                .expect("deleted source response should still replay"),
+            SourceCreationIdempotencyClaim::Replay(SourceCreationReplay { response, .. })
+                if response.body == expected_body
+        ));
+        assert_eq!(
+            sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM sources")
+                .fetch_one(&opened.database.pool)
+                .await
+                .expect("source count should read"),
+            0
+        );
+    }
+
+    #[tokio::test]
+    async fn stale_reservation_cannot_complete_a_replacement_record() {
+        let (_directory, opened, store, clock) = fixture().await;
+        let request = json!({ "kind": "openapi" });
+        let stale = fresh(&store, "stale-key", &request).await;
+        store
+            .interrupt(&stale)
+            .await
+            .expect("old reservation should terminalize");
+        clock.set(1_000 + SOURCE_CREATION_TOMBSTONE_TTL_SECONDS);
+        assert_eq!(
+            store
+                .lookup(1, SOURCE_CREATION_ROUTE, "stale-key")
+                .await
+                .expect("expired tombstone should purge"),
+            None
+        );
+        let replacement = fresh(&store, "stale-key", &request).await;
+        assert_ne!(stale.id(), replacement.id());
+        let catalog = CatalogStore::new(
+            opened.database.pool.clone(),
+            opened.database.keyring.clone(),
+        );
+        assert!(
+            create_empty_source(&catalog, &stale, "stale", SourceKind::Openapi)
+                .await
+                .is_err()
+        );
+        assert_eq!(
+            store
+                .lookup(1, SOURCE_CREATION_ROUTE, "stale-key")
+                .await
+                .expect("replacement should remain"),
+            Some(SourceCreationIdempotencyStatus::InProgress)
+        );
+        assert_eq!(
+            sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM sources")
+                .fetch_one(&opened.database.pool)
+                .await
+                .expect("source count should read"),
+            0
+        );
+    }
+
+    #[tokio::test]
+    async fn responses_expire_to_a_tombstone_before_the_key_can_be_purged() {
+        let (_directory, _opened, store, clock) = fixture().await;
+        let request = json!({ "kind": "openapi" });
+        let reservation = fresh(&store, "expiry-key", &request).await;
+        complete(
+            &store,
+            &reservation,
+            &SourceCreationResponse::json(201, br#"{"id":"source"}"#.to_vec()),
+        )
+        .await
+        .expect("completion should succeed");
+        clock.set(1_000 + SOURCE_CREATION_IDEMPOTENCY_TTL_SECONDS);
+        assert!(matches!(
+            store
+                .claim(1, SOURCE_CREATION_ROUTE, "expiry-key", &request)
+                .await
+                .expect("expired key should classify"),
+            SourceCreationIdempotencyClaim::Expired
+        ));
+        clock.set(1_000 + SOURCE_CREATION_TOMBSTONE_TTL_SECONDS);
+        assert_eq!(
+            store
+                .lookup(1, SOURCE_CREATION_ROUTE, "expiry-key")
+                .await
+                .expect("purge boundary should read"),
+            None
+        );
+    }
+
+    #[tokio::test]
+    async fn claim_admission_prioritizes_scoped_tombstones_and_persists_monotonic_clock() {
+        let (_directory, opened, store, clock) = fixture().await;
+        seed_admission_starvation(
+            &opened.database.pool,
+            "claim-admission",
+            SOURCE_CREATION_ROUTE,
+        )
+        .await;
+
+        const ADVANCED_NOW: i64 = 20_000;
+        clock.set(ADVANCED_NOW);
+        let SourceCreationIdempotencyClaim::Fresh(reservation) = store
+            .claim(
+                1,
+                SOURCE_CREATION_ROUTE,
+                "scoped-claim-admission",
+                &json!({ "kind": "openapi" }),
+            )
+            .await
+            .expect("scoped cleanup should admit the claim")
+        else {
+            panic!("scoped cleanup should elect a fresh claim");
+        };
+        assert_eq!(reservation.created_at, ADVANCED_NOW);
+        clock.set(2);
+        assert_eq!(
+            store
+                .lookup(1, SOURCE_CREATION_ROUTE, "scoped-claim-admission")
+                .await
+                .expect("backward-clock claim lookup should succeed"),
+            Some(SourceCreationIdempotencyStatus::InProgress)
+        );
+        assert_eq!(
+            sqlx::query_scalar::<_, i64>(
+                "SELECT COUNT(*) FROM source_creation_idempotency \
+                 WHERE admin_id = 1 AND route = ?",
+            )
+            .bind(SOURCE_CREATION_ROUTE)
+            .fetch_one(&opened.database.pool)
+            .await
+            .expect("admitted claim scope count should read"),
+            1
+        );
+        assert_eq!(
+            sqlx::query_scalar::<_, i64>(
+                "SELECT effective_now FROM source_creation_idempotency_clock WHERE id = 1",
+            )
+            .fetch_one(&opened.database.pool)
+            .await
+            .expect("effective claim clock should read"),
+            ADVANCED_NOW
+        );
+    }
+
+    #[tokio::test]
+    async fn seal_admission_prioritizes_scoped_tombstones_on_its_first_call() {
+        let (_directory, opened, store, clock) = fixture().await;
+        let seal_route = "POST /api/v1/sources/seal";
+        seed_admission_starvation(&opened.database.pool, "seal-admission", seal_route).await;
+        const ADVANCED_NOW: i64 = 20_000;
+        clock.set(ADVANCED_NOW);
+        assert_eq!(
+            store
+                .seal_missing(1, seal_route, "scoped-seal-admission")
+                .await
+                .expect("first seal should admit after scoped cleanup"),
+            SourceCreationIdempotencyStatus::Abandoned
+        );
+        clock.set(2);
+        assert_eq!(
+            store
+                .lookup(1, seal_route, "scoped-seal-admission")
+                .await
+                .expect("backward-clock seal lookup should succeed"),
+            Some(SourceCreationIdempotencyStatus::Abandoned)
+        );
+        assert_eq!(
+            sqlx::query_scalar::<_, i64>(
+                "SELECT created_at FROM source_creation_idempotency \
+                 WHERE admin_id = 1 AND route = ?",
+            )
+            .bind(seal_route)
+            .fetch_one(&opened.database.pool)
+            .await
+            .expect("sealed row timestamp should read"),
+            ADVANCED_NOW
+        );
+        assert_eq!(
+            sqlx::query_scalar::<_, i64>(
+                "SELECT effective_now FROM source_creation_idempotency_clock WHERE id = 1",
+            )
+            .fetch_one(&opened.database.pool)
+            .await
+            .expect("effective clock should read"),
+            ADVANCED_NOW
+        );
+    }
+
+    #[tokio::test]
+    async fn row_and_response_capacity_fail_closed() {
+        let (_directory, _opened, store, _clock) = fixture().await;
+        let request = json!({ "kind": "openapi" });
+        let row_limited = store.clone().with_limits(SourceCreationIdempotencyLimits {
+            records: 1,
+            records_per_admin_route: 1,
+            response_ciphertext_bytes: 1_024,
+        });
+        fresh(&row_limited, "first-capacity", &request).await;
+        assert!(matches!(
+            row_limited
+                .claim(1, SOURCE_CREATION_ROUTE, "second-capacity", &request)
+                .await,
+            Err(SourceCreationIdempotencyError::Capacity)
+        ));
+
+        let response_limited = store.with_limits(SourceCreationIdempotencyLimits {
+            records: 10,
+            records_per_admin_route: 10,
+            response_ciphertext_bytes: 0,
+        });
+        let reservation = fresh(&response_limited, "response-capacity", &request).await;
+        assert_eq!(
+            response_limited
+                .fail(
+                    &reservation,
+                    &SourceCreationResponse::json(400, br#"{"code":"failed"}"#.to_vec()),
+                )
+                .await
+                .expect("response capacity should terminalize"),
+            SourceCreationIdempotencyStatus::Interrupted
+        );
+    }
+
+    async fn create_empty_source(
+        catalog: &CatalogStore,
+        reservation: &super::SourceCreationReservation,
+        slug: &str,
+        kind: SourceKind,
+    ) -> Result<
+        (
+            crate::catalog::SourceRecord,
+            crate::catalog::CatalogSyncResult,
+        ),
+        CatalogError,
+    > {
+        catalog
+            .create_source_with_catalog(
+                CreateSource {
+                    kind,
+                    preferred_slug: slug.to_owned(),
+                    display_name: slug.to_owned(),
+                    description: None,
+                    configuration: serde_json::Map::new(),
+                },
+                &CredentialPayload {
+                    schema_version: 1,
+                    payload: json!({}),
+                },
+                InitialCatalogSnapshot {
+                    artifacts: Vec::new(),
+                    tools: Vec::new(),
+                },
+                Vec::new(),
+                AuditContext::admin("source-create", 1)
+                    .with_source_creation_idempotency(reservation),
+            )
+            .await
+    }
+}
diff --git a/src/catalog/store.rs b/src/catalog/store.rs
new file mode 100644
index 000000000..53032ad51
--- /dev/null
+++ b/src/catalog/store.rs
@@ -0,0 +1,4593 @@
+use std::{
+    collections::{HashMap, HashSet},
+    str::FromStr,
+    sync::Arc,
+};
+
+use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
+use serde_json::{Map, Value, json};
+use sqlx::{FromRow, SqlitePool, Transaction};
+use tokio::sync::{RwLock, Semaphore};
+use uuid::Uuid;
+
+use super::{
+    ArtifactKind, AuditContext, BulkToolModeResult, CatalogError, CatalogSnapshot,
+    CatalogSyncResult, CreateSource, CredentialPayload, DEFAULT_PAGE_LIMIT, DescribedTool,
+    DiscoveryPage, InitialCatalogSnapshot, InvocationLease, InvocationLookup, InvocationPreflight,
+    InvocationRevisionToken, ListToolsFilter, MAX_PAGE_LIMIT, NewRequestLog,
+    OAuthBindingExpectation, RequestLogPage, RequestLogRecord, RequestOutcome, RequestSurface,
+    SourceHealth, SourceKind, SourceRecord, StagedToolBinding, StoredCredential, StoredToolBinding,
+    ToolBinding, ToolMode, ToolPage, ToolRecord, ToolSummary, UpdateSource, effective_mode, search,
+    source_idempotency,
+};
+use crate::{crypto::Keyring, unix_timestamp};
+
+const CREDENTIAL_PURPOSE: &str = "source-credential-v1";
+const RESERVED_SOURCE_SLUGS: [&str; 6] =
+    ["tools", "search", "describe", "sources", "executor", "then"];
+const RESERVED_TOOL_NAMES: [&str; 1] = ["then"];
+const TOOL_ERROR_TYPESCRIPT: &str =
+    "{ code: string; message: string; status?: number; details?: unknown; retryable?: boolean }";
+const TOOL_HTTP_META_TYPESCRIPT: &str = "{ status: number; headers: { [k: string]: string; } }";
+const TOOL_FILE_TYPESCRIPT: &str = r#"{ _tag: "ToolFile"; name?: string; mimeType: string; encoding: "base64"; data: string; byteLength: number; }"#;
+const MAX_SEARCH_CANDIDATES: i64 = 4_096;
+const MAX_SEARCH_QUERY_CHARACTERS: usize = 256;
+const MAX_SEARCH_QUERY_BYTES: usize = 1_024;
+const MAX_SEARCH_QUERY_TOKENS: usize = 64;
+const MAX_SEARCH_TOKEN_BYTES: usize = 256;
+const MAX_ACTIVE_TOOLS_PER_SOURCE: usize = 100_000;
+const MAX_TOMBSTONED_TOOLS_PER_SOURCE: usize = 25_000;
+const MAX_TOOL_HISTORY_PER_SOURCE: usize =
+    MAX_ACTIVE_TOOLS_PER_SOURCE + MAX_TOMBSTONED_TOOLS_PER_SOURCE;
+const MAX_REQUEST_LOG_ROWS: i64 = 10_000;
+const MAX_AUDIT_EVENT_ROWS: i64 = 10_000;
+const MAX_AUDIT_METADATA_BYTES: usize = 64 * 1024;
+const MAX_ARTIFACT_COUNT: usize = 4_096;
+const MAX_ARTIFACT_BYTES: usize = 8 * 1024 * 1024;
+const MAX_ARTIFACT_KEY_BYTES: usize = 1024;
+const MAX_SCHEMA_BYTES: usize = 2 * 1024 * 1024;
+const MAX_TYPESCRIPT_DEFINITIONS_BYTES: usize = 2 * 1024 * 1024;
+const MAX_TYPESCRIPT_PREVIEW_BYTES: usize = 256 * 1024;
+const MAX_TOOL_STABLE_KEY_BYTES: usize = 2 * 1024;
+const MAX_TOOL_NAME_BYTES: usize = 1024;
+const MAX_TOOL_DESCRIPTION_BYTES: usize = 16 * 1024;
+const MAX_SEARCH_DESCRIPTION_BYTES: usize = 32 * 1024;
+const MAX_SHORT_GRAM_DOCUMENT_BYTES: usize = 16 * 1024;
+const MAX_LOCAL_NAME_BYTES: usize = 128;
+const MAX_CATALOG_PAYLOAD_BYTES: usize = 32 * 1024 * 1024;
+const MAX_SOURCE_HEALTH_ERROR_CODE_BYTES: usize = 64;
+
+#[derive(Clone)]
+pub struct CatalogStore {
+    pool: SqlitePool,
+    keyring: Keyring,
+    mutation_lock: Arc<RwLock<()>>,
+    request_log_writes: Arc<Semaphore>,
+}
+
+#[derive(FromRow)]
+struct SourceRow {
+    id: String,
+    kind: String,
+    slug: String,
+    display_name: String,
+    description: Option<String>,
+    configuration_json: String,
+    mode_override: Option<String>,
+    health_status: String,
+    health_error_code: Option<String>,
+    revision: i64,
+    catalog_revision: i64,
+    created_at: i64,
+    updated_at: i64,
+    last_refreshed_at: Option<i64>,
+    tool_count: i64,
+    tombstoned_tool_count: i64,
+}
+
+#[derive(FromRow)]
+struct ToolRow {
+    id: String,
+    source_id: String,
+    source_slug: String,
+    source_mode_override: Option<String>,
+    stable_key: String,
+    local_name: String,
+    display_name: String,
+    description: Option<String>,
+    input_schema_json: String,
+    output_schema_json: Option<String>,
+    input_typescript: Option<String>,
+    output_typescript: Option<String>,
+    typescript_definitions_json: String,
+    intrinsic_mode: String,
+    mode_override: Option<String>,
+    present: i64,
+    revision: i64,
+    created_at: i64,
+    updated_at: i64,
+    last_seen_at: i64,
+    tombstoned_at: Option<i64>,
+}
+
+#[derive(FromRow)]
+struct ToolSummaryRow {
+    id: String,
+    source_id: String,
+    source_slug: String,
+    source_mode_override: Option<String>,
+    stable_key: String,
+    local_name: String,
+    display_name: String,
+    description: Option<String>,
+    intrinsic_mode: String,
+    mode_override: Option<String>,
+    present: i64,
+    revision: i64,
+    created_at: i64,
+    updated_at: i64,
+    last_seen_at: i64,
+    tombstoned_at: Option<i64>,
+}
+
+#[derive(FromRow)]
+struct RequestLogRow {
+    request_id: String,
+    actor_api_token_id: Option<String>,
+    surface: String,
+    source_id: Option<String>,
+    tool_id: Option<String>,
+    path_snapshot: Option<String>,
+    outcome: String,
+    error_code: Option<String>,
+    duration_ms: i64,
+    approval_id: Option<String>,
+    created_at: i64,
+}
+
+#[derive(FromRow)]
+struct InvocationRow {
+    tool_id: String,
+    source_id: String,
+    source_display_name: String,
+    tool_display_name: String,
+    source_kind: String,
+    source_slug: String,
+    stable_key: String,
+    local_name: String,
+    present: i64,
+    intrinsic_mode: String,
+    tool_mode_override: Option<String>,
+    source_mode_override: Option<String>,
+    tool_revision: i64,
+    source_revision: i64,
+    catalog_revision: i64,
+    configuration_json: String,
+    input_schema_json: String,
+    binding_protocol: Option<String>,
+    binding_version: Option<i64>,
+    definition_json: Option<String>,
+    binding_revision: Option<i64>,
+    credential_schema_version: Option<i64>,
+    credential_ciphertext: Option<Vec<u8>>,
+    credential_revision: Option<i64>,
+}
+
+struct PreparedTool {
+    stable_key: String,
+    preferred_name: String,
+    display_name: String,
+    description: Option<String>,
+    search_description: String,
+    search_short_grams: String,
+    input_schema_json: String,
+    output_schema_json: Option<String>,
+    input_typescript: Option<String>,
+    output_typescript: Option<String>,
+    typescript_definitions_json: String,
+    intrinsic_mode: ToolMode,
+}
+
+struct PreparedArtifact {
+    kind: ArtifactKind,
+    stable_key: String,
+    content_json: String,
+}
+
+struct PreparedSnapshot {
+    tools: Vec<PreparedTool>,
+    artifacts: Vec<PreparedArtifact>,
+    payload_bytes: usize,
+}
+
+enum CatalogApplyKind<'a> {
+    Initial {
+        source_kind: SourceKind,
+        slug: &'a str,
+        credential_schema_version: u32,
+    },
+    Refresh,
+}
+
+#[derive(Clone, Copy)]
+enum InitialSourceState {
+    Unknown,
+    Healthy,
+    AuthorizationRequired,
+}
+
+struct PreparedToolBinding {
+    stable_key: String,
+    protocol: &'static str,
+    version: i64,
+    definition_json: String,
+}
+
+type PreparedToolBindings = Vec<PreparedToolBinding>;
+
+#[derive(Clone, Copy)]
+struct PayloadLimits {
+    artifact_count: usize,
+    artifact: usize,
+    artifact_key: usize,
+    schema: usize,
+    typescript_definitions: usize,
+    typescript_preview: usize,
+    tool_stable_key: usize,
+    tool_name: usize,
+    tool_description: usize,
+    search_description: usize,
+    short_gram_document: usize,
+    local_name: usize,
+    aggregate: usize,
+}
+
+impl Default for PayloadLimits {
+    fn default() -> Self {
+        Self {
+            artifact_count: MAX_ARTIFACT_COUNT,
+            artifact: MAX_ARTIFACT_BYTES,
+            artifact_key: MAX_ARTIFACT_KEY_BYTES,
+            schema: MAX_SCHEMA_BYTES,
+            typescript_definitions: MAX_TYPESCRIPT_DEFINITIONS_BYTES,
+            typescript_preview: MAX_TYPESCRIPT_PREVIEW_BYTES,
+            tool_stable_key: MAX_TOOL_STABLE_KEY_BYTES,
+            tool_name: MAX_TOOL_NAME_BYTES,
+            tool_description: MAX_TOOL_DESCRIPTION_BYTES,
+            search_description: MAX_SEARCH_DESCRIPTION_BYTES,
+            short_gram_document: MAX_SHORT_GRAM_DOCUMENT_BYTES,
+            local_name: MAX_LOCAL_NAME_BYTES,
+            aggregate: MAX_CATALOG_PAYLOAD_BYTES,
+        }
+    }
+}
+
+struct PayloadBudget {
+    limits: PayloadLimits,
+    consumed: usize,
+}
+
+struct NameAllocator {
+    used: HashSet<String>,
+    next_suffix: HashMap<CollisionNamespace, u64>,
+    candidate_probes: usize,
+}
+
+#[derive(Eq, Hash, PartialEq)]
+struct CollisionNamespace {
+    prefix: String,
+    separator: char,
+    suffix_digits: u32,
+}
+
+impl CatalogStore {
+    pub(crate) fn new(pool: SqlitePool, keyring: Keyring) -> Self {
+        Self {
+            pool,
+            keyring,
+            mutation_lock: Arc::new(RwLock::new(())),
+            request_log_writes: Arc::new(Semaphore::new(1)),
+        }
+    }
+
+    pub fn pool(&self) -> &SqlitePool {
+        &self.pool
+    }
+
+    pub(crate) fn source_creation_idempotency(
+        &self,
+    ) -> source_idempotency::SourceCreationIdempotencyStore {
+        source_idempotency::SourceCreationIdempotencyStore::new(
+            self.pool.clone(),
+            self.keyring.clone(),
+        )
+    }
+
+    pub async fn global_revision(&self) -> Result<i64, CatalogError> {
+        Ok(
+            sqlx::query_scalar("SELECT revision FROM catalog_state WHERE id = 1")
+                .fetch_one(&self.pool)
+                .await?,
+        )
+    }
+
+    pub async fn create_source_with_catalog(
+        &self,
+        input: CreateSource,
+        credential: &CredentialPayload,
+        snapshot: InitialCatalogSnapshot,
+        bindings: Vec<StagedToolBinding>,
+        audit: AuditContext<'_>,
+    ) -> Result<(SourceRecord, CatalogSyncResult), CatalogError> {
+        self.create_source_with_catalog_health(
+            input,
+            credential,
+            snapshot,
+            bindings,
+            SourceHealth::Healthy,
+            audit,
+        )
+        .await
+    }
+
+    pub async fn create_source_with_catalog_health(
+        &self,
+        input: CreateSource,
+        credential: &CredentialPayload,
+        snapshot: InitialCatalogSnapshot,
+        bindings: Vec<StagedToolBinding>,
+        initial_health: SourceHealth,
+        audit: AuditContext<'_>,
+    ) -> Result<(SourceRecord, CatalogSyncResult), CatalogError> {
+        if initial_health == SourceHealth::Error {
+            return Err(validation(
+                "invalid_initial_source_health",
+                "Atomic source creation supports healthy or unknown initial health.",
+            ));
+        }
+        self.create_source_with_catalog_state(
+            input,
+            credential,
+            snapshot,
+            bindings,
+            match initial_health {
+                SourceHealth::Unknown => InitialSourceState::Unknown,
+                SourceHealth::Healthy => InitialSourceState::Healthy,
+                SourceHealth::Error => unreachable!("error initial health was rejected"),
+            },
+            audit,
+        )
+        .await
+    }
+
+    pub async fn create_authorization_required_source_with_catalog(
+        &self,
+        input: CreateSource,
+        credential: &CredentialPayload,
+        snapshot: InitialCatalogSnapshot,
+        bindings: Vec<StagedToolBinding>,
+        audit: AuditContext<'_>,
+    ) -> Result<(SourceRecord, CatalogSyncResult), CatalogError> {
+        self.create_source_with_catalog_state(
+            input,
+            credential,
+            snapshot,
+            bindings,
+            InitialSourceState::AuthorizationRequired,
+            audit,
+        )
+        .await
+    }
+
+    async fn create_source_with_catalog_state(
+        &self,
+        input: CreateSource,
+        credential: &CredentialPayload,
+        snapshot: InitialCatalogSnapshot,
+        bindings: Vec<StagedToolBinding>,
+        initial_state: InitialSourceState,
+        audit: AuditContext<'_>,
+    ) -> Result<(SourceRecord, CatalogSyncResult), CatalogError> {
+        if !matches!(
+            input.kind,
+            SourceKind::Openapi | SourceKind::Graphql | SourceKind::McpHttp | SourceKind::McpStdio
+        ) {
+            return Err(validation(
+                "invalid_source_kind",
+                "Atomic imported-source creation supports OpenAPI, GraphQL, and MCP sources.",
+            ));
+        }
+        let display_name = validate_text(
+            "invalid_source_name",
+            "Source names must contain between 1 and 200 characters.",
+            &input.display_name,
+            200,
+        )?;
+        let description = validate_optional_text(
+            "invalid_source_description",
+            "Source descriptions may contain at most 2000 characters.",
+            input.description.as_deref(),
+            2000,
+        )?;
+        if credential.schema_version == 0 {
+            return Err(validation(
+                "invalid_credential_schema",
+                "Credential schema versions must be positive.",
+            ));
+        }
+        let (prepared, prepared_bindings) =
+            prepare_initial_snapshot_and_bindings(snapshot, bindings)?;
+        if prepared_bindings
+            .iter()
+            .map(|binding| &binding.stable_key)
+            .collect::<HashSet<_>>()
+            != prepared
+                .tools
+                .iter()
+                .map(|tool| &tool.stable_key)
+                .collect::<HashSet<_>>()
+        {
+            return Err(validation(
+                "incomplete_tool_bindings",
+                "Every staged imported tool must have exactly one binding.",
+            ));
+        }
+        if prepared_bindings
+            .iter()
+            .any(|binding| binding.protocol != input.kind.as_str())
+        {
+            return Err(validation(
+                "invalid_source_kind",
+                "Every staged tool binding must match its source protocol.",
+            ));
+        }
+
+        let source_id = Uuid::new_v4().to_string();
+        let configuration_json = serde_json::to_string(&input.configuration)?;
+        let credential_plaintext = serde_json::to_vec(&credential.payload)?;
+        let credential_ciphertext =
+            self.keyring
+                .encrypt(CREDENTIAL_PURPOSE, &source_id, &credential_plaintext)?;
+        let base_slug = normalize_source_slug(&input.preferred_slug);
+        let now = unix_timestamp();
+        let _write = self.mutation_lock.write().await;
+        let mut transaction = self.pool.begin_with("BEGIN IMMEDIATE").await?;
+
+        let mut used_slugs = sqlx::query_scalar::<_, String>("SELECT slug FROM sources")
+            .fetch_all(&mut *transaction)
+            .await?
+            .into_iter()
+            .collect::<HashSet<_>>();
+        used_slugs.extend(RESERVED_SOURCE_SLUGS.into_iter().map(str::to_owned));
+        let slug = NameAllocator::new(used_slugs).allocate(&base_slug, 63, '_');
+        let search_short_grams = search::short_gram_document(&[&slug]);
+        let (initial_health, initial_health_error_code) = match initial_state {
+            InitialSourceState::Unknown => ("unknown", None),
+            InitialSourceState::Healthy => ("healthy", None),
+            InitialSourceState::AuthorizationRequired => ("error", Some("authorization_required")),
+        };
+        let last_refreshed_at = (initial_health == "healthy").then_some(now);
+        sqlx::query(
+            "INSERT INTO sources \
+             (id, kind, slug, search_short_grams, display_name, description, configuration_json, \
+              health_status, health_error_code, revision, catalog_revision, created_at, updated_at, \
+              last_refreshed_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 1, 1, ?, ?, ?)",
+        )
+        .bind(&source_id)
+        .bind(input.kind.as_str())
+        .bind(&slug)
+        .bind(search_short_grams)
+        .bind(display_name)
+        .bind(description)
+        .bind(configuration_json)
+        .bind(initial_health)
+        .bind(initial_health_error_code)
+        .bind(now)
+        .bind(now)
+        .bind(last_refreshed_at)
+        .execute(&mut *transaction)
+        .await?;
+        sqlx::query(
+            "INSERT INTO source_credentials \
+             (source_id, schema_version, payload_ciphertext, revision, created_at, updated_at) \
+             VALUES (?, ?, ?, 0, ?, ?)",
+        )
+        .bind(&source_id)
+        .bind(i64::from(credential.schema_version))
+        .bind(credential_ciphertext)
+        .bind(now)
+        .bind(now)
+        .execute(&mut *transaction)
+        .await?;
+
+        apply_artifacts(&mut transaction, &source_id, &prepared.artifacts, now).await?;
+        let missing = apply_tools(&mut transaction, &source_id, &prepared.tools, now).await?;
+        debug_assert!(missing.is_empty());
+        apply_tool_bindings(&mut transaction, &source_id, &prepared_bindings, now).await?;
+        rebuild_search_indexes(&mut transaction, &source_id).await?;
+
+        let source_path = format!("tools.{slug}");
+        let (source_revision, catalog_revision, global_revision) = finalize_catalog_apply(
+            &mut transaction,
+            audit,
+            &source_id,
+            &source_path,
+            CatalogApplyKind::Initial {
+                source_kind: input.kind,
+                slug: &slug,
+                credential_schema_version: credential.schema_version,
+            },
+            prepared.tools.len(),
+            prepared.artifacts.len(),
+            0,
+            now,
+        )
+        .await?;
+
+        let source = sqlx::query_as::<_, SourceRow>(SOURCE_SELECT_BY_ID)
+            .bind(&source_id)
+            .fetch_one(&mut *transaction)
+            .await?
+            .try_into()?;
+        if let Some(reservation) = audit.source_creation_idempotency() {
+            let response_body = serde_json::to_vec(&source)?;
+            source_idempotency::complete_source_creation_in(
+                &mut transaction,
+                &self.keyring,
+                reservation,
+                &response_body,
+                now,
+            )
+            .await?;
+        }
+        transaction.commit().await?;
+        let sync = CatalogSyncResult {
+            source_id,
+            source_revision,
+            catalog_revision,
+            global_revision,
+            active_tool_count: prepared.tools.len(),
+            tombstoned_tool_count: 0,
+        };
+        Ok((source, sync))
+    }
+
+    pub async fn create_source(
+        &self,
+        input: CreateSource,
+        audit: AuditContext<'_>,
+    ) -> Result<SourceRecord, CatalogError> {
+        let display_name = validate_text(
+            "invalid_source_name",
+            "Source names must contain between 1 and 200 characters.",
+            &input.display_name,
+            200,
+        )?;
+        let description = validate_optional_text(
+            "invalid_source_description",
+            "Source descriptions may contain at most 2000 characters.",
+            input.description.as_deref(),
+            2000,
+        )?;
+        let base_slug = normalize_source_slug(&input.preferred_slug);
+        let source_id = Uuid::new_v4().to_string();
+        let configuration_json = serde_json::to_string(&input.configuration)?;
+        let now = unix_timestamp();
+        let _write = self.mutation_lock.write().await;
+        let mut transaction = self.pool.begin_with("BEGIN IMMEDIATE").await?;
+        let mut used_slugs = sqlx::query_scalar::<_, String>("SELECT slug FROM sources")
+            .fetch_all(&mut *transaction)
+            .await?
+            .into_iter()
+            .collect::<HashSet<_>>();
+        used_slugs.extend(RESERVED_SOURCE_SLUGS.into_iter().map(str::to_owned));
+        let slug = NameAllocator::new(used_slugs).allocate(&base_slug, 63, '_');
+        let search_short_grams = search::short_gram_document(&[&slug]);
+        sqlx::query(
+            "INSERT INTO sources \
+             (id, kind, slug, search_short_grams, display_name, description, configuration_json, \
+              created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",
+        )
+        .bind(&source_id)
+        .bind(input.kind.as_str())
+        .bind(&slug)
+        .bind(search_short_grams)
+        .bind(display_name)
+        .bind(description)
+        .bind(configuration_json)
+        .bind(now)
+        .bind(now)
+        .execute(&mut *transaction)
+        .await?;
+        bump_global_revision(&mut transaction, now).await?;
+        insert_audit(
+            &mut transaction,
+            audit,
+            "source.created",
+            Some(&source_id),
+            None,
+            Some(&format!("tools.{slug}")),
+            source_created_audit_metadata(audit, input.kind, &slug),
+            now,
+        )
+        .await?;
+        let source: SourceRecord = sqlx::query_as::<_, SourceRow>(SOURCE_SELECT_BY_ID)
+            .bind(&source_id)
+            .fetch_one(&mut *transaction)
+            .await?
+            .try_into()?;
+        if let Some(reservation) = audit.source_creation_idempotency() {
+            let response_body = serde_json::to_vec(&source)?;
+            source_idempotency::complete_source_creation_in(
+                &mut transaction,
+                &self.keyring,
+                reservation,
+                &response_body,
+                now,
+            )
+            .await?;
+        }
+        transaction.commit().await?;
+        Ok(source)
+    }
+
+    pub async fn list_sources(&self) -> Result<Vec<SourceRecord>, CatalogError> {
+        Ok(self.list_sources_snapshot().await?.0)
+    }
+
+    pub async fn list_sources_snapshot(&self) -> Result<(Vec<SourceRecord>, i64), CatalogError> {
+        let mut transaction = self.pool.begin().await?;
+        let sources = sqlx::query_as::<_, SourceRow>(SOURCE_SELECT_ALL)
+            .fetch_all(&mut *transaction)
+            .await?
+            .into_iter()
+            .map(SourceRecord::try_from)
+            .collect::<Result<Vec<_>, _>>()?;
+        let revision = sqlx::query_scalar("SELECT revision FROM catalog_state WHERE id = 1")
+            .fetch_one(&mut *transaction)
+            .await?;
+        transaction.commit().await?;
+        Ok((sources, revision))
+    }
+
+    pub async fn source(&self, source_id: &str) -> Result<SourceRecord, CatalogError> {
+        sqlx::query_as::<_, SourceRow>(SOURCE_SELECT_BY_ID)
+            .bind(source_id)
+            .fetch_optional(&self.pool)
+            .await?
+            .ok_or(CatalogError::NotFound { entity: "source" })?
+            .try_into()
+    }
+
+    pub async fn update_source(
+        &self,
+        source_id: &str,
+        input: UpdateSource,
+        audit: AuditContext<'_>,
+    ) -> Result<SourceRecord, CatalogError> {
+        let display_name = validate_text(
+            "invalid_source_name",
+            "Source names must contain between 1 and 200 characters.",
+            &input.display_name,
+            200,
+        )?;
+        let description = validate_optional_text(
+            "invalid_source_description",
+            "Source descriptions may contain at most 2000 characters.",
+            input.description.as_deref(),
+            2000,
+        )?;
+        let configuration_json = serde_json::to_string(&input.configuration)?;
+        let _write = self.mutation_lock.write().await;
+        let now = unix_timestamp();
+        let mut transaction = self.pool.begin_with("BEGIN IMMEDIATE").await?;
+        let changed = sqlx::query(
+            "UPDATE sources SET display_name = ?, description = ?, configuration_json = ?, \
+             revision = revision + 1, updated_at = ? WHERE id = ? AND revision = ?",
+        )
+        .bind(display_name)
+        .bind(description)
+        .bind(configuration_json)
+        .bind(now)
+        .bind(source_id)
+        .bind(input.expected_revision)
+        .execute(&mut *transaction)
+        .await?
+        .rows_affected();
+        if changed == 0 {
+            return Err(revision_or_not_found(
+                &mut transaction,
+                "sources",
+                source_id,
+                "source",
+                input.expected_revision,
+            )
+            .await?);
+        }
+        let global_revision = bump_global_revision(&mut transaction, now).await?;
+        let source_path = source_path_snapshot(&mut transaction, source_id).await?;
+        insert_audit(
+            &mut transaction,
+            audit,
+            "source.updated",
+            Some(source_id),
+            None,
+            Some(&source_path),
+            json!({ "globalRevision": global_revision }),
+            now,
+        )
+        .await?;
+        transaction.commit().await?;
+        self.source(source_id).await
+    }
+
+    pub async fn delete_source(
+        &self,
+        source_id: &str,
+        audit: AuditContext<'_>,
+    ) -> Result<(), CatalogError> {
+        let _write = self.mutation_lock.write().await;
+        let mut transaction = self.pool.begin_with("BEGIN IMMEDIATE").await?;
+        let source = sqlx::query_as::<_, SourceRow>(SOURCE_SELECT_BY_ID)
+            .bind(source_id)
+            .fetch_optional(&mut *transaction)
+            .await?
+            .ok_or(CatalogError::NotFound { entity: "source" })?;
+        let path = format!("tools.{}", source.slug);
+        insert_audit(
+            &mut transaction,
+            audit,
+            "source.deleted",
+            Some(source_id),
+            None,
+            Some(&path),
+            json!({ "slug": source.slug, "kind": source.kind }),
+            unix_timestamp(),
+        )
+        .await?;
+        sqlx::query("DELETE FROM tool_search WHERE source_id = ?")
+            .bind(source_id)
+            .execute(&mut *transaction)
+            .await?;
+        sqlx::query("DELETE FROM tool_search_trigram WHERE source_id = ?")
+            .bind(source_id)
+            .execute(&mut *transaction)
+            .await?;
+        sqlx::query("DELETE FROM tool_search_short WHERE source_id = ?")
+            .bind(source_id)
+            .execute(&mut *transaction)
+            .await?;
+        sqlx::query("DELETE FROM sources WHERE id = ?")
+            .bind(source_id)
+            .execute(&mut *transaction)
+            .await?;
+        bump_global_revision(&mut transaction, unix_timestamp()).await?;
+        transaction.commit().await?;
+        Ok(())
+    }
+
+    pub async fn set_source_mode(
+        &self,
+        source_id: &str,
+        mode: Option<ToolMode>,
+        expected_revision: i64,
+        audit: AuditContext<'_>,
+    ) -> Result<SourceRecord, CatalogError> {
+        let _write = self.mutation_lock.write().await;
+        let now = unix_timestamp();
+        let mut transaction = self.pool.begin_with("BEGIN IMMEDIATE").await?;
+        let changed = sqlx::query(
+            "UPDATE sources SET mode_override = ?, revision = revision + 1, updated_at = ? \
+             WHERE id = ? AND revision = ?",
+        )
+        .bind(mode.map(ToolMode::as_str))
+        .bind(now)
+        .bind(source_id)
+        .bind(expected_revision)
+        .execute(&mut *transaction)
+        .await?
+        .rows_affected();
+        if changed == 0 {
+            return Err(revision_or_not_found(
+                &mut transaction,
+                "sources",
+                source_id,
+                "source",
+                expected_revision,
+            )
+            .await?);
+        }
+        let global_revision = bump_global_revision(&mut transaction, now).await?;
+        let source_path = source_path_snapshot(&mut transaction, source_id).await?;
+        insert_audit(
+            &mut transaction,
+            audit,
+            "source.mode_changed",
+            Some(source_id),
+            None,
+            Some(&source_path),
+            json!({ "modeOverride": mode, "globalRevision": global_revision }),
+            now,
+        )
+        .await?;
+        transaction.commit().await?;
+        self.source(source_id).await
+    }
+
+    pub async fn mark_source_credential_required(
+        &self,
+        source_id: &str,
+        expected_revision: i64,
+        audit: AuditContext<'_>,
+    ) -> Result<SourceRecord, CatalogError> {
+        self.set_source_health(
+            source_id,
+            SourceHealth::Unknown,
+            None,
+            "credential_required",
+            expected_revision,
+            audit,
+        )
+        .await
+    }
+
+    pub async fn mark_source_error(
+        &self,
+        source_id: &str,
+        error_code: &'static str,
+        expected_revision: i64,
+        audit: AuditContext<'_>,
+    ) -> Result<SourceRecord, CatalogError> {
+        self.set_source_health(
+            source_id,
+            SourceHealth::Error,
+            Some(error_code),
+            error_code,
+            expected_revision,
+            audit,
+        )
+        .await
+    }
+
+    async fn set_source_health(
+        &self,
+        source_id: &str,
+        health: SourceHealth,
+        health_error_code: Option<&'static str>,
+        transition_code: &'static str,
+        expected_revision: i64,
+        audit: AuditContext<'_>,
+    ) -> Result<SourceRecord, CatalogError> {
+        validate_source_health_error_code(transition_code)?;
+        if let Some(error_code) = health_error_code {
+            validate_source_health_error_code(error_code)?;
+        }
+        let _write = self.mutation_lock.write().await;
+        let now = unix_timestamp();
+        let mut transaction = self.pool.begin_with("BEGIN IMMEDIATE").await?;
+        let current = sqlx::query_as::<_, SourceRow>(SOURCE_SELECT_BY_ID)
+            .bind(source_id)
+            .fetch_optional(&mut *transaction)
+            .await?
+            .ok_or(CatalogError::NotFound { entity: "source" })?;
+        let health_status = match health {
+            SourceHealth::Unknown => "unknown",
+            SourceHealth::Healthy => "healthy",
+            SourceHealth::Error => "error",
+        };
+        if current.health_status == health_status
+            && current.health_error_code.as_deref() == health_error_code
+        {
+            let source = current.try_into()?;
+            transaction.commit().await?;
+            return Ok(source);
+        }
+        if current.revision != expected_revision {
+            return Err(CatalogError::RevisionConflict {
+                scope: "source",
+                expected: expected_revision,
+                actual: current.revision,
+            });
+        }
+        let changed = sqlx::query(
+            "UPDATE sources SET health_status = ?, health_error_code = ?, \
+             revision = revision + 1, updated_at = ? WHERE id = ? AND revision = ?",
+        )
+        .bind(health_status)
+        .bind(health_error_code)
+        .bind(now)
+        .bind(source_id)
+        .bind(expected_revision)
+        .execute(&mut *transaction)
+        .await?
+        .rows_affected();
+        if changed != 1 {
+            return Err(CatalogError::RevisionConflict {
+                scope: "source",
+                expected: expected_revision,
+                actual: current.revision,
+            });
+        }
+        let global_revision = bump_global_revision(&mut transaction, now).await?;
+        let source_path = source_path_snapshot(&mut transaction, source_id).await?;
+        insert_audit(
+            &mut transaction,
+            audit,
+            "source.health_changed",
+            Some(source_id),
+            None,
+            Some(&source_path),
+            json!({
+                "healthStatus": health,
+                "errorCode": health_error_code,
+                "reasonCode": transition_code,
+                "globalRevision": global_revision,
+            }),
+            now,
+        )
+        .await?;
+        let source = sqlx::query_as::<_, SourceRow>(SOURCE_SELECT_BY_ID)
+            .bind(source_id)
+            .fetch_one(&mut *transaction)
+            .await?
+            .try_into()?;
+        transaction.commit().await?;
+        Ok(source)
+    }
+
+    pub async fn put_credential(
+        &self,
+        source_id: &str,
+        credential: &CredentialPayload,
+        expected_revision: Option<i64>,
+        audit: AuditContext<'_>,
+    ) -> Result<(), CatalogError> {
+        if credential.schema_version == 0 {
+            return Err(validation(
+                "invalid_credential_schema",
+                "Credential schema versions must be positive.",
+            ));
+        }
+        let plaintext = serde_json::to_vec(&credential.payload)?;
+        let ciphertext = self
+            .keyring
+            .encrypt(CREDENTIAL_PURPOSE, source_id, &plaintext)?;
+        let now = unix_timestamp();
+        let _write = self.mutation_lock.write().await;
+        let mut transaction = self.pool.begin_with("BEGIN IMMEDIATE").await?;
+        ensure_source_exists(&mut transaction, source_id).await?;
+        let actual_revision = sqlx::query_scalar::<_, i64>(
+            "SELECT revision FROM source_credentials WHERE source_id = ?",
+        )
+        .bind(source_id)
+        .fetch_optional(&mut *transaction)
+        .await?;
+        if actual_revision != expected_revision {
+            return Err(CatalogError::RevisionConflict {
+                scope: "credential",
+                expected: expected_revision.unwrap_or(-1),
+                actual: actual_revision.unwrap_or(-1),
+            });
+        }
+        if let Some(actual_revision) = actual_revision {
+            let changed = sqlx::query(
+                "UPDATE source_credentials SET schema_version = ?, payload_ciphertext = ?, \
+                 revision = revision + 1, updated_at = ? WHERE source_id = ? AND revision = ?",
+            )
+            .bind(i64::from(credential.schema_version))
+            .bind(ciphertext)
+            .bind(now)
+            .bind(source_id)
+            .bind(actual_revision)
+            .execute(&mut *transaction)
+            .await?
+            .rows_affected();
+            if changed == 0 {
+                return Err(CatalogError::RevisionConflict {
+                    scope: "credential",
+                    expected: actual_revision,
+                    actual: sqlx::query_scalar(
+                        "SELECT revision FROM source_credentials WHERE source_id = ?",
+                    )
+                    .bind(source_id)
+                    .fetch_optional(&mut *transaction)
+                    .await?
+                    .unwrap_or(-1),
+                });
+            }
+        } else {
+            sqlx::query(
+                "INSERT INTO source_credentials \
+                 (source_id, schema_version, payload_ciphertext, revision, created_at, updated_at) \
+                 VALUES (?, ?, ?, 0, ?, ?)",
+            )
+            .bind(source_id)
+            .bind(i64::from(credential.schema_version))
+            .bind(ciphertext)
+            .bind(now)
+            .bind(now)
+            .execute(&mut *transaction)
+            .await?;
+        }
+        increment_source_and_global(&mut transaction, source_id, now).await?;
+        let source_path = source_path_snapshot(&mut transaction, source_id).await?;
+        insert_audit(
+            &mut transaction,
+            audit,
+            "source.credential_changed",
+            Some(source_id),
+            None,
+            Some(&source_path),
+            json!({ "schemaVersion": credential.schema_version }),
+            now,
+        )
+        .await?;
+        transaction.commit().await?;
+        Ok(())
+    }
+
+    pub async fn credential(
+        &self,
+        source_id: &str,
+    ) -> Result<Option<StoredCredential>, CatalogError> {
+        let credential = sqlx::query_as::<_, (i64, Vec<u8>, i64)>(
+            "SELECT schema_version, payload_ciphertext, revision FROM source_credentials WHERE source_id = ?",
+        )
+        .bind(source_id)
+        .fetch_optional(&self.pool)
+        .await?;
+        credential
+            .map(|(schema_version, ciphertext, revision)| {
+                let plaintext = self
+                    .keyring
+                    .decrypt(CREDENTIAL_PURPOSE, source_id, &ciphertext)?;
+                Ok(StoredCredential {
+                    revision,
+                    credential: CredentialPayload {
+                        schema_version: u32::try_from(schema_version)
+                            .map_err(|_| CatalogError::CorruptData("credential schema version"))?,
+                        payload: serde_json::from_slice(&plaintext)?,
+                    },
+                })
+            })
+            .transpose()
+    }
+
+    pub async fn delete_credential(
+        &self,
+        source_id: &str,
+        expected_revision: i64,
+        audit: AuditContext<'_>,
+    ) -> Result<(), CatalogError> {
+        let now = unix_timestamp();
+        let _write = self.mutation_lock.write().await;
+        let mut transaction = self.pool.begin_with("BEGIN IMMEDIATE").await?;
+        ensure_source_exists(&mut transaction, source_id).await?;
+        let changed =
+            sqlx::query("DELETE FROM source_credentials WHERE source_id = ? AND revision = ?")
+                .bind(source_id)
+                .bind(expected_revision)
+                .execute(&mut *transaction)
+                .await?
+                .rows_affected();
+        if changed == 0 {
+            let actual = sqlx::query_scalar::<_, i64>(
+                "SELECT revision FROM source_credentials WHERE source_id = ?",
+            )
+            .bind(source_id)
+            .fetch_optional(&mut *transaction)
+            .await?
+            .unwrap_or(-1);
+            return Err(CatalogError::RevisionConflict {
+                scope: "credential",
+                expected: expected_revision,
+                actual,
+            });
+        }
+        increment_source_and_global(&mut transaction, source_id, now).await?;
+        let source_path = source_path_snapshot(&mut transaction, source_id).await?;
+        insert_audit(
+            &mut transaction,
+            audit,
+            "source.credential_deleted",
+            Some(source_id),
+            None,
+            Some(&source_path),
+            json!({}),
+            now,
+        )
+        .await?;
+        transaction.commit().await?;
+        Ok(())
+    }
+
+    pub async fn replace_credential_and_mark_unknown(
+        &self,
+        source_id: &str,
+        credential: &CredentialPayload,
+        expected_source_revision: i64,
+        expected_credential_revision: i64,
+        audit: AuditContext<'_>,
+    ) -> Result<(StoredCredential, SourceRecord), CatalogError> {
+        let ciphertext = self.prepare_credential_ciphertext(source_id, credential)?;
+        let now = unix_timestamp();
+        let _write = self.mutation_lock.write().await;
+        let mut transaction = self.pool.begin_with("BEGIN IMMEDIATE").await?;
+        ensure_source_revision(&mut transaction, source_id, expected_source_revision).await?;
+        let credential_revision = replace_credential_in_transaction(
+            &mut transaction,
+            source_id,
+            credential.schema_version,
+            ciphertext,
+            expected_credential_revision,
+            now,
+        )
+        .await?;
+        let source_revision = sqlx::query_scalar::<_, i64>(
+            "UPDATE sources SET health_status = 'unknown', health_error_code = NULL, \
+             revision = revision + 1, updated_at = ? WHERE id = ? AND revision = ? \
+             RETURNING revision",
+        )
+        .bind(now)
+        .bind(source_id)
+        .bind(expected_source_revision)
+        .fetch_one(&mut *transaction)
+        .await?;
+        let global_revision = bump_global_revision(&mut transaction, now).await?;
+        let source_path = source_path_snapshot(&mut transaction, source_id).await?;
+        insert_audit(
+            &mut transaction,
+            audit,
+            "source.credential_changed",
+            Some(source_id),
+            None,
+            Some(&source_path),
+            json!({ "schemaVersion": credential.schema_version }),
+            now,
+        )
+        .await?;
+        insert_audit(
+            &mut transaction,
+            audit,
+            "source.health_changed",
+            Some(source_id),
+            None,
+            Some(&source_path),
+            json!({
+                "healthStatus": SourceHealth::Unknown,
+                "errorCode": null,
+                "reasonCode": "credential_required",
+                "globalRevision": global_revision,
+            }),
+            now,
+        )
+        .await?;
+        let source: SourceRecord = sqlx::query_as::<_, SourceRow>(SOURCE_SELECT_BY_ID)
+            .bind(source_id)
+            .fetch_one(&mut *transaction)
+            .await?
+            .try_into()?;
+        transaction.commit().await?;
+        debug_assert_eq!(source_revision, source.revision);
+        Ok((
+            StoredCredential {
+                revision: credential_revision,
+                credential: credential.clone(),
+            },
+            source,
+        ))
+    }
+
+    pub async fn delete_credential_and_mark_unknown(
+        &self,
+        source_id: &str,
+        expected_source_revision: i64,
+        expected_credential_revision: i64,
+        audit: AuditContext<'_>,
+    ) -> Result<SourceRecord, CatalogError> {
+        let now = unix_timestamp();
+        let _write = self.mutation_lock.write().await;
+        let mut transaction = self.pool.begin_with("BEGIN IMMEDIATE").await?;
+        ensure_source_revision(&mut transaction, source_id, expected_source_revision).await?;
+        delete_credential_in_transaction(&mut transaction, source_id, expected_credential_revision)
+            .await?;
+        sqlx::query(
+            "UPDATE sources SET health_status = 'unknown', health_error_code = NULL, \
+             revision = revision + 1, updated_at = ? WHERE id = ? AND revision = ?",
+        )
+        .bind(now)
+        .bind(source_id)
+        .bind(expected_source_revision)
+        .execute(&mut *transaction)
+        .await?;
+        let global_revision = bump_global_revision(&mut transaction, now).await?;
+        let source_path = source_path_snapshot(&mut transaction, source_id).await?;
+        insert_audit(
+            &mut transaction,
+            audit,
+            "source.credential_deleted",
+            Some(source_id),
+            None,
+            Some(&source_path),
+            json!({}),
+            now,
+        )
+        .await?;
+        insert_audit(
+            &mut transaction,
+            audit,
+            "source.health_changed",
+            Some(source_id),
+            None,
+            Some(&source_path),
+            json!({
+                "healthStatus": SourceHealth::Unknown,
+                "errorCode": null,
+                "reasonCode": "credential_required",
+                "globalRevision": global_revision,
+            }),
+            now,
+        )
+        .await?;
+        let source: SourceRecord = sqlx::query_as::<_, SourceRow>(SOURCE_SELECT_BY_ID)
+            .bind(source_id)
+            .fetch_one(&mut *transaction)
+            .await?
+            .try_into()?;
+        transaction.commit().await?;
+        Ok(source)
+    }
+
+    pub async fn tool_binding(&self, tool_id: &str) -> Result<StoredToolBinding, CatalogError> {
+        let row = sqlx::query_as::<_, (String, String, String, String, String, i64, String, i64)>(
+            "SELECT tool_bindings.tool_id, tools.source_id, sources.kind, tools.stable_key, \
+             tool_bindings.protocol, tool_bindings.binding_version, tool_bindings.definition_json, \
+             tool_bindings.revision FROM tool_bindings \
+             JOIN tools ON tools.id = tool_bindings.tool_id \
+             JOIN sources ON sources.id = tools.source_id \
+             WHERE tool_bindings.tool_id = ? AND tools.present = 1",
+        )
+        .bind(tool_id)
+        .fetch_optional(&self.pool)
+        .await?
+        .ok_or(CatalogError::NotFound {
+            entity: "tool binding",
+        })?;
+        let binding = ToolBinding::decode(&row.4, row.5, &row.6)?;
+        if !binding_matches_source_kind(&binding, SourceKind::from_str(&row.2)?) {
+            return Err(CatalogError::CorruptData(
+                "tool binding does not match source kind",
+            ));
+        }
+        require_binding_stable_key(&binding, &row.3)?;
+        Ok(StoredToolBinding {
+            tool_id: row.0,
+            source_id: row.1,
+            revision: row.7,
+            binding,
+        })
+    }
+
+    pub async fn sync_catalog(
+        &self,
+        source_id: &str,
+        snapshot: CatalogSnapshot,
+        audit: AuditContext<'_>,
+    ) -> Result<CatalogSyncResult, CatalogError> {
+        self.sync_catalog_with_bindings(source_id, snapshot, Vec::new(), audit)
+            .await
+    }
+
+    pub async fn sync_catalog_with_bindings(
+        &self,
+        source_id: &str,
+        snapshot: CatalogSnapshot,
+        bindings: Vec<StagedToolBinding>,
+        audit: AuditContext<'_>,
+    ) -> Result<CatalogSyncResult, CatalogError> {
+        self.sync_catalog_with_bindings_and_optional_oauth_binding(
+            source_id, snapshot, bindings, None, audit,
+        )
+        .await
+    }
+
+    pub async fn sync_catalog_with_bindings_and_oauth_binding(
+        &self,
+        source_id: &str,
+        snapshot: CatalogSnapshot,
+        bindings: Vec<StagedToolBinding>,
+        expected_oauth_binding: OAuthBindingExpectation,
+        audit: AuditContext<'_>,
+    ) -> Result<CatalogSyncResult, CatalogError> {
+        self.sync_catalog_with_bindings_and_optional_oauth_binding(
+            source_id,
+            snapshot,
+            bindings,
+            Some(expected_oauth_binding),
+            audit,
+        )
+        .await
+    }
+
+    async fn sync_catalog_with_bindings_and_optional_oauth_binding(
+        &self,
+        source_id: &str,
+        snapshot: CatalogSnapshot,
+        bindings: Vec<StagedToolBinding>,
+        expected_oauth_binding: Option<OAuthBindingExpectation>,
+        audit: AuditContext<'_>,
+    ) -> Result<CatalogSyncResult, CatalogError> {
+        let expected_source_revision = snapshot.expected_source_revision;
+        let expected_credential_revision = snapshot.expected_credential_revision;
+        let (prepared, prepared_bindings) = prepare_snapshot_and_bindings(snapshot, bindings)?;
+        let now = unix_timestamp();
+        let _write = self.mutation_lock.write().await;
+        let mut transaction = self.pool.begin_with("BEGIN IMMEDIATE").await?;
+        validate_catalog_apply_basis(
+            &mut transaction,
+            source_id,
+            expected_source_revision,
+            expected_credential_revision,
+            &prepared,
+            &prepared_bindings,
+        )
+        .await?;
+        if let Some(expected_oauth_binding) = expected_oauth_binding.as_ref() {
+            validate_oauth_binding_expectation(&mut transaction, source_id, expected_oauth_binding)
+                .await?;
+        }
+        let result = apply_prepared_catalog_refresh(
+            &mut transaction,
+            source_id,
+            &prepared,
+            &prepared_bindings,
+            audit,
+            now,
+        )
+        .await?;
+        transaction.commit().await?;
+        Ok(result)
+    }
+
+    pub async fn replace_credential_and_sync_catalog(
+        &self,
+        source_id: &str,
+        credential: &CredentialPayload,
+        snapshot: CatalogSnapshot,
+        bindings: Vec<StagedToolBinding>,
+        audit: AuditContext<'_>,
+    ) -> Result<(StoredCredential, CatalogSyncResult, SourceRecord), CatalogError> {
+        self.replace_credential_and_sync_catalog_with_optional_oauth_binding(
+            source_id, credential, snapshot, bindings, None, audit,
+        )
+        .await
+    }
+
+    pub async fn replace_credential_and_sync_catalog_with_oauth_binding(
+        &self,
+        source_id: &str,
+        credential: &CredentialPayload,
+        snapshot: CatalogSnapshot,
+        bindings: Vec<StagedToolBinding>,
+        expected_oauth_binding: OAuthBindingExpectation,
+        audit: AuditContext<'_>,
+    ) -> Result<(StoredCredential, CatalogSyncResult, SourceRecord), CatalogError> {
+        self.replace_credential_and_sync_catalog_with_optional_oauth_binding(
+            source_id,
+            credential,
+            snapshot,
+            bindings,
+            Some(expected_oauth_binding),
+            audit,
+        )
+        .await
+    }
+
+    async fn replace_credential_and_sync_catalog_with_optional_oauth_binding(
+        &self,
+        source_id: &str,
+        credential: &CredentialPayload,
+        snapshot: CatalogSnapshot,
+        bindings: Vec<StagedToolBinding>,
+        expected_oauth_binding: Option<OAuthBindingExpectation>,
+        audit: AuditContext<'_>,
+    ) -> Result<(StoredCredential, CatalogSyncResult, SourceRecord), CatalogError> {
+        let expected_source_revision = snapshot.expected_source_revision;
+        let expected_credential_revision =
+            snapshot.expected_credential_revision.ok_or_else(|| {
+                validation(
+                    "credential_required",
+                    "Atomic credential replacement requires an existing credential revision.",
+                )
+            })?;
+        let (prepared, prepared_bindings) = prepare_snapshot_and_bindings(snapshot, bindings)?;
+        let ciphertext = self.prepare_credential_ciphertext(source_id, credential)?;
+        let now = unix_timestamp();
+        let _write = self.mutation_lock.write().await;
+        let mut transaction = self.pool.begin_with("BEGIN IMMEDIATE").await?;
+        validate_catalog_apply_basis(
+            &mut transaction,
+            source_id,
+            expected_source_revision,
+            Some(expected_credential_revision),
+            &prepared,
+            &prepared_bindings,
+        )
+        .await?;
+        if let Some(expected_oauth_binding) = expected_oauth_binding.as_ref() {
+            validate_oauth_binding_expectation(&mut transaction, source_id, expected_oauth_binding)
+                .await?;
+        }
+        let credential_revision = replace_credential_in_transaction(
+            &mut transaction,
+            source_id,
+            credential.schema_version,
+            ciphertext,
+            expected_credential_revision,
+            now,
+        )
+        .await?;
+        let source_path = source_path_snapshot(&mut transaction, source_id).await?;
+        insert_audit(
+            &mut transaction,
+            audit,
+            "source.credential_changed",
+            Some(source_id),
+            None,
+            Some(&source_path),
+            json!({ "schemaVersion": credential.schema_version }),
+            now,
+        )
+        .await?;
+        let sync = apply_prepared_catalog_refresh(
+            &mut transaction,
+            source_id,
+            &prepared,
+            &prepared_bindings,
+            audit,
+            now,
+        )
+        .await?;
+        let source: SourceRecord = sqlx::query_as::<_, SourceRow>(SOURCE_SELECT_BY_ID)
+            .bind(source_id)
+            .fetch_one(&mut *transaction)
+            .await?
+            .try_into()?;
+        transaction.commit().await?;
+        Ok((
+            StoredCredential {
+                revision: credential_revision,
+                credential: credential.clone(),
+            },
+            sync,
+            source,
+        ))
+    }
+
+    fn prepare_credential_ciphertext(
+        &self,
+        source_id: &str,
+        credential: &CredentialPayload,
+    ) -> Result<Vec<u8>, CatalogError> {
+        if credential.schema_version == 0 {
+            return Err(validation(
+                "invalid_credential_schema",
+                "Credential schema versions must be positive.",
+            ));
+        }
+        let plaintext = serde_json::to_vec(&credential.payload)?;
+        Ok(self
+            .keyring
+            .encrypt(CREDENTIAL_PURPOSE, source_id, &plaintext)?)
+    }
+
+    pub async fn list_tools(&self, filter: ListToolsFilter) -> Result<ToolPage, CatalogError> {
+        let tokens_json = serde_json::to_string(
+            &filter
+                .query
+                .as_deref()
+                .map(normalize_filter_query)
+                .unwrap_or_default(),
+        )?;
+        let source_id = filter.source_id.as_deref();
+        let effective_mode = filter.effective_mode.map(ToolMode::as_str);
+        let include_tombstoned = i64::from(filter.include_tombstoned);
+        let limit = page_limit(filter.limit);
+        let offset = i64::from(filter.offset);
+        let mut transaction = self.pool.begin().await?;
+        let total = sqlx::query_scalar::<_, i64>(TOOL_LIST_COUNT)
+            .bind(include_tombstoned)
+            .bind(source_id)
+            .bind(source_id)
+            .bind(effective_mode)
+            .bind(effective_mode)
+            .bind(&tokens_json)
+            .fetch_one(&mut *transaction)
+            .await?;
+        let items = sqlx::query_as::<_, ToolSummaryRow>(TOOL_LIST_PAGE)
+            .bind(include_tombstoned)
+            .bind(source_id)
+            .bind(source_id)
+            .bind(effective_mode)
+            .bind(effective_mode)
+            .bind(tokens_json)
+            .bind(i64::try_from(limit).unwrap_or(i64::MAX))
+            .bind(offset)
+            .fetch_all(&mut *transaction)
+            .await?
+            .into_iter()
+            .map(ToolSummary::try_from)
+            .collect::<Result<Vec<_>, _>>()?;
+        let catalog_revision =
+            sqlx::query_scalar("SELECT revision FROM catalog_state WHERE id = 1")
+                .fetch_one(&mut *transaction)
+                .await?;
+        transaction.commit().await?;
+        let total = usize::try_from(total).map_err(|_| CatalogError::CorruptData("tool count"))?;
+        let start = usize::try_from(filter.offset)
+            .unwrap_or(usize::MAX)
+            .min(total);
+        let consumed = start + items.len();
+        let has_more = consumed < total;
+        Ok(ToolPage {
+            items,
+            total,
+            has_more,
+            next_offset: has_more.then_some(consumed),
+            catalog_revision,
+        })
+    }
+
+    pub async fn tool(&self, tool_id: &str) -> Result<ToolRecord, CatalogError> {
+        sqlx::query_as::<_, ToolRow>(TOOL_SELECT_BY_ID)
+            .bind(tool_id)
+            .fetch_optional(&self.pool)
+            .await?
+            .ok_or(CatalogError::NotFound { entity: "tool" })?
+            .try_into()
+    }
+
+    pub async fn set_tool_mode(
+        &self,
+        tool_id: &str,
+        mode: Option<ToolMode>,
+        expected_revision: i64,
+        audit: AuditContext<'_>,
+    ) -> Result<ToolRecord, CatalogError> {
+        self.set_tool_mode_with_source_revision(tool_id, mode, expected_revision, audit)
+            .await
+            .map(|(tool, _, _)| tool)
+    }
+
+    pub(crate) async fn set_tool_mode_with_source_revision(
+        &self,
+        tool_id: &str,
+        mode: Option<ToolMode>,
+        expected_revision: i64,
+        audit: AuditContext<'_>,
+    ) -> Result<(ToolRecord, String, i64), CatalogError> {
+        let _write = self.mutation_lock.write().await;
+        let now = unix_timestamp();
+        let mut transaction = self.pool.begin_with("BEGIN IMMEDIATE").await?;
+        let row = sqlx::query_as::<_, (String, String, String)>(
+            "SELECT tools.source_id, sources.slug, tools.local_name \
+             FROM tools JOIN sources ON sources.id = tools.source_id WHERE tools.id = ?",
+        )
+        .bind(tool_id)
+        .fetch_optional(&mut *transaction)
+        .await?
+        .ok_or(CatalogError::NotFound { entity: "tool" })?;
+        let changed = sqlx::query(
+            "UPDATE tools SET mode_override = ?, revision = revision + 1, updated_at = ? \
+             WHERE id = ? AND revision = ?",
+        )
+        .bind(mode.map(ToolMode::as_str))
+        .bind(now)
+        .bind(tool_id)
+        .bind(expected_revision)
+        .execute(&mut *transaction)
+        .await?
+        .rows_affected();
+        if changed == 0 {
+            let actual = sqlx::query_scalar::<_, i64>("SELECT revision FROM tools WHERE id = ?")
+                .bind(tool_id)
+                .fetch_one(&mut *transaction)
+                .await?;
+            return Err(CatalogError::RevisionConflict {
+                scope: "tool",
+                expected: expected_revision,
+                actual,
+            });
+        }
+        let source_revision = increment_source_revision(&mut transaction, &row.0, now).await?;
+        let global_revision = bump_global_revision(&mut transaction, now).await?;
+        let path = format!("tools.{}.{}", row.1, row.2);
+        insert_audit(
+            &mut transaction,
+            audit,
+            "tool.mode_changed",
+            Some(&row.0),
+            Some(tool_id),
+            Some(&path),
+            json!({
+                "modeOverride": mode,
+                "sourceRevision": source_revision,
+                "globalRevision": global_revision
+            }),
+            now,
+        )
+        .await?;
+        transaction.commit().await?;
+        let tool = self.tool(tool_id).await?;
+        Ok((tool, row.0, source_revision))
+    }
+
+    pub async fn bulk_set_source_tool_modes(
+        &self,
+        source_id: &str,
+        mode: Option<ToolMode>,
+        expected_source_revision: i64,
+        audit: AuditContext<'_>,
+    ) -> Result<BulkToolModeResult, CatalogError> {
+        let _write = self.mutation_lock.write().await;
+        let now = unix_timestamp();
+        let mut transaction = self.pool.begin_with("BEGIN IMMEDIATE").await?;
+        let actual_revision =
+            sqlx::query_scalar::<_, i64>("SELECT revision FROM sources WHERE id = ?")
+                .bind(source_id)
+                .fetch_optional(&mut *transaction)
+                .await?
+                .ok_or(CatalogError::NotFound { entity: "source" })?;
+        if actual_revision != expected_source_revision {
+            return Err(CatalogError::RevisionConflict {
+                scope: "source",
+                expected: expected_source_revision,
+                actual: actual_revision,
+            });
+        }
+        let updated_count = sqlx::query(
+            "UPDATE tools SET mode_override = ?, revision = revision + 1, updated_at = ? \
+             WHERE source_id = ? AND present = 1",
+        )
+        .bind(mode.map(ToolMode::as_str))
+        .bind(now)
+        .bind(source_id)
+        .execute(&mut *transaction)
+        .await?
+        .rows_affected() as usize;
+        let source_revision = increment_source_revision(&mut transaction, source_id, now).await?;
+        let catalog_revision = bump_global_revision(&mut transaction, now).await?;
+        let source_path = source_path_snapshot(&mut transaction, source_id).await?;
+        insert_audit(
+            &mut transaction,
+            audit,
+            "tool.mode_bulk_changed",
+            Some(source_id),
+            None,
+            Some(&source_path),
+            json!({
+                "selection": "source",
+                "modeOverride": mode,
+                "updatedCount": updated_count,
+                "sourceRevision": source_revision,
+                "globalRevision": catalog_revision
+            }),
+            now,
+        )
+        .await?;
+        transaction.commit().await?;
+        Ok(BulkToolModeResult {
+            updated_count,
+            catalog_revision,
+            source_revisions: [(source_id.to_owned(), source_revision)]
+                .into_iter()
+                .collect(),
+        })
+    }
+
+    pub async fn bulk_set_tool_modes(
+        &self,
+        tool_ids: &[String],
+        mode: Option<ToolMode>,
+        expected_catalog_revision: i64,
+        audit: AuditContext<'_>,
+    ) -> Result<BulkToolModeResult, CatalogError> {
+        let mut unique_ids = tool_ids.to_vec();
+        unique_ids.sort_unstable();
+        unique_ids.dedup();
+        if unique_ids.is_empty() || unique_ids.len() > 200 {
+            return Err(validation(
+                "invalid_tool_selection",
+                "Select between 1 and 200 tools for a bulk mode change.",
+            ));
+        }
+        let _write = self.mutation_lock.write().await;
+        let now = unix_timestamp();
+        let mut transaction = self.pool.begin_with("BEGIN IMMEDIATE").await?;
+        let actual_catalog_revision =
+            sqlx::query_scalar::<_, i64>("SELECT revision FROM catalog_state WHERE id = 1")
+                .fetch_one(&mut *transaction)
+                .await?;
+        if actual_catalog_revision != expected_catalog_revision {
+            return Err(CatalogError::RevisionConflict {
+                scope: "catalog",
+                expected: expected_catalog_revision,
+                actual: actual_catalog_revision,
+            });
+        }
+        let mut source_ids = HashSet::new();
+        let mut selected_tools = Vec::with_capacity(unique_ids.len());
+        for tool_id in &unique_ids {
+            let (source_id, source_slug, local_name) =
+                sqlx::query_as::<_, (String, String, String)>(
+                    "SELECT tools.source_id, sources.slug, tools.local_name \
+                 FROM tools JOIN sources ON sources.id = tools.source_id \
+                 WHERE tools.id = ? AND tools.present = 1",
+                )
+                .bind(tool_id)
+                .fetch_optional(&mut *transaction)
+                .await?
+                .ok_or(CatalogError::NotFound { entity: "tool" })?;
+            source_ids.insert(source_id);
+            selected_tools.push(json!({
+                "toolId": tool_id,
+                "path": format!("tools.{source_slug}.{local_name}")
+            }));
+        }
+        for tool_id in &unique_ids {
+            sqlx::query(
+                "UPDATE tools SET mode_override = ?, revision = revision + 1, updated_at = ? \
+                 WHERE id = ?",
+            )
+            .bind(mode.map(ToolMode::as_str))
+            .bind(now)
+            .bind(tool_id)
+            .execute(&mut *transaction)
+            .await?;
+        }
+        let mut source_revisions = std::collections::BTreeMap::new();
+        for source_id in source_ids {
+            let revision = increment_source_revision(&mut transaction, &source_id, now).await?;
+            source_revisions.insert(source_id, revision);
+        }
+        let catalog_revision = bump_global_revision(&mut transaction, now).await?;
+        insert_audit(
+            &mut transaction,
+            audit,
+            "tool.mode_bulk_changed",
+            None,
+            None,
+            None,
+            json!({
+                "selection": "explicit",
+                "selectedTools": selected_tools,
+                "modeOverride": mode,
+                "updatedCount": unique_ids.len(),
+                "globalRevision": catalog_revision
+            }),
+            now,
+        )
+        .await?;
+        transaction.commit().await?;
+        Ok(BulkToolModeResult {
+            updated_count: unique_ids.len(),
+            catalog_revision,
+            source_revisions,
+        })
+    }
+
+    pub async fn search_tools(
+        &self,
+        query: &str,
+        namespace: Option<&str>,
+        limit: u32,
+        offset: u32,
+    ) -> Result<DiscoveryPage, CatalogError> {
+        validate_search_input("query", query)?;
+        if let Some(namespace) = namespace {
+            validate_search_input("namespace", namespace)?;
+        }
+        let Some(expressions) = search::candidate_expressions(query) else {
+            return Ok(search::search(
+                &[],
+                query,
+                namespace,
+                page_limit(limit),
+                usize::try_from(offset).unwrap_or(usize::MAX),
+            ));
+        };
+        let namespace_prefix = search::namespace_prefix(namespace);
+        let namespace_like = namespace_prefix
+            .as_ref()
+            .map(|namespace| format!("{namespace} %"));
+        let trigram_enabled = i64::from(expressions.trigram.is_some());
+        let short_bigram_enabled = i64::from(expressions.short_bigram.is_some());
+        let trigram = expressions
+            .trigram
+            .as_deref()
+            .unwrap_or(r#""executorsearchnomatchsentinel""#);
+        let short_bigram = expressions.short_bigram.as_deref().unwrap_or(r#""g2ffff""#);
+        let tools = sqlx::query_as::<_, ToolSummaryRow>(TOOL_SEARCH_CANDIDATES)
+            .bind(expressions.word)
+            .bind(trigram)
+            .bind(short_bigram)
+            .bind(expressions.short_unigram)
+            .bind(namespace_prefix.as_deref())
+            .bind(namespace_prefix.as_deref())
+            .bind(namespace_like.as_deref())
+            .bind(MAX_SEARCH_CANDIDATES)
+            .bind(trigram_enabled)
+            .bind(short_bigram_enabled)
+            .fetch_all(&self.pool)
+            .await?
+            .into_iter()
+            .map(ToolSummary::try_from)
+            .collect::<Result<Vec<_>, _>>()?;
+        Ok(search::search(
+            &tools,
+            query,
+            namespace,
+            page_limit(limit),
+            usize::try_from(offset).unwrap_or(usize::MAX),
+        ))
+    }
+
+    pub async fn describe_tool(&self, path: &str) -> Result<DescribedTool, CatalogError> {
+        let tool = self.gateway_tool_by_path(path).await?;
+        let mut definitions = tool.typescript_definitions.clone();
+        definitions.insert("ToolError".to_owned(), TOOL_ERROR_TYPESCRIPT.to_owned());
+        definitions.insert(
+            "ToolHttpMeta".to_owned(),
+            TOOL_HTTP_META_TYPESCRIPT.to_owned(),
+        );
+        definitions.insert("ToolFile".to_owned(), TOOL_FILE_TYPESCRIPT.to_owned());
+        let output = tool.output_typescript.as_deref().unwrap_or("unknown");
+        Ok(DescribedTool {
+            path: path.to_owned(),
+            name: tool.local_name,
+            description: tool.description,
+            input_typescript: tool.input_typescript,
+            output_typescript: Some(format!(
+                "{{ ok: true; data: {output}; http?: ToolHttpMeta }} | {{ ok: false; error: ToolError }}"
+            )),
+            type_script_definitions: definitions,
+            input_schema: tool.input_schema,
+            output_schema: tool.output_schema,
+            effective_mode: tool.effective_mode,
+        })
+    }
+
+    pub async fn guard_invocation(&self, path: &str) -> Result<InvocationLookup, CatalogError> {
+        let tool =
+            self.tool_summary_by_path(path)
+                .await?
+                .ok_or_else(|| CatalogError::ToolNotFound {
+                    path: normalize_sandbox_path(path),
+                })?;
+        if !tool.present {
+            return Err(CatalogError::ToolNotFound {
+                path: normalize_sandbox_path(path),
+            });
+        }
+        if tool.effective_mode.mode == ToolMode::Disabled {
+            return Err(CatalogError::ToolDisabled {
+                path: tool.sandbox_path,
+            });
+        }
+        let source_display_name = self.source(&tool.source_id).await?.display_name;
+        Ok(InvocationLookup {
+            tool_id: tool.id,
+            source_id: tool.source_id,
+            source_display_name,
+            tool_display_name: tool.display_name,
+            callable_path: tool.callable_path,
+            sandbox_path: tool.sandbox_path,
+            effective_mode: tool.effective_mode.mode,
+            mode_provenance: tool.effective_mode.provenance,
+            requires_approval: tool.effective_mode.mode == ToolMode::Ask,
+        })
+    }
+
+    pub async fn prepare_invocation(&self, path: &str) -> Result<InvocationLease, CatalogError> {
+        let Some((source_slug, local_name)) = parse_tool_path(path) else {
+            return Err(CatalogError::ToolNotFound {
+                path: normalize_sandbox_path(path),
+            });
+        };
+        let guard = self.mutation_lock.clone().read_owned().await;
+        let mut transaction = self.pool.begin().await?;
+        let row = sqlx::query_as::<_, InvocationRow>(INVOCATION_SELECT_BY_PATH)
+            .bind(source_slug)
+            .bind(local_name)
+            .fetch_optional(&mut *transaction)
+            .await?;
+        transaction.commit().await?;
+        let row = row.ok_or_else(|| CatalogError::ToolNotFound {
+            path: normalize_sandbox_path(path),
+        })?;
+        self.invocation_lease(row, guard)
+    }
+
+    /// Resolves policy and validates the stored input schema without decrypting source credentials.
+    ///
+    /// Ask-mode callers must use this snapshot before creating an approval. The read guard keeps
+    /// the revision token coherent only for the duration of preflight and must not be retained while
+    /// an approval is pending.
+    pub async fn preflight_invocation(
+        &self,
+        path: &str,
+    ) -> Result<InvocationPreflight, CatalogError> {
+        let Some((source_slug, local_name)) = parse_tool_path(path) else {
+            return Err(CatalogError::ToolNotFound {
+                path: normalize_sandbox_path(path),
+            });
+        };
+        let guard = self.mutation_lock.clone().read_owned().await;
+        let mut transaction = self.pool.begin().await?;
+        let row = sqlx::query_as::<_, InvocationRow>(INVOCATION_SELECT_BY_PATH)
+            .bind(source_slug)
+            .bind(local_name)
+            .fetch_optional(&mut *transaction)
+            .await?;
+        transaction.commit().await?;
+        let row = row.ok_or_else(|| CatalogError::ToolNotFound {
+            path: normalize_sandbox_path(path),
+        })?;
+        Self::invocation_preflight(row, guard)
+    }
+
+    pub async fn revalidate_invocation(
+        &self,
+        token: &InvocationRevisionToken,
+    ) -> Result<Option<InvocationLease>, CatalogError> {
+        let guard = self.mutation_lock.clone().read_owned().await;
+        let mut transaction = self.pool.begin().await?;
+        let row = sqlx::query_as::<_, InvocationRow>(INVOCATION_SELECT_BY_REVISION)
+            .bind(&token.tool_id)
+            .bind(&token.source_id)
+            .bind(token.source_revision)
+            .bind(token.catalog_revision)
+            .bind(token.tool_revision)
+            .bind(token.binding_revision)
+            .bind(token.credential_revision)
+            .fetch_optional(&mut *transaction)
+            .await?;
+        transaction.commit().await?;
+        row.map(|row| self.invocation_lease(row, guard)).transpose()
+    }
+
+    fn invocation_lease(
+        &self,
+        row: InvocationRow,
+        guard: tokio::sync::OwnedRwLockReadGuard<()>,
+    ) -> Result<InvocationLease, CatalogError> {
+        let sandbox_path = format!("{}.{}", row.source_slug, row.local_name);
+        if row.present == 0 {
+            return Err(CatalogError::ToolNotFound { path: sandbox_path });
+        }
+        let effective_mode = effective_mode(
+            ToolMode::from_str(&row.intrinsic_mode)?,
+            parse_optional_mode(row.source_mode_override)?,
+            parse_optional_mode(row.tool_mode_override)?,
+        );
+        let mode = effective_mode.mode;
+        if mode == ToolMode::Disabled {
+            return Err(CatalogError::ToolDisabled { path: sandbox_path });
+        }
+        let binding_protocol = row
+            .binding_protocol
+            .as_deref()
+            .ok_or(CatalogError::CorruptData("active tool binding missing"))?;
+        let binding_version = row
+            .binding_version
+            .ok_or(CatalogError::CorruptData("active tool binding missing"))?;
+        let definition_json = row
+            .definition_json
+            .as_deref()
+            .ok_or(CatalogError::CorruptData("active tool binding missing"))?;
+        let binding_revision = row
+            .binding_revision
+            .ok_or(CatalogError::CorruptData("active tool binding missing"))?;
+        let binding = ToolBinding::decode(binding_protocol, binding_version, definition_json)?;
+        let source_kind = SourceKind::from_str(&row.source_kind)?;
+        if !binding_matches_source_kind(&binding, source_kind) {
+            return Err(CatalogError::CorruptData(
+                "tool binding does not match source kind",
+            ));
+        }
+        require_binding_stable_key(&binding, &row.stable_key)?;
+        let credential = match (
+            row.credential_schema_version,
+            row.credential_ciphertext,
+            row.credential_revision,
+        ) {
+            (Some(schema_version), Some(ciphertext), Some(revision)) => {
+                let plaintext =
+                    self.keyring
+                        .decrypt(CREDENTIAL_PURPOSE, &row.source_id, &ciphertext)?;
+                Some(StoredCredential {
+                    revision,
+                    credential: CredentialPayload {
+                        schema_version: u32::try_from(schema_version)
+                            .map_err(|_| CatalogError::CorruptData("credential schema version"))?,
+                        payload: serde_json::from_slice(&plaintext)?,
+                    },
+                })
+            }
+            (None, None, None) => None,
+            _ => return Err(CatalogError::CorruptData("incomplete source credential")),
+        };
+        let callable_path = format!("tools.{sandbox_path}");
+        let lookup = InvocationLookup {
+            tool_id: row.tool_id.clone(),
+            source_id: row.source_id.clone(),
+            source_display_name: row.source_display_name,
+            tool_display_name: row.tool_display_name,
+            callable_path,
+            sandbox_path,
+            effective_mode: mode,
+            mode_provenance: effective_mode.provenance,
+            requires_approval: mode == ToolMode::Ask,
+        };
+        if row.input_schema_json.len() > MAX_SCHEMA_BYTES {
+            return Err(CatalogError::CorruptData("tool input schema is too large"));
+        }
+        let input_schema: Value = serde_json::from_str(&row.input_schema_json)?;
+        let input_validator = super::schema::compile(&input_schema)
+            .map_err(|()| CatalogError::CorruptData("tool input schema is invalid"))?;
+        Ok(InvocationLease {
+            revisions: InvocationRevisionToken {
+                source_id: row.source_id,
+                tool_id: row.tool_id,
+                source_revision: row.source_revision,
+                catalog_revision: row.catalog_revision,
+                tool_revision: row.tool_revision,
+                binding_revision,
+                credential_revision: row.credential_revision,
+            },
+            lookup,
+            source_kind,
+            binding,
+            input_schema,
+            input_validator,
+            source_configuration: serde_json::from_str(&row.configuration_json)?,
+            credential,
+            _guard: guard,
+        })
+    }
+
+    fn invocation_preflight(
+        row: InvocationRow,
+        guard: tokio::sync::OwnedRwLockReadGuard<()>,
+    ) -> Result<InvocationPreflight, CatalogError> {
+        let sandbox_path = format!("{}.{}", row.source_slug, row.local_name);
+        if row.present == 0 {
+            return Err(CatalogError::ToolNotFound { path: sandbox_path });
+        }
+        let effective_mode = effective_mode(
+            ToolMode::from_str(&row.intrinsic_mode)?,
+            parse_optional_mode(row.source_mode_override)?,
+            parse_optional_mode(row.tool_mode_override)?,
+        );
+        let mode = effective_mode.mode;
+        if mode == ToolMode::Disabled {
+            return Err(CatalogError::ToolDisabled { path: sandbox_path });
+        }
+        let binding_protocol = row
+            .binding_protocol
+            .as_deref()
+            .ok_or(CatalogError::CorruptData("active tool binding missing"))?;
+        let binding_version = row
+            .binding_version
+            .ok_or(CatalogError::CorruptData("active tool binding missing"))?;
+        let definition_json = row
+            .definition_json
+            .as_deref()
+            .ok_or(CatalogError::CorruptData("active tool binding missing"))?;
+        let binding_revision = row
+            .binding_revision
+            .ok_or(CatalogError::CorruptData("active tool binding missing"))?;
+        let binding = ToolBinding::decode(binding_protocol, binding_version, definition_json)?;
+        if !binding_matches_source_kind(&binding, SourceKind::from_str(&row.source_kind)?) {
+            return Err(CatalogError::CorruptData(
+                "tool binding does not match source kind",
+            ));
+        }
+        require_binding_stable_key(&binding, &row.stable_key)?;
+        if row.input_schema_json.len() > MAX_SCHEMA_BYTES {
+            return Err(CatalogError::CorruptData("tool input schema is too large"));
+        }
+        let input_schema: Value = serde_json::from_str(&row.input_schema_json)?;
+        let input_validator = super::schema::compile(&input_schema)
+            .map_err(|()| CatalogError::CorruptData("tool input schema is invalid"))?;
+        Ok(InvocationPreflight {
+            revisions: InvocationRevisionToken {
+                source_id: row.source_id.clone(),
+                tool_id: row.tool_id.clone(),
+                source_revision: row.source_revision,
+                catalog_revision: row.catalog_revision,
+                tool_revision: row.tool_revision,
+                binding_revision,
+                credential_revision: row.credential_revision,
+            },
+            lookup: InvocationLookup {
+                tool_id: row.tool_id,
+                source_id: row.source_id,
+                source_display_name: row.source_display_name,
+                tool_display_name: row.tool_display_name,
+                callable_path: format!("tools.{sandbox_path}"),
+                sandbox_path,
+                effective_mode: mode,
+                mode_provenance: effective_mode.provenance,
+                requires_approval: mode == ToolMode::Ask,
+            },
+            input_schema,
+            input_validator,
+            _guard: guard,
+        })
+    }
+
+    pub async fn record_request(&self, log: NewRequestLog) -> Result<(), CatalogError> {
+        let duration_ms = i64::try_from(log.duration_ms).map_err(|_| {
+            validation(
+                "invalid_duration",
+                "Request duration is too large to store.",
+            )
+        })?;
+        validate_log_text("request ID", &log.request_id, 128)?;
+        validate_optional_log_text("path snapshot", log.path_snapshot.as_deref(), 512)?;
+        validate_optional_log_text("error code", log.error_code.as_deref(), 128)?;
+        validate_optional_log_text("approval ID", log.approval_id.as_deref(), 128)?;
+        if (log.source_id.is_some() || log.tool_id.is_some()) && log.path_snapshot.is_none() {
+            return Err(validation(
+                "invalid_log_path",
+                "Catalog request logs with source or tool IDs require a path snapshot.",
+            ));
+        }
+        let _permit = self
+            .request_log_writes
+            .clone()
+            .try_acquire_owned()
+            .map_err(|_| {
+                validation(
+                    "request_log_backpressure",
+                    "Request logging is at capacity. The request log was not stored.",
+                )
+            })?;
+        self.persist_request(log, duration_ms).await
+    }
+
+    async fn persist_request(
+        &self,
+        log: NewRequestLog,
+        duration_ms: i64,
+    ) -> Result<(), CatalogError> {
+        let mut transaction = self.pool.begin_with("BEGIN IMMEDIATE").await?;
+        sqlx::query(
+            "INSERT INTO request_logs \
+             (request_id, actor_api_token_id, surface, source_id, tool_id, path_snapshot, \
+              outcome, error_code, duration_ms, approval_id, created_at) \
+             VALUES (?, \
+              (SELECT id FROM api_tokens WHERE id = ?), ?, \
+              (SELECT id FROM sources WHERE id = ?), \
+              (SELECT id FROM tools WHERE id = ?), ?, ?, ?, ?, ?, ?)",
+        )
+        .bind(log.request_id)
+        .bind(log.actor_api_token_id)
+        .bind(log.surface.as_str())
+        .bind(log.source_id)
+        .bind(log.tool_id)
+        .bind(log.path_snapshot)
+        .bind(log.outcome.as_str())
+        .bind(log.error_code)
+        .bind(duration_ms)
+        .bind(log.approval_id)
+        .bind(log.created_at)
+        .execute(&mut *transaction)
+        .await?;
+        sqlx::query(
+            "DELETE FROM request_logs WHERE request_id IN ( \
+             SELECT request_id FROM request_logs \
+             ORDER BY created_at DESC, request_id DESC LIMIT -1 OFFSET ?)",
+        )
+        .bind(MAX_REQUEST_LOG_ROWS)
+        .execute(&mut *transaction)
+        .await?;
+        transaction.commit().await?;
+        Ok(())
+    }
+
+    pub async fn request_log(&self, request_id: &str) -> Result<RequestLogRecord, CatalogError> {
+        sqlx::query_as::<_, RequestLogRow>(REQUEST_LOG_SELECT_BY_ID)
+            .bind(request_id)
+            .fetch_optional(&self.pool)
+            .await?
+            .ok_or(CatalogError::NotFound {
+                entity: "request log",
+            })?
+            .try_into()
+    }
+
+    pub async fn list_request_logs(
+        &self,
+        cursor: Option<&str>,
+        limit: u32,
+    ) -> Result<RequestLogPage, CatalogError> {
+        let limit = page_limit(limit);
+        let cursor = cursor.map(decode_cursor).transpose()?;
+        let mut rows = if let Some((created_at, request_id)) = cursor {
+            sqlx::query_as::<_, RequestLogRow>(
+                "SELECT request_id, actor_api_token_id, surface, source_id, tool_id, \
+                 path_snapshot, outcome, error_code, duration_ms, approval_id, created_at \
+                 FROM request_logs WHERE created_at < ? OR (created_at = ? AND request_id < ?) \
+                 ORDER BY created_at DESC, request_id DESC LIMIT ?",
+            )
+            .bind(created_at)
+            .bind(created_at)
+            .bind(request_id)
+            .bind(i64::try_from(limit + 1).unwrap_or(i64::MAX))
+            .fetch_all(&self.pool)
+            .await?
+        } else {
+            sqlx::query_as::<_, RequestLogRow>(
+                "SELECT request_id, actor_api_token_id, surface, source_id, tool_id, \
+                 path_snapshot, outcome, error_code, duration_ms, approval_id, created_at \
+                 FROM request_logs ORDER BY created_at DESC, request_id DESC LIMIT ?",
+            )
+            .bind(i64::try_from(limit + 1).unwrap_or(i64::MAX))
+            .fetch_all(&self.pool)
+            .await?
+        };
+        let has_more = rows.len() > limit;
+        rows.truncate(limit);
+        let next_cursor = has_more.then(|| {
+            let last = rows.last().expect("a page with more rows is not empty");
+            encode_cursor(last.created_at, &last.request_id)
+        });
+        Ok(RequestLogPage {
+            items: rows
+                .into_iter()
+                .map(RequestLogRecord::try_from)
+                .collect::<Result<_, _>>()?,
+            next_cursor,
+        })
+    }
+
+    async fn tool_by_path(&self, path: &str) -> Result<Option<ToolRecord>, CatalogError> {
+        let Some((source_slug, local_name)) = parse_tool_path(path) else {
+            return Ok(None);
+        };
+        sqlx::query_as::<_, ToolRow>(TOOL_SELECT_BY_PATH)
+            .bind(source_slug)
+            .bind(local_name)
+            .fetch_optional(&self.pool)
+            .await?
+            .map(ToolRecord::try_from)
+            .transpose()
+    }
+
+    async fn tool_summary_by_path(&self, path: &str) -> Result<Option<ToolSummary>, CatalogError> {
+        let Some((source_slug, local_name)) = parse_tool_path(path) else {
+            return Ok(None);
+        };
+        sqlx::query_as::<_, ToolSummaryRow>(TOOL_SUMMARY_SELECT_BY_PATH)
+            .bind(source_slug)
+            .bind(local_name)
+            .fetch_optional(&self.pool)
+            .await?
+            .map(ToolSummary::try_from)
+            .transpose()
+    }
+
+    async fn gateway_tool_by_path(&self, path: &str) -> Result<ToolRecord, CatalogError> {
+        let tool = self
+            .tool_by_path(path)
+            .await?
+            .ok_or_else(|| CatalogError::ToolNotFound {
+                path: normalize_sandbox_path(path),
+            })?;
+        if !tool.present || tool.effective_mode.mode == ToolMode::Disabled {
+            return Err(CatalogError::ToolNotFound {
+                path: normalize_sandbox_path(path),
+            });
+        }
+        Ok(tool)
+    }
+}
+
+impl TryFrom<SourceRow> for SourceRecord {
+    type Error = CatalogError;
+
+    fn try_from(row: SourceRow) -> Result<Self, Self::Error> {
+        let configuration = serde_json::from_str::<Map<String, Value>>(&row.configuration_json)?;
+        Ok(Self {
+            id: row.id,
+            kind: SourceKind::from_str(&row.kind)?,
+            slug: row.slug,
+            display_name: row.display_name,
+            description: row.description,
+            configuration,
+            mode_override: parse_optional_mode(row.mode_override)?,
+            health_status: SourceHealth::from_str(&row.health_status)?,
+            health_error_code: row.health_error_code,
+            revision: row.revision,
+            catalog_revision: row.catalog_revision,
+            created_at: row.created_at,
+            updated_at: row.updated_at,
+            last_refreshed_at: row.last_refreshed_at,
+            tool_count: row.tool_count,
+            tombstoned_tool_count: row.tombstoned_tool_count,
+        })
+    }
+}
+
+impl TryFrom<ToolRow> for ToolRecord {
+    type Error = CatalogError;
+
+    fn try_from(row: ToolRow) -> Result<Self, Self::Error> {
+        let intrinsic_mode = ToolMode::from_str(&row.intrinsic_mode)?;
+        let source_override = parse_optional_mode(row.source_mode_override)?;
+        let mode_override = parse_optional_mode(row.mode_override)?;
+        let effective_mode = effective_mode(intrinsic_mode, source_override, mode_override);
+        let sandbox_path = format!("{}.{}", row.source_slug, row.local_name);
+        let callable_path = format!("tools.{sandbox_path}");
+        Ok(Self {
+            id: row.id,
+            source_id: row.source_id,
+            source_slug: row.source_slug,
+            stable_key: row.stable_key,
+            local_name: row.local_name,
+            callable_path,
+            sandbox_path,
+            display_name: row.display_name,
+            description: row.description,
+            input_schema: serde_json::from_str(&row.input_schema_json)?,
+            output_schema: row
+                .output_schema_json
+                .map(|json| serde_json::from_str(&json))
+                .transpose()?,
+            input_typescript: row.input_typescript,
+            output_typescript: row.output_typescript,
+            typescript_definitions: serde_json::from_str(&row.typescript_definitions_json)?,
+            intrinsic_mode,
+            mode_override,
+            effective_mode,
+            present: row.present != 0,
+            revision: row.revision,
+            created_at: row.created_at,
+            updated_at: row.updated_at,
+            last_seen_at: row.last_seen_at,
+            tombstoned_at: row.tombstoned_at,
+        })
+    }
+}
+
+impl TryFrom<ToolSummaryRow> for ToolSummary {
+    type Error = CatalogError;
+
+    fn try_from(row: ToolSummaryRow) -> Result<Self, Self::Error> {
+        let intrinsic_mode = ToolMode::from_str(&row.intrinsic_mode)?;
+        let source_override = parse_optional_mode(row.source_mode_override)?;
+        let mode_override = parse_optional_mode(row.mode_override)?;
+        let effective_mode = effective_mode(intrinsic_mode, source_override, mode_override);
+        let sandbox_path = format!("{}.{}", row.source_slug, row.local_name);
+        let callable_path = format!("tools.{sandbox_path}");
+        Ok(Self {
+            id: row.id,
+            source_id: row.source_id,
+            source_slug: row.source_slug,
+            stable_key: row.stable_key,
+            local_name: row.local_name,
+            callable_path,
+            sandbox_path,
+            display_name: row.display_name,
+            description: row.description,
+            intrinsic_mode,
+            mode_override,
+            effective_mode,
+            present: row.present != 0,
+            revision: row.revision,
+            created_at: row.created_at,
+            updated_at: row.updated_at,
+            last_seen_at: row.last_seen_at,
+            tombstoned_at: row.tombstoned_at,
+        })
+    }
+}
+
+impl TryFrom<RequestLogRow> for RequestLogRecord {
+    type Error = CatalogError;
+
+    fn try_from(row: RequestLogRow) -> Result<Self, Self::Error> {
+        Ok(Self {
+            request_id: row.request_id,
+            actor_api_token_id: row.actor_api_token_id,
+            surface: RequestSurface::from_str(&row.surface)?,
+            source_id: row.source_id,
+            tool_id: row.tool_id,
+            path_snapshot: row.path_snapshot,
+            outcome: RequestOutcome::from_str(&row.outcome)?,
+            error_code: row.error_code,
+            duration_ms: row.duration_ms,
+            approval_id: row.approval_id,
+            created_at: row.created_at,
+        })
+    }
+}
+
+const SOURCE_SELECT_ALL: &str = "SELECT sources.id, sources.kind, sources.slug, sources.display_name, sources.description, \
+     sources.configuration_json, sources.mode_override, sources.health_status, \
+     sources.health_error_code, sources.revision, sources.catalog_revision, \
+     sources.created_at, sources.updated_at, sources.last_refreshed_at, \
+     (SELECT COUNT(*) FROM tools WHERE tools.source_id = sources.id AND tools.present = 1) AS tool_count, \
+     (SELECT COUNT(*) FROM tools WHERE tools.source_id = sources.id AND tools.present = 0) AS tombstoned_tool_count \
+     FROM sources ORDER BY sources.slug, sources.id";
+
+const SOURCE_SELECT_BY_ID: &str = "SELECT sources.id, sources.kind, sources.slug, sources.display_name, sources.description, \
+     sources.configuration_json, sources.mode_override, sources.health_status, \
+     sources.health_error_code, sources.revision, sources.catalog_revision, \
+     sources.created_at, sources.updated_at, sources.last_refreshed_at, \
+     (SELECT COUNT(*) FROM tools WHERE tools.source_id = sources.id AND tools.present = 1) AS tool_count, \
+     (SELECT COUNT(*) FROM tools WHERE tools.source_id = sources.id AND tools.present = 0) AS tombstoned_tool_count \
+     FROM sources WHERE sources.id = ?";
+
+const TOOL_SELECT_BY_ID: &str = "SELECT tools.id, tools.source_id, sources.slug AS source_slug, \
+     sources.mode_override AS source_mode_override, tools.stable_key, tools.local_name, \
+     tools.display_name, tools.description, tools.input_schema_json, tools.output_schema_json, \
+     tools.input_typescript, tools.output_typescript, tools.typescript_definitions_json, \
+     tools.intrinsic_mode, tools.mode_override, tools.present, tools.revision, \
+     tools.created_at, tools.updated_at, tools.last_seen_at, tools.tombstoned_at \
+     FROM tools JOIN sources ON sources.id = tools.source_id WHERE tools.id = ?";
+
+const TOOL_SELECT_BY_PATH: &str = "SELECT tools.id, tools.source_id, sources.slug AS source_slug, \
+     sources.mode_override AS source_mode_override, tools.stable_key, tools.local_name, \
+     tools.display_name, tools.description, tools.input_schema_json, tools.output_schema_json, \
+     tools.input_typescript, tools.output_typescript, tools.typescript_definitions_json, \
+     tools.intrinsic_mode, tools.mode_override, tools.present, tools.revision, \
+     tools.created_at, tools.updated_at, tools.last_seen_at, tools.tombstoned_at \
+     FROM tools JOIN sources ON sources.id = tools.source_id \
+     WHERE sources.slug = ? AND tools.local_name = ?";
+
+const TOOL_LIST_COUNT: &str = "SELECT COUNT(*) FROM tools \
+     JOIN sources ON sources.id = tools.source_id \
+     WHERE (? = 1 OR tools.present = 1) \
+       AND (? IS NULL OR tools.source_id = ?) \
+       AND (? IS NULL OR coalesce(tools.mode_override, sources.mode_override, tools.intrinsic_mode) = ?) \
+       AND NOT EXISTS ( \
+         SELECT 1 FROM json_each(?) AS query_tokens \
+         WHERE instr(lower( \
+           'tools.' || sources.slug || '.' || tools.local_name || ' ' || tools.display_name || ' ' || \
+           tools.stable_key || ' ' || coalesce(tools.description, '') || ' ' || sources.slug \
+         ), CAST(query_tokens.value AS TEXT)) = 0)";
+
+const TOOL_LIST_PAGE: &str = "SELECT tools.id, tools.source_id, sources.slug AS source_slug, \
+     sources.mode_override AS source_mode_override, tools.stable_key, tools.local_name, \
+     tools.display_name, tools.description, tools.intrinsic_mode, tools.mode_override, \
+     tools.present, tools.revision, tools.created_at, tools.updated_at, \
+     tools.last_seen_at, tools.tombstoned_at \
+     FROM tools JOIN sources ON sources.id = tools.source_id \
+     WHERE (? = 1 OR tools.present = 1) \
+       AND (? IS NULL OR tools.source_id = ?) \
+       AND (? IS NULL OR coalesce(tools.mode_override, sources.mode_override, tools.intrinsic_mode) = ?) \
+       AND NOT EXISTS ( \
+         SELECT 1 FROM json_each(?) AS query_tokens \
+         WHERE instr(lower( \
+           'tools.' || sources.slug || '.' || tools.local_name || ' ' || tools.display_name || ' ' || \
+           tools.stable_key || ' ' || coalesce(tools.description, '') || ' ' || sources.slug \
+         ), CAST(query_tokens.value AS TEXT)) = 0) \
+     ORDER BY sources.slug, tools.local_name, tools.id LIMIT ? OFFSET ?";
+
+const TOOL_SEARCH_CANDIDATES: &str = "WITH ranked_candidates AS ( \
+       SELECT * FROM ( \
+         SELECT tools.id AS tool_id, 0 AS priority, \
+                bm25(tool_search, 0.0, 0.0, 8.0, 10.0, 5.0, 12.0) AS relevance \
+         FROM tool_search JOIN tools ON tools.id = tool_search.tool_id \
+         JOIN sources ON sources.id = tools.source_id \
+         WHERE tool_search MATCH ?1 AND tools.present = 1 \
+           AND coalesce(tools.mode_override, sources.mode_override, tools.intrinsic_mode) <> 'disabled' \
+           AND (?5 IS NULL OR ( \
+             replace(sources.slug, '_', ' ') || ' ' || replace(tools.local_name, '_', ' ') = ?6 \
+             OR replace(sources.slug, '_', ' ') || ' ' || replace(tools.local_name, '_', ' ') LIKE ?7)) \
+         ORDER BY relevance, tools.id LIMIT ?8) \
+       UNION ALL \
+       SELECT * FROM ( \
+         SELECT tools.id AS tool_id, 1 AS priority, \
+                bm25(tool_search_trigram, 0.0, 0.0, 8.0, 10.0, 5.0, 12.0) AS relevance \
+         FROM tool_search_trigram JOIN tools ON tools.id = tool_search_trigram.tool_id \
+         JOIN sources ON sources.id = tools.source_id \
+         WHERE ?9 = 1 AND tool_search_trigram MATCH ?2 AND tools.present = 1 \
+           AND coalesce(tools.mode_override, sources.mode_override, tools.intrinsic_mode) <> 'disabled' \
+           AND (?5 IS NULL OR ( \
+             replace(sources.slug, '_', ' ') || ' ' || replace(tools.local_name, '_', ' ') = ?6 \
+             OR replace(sources.slug, '_', ' ') || ' ' || replace(tools.local_name, '_', ' ') LIKE ?7)) \
+         ORDER BY relevance, tools.id LIMIT ?8) \
+       UNION ALL \
+       SELECT * FROM ( \
+         SELECT tools.id AS tool_id, 2 AS priority, \
+                bm25(tool_search_short, 0.0, 0.0, 1.0) AS relevance \
+         FROM tool_search_short JOIN tools ON tools.id = tool_search_short.tool_id \
+         JOIN sources ON sources.id = tools.source_id \
+         WHERE ?10 = 1 AND tool_search_short MATCH ?3 AND tools.present = 1 \
+           AND coalesce(tools.mode_override, sources.mode_override, tools.intrinsic_mode) <> 'disabled' \
+           AND (?5 IS NULL OR ( \
+             replace(sources.slug, '_', ' ') || ' ' || replace(tools.local_name, '_', ' ') = ?6 \
+             OR replace(sources.slug, '_', ' ') || ' ' || replace(tools.local_name, '_', ' ') LIKE ?7)) \
+         ORDER BY relevance, tools.id LIMIT ?8) \
+       UNION ALL \
+       SELECT * FROM ( \
+         SELECT tools.id AS tool_id, 3 AS priority, \
+                bm25(tool_search_short, 0.0, 0.0, 1.0) AS relevance \
+         FROM tool_search_short JOIN tools ON tools.id = tool_search_short.tool_id \
+         JOIN sources ON sources.id = tools.source_id \
+         WHERE tool_search_short MATCH ?4 AND tools.present = 1 \
+           AND coalesce(tools.mode_override, sources.mode_override, tools.intrinsic_mode) <> 'disabled' \
+           AND (?5 IS NULL OR ( \
+             replace(sources.slug, '_', ' ') || ' ' || replace(tools.local_name, '_', ' ') = ?6 \
+             OR replace(sources.slug, '_', ' ') || ' ' || replace(tools.local_name, '_', ' ') LIKE ?7)) \
+         ORDER BY relevance, tools.id LIMIT ?8) \
+     ), best_priority AS ( \
+       SELECT tool_id, min(priority) AS priority FROM ranked_candidates GROUP BY tool_id \
+     ), deduped AS ( \
+       SELECT ranked.tool_id, ranked.priority, min(ranked.relevance) AS relevance \
+       FROM ranked_candidates AS ranked \
+       JOIN best_priority AS best \
+         ON best.tool_id = ranked.tool_id AND best.priority = ranked.priority \
+       GROUP BY ranked.tool_id, ranked.priority \
+     ), candidates AS ( \
+       SELECT tool_id, priority, relevance FROM deduped \
+       ORDER BY priority, relevance, tool_id LIMIT ?8 \
+     ) \
+     SELECT tools.id, tools.source_id, sources.slug AS source_slug, \
+            sources.mode_override AS source_mode_override, tools.stable_key, tools.local_name, \
+            tools.display_name, tools.description, tools.intrinsic_mode, tools.mode_override, \
+            tools.present, tools.revision, tools.created_at, tools.updated_at, \
+            tools.last_seen_at, tools.tombstoned_at \
+     FROM candidates JOIN tools ON tools.id = candidates.tool_id \
+     JOIN sources ON sources.id = tools.source_id \
+     ORDER BY candidates.priority, candidates.relevance, sources.slug, tools.local_name, tools.id";
+
+const TOOL_SUMMARY_SELECT_BY_PATH: &str = "SELECT tools.id, tools.source_id, sources.slug AS source_slug, \
+     sources.mode_override AS source_mode_override, tools.stable_key, tools.local_name, \
+     tools.display_name, tools.description, tools.intrinsic_mode, tools.mode_override, \
+     tools.present, tools.revision, tools.created_at, tools.updated_at, \
+     tools.last_seen_at, tools.tombstoned_at \
+     FROM tools JOIN sources ON sources.id = tools.source_id \
+     WHERE sources.slug = ? AND tools.local_name = ?";
+
+const INVOCATION_SELECT_BY_PATH: &str = "SELECT tools.id AS tool_id, tools.source_id, \
+     sources.display_name AS source_display_name, tools.display_name AS tool_display_name, \
+     sources.kind AS source_kind, sources.slug AS source_slug, tools.stable_key, tools.local_name, \
+     tools.present, tools.intrinsic_mode, \
+     tools.mode_override AS tool_mode_override, sources.mode_override AS source_mode_override, \
+     tools.revision AS tool_revision, sources.revision AS source_revision, \
+     sources.catalog_revision, sources.configuration_json, tools.input_schema_json, \
+     tool_bindings.protocol AS binding_protocol, tool_bindings.binding_version, \
+     tool_bindings.definition_json, tool_bindings.revision AS binding_revision, \
+     source_credentials.schema_version AS credential_schema_version, \
+     source_credentials.payload_ciphertext AS credential_ciphertext, \
+     source_credentials.revision AS credential_revision \
+     FROM tools JOIN sources ON sources.id = tools.source_id \
+     LEFT JOIN tool_bindings ON tool_bindings.tool_id = tools.id \
+     LEFT JOIN source_credentials ON source_credentials.source_id = sources.id \
+     WHERE sources.slug = ? AND tools.local_name = ?";
+
+const INVOCATION_SELECT_BY_REVISION: &str = "SELECT tools.id AS tool_id, tools.source_id, \
+     sources.display_name AS source_display_name, tools.display_name AS tool_display_name, \
+     sources.kind AS source_kind, sources.slug AS source_slug, tools.stable_key, tools.local_name, \
+     tools.present, tools.intrinsic_mode, \
+     tools.mode_override AS tool_mode_override, sources.mode_override AS source_mode_override, \
+     tools.revision AS tool_revision, sources.revision AS source_revision, \
+     sources.catalog_revision, sources.configuration_json, tools.input_schema_json, \
+     tool_bindings.protocol AS binding_protocol, tool_bindings.binding_version, \
+     tool_bindings.definition_json, tool_bindings.revision AS binding_revision, \
+     source_credentials.schema_version AS credential_schema_version, \
+     source_credentials.payload_ciphertext AS credential_ciphertext, \
+     source_credentials.revision AS credential_revision \
+     FROM tools JOIN sources ON sources.id = tools.source_id \
+     JOIN tool_bindings ON tool_bindings.tool_id = tools.id \
+     LEFT JOIN source_credentials ON source_credentials.source_id = sources.id \
+     WHERE tools.id = ? AND tools.source_id = ? AND tools.present = 1 \
+       AND sources.revision = ? AND sources.catalog_revision = ? \
+       AND tools.revision = ? AND tool_bindings.revision = ? \
+       AND source_credentials.revision IS ?";
+
+const REQUEST_LOG_SELECT_BY_ID: &str = "SELECT request_id, actor_api_token_id, surface, source_id, tool_id, path_snapshot, \
+     outcome, error_code, duration_ms, approval_id, created_at \
+     FROM request_logs WHERE request_id = ?";
+
+fn prepare_snapshot_and_bindings(
+    snapshot: CatalogSnapshot,
+    bindings: Vec<StagedToolBinding>,
+) -> Result<(PreparedSnapshot, PreparedToolBindings), CatalogError> {
+    prepare_snapshot_and_bindings_with_limits(snapshot, bindings, PayloadLimits::default())
+}
+
+fn prepare_initial_snapshot_and_bindings(
+    snapshot: InitialCatalogSnapshot,
+    bindings: Vec<StagedToolBinding>,
+) -> Result<(PreparedSnapshot, PreparedToolBindings), CatalogError> {
+    let prepared = prepare_catalog_content_with_limits(
+        snapshot.artifacts,
+        snapshot.tools,
+        PayloadLimits::default(),
+    )?;
+    let prepared_bindings = prepare_tool_bindings_with_limits(
+        bindings,
+        PayloadLimits::default(),
+        prepared.payload_bytes,
+    )?;
+    Ok((prepared, prepared_bindings))
+}
+
+fn prepare_snapshot_and_bindings_with_limits(
+    snapshot: CatalogSnapshot,
+    bindings: Vec<StagedToolBinding>,
+    limits: PayloadLimits,
+) -> Result<(PreparedSnapshot, PreparedToolBindings), CatalogError> {
+    let prepared = prepare_snapshot_with_limits(snapshot, limits)?;
+    let prepared_bindings =
+        prepare_tool_bindings_with_limits(bindings, limits, prepared.payload_bytes)?;
+    Ok((prepared, prepared_bindings))
+}
+
+#[cfg(test)]
+fn prepare_tool_bindings(
+    bindings: Vec<StagedToolBinding>,
+) -> Result<PreparedToolBindings, CatalogError> {
+    prepare_tool_bindings_with_limits(bindings, PayloadLimits::default(), 0)
+}
+
+fn prepare_tool_bindings_with_limits(
+    bindings: Vec<StagedToolBinding>,
+    limits: PayloadLimits,
+    initial_payload_bytes: usize,
+) -> Result<PreparedToolBindings, CatalogError> {
+    let mut prepared = Vec::with_capacity(bindings.len());
+    let mut seen = HashSet::with_capacity(bindings.len());
+    let mut total_bytes = initial_payload_bytes;
+    for binding in bindings {
+        let stable_key = validate_stable_text(
+            "invalid_stable_key",
+            "Tool stable keys must contain between 1 and 1024 characters.",
+            &binding.stable_key,
+            1024,
+        )?;
+        if !seen.insert(stable_key.clone()) {
+            return Err(validation(
+                "duplicate_tool_binding",
+                "A staged catalog contains the same tool binding more than once.",
+            ));
+        }
+        let definition_json = match &binding.binding {
+            ToolBinding::OpenapiV1(binding) => {
+                if binding.version != 1 {
+                    return Err(validation(
+                        "invalid_tool_binding",
+                        "The OpenAPI tool binding version is not supported.",
+                    ));
+                }
+                serde_json::to_string(binding)?
+            }
+            ToolBinding::GraphqlV1(binding) => {
+                if binding.stable_key().ok().as_deref() != Some(stable_key.as_str()) {
+                    return Err(validation(
+                        "invalid_tool_binding",
+                        "A GraphQL tool binding must be canonical and match its stable catalog key.",
+                    ));
+                }
+                serde_json::to_string(binding)?
+            }
+            ToolBinding::McpHttpV1(binding) | ToolBinding::McpStdioV1(binding) => {
+                if binding.version != 1
+                    || binding.tool_name.is_empty()
+                    || binding.tool_name.chars().count() > 128
+                    || binding.tool_name.trim() != binding.tool_name
+                    || binding.tool_name.chars().any(char::is_control)
+                {
+                    return Err(validation(
+                        "invalid_tool_binding",
+                        "The MCP tool binding version or tool name is not supported.",
+                    ));
+                }
+                if binding.tool_name != stable_key {
+                    return Err(validation(
+                        "invalid_tool_binding",
+                        "An MCP tool binding name must match its stable catalog key.",
+                    ));
+                }
+                serde_json::to_string(binding)?
+            }
+        };
+        if definition_json.len() > limits.schema {
+            return Err(validation(
+                "tool_binding_too_large",
+                "A tool binding exceeds the serialized-size limit.",
+            ));
+        }
+        total_bytes = total_bytes
+            .checked_add(definition_json.len())
+            .filter(|size| *size <= limits.aggregate)
+            .ok_or_else(|| {
+                validation(
+                    "catalog_payload_too_large",
+                    "The staged tool bindings exceed the aggregate size limit.",
+                )
+            })?;
+        prepared.push(PreparedToolBinding {
+            stable_key,
+            protocol: binding.binding.protocol(),
+            version: binding.binding.version(),
+            definition_json,
+        });
+    }
+    Ok(prepared)
+}
+
+fn prepare_snapshot_with_limits(
+    snapshot: CatalogSnapshot,
+    limits: PayloadLimits,
+) -> Result<PreparedSnapshot, CatalogError> {
+    prepare_catalog_content_with_limits(snapshot.artifacts, snapshot.tools, limits)
+}
+
+fn prepare_catalog_content_with_limits(
+    staged_artifacts: Vec<super::StagedArtifact>,
+    staged_tools: Vec<super::StagedTool>,
+    limits: PayloadLimits,
+) -> Result<PreparedSnapshot, CatalogError> {
+    if staged_tools.len() > MAX_ACTIVE_TOOLS_PER_SOURCE {
+        return Err(validation(
+            "catalog_too_large",
+            format!(
+                "A catalog refresh may contain at most {MAX_ACTIVE_TOOLS_PER_SOURCE} active tools."
+            ),
+        ));
+    }
+    validate_artifact_count(staged_artifacts.len(), limits.artifact_count)?;
+    let mut budget = PayloadBudget::new(limits);
+    let mut artifact_keys = HashSet::with_capacity(staged_artifacts.len());
+    let mut artifacts = Vec::with_capacity(staged_artifacts.len());
+    for artifact in staged_artifacts {
+        let stable_key = validate_stable_text(
+            "invalid_artifact_key",
+            "Artifact stable keys must contain between 1 and 512 characters.",
+            &artifact.stable_key,
+            512,
+        )?;
+        if !artifact_keys.insert((artifact.kind.as_str(), stable_key.clone())) {
+            return Err(validation(
+                "duplicate_artifact_key",
+                "A staged catalog contains the same source artifact more than once.",
+            ));
+        }
+        budget.charge(
+            stable_key.len(),
+            limits.artifact_key,
+            "artifact_key_too_large",
+            "A staged artifact key exceeds the byte-size limit.",
+        )?;
+        budget.charge_aggregate(artifact.kind.as_str().len())?;
+        let content_json = serde_json::to_string(&artifact.content)?;
+        budget.charge(
+            content_json.len(),
+            limits.artifact,
+            "artifact_too_large",
+            "A staged artifact exceeds the serialized-size limit.",
+        )?;
+        artifacts.push(PreparedArtifact {
+            kind: artifact.kind,
+            stable_key,
+            content_json,
+        });
+    }
+    artifacts.sort_by(|left, right| {
+        left.kind
+            .as_str()
+            .cmp(right.kind.as_str())
+            .then_with(|| left.stable_key.cmp(&right.stable_key))
+    });
+
+    let mut stable_keys = HashSet::with_capacity(staged_tools.len());
+    let mut tools = Vec::with_capacity(staged_tools.len());
+    for tool in staged_tools {
+        let stable_key = validate_stable_text(
+            "invalid_stable_key",
+            "Tool stable keys must contain between 1 and 1024 characters.",
+            &tool.stable_key,
+            1024,
+        )?;
+        if !stable_keys.insert(stable_key.clone()) {
+            return Err(validation(
+                "duplicate_stable_key",
+                "A staged catalog contains the same stable tool key more than once.",
+            ));
+        }
+        budget.charge(
+            stable_key.len(),
+            limits.tool_stable_key,
+            "tool_key_too_large",
+            "A staged tool stable key exceeds the byte-size limit.",
+        )?;
+        let preferred_name = validate_text(
+            "invalid_tool_name",
+            "Tool names must contain between 1 and 300 characters.",
+            &tool.preferred_name,
+            300,
+        )?;
+        budget.charge(
+            preferred_name.len(),
+            limits.tool_name,
+            "tool_name_too_large",
+            "A staged tool name exceeds the byte-size limit.",
+        )?;
+        let display_name = validate_text(
+            "invalid_tool_name",
+            "Tool display names must contain between 1 and 300 characters.",
+            &tool.display_name,
+            300,
+        )?;
+        budget.charge(
+            display_name.len(),
+            limits.tool_name,
+            "tool_name_too_large",
+            "A staged tool name exceeds the byte-size limit.",
+        )?;
+        let description = validate_optional_text(
+            "invalid_tool_description",
+            "Tool descriptions may contain at most 4000 characters.",
+            tool.description.as_deref(),
+            4000,
+        )?;
+        if let Some(description) = &description {
+            budget.charge(
+                description.len(),
+                limits.tool_description,
+                "tool_description_too_large",
+                "A staged tool description exceeds the byte-size limit.",
+            )?;
+        }
+        validate_optional_text(
+            "invalid_typescript",
+            "TypeScript previews may contain at most 100000 characters.",
+            tool.input_typescript.as_deref(),
+            100_000,
+        )?;
+        if let Some(input_typescript) = &tool.input_typescript {
+            budget.charge(
+                input_typescript.len(),
+                limits.typescript_preview,
+                "typescript_too_large",
+                "A staged TypeScript preview exceeds the byte-size limit.",
+            )?;
+        }
+        validate_optional_text(
+            "invalid_typescript",
+            "TypeScript previews may contain at most 100000 characters.",
+            tool.output_typescript.as_deref(),
+            100_000,
+        )?;
+        if let Some(output_typescript) = &tool.output_typescript {
+            budget.charge(
+                output_typescript.len(),
+                limits.typescript_preview,
+                "typescript_too_large",
+                "A staged TypeScript preview exceeds the byte-size limit.",
+            )?;
+        }
+        let search_description = description
+            .as_deref()
+            .map(search::normalize_for_index)
+            .unwrap_or_default();
+        budget.charge(
+            search_description.len(),
+            limits.search_description,
+            "search_description_too_large",
+            "A normalized tool description exceeds the byte-size limit.",
+        )?;
+        let normalized_preferred_name = normalize_tool_name(&preferred_name);
+        let search_short_grams =
+            search::short_gram_document(&[&normalized_preferred_name, &search_description]);
+        budget.charge(
+            search_short_grams.len(),
+            limits.short_gram_document,
+            "search_index_too_large",
+            "A staged tool search index exceeds the byte-size limit.",
+        )?;
+        budget.charge_aggregate(limits.local_name)?;
+        budget.charge_aggregate(tool.intrinsic_mode.as_str().len())?;
+        let input_schema_json = serde_json::to_string(&tool.input_schema)?;
+        budget.charge(
+            input_schema_json.len(),
+            limits.schema,
+            "schema_too_large",
+            "A staged tool schema exceeds the serialized-size limit.",
+        )?;
+        super::schema::compile(&tool.input_schema).map_err(|()| {
+            validation(
+                "invalid_tool_input_schema",
+                "A staged tool input schema is invalid or unsafe.",
+            )
+        })?;
+        let output_schema_json = tool
+            .output_schema
+            .as_ref()
+            .map(serde_json::to_string)
+            .transpose()?;
+        if let Some(output_schema_json) = &output_schema_json {
+            budget.charge(
+                output_schema_json.len(),
+                limits.schema,
+                "schema_too_large",
+                "A staged tool schema exceeds the serialized-size limit.",
+            )?;
+        }
+        let typescript_definitions_json = serde_json::to_string(&tool.typescript_definitions)?;
+        budget.charge(
+            typescript_definitions_json.len(),
+            limits.typescript_definitions,
+            "typescript_definitions_too_large",
+            "Staged TypeScript definitions exceed the serialized-size limit.",
+        )?;
+        tools.push(PreparedTool {
+            stable_key,
+            preferred_name,
+            display_name,
+            search_description,
+            search_short_grams,
+            description,
+            input_schema_json,
+            output_schema_json,
+            input_typescript: tool.input_typescript,
+            output_typescript: tool.output_typescript,
+            typescript_definitions_json,
+            intrinsic_mode: tool.intrinsic_mode,
+        });
+    }
+    tools.sort_by(|left, right| left.stable_key.cmp(&right.stable_key));
+    Ok(PreparedSnapshot {
+        tools,
+        artifacts,
+        payload_bytes: budget.consumed,
+    })
+}
+
+fn parse_optional_mode(value: Option<String>) -> Result<Option<ToolMode>, CatalogError> {
+    value.map(|value| ToolMode::from_str(&value)).transpose()
+}
+
+fn binding_matches_source_kind(binding: &ToolBinding, source_kind: SourceKind) -> bool {
+    matches!(
+        (binding, source_kind),
+        (ToolBinding::OpenapiV1(_), SourceKind::Openapi)
+            | (ToolBinding::GraphqlV1(_), SourceKind::Graphql)
+            | (ToolBinding::McpHttpV1(_), SourceKind::McpHttp)
+            | (ToolBinding::McpStdioV1(_), SourceKind::McpStdio)
+    )
+}
+
+fn require_binding_stable_key(binding: &ToolBinding, stable_key: &str) -> Result<(), CatalogError> {
+    if let ToolBinding::GraphqlV1(binding) = binding
+        && binding.stable_key().ok().as_deref() != Some(stable_key)
+    {
+        return Err(CatalogError::CorruptData(
+            "GraphQL tool binding does not match tool stable key",
+        ));
+    }
+    Ok(())
+}
+
+fn normalize_source_slug(value: &str) -> String {
+    normalize_identifier(value, "source")
+}
+
+fn normalize_tool_name(value: &str) -> String {
+    normalize_identifier(value, "tool")
+}
+
+fn normalize_identifier(value: &str, fallback: &str) -> String {
+    let mut normalized = String::new();
+    let mut separator_pending = false;
+    let mut previous: Option<char> = None;
+    for character in value.chars() {
+        if character.is_ascii_alphanumeric() {
+            let camel_boundary = character.is_ascii_uppercase()
+                && previous.is_some_and(|previous| {
+                    previous.is_ascii_lowercase() || previous.is_ascii_digit()
+                });
+            if (separator_pending || camel_boundary) && !normalized.is_empty() {
+                normalized.push('_');
+            }
+            normalized.push(character.to_ascii_lowercase());
+            separator_pending = false;
+        } else if !normalized.is_empty() {
+            separator_pending = true;
+        }
+        previous = Some(character);
+    }
+    if normalized.is_empty() {
+        normalized.push_str(fallback);
+    }
+    if !normalized.starts_with(|character: char| character.is_ascii_lowercase()) {
+        normalized.insert_str(0, &format!("{fallback}_"));
+    }
+    normalized
+}
+
+impl PayloadBudget {
+    fn new(limits: PayloadLimits) -> Self {
+        Self {
+            limits,
+            consumed: 0,
+        }
+    }
+
+    fn charge(
+        &mut self,
+        bytes: usize,
+        item_limit: usize,
+        item_code: &'static str,
+        item_message: &'static str,
+    ) -> Result<(), CatalogError> {
+        if bytes > item_limit {
+            return Err(validation(item_code, item_message));
+        }
+        self.charge_aggregate(bytes)
+    }
+
+    fn charge_aggregate(&mut self, bytes: usize) -> Result<(), CatalogError> {
+        self.consumed = self.consumed.checked_add(bytes).ok_or_else(|| {
+            validation(
+                "catalog_payload_too_large",
+                "The staged catalog payload exceeds the aggregate serialized-size limit.",
+            )
+        })?;
+        if self.consumed > self.limits.aggregate {
+            return Err(validation(
+                "catalog_payload_too_large",
+                "The staged catalog payload exceeds the aggregate serialized-size limit.",
+            ));
+        }
+        Ok(())
+    }
+}
+
+impl NameAllocator {
+    fn new(used: HashSet<String>) -> Self {
+        Self {
+            used,
+            next_suffix: HashMap::new(),
+            candidate_probes: 0,
+        }
+    }
+
+    fn allocate(&mut self, base: &str, maximum_length: usize, separator: char) -> String {
+        let base = &base[..base.len().min(maximum_length)];
+        if self.used.insert(base.to_owned()) {
+            return base.to_owned();
+        }
+
+        let mut range_start = 2_u64;
+        loop {
+            let suffix_digits = range_start.ilog10() + 1;
+            let range_end = 10_u64
+                .checked_pow(suffix_digits)
+                .map_or(u64::MAX, |next_power| next_power - 1);
+            let prefix_length = maximum_length
+                .saturating_sub(1 + suffix_digits as usize)
+                .min(base.len());
+            let namespace = CollisionNamespace {
+                prefix: base[..prefix_length].to_owned(),
+                separator,
+                suffix_digits,
+            };
+            let next_suffix = self.next_suffix.entry(namespace).or_insert(range_start);
+            while *next_suffix <= range_end {
+                let index = *next_suffix;
+                *next_suffix = index.saturating_add(1);
+                let suffix = format!("{separator}{index}");
+                let candidate = format!("{}{suffix}", &base[..prefix_length]);
+                self.candidate_probes = self.candidate_probes.saturating_add(1);
+                if self.used.insert(candidate.clone()) {
+                    return candidate;
+                }
+            }
+            range_start = range_end
+                .checked_add(1)
+                .expect("the integer suffix space is unbounded for catalog-sized allocations");
+        }
+    }
+
+    #[cfg(test)]
+    fn candidate_probes(&self) -> usize {
+        self.candidate_probes
+    }
+}
+
+fn validate_artifact_count(count: usize, maximum: usize) -> Result<(), CatalogError> {
+    if count > maximum {
+        Err(validation(
+            "catalog_too_many_artifacts",
+            format!("A catalog refresh may contain at most {maximum} artifacts."),
+        ))
+    } else {
+        Ok(())
+    }
+}
+
+fn validate_tool_history(
+    existing: &HashMap<String, (String, bool)>,
+    staged_keys: &HashSet<String>,
+) -> Result<(), CatalogError> {
+    let new_unique_count = staged_keys
+        .iter()
+        .filter(|stable_key| !existing.contains_key(*stable_key))
+        .count();
+    let projected_history = existing
+        .len()
+        .checked_add(new_unique_count)
+        .ok_or_else(|| {
+            validation(
+                "catalog_too_large",
+                "The source tool history exceeds the supported ceiling.",
+            )
+        })?;
+    let projected_tombstones = existing
+        .keys()
+        .filter(|stable_key| !staged_keys.contains(*stable_key))
+        .count();
+    if projected_history > MAX_TOOL_HISTORY_PER_SOURCE
+        || projected_tombstones > MAX_TOMBSTONED_TOOLS_PER_SOURCE
+    {
+        return Err(validation(
+            "catalog_too_large",
+            format!(
+                "A source may retain at most {MAX_ACTIVE_TOOLS_PER_SOURCE} active tools and \
+                 {MAX_TOMBSTONED_TOOLS_PER_SOURCE} tombstoned tools. Delete and recreate the \
+                 source to intentionally discard retained tool history."
+            ),
+        ));
+    }
+    Ok(())
+}
+
+fn validate_text(
+    code: &'static str,
+    message: &'static str,
+    value: &str,
+    maximum_length: usize,
+) -> Result<String, CatalogError> {
+    let value = value.trim();
+    if value.is_empty() || value.chars().count() > maximum_length || value.contains('\0') {
+        return Err(validation(code, message));
+    }
+    Ok(value.to_owned())
+}
+
+fn validate_stable_text(
+    code: &'static str,
+    message: &'static str,
+    value: &str,
+    maximum_length: usize,
+) -> Result<String, CatalogError> {
+    if value.trim().is_empty() || value.chars().count() > maximum_length || value.contains('\0') {
+        return Err(validation(code, message));
+    }
+    Ok(value.to_owned())
+}
+
+fn validate_optional_text(
+    code: &'static str,
+    message: &'static str,
+    value: Option<&str>,
+    maximum_length: usize,
+) -> Result<Option<String>, CatalogError> {
+    value
+        .map(|value| {
+            if value.chars().count() > maximum_length || value.contains('\0') {
+                Err(validation(code, message))
+            } else {
+                Ok(value.to_owned())
+            }
+        })
+        .transpose()
+}
+
+fn validate_source_health_error_code(error_code: &str) -> Result<(), CatalogError> {
+    let characters = error_code.as_bytes();
+    let valid = error_code.len() <= MAX_SOURCE_HEALTH_ERROR_CODE_BYTES
+        && characters
+            .first()
+            .is_some_and(|character| character.is_ascii_lowercase())
+        && characters
+            .last()
+            .is_some_and(|character| character.is_ascii_lowercase() || character.is_ascii_digit())
+        && characters.iter().all(|character| {
+            character.is_ascii_lowercase() || character.is_ascii_digit() || *character == b'_'
+        })
+        && characters.windows(2).all(|pair| pair != b"__");
+    if valid {
+        Ok(())
+    } else {
+        Err(validation(
+            "invalid_source_health_error_code",
+            format!(
+                "Source health error codes must contain at most \
+                 {MAX_SOURCE_HEALTH_ERROR_CODE_BYTES} ASCII bytes and use lower_snake_case."
+            ),
+        ))
+    }
+}
+
+fn validation(code: &'static str, message: impl Into<String>) -> CatalogError {
+    CatalogError::Validation {
+        code,
+        message: message.into(),
+    }
+}
+
+fn normalize_filter_query(query: &str) -> Vec<String> {
+    query
+        .to_lowercase()
+        .split_whitespace()
+        .map(str::to_owned)
+        .collect()
+}
+
+fn validate_search_input(label: &str, value: &str) -> Result<(), CatalogError> {
+    if value.len() > MAX_SEARCH_QUERY_BYTES || value.chars().count() > MAX_SEARCH_QUERY_CHARACTERS {
+        return Err(validation(
+            "invalid_search_query",
+            format!(
+                "The search {label} may contain at most {MAX_SEARCH_QUERY_CHARACTERS} characters \
+                 and {MAX_SEARCH_QUERY_BYTES} bytes."
+            ),
+        ));
+    }
+    let tokens = search::query_tokens(value);
+    if tokens.len() > MAX_SEARCH_QUERY_TOKENS
+        || tokens
+            .iter()
+            .any(|token| token.len() > MAX_SEARCH_TOKEN_BYTES)
+    {
+        return Err(validation(
+            "invalid_search_query",
+            format!(
+                "The search {label} may contain at most {MAX_SEARCH_QUERY_TOKENS} tokens, with \
+                 at most {MAX_SEARCH_TOKEN_BYTES} bytes per token."
+            ),
+        ));
+    }
+    Ok(())
+}
+
+fn page_limit(limit: u32) -> usize {
+    let limit = if limit == 0 {
+        DEFAULT_PAGE_LIMIT
+    } else {
+        limit
+    };
+    usize::try_from(limit.min(MAX_PAGE_LIMIT)).unwrap_or(MAX_PAGE_LIMIT as usize)
+}
+
+fn parse_tool_path(path: &str) -> Option<(&str, &str)> {
+    let sandbox_path = path.strip_prefix("tools.").unwrap_or(path);
+    let mut segments = sandbox_path.split('.');
+    let source = segments.next()?;
+    let tool = segments.next()?;
+    (!source.is_empty() && !tool.is_empty() && segments.next().is_none()).then_some((source, tool))
+}
+
+fn normalize_sandbox_path(path: &str) -> String {
+    path.strip_prefix("tools.").unwrap_or(path).to_owned()
+}
+
+async fn validate_catalog_apply_basis(
+    transaction: &mut Transaction<'_, sqlx::Sqlite>,
+    source_id: &str,
+    expected_source_revision: i64,
+    expected_credential_revision: Option<i64>,
+    prepared: &PreparedSnapshot,
+    prepared_bindings: &[PreparedToolBinding],
+) -> Result<SourceKind, CatalogError> {
+    let (actual_source_revision, source_kind) =
+        sqlx::query_as::<_, (i64, String)>("SELECT revision, kind FROM sources WHERE id = ?")
+            .bind(source_id)
+            .fetch_optional(&mut **transaction)
+            .await?
+            .ok_or(CatalogError::NotFound { entity: "source" })?;
+    if actual_source_revision != expected_source_revision {
+        return Err(CatalogError::RevisionConflict {
+            scope: "source",
+            expected: expected_source_revision,
+            actual: actual_source_revision,
+        });
+    }
+    let source_kind = SourceKind::from_str(&source_kind)?;
+    let binding_keys = prepared_bindings
+        .iter()
+        .map(|binding| &binding.stable_key)
+        .collect::<HashSet<_>>();
+    let staged_tool_keys = prepared
+        .tools
+        .iter()
+        .map(|tool| &tool.stable_key)
+        .collect::<HashSet<_>>();
+    if binding_keys != staged_tool_keys {
+        return Err(validation(
+            "incomplete_tool_bindings",
+            "Every active imported tool must have exactly one binding.",
+        ));
+    }
+    if prepared_bindings
+        .iter()
+        .any(|binding| binding.protocol != source_kind.as_str())
+    {
+        return Err(validation(
+            "invalid_source_kind",
+            "Every staged tool binding must match its source protocol.",
+        ));
+    }
+    let actual_credential_revision =
+        sqlx::query_scalar::<_, i64>("SELECT revision FROM source_credentials WHERE source_id = ?")
+            .bind(source_id)
+            .fetch_optional(&mut **transaction)
+            .await?;
+    if actual_credential_revision != expected_credential_revision {
+        return Err(CatalogError::RevisionConflict {
+            scope: "credential",
+            expected: expected_credential_revision.unwrap_or(-1),
+            actual: actual_credential_revision.unwrap_or(-1),
+        });
+    }
+    Ok(source_kind)
+}
+
+async fn validate_oauth_binding_expectation(
+    transaction: &mut Transaction<'_, sqlx::Sqlite>,
+    source_id: &str,
+    expected: &OAuthBindingExpectation,
+) -> Result<(), CatalogError> {
+    let credential_key = match expected {
+        OAuthBindingExpectation::Absent { credential_key }
+        | OAuthBindingExpectation::Exact { credential_key, .. } => credential_key,
+    };
+    let actual = sqlx::query_as::<_, (String, i64, String)>(
+        "SELECT id, current_config_revision, status
+         FROM oauth_connections
+         WHERE source_id = ? AND credential_key = ?",
+    )
+    .bind(source_id)
+    .bind(credential_key)
+    .fetch_optional(&mut **transaction)
+    .await?;
+    let matches = match (expected, actual) {
+        (OAuthBindingExpectation::Absent { .. }, None) => true,
+        (
+            OAuthBindingExpectation::Exact {
+                connection_id,
+                config_revision,
+                ..
+            },
+            Some((actual_connection_id, actual_config_revision, status)),
+        ) => {
+            actual_connection_id == *connection_id
+                && actual_config_revision == *config_revision
+                && status == "active"
+        }
+        (OAuthBindingExpectation::Absent { .. }, Some(_))
+        | (OAuthBindingExpectation::Exact { .. }, None) => false,
+    };
+    if matches {
+        Ok(())
+    } else {
+        Err(validation(
+            "oauth_binding_changed",
+            "The managed OAuth binding changed while the source catalog was being prepared.",
+        ))
+    }
+}
+
+async fn apply_prepared_catalog_refresh(
+    transaction: &mut Transaction<'_, sqlx::Sqlite>,
+    source_id: &str,
+    prepared: &PreparedSnapshot,
+    prepared_bindings: &[PreparedToolBinding],
+    audit: AuditContext<'_>,
+    now: i64,
+) -> Result<CatalogSyncResult, CatalogError> {
+    apply_artifacts(transaction, source_id, &prepared.artifacts, now).await?;
+    let missing = apply_tools(transaction, source_id, &prepared.tools, now).await?;
+    apply_tool_bindings(transaction, source_id, prepared_bindings, now).await?;
+    rebuild_search_indexes(transaction, source_id).await?;
+    let source_path = source_path_snapshot(transaction, source_id).await?;
+    let (source_revision, catalog_revision, global_revision) = finalize_catalog_apply(
+        transaction,
+        audit,
+        source_id,
+        &source_path,
+        CatalogApplyKind::Refresh,
+        prepared.tools.len(),
+        prepared.artifacts.len(),
+        missing.len(),
+        now,
+    )
+    .await?;
+    Ok(CatalogSyncResult {
+        source_id: source_id.to_owned(),
+        source_revision,
+        catalog_revision,
+        global_revision,
+        active_tool_count: prepared.tools.len(),
+        tombstoned_tool_count: missing.len(),
+    })
+}
+
+#[allow(clippy::too_many_arguments)]
+async fn finalize_catalog_apply(
+    transaction: &mut Transaction<'_, sqlx::Sqlite>,
+    audit: AuditContext<'_>,
+    source_id: &str,
+    source_path: &str,
+    kind: CatalogApplyKind<'_>,
+    active_tool_count: usize,
+    artifact_count: usize,
+    tombstoned_tool_count: usize,
+    now: i64,
+) -> Result<(i64, i64, i64), CatalogError> {
+    let revisions = match kind {
+        CatalogApplyKind::Initial { .. } => {
+            sqlx::query_as::<_, (i64, i64)>(
+                "SELECT revision, catalog_revision FROM sources WHERE id = ?",
+            )
+            .bind(source_id)
+            .fetch_one(&mut **transaction)
+            .await?
+        }
+        CatalogApplyKind::Refresh => {
+            sqlx::query_as::<_, (i64, i64)>(
+                "UPDATE sources SET revision = revision + 1, \
+             catalog_revision = catalog_revision + 1, health_status = 'healthy', \
+             health_error_code = NULL, updated_at = ?, last_refreshed_at = ? \
+             WHERE id = ? RETURNING revision, catalog_revision",
+            )
+            .bind(now)
+            .bind(now)
+            .bind(source_id)
+            .fetch_one(&mut **transaction)
+            .await?
+        }
+    };
+    let global_revision = bump_global_revision(transaction, now).await?;
+    if let CatalogApplyKind::Initial {
+        source_kind,
+        slug,
+        credential_schema_version,
+    } = kind
+    {
+        insert_audit(
+            transaction,
+            audit,
+            "source.created",
+            Some(source_id),
+            None,
+            Some(source_path),
+            source_created_audit_metadata(audit, source_kind, slug),
+            now,
+        )
+        .await?;
+        insert_audit(
+            transaction,
+            audit,
+            "source.credential_changed",
+            Some(source_id),
+            None,
+            Some(source_path),
+            json!({ "schemaVersion": credential_schema_version }),
+            now,
+        )
+        .await?;
+    }
+    insert_audit(
+        transaction,
+        audit,
+        "source.catalog_refreshed",
+        Some(source_id),
+        None,
+        Some(source_path),
+        json!({
+            "catalogRevision": revisions.1,
+            "activeToolCount": active_tool_count,
+            "artifactCount": artifact_count,
+            "tombstonedToolCount": tombstoned_tool_count,
+            "globalRevision": global_revision
+        }),
+        now,
+    )
+    .await?;
+    Ok((revisions.0, revisions.1, global_revision))
+}
+
+fn source_created_audit_metadata(
+    audit: AuditContext<'_>,
+    source_kind: SourceKind,
+    slug: &str,
+) -> Value {
+    let mut metadata = json!({ "kind": source_kind, "slug": slug });
+    if let Some(idempotency_record_id) = audit.source_creation_idempotency_id() {
+        metadata
+            .as_object_mut()
+            .expect("source audit metadata is an object")
+            .insert(
+                "idempotencyRecordId".to_owned(),
+                Value::String(idempotency_record_id.to_owned()),
+            );
+    }
+    metadata
+}
+
+async fn apply_artifacts(
+    transaction: &mut Transaction<'_, sqlx::Sqlite>,
+    source_id: &str,
+    artifacts: &[PreparedArtifact],
+    now: i64,
+) -> Result<(), CatalogError> {
+    let staged_keys = artifacts
+        .iter()
+        .map(|artifact| {
+            (
+                artifact.kind.as_str().to_owned(),
+                artifact.stable_key.clone(),
+            )
+        })
+        .collect::<HashSet<_>>();
+    let existing_keys = sqlx::query_as::<_, (String, String)>(
+        "SELECT artifact_kind, stable_key FROM source_artifacts WHERE source_id = ?",
+    )
+    .bind(source_id)
+    .fetch_all(&mut **transaction)
+    .await?;
+    for artifact in artifacts {
+        sqlx::query(
+            "INSERT INTO source_artifacts \
+             (id, source_id, artifact_kind, stable_key, content_json, revision, created_at, updated_at) \
+             VALUES (?, ?, ?, ?, ?, 0, ?, ?) \
+             ON CONFLICT(source_id, artifact_kind, stable_key) DO UPDATE SET \
+             content_json = excluded.content_json, revision = source_artifacts.revision + 1, \
+             updated_at = excluded.updated_at",
+        )
+        .bind(Uuid::new_v4().to_string())
+        .bind(source_id)
+        .bind(artifact.kind.as_str())
+        .bind(&artifact.stable_key)
+        .bind(&artifact.content_json)
+        .bind(now)
+        .bind(now)
+        .execute(&mut **transaction)
+        .await?;
+    }
+    for (kind, stable_key) in existing_keys {
+        if !staged_keys.contains(&(kind.clone(), stable_key.clone())) {
+            sqlx::query(
+                "DELETE FROM source_artifacts \
+                 WHERE source_id = ? AND artifact_kind = ? AND stable_key = ?",
+            )
+            .bind(source_id)
+            .bind(kind)
+            .bind(stable_key)
+            .execute(&mut **transaction)
+            .await?;
+        }
+    }
+    Ok(())
+}
+
+async fn apply_tools(
+    transaction: &mut Transaction<'_, sqlx::Sqlite>,
+    source_id: &str,
+    tools: &[PreparedTool],
+    now: i64,
+) -> Result<Vec<String>, CatalogError> {
+    let existing = sqlx::query_as::<_, (String, String, i64)>(
+        "SELECT stable_key, local_name, present FROM tools WHERE source_id = ?",
+    )
+    .bind(source_id)
+    .fetch_all(&mut **transaction)
+    .await?;
+    let existing_by_key = existing
+        .into_iter()
+        .map(|(stable_key, local_name, present)| (stable_key, (local_name, present != 0)))
+        .collect::<HashMap<_, _>>();
+    let staged_keys = tools
+        .iter()
+        .map(|tool| tool.stable_key.clone())
+        .collect::<HashSet<_>>();
+    validate_tool_history(&existing_by_key, &staged_keys)?;
+    let mut used_names = existing_by_key
+        .values()
+        .map(|(local_name, _)| local_name.clone())
+        .collect::<HashSet<_>>();
+    used_names.extend(RESERVED_TOOL_NAMES.into_iter().map(str::to_owned));
+    let mut name_allocator = NameAllocator::new(used_names);
+    for tool in tools {
+        let local_name = existing_by_key
+            .get(&tool.stable_key)
+            .map(|(local_name, _)| local_name.clone())
+            .unwrap_or_else(|| {
+                let base = normalize_tool_name(&tool.preferred_name);
+                name_allocator.allocate(&base, 128, '_')
+            });
+        sqlx::query(
+            "INSERT INTO tools \
+             (id, source_id, stable_key, local_name, display_name, description, search_description, \
+              search_short_grams, input_schema_json, output_schema_json, input_typescript, \
+              output_typescript, typescript_definitions_json, intrinsic_mode, present, revision, \
+              created_at, updated_at, last_seen_at, tombstoned_at) \
+             VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, 0, ?, ?, ?, NULL) \
+             ON CONFLICT(source_id, stable_key) DO UPDATE SET \
+              display_name = excluded.display_name, description = excluded.description, \
+              search_description = excluded.search_description, \
+              search_short_grams = excluded.search_short_grams, \
+              input_schema_json = excluded.input_schema_json, \
+              output_schema_json = excluded.output_schema_json, \
+              input_typescript = excluded.input_typescript, \
+              output_typescript = excluded.output_typescript, \
+              typescript_definitions_json = excluded.typescript_definitions_json, \
+              intrinsic_mode = excluded.intrinsic_mode, present = 1, \
+              revision = tools.revision + 1, updated_at = excluded.updated_at, \
+              last_seen_at = excluded.last_seen_at, tombstoned_at = NULL",
+        )
+        .bind(Uuid::new_v4().to_string())
+        .bind(source_id)
+        .bind(&tool.stable_key)
+        .bind(local_name)
+        .bind(&tool.display_name)
+        .bind(&tool.description)
+        .bind(&tool.search_description)
+        .bind(&tool.search_short_grams)
+        .bind(&tool.input_schema_json)
+        .bind(&tool.output_schema_json)
+        .bind(&tool.input_typescript)
+        .bind(&tool.output_typescript)
+        .bind(&tool.typescript_definitions_json)
+        .bind(tool.intrinsic_mode.as_str())
+        .bind(now)
+        .bind(now)
+        .bind(now)
+        .execute(&mut **transaction)
+        .await?;
+    }
+    let missing = existing_by_key
+        .iter()
+        .filter(|(stable_key, (_, present))| *present && !staged_keys.contains(*stable_key))
+        .map(|(stable_key, _)| stable_key.clone())
+        .collect::<Vec<_>>();
+    for stable_key in &missing {
+        sqlx::query(
+            "UPDATE tools SET present = 0, revision = revision + 1, updated_at = ?, \
+             tombstoned_at = ? WHERE source_id = ? AND stable_key = ? AND present = 1",
+        )
+        .bind(now)
+        .bind(now)
+        .bind(source_id)
+        .bind(stable_key)
+        .execute(&mut **transaction)
+        .await?;
+    }
+    Ok(missing)
+}
+
+async fn apply_tool_bindings(
+    transaction: &mut Transaction<'_, sqlx::Sqlite>,
+    source_id: &str,
+    bindings: &[PreparedToolBinding],
+    now: i64,
+) -> Result<(), CatalogError> {
+    for binding in bindings {
+        let changed = sqlx::query(
+            "INSERT INTO tool_bindings \
+             (tool_id, protocol, binding_version, definition_json, revision, created_at, updated_at) \
+             SELECT id, ?, ?, ?, 0, ?, ? FROM tools \
+             WHERE source_id = ? AND stable_key = ? AND present = 1 \
+             ON CONFLICT(tool_id) DO UPDATE SET protocol = excluded.protocol, \
+             binding_version = excluded.binding_version, \
+             definition_json = excluded.definition_json, revision = tool_bindings.revision + 1, \
+             updated_at = excluded.updated_at",
+        )
+        .bind(binding.protocol)
+        .bind(binding.version)
+        .bind(&binding.definition_json)
+        .bind(now)
+        .bind(now)
+        .bind(source_id)
+        .bind(&binding.stable_key)
+        .execute(&mut **transaction)
+        .await?
+        .rows_affected();
+        if changed != 1 {
+            return Err(validation(
+                "invalid_tool_binding",
+                "A tool binding does not match an active imported tool.",
+            ));
+        }
+    }
+    sqlx::query(
+        "DELETE FROM tool_bindings WHERE tool_id IN (\
+         SELECT id FROM tools WHERE source_id = ? AND present = 0)",
+    )
+    .bind(source_id)
+    .execute(&mut **transaction)
+    .await?;
+    Ok(())
+}
+
+async fn rebuild_search_indexes(
+    transaction: &mut Transaction<'_, sqlx::Sqlite>,
+    source_id: &str,
+) -> Result<(), CatalogError> {
+    for table in ["tool_search", "tool_search_trigram", "tool_search_short"] {
+        let statement = format!("DELETE FROM {table} WHERE source_id = ?");
+        sqlx::query(&statement)
+            .bind(source_id)
+            .execute(&mut **transaction)
+            .await?;
+    }
+    for table in ["tool_search", "tool_search_trigram"] {
+        let statement = format!(
+            "INSERT INTO {table} \
+             (source_id, tool_id, source_slug, local_name, description, sandbox_path) \
+             SELECT tools.source_id, tools.id, replace(sources.slug, '_', ' '), \
+                    replace(tools.local_name, '_', ' '), tools.search_description, \
+                    replace(sources.slug, '_', ' ') || ' ' || replace(tools.local_name, '_', ' ') \
+             FROM tools JOIN sources ON sources.id = tools.source_id \
+             WHERE tools.source_id = ? AND tools.present = 1"
+        );
+        sqlx::query(&statement)
+            .bind(source_id)
+            .execute(&mut **transaction)
+            .await?;
+    }
+    sqlx::query(
+        "INSERT INTO tool_search_short (source_id, tool_id, grams) \
+         SELECT tools.source_id, tools.id, \
+                sources.search_short_grams || ' ' || tools.search_short_grams \
+         FROM tools JOIN sources ON sources.id = tools.source_id \
+         WHERE tools.source_id = ? AND tools.present = 1",
+    )
+    .bind(source_id)
+    .execute(&mut **transaction)
+    .await?;
+    Ok(())
+}
+
+async fn ensure_source_exists(
+    transaction: &mut Transaction<'_, sqlx::Sqlite>,
+    source_id: &str,
+) -> Result<(), CatalogError> {
+    let exists = sqlx::query_scalar::<_, i64>("SELECT EXISTS(SELECT 1 FROM sources WHERE id = ?)")
+        .bind(source_id)
+        .fetch_one(&mut **transaction)
+        .await?
+        != 0;
+    if exists {
+        Ok(())
+    } else {
+        Err(CatalogError::NotFound { entity: "source" })
+    }
+}
+
+async fn ensure_source_revision(
+    transaction: &mut Transaction<'_, sqlx::Sqlite>,
+    source_id: &str,
+    expected_revision: i64,
+) -> Result<(), CatalogError> {
+    let actual_revision = sqlx::query_scalar::<_, i64>("SELECT revision FROM sources WHERE id = ?")
+        .bind(source_id)
+        .fetch_optional(&mut **transaction)
+        .await?
+        .ok_or(CatalogError::NotFound { entity: "source" })?;
+    if actual_revision == expected_revision {
+        Ok(())
+    } else {
+        Err(CatalogError::RevisionConflict {
+            scope: "source",
+            expected: expected_revision,
+            actual: actual_revision,
+        })
+    }
+}
+
+async fn replace_credential_in_transaction(
+    transaction: &mut Transaction<'_, sqlx::Sqlite>,
+    source_id: &str,
+    schema_version: u32,
+    ciphertext: Vec<u8>,
+    expected_revision: i64,
+    now: i64,
+) -> Result<i64, CatalogError> {
+    let revision = sqlx::query_scalar::<_, i64>(
+        "UPDATE source_credentials SET schema_version = ?, payload_ciphertext = ?, \
+         revision = revision + 1, updated_at = ? WHERE source_id = ? AND revision = ? \
+         RETURNING revision",
+    )
+    .bind(i64::from(schema_version))
+    .bind(ciphertext)
+    .bind(now)
+    .bind(source_id)
+    .bind(expected_revision)
+    .fetch_optional(&mut **transaction)
+    .await?;
+    if let Some(revision) = revision {
+        return Ok(revision);
+    }
+    let actual =
+        sqlx::query_scalar::<_, i64>("SELECT revision FROM source_credentials WHERE source_id = ?")
+            .bind(source_id)
+            .fetch_optional(&mut **transaction)
+            .await?
+            .unwrap_or(-1);
+    Err(CatalogError::RevisionConflict {
+        scope: "credential",
+        expected: expected_revision,
+        actual,
+    })
+}
+
+async fn delete_credential_in_transaction(
+    transaction: &mut Transaction<'_, sqlx::Sqlite>,
+    source_id: &str,
+    expected_revision: i64,
+) -> Result<(), CatalogError> {
+    let changed =
+        sqlx::query("DELETE FROM source_credentials WHERE source_id = ? AND revision = ?")
+            .bind(source_id)
+            .bind(expected_revision)
+            .execute(&mut **transaction)
+            .await?
+            .rows_affected();
+    if changed == 1 {
+        return Ok(());
+    }
+    let actual =
+        sqlx::query_scalar::<_, i64>("SELECT revision FROM source_credentials WHERE source_id = ?")
+            .bind(source_id)
+            .fetch_optional(&mut **transaction)
+            .await?
+            .unwrap_or(-1);
+    Err(CatalogError::RevisionConflict {
+        scope: "credential",
+        expected: expected_revision,
+        actual,
+    })
+}
+
+async fn source_path_snapshot(
+    transaction: &mut Transaction<'_, sqlx::Sqlite>,
+    source_id: &str,
+) -> Result<String, CatalogError> {
+    let slug = sqlx::query_scalar::<_, String>("SELECT slug FROM sources WHERE id = ?")
+        .bind(source_id)
+        .fetch_one(&mut **transaction)
+        .await?;
+    Ok(format!("tools.{slug}"))
+}
+
+async fn revision_or_not_found(
+    transaction: &mut Transaction<'_, sqlx::Sqlite>,
+    _table: &'static str,
+    id: &str,
+    scope: &'static str,
+    expected: i64,
+) -> Result<CatalogError, CatalogError> {
+    let actual = sqlx::query_scalar::<_, i64>("SELECT revision FROM sources WHERE id = ?")
+        .bind(id)
+        .fetch_optional(&mut **transaction)
+        .await?;
+    Ok(match actual {
+        Some(actual) => CatalogError::RevisionConflict {
+            scope,
+            expected,
+            actual,
+        },
+        None => CatalogError::NotFound { entity: scope },
+    })
+}
+
+async fn increment_source_revision(
+    transaction: &mut Transaction<'_, sqlx::Sqlite>,
+    source_id: &str,
+    now: i64,
+) -> Result<i64, CatalogError> {
+    Ok(sqlx::query_scalar(
+        "UPDATE sources SET revision = revision + 1, updated_at = ? \
+         WHERE id = ? RETURNING revision",
+    )
+    .bind(now)
+    .bind(source_id)
+    .fetch_one(&mut **transaction)
+    .await?)
+}
+
+async fn increment_source_and_global(
+    transaction: &mut Transaction<'_, sqlx::Sqlite>,
+    source_id: &str,
+    now: i64,
+) -> Result<(i64, i64), CatalogError> {
+    let source_revision = increment_source_revision(transaction, source_id, now).await?;
+    let global_revision = bump_global_revision(transaction, now).await?;
+    Ok((source_revision, global_revision))
+}
+
+async fn bump_global_revision(
+    transaction: &mut Transaction<'_, sqlx::Sqlite>,
+    now: i64,
+) -> Result<i64, CatalogError> {
+    Ok(sqlx::query_scalar(
+        "UPDATE catalog_state SET revision = revision + 1, updated_at = ? \
+         WHERE id = 1 RETURNING revision",
+    )
+    .bind(now)
+    .fetch_one(&mut **transaction)
+    .await?)
+}
+
+#[allow(clippy::too_many_arguments)]
+async fn insert_audit(
+    transaction: &mut Transaction<'_, sqlx::Sqlite>,
+    audit: AuditContext<'_>,
+    action: &str,
+    source_id: Option<&str>,
+    tool_id: Option<&str>,
+    target_path_snapshot: Option<&str>,
+    metadata: Value,
+    created_at: i64,
+) -> Result<(), CatalogError> {
+    insert_audit_with_limit(
+        transaction,
+        audit,
+        action,
+        source_id,
+        tool_id,
+        target_path_snapshot,
+        metadata,
+        created_at,
+        MAX_AUDIT_EVENT_ROWS,
+    )
+    .await
+}
+
+#[allow(clippy::too_many_arguments)]
+async fn insert_audit_with_limit(
+    transaction: &mut Transaction<'_, sqlx::Sqlite>,
+    audit: AuditContext<'_>,
+    action: &str,
+    source_id: Option<&str>,
+    tool_id: Option<&str>,
+    target_path_snapshot: Option<&str>,
+    metadata: Value,
+    created_at: i64,
+    maximum_rows: i64,
+) -> Result<(), CatalogError> {
+    let metadata_json = serde_json::to_string(&metadata)?;
+    if metadata_json.len() > MAX_AUDIT_METADATA_BYTES {
+        return Err(validation(
+            "audit_metadata_too_large",
+            format!(
+                "Audit metadata may contain at most {MAX_AUDIT_METADATA_BYTES} serialized bytes."
+            ),
+        ));
+    }
+    sqlx::query(
+        "INSERT INTO audit_events \
+         (id, request_id, actor_admin_id, action, source_id, tool_id, \
+          target_path_snapshot, metadata_json, created_at) \
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",
+    )
+    .bind(Uuid::new_v4().to_string())
+    .bind(audit.request_id())
+    .bind(audit.actor_admin_id())
+    .bind(action)
+    .bind(source_id)
+    .bind(tool_id)
+    .bind(target_path_snapshot)
+    .bind(metadata_json)
+    .bind(created_at)
+    .execute(&mut **transaction)
+    .await?;
+    sqlx::query(
+        "DELETE FROM audit_events WHERE rowid IN ( \
+         SELECT rowid FROM audit_events \
+         ORDER BY rowid DESC LIMIT -1 OFFSET ?)",
+    )
+    .bind(maximum_rows)
+    .execute(&mut **transaction)
+    .await?;
+    Ok(())
+}
+
+fn validate_log_text(label: &str, value: &str, maximum_length: usize) -> Result<(), CatalogError> {
+    if value.is_empty() || value.len() > maximum_length || value.contains('\0') {
+        Err(validation(
+            "invalid_request_log",
+            format!("The request log {label} is invalid."),
+        ))
+    } else {
+        Ok(())
+    }
+}
+
+fn validate_optional_log_text(
+    label: &str,
+    value: Option<&str>,
+    maximum_length: usize,
+) -> Result<(), CatalogError> {
+    if let Some(value) = value {
+        validate_log_text(label, value, maximum_length)?;
+    }
+    Ok(())
+}
+
+fn encode_cursor(created_at: i64, request_id: &str) -> String {
+    URL_SAFE_NO_PAD.encode(format!("{created_at}\n{request_id}"))
+}
+
+fn decode_cursor(cursor: &str) -> Result<(i64, String), CatalogError> {
+    let decoded = URL_SAFE_NO_PAD
+        .decode(cursor)
+        .map_err(|_| validation("invalid_cursor", "The request-log cursor is malformed."))?;
+    let decoded = String::from_utf8(decoded)
+        .map_err(|_| validation("invalid_cursor", "The request-log cursor is malformed."))?;
+    let (created_at, request_id) = decoded
+        .split_once('\n')
+        .ok_or_else(|| validation("invalid_cursor", "The request-log cursor is malformed."))?;
+    let created_at = created_at
+        .parse::<i64>()
+        .map_err(|_| validation("invalid_cursor", "The request-log cursor is malformed."))?;
+    validate_log_text("cursor request ID", request_id, 128)?;
+    Ok((created_at, request_id.to_owned()))
+}
+
+#[cfg(test)]
+mod tests {
+    use std::collections::{BTreeMap, HashSet};
+
+    use serde_json::json;
+
+    use sqlx::sqlite::SqlitePoolOptions;
+
+    use super::{
+        CatalogSnapshot, NameAllocator, PayloadLimits, insert_audit_with_limit,
+        prepare_snapshot_and_bindings_with_limits, prepare_snapshot_with_limits,
+    };
+    use crate::catalog::{
+        ArtifactKind, AuditContext, CatalogError, StagedArtifact, StagedTool, StagedToolBinding,
+        ToolBinding, ToolMode,
+    };
+    use crate::graphql::{GraphqlBindingV1, GraphqlOperation};
+    use crate::openapi::OpenApiBinding;
+
+    fn empty_snapshot() -> CatalogSnapshot {
+        CatalogSnapshot {
+            expected_source_revision: 0,
+            expected_credential_revision: None,
+            artifacts: Vec::new(),
+            tools: Vec::new(),
+        }
+    }
+
+    fn small_limits() -> PayloadLimits {
+        PayloadLimits {
+            artifact_count: 2,
+            artifact: 128,
+            artifact_key: 128,
+            schema: 128,
+            typescript_definitions: 128,
+            typescript_preview: 128,
+            tool_stable_key: 128,
+            tool_name: 128,
+            tool_description: 128,
+            search_description: 128,
+            short_gram_document: 1024,
+            local_name: 16,
+            aggregate: 256,
+        }
+    }
+
+    #[test]
+    fn graphql_binding_identity_must_match_the_staged_stable_key() {
+        let mut binding = GraphqlBindingV1 {
+            version: 1,
+            operation: GraphqlOperation::Query,
+            field_name: "viewer".to_owned(),
+            operation_name: "ExecutorOperation".to_owned(),
+            variables: Vec::new(),
+            selection: Vec::new(),
+            document: String::new(),
+        };
+        binding.document = binding
+            .canonical_document()
+            .expect("test binding is canonical");
+        let error = match super::prepare_tool_bindings(vec![StagedToolBinding {
+            stable_key: "graphql:v1:mutation:viewer".to_owned(),
+            binding: ToolBinding::GraphqlV1(binding),
+        }]) {
+            Ok(_) => {
+                panic!("coherently rewritten GraphQL bindings must fail stable-key validation")
+            }
+            Err(error) => error,
+        };
+        assert!(matches!(
+            error,
+            CatalogError::Validation {
+                code: "invalid_tool_binding",
+                ..
+            }
+        ));
+    }
+
+    fn staged_tool() -> StagedTool {
+        StagedTool {
+            stable_key: "tool".to_owned(),
+            preferred_name: "Tool".to_owned(),
+            display_name: "Tool".to_owned(),
+            description: None,
+            input_schema: json!({ "type": "object" }),
+            output_schema: None,
+            input_typescript: None,
+            output_typescript: None,
+            typescript_definitions: BTreeMap::new(),
+            intrinsic_mode: ToolMode::Enabled,
+        }
+    }
+
+    #[test]
+    fn identical_tool_names_allocate_linearly_and_deterministically_at_the_catalog_limit() {
+        let mut allocator = NameAllocator::new(HashSet::new());
+        let mut allocated = HashSet::with_capacity(100_000);
+        for index in 1..=100_000 {
+            let name = allocator.allocate("run", 128, '_');
+            assert!(allocated.insert(name.clone()));
+            if index == 1 {
+                assert_eq!(name, "run");
+            } else if index == 100_000 {
+                assert_eq!(name, "run_100000");
+            }
+        }
+        assert_eq!(allocator.candidate_probes(), 99_999);
+    }
+
+    #[test]
+    fn collapsing_max_length_bases_share_suffix_probe_progress() {
+        const ALPHABET: &[u8] = b"abcdefghijklmnopqrstuvwxyz0123456789";
+        let common_prefix = "a".repeat(126);
+        let mut bases = Vec::with_capacity(ALPHABET.len() * ALPHABET.len());
+        for first in ALPHABET {
+            for second in ALPHABET {
+                bases.push(format!(
+                    "{common_prefix}{}{}",
+                    char::from(*first),
+                    char::from(*second)
+                ));
+            }
+        }
+        assert_eq!(bases.len(), 1_296);
+
+        let mut allocator = NameAllocator::new(HashSet::new());
+        let mut terminal = String::new();
+        for base in &bases {
+            terminal = allocator.allocate(base, 128, '_');
+            assert_eq!(terminal, *base);
+            for _ in 0..76 {
+                terminal = allocator.allocate(base, 128, '_');
+            }
+        }
+
+        let suffix_allocations = bases.len() * 76;
+        assert_eq!(allocator.candidate_probes(), suffix_allocations);
+        assert_eq!(allocator.used.len(), bases.len() + suffix_allocations);
+        assert_eq!(terminal, format!("{}_98497", &common_prefix[..122]));
+    }
+
+    #[test]
+    fn snapshot_payload_limits_reject_each_bounded_payload_class() {
+        let mut artifact_snapshot = empty_snapshot();
+        artifact_snapshot.artifacts.push(StagedArtifact {
+            kind: ArtifactKind::Metadata,
+            stable_key: "large".to_owned(),
+            content: json!({ "value": "x".repeat(256) }),
+        });
+        assert!(matches!(
+            prepare_snapshot_with_limits(artifact_snapshot, small_limits()),
+            Err(super::CatalogError::Validation {
+                code: "artifact_too_large",
+                ..
+            })
+        ));
+
+        let mut schema_snapshot = empty_snapshot();
+        let mut schema_tool = staged_tool();
+        schema_tool.input_schema = json!({ "value": "x".repeat(256) });
+        schema_snapshot.tools.push(schema_tool);
+        assert!(matches!(
+            prepare_snapshot_with_limits(schema_snapshot, small_limits()),
+            Err(super::CatalogError::Validation {
+                code: "schema_too_large",
+                ..
+            })
+        ));
+
+        let mut definitions_snapshot = empty_snapshot();
+        let mut definitions_tool = staged_tool();
+        definitions_tool
+            .typescript_definitions
+            .insert("Large".to_owned(), "x".repeat(256));
+        definitions_snapshot.tools.push(definitions_tool);
+        assert!(matches!(
+            prepare_snapshot_with_limits(definitions_snapshot, small_limits()),
+            Err(super::CatalogError::Validation {
+                code: "typescript_definitions_too_large",
+                ..
+            })
+        ));
+    }
+
+    #[test]
+    fn snapshot_payload_limits_reject_aggregate_serialized_bytes() {
+        let mut snapshot = empty_snapshot();
+        for index in 0..3 {
+            snapshot.artifacts.push(StagedArtifact {
+                kind: ArtifactKind::Metadata,
+                stable_key: format!("artifact-{index}"),
+                content: json!({ "value": "x".repeat(90) }),
+            });
+        }
+        let mut limits = small_limits();
+        limits.artifact_count = 3;
+        assert!(matches!(
+            prepare_snapshot_with_limits(snapshot, limits),
+            Err(super::CatalogError::Validation {
+                code: "catalog_payload_too_large",
+                ..
+            })
+        ));
+    }
+
+    #[test]
+    fn snapshot_and_bindings_share_one_aggregate_payload_budget() {
+        let snapshot = CatalogSnapshot {
+            expected_source_revision: 0,
+            expected_credential_revision: None,
+            artifacts: Vec::new(),
+            tools: vec![staged_tool()],
+        };
+        let bindings = vec![StagedToolBinding {
+            stable_key: "tool".to_owned(),
+            binding: ToolBinding::OpenapiV1(OpenApiBinding {
+                version: 1,
+                method: "GET".to_owned(),
+                path_template: "/tool".to_owned(),
+                server_url: format!("https://{}.example.test", "x".repeat(100)),
+                parameters: Vec::new(),
+                request_body: None,
+                security: Vec::new(),
+            }),
+        }];
+        let mut limits = small_limits();
+        limits.schema = 256;
+        limits.aggregate = 1_024;
+        let snapshot_bytes = prepare_snapshot_with_limits(snapshot.clone(), limits)
+            .expect("snapshot should fit independently")
+            .payload_bytes;
+        let binding_bytes = match &bindings[0].binding {
+            ToolBinding::OpenapiV1(binding) => serde_json::to_string(binding)
+                .expect("binding should serialize")
+                .len(),
+            ToolBinding::GraphqlV1(binding) => serde_json::to_string(binding)
+                .expect("binding should serialize")
+                .len(),
+            ToolBinding::McpHttpV1(binding) | ToolBinding::McpStdioV1(binding) => {
+                serde_json::to_string(binding)
+                    .expect("binding should serialize")
+                    .len()
+            }
+        };
+        limits.aggregate = snapshot_bytes + binding_bytes - 1;
+        assert!(prepare_snapshot_with_limits(snapshot.clone(), limits).is_ok());
+        assert!(super::prepare_tool_bindings_with_limits(bindings.clone(), limits, 0).is_ok());
+        assert!(matches!(
+            prepare_snapshot_and_bindings_with_limits(snapshot, bindings, limits),
+            Err(CatalogError::Validation {
+                code: "catalog_payload_too_large",
+                ..
+            })
+        ));
+    }
+
+    #[test]
+    fn snapshot_payload_budget_charges_typescript_and_text_copies() {
+        let mut typescript_snapshot = empty_snapshot();
+        let mut typescript_tool = staged_tool();
+        typescript_tool.input_typescript = Some("i".repeat(110));
+        typescript_tool.output_typescript = Some("o".repeat(110));
+        typescript_snapshot.tools.push(typescript_tool);
+        assert!(matches!(
+            prepare_snapshot_with_limits(typescript_snapshot, small_limits()),
+            Err(super::CatalogError::Validation {
+                code: "catalog_payload_too_large",
+                ..
+            })
+        ));
+
+        let mut key_and_name_snapshot = empty_snapshot();
+        let mut key_and_name_tool = staged_tool();
+        key_and_name_tool.stable_key = "k".repeat(80);
+        key_and_name_tool.preferred_name = "p".repeat(80);
+        key_and_name_tool.display_name = "d".repeat(80);
+        key_and_name_snapshot.tools.push(key_and_name_tool);
+        assert!(matches!(
+            prepare_snapshot_with_limits(key_and_name_snapshot, small_limits()),
+            Err(super::CatalogError::Validation {
+                code: "catalog_payload_too_large",
+                ..
+            })
+        ));
+
+        let mut description_snapshot = empty_snapshot();
+        let mut description_tool = staged_tool();
+        description_tool.description = Some("description".repeat(10));
+        description_snapshot.tools.push(description_tool);
+        assert!(matches!(
+            prepare_snapshot_with_limits(description_snapshot, small_limits()),
+            Err(super::CatalogError::Validation {
+                code: "catalog_payload_too_large",
+                ..
+            })
+        ));
+    }
+
+    #[test]
+    fn snapshot_payload_limits_reject_preview_items_and_tiny_artifact_floods() {
+        let mut preview_snapshot = empty_snapshot();
+        let mut preview_tool = staged_tool();
+        preview_tool.input_typescript = Some("x".repeat(129));
+        preview_snapshot.tools.push(preview_tool);
+        assert!(matches!(
+            prepare_snapshot_with_limits(preview_snapshot, small_limits()),
+            Err(super::CatalogError::Validation {
+                code: "typescript_too_large",
+                ..
+            })
+        ));
+
+        assert!(matches!(
+            super::validate_artifact_count(1_000_000, small_limits().artifact_count),
+            Err(super::CatalogError::Validation {
+                code: "catalog_too_many_artifacts",
+                ..
+            })
+        ));
+        let mut tiny_artifacts = empty_snapshot();
+        for index in 0..3 {
+            tiny_artifacts.artifacts.push(StagedArtifact {
+                kind: ArtifactKind::Metadata,
+                stable_key: format!("tiny-{index}"),
+                content: json!(null),
+            });
+        }
+        assert!(matches!(
+            prepare_snapshot_with_limits(tiny_artifacts, small_limits()),
+            Err(super::CatalogError::Validation {
+                code: "catalog_too_many_artifacts",
+                ..
+            })
+        ));
+    }
+
+    #[tokio::test]
+    async fn audit_insert_compacts_oldest_rows_and_preserves_context_atomically() {
+        let pool = SqlitePoolOptions::new()
+            .max_connections(1)
+            .connect("sqlite::memory:")
+            .await
+            .expect("test database should open");
+        sqlx::query(
+            "CREATE TABLE audit_events ( \
+             id TEXT PRIMARY KEY NOT NULL, request_id TEXT, actor_admin_id INTEGER, \
+             action TEXT NOT NULL, source_id TEXT, tool_id TEXT, target_path_snapshot TEXT, \
+             metadata_json TEXT NOT NULL, created_at INTEGER NOT NULL)",
+        )
+        .execute(&pool)
+        .await
+        .expect("audit table should be created");
+
+        for index in 1..=5 {
+            let request_id = format!("request-{index}");
+            let mut transaction = pool.begin().await.expect("transaction should begin");
+            insert_audit_with_limit(
+                &mut transaction,
+                AuditContext::admin(&request_id, 7),
+                &format!("action-{index}"),
+                Some("source-1"),
+                Some("tool-1"),
+                Some("tools.source.tool"),
+                json!({ "sequence": index }),
+                index,
+                3,
+            )
+            .await
+            .expect("bounded audit insertion should succeed");
+            transaction
+                .commit()
+                .await
+                .expect("audit insertion and compaction should commit together");
+        }
+
+        let rows = sqlx::query_as::<_, (String, String, i64, String, String)>(
+            "SELECT action, request_id, actor_admin_id, target_path_snapshot, metadata_json \
+             FROM audit_events ORDER BY created_at",
+        )
+        .fetch_all(&pool)
+        .await
+        .expect("retained audit rows should read");
+        assert_eq!(rows.len(), 3);
+        assert_eq!(rows[0].0, "action-3");
+        assert_eq!(rows[2].0, "action-5");
+        assert_eq!(rows[2].1, "request-5");
+        assert_eq!(rows[2].2, 7);
+        assert_eq!(rows[2].3, "tools.source.tool");
+        assert_eq!(
+            serde_json::from_str::<serde_json::Value>(&rows[2].4)
+                .expect("retained metadata should be valid JSON"),
+            json!({ "sequence": 5 })
+        );
+
+        let mut transaction = pool.begin().await.expect("transaction should begin");
+        insert_audit_with_limit(
+            &mut transaction,
+            AuditContext::system(Some("request-6")),
+            "action-6",
+            Some("source-1"),
+            Some("tool-1"),
+            Some("tools.source.tool"),
+            json!({ "sequence": 6 }),
+            6,
+            3,
+        )
+        .await
+        .expect("an uncommitted insertion should compact inside its transaction");
+        let in_transaction = sqlx::query_scalar::<_, String>(
+            "SELECT group_concat(action, ',') FROM ( \
+             SELECT action FROM audit_events ORDER BY created_at)",
+        )
+        .fetch_one(&mut *transaction)
+        .await
+        .expect("transactional audit rows should read");
+        assert_eq!(in_transaction, "action-4,action-5,action-6");
+        transaction
+            .rollback()
+            .await
+            .expect("audit insertion and compaction should roll back together");
+        let after_rollback = sqlx::query_scalar::<_, String>(
+            "SELECT group_concat(action, ',') FROM ( \
+             SELECT action FROM audit_events ORDER BY created_at)",
+        )
+        .fetch_one(&pool)
+        .await
+        .expect("rolled-back audit rows should read");
+        assert_eq!(after_rollback, "action-3,action-4,action-5");
+    }
+
+    #[tokio::test]
+    async fn oversized_audit_metadata_is_rejected_without_inserting_a_row() {
+        let pool = SqlitePoolOptions::new()
+            .max_connections(1)
+            .connect("sqlite::memory:")
+            .await
+            .expect("test database should open");
+        sqlx::query(
+            "CREATE TABLE audit_events ( \
+             id TEXT PRIMARY KEY NOT NULL, request_id TEXT, actor_admin_id INTEGER, \
+             action TEXT NOT NULL, source_id TEXT, tool_id TEXT, target_path_snapshot TEXT, \
+             metadata_json TEXT NOT NULL, created_at INTEGER NOT NULL)",
+        )
+        .execute(&pool)
+        .await
+        .expect("audit table should be created");
+        let mut transaction = pool.begin().await.expect("transaction should begin");
+        let error = insert_audit_with_limit(
+            &mut transaction,
+            AuditContext::system(Some("oversized-audit")),
+            "oversized",
+            None,
+            None,
+            None,
+            json!({ "value": "x".repeat(super::MAX_AUDIT_METADATA_BYTES) }),
+            1,
+            3,
+        )
+        .await
+        .expect_err("oversized metadata should fail before insertion");
+        assert!(matches!(
+            error,
+            CatalogError::Validation {
+                code: "audit_metadata_too_large",
+                ..
+            }
+        ));
+        transaction
+            .commit()
+            .await
+            .expect("empty transaction should commit");
+        let count = sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM audit_events")
+            .fetch_one(&pool)
+            .await
+            .expect("audit count should read");
+        assert_eq!(count, 0);
+    }
+
+    #[tokio::test]
+    async fn audit_retention_uses_insertion_order_when_the_wall_clock_moves_backward() {
+        let pool = SqlitePoolOptions::new()
+            .max_connections(1)
+            .connect("sqlite::memory:")
+            .await
+            .expect("test database should open");
+        sqlx::query(
+            "CREATE TABLE audit_events ( \
+             id TEXT PRIMARY KEY NOT NULL, request_id TEXT, actor_admin_id INTEGER, \
+             action TEXT NOT NULL, source_id TEXT, tool_id TEXT, target_path_snapshot TEXT, \
+             metadata_json TEXT NOT NULL, created_at INTEGER NOT NULL)",
+        )
+        .execute(&pool)
+        .await
+        .expect("audit table should be created");
+
+        for (index, future_timestamp) in [10_000, 20_000, 30_000].into_iter().enumerate() {
+            let mut transaction = pool.begin().await.expect("transaction should begin");
+            insert_audit_with_limit(
+                &mut transaction,
+                AuditContext::system(None),
+                &format!("future-{}", index + 1),
+                None,
+                None,
+                None,
+                json!({}),
+                future_timestamp,
+                3,
+            )
+            .await
+            .expect("future-dated audit should insert");
+            transaction.commit().await.expect("audit should commit");
+        }
+
+        let mut transaction = pool.begin().await.expect("transaction should begin");
+        insert_audit_with_limit(
+            &mut transaction,
+            AuditContext::system(Some("backward-clock-request")),
+            "new-after-clock-reset",
+            None,
+            None,
+            Some("tools.source.tool"),
+            json!({ "clock": "reset" }),
+            1,
+            3,
+        )
+        .await
+        .expect("new audit should survive retention despite its lower timestamp");
+        transaction.commit().await.expect("new audit should commit");
+
+        let retained = sqlx::query_as::<_, (String, i64)>(
+            "SELECT action, created_at FROM audit_events ORDER BY rowid",
+        )
+        .fetch_all(&pool)
+        .await
+        .expect("retained audits should read");
+        assert_eq!(
+            retained,
+            vec![
+                ("future-2".to_owned(), 20_000),
+                ("future-3".to_owned(), 30_000),
+                ("new-after-clock-reset".to_owned(), 1),
+            ]
+        );
+    }
+}
diff --git a/src/cli/client.rs b/src/cli/client.rs
new file mode 100644
index 000000000..08794a97a
--- /dev/null
+++ b/src/cli/client.rs
@@ -0,0 +1,1711 @@
+use std::{
+    io,
+    net::{IpAddr, SocketAddr, ToSocketAddrs},
+    time::{Duration, Instant},
+};
+
+use reqwest::{Method, Response, StatusCode, header};
+use serde::{Deserialize, Serialize, de::DeserializeOwned};
+use serde_json::{Value, json};
+use thiserror::Error;
+use url::Url;
+
+use super::terminal::safe_field;
+
+const MAX_RESPONSE_BYTES: usize = 16 * 1024 * 1024;
+const MAX_LOOPBACK_ADDRESSES: usize = 32;
+const IDEMPOTENCY_WAIT_LIMIT: Duration = Duration::from_secs(60);
+
+#[derive(Clone)]
+pub struct GatewayClient {
+    http: reqwest::Client,
+    base_url: Url,
+    token: String,
+}
+
+#[derive(Debug, Error)]
+pub enum ClientError {
+    #[error("the Executor base URL is invalid: {0}")]
+    InvalidBaseUrl(String),
+    #[error("EXECUTOR_API_TOKEN or --api-token is required")]
+    MissingToken,
+    #[error("Executor is not reachable at {base_url}: {source}")]
+    Unreachable {
+        base_url: String,
+        #[source]
+        source: reqwest::Error,
+    },
+    #[error("Executor returned an invalid response: {0}")]
+    InvalidResponse(String),
+    #[error("Executor returned too much data")]
+    ResponseTooLarge,
+    #[error(
+        "plaintext HTTP is allowed only when the Executor host resolves exclusively to loopback addresses; use HTTPS or pass --allow-insecure-http"
+    )]
+    UnsafeHttpResolution,
+    #[error(
+        "Executor may have completed {operation}, but {reason}; the outcome is unknown. Do not repeat it with a new request identity.{recovery_suffix}"
+    )]
+    OutcomeUnknown {
+        operation: &'static str,
+        reason: &'static str,
+        recovery_suffix: String,
+    },
+    #[error("Executor request failed ({status} {code}): {message}{request_suffix}")]
+    Api {
+        status: StatusCode,
+        code: String,
+        message: String,
+        request_suffix: String,
+    },
+}
+
+#[derive(Debug, Deserialize)]
+struct ErrorEnvelope {
+    error: ApiErrorBody,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct ApiErrorBody {
+    code: String,
+    message: String,
+    request_id: Option<String>,
+}
+
+#[derive(Debug, Deserialize, Serialize)]
+pub struct ApprovalRequired {
+    pub status: String,
+    pub approval: PendingApproval,
+}
+
+#[derive(Debug, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct PendingApproval {
+    pub id: String,
+    pub status: String,
+    pub revision: i64,
+    pub path: String,
+    pub created_at: i64,
+    pub expires_at: i64,
+    pub status_url: String,
+}
+
+#[derive(Debug, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ApprovalDetail {
+    pub id: String,
+    pub status: String,
+    pub revision: i64,
+    pub path: String,
+    pub created_at: i64,
+    pub updated_at: i64,
+    pub expires_at: i64,
+    pub failure_code: Option<String>,
+    pub result: Option<Value>,
+}
+
+pub enum InvokeResponse {
+    Complete(Value),
+    ApprovalRequired(ApprovalRequired),
+}
+
+impl GatewayClient {
+    #[cfg(test)]
+    pub fn new(base_url: &str, token: Option<&str>) -> Result<Self, ClientError> {
+        Self::new_with_policy(base_url, token, false)
+    }
+
+    pub fn new_with_policy(
+        base_url: &str,
+        token: Option<&str>,
+        allow_insecure_http: bool,
+    ) -> Result<Self, ClientError> {
+        Self::new_with_policy_and_resolver(
+            base_url,
+            token,
+            allow_insecure_http,
+            resolve_system_addresses,
+        )
+    }
+
+    fn new_with_policy_and_resolver<F>(
+        base_url: &str,
+        token: Option<&str>,
+        allow_insecure_http: bool,
+        resolver: F,
+    ) -> Result<Self, ClientError>
+    where
+        F: FnOnce(&str, u16) -> io::Result<Vec<SocketAddr>>,
+    {
+        let token = token
+            .filter(|token| !token.is_empty())
+            .ok_or(ClientError::MissingToken)?;
+        let base_url = normalized_base_url_with_policy(base_url, allow_insecure_http)?;
+        let builder = reqwest::Client::builder()
+            .no_proxy()
+            .redirect(reqwest::redirect::Policy::none())
+            .connect_timeout(Duration::from_secs(5))
+            .timeout(Duration::from_secs(35))
+            .user_agent(concat!("executor-cli/", env!("CARGO_PKG_VERSION")));
+        let http = pin_plaintext_loopback(builder, &base_url, allow_insecure_http, resolver)?
+            .build()
+            .map_err(|error| ClientError::InvalidResponse(error.to_string()))?;
+        Ok(Self {
+            http,
+            base_url,
+            token: token.to_owned(),
+        })
+    }
+
+    pub fn dashboard_url(&self) -> Url {
+        self.base_url.clone()
+    }
+
+    pub async fn invoke(
+        &self,
+        path: &str,
+        arguments: Value,
+        idempotency_key: &str,
+    ) -> Result<InvokeResponse, ClientError> {
+        self.invoke_with_wait_limit(path, arguments, idempotency_key, IDEMPOTENCY_WAIT_LIMIT)
+            .await
+    }
+
+    async fn invoke_with_wait_limit(
+        &self,
+        path: &str,
+        arguments: Value,
+        idempotency_key: &str,
+        wait_limit: Duration,
+    ) -> Result<InvokeResponse, ClientError> {
+        let payload = json!({"path": path, "arguments": arguments});
+        let mut send_retry_used = false;
+        let mut response_retry_used = false;
+        let mut outcome_may_exist = false;
+        let started = Instant::now();
+        loop {
+            let response = self
+                .request(Method::POST, "api/v1/gateway/tools/invoke")?
+                .header("idempotency-key", idempotency_key)
+                .json(&payload)
+                .send()
+                .await;
+            let response = match response {
+                Ok(response) => response,
+                Err(source) if !send_retry_used => {
+                    outcome_may_exist |= !source.is_connect();
+                    send_retry_used = true;
+                    tokio::time::sleep(Duration::from_millis(200)).await;
+                    continue;
+                }
+                Err(source) if outcome_may_exist || !source.is_connect() => {
+                    return Err(outcome_unknown(
+                        "the tool call",
+                        "its response could not be received",
+                        Some(idempotency_key),
+                    ));
+                }
+                Err(source) => return Err(self.unreachable(source)),
+            };
+
+            let status = response.status();
+            let retry_after = response
+                .headers()
+                .get(header::RETRY_AFTER)
+                .and_then(|value| value.to_str().ok())
+                .and_then(|value| value.parse::<u64>().ok())
+                .unwrap_or(1)
+                .min(2);
+            let bytes = match read_bounded(response).await {
+                Ok(bytes) => bytes,
+                Err(ResponseReadError::Transport(_))
+                    if status.is_success()
+                        || status == StatusCode::CONFLICT
+                        || status.is_server_error()
+                        || outcome_may_exist =>
+                {
+                    outcome_may_exist = true;
+                    if !response_retry_used {
+                        response_retry_used = true;
+                        tokio::time::sleep(Duration::from_millis(200)).await;
+                        continue;
+                    }
+                    return Err(outcome_unknown(
+                        "the tool call",
+                        "its response could not be read after a safe replay attempt",
+                        Some(idempotency_key),
+                    ));
+                }
+                Err(ResponseReadError::TooLarge)
+                    if status.is_success()
+                        || status == StatusCode::CONFLICT
+                        || status.is_server_error()
+                        || outcome_may_exist =>
+                {
+                    outcome_may_exist = true;
+                    if !response_retry_used {
+                        response_retry_used = true;
+                        tokio::time::sleep(Duration::from_millis(200)).await;
+                        continue;
+                    }
+                    return Err(outcome_unknown(
+                        "the tool call",
+                        "its response was too large to verify after a safe replay attempt",
+                        Some(idempotency_key),
+                    ));
+                }
+                Err(error) if !status.is_success() => {
+                    return match error {
+                        ResponseReadError::Transport(_) => {
+                            Err(api_error(status, None, &self.token))
+                        }
+                        ResponseReadError::TooLarge => Err(ClientError::ResponseTooLarge),
+                    };
+                }
+                Err(error) => return Err(error.into_client_error()),
+            };
+
+            if !status.is_success() {
+                let envelope = serde_json::from_slice::<ErrorEnvelope>(&bytes).ok();
+                if status == StatusCode::CONFLICT {
+                    if envelope
+                        .as_ref()
+                        .is_some_and(|envelope| envelope.error.code == "idempotency_in_progress")
+                    {
+                        outcome_may_exist = true;
+                        if started.elapsed() < wait_limit {
+                            tokio::time::sleep(Duration::from_secs(retry_after)).await;
+                            continue;
+                        }
+                        return Err(outcome_unknown(
+                            "the tool call",
+                            "it remained in progress beyond the safe wait limit",
+                            Some(idempotency_key),
+                        ));
+                    }
+                    if envelope.is_none() {
+                        outcome_may_exist = true;
+                        if !response_retry_used {
+                            response_retry_used = true;
+                            tokio::time::sleep(Duration::from_millis(200)).await;
+                            continue;
+                        }
+                        return Err(outcome_unknown(
+                            "the tool call",
+                            "its conflict response could not be decoded after a safe replay attempt",
+                            Some(idempotency_key),
+                        ));
+                    }
+                }
+                if envelope.is_none() && (status.is_server_error() || outcome_may_exist) {
+                    outcome_may_exist = true;
+                    if !response_retry_used {
+                        response_retry_used = true;
+                        tokio::time::sleep(Duration::from_millis(200)).await;
+                        continue;
+                    }
+                    return Err(outcome_unknown(
+                        "the tool call",
+                        "the replay did not return a definitive typed response after a safe replay attempt",
+                        Some(idempotency_key),
+                    ));
+                }
+                return Err(api_error(status, envelope, &self.token));
+            }
+
+            let decoded = if status == StatusCode::ACCEPTED {
+                decode_success::<ApprovalRequired>(status, &bytes, &self.token)
+                    .map(InvokeResponse::ApprovalRequired)
+            } else {
+                decode_success(status, &bytes, &self.token).map(InvokeResponse::Complete)
+            };
+            match decoded {
+                Ok(response) => return Ok(response),
+                Err(ClientError::InvalidResponse(_)) if !response_retry_used => {
+                    outcome_may_exist = true;
+                    response_retry_used = true;
+                    tokio::time::sleep(Duration::from_millis(200)).await;
+                }
+                Err(ClientError::InvalidResponse(_)) => {
+                    return Err(outcome_unknown(
+                        "the tool call",
+                        "its response could not be decoded after a safe replay attempt",
+                        Some(idempotency_key),
+                    ));
+                }
+                Err(error) => return Err(error),
+            }
+        }
+    }
+
+    pub async fn approval(&self, approval_id: &str) -> Result<ApprovalDetail, ClientError> {
+        let path = approval_path(approval_id)?;
+        let response = self
+            .request(Method::GET, &path)?
+            .send()
+            .await
+            .map_err(|source| self.unreachable(source))?;
+        self.decode_success(response).await
+    }
+
+    pub async fn cancel_approval(
+        &self,
+        approval_id: &str,
+        expected_revision: i64,
+    ) -> Result<ApprovalDetail, ClientError> {
+        let path = approval_path(approval_id)?;
+        let response = self
+            .request(Method::DELETE, &path)?
+            .query(&[("expectedRevision", expected_revision)])
+            .send()
+            .await
+            .map_err(|source| {
+                if source.is_connect() {
+                    self.unreachable(source)
+                } else {
+                    outcome_unknown(
+                        "the approval cancellation",
+                        "its response could not be received",
+                        None,
+                    )
+                }
+            })?;
+        self.decode_non_idempotent_mutation(response, "the approval cancellation")
+            .await
+    }
+
+    pub async fn search(
+        &self,
+        query: &str,
+        namespace: Option<&str>,
+        limit: u32,
+        offset: u32,
+    ) -> Result<Value, ClientError> {
+        let response = self
+            .request(Method::POST, "api/v1/gateway/tools/search")?
+            .json(&json!({
+                "query": query,
+                "namespace": namespace,
+                "limit": limit,
+                "offset": offset,
+            }))
+            .send()
+            .await
+            .map_err(|source| self.unreachable(source))?;
+        self.decode_success(response).await
+    }
+
+    pub async fn describe(&self, path: &str) -> Result<Value, ClientError> {
+        let response = self
+            .request(Method::POST, "api/v1/gateway/tools/describe")?
+            .json(&json!({"path": path}))
+            .send()
+            .await
+            .map_err(|source| self.unreachable(source))?;
+        self.decode_success(response).await
+    }
+
+    pub async fn sources(&self) -> Result<Value, ClientError> {
+        let response = self
+            .request(Method::GET, "api/v1/gateway/sources")?
+            .send()
+            .await
+            .map_err(|source| self.unreachable(source))?;
+        self.decode_success(response).await
+    }
+
+    fn request(&self, method: Method, path: &str) -> Result<reqwest::RequestBuilder, ClientError> {
+        let url = self.base_url.join(path).map_err(|_| {
+            ClientError::InvalidResponse("could not construct the Executor API URL".to_owned())
+        })?;
+        Ok(self
+            .http
+            .request(method, url)
+            .header(header::AUTHORIZATION, format!("Bearer {}", self.token))
+            .header(header::ACCEPT, "application/json"))
+    }
+
+    async fn decode_success<T: DeserializeOwned>(
+        &self,
+        response: Response,
+    ) -> Result<T, ClientError> {
+        let status = response.status();
+        let bytes = read_bounded(response)
+            .await
+            .map_err(ResponseReadError::into_client_error)?;
+        decode_success(status, &bytes, &self.token)
+    }
+
+    async fn decode_non_idempotent_mutation<T: DeserializeOwned>(
+        &self,
+        response: Response,
+        operation: &'static str,
+    ) -> Result<T, ClientError> {
+        let status = response.status();
+        let bytes = match read_bounded(response).await {
+            Ok(bytes) => bytes,
+            Err(ResponseReadError::Transport(_))
+                if status.is_success() || status.is_server_error() =>
+            {
+                return Err(outcome_unknown(
+                    operation,
+                    "its response could not be read and the request was not automatically retried",
+                    None,
+                ));
+            }
+            Err(ResponseReadError::TooLarge) if status.is_success() || status.is_server_error() => {
+                return Err(outcome_unknown(
+                    operation,
+                    "its response was too large to verify and the request was not automatically retried",
+                    None,
+                ));
+            }
+            Err(error) if !status.is_success() => {
+                return match error {
+                    ResponseReadError::Transport(_) => Err(api_error(status, None, &self.token)),
+                    ResponseReadError::TooLarge => Err(ClientError::ResponseTooLarge),
+                };
+            }
+            Err(error) => return Err(error.into_client_error()),
+        };
+        if !status.is_success() {
+            let envelope = serde_json::from_slice::<ErrorEnvelope>(&bytes).ok();
+            if envelope.is_none() && status.is_server_error() {
+                return Err(outcome_unknown(
+                    operation,
+                    "its server-error response could not be decoded and the request was not automatically retried",
+                    None,
+                ));
+            }
+            return Err(api_error(status, envelope, &self.token));
+        }
+        serde_json::from_slice(&bytes).map_err(|_| {
+            outcome_unknown(
+                operation,
+                "its response could not be decoded and the request was not automatically retried",
+                None,
+            )
+        })
+    }
+
+    fn unreachable(&self, source: reqwest::Error) -> ClientError {
+        ClientError::Unreachable {
+            base_url: self.base_url.to_string(),
+            source,
+        }
+    }
+}
+
+pub fn normalized_base_url(input: &str) -> Result<Url, ClientError> {
+    normalized_base_url_with_policy(input, false)
+}
+
+pub(crate) fn normalized_base_url_with_policy(
+    input: &str,
+    allow_insecure_http: bool,
+) -> Result<Url, ClientError> {
+    let mut url =
+        Url::parse(input).map_err(|error| ClientError::InvalidBaseUrl(error.to_string()))?;
+    if !matches!(url.scheme(), "http" | "https")
+        || url.host().is_none()
+        || !url.username().is_empty()
+        || url.password().is_some()
+        || url.query().is_some()
+        || url.fragment().is_some()
+    {
+        return Err(ClientError::InvalidBaseUrl(
+            "use an http(s) origin without credentials, query, or fragment".to_owned(),
+        ));
+    }
+    if !matches!(url.path(), "" | "/") {
+        return Err(ClientError::InvalidBaseUrl(
+            "the base URL must not contain a path".to_owned(),
+        ));
+    }
+    if url.scheme() == "http" && !is_loopback_host(&url) && !allow_insecure_http {
+        return Err(ClientError::InvalidBaseUrl(
+            "plaintext HTTP is allowed only for localhost or a loopback IP; use HTTPS".to_owned(),
+        ));
+    }
+    url.set_path("/");
+    Ok(url)
+}
+
+fn is_loopback_host(url: &Url) -> bool {
+    match url.host() {
+        Some(url::Host::Ipv4(address)) => address.is_loopback(),
+        Some(url::Host::Ipv6(address)) => canonical_ip(IpAddr::V6(address)).is_loopback(),
+        Some(url::Host::Domain(domain)) => is_localhost_domain(domain),
+        None => false,
+    }
+}
+
+fn is_localhost_domain(domain: &str) -> bool {
+    let domain = domain.strip_suffix('.').unwrap_or(domain);
+    domain.eq_ignore_ascii_case("localhost")
+        || domain
+            .to_ascii_lowercase()
+            .strip_suffix(".localhost")
+            .is_some_and(|prefix| !prefix.is_empty())
+}
+
+pub(crate) fn resolve_system_addresses(hostname: &str, port: u16) -> io::Result<Vec<SocketAddr>> {
+    (hostname, port)
+        .to_socket_addrs()
+        .map(|addresses| addresses.take(MAX_LOOPBACK_ADDRESSES + 1).collect())
+}
+
+pub(crate) fn pin_plaintext_loopback<F>(
+    builder: reqwest::ClientBuilder,
+    origin: &Url,
+    allow_insecure_http: bool,
+    resolver: F,
+) -> Result<reqwest::ClientBuilder, ClientError>
+where
+    F: FnOnce(&str, u16) -> io::Result<Vec<SocketAddr>>,
+{
+    if origin.scheme() != "http" || allow_insecure_http {
+        return Ok(builder);
+    }
+    let port = origin
+        .port_or_known_default()
+        .ok_or(ClientError::UnsafeHttpResolution)?;
+    let Some(host) = origin.host() else {
+        return Err(ClientError::UnsafeHttpResolution);
+    };
+    let url::Host::Domain(hostname) = host else {
+        let address = match host {
+            url::Host::Ipv4(address) => IpAddr::V4(address),
+            url::Host::Ipv6(address) => canonical_ip(IpAddr::V6(address)),
+            url::Host::Domain(_) => unreachable!("domain handled above"),
+        };
+        return address
+            .is_loopback()
+            .then_some(builder)
+            .ok_or(ClientError::UnsafeHttpResolution);
+    };
+    if !is_localhost_domain(hostname) {
+        return Err(ClientError::UnsafeHttpResolution);
+    }
+    let addresses = resolver(hostname, port).map_err(|_| ClientError::UnsafeHttpResolution)?;
+    if addresses.is_empty() || addresses.len() > MAX_LOOPBACK_ADDRESSES {
+        return Err(ClientError::UnsafeHttpResolution);
+    }
+    let mut addresses = addresses
+        .into_iter()
+        .map(|address| SocketAddr::new(canonical_ip(address.ip()), port))
+        .collect::<Vec<_>>();
+    if addresses.iter().any(|address| !address.ip().is_loopback()) {
+        return Err(ClientError::UnsafeHttpResolution);
+    }
+    addresses.sort_unstable();
+    addresses.dedup();
+    Ok(builder.resolve_to_addrs(hostname, &addresses))
+}
+
+fn canonical_ip(address: IpAddr) -> IpAddr {
+    match address {
+        IpAddr::V6(address) => address
+            .to_ipv4_mapped()
+            .map(IpAddr::V4)
+            .unwrap_or(IpAddr::V6(address)),
+        address => address,
+    }
+}
+
+fn approval_path(approval_id: &str) -> Result<String, ClientError> {
+    if approval_id.is_empty()
+        || approval_id.len() > 128
+        || !approval_id
+            .bytes()
+            .all(|byte| byte.is_ascii_alphanumeric() || byte == b'-')
+    {
+        return Err(ClientError::InvalidResponse(
+            "approval ID was invalid".to_owned(),
+        ));
+    }
+    Ok(format!("api/v1/gateway/approvals/{approval_id}"))
+}
+
+fn api_error(status: StatusCode, envelope: Option<ErrorEnvelope>, token: &str) -> ClientError {
+    let (code, message, request_suffix) = match envelope {
+        Some(envelope) => (
+            safe_field_redacting_secret(&envelope.error.code, token),
+            safe_field_redacting_secret(&envelope.error.message, token),
+            envelope
+                .error
+                .request_id
+                .map(|id| format!(" (request {})", safe_field_redacting_secret(&id, token)))
+                .unwrap_or_default(),
+        ),
+        None => (
+            "http_error".to_owned(),
+            status
+                .canonical_reason()
+                .unwrap_or("request failed")
+                .to_owned(),
+            String::new(),
+        ),
+    };
+    ClientError::Api {
+        status,
+        code,
+        message,
+        request_suffix,
+    }
+}
+
+fn decode_success<T: DeserializeOwned>(
+    status: StatusCode,
+    bytes: &[u8],
+    token: &str,
+) -> Result<T, ClientError> {
+    if !status.is_success() {
+        let envelope = serde_json::from_slice::<ErrorEnvelope>(bytes).ok();
+        return Err(api_error(status, envelope, token));
+    }
+    serde_json::from_slice(bytes).map_err(|error| ClientError::InvalidResponse(error.to_string()))
+}
+
+pub(crate) fn safe_field_redacting_secret(value: &str, secret: &str) -> String {
+    if secret.is_empty() {
+        return safe_field(value);
+    }
+    safe_field(&value.replace(secret, "[redacted]"))
+}
+
+fn outcome_unknown(
+    operation: &'static str,
+    reason: &'static str,
+    idempotency_key: Option<&str>,
+) -> ClientError {
+    let recovery_suffix = idempotency_key
+        .map(|key| format!(" Recovery idempotency key: {}.", safe_field(key)))
+        .unwrap_or_default();
+    ClientError::OutcomeUnknown {
+        operation,
+        reason,
+        recovery_suffix,
+    }
+}
+
+enum ResponseReadError {
+    Transport(reqwest::Error),
+    TooLarge,
+}
+
+impl ResponseReadError {
+    fn into_client_error(self) -> ClientError {
+        match self {
+            Self::Transport(error) => ClientError::InvalidResponse(error.to_string()),
+            Self::TooLarge => ClientError::ResponseTooLarge,
+        }
+    }
+}
+
+async fn read_bounded(mut response: Response) -> Result<Vec<u8>, ResponseReadError> {
+    if response
+        .content_length()
+        .is_some_and(|length| length > MAX_RESPONSE_BYTES as u64)
+    {
+        return Err(ResponseReadError::TooLarge);
+    }
+    let mut bytes = Vec::new();
+    while let Some(chunk) = response
+        .chunk()
+        .await
+        .map_err(ResponseReadError::Transport)?
+    {
+        if bytes.len().saturating_add(chunk.len()) > MAX_RESPONSE_BYTES {
+            return Err(ResponseReadError::TooLarge);
+        }
+        bytes.extend_from_slice(&chunk);
+    }
+    Ok(bytes)
+}
+
+#[cfg(test)]
+mod tests {
+    use std::{
+        collections::HashSet,
+        sync::{
+            Arc, Mutex,
+            atomic::{AtomicUsize, Ordering},
+        },
+    };
+
+    use axum::{
+        Json, Router,
+        extract::State,
+        http::{HeaderMap, Uri},
+        response::IntoResponse,
+        routing::{get, post},
+    };
+    use serde_json::json;
+    use tokio::{
+        io::{AsyncReadExt, AsyncWriteExt},
+        sync::oneshot,
+    };
+
+    use super::*;
+
+    type CapturedRequestSender =
+        std::sync::Arc<std::sync::Mutex<Option<oneshot::Sender<(Uri, HeaderMap)>>>>;
+
+    enum RawReply {
+        Complete {
+            status: StatusCode,
+            body: &'static str,
+        },
+        Truncated {
+            status: StatusCode,
+            body: &'static str,
+        },
+    }
+
+    impl RawReply {
+        fn status(&self) -> StatusCode {
+            match self {
+                Self::Complete { status, .. } | Self::Truncated { status, .. } => *status,
+            }
+        }
+
+        fn body(&self) -> &'static str {
+            match self {
+                Self::Complete { body, .. } | Self::Truncated { body, .. } => body,
+            }
+        }
+    }
+
+    #[derive(Debug)]
+    struct RawCall {
+        method: String,
+        target: String,
+        idempotency_key: Option<String>,
+    }
+
+    #[derive(Default)]
+    struct RawServerState {
+        calls: Mutex<Vec<RawCall>>,
+        committed_keys: Mutex<HashSet<String>>,
+        dispatches: AtomicUsize,
+    }
+
+    async fn spawn_server(router: Router) -> (String, tokio::task::JoinHandle<()>) {
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("listener");
+        let address = listener.local_addr().expect("address");
+        let task = tokio::spawn(async move {
+            axum::serve(listener, router).await.expect("test server");
+        });
+        (format!("http://{address}"), task)
+    }
+
+    async fn spawn_raw_server(
+        replies: Vec<RawReply>,
+    ) -> (String, tokio::task::JoinHandle<()>, Arc<RawServerState>) {
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("listener");
+        let address = listener.local_addr().expect("address");
+        let state = Arc::new(RawServerState::default());
+        let server_state = Arc::clone(&state);
+        let task = tokio::spawn(async move {
+            for reply in replies {
+                let (mut stream, _) = listener.accept().await.expect("connection");
+                let call = read_raw_call(&mut stream).await;
+                if reply.status().is_success() || reply.status().is_server_error() {
+                    match &call.idempotency_key {
+                        Some(key) => {
+                            if server_state
+                                .committed_keys
+                                .lock()
+                                .expect("committed keys")
+                                .insert(key.clone())
+                            {
+                                server_state.dispatches.fetch_add(1, Ordering::SeqCst);
+                            }
+                        }
+                        None => {
+                            server_state.dispatches.fetch_add(1, Ordering::SeqCst);
+                        }
+                    }
+                }
+                server_state.calls.lock().expect("calls").push(call);
+                write_raw_reply(&mut stream, reply).await;
+            }
+        });
+        (format!("http://{address}"), task, state)
+    }
+
+    async fn finish_raw_server(mut task: tokio::task::JoinHandle<()>) {
+        match tokio::time::timeout(Duration::from_secs(2), &mut task).await {
+            Ok(result) => result.expect("raw server"),
+            Err(_) => {
+                task.abort();
+                let _ = task.await;
+                panic!("raw server did not receive the expected requests");
+            }
+        }
+    }
+
+    async fn read_raw_call(stream: &mut tokio::net::TcpStream) -> RawCall {
+        let mut request = Vec::new();
+        let header_end = loop {
+            if let Some(index) = request.windows(4).position(|window| window == b"\r\n\r\n") {
+                break index + 4;
+            }
+            let mut buffer = [0_u8; 1024];
+            let read = stream.read(&mut buffer).await.expect("read request");
+            assert_ne!(read, 0, "request ended before headers");
+            request.extend_from_slice(&buffer[..read]);
+            assert!(request.len() <= 64 * 1024, "request headers were too large");
+        };
+        let headers = String::from_utf8(request[..header_end].to_vec()).expect("ASCII headers");
+        let content_length = headers
+            .lines()
+            .find_map(|line| {
+                let (name, value) = line.split_once(':')?;
+                name.eq_ignore_ascii_case("content-length")
+                    .then(|| value.trim().parse::<usize>().expect("content length"))
+            })
+            .unwrap_or_default();
+        while request.len() < header_end + content_length {
+            let mut buffer = [0_u8; 1024];
+            let read = stream.read(&mut buffer).await.expect("read request body");
+            assert_ne!(read, 0, "request ended before body");
+            request.extend_from_slice(&buffer[..read]);
+        }
+        let request_line = headers.lines().next().expect("request line");
+        let mut request_parts = request_line.split_whitespace();
+        let method = request_parts.next().expect("request method").to_owned();
+        let target = request_parts.next().expect("request target").to_owned();
+        let idempotency_key = headers.lines().find_map(|line| {
+            let (name, value) = line.split_once(':')?;
+            name.eq_ignore_ascii_case("idempotency-key")
+                .then(|| value.trim().to_owned())
+        });
+        RawCall {
+            method,
+            target,
+            idempotency_key,
+        }
+    }
+
+    async fn write_raw_reply(stream: &mut tokio::net::TcpStream, reply: RawReply) {
+        let status = reply.status();
+        let body = reply.body().as_bytes();
+        let headers = format!(
+            "HTTP/1.1 {} {}\r\ncontent-type: application/json\r\ncontent-length: {}\r\nconnection: close\r\n\r\n",
+            status.as_u16(),
+            status.canonical_reason().unwrap_or("Unknown"),
+            body.len()
+        );
+        stream
+            .write_all(headers.as_bytes())
+            .await
+            .expect("write response headers");
+        match reply {
+            RawReply::Complete { .. } => stream.write_all(body).await.expect("write response body"),
+            RawReply::Truncated { .. } => stream
+                .write_all(&body[..body.len() / 2])
+                .await
+                .expect("write partial response body"),
+        }
+        stream.shutdown().await.expect("close response");
+    }
+
+    #[test]
+    fn normalizes_clean_origins_and_rejects_secret_bearing_urls() {
+        assert_eq!(
+            normalized_base_url("http://localhost:4788")
+                .expect("valid URL")
+                .as_str(),
+            "http://localhost:4788/"
+        );
+        for invalid in [
+            "http://token@localhost:4788",
+            "http://localhost:4788/?token=secret",
+            "http://localhost:4788/#secret",
+            "file:///tmp/executor",
+            "http://localhost:4788/prefix",
+            "http://example.com:4788",
+        ] {
+            assert!(normalized_base_url(invalid).is_err(), "accepted {invalid}");
+        }
+    }
+
+    #[test]
+    fn requires_a_token_without_putting_it_in_the_dashboard_url() {
+        assert!(matches!(
+            GatewayClient::new("http://localhost:4788", None),
+            Err(ClientError::MissingToken)
+        ));
+        let client = GatewayClient::new("http://localhost:4788", Some("secret")).expect("client");
+        assert_eq!(client.dashboard_url().as_str(), "http://localhost:4788/");
+        assert!(!client.dashboard_url().as_str().contains("secret"));
+    }
+
+    #[test]
+    fn default_http_accepts_only_resolved_loopback_origins() {
+        for origin in [
+            "http://127.0.0.1:4788",
+            "http://[::1]:4788",
+            "http://localhost:4788",
+        ] {
+            GatewayClient::new(origin, Some("secret")).expect("loopback origin");
+        }
+
+        let subdomain = GatewayClient::new_with_policy_and_resolver(
+            "http://api.localhost:4788",
+            Some("secret"),
+            false,
+            |hostname, port| {
+                assert_eq!(hostname, "api.localhost");
+                Ok(vec![SocketAddr::from(([127, 0, 0, 1], port))])
+            },
+        )
+        .expect("resolved localhost subdomain");
+        assert_eq!(subdomain.dashboard_url().host_str(), Some("api.localhost"));
+    }
+
+    #[test]
+    fn poisoned_localhost_resolution_is_rejected_before_client_creation() {
+        let resolutions = Arc::new(AtomicUsize::new(0));
+        for resolved_ips in [
+            vec![[203, 0, 113, 10]],
+            vec![[127, 0, 0, 1], [203, 0, 113, 10]],
+        ] {
+            let resolver_calls = Arc::clone(&resolutions);
+            let error = match GatewayClient::new_with_policy_and_resolver(
+                "http://poison.localhost:4788",
+                Some("top-secret-token"),
+                false,
+                move |hostname, port| {
+                    resolver_calls.fetch_add(1, Ordering::SeqCst);
+                    assert_eq!(hostname, "poison.localhost");
+                    Ok(resolved_ips
+                        .into_iter()
+                        .map(|address| SocketAddr::from((address, port)))
+                        .collect())
+                },
+            ) {
+                Ok(_) => panic!("poisoned resolution created an HTTP client"),
+                Err(error) => error,
+            };
+
+            assert!(matches!(error, ClientError::UnsafeHttpResolution));
+            assert!(!error.to_string().contains("top-secret-token"));
+        }
+        assert_eq!(resolutions.load(Ordering::SeqCst), 2);
+    }
+
+    #[tokio::test]
+    async fn resolved_localhost_is_pinned_for_bearer_requests() {
+        async fn invoke(headers: HeaderMap) -> impl IntoResponse {
+            assert_eq!(
+                headers
+                    .get(header::AUTHORIZATION)
+                    .and_then(|value| value.to_str().ok()),
+                Some("Bearer secret-token")
+            );
+            Json(json!({"ok": true, "data": {"pinned": true}}))
+        }
+
+        let router = Router::new().route("/api/v1/gateway/tools/invoke", post(invoke));
+        let (numeric_base_url, task) = spawn_server(router).await;
+        let numeric = Url::parse(&numeric_base_url).expect("numeric test URL");
+        let address = match numeric.host().expect("host") {
+            url::Host::Ipv4(address) => {
+                SocketAddr::new(IpAddr::V4(address), numeric.port().expect("port"))
+            }
+            host => panic!("expected IPv4 test server, got {host:?}"),
+        };
+        let client = GatewayClient::new_with_policy_and_resolver(
+            &format!("http://gateway.localhost:{}/", address.port()),
+            Some("secret-token"),
+            false,
+            move |hostname, port| {
+                assert_eq!(hostname, "gateway.localhost");
+                assert_eq!(port, address.port());
+                Ok(vec![address])
+            },
+        )
+        .expect("pinned client");
+
+        let InvokeResponse::Complete(result) = client
+            .invoke("tools.jobs.run", json!({}), "pinned-request")
+            .await
+            .expect("pinned request")
+        else {
+            panic!("expected completed invocation");
+        };
+        assert_eq!(result["data"]["pinned"], true);
+        task.abort();
+    }
+
+    #[test]
+    fn https_and_explicit_insecure_http_skip_loopback_resolution() {
+        for (origin, allow_insecure_http) in [
+            ("https://example.test:4788", false),
+            ("http://example.test:4788", true),
+        ] {
+            let client = GatewayClient::new_with_policy_and_resolver(
+                origin,
+                Some("secret"),
+                allow_insecure_http,
+                |_, _| panic!("safe-mode loopback resolution was not required"),
+            )
+            .expect("origin without safe-mode plaintext resolution");
+            assert_eq!(client.dashboard_url().host_str(), Some("example.test"));
+        }
+    }
+
+    #[tokio::test]
+    async fn invocation_uses_auth_header_and_never_a_url_secret() {
+        async fn invoke(
+            State(sender): State<CapturedRequestSender>,
+            uri: Uri,
+            headers: HeaderMap,
+        ) -> impl IntoResponse {
+            if let Some(sender) = sender.lock().expect("sender lock").take() {
+                let _ = sender.send((uri, headers));
+            }
+            Json(json!({"ok": true, "data": {"value": 2}}))
+        }
+
+        let (sender, receiver) = oneshot::channel();
+        let state = std::sync::Arc::new(std::sync::Mutex::new(Some(sender)));
+        let router = Router::new()
+            .route("/api/v1/gateway/tools/invoke", post(invoke))
+            .with_state(state);
+        let (base_url, task) = spawn_server(router).await;
+        let client = GatewayClient::new(&base_url, Some("secret-token")).expect("client");
+        let result = client
+            .invoke("tools.math.add", json!({}), "one-command-key")
+            .await
+            .expect("invoke");
+        assert!(matches!(result, InvokeResponse::Complete(_)));
+        let (uri, headers) = receiver.await.expect("request capture");
+        assert_eq!(uri.path(), "/api/v1/gateway/tools/invoke");
+        assert_eq!(uri.query(), None);
+        assert_eq!(
+            headers
+                .get(header::AUTHORIZATION)
+                .and_then(|value| value.to_str().ok()),
+            Some("Bearer secret-token")
+        );
+        assert_eq!(
+            headers
+                .get("idempotency-key")
+                .and_then(|value| value.to_str().ok()),
+            Some("one-command-key")
+        );
+        task.abort();
+    }
+
+    #[tokio::test]
+    async fn bearer_requests_never_follow_redirects() {
+        async fn redirect(State(location): State<String>, headers: HeaderMap) -> impl IntoResponse {
+            assert_eq!(
+                headers
+                    .get(header::AUTHORIZATION)
+                    .and_then(|value| value.to_str().ok()),
+                Some("Bearer redirect-secret")
+            );
+            (
+                StatusCode::TEMPORARY_REDIRECT,
+                [(header::LOCATION, location)],
+            )
+        }
+
+        let target = tokio::net::TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("redirect target listener");
+        let target_address = target.local_addr().expect("target address");
+        let router = Router::new()
+            .route("/api/v1/gateway/tools/invoke", post(redirect))
+            .with_state(format!("http://{target_address}/steal"));
+        let (base_url, task) = spawn_server(router).await;
+        let client = GatewayClient::new(&base_url, Some("redirect-secret")).expect("client");
+
+        let error = match client
+            .invoke("tools.jobs.run", json!({}), "redirect-request")
+            .await
+        {
+            Ok(_) => panic!("redirect unexpectedly succeeded"),
+            Err(error) => error,
+        };
+
+        assert!(matches!(
+            error,
+            ClientError::Api {
+                status: StatusCode::TEMPORARY_REDIRECT,
+                ..
+            }
+        ));
+        assert!(!error.to_string().contains("redirect-secret"));
+        assert!(
+            tokio::time::timeout(Duration::from_millis(100), target.accept())
+                .await
+                .is_err(),
+            "redirect target received a bearer-bearing request"
+        );
+        task.abort();
+    }
+
+    #[tokio::test]
+    async fn api_error_fields_cannot_reflect_the_bearer_token() {
+        async fn reflected(headers: HeaderMap) -> impl IntoResponse {
+            assert_eq!(
+                headers
+                    .get(header::AUTHORIZATION)
+                    .and_then(|value| value.to_str().ok()),
+                Some("Bearer secret-reflection-token")
+            );
+            (
+                StatusCode::BAD_REQUEST,
+                Json(json!({
+                    "error": {
+                        "code": "secret-reflection-token",
+                        "message": "Bearer secret-reflection-token was rejected",
+                        "requestId": "secret-reflection-token"
+                    }
+                })),
+            )
+        }
+
+        let router = Router::new().route("/api/v1/gateway/sources", get(reflected));
+        let (base_url, task) = spawn_server(router).await;
+        let client = GatewayClient::new(&base_url, Some("secret-reflection-token"))
+            .expect("loopback client");
+
+        let error = client.sources().await.expect_err("reflected API error");
+        let rendered = error.to_string();
+        assert!(!rendered.contains("secret-reflection-token"));
+        assert!(rendered.contains("[redacted]"));
+        task.abort();
+    }
+
+    #[tokio::test]
+    async fn decodes_approval_poll_cancel_and_revoked_token_errors() {
+        async fn invoke() -> impl IntoResponse {
+            (
+                StatusCode::ACCEPTED,
+                Json(json!({
+                    "status": "approval_required",
+                    "approval": {
+                        "id": "approval-1",
+                        "status": "pending",
+                        "revision": 0,
+                        "path": "tools.mail.send",
+                        "createdAt": 1,
+                        "expiresAt": 60,
+                        "statusUrl": "/api/v1/gateway/approvals/approval-1"
+                    }
+                })),
+            )
+        }
+        async fn approval() -> impl IntoResponse {
+            Json(json!({
+                "id": "approval-1",
+                "status": "succeeded",
+                "revision": 2,
+                "path": "tools.mail.send",
+                "createdAt": 1,
+                "updatedAt": 2,
+                "expiresAt": 60,
+                "failureCode": null,
+                "result": {"ok": true, "data": {"sent": true}}
+            }))
+        }
+        async fn revoked() -> impl IntoResponse {
+            (
+                StatusCode::UNAUTHORIZED,
+                Json(json!({
+                    "error": {
+                        "code": "unauthorized",
+                        "message": "The API token is no longer active.",
+                        "requestId": "request-1"
+                    }
+                })),
+            )
+        }
+        let router = Router::new()
+            .route("/api/v1/gateway/tools/invoke", post(invoke))
+            .route(
+                "/api/v1/gateway/approvals/approval-1",
+                get(approval).delete(approval),
+            )
+            .route("/api/v1/gateway/sources", get(revoked));
+        let (base_url, task) = spawn_server(router).await;
+        let client = GatewayClient::new(&base_url, Some("token")).expect("client");
+        let InvokeResponse::ApprovalRequired(pending) = client
+            .invoke("tools.mail.send", json!({}), "approval-key")
+            .await
+            .expect("approval")
+        else {
+            panic!("expected approval");
+        };
+        let detail = client
+            .approval(&pending.approval.id)
+            .await
+            .expect("approval detail");
+        assert_eq!(detail.status, "succeeded");
+        let cancelled = client
+            .cancel_approval(&pending.approval.id, detail.revision)
+            .await
+            .expect("cancel request");
+        assert_eq!(cancelled.id, "approval-1");
+        let error = client.sources().await.expect_err("revoked token");
+        assert!(matches!(
+            error,
+            ClientError::Api {
+                status: StatusCode::UNAUTHORIZED,
+                ref code,
+                ..
+            } if code == "unauthorized"
+        ));
+        assert!(error.to_string().contains("request request-1"));
+        task.abort();
+    }
+
+    #[tokio::test]
+    async fn reports_when_the_server_is_not_running() {
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("listener");
+        let address = listener.local_addr().expect("address");
+        drop(listener);
+        let client =
+            GatewayClient::new(&format!("http://{address}"), Some("token")).expect("client");
+        assert!(matches!(
+            client.sources().await,
+            Err(ClientError::Unreachable { .. })
+        ));
+    }
+
+    #[test]
+    fn approval_ids_cannot_redirect_bearer_requests() {
+        for invalid in [
+            "https://attacker.example/x",
+            "/https://attacker.example/x",
+            "../other",
+            "approval?id=secret",
+        ] {
+            assert!(approval_path(invalid).is_err(), "accepted {invalid}");
+        }
+        assert_eq!(
+            approval_path("9d6e9268-197d-4e60-b267-3f2bf85d368f").expect("UUID"),
+            "api/v1/gateway/approvals/9d6e9268-197d-4e60-b267-3f2bf85d368f"
+        );
+    }
+
+    #[tokio::test]
+    async fn retries_in_progress_with_the_same_idempotency_key() {
+        #[derive(Clone, Default)]
+        struct StateValue {
+            calls: std::sync::Arc<std::sync::Mutex<Vec<String>>>,
+        }
+        async fn invoke(State(state): State<StateValue>, headers: HeaderMap) -> impl IntoResponse {
+            let key = headers
+                .get("idempotency-key")
+                .and_then(|value| value.to_str().ok())
+                .unwrap_or_default()
+                .to_owned();
+            let count = {
+                let mut calls = state.calls.lock().expect("calls");
+                calls.push(key);
+                calls.len()
+            };
+            if count < 3 {
+                return (
+                    StatusCode::CONFLICT,
+                    [(header::RETRY_AFTER, "0")],
+                    Json(json!({
+                        "error": {
+                            "code": "idempotency_in_progress",
+                            "message": "Still running",
+                            "requestId": "request-1"
+                        }
+                    })),
+                )
+                    .into_response();
+            }
+            Json(json!({"ok": true, "data": {"done": true}})).into_response()
+        }
+        let state = StateValue::default();
+        let router = Router::new()
+            .route("/api/v1/gateway/tools/invoke", post(invoke))
+            .with_state(state.clone());
+        let (base_url, task) = spawn_server(router).await;
+        let client = GatewayClient::new(&base_url, Some("token")).expect("client");
+        let result = client
+            .invoke("tools.jobs.run", json!({}), "stable-key")
+            .await
+            .expect("eventual replay");
+        assert!(matches!(result, InvokeResponse::Complete(_)));
+        assert_eq!(
+            state.calls.lock().expect("calls").as_slice(),
+            ["stable-key", "stable-key", "stable-key"]
+        );
+        task.abort();
+    }
+
+    #[tokio::test]
+    async fn in_progress_wait_exhaustion_preserves_the_recovery_identity() {
+        const BODY: &str = r#"{"error":{"code":"idempotency_in_progress","message":"Still running","requestId":"request-1"}}"#;
+        let (base_url, task, state) = spawn_raw_server(vec![RawReply::Complete {
+            status: StatusCode::CONFLICT,
+            body: BODY,
+        }])
+        .await;
+        let client = GatewayClient::new(&base_url, Some("token")).expect("client");
+
+        let error = match client
+            .invoke_with_wait_limit(
+                "tools.jobs.run",
+                json!({}),
+                "in-progress-recovery-key",
+                Duration::ZERO,
+            )
+            .await
+        {
+            Ok(_) => panic!("expected unresolved in-progress invocation"),
+            Err(error) => error,
+        };
+
+        assert!(matches!(error, ClientError::OutcomeUnknown { .. }));
+        assert!(error.to_string().contains("in-progress-recovery-key"));
+        finish_raw_server(task).await;
+        let calls = state.calls.lock().expect("calls");
+        assert_eq!(calls.len(), 1);
+        assert_eq!(
+            calls[0].idempotency_key.as_deref(),
+            Some("in-progress-recovery-key")
+        );
+    }
+
+    #[tokio::test]
+    async fn malformed_conflict_replays_then_exhausts_as_outcome_unknown() {
+        let (base_url, task, state) = spawn_raw_server(vec![
+            RawReply::Complete {
+                status: StatusCode::CONFLICT,
+                body: "not-json",
+            },
+            RawReply::Complete {
+                status: StatusCode::CONFLICT,
+                body: "still-not-json",
+            },
+        ])
+        .await;
+        let client = GatewayClient::new(&base_url, Some("token")).expect("client");
+
+        let error = match client
+            .invoke("tools.jobs.run", json!({}), "conflict-recovery-key")
+            .await
+        {
+            Ok(_) => panic!("expected unresolved conflict response"),
+            Err(error) => error,
+        };
+
+        assert!(matches!(error, ClientError::OutcomeUnknown { .. }));
+        assert!(error.to_string().contains("conflict-recovery-key"));
+        finish_raw_server(task).await;
+        let calls = state.calls.lock().expect("calls");
+        assert_eq!(calls.len(), 2);
+        assert!(
+            calls
+                .iter()
+                .all(|call| call.idempotency_key.as_deref() == Some("conflict-recovery-key"))
+        );
+    }
+
+    #[tokio::test]
+    async fn truncated_server_error_replays_with_the_same_identity() {
+        const ERROR_BODY: &str = r#"{"error":{"code":"internal_error","message":"Response unavailable","requestId":"request-1"}}"#;
+        const SUCCESS_BODY: &str = r#"{"ok":true,"data":{"executions":1}}"#;
+        let (base_url, task, state) = spawn_raw_server(vec![
+            RawReply::Truncated {
+                status: StatusCode::INTERNAL_SERVER_ERROR,
+                body: ERROR_BODY,
+            },
+            RawReply::Complete {
+                status: StatusCode::OK,
+                body: SUCCESS_BODY,
+            },
+        ])
+        .await;
+        let client = GatewayClient::new(&base_url, Some("token")).expect("client");
+
+        let InvokeResponse::Complete(result) = client
+            .invoke("tools.jobs.run", json!({}), "server-error-replay-key")
+            .await
+            .expect("safe replay")
+        else {
+            panic!("expected completed invocation");
+        };
+
+        assert_eq!(result["data"]["executions"], 1);
+        finish_raw_server(task).await;
+        let calls = state.calls.lock().expect("calls");
+        assert_eq!(calls.len(), 2);
+        assert!(
+            calls
+                .iter()
+                .all(|call| { call.idempotency_key.as_deref() == Some("server-error-replay-key") })
+        );
+        assert_eq!(state.dispatches.load(Ordering::SeqCst), 1);
+    }
+
+    #[tokio::test]
+    async fn malformed_server_error_replays_then_exhausts_as_outcome_unknown() {
+        let (base_url, task, state) = spawn_raw_server(vec![
+            RawReply::Complete {
+                status: StatusCode::BAD_GATEWAY,
+                body: "not-json",
+            },
+            RawReply::Complete {
+                status: StatusCode::BAD_GATEWAY,
+                body: "still-not-json",
+            },
+        ])
+        .await;
+        let client = GatewayClient::new(&base_url, Some("token")).expect("client");
+
+        let error = match client
+            .invoke("tools.jobs.run", json!({}), "server-error-unknown-key")
+            .await
+        {
+            Ok(_) => panic!("expected unresolved server error response"),
+            Err(error) => error,
+        };
+
+        assert!(matches!(error, ClientError::OutcomeUnknown { .. }));
+        assert!(error.to_string().contains("server-error-unknown-key"));
+        finish_raw_server(task).await;
+        let calls = state.calls.lock().expect("calls");
+        assert_eq!(calls.len(), 2);
+        assert!(
+            calls.iter().all(|call| {
+                call.idempotency_key.as_deref() == Some("server-error-unknown-key")
+            })
+        );
+        assert_eq!(state.dispatches.load(Ordering::SeqCst), 1);
+    }
+
+    #[tokio::test]
+    async fn replays_a_committed_mutation_after_the_first_response_is_truncated() {
+        const BODY: &str = r#"{"ok":true,"data":{"executions":1}}"#;
+        let (base_url, task, state) = spawn_raw_server(vec![
+            RawReply::Truncated {
+                status: StatusCode::OK,
+                body: BODY,
+            },
+            RawReply::Complete {
+                status: StatusCode::OK,
+                body: BODY,
+            },
+        ])
+        .await;
+        let client = GatewayClient::new(&base_url, Some("token")).expect("client");
+
+        let InvokeResponse::Complete(result) = client
+            .invoke("tools.jobs.run", json!({}), "stable-replay-key")
+            .await
+            .expect("safe replay")
+        else {
+            panic!("expected completed invocation");
+        };
+
+        assert_eq!(result["data"]["executions"], 1);
+        finish_raw_server(task).await;
+        let calls = state.calls.lock().expect("calls");
+        assert_eq!(calls.len(), 2);
+        assert!(calls.iter().all(|call| {
+            call.method == "POST"
+                && call.target == "/api/v1/gateway/tools/invoke"
+                && call.idempotency_key.as_deref() == Some("stable-replay-key")
+        }));
+        assert_eq!(state.dispatches.load(Ordering::SeqCst), 1);
+    }
+
+    #[tokio::test]
+    async fn replays_with_the_same_identity_when_a_success_body_cannot_be_decoded() {
+        const BODY: &str = r#"{"ok":true,"data":{"executions":1}}"#;
+        let (base_url, task, state) = spawn_raw_server(vec![
+            RawReply::Complete {
+                status: StatusCode::OK,
+                body: "not-json",
+            },
+            RawReply::Complete {
+                status: StatusCode::OK,
+                body: BODY,
+            },
+        ])
+        .await;
+        let client = GatewayClient::new(&base_url, Some("token")).expect("client");
+
+        let InvokeResponse::Complete(result) = client
+            .invoke("tools.jobs.run", json!({}), "decode-replay-key")
+            .await
+            .expect("safe replay")
+        else {
+            panic!("expected completed invocation");
+        };
+
+        assert_eq!(result["data"]["executions"], 1);
+        finish_raw_server(task).await;
+        let calls = state.calls.lock().expect("calls");
+        assert_eq!(calls.len(), 2);
+        assert!(
+            calls
+                .iter()
+                .all(|call| call.idempotency_key.as_deref() == Some("decode-replay-key"))
+        );
+        assert_eq!(state.dispatches.load(Ordering::SeqCst), 1);
+    }
+
+    #[tokio::test]
+    async fn repeated_response_truncation_exhausts_as_outcome_unknown() {
+        const BODY: &str = r#"{"ok":true,"data":{"executions":1}}"#;
+        let (base_url, task, state) = spawn_raw_server(vec![
+            RawReply::Truncated {
+                status: StatusCode::OK,
+                body: BODY,
+            },
+            RawReply::Truncated {
+                status: StatusCode::OK,
+                body: BODY,
+            },
+        ])
+        .await;
+        let client = GatewayClient::new(&base_url, Some("token")).expect("client");
+
+        let error = match client
+            .invoke("tools.jobs.run", json!({}), "exhausted-replay-key")
+            .await
+        {
+            Ok(_) => panic!("expected unresolved response ambiguity"),
+            Err(error) => error,
+        };
+
+        assert!(matches!(error, ClientError::OutcomeUnknown { .. }));
+        assert!(error.to_string().contains("outcome is unknown"));
+        assert!(error.to_string().contains("exhausted-replay-key"));
+        finish_raw_server(task).await;
+        let calls = state.calls.lock().expect("calls");
+        assert_eq!(calls.len(), 2);
+        assert!(
+            calls
+                .iter()
+                .all(|call| { call.idempotency_key.as_deref() == Some("exhausted-replay-key") })
+        );
+        assert_eq!(state.dispatches.load(Ordering::SeqCst), 1);
+    }
+
+    #[tokio::test]
+    async fn definitive_client_errors_are_not_retried() {
+        const BODY: &str = r#"{"error":{"code":"invalid_arguments","message":"Bad input","requestId":"request-1"}}"#;
+        let (base_url, task, state) = spawn_raw_server(vec![RawReply::Complete {
+            status: StatusCode::UNPROCESSABLE_ENTITY,
+            body: BODY,
+        }])
+        .await;
+        let client = GatewayClient::new(&base_url, Some("token")).expect("client");
+
+        let error = match client
+            .invoke("tools.jobs.run", json!({}), "definitive-error-key")
+            .await
+        {
+            Ok(_) => panic!("expected typed API error"),
+            Err(error) => error,
+        };
+
+        assert!(matches!(
+            error,
+            ClientError::Api {
+                status: StatusCode::UNPROCESSABLE_ENTITY,
+                ref code,
+                ..
+            } if code == "invalid_arguments"
+        ));
+        finish_raw_server(task).await;
+        assert_eq!(state.calls.lock().expect("calls").len(), 1);
+        assert_eq!(state.dispatches.load(Ordering::SeqCst), 0);
+    }
+
+    #[tokio::test]
+    async fn non_idempotent_mutations_are_not_retried_after_response_truncation() {
+        const BODY: &str = r#"{"id":"approval-1","status":"canceled","revision":2,"path":"tools.mail.send","createdAt":1,"updatedAt":2,"expiresAt":60,"failureCode":"canceled","result":null}"#;
+        let (base_url, task, state) = spawn_raw_server(vec![RawReply::Truncated {
+            status: StatusCode::OK,
+            body: BODY,
+        }])
+        .await;
+        let client = GatewayClient::new(&base_url, Some("token")).expect("client");
+
+        let error = client
+            .cancel_approval("approval-1", 1)
+            .await
+            .expect_err("unknown cancellation outcome");
+
+        assert!(matches!(error, ClientError::OutcomeUnknown { .. }));
+        assert!(error.to_string().contains("not automatically retried"));
+        finish_raw_server(task).await;
+        let calls = state.calls.lock().expect("calls");
+        assert_eq!(calls.len(), 1);
+        assert_eq!(calls[0].method, "DELETE");
+        assert_eq!(
+            calls[0].target,
+            "/api/v1/gateway/approvals/approval-1?expectedRevision=1"
+        );
+        assert_eq!(calls[0].idempotency_key, None);
+        assert_eq!(state.dispatches.load(Ordering::SeqCst), 1);
+    }
+
+    #[tokio::test]
+    async fn non_idempotent_mutations_preserve_unknown_outcomes_for_truncated_server_errors() {
+        const BODY: &str = r#"{"error":{"code":"internal_error","message":"Response unavailable","requestId":"request-1"}}"#;
+        let (base_url, task, state) = spawn_raw_server(vec![RawReply::Truncated {
+            status: StatusCode::INTERNAL_SERVER_ERROR,
+            body: BODY,
+        }])
+        .await;
+        let client = GatewayClient::new(&base_url, Some("token")).expect("client");
+
+        let error = client
+            .cancel_approval("approval-1", 1)
+            .await
+            .expect_err("unknown cancellation outcome");
+
+        assert!(matches!(error, ClientError::OutcomeUnknown { .. }));
+        assert!(error.to_string().contains("not automatically retried"));
+        finish_raw_server(task).await;
+        assert_eq!(state.calls.lock().expect("calls").len(), 1);
+        assert_eq!(state.dispatches.load(Ordering::SeqCst), 1);
+    }
+
+    #[tokio::test]
+    async fn query_responses_still_decode_normally() {
+        const BODY: &str = r#"{"ok":true,"data":{"sources":[{"id":"source-1"}]}}"#;
+        let (base_url, task, state) = spawn_raw_server(vec![RawReply::Complete {
+            status: StatusCode::OK,
+            body: BODY,
+        }])
+        .await;
+        let client = GatewayClient::new(&base_url, Some("token")).expect("client");
+
+        let result = client.sources().await.expect("sources query");
+
+        assert_eq!(result["data"]["sources"][0]["id"], "source-1");
+        finish_raw_server(task).await;
+        let calls = state.calls.lock().expect("calls");
+        assert_eq!(calls.len(), 1);
+        assert_eq!(calls[0].method, "GET");
+        assert_eq!(calls[0].target, "/api/v1/gateway/sources");
+        assert_eq!(calls[0].idempotency_key, None);
+    }
+}
diff --git a/src/cli/input.rs b/src/cli/input.rs
new file mode 100644
index 000000000..734ad813b
--- /dev/null
+++ b/src/cli/input.rs
@@ -0,0 +1,125 @@
+use std::{fs::File, io::Read, path::Path};
+
+use serde_json::{Map, Value};
+use thiserror::Error;
+
+pub const MAX_ARGUMENT_FILE_BYTES: usize = crate::invocation::MAX_ARGUMENT_BYTES;
+
+#[derive(Debug, Error)]
+pub enum InputError {
+    #[error("could not read arguments from {path}: {source}")]
+    Read {
+        path: String,
+        #[source]
+        source: std::io::Error,
+    },
+    #[error("tool arguments exceed the {MAX_ARGUMENT_FILE_BYTES} byte CLI limit")]
+    TooLarge,
+    #[error("tool arguments are not valid JSON: {0}")]
+    InvalidJson(#[source] serde_json::Error),
+    #[error("tool arguments must be a JSON object")]
+    NotObject,
+}
+
+pub fn parse_arguments(input: Option<&str>) -> Result<Value, InputError> {
+    let Some(input) = input else {
+        return Ok(Value::Object(Map::new()));
+    };
+    let bytes = match input.strip_prefix('@') {
+        Some(path) => read_bounded(path)?,
+        None => {
+            if input.len() > MAX_ARGUMENT_FILE_BYTES {
+                return Err(InputError::TooLarge);
+            }
+            input.as_bytes().to_vec()
+        }
+    };
+    let value: Value = serde_json::from_slice(&bytes).map_err(InputError::InvalidJson)?;
+    if value.is_object() {
+        Ok(value)
+    } else {
+        Err(InputError::NotObject)
+    }
+}
+
+fn read_bounded(path: &str) -> Result<Vec<u8>, InputError> {
+    if path.is_empty() {
+        return Err(InputError::Read {
+            path: path.to_owned(),
+            source: std::io::Error::new(
+                std::io::ErrorKind::InvalidInput,
+                "the @file path is empty",
+            ),
+        });
+    }
+    let mut file = File::open(Path::new(path)).map_err(|source| InputError::Read {
+        path: path.to_owned(),
+        source,
+    })?;
+    let mut bytes = Vec::new();
+    file.by_ref()
+        .take((MAX_ARGUMENT_FILE_BYTES + 1) as u64)
+        .read_to_end(&mut bytes)
+        .map_err(|source| InputError::Read {
+            path: path.to_owned(),
+            source,
+        })?;
+    if bytes.len() > MAX_ARGUMENT_FILE_BYTES {
+        return Err(InputError::TooLarge);
+    }
+    Ok(bytes)
+}
+
+#[cfg(test)]
+mod tests {
+    use std::io::Write;
+
+    use serde_json::json;
+
+    use super::*;
+
+    #[test]
+    fn parses_inline_file_and_default_objects() {
+        assert_eq!(parse_arguments(None).expect("default"), json!({}));
+        assert_eq!(
+            parse_arguments(Some(r#"{"message":"hello"}"#)).expect("inline"),
+            json!({"message": "hello"})
+        );
+        let mut file = tempfile::NamedTempFile::new().expect("temporary file");
+        file.write_all(br#"{"from":"file"}"#).expect("write");
+        let argument = format!("@{}", file.path().display());
+        assert_eq!(
+            parse_arguments(Some(&argument)).expect("file"),
+            json!({"from": "file"})
+        );
+    }
+
+    #[test]
+    fn rejects_invalid_non_object_and_oversized_inputs() {
+        assert!(matches!(
+            parse_arguments(Some("{")),
+            Err(InputError::InvalidJson(_))
+        ));
+        assert!(matches!(
+            parse_arguments(Some("[]")),
+            Err(InputError::NotObject)
+        ));
+        let oversized = "x".repeat(MAX_ARGUMENT_FILE_BYTES + 1);
+        assert!(matches!(
+            parse_arguments(Some(&oversized)),
+            Err(InputError::TooLarge)
+        ));
+    }
+
+    #[test]
+    fn rejects_oversized_files_without_unbounded_reads() {
+        let mut file = tempfile::NamedTempFile::new().expect("temporary file");
+        file.write_all(&vec![b'x'; MAX_ARGUMENT_FILE_BYTES + 1])
+            .expect("write");
+        let argument = format!("@{}", file.path().display());
+        assert!(matches!(
+            parse_arguments(Some(&argument)),
+            Err(InputError::TooLarge)
+        ));
+    }
+}
diff --git a/src/cli/mcp_bridge.rs b/src/cli/mcp_bridge.rs
new file mode 100644
index 000000000..c02b5db4c
--- /dev/null
+++ b/src/cli/mcp_bridge.rs
@@ -0,0 +1,1072 @@
+use std::{future::Future, io, net::SocketAddr, pin::pin, time::Duration};
+
+use anyhow::{Context, Result, bail};
+use reqwest::{Response, StatusCode, header};
+use serde_json::Value;
+use tokio::{
+    io::{AsyncBufRead, AsyncBufReadExt, AsyncRead, AsyncWrite, AsyncWriteExt, BufReader},
+    sync::mpsc,
+    task::JoinSet,
+};
+use url::Url;
+
+const PROTOCOL_VERSION: &str = "2025-11-25";
+const SESSION_HEADER: &str = "mcp-session-id";
+const MAX_MESSAGE_BYTES: usize = crate::invocation::MAX_ARGUMENT_BYTES + 64 * 1024;
+const MAX_IN_FLIGHT_REQUESTS: usize = 8;
+const MAX_IN_FLIGHT_WITH_CANCELLATION: usize = 16;
+
+pub async fn run(base_url: &str, token: Option<&str>, allow_insecure_http: bool) -> Result<()> {
+    let token = token
+        .filter(|token| !token.is_empty())
+        .ok_or_else(|| anyhow::anyhow!("EXECUTOR_API_TOKEN or --api-token is required"))?;
+    bridge(
+        base_url,
+        token,
+        allow_insecure_http,
+        tokio::io::stdin(),
+        tokio::io::stdout(),
+        shutdown_signal(),
+    )
+    .await
+}
+
+#[cfg(unix)]
+async fn shutdown_signal() {
+    let terminate = tokio::signal::unix::signal(tokio::signal::unix::SignalKind::terminate());
+    let Ok(mut terminate) = terminate else {
+        let _ = tokio::signal::ctrl_c().await;
+        return;
+    };
+    tokio::select! {
+        _ = tokio::signal::ctrl_c() => {}
+        _ = terminate.recv() => {}
+    }
+}
+
+#[cfg(not(unix))]
+async fn shutdown_signal() {
+    let _ = tokio::signal::ctrl_c().await;
+}
+
+async fn bridge<R, W, S>(
+    base_url: &str,
+    token: &str,
+    allow_insecure_http: bool,
+    input: R,
+    output: W,
+    shutdown: S,
+) -> Result<()>
+where
+    R: AsyncRead + Unpin + Send + 'static,
+    W: AsyncWrite + Unpin,
+    S: Future<Output = ()>,
+{
+    bridge_with_resolver(
+        base_url,
+        token,
+        allow_insecure_http,
+        input,
+        output,
+        shutdown,
+        super::client::resolve_system_addresses,
+    )
+    .await
+}
+
+async fn bridge_with_resolver<R, W, S, F>(
+    base_url: &str,
+    token: &str,
+    allow_insecure_http: bool,
+    input: R,
+    mut output: W,
+    shutdown: S,
+    resolver: F,
+) -> Result<()>
+where
+    R: AsyncRead + Unpin + Send + 'static,
+    W: AsyncWrite + Unpin,
+    S: Future<Output = ()>,
+    F: FnOnce(&str, u16) -> io::Result<Vec<SocketAddr>>,
+{
+    let mut endpoint =
+        super::client::normalized_base_url_with_policy(base_url, allow_insecure_http)?;
+    endpoint.set_path("mcp");
+    let builder = reqwest::Client::builder()
+        .no_proxy()
+        .redirect(reqwest::redirect::Policy::none())
+        .connect_timeout(Duration::from_secs(5));
+    let http =
+        super::client::pin_plaintext_loopback(builder, &endpoint, allow_insecure_http, resolver)?
+            .build()
+            .context("could not initialize the MCP HTTP client")?;
+    let mut session = None;
+    let result = bridge_session(
+        &http,
+        &endpoint,
+        token,
+        &mut session,
+        BufReader::new(input),
+        &mut output,
+        shutdown,
+    )
+    .await;
+    close_session(&http, &endpoint, token, session.as_deref()).await;
+    result
+}
+
+async fn bridge_session<R, W, S>(
+    http: &reqwest::Client,
+    endpoint: &Url,
+    token: &str,
+    session: &mut Option<String>,
+    mut input: BufReader<R>,
+    output: &mut W,
+    shutdown: S,
+) -> Result<()>
+where
+    R: AsyncRead + Unpin + Send + 'static,
+    W: AsyncWrite + Unpin,
+    S: Future<Output = ()>,
+{
+    let mut shutdown = pin!(shutdown);
+    let first = tokio::select! {
+        line = read_line_bounded(&mut input) => line?,
+        _ = &mut shutdown => return Ok(()),
+    };
+    let Some(first) = first else {
+        return Ok(());
+    };
+    let first = decode_stdin_message(&first)?;
+    let initialize_request = mcp_request(http, endpoint, token, None).json(&first);
+    let initialize_response = tokio::select! {
+        response = initialize_request.send() => {
+            response.context("Executor is not reachable; start `executor server` first")?
+        }
+        _ = &mut shutdown => return Ok(()),
+    };
+    *session = response_session_id(&initialize_response)?;
+    if session.is_none() {
+        bail!("the first MCP message must initialize a stateful Executor session");
+    }
+    let reply = tokio::select! {
+        reply = decode_http_response(initialize_response, token) => reply?,
+        _ = &mut shutdown => return Ok(()),
+    };
+    write_protocol_reply(output, reply.stdout).await?;
+
+    let initialized = tokio::select! {
+        line = read_line_bounded(&mut input) => line?,
+        _ = &mut shutdown => return Ok(()),
+    };
+    let Some(initialized) = initialized else {
+        return Ok(());
+    };
+    let initialized = decode_stdin_message(&initialized)?;
+    if initialized.get("method").and_then(Value::as_str) != Some("notifications/initialized")
+        || initialized.get("id").is_some()
+    {
+        bail!("MCP initialize must be followed by notifications/initialized");
+    }
+    let initialized_reply = tokio::select! {
+        reply = post_message(
+            http,
+            endpoint,
+            token,
+            session.as_deref(),
+            initialized,
+        ) => reply?,
+        _ = &mut shutdown => return Ok(()),
+    };
+    write_protocol_reply(output, initialized_reply.stdout).await?;
+
+    let (line_sender, mut lines) = mpsc::channel::<Result<Option<Vec<u8>>>>(8);
+    let reader = tokio::spawn(async move {
+        loop {
+            let line = read_line_bounded(&mut input).await;
+            let done = matches!(line, Ok(None) | Err(_));
+            if line_sender.send(line).await.is_err() || done {
+                return;
+            }
+        }
+    });
+    let mut requests = JoinSet::new();
+    loop {
+        tokio::select! {
+            _ = &mut shutdown => {
+                reader.abort();
+                requests.abort_all();
+                return Ok(());
+            }
+            line = lines.recv() => match line {
+                Some(Ok(Some(line))) => {
+                    let message = decode_stdin_message(&line)?;
+                    let is_cancellation = message.get("method").and_then(Value::as_str)
+                        == Some("notifications/cancelled");
+                    let limit = if is_cancellation {
+                        MAX_IN_FLIGHT_WITH_CANCELLATION
+                    } else {
+                        MAX_IN_FLIGHT_REQUESTS
+                    };
+                    if requests.len() >= limit {
+                        write_protocol_reply(output, overload_response(&message)?).await?;
+                        continue;
+                    }
+                    let http = http.clone();
+                    let endpoint = endpoint.clone();
+                    let token = token.to_owned();
+                    let session = session.clone().expect("session established above");
+                    requests.spawn(async move {
+                        post_message(&http, &endpoint, &token, Some(&session), message)
+                            .await
+                            .map(|reply| reply.stdout)
+                    });
+                }
+                Some(Ok(None)) | None => {
+                    reader.abort();
+                    requests.abort_all();
+                    return Ok(());
+                }
+                Some(Err(error)) => {
+                    reader.abort();
+                    requests.abort_all();
+                    return Err(error);
+                }
+            },
+            joined = requests.join_next(), if !requests.is_empty() => {
+                let reply = joined
+                    .expect("a request was active")
+                    .context("MCP forwarding task stopped unexpectedly")??;
+                write_protocol_reply(output, reply).await?;
+            }
+        }
+    }
+}
+
+struct HttpReply {
+    stdout: Option<Vec<u8>>,
+}
+
+async fn post_message(
+    http: &reqwest::Client,
+    endpoint: &Url,
+    token: &str,
+    session: Option<&str>,
+    message: Value,
+) -> Result<HttpReply> {
+    let response = mcp_request(http, endpoint, token, session)
+        .json(&message)
+        .send()
+        .await
+        .context("Executor is not reachable; start `executor server` first")?;
+    decode_http_response(response, token).await
+}
+
+fn response_session_id(response: &Response) -> Result<Option<String>> {
+    let response_session = response
+        .headers()
+        .get(SESSION_HEADER)
+        .and_then(|value| value.to_str().ok())
+        .map(str::to_owned);
+    if response_session.as_ref().is_some_and(|session| {
+        session.is_empty()
+            || session.len() > 128
+            || !session.bytes().all(|byte| (0x21..=0x7e).contains(&byte))
+    }) {
+        bail!("Executor returned an invalid MCP session ID");
+    }
+    Ok(response_session)
+}
+
+async fn decode_http_response(response: Response, token: &str) -> Result<HttpReply> {
+    let _response_session = response_session_id(&response)?;
+    let status = response.status();
+    let body = tokio::time::timeout(
+        Duration::from_secs(11 * 60),
+        read_response_bounded(response),
+    )
+    .await
+    .context("Executor MCP response timed out")??;
+    if !status.is_success() {
+        let detail = serde_json::from_slice::<Value>(&body)
+            .ok()
+            .and_then(|value| {
+                value
+                    .pointer("/error/message")
+                    .and_then(Value::as_str)
+                    .map(|message| super::client::safe_field_redacting_secret(message, token))
+            })
+            .unwrap_or_else(|| {
+                status
+                    .canonical_reason()
+                    .unwrap_or("MCP request failed")
+                    .to_owned()
+            });
+        bail!("Executor MCP request failed ({status}): {detail}");
+    }
+    let stdout = if status == StatusCode::ACCEPTED || body.is_empty() {
+        None
+    } else {
+        let response: Value =
+            serde_json::from_slice(&body).context("Executor returned invalid MCP JSON-RPC data")?;
+        Some(serde_json::to_vec(&response).context("could not encode the MCP response")?)
+    };
+    Ok(HttpReply { stdout })
+}
+
+fn decode_stdin_message(line: &[u8]) -> Result<Value> {
+    let message: Value =
+        serde_json::from_slice(line).context("stdin contained an invalid MCP JSON-RPC message")?;
+    if !message.is_object() {
+        bail!("stdin MCP messages must be JSON objects");
+    }
+    Ok(message)
+}
+
+fn overload_response(message: &Value) -> Result<Option<Vec<u8>>> {
+    let Some(id) = message.get("id") else {
+        return Ok(None);
+    };
+    let response = serde_json::json!({
+        "jsonrpc": "2.0",
+        "id": id,
+        "error": {
+            "code": -32000,
+            "message": "Executor CLI MCP bridge is busy"
+        }
+    });
+    serde_json::to_vec(&response)
+        .map(Some)
+        .context("could not encode the MCP overload response")
+}
+
+async fn write_protocol_reply(
+    output: &mut (impl AsyncWrite + Unpin),
+    reply: Option<Vec<u8>>,
+) -> Result<()> {
+    let Some(reply) = reply else {
+        return Ok(());
+    };
+    output.write_all(&reply).await?;
+    output.write_all(b"\n").await?;
+    output.flush().await?;
+    Ok(())
+}
+
+fn mcp_request(
+    http: &reqwest::Client,
+    endpoint: &Url,
+    token: &str,
+    session: Option<&str>,
+) -> reqwest::RequestBuilder {
+    let mut request = http
+        .post(endpoint.clone())
+        .bearer_auth(token)
+        .header(header::ACCEPT, "application/json, text/event-stream")
+        .header(header::CONTENT_TYPE, "application/json");
+    if let Some(session) = session {
+        request = request
+            .header(SESSION_HEADER, session)
+            .header("mcp-protocol-version", PROTOCOL_VERSION);
+    }
+    request
+}
+
+async fn close_session(http: &reqwest::Client, endpoint: &Url, token: &str, session: Option<&str>) {
+    let Some(session) = session else {
+        return;
+    };
+    let _ = http
+        .delete(endpoint.clone())
+        .bearer_auth(token)
+        .header(SESSION_HEADER, session)
+        .header("mcp-protocol-version", PROTOCOL_VERSION)
+        .timeout(Duration::from_secs(2))
+        .send()
+        .await;
+}
+
+async fn read_line_bounded(input: &mut (impl AsyncBufRead + Unpin)) -> Result<Option<Vec<u8>>> {
+    let mut line = Vec::new();
+    loop {
+        let available = input.fill_buf().await?;
+        if available.is_empty() {
+            if line.is_empty() {
+                return Ok(None);
+            }
+            return Ok(Some(line));
+        }
+        let newline = available.iter().position(|byte| *byte == b'\n');
+        let payload_take = newline.unwrap_or(available.len());
+        let take = newline.map_or(available.len(), |position| position + 1);
+        if line.len().saturating_add(payload_take) > MAX_MESSAGE_BYTES {
+            bail!("stdin MCP message exceeds the {MAX_MESSAGE_BYTES} byte limit");
+        }
+        line.extend_from_slice(&available[..take]);
+        input.consume(take);
+        if newline.is_some() {
+            line.pop();
+            if line.last() == Some(&b'\r') {
+                line.pop();
+            }
+            return Ok(Some(line));
+        }
+    }
+}
+
+async fn read_response_bounded(mut response: Response) -> Result<Vec<u8>> {
+    if response
+        .content_length()
+        .is_some_and(|length| length > MAX_MESSAGE_BYTES as u64)
+    {
+        bail!("Executor MCP response exceeds the {MAX_MESSAGE_BYTES} byte limit");
+    }
+    let mut body = Vec::new();
+    while let Some(chunk) = response.chunk().await? {
+        if body.len().saturating_add(chunk.len()) > MAX_MESSAGE_BYTES {
+            bail!("Executor MCP response exceeds the {MAX_MESSAGE_BYTES} byte limit");
+        }
+        body.extend_from_slice(&chunk);
+    }
+    Ok(body)
+}
+
+#[cfg(test)]
+mod tests {
+    use std::sync::{
+        Arc, Mutex,
+        atomic::{AtomicBool, AtomicUsize, Ordering},
+    };
+
+    use axum::{
+        Json, Router,
+        extract::State,
+        http::{HeaderMap, StatusCode},
+        response::IntoResponse,
+        routing::post,
+    };
+    use serde_json::json;
+    use tokio::io::AsyncWriteExt;
+
+    use super::*;
+
+    type CapturedRequests = Arc<Mutex<Vec<(Option<String>, Option<String>)>>>;
+
+    #[derive(Clone, Default)]
+    struct TestState {
+        deletes: Arc<Mutex<usize>>,
+        requests: CapturedRequests,
+        hold_calls: Arc<AtomicBool>,
+        release_call: Arc<tokio::sync::Notify>,
+        cancellation_seen: Arc<AtomicBool>,
+        initialized: Arc<AtomicBool>,
+    }
+
+    async fn post_mcp(
+        State(state): State<TestState>,
+        headers: HeaderMap,
+        Json(body): Json<Value>,
+    ) -> impl axum::response::IntoResponse {
+        let auth = headers
+            .get(header::AUTHORIZATION)
+            .and_then(|value| value.to_str().ok())
+            .map(str::to_owned);
+        let session = headers
+            .get(SESSION_HEADER)
+            .and_then(|value| value.to_str().ok())
+            .map(str::to_owned);
+        state
+            .requests
+            .lock()
+            .expect("requests")
+            .push((auth, session));
+        if body.get("method") == Some(&json!("tools/call"))
+            && state.hold_calls.load(Ordering::SeqCst)
+        {
+            state.release_call.notified().await;
+        }
+        if body.get("method") == Some(&json!("notifications/cancelled")) {
+            state.cancellation_seen.store(true, Ordering::SeqCst);
+        }
+        if body.get("method") == Some(&json!("initialize")) {
+            let mut response = Json(json!({
+                "jsonrpc": "2.0",
+                "id": body["id"],
+                "result": {"protocolVersion": PROTOCOL_VERSION}
+            }))
+            .into_response();
+            response
+                .headers_mut()
+                .insert(SESSION_HEADER, "session-1".parse().expect("header"));
+            response
+        } else if body.get("method") == Some(&json!("notifications/initialized")) {
+            state.initialized.store(true, Ordering::SeqCst);
+            StatusCode::ACCEPTED.into_response()
+        } else if !state.initialized.load(Ordering::SeqCst) {
+            StatusCode::BAD_REQUEST.into_response()
+        } else if body.get("id").is_none() {
+            StatusCode::ACCEPTED.into_response()
+        } else {
+            Json(json!({"jsonrpc": "2.0", "id": body["id"], "result": {}})).into_response()
+        }
+    }
+
+    async fn delete_mcp(State(state): State<TestState>) -> StatusCode {
+        *state.deletes.lock().expect("deletes") += 1;
+        StatusCode::NO_CONTENT
+    }
+
+    #[tokio::test]
+    async fn bridge_keeps_protocol_stdout_clean_and_closes_the_session() {
+        let state = TestState::default();
+        let router = Router::new()
+            .route("/mcp", post(post_mcp).delete(delete_mcp))
+            .with_state(state.clone());
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("listener");
+        let address = listener.local_addr().expect("address");
+        let server = tokio::spawn(async move {
+            axum::serve(listener, router).await.expect("server");
+        });
+        let (mut writer, reader) = tokio::io::duplex(4096);
+        writer
+            .write_all(
+                concat!(
+                    "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{}}\n",
+                    "{\"jsonrpc\":\"2.0\",\"method\":\"notifications/initialized\"}\n",
+                    "{\"jsonrpc\":\"2.0\",\"id\":2,\"method\":\"ping\"}\n"
+                )
+                .as_bytes(),
+            )
+            .await
+            .expect("input");
+        let output = VecWriter::default();
+        let captured = output.bytes.clone();
+        let bridge_task = tokio::spawn(async move {
+            bridge(
+                &format!("http://{address}"),
+                "secret-token",
+                false,
+                reader,
+                output,
+                std::future::pending(),
+            )
+            .await
+        });
+        tokio::time::timeout(Duration::from_secs(2), async {
+            loop {
+                if captured
+                    .lock()
+                    .expect("output")
+                    .iter()
+                    .filter(|byte| **byte == b'\n')
+                    .count()
+                    == 2
+                {
+                    return;
+                }
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .expect("responses");
+        writer.shutdown().await.expect("EOF");
+        bridge_task.await.expect("bridge task").expect("bridge");
+        let output = String::from_utf8(captured.lock().expect("output").clone()).expect("UTF-8");
+        let lines = output.lines().collect::<Vec<_>>();
+        assert_eq!(lines.len(), 2, "notifications must not produce stdout");
+        assert!(
+            lines
+                .iter()
+                .all(|line| serde_json::from_str::<Value>(line).is_ok())
+        );
+        let requests = state.requests.lock().expect("requests");
+        assert_eq!(requests[0], (Some("Bearer secret-token".to_owned()), None));
+        assert_eq!(
+            requests[1],
+            (
+                Some("Bearer secret-token".to_owned()),
+                Some("session-1".to_owned())
+            )
+        );
+        drop(requests);
+        assert_eq!(*state.deletes.lock().expect("deletes"), 1);
+        server.abort();
+    }
+
+    #[tokio::test]
+    async fn bridge_requires_a_running_server_without_polluting_stdout() {
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("listener");
+        let address = listener.local_addr().expect("address");
+        drop(listener);
+        let input = std::io::Cursor::new(
+            b"{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{}}\n".to_vec(),
+        );
+        let output = VecWriter::default();
+        let captured = output.bytes.clone();
+        let error = bridge(
+            &format!("http://{address}"),
+            "token",
+            false,
+            input,
+            output,
+            std::future::pending(),
+        )
+        .await
+        .expect_err("server is stopped");
+        assert!(error.to_string().contains("start `executor server` first"));
+        assert!(captured.lock().expect("output").is_empty());
+    }
+
+    #[tokio::test]
+    async fn bridge_rejects_poisoned_localhost_before_a_bearer_request() {
+        let input = std::io::Cursor::new(
+            b"{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{}}\n".to_vec(),
+        );
+        let output = VecWriter::default();
+        let captured = Arc::clone(&output.bytes);
+        let resolutions = Arc::new(AtomicUsize::new(0));
+        let resolver_calls = Arc::clone(&resolutions);
+
+        let error = bridge_with_resolver(
+            "http://poison.localhost:4788",
+            "top-secret-token",
+            false,
+            input,
+            output,
+            std::future::pending(),
+            move |hostname, port| {
+                resolver_calls.fetch_add(1, Ordering::SeqCst);
+                assert_eq!(hostname, "poison.localhost");
+                Ok(vec![
+                    SocketAddr::from(([127, 0, 0, 1], port)),
+                    SocketAddr::from(([203, 0, 113, 10], port)),
+                ])
+            },
+        )
+        .await
+        .expect_err("poisoned resolution");
+
+        assert_eq!(resolutions.load(Ordering::SeqCst), 1);
+        assert!(captured.lock().expect("output").is_empty());
+        assert!(error.to_string().contains("loopback"));
+        assert!(!error.to_string().contains("top-secret-token"));
+    }
+
+    #[tokio::test]
+    async fn bridge_pins_resolved_localhost_before_forwarding_bearer_tokens() {
+        let state = TestState::default();
+        let router = Router::new()
+            .route("/mcp", post(post_mcp).delete(delete_mcp))
+            .with_state(state.clone());
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("listener");
+        let address = listener.local_addr().expect("address");
+        let server = tokio::spawn(async move {
+            axum::serve(listener, router).await.expect("server");
+        });
+        let input = std::io::Cursor::new(
+            concat!(
+                "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{}}\n",
+                "{\"jsonrpc\":\"2.0\",\"method\":\"notifications/initialized\"}\n"
+            )
+            .as_bytes()
+            .to_vec(),
+        );
+        let output = VecWriter::default();
+        let captured = Arc::clone(&output.bytes);
+
+        bridge_with_resolver(
+            &format!("http://bridge.localhost:{}/", address.port()),
+            "pinned-secret",
+            false,
+            input,
+            output,
+            std::future::pending(),
+            move |hostname, port| {
+                assert_eq!(hostname, "bridge.localhost");
+                assert_eq!(port, address.port());
+                Ok(vec![address])
+            },
+        )
+        .await
+        .expect("pinned bridge");
+
+        assert_eq!(
+            String::from_utf8(captured.lock().expect("output").clone())
+                .expect("UTF-8")
+                .lines()
+                .count(),
+            1
+        );
+        let requests = state.requests.lock().expect("requests");
+        assert_eq!(
+            requests.first().and_then(|request| request.0.as_deref()),
+            Some("Bearer pinned-secret")
+        );
+        drop(requests);
+        assert_eq!(*state.deletes.lock().expect("deletes"), 1);
+        server.abort();
+    }
+
+    #[tokio::test]
+    async fn bridge_bearer_requests_never_follow_redirects() {
+        async fn redirect(State(location): State<String>, headers: HeaderMap) -> impl IntoResponse {
+            assert_eq!(
+                headers
+                    .get(header::AUTHORIZATION)
+                    .and_then(|value| value.to_str().ok()),
+                Some("Bearer redirect-secret")
+            );
+            (
+                StatusCode::TEMPORARY_REDIRECT,
+                [(header::LOCATION, location)],
+            )
+        }
+
+        let target = tokio::net::TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("redirect target listener");
+        let target_address = target.local_addr().expect("target address");
+        let router = Router::new()
+            .route("/mcp", post(redirect))
+            .with_state(format!("http://{target_address}/steal"));
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("redirect server listener");
+        let address = listener.local_addr().expect("redirect server address");
+        let server = tokio::spawn(async move {
+            axum::serve(listener, router).await.expect("server");
+        });
+        let input = std::io::Cursor::new(
+            b"{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{}}\n".to_vec(),
+        );
+        let output = VecWriter::default();
+        let captured = Arc::clone(&output.bytes);
+
+        let error = bridge(
+            &format!("http://{address}"),
+            "redirect-secret",
+            false,
+            input,
+            output,
+            std::future::pending(),
+        )
+        .await
+        .expect_err("redirect must not be followed");
+
+        assert!(captured.lock().expect("output").is_empty());
+        assert!(!error.to_string().contains("redirect-secret"));
+        assert!(
+            tokio::time::timeout(Duration::from_millis(100), target.accept())
+                .await
+                .is_err(),
+            "redirect target received a bearer-bearing request"
+        );
+        server.abort();
+    }
+
+    #[tokio::test]
+    async fn bridge_error_messages_cannot_reflect_the_bearer_token() {
+        async fn reflected(headers: HeaderMap) -> impl IntoResponse {
+            assert_eq!(
+                headers
+                    .get(header::AUTHORIZATION)
+                    .and_then(|value| value.to_str().ok()),
+                Some("Bearer secret-reflection-token")
+            );
+            let mut response = (
+                StatusCode::BAD_REQUEST,
+                Json(json!({
+                    "error": {
+                        "message": "Bearer secret-reflection-token was rejected"
+                    }
+                })),
+            )
+                .into_response();
+            response
+                .headers_mut()
+                .insert(SESSION_HEADER, "session-1".parse().expect("session header"));
+            response
+        }
+        async fn close() -> StatusCode {
+            StatusCode::NO_CONTENT
+        }
+
+        let router = Router::new().route("/mcp", post(reflected).delete(close));
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("listener");
+        let address = listener.local_addr().expect("address");
+        let server = tokio::spawn(async move {
+            axum::serve(listener, router).await.expect("server");
+        });
+        let input = std::io::Cursor::new(
+            b"{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{}}\n".to_vec(),
+        );
+
+        let error = bridge(
+            &format!("http://{address}"),
+            "secret-reflection-token",
+            false,
+            input,
+            VecWriter::default(),
+            std::future::pending(),
+        )
+        .await
+        .expect_err("reflected MCP error");
+
+        let rendered = error.to_string();
+        assert!(!rendered.contains("secret-reflection-token"));
+        assert!(rendered.contains("[redacted]"));
+        server.abort();
+    }
+
+    #[tokio::test]
+    async fn bridge_closes_session_after_malformed_post_initialize_input() {
+        let state = TestState::default();
+        let router = Router::new()
+            .route("/mcp", post(post_mcp).delete(delete_mcp))
+            .with_state(state.clone());
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("listener");
+        let address = listener.local_addr().expect("address");
+        let server = tokio::spawn(async move {
+            axum::serve(listener, router).await.expect("server");
+        });
+        let input = std::io::Cursor::new(
+            concat!(
+                "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{}}\n",
+                "not-json\n"
+            )
+            .as_bytes()
+            .to_vec(),
+        );
+        let error = bridge(
+            &format!("http://{address}"),
+            "token",
+            false,
+            input,
+            VecWriter::default(),
+            std::future::pending(),
+        )
+        .await
+        .expect_err("malformed input");
+        assert!(error.to_string().contains("invalid MCP JSON-RPC"));
+        assert_eq!(*state.deletes.lock().expect("deletes"), 1);
+        server.abort();
+    }
+
+    #[tokio::test]
+    async fn bridge_shutdown_signal_closes_session_without_stdout_noise() {
+        let state = TestState::default();
+        let router = Router::new()
+            .route("/mcp", post(post_mcp).delete(delete_mcp))
+            .with_state(state.clone());
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("listener");
+        let address = listener.local_addr().expect("address");
+        let server = tokio::spawn(async move {
+            axum::serve(listener, router).await.expect("server");
+        });
+        let (mut writer, input) = tokio::io::duplex(4096);
+        writer
+            .write_all(
+                concat!(
+                    "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{}}\n",
+                    "{\"jsonrpc\":\"2.0\",\"method\":\"notifications/initialized\"}\n"
+                )
+                .as_bytes(),
+            )
+            .await
+            .expect("handshake");
+        let output = VecWriter::default();
+        let captured = output.bytes.clone();
+        let (shutdown, shutdown_requested) = tokio::sync::oneshot::channel();
+        let bridge_task = tokio::spawn(async move {
+            bridge(
+                &format!("http://{address}"),
+                "token",
+                false,
+                input,
+                output,
+                async {
+                    let _ = shutdown_requested.await;
+                },
+            )
+            .await
+        });
+        tokio::time::timeout(Duration::from_secs(2), async {
+            loop {
+                if state.initialized.load(Ordering::SeqCst) {
+                    return;
+                }
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .expect("session initialization");
+        shutdown.send(()).expect("shutdown receiver");
+        bridge_task.await.expect("bridge task").expect("bridge");
+        assert_eq!(*state.deletes.lock().expect("deletes"), 1);
+        let output = String::from_utf8(captured.lock().expect("output").clone()).expect("UTF-8");
+        assert_eq!(
+            output.lines().count(),
+            1,
+            "only initialize may reach stdout"
+        );
+        server.abort();
+    }
+
+    #[tokio::test]
+    async fn bridge_forwards_cancellation_while_another_request_is_open() {
+        let state = TestState::default();
+        state.hold_calls.store(true, Ordering::SeqCst);
+        let router = Router::new()
+            .route("/mcp", post(post_mcp).delete(delete_mcp))
+            .with_state(state.clone());
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("listener");
+        let address = listener.local_addr().expect("address");
+        let server = tokio::spawn(async move {
+            axum::serve(listener, router).await.expect("server");
+        });
+        let (mut writer, input) = tokio::io::duplex(4096);
+        writer
+            .write_all(concat!(
+                "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{}}\n",
+                "{\"jsonrpc\":\"2.0\",\"method\":\"notifications/initialized\"}\n",
+                "{\"jsonrpc\":\"2.0\",\"id\":2,\"method\":\"tools/call\",\"params\":{}}\n",
+                "{\"jsonrpc\":\"2.0\",\"method\":\"notifications/cancelled\",\"params\":{\"requestId\":2}}\n"
+            )
+            .as_bytes())
+            .await
+            .expect("input");
+        let bridge_task = tokio::spawn(async move {
+            bridge(
+                &format!("http://{address}"),
+                "token",
+                false,
+                input,
+                VecWriter::default(),
+                std::future::pending(),
+            )
+            .await
+        });
+        tokio::time::timeout(Duration::from_secs(2), async {
+            loop {
+                if state.cancellation_seen.load(Ordering::SeqCst) {
+                    return;
+                }
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .expect("cancellation notification should not wait for the tool call");
+        state.release_call.notify_waiters();
+        writer.shutdown().await.expect("EOF");
+        bridge_task.await.expect("bridge task").expect("bridge");
+        server.abort();
+    }
+
+    #[tokio::test]
+    async fn overload_does_not_block_the_reserved_cancellation_lane() {
+        let state = TestState::default();
+        state.hold_calls.store(true, Ordering::SeqCst);
+        let router = Router::new()
+            .route("/mcp", post(post_mcp).delete(delete_mcp))
+            .with_state(state.clone());
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("listener");
+        let address = listener.local_addr().expect("address");
+        let server = tokio::spawn(async move {
+            axum::serve(listener, router).await.expect("server");
+        });
+        let (mut writer, input) = tokio::io::duplex(16 * 1024);
+        writer
+            .write_all(
+                b"{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{}}\n{\"jsonrpc\":\"2.0\",\"method\":\"notifications/initialized\"}\n",
+            )
+            .await
+            .expect("handshake");
+        for id in 2..=10 {
+            writer
+                .write_all(
+                    format!(
+                        "{{\"jsonrpc\":\"2.0\",\"id\":{id},\"method\":\"tools/call\",\"params\":{{}}}}\n"
+                    )
+                    .as_bytes(),
+                )
+                .await
+                .expect("call");
+        }
+        writer
+            .write_all(
+                b"{\"jsonrpc\":\"2.0\",\"method\":\"notifications/cancelled\",\"params\":{\"requestId\":2}}\n",
+            )
+            .await
+            .expect("cancellation");
+        let bridge_task = tokio::spawn(async move {
+            bridge(
+                &format!("http://{address}"),
+                "token",
+                false,
+                input,
+                VecWriter::default(),
+                std::future::pending(),
+            )
+            .await
+        });
+        tokio::time::timeout(Duration::from_secs(2), async {
+            loop {
+                if state.cancellation_seen.load(Ordering::SeqCst) {
+                    return;
+                }
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .expect("cancellation must bypass the saturated regular lane");
+        writer.shutdown().await.expect("EOF");
+        bridge_task.await.expect("bridge task").expect("bridge");
+        server.abort();
+    }
+
+    #[derive(Clone, Default)]
+    struct VecWriter {
+        bytes: Arc<Mutex<Vec<u8>>>,
+    }
+
+    impl AsyncWrite for VecWriter {
+        fn poll_write(
+            self: std::pin::Pin<&mut Self>,
+            _context: &mut std::task::Context<'_>,
+            buffer: &[u8],
+        ) -> std::task::Poll<std::io::Result<usize>> {
+            self.bytes.lock().expect("output").extend_from_slice(buffer);
+            std::task::Poll::Ready(Ok(buffer.len()))
+        }
+
+        fn poll_flush(
+            self: std::pin::Pin<&mut Self>,
+            _context: &mut std::task::Context<'_>,
+        ) -> std::task::Poll<std::io::Result<()>> {
+            std::task::Poll::Ready(Ok(()))
+        }
+
+        fn poll_shutdown(
+            self: std::pin::Pin<&mut Self>,
+            _context: &mut std::task::Context<'_>,
+        ) -> std::task::Poll<std::io::Result<()>> {
+            std::task::Poll::Ready(Ok(()))
+        }
+    }
+}
diff --git a/src/cli/mod.rs b/src/cli/mod.rs
new file mode 100644
index 000000000..276524c8f
--- /dev/null
+++ b/src/cli/mod.rs
@@ -0,0 +1,447 @@
+mod client;
+mod input;
+mod mcp_bridge;
+mod output;
+mod terminal;
+
+use std::{
+    io,
+    process::{Command, Stdio},
+    time::Duration,
+    time::{SystemTime, UNIX_EPOCH},
+};
+
+use anyhow::{Context, Result, bail};
+use clap::{Args, Subcommand};
+use serde_json::Value;
+use tokio::time::sleep;
+use uuid::Uuid;
+
+pub use client::normalized_base_url;
+use client::{GatewayClient, InvokeResponse};
+use input::parse_arguments;
+
+pub const DEFAULT_BASE_URL: &str = crate::DEFAULT_ORIGIN;
+
+#[derive(Clone, Debug)]
+pub struct ConnectionOptions {
+    pub base_url: String,
+    pub api_token: Option<String>,
+    pub json: bool,
+    pub allow_insecure_http: bool,
+}
+
+#[derive(Args, Debug)]
+pub struct CallArgs {
+    #[arg(required = true, num_args = 1.., value_name = "PATH [PATH] [JSON-OR-@FILE]")]
+    pub values: Vec<String>,
+}
+
+#[derive(Args, Debug)]
+pub struct ToolsArgs {
+    #[command(subcommand)]
+    pub command: ToolsCommand,
+}
+
+#[derive(Subcommand, Debug)]
+pub enum ToolsCommand {
+    Search(SearchArgs),
+    Describe(DescribeArgs),
+    Sources,
+}
+
+#[derive(Args, Debug)]
+pub struct SearchArgs {
+    pub query: String,
+    #[arg(long)]
+    pub namespace: Option<String>,
+    #[arg(long, default_value_t = 12, value_parser = clap::value_parser!(u32).range(1..=100))]
+    pub limit: u32,
+    #[arg(long, default_value_t = 0)]
+    pub offset: u32,
+}
+
+#[derive(Args, Debug)]
+pub struct DescribeArgs {
+    #[arg(required = true, num_args = 1..=2, value_name = "PATH [PATH]")]
+    pub path: Vec<String>,
+}
+
+pub async fn call(options: ConnectionOptions, args: CallArgs) -> Result<()> {
+    let (path, input) = split_call_values(&args.values)?;
+    let arguments = parse_arguments(input).context("invalid tool arguments")?;
+    let client = client(&options)?;
+    let idempotency_key = Uuid::new_v4().to_string();
+    match client.invoke(&path, arguments, &idempotency_key).await? {
+        InvokeResponse::Complete(value) => print_call(&value, options.json)?,
+        InvokeResponse::ApprovalRequired(pending) => {
+            let approval_url = approval_dashboard_url(&client, &pending.approval.id)?;
+            eprintln!(
+                "Approval required for {}.",
+                terminal::safe_field(&pending.approval.path)
+            );
+            eprintln!("Review it at: {approval_url}");
+            let _ = try_open(&approval_url);
+            let value = wait_for_approval(
+                &client,
+                &pending.approval.id,
+                pending.approval.revision,
+                pending.approval.expires_at,
+            )
+            .await?;
+            print_call(&value, options.json)?;
+        }
+    }
+    Ok(())
+}
+
+pub async fn tools(options: ConnectionOptions, args: ToolsArgs) -> Result<()> {
+    let client = client(&options)?;
+    let value = match &args.command {
+        ToolsCommand::Search(args) => {
+            client
+                .search(
+                    &args.query,
+                    args.namespace.as_deref(),
+                    args.limit,
+                    args.offset,
+                )
+                .await?
+        }
+        ToolsCommand::Describe(args) => {
+            let path = normalize_path(&args.path)?;
+            client.describe(&path).await?
+        }
+        ToolsCommand::Sources => client.sources().await?,
+    };
+    if options.json {
+        output::write_json(io::stdout().lock(), &value)?;
+        return Ok(());
+    }
+    match &args.command {
+        ToolsCommand::Search(_) => output::write_search_human(io::stdout().lock(), &value)?,
+        ToolsCommand::Describe(_) => output::write_describe_human(io::stdout().lock(), &value)?,
+        ToolsCommand::Sources => output::write_sources_human(io::stdout().lock(), &value)?,
+    }
+    Ok(())
+}
+
+pub async fn mcp(options: ConnectionOptions) -> Result<()> {
+    if options.json {
+        bail!("--json is not valid with the MCP stdio bridge");
+    }
+    mcp_bridge::run(
+        &options.base_url,
+        options.api_token.as_deref(),
+        options.allow_insecure_http,
+    )
+    .await
+}
+
+pub fn open(options: &ConnectionOptions) -> Result<()> {
+    let url =
+        client::normalized_base_url_with_policy(&options.base_url, options.allow_insecure_http)?;
+    println!("Opening {url}");
+    try_open(url.as_str())
+        .with_context(|| format!("could not open a browser; copy this URL instead: {url}"))
+}
+
+fn client(options: &ConnectionOptions) -> Result<GatewayClient> {
+    GatewayClient::new_with_policy(
+        &options.base_url,
+        options.api_token.as_deref(),
+        options.allow_insecure_http,
+    )
+    .map_err(Into::into)
+}
+
+fn split_call_values(values: &[String]) -> Result<(String, Option<&str>)> {
+    let (path_values, input) = match values {
+        [] => bail!("a tool path is required"),
+        [path] => (std::slice::from_ref(path), None),
+        [path, input] if path.contains('.') || path.contains('/') || looks_like_json(input) => {
+            (std::slice::from_ref(path), Some(input.as_str()))
+        }
+        [_, _] => (&values[..2], None),
+        [source, tool, input] => {
+            let _ = (source, tool);
+            (&values[..2], Some(input.as_str()))
+        }
+        _ => bail!("use a dotted path, or two path segments, followed by one JSON argument"),
+    };
+    Ok((normalize_path(path_values)?, input))
+}
+
+fn looks_like_json(value: &str) -> bool {
+    let value = value.trim_start();
+    value.starts_with('{') || value.starts_with('@')
+}
+
+pub fn normalize_path(values: &[String]) -> Result<String> {
+    let segments: Vec<&str> = match values {
+        [path] => path
+            .strip_prefix("tools.")
+            .unwrap_or(path)
+            .split(['.', '/'])
+            .collect(),
+        [source, tool] => vec![source, tool],
+        _ => bail!("tool paths must be dotted or contain exactly two segments"),
+    };
+    if segments.len() != 2 || segments.iter().any(|segment| !valid_segment(segment)) {
+        bail!("tool paths must look like source.tool or source tool");
+    }
+    Ok(format!("tools.{}.{}", segments[0], segments[1]))
+}
+
+fn valid_segment(segment: &str) -> bool {
+    let mut characters = segment.chars();
+    characters
+        .next()
+        .is_some_and(|character| character.is_ascii_lowercase())
+        && characters.all(|character| {
+            character.is_ascii_lowercase() || character.is_ascii_digit() || character == '_'
+        })
+}
+
+fn approval_dashboard_url(client: &GatewayClient, approval_id: &str) -> Result<String> {
+    let mut url = client.dashboard_url();
+    url.set_path("approvals");
+    url.query_pairs_mut().append_pair("approval", approval_id);
+    Ok(url.to_string())
+}
+
+async fn wait_for_approval(
+    client: &GatewayClient,
+    approval_id: &str,
+    mut revision: i64,
+    mut expires_at: i64,
+) -> Result<Value> {
+    let interrupt = tokio::signal::ctrl_c();
+    tokio::pin!(interrupt);
+    loop {
+        if unix_timestamp() >= expires_at.saturating_add(2) {
+            bail!("tool approval expired while waiting");
+        }
+        let detail = tokio::select! {
+            detail = client.approval(approval_id) => detail?,
+            interrupt = &mut interrupt => {
+                interrupt.context("could not listen for Ctrl-C")?;
+                return cancel_waiting_approval(client, approval_id, revision).await;
+            }
+        };
+        revision = detail.revision;
+        expires_at = detail.expires_at;
+        match detail.status.as_str() {
+            "pending" | "approved" | "executing" => {
+                tokio::select! {
+                    _ = sleep(Duration::from_millis(750)) => {}
+                    interrupt = &mut interrupt => {
+                        interrupt.context("could not listen for Ctrl-C")?;
+                        return cancel_waiting_approval(client, approval_id, revision).await;
+                    }
+                }
+            }
+            "succeeded" => {
+                return detail
+                    .result
+                    .ok_or_else(|| anyhow::anyhow!("approval succeeded without a tool result"));
+            }
+            "failed" if detail.result.is_some() => {
+                return Ok(detail.result.expect("checked result"));
+            }
+            "denied" | "canceled" | "expired" | "failed" | "stale" | "interrupted" => {
+                let code = detail.failure_code.unwrap_or_else(|| detail.status.clone());
+                bail!(
+                    "tool call ended with status {} ({})",
+                    terminal::safe_field(&detail.status),
+                    terminal::safe_field(&code)
+                );
+            }
+            status => bail!(
+                "Executor returned an unknown approval status: {}",
+                terminal::safe_field(status)
+            ),
+        }
+    }
+}
+
+async fn cancel_waiting_approval(
+    client: &GatewayClient,
+    approval_id: &str,
+    revision: i64,
+) -> Result<Value> {
+    let cancellation = tokio::time::timeout(
+        Duration::from_secs(5),
+        client.cancel_approval(approval_id, revision),
+    )
+    .await;
+    match cancellation {
+        Err(_) => bail!("interrupted while waiting for approval; cancellation timed out"),
+        Ok(Ok(_)) => bail!("approval canceled"),
+        Ok(Err(cancel_error)) => {
+            match tokio::time::timeout(Duration::from_secs(5), client.approval(approval_id)).await {
+                Ok(Ok(detail))
+                    if matches!(
+                        detail.status.as_str(),
+                        "denied" | "canceled" | "expired" | "failed" | "stale" | "interrupted"
+                    ) =>
+                {
+                    bail!(
+                        "tool call ended with status {}",
+                        terminal::safe_field(&detail.status)
+                    )
+                }
+                Ok(Ok(detail)) if detail.status == "succeeded" && detail.result.is_some() => {
+                    Ok(detail.result.expect("checked result"))
+                }
+                _ => {
+                    bail!(
+                        "interrupted while waiting for approval; cancellation failed: {cancel_error}"
+                    )
+                }
+            }
+        }
+    }
+}
+
+fn unix_timestamp() -> i64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_secs() as i64
+}
+
+fn print_call(value: &Value, json_output: bool) -> Result<()> {
+    if json_output {
+        output::write_json(io::stdout().lock(), value)?;
+    } else {
+        output::write_call_human(io::stdout().lock(), value)?;
+    }
+    Ok(())
+}
+
+fn try_open(url: &str) -> Result<()> {
+    #[cfg(target_os = "macos")]
+    let mut command = Command::new("open");
+    #[cfg(target_os = "linux")]
+    let mut command = Command::new("xdg-open");
+    #[cfg(not(any(target_os = "macos", target_os = "linux")))]
+    bail!("opening a browser is only supported on Linux and macOS");
+
+    #[cfg(any(target_os = "macos", target_os = "linux"))]
+    {
+        command
+            .arg(url)
+            .stdin(Stdio::null())
+            .stdout(Stdio::null())
+            .stderr(Stdio::null())
+            .spawn()
+            .context("the platform browser opener is unavailable")?;
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use axum::{Json, Router, routing::get};
+    use serde_json::json;
+
+    use super::*;
+
+    #[test]
+    fn accepts_dotted_prefixed_slash_and_segmented_paths() {
+        for (input, expected) in [
+            (vec!["github.issues_create"], "tools.github.issues_create"),
+            (
+                vec!["tools.github.issues_create"],
+                "tools.github.issues_create",
+            ),
+            (vec!["github/issues_create"], "tools.github.issues_create"),
+            (
+                vec!["github", "issues_create"],
+                "tools.github.issues_create",
+            ),
+        ] {
+            let input = input.into_iter().map(str::to_owned).collect::<Vec<_>>();
+            assert_eq!(normalize_path(&input).expect("valid path"), expected);
+        }
+        assert!(normalize_path(&["Github.bad".to_owned()]).is_err());
+        assert!(normalize_path(&["three.part.path".to_owned()]).is_err());
+    }
+
+    #[test]
+    fn splits_call_path_and_optional_arguments_without_ambiguity() {
+        let values = vec!["github".to_owned(), "issues_create".to_owned()];
+        let (path, input) = split_call_values(&values).expect("segmented call");
+        assert_eq!(path, "tools.github.issues_create");
+        assert_eq!(input, None);
+
+        let values = vec!["github.issues_create".to_owned(), "{}".to_owned()];
+        let (path, input) = split_call_values(&values).expect("dotted call");
+        assert_eq!(path, "tools.github.issues_create");
+        assert_eq!(input, Some("{}"));
+    }
+
+    #[test]
+    fn approval_dashboard_url_contains_no_api_token() {
+        let client =
+            GatewayClient::new("http://localhost:4788", Some("top-secret")).expect("client");
+        let url = approval_dashboard_url(&client, "approval-1").expect("URL");
+        assert_eq!(url, "http://localhost:4788/approvals?approval=approval-1");
+        assert!(!url.contains("top-secret"));
+    }
+
+    #[test]
+    fn approval_json_shape_is_preserved() {
+        let value = json!({"status": "succeeded", "result": {"ok": true}});
+        let mut output = Vec::new();
+        output::write_json(&mut output, &value).expect("output");
+        assert_eq!(
+            serde_json::from_slice::<Value>(&output).expect("JSON"),
+            value
+        );
+    }
+
+    #[tokio::test]
+    async fn approval_wait_preserves_succeeded_and_failed_tool_results() {
+        async fn succeeded() -> Json<Value> {
+            Json(json!({
+                "id": "approval-1", "status": "succeeded", "revision": 2,
+                "path": "tools.mail.send", "createdAt": 1,
+                "updatedAt": 2, "expiresAt": unix_timestamp() + 60,
+                "failureCode": null,
+                "result": {"ok": true, "data": {"sent": true}}
+            }))
+        }
+        async fn failed() -> Json<Value> {
+            Json(json!({
+                "id": "approval-2", "status": "failed", "revision": 2,
+                "path": "tools.mail.send", "createdAt": 1,
+                "updatedAt": 2, "expiresAt": unix_timestamp() + 60,
+                "failureCode": "upstream_failed",
+                "result": {"ok": false, "data": null, "error": {"code": "upstream_failed", "message": "Nope"}}
+            }))
+        }
+        let router = Router::new()
+            .route("/api/v1/gateway/approvals/approval-1", get(succeeded))
+            .route("/api/v1/gateway/approvals/approval-2", get(failed));
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("listener");
+        let address = listener.local_addr().expect("address");
+        let server = tokio::spawn(async move {
+            axum::serve(listener, router).await.expect("server");
+        });
+        let client =
+            GatewayClient::new(&format!("http://{address}"), Some("token")).expect("client");
+        let success = wait_for_approval(&client, "approval-1", 0, unix_timestamp() + 60)
+            .await
+            .expect("success");
+        assert_eq!(success["data"]["sent"], true);
+        let failure = wait_for_approval(&client, "approval-2", 0, unix_timestamp() + 60)
+            .await
+            .expect("public failure result");
+        assert_eq!(failure["error"]["code"], "upstream_failed");
+        server.abort();
+    }
+}
diff --git a/src/cli/output.rs b/src/cli/output.rs
new file mode 100644
index 000000000..1cbd83c04
--- /dev/null
+++ b/src/cli/output.rs
@@ -0,0 +1,145 @@
+use std::io::{self, Write};
+
+use serde_json::Value;
+
+use super::terminal::safe_field;
+
+pub fn write_json(mut output: impl Write, value: &Value) -> io::Result<()> {
+    serde_json::to_writer_pretty(&mut output, value)?;
+    writeln!(output)
+}
+
+pub fn write_call_human(output: impl Write, value: &Value) -> io::Result<()> {
+    if value.get("ok") == Some(&Value::Bool(true))
+        && let Some(data) = value.get("data")
+    {
+        return write_json(output, data);
+    }
+    write_json(output, value)
+}
+
+pub fn write_search_human(mut output: impl Write, value: &Value) -> io::Result<()> {
+    let Some(items) = value.get("items").and_then(Value::as_array) else {
+        return write_json(output, value);
+    };
+    if items.is_empty() {
+        return writeln!(output, "No tools found.");
+    }
+    for item in items {
+        let path = item
+            .get("path")
+            .and_then(Value::as_str)
+            .unwrap_or("unknown");
+        let approval = item
+            .get("requiresApproval")
+            .and_then(Value::as_bool)
+            .unwrap_or(false);
+        writeln!(
+            output,
+            "{}{}",
+            safe_field(path),
+            if approval {
+                "  [approval required]"
+            } else {
+                ""
+            }
+        )?;
+        if let Some(description) = item.get("description").and_then(Value::as_str) {
+            writeln!(output, "  {}", safe_field(description))?;
+        }
+    }
+    if value
+        .get("hasMore")
+        .and_then(Value::as_bool)
+        .unwrap_or(false)
+    {
+        writeln!(
+            output,
+            "More results are available. Use --offset to continue."
+        )?;
+    }
+    Ok(())
+}
+
+pub fn write_describe_human(mut output: impl Write, value: &Value) -> io::Result<()> {
+    let path = value
+        .get("path")
+        .and_then(Value::as_str)
+        .unwrap_or("unknown");
+    writeln!(output, "{}", safe_field(path))?;
+    if let Some(description) = value.get("description").and_then(Value::as_str) {
+        writeln!(output, "{}", safe_field(description))?;
+    }
+    if let Some(mode) = value.pointer("/effectiveMode/mode").and_then(Value::as_str) {
+        writeln!(output, "Mode: {}", safe_field(mode))?;
+    }
+    if let Some(input) = value.get("inputSchema") {
+        writeln!(output, "Input:")?;
+        serde_json::to_writer_pretty(&mut output, input)?;
+        writeln!(output)?;
+    }
+    Ok(())
+}
+
+pub fn write_sources_human(mut output: impl Write, value: &Value) -> io::Result<()> {
+    let Some(sources) = value.get("sources").and_then(Value::as_array) else {
+        return write_json(output, value);
+    };
+    if sources.is_empty() {
+        return writeln!(output, "No sources connected.");
+    }
+    for source in sources {
+        let slug = source
+            .get("slug")
+            .and_then(Value::as_str)
+            .unwrap_or("unknown");
+        let display_name = source
+            .get("displayName")
+            .and_then(Value::as_str)
+            .unwrap_or(slug);
+        let kind = source
+            .get("kind")
+            .and_then(Value::as_str)
+            .unwrap_or("unknown");
+        let count = source.get("toolCount").and_then(Value::as_i64).unwrap_or(0);
+        writeln!(
+            output,
+            "{}  {}  {}  {count} tools",
+            safe_field(slug),
+            safe_field(display_name),
+            safe_field(kind)
+        )?;
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use serde_json::json;
+
+    use super::*;
+
+    #[test]
+    fn human_and_json_outputs_are_stable_and_secret_free() {
+        let value = json!({
+            "items": [{
+                "path": "tools.github.issue_create",
+                "description": "Create an issue",
+                "requiresApproval": true
+            }],
+            "hasMore": true
+        });
+        let mut human = Vec::new();
+        write_search_human(&mut human, &value).expect("human output");
+        let human = String::from_utf8(human).expect("UTF-8");
+        assert!(human.contains("tools.github.issue_create  [approval required]"));
+        assert!(human.contains("Use --offset"));
+
+        let mut json_output = Vec::new();
+        write_json(&mut json_output, &value).expect("JSON output");
+        assert_eq!(
+            serde_json::from_slice::<Value>(&json_output).expect("valid JSON"),
+            value
+        );
+    }
+}
diff --git a/src/cli/terminal.rs b/src/cli/terminal.rs
new file mode 100644
index 000000000..fe0e07cb3
--- /dev/null
+++ b/src/cli/terminal.rs
@@ -0,0 +1,42 @@
+const MAX_TERMINAL_FIELD_CHARACTERS: usize = 2_000;
+
+pub fn safe_field(value: &str) -> String {
+    let mut output = String::new();
+    for character in value.chars().take(MAX_TERMINAL_FIELD_CHARACTERS) {
+        if character.is_control()
+            || matches!(
+                character,
+                '\u{061c}'
+                    | '\u{200e}'
+                    | '\u{200f}'
+                    | '\u{202a}'..='\u{202e}'
+                    | '\u{2066}'..='\u{2069}'
+            )
+        {
+            output.push(' ');
+        } else {
+            output.push(character);
+        }
+    }
+    if value.chars().count() > MAX_TERMINAL_FIELD_CHARACTERS {
+        output.push_str("...");
+    }
+    output
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn removes_terminal_controls_and_bounds_fields() {
+        assert_eq!(
+            safe_field("hello\n\u{1b}]52;c;evil\u{7}world"),
+            "hello  ]52;c;evil world"
+        );
+        let long = "x".repeat(MAX_TERMINAL_FIELD_CHARACTERS + 1);
+        let safe = safe_field(&long);
+        assert!(safe.ends_with("..."));
+        assert_eq!(safe.len(), MAX_TERMINAL_FIELD_CHARACTERS + 3);
+    }
+}
diff --git a/src/crypto.rs b/src/crypto.rs
new file mode 100644
index 000000000..e7ab15e97
--- /dev/null
+++ b/src/crypto.rs
@@ -0,0 +1,827 @@
+use std::{
+    fs::{self, File, OpenOptions},
+    io::{ErrorKind, Read, Write},
+    path::{Path, PathBuf},
+};
+
+use argon2::{
+    Argon2, PasswordHash, PasswordHasher, PasswordVerifier,
+    password_hash::{SaltString, rand_core::OsRng},
+};
+use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
+use chacha20poly1305::{
+    KeyInit, XChaCha20Poly1305, XNonce,
+    aead::{Aead, Payload},
+};
+use hkdf::Hkdf;
+use hmac::{Hmac, Mac};
+use rand::{RngCore, rngs::OsRng as SystemOsRng};
+use sha2::Sha256;
+use subtle::ConstantTimeEq;
+use thiserror::Error;
+use uuid::Uuid;
+
+const MASTER_KEY_LENGTH: usize = 32;
+const NONCE_LENGTH: usize = 24;
+const ENVELOPE_VERSION: u8 = 1;
+
+#[derive(Debug, Eq, PartialEq)]
+enum KeyPublishOutcome {
+    Published,
+    Existing,
+}
+
+#[derive(Debug, Error)]
+pub enum CryptoError {
+    #[error("could not create the Executor data directory: {0}")]
+    CreateDataDirectory(#[source] std::io::Error),
+    #[error("the initialized database has no master key file at {0}")]
+    MissingMasterKey(PathBuf),
+    #[error("could not read the master key file at {path}: {source}")]
+    ReadMasterKey {
+        path: PathBuf,
+        source: std::io::Error,
+    },
+    #[error("the master key file at {path} must contain exactly 32 bytes, found {length}")]
+    InvalidMasterKeyLength { path: PathBuf, length: usize },
+    #[error("the master key file at {path} has unsafe metadata: {reason}")]
+    UnsafeMasterKeyMetadata { path: PathBuf, reason: &'static str },
+    #[error("could not create a master key file at {path}: {source}")]
+    CreateMasterKey {
+        path: PathBuf,
+        source: std::io::Error,
+    },
+    #[error("could not derive an instance subkey")]
+    KeyDerivation,
+    #[error("could not encrypt protected data")]
+    Encryption,
+    #[error("could not decrypt protected data")]
+    Decryption,
+    #[error("unsupported protected-data envelope version {0}")]
+    UnsupportedEnvelopeVersion(u8),
+    #[error("could not hash the password")]
+    PasswordHash,
+}
+
+#[derive(Clone)]
+pub struct Keyring {
+    encryption_key: [u8; 32],
+    digest_key: [u8; 32],
+}
+
+impl Keyring {
+    pub fn from_master_key(master_key: [u8; MASTER_KEY_LENGTH]) -> Result<Self, CryptoError> {
+        let hkdf = Hkdf::<Sha256>::new(Some(b"executor-instance-v1"), &master_key);
+        let mut encryption_key = [0_u8; 32];
+        let mut digest_key = [0_u8; 32];
+        hkdf.expand(b"xchacha20poly1305-at-rest", &mut encryption_key)
+            .map_err(|_| CryptoError::KeyDerivation)?;
+        hkdf.expand(b"authentication-digests", &mut digest_key)
+            .map_err(|_| CryptoError::KeyDerivation)?;
+
+        Ok(Self {
+            encryption_key,
+            digest_key,
+        })
+    }
+
+    pub fn random() -> Result<Self, CryptoError> {
+        let mut master_key = [0_u8; MASTER_KEY_LENGTH];
+        SystemOsRng.fill_bytes(&mut master_key);
+        Self::from_master_key(master_key)
+    }
+
+    pub fn encrypt(
+        &self,
+        purpose: &str,
+        record_id: &str,
+        plaintext: &[u8],
+    ) -> Result<Vec<u8>, CryptoError> {
+        let cipher = XChaCha20Poly1305::new((&self.encryption_key).into());
+        let mut nonce_bytes = [0_u8; NONCE_LENGTH];
+        SystemOsRng.fill_bytes(&mut nonce_bytes);
+        let aad = aad(purpose, record_id);
+        let ciphertext = cipher
+            .encrypt(
+                XNonce::from_slice(&nonce_bytes),
+                Payload {
+                    msg: plaintext,
+                    aad: &aad,
+                },
+            )
+            .map_err(|_| CryptoError::Encryption)?;
+
+        let mut sealed = Vec::with_capacity(1 + NONCE_LENGTH + ciphertext.len());
+        sealed.push(ENVELOPE_VERSION);
+        sealed.extend_from_slice(&nonce_bytes);
+        sealed.extend_from_slice(&ciphertext);
+        Ok(sealed)
+    }
+
+    pub fn decrypt(
+        &self,
+        purpose: &str,
+        record_id: &str,
+        sealed: &[u8],
+    ) -> Result<Vec<u8>, CryptoError> {
+        let Some((&version, envelope)) = sealed.split_first() else {
+            return Err(CryptoError::Decryption);
+        };
+        if version != ENVELOPE_VERSION {
+            return Err(CryptoError::UnsupportedEnvelopeVersion(version));
+        }
+        if envelope.len() <= NONCE_LENGTH {
+            return Err(CryptoError::Decryption);
+        }
+
+        let (nonce, ciphertext) = envelope.split_at(NONCE_LENGTH);
+        let aad = aad(purpose, record_id);
+        XChaCha20Poly1305::new((&self.encryption_key).into())
+            .decrypt(
+                XNonce::from_slice(nonce),
+                Payload {
+                    msg: ciphertext,
+                    aad: &aad,
+                },
+            )
+            .map_err(|_| CryptoError::Decryption)
+    }
+
+    pub(crate) fn digest(&self, purpose: &str, secret: &[u8]) -> [u8; 32] {
+        let mut mac = <Hmac<Sha256> as Mac>::new_from_slice(&self.digest_key)
+            .expect("HMAC accepts a 32-byte key");
+        mac.update(b"executor:v1:");
+        mac.update(purpose.as_bytes());
+        mac.update(b":");
+        mac.update(secret);
+        mac.finalize().into_bytes().into()
+    }
+
+    pub(crate) fn digest_matches(&self, purpose: &str, secret: &[u8], expected: &[u8]) -> bool {
+        self.digest(purpose, secret)
+            .as_slice()
+            .ct_eq(expected)
+            .into()
+    }
+}
+
+pub(crate) fn generate_secret(prefix: &str) -> String {
+    let mut bytes = [0_u8; 32];
+    SystemOsRng.fill_bytes(&mut bytes);
+    format!("{prefix}{}", URL_SAFE_NO_PAD.encode(bytes))
+}
+
+pub(crate) fn hash_password(password: &str) -> Result<String, CryptoError> {
+    let salt = SaltString::generate(&mut OsRng);
+    Argon2::default()
+        .hash_password(password.as_bytes(), &salt)
+        .map(|hash| hash.to_string())
+        .map_err(|_| CryptoError::PasswordHash)
+}
+
+pub(crate) fn verify_password(password: &str, encoded_hash: &str) -> bool {
+    let Ok(hash) = PasswordHash::new(encoded_hash) else {
+        return false;
+    };
+    Argon2::default()
+        .verify_password(password.as_bytes(), &hash)
+        .is_ok()
+}
+
+pub(crate) fn load_or_create_master_key(
+    data_dir: &Path,
+    database_existed: bool,
+    configured_path: Option<&Path>,
+) -> Result<[u8; MASTER_KEY_LENGTH], CryptoError> {
+    load_or_create_master_key_with_sync(
+        data_dir,
+        database_existed,
+        configured_path,
+        &sync_directory,
+    )
+}
+
+fn load_or_create_master_key_with_sync(
+    data_dir: &Path,
+    database_existed: bool,
+    configured_path: Option<&Path>,
+    sync_parent: &impl Fn(&Path) -> Result<(), std::io::Error>,
+) -> Result<[u8; MASTER_KEY_LENGTH], CryptoError> {
+    fs::create_dir_all(data_dir).map_err(CryptoError::CreateDataDirectory)?;
+    secure_directory(data_dir).map_err(CryptoError::CreateDataDirectory)?;
+
+    let key_path = configured_path
+        .map(Path::to_path_buf)
+        .unwrap_or_else(|| data_dir.join("master.key"));
+
+    if key_path.exists() {
+        if configured_path.is_none() {
+            let parent = key_path.parent().unwrap_or_else(|| Path::new("."));
+            recover_master_key_publication_alias(&key_path, parent, sync_parent).map_err(
+                |source| CryptoError::CreateMasterKey {
+                    path: key_path.clone(),
+                    source,
+                },
+            )?;
+            sync_parent(parent).map_err(|source| CryptoError::CreateMasterKey {
+                path: key_path.clone(),
+                source,
+            })?;
+        }
+        return read_master_key(&key_path);
+    }
+
+    if configured_path.is_some() || database_existed {
+        return Err(CryptoError::MissingMasterKey(key_path));
+    }
+
+    create_master_key_atomically(&key_path, sync_parent)
+}
+
+fn aad(purpose: &str, record_id: &str) -> Vec<u8> {
+    let mut encoded = Vec::with_capacity(24 + purpose.len() + record_id.len());
+    encoded.extend_from_slice(b"executor-aad");
+    encoded.push(ENVELOPE_VERSION);
+    append_length_prefixed(&mut encoded, purpose.as_bytes());
+    append_length_prefixed(&mut encoded, record_id.as_bytes());
+    encoded
+}
+
+fn append_length_prefixed(encoded: &mut Vec<u8>, value: &[u8]) {
+    encoded.extend_from_slice(&(value.len() as u64).to_be_bytes());
+    encoded.extend_from_slice(value);
+}
+
+fn read_master_key(path: &Path) -> Result<[u8; MASTER_KEY_LENGTH], CryptoError> {
+    let file = open_master_key(path).map_err(|source| CryptoError::ReadMasterKey {
+        path: path.to_path_buf(),
+        source,
+    })?;
+    let metadata = file
+        .metadata()
+        .map_err(|source| CryptoError::ReadMasterKey {
+            path: path.to_path_buf(),
+            source,
+        })?;
+    validate_master_key_metadata(path, &metadata)?;
+    let mut contents = Vec::with_capacity(MASTER_KEY_LENGTH + 1);
+    file.take((MASTER_KEY_LENGTH + 1) as u64)
+        .read_to_end(&mut contents)
+        .map_err(|source| CryptoError::ReadMasterKey {
+            path: path.to_path_buf(),
+            source,
+        })?;
+    if contents.len() != MASTER_KEY_LENGTH {
+        let observed_length = if contents.len() > MASTER_KEY_LENGTH {
+            usize::try_from(metadata.len())
+                .unwrap_or(usize::MAX)
+                .max(contents.len())
+        } else {
+            contents.len()
+        };
+        return Err(CryptoError::InvalidMasterKeyLength {
+            path: path.to_path_buf(),
+            length: observed_length,
+        });
+    }
+    let mut key = [0_u8; MASTER_KEY_LENGTH];
+    key.copy_from_slice(&contents);
+    Ok(key)
+}
+
+fn open_master_key(path: &Path) -> Result<File, std::io::Error> {
+    let mut options = OpenOptions::new();
+    options.read(true);
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::OpenOptionsExt;
+        options.custom_flags(libc::O_NOFOLLOW | libc::O_NONBLOCK);
+    }
+    options.open(path)
+}
+
+fn validate_master_key_metadata(path: &Path, metadata: &fs::Metadata) -> Result<(), CryptoError> {
+    if !metadata.is_file() {
+        return Err(CryptoError::UnsafeMasterKeyMetadata {
+            path: path.to_path_buf(),
+            reason: "it must be a regular file",
+        });
+    }
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::MetadataExt;
+        if metadata.nlink() != 1 {
+            return Err(CryptoError::UnsafeMasterKeyMetadata {
+                path: path.to_path_buf(),
+                reason: "it must have exactly one hard link",
+            });
+        }
+        validate_master_key_unix_permissions(
+            path,
+            metadata.uid(),
+            unsafe { libc::geteuid() },
+            metadata.mode() & 0o7777,
+        )?;
+    }
+    Ok(())
+}
+
+#[cfg(unix)]
+fn validate_master_key_unix_permissions(
+    path: &Path,
+    owner_uid: u32,
+    effective_uid: u32,
+    mode: u32,
+) -> Result<(), CryptoError> {
+    if owner_uid == 0 {
+        if !matches!(mode, 0o400 | 0o440 | 0o600 | 0o640) {
+            return Err(CryptoError::UnsafeMasterKeyMetadata {
+                path: path.to_path_buf(),
+                reason: "a root-owned key must use mode 0400, 0440, 0600, or 0640",
+            });
+        }
+    } else if owner_uid == effective_uid {
+        if !matches!(mode, 0o400 | 0o600) {
+            return Err(CryptoError::UnsafeMasterKeyMetadata {
+                path: path.to_path_buf(),
+                reason: "a service-user-owned key must use mode 0400 or 0600",
+            });
+        }
+    } else {
+        return Err(CryptoError::UnsafeMasterKeyMetadata {
+            path: path.to_path_buf(),
+            reason: "it must be owned by the effective service user or root",
+        });
+    }
+    Ok(())
+}
+
+fn create_master_key_atomically(
+    path: &Path,
+    sync_parent: &impl Fn(&Path) -> Result<(), std::io::Error>,
+) -> Result<[u8; MASTER_KEY_LENGTH], CryptoError> {
+    let parent = path.parent().unwrap_or_else(|| Path::new("."));
+    fs::create_dir_all(parent).map_err(CryptoError::CreateDataDirectory)?;
+    secure_directory(parent).map_err(CryptoError::CreateDataDirectory)?;
+
+    let mut key = [0_u8; MASTER_KEY_LENGTH];
+    SystemOsRng.fill_bytes(&mut key);
+    let temporary_path = parent.join(format!(".master-key-{}.tmp", Uuid::new_v4()));
+
+    let create_result = (|| -> Result<KeyPublishOutcome, std::io::Error> {
+        let mut options = OpenOptions::new();
+        options.write(true).create_new(true);
+        secure_file_options(&mut options);
+        let mut file = options.open(&temporary_path)?;
+        file.write_all(&key)?;
+        file.sync_all()?;
+        publish_master_key(&temporary_path, path, parent, sync_parent)
+    })();
+
+    match create_result {
+        Ok(KeyPublishOutcome::Published) => Ok(key),
+        Ok(KeyPublishOutcome::Existing) => {
+            sync_parent(parent).map_err(|source| CryptoError::CreateMasterKey {
+                path: path.to_path_buf(),
+                source,
+            })?;
+            read_master_key(path)
+        }
+        Err(source) => Err(CryptoError::CreateMasterKey {
+            path: path.to_path_buf(),
+            source,
+        }),
+    }
+}
+
+fn publish_master_key(
+    temporary_path: &Path,
+    path: &Path,
+    parent: &Path,
+    sync_parent: &impl Fn(&Path) -> Result<(), std::io::Error>,
+) -> Result<KeyPublishOutcome, std::io::Error> {
+    match fs::hard_link(temporary_path, path) {
+        Ok(()) => {}
+        Err(error) if error.kind() == ErrorKind::AlreadyExists => {
+            fs::remove_file(temporary_path)?;
+            return Ok(KeyPublishOutcome::Existing);
+        }
+        Err(error) => {
+            let _ = fs::remove_file(temporary_path);
+            return Err(error);
+        }
+    }
+
+    fs::remove_file(temporary_path)?;
+    sync_parent(parent)?;
+    Ok(KeyPublishOutcome::Published)
+}
+
+#[cfg(unix)]
+fn recover_master_key_publication_alias(
+    path: &Path,
+    parent: &Path,
+    sync_parent: &impl Fn(&Path) -> Result<(), std::io::Error>,
+) -> Result<(), std::io::Error> {
+    use std::os::unix::fs::MetadataExt;
+
+    let destination = fs::symlink_metadata(path)?;
+    if !destination.is_file() || destination.nlink() != 2 {
+        return Ok(());
+    }
+
+    let mut matching_alias = None;
+    for entry in fs::read_dir(parent)? {
+        let entry = entry?;
+        let name = entry.file_name();
+        let Some(name) = name.to_str() else {
+            continue;
+        };
+        let Some(uuid) = name
+            .strip_prefix(".master-key-")
+            .and_then(|name| name.strip_suffix(".tmp"))
+        else {
+            continue;
+        };
+        if Uuid::parse_str(uuid).is_err() {
+            continue;
+        }
+        let alias_path = entry.path();
+        let alias = fs::symlink_metadata(&alias_path)?;
+        let is_matching = alias.is_file()
+            && alias.dev() == destination.dev()
+            && alias.ino() == destination.ino()
+            && alias.nlink() == 2
+            && alias.uid() == unsafe { libc::geteuid() }
+            && alias.uid() == destination.uid()
+            && alias.gid() == destination.gid()
+            && alias.mode() == destination.mode()
+            && alias.mode() & 0o7777 == 0o600
+            && alias.len() == MASTER_KEY_LENGTH as u64
+            && alias.len() == destination.len();
+        if !is_matching {
+            continue;
+        }
+        if matching_alias.replace(alias_path).is_some() {
+            return Ok(());
+        }
+    }
+
+    if let Some(alias) = matching_alias {
+        fs::remove_file(alias)?;
+        sync_parent(parent)?;
+    }
+    Ok(())
+}
+
+#[cfg(not(unix))]
+fn recover_master_key_publication_alias(
+    _path: &Path,
+    _parent: &Path,
+    _sync_parent: &impl Fn(&Path) -> Result<(), std::io::Error>,
+) -> Result<(), std::io::Error> {
+    Ok(())
+}
+
+fn sync_directory(path: &Path) -> Result<(), std::io::Error> {
+    fs::File::open(path)?.sync_all()
+}
+
+#[cfg(unix)]
+fn secure_directory(path: &Path) -> Result<(), std::io::Error> {
+    use std::os::unix::fs::PermissionsExt;
+
+    fs::set_permissions(path, fs::Permissions::from_mode(0o700))
+}
+
+#[cfg(not(unix))]
+fn secure_directory(_path: &Path) -> Result<(), std::io::Error> {
+    Ok(())
+}
+
+#[cfg(unix)]
+fn secure_file_options(options: &mut OpenOptions) {
+    use std::os::unix::fs::OpenOptionsExt;
+
+    options.mode(0o600);
+}
+
+#[cfg(not(unix))]
+fn secure_file_options(_options: &mut OpenOptions) {}
+
+#[cfg(test)]
+mod tests {
+    use super::{
+        CryptoError, KeyPublishOutcome, load_or_create_master_key_with_sync, publish_master_key,
+    };
+    use std::{cell::Cell, fs, io::ErrorKind};
+
+    #[cfg(unix)]
+    use std::os::unix::fs::{MetadataExt, PermissionsExt};
+
+    #[test]
+    fn parent_sync_failures_are_propagated_after_key_publication() {
+        let directory = tempfile::tempdir().expect("temporary directory should be created");
+        let temporary_path = directory.path().join("temporary.key");
+        let key_path = directory.path().join("master.key");
+        fs::write(&temporary_path, [1_u8; 32]).expect("temporary key should be written");
+
+        let error = publish_master_key(&temporary_path, &key_path, directory.path(), &|_| {
+            Err(std::io::Error::other("injected directory sync failure"))
+        })
+        .expect_err("directory sync failure must be returned");
+        assert_eq!(error.kind(), ErrorKind::Other);
+        assert!(key_path.exists());
+    }
+
+    #[test]
+    fn only_an_already_existing_link_uses_the_existing_key_path() {
+        let directory = tempfile::tempdir().expect("temporary directory should be created");
+        let temporary_path = directory.path().join("temporary.key");
+        let key_path = directory.path().join("master.key");
+        fs::write(&temporary_path, [1_u8; 32]).expect("temporary key should be written");
+        fs::write(&key_path, [2_u8; 32]).expect("existing key should be written");
+
+        let outcome = publish_master_key(&temporary_path, &key_path, directory.path(), &|_| {
+            panic!("an existing link must not run the publication sync path")
+        })
+        .expect("already existing key should be detected");
+        assert_eq!(outcome, KeyPublishOutcome::Existing);
+        assert!(!temporary_path.exists());
+        assert_eq!(
+            fs::read(key_path).expect("existing key should be readable"),
+            [2_u8; 32]
+        );
+    }
+
+    #[test]
+    fn failed_publication_sync_is_retried_before_the_existing_key_is_read() {
+        let directory = tempfile::tempdir().expect("temporary directory should be created");
+        let sync_attempts = Cell::new(0);
+        let sync_parent = |_: &std::path::Path| {
+            let attempt = sync_attempts.get() + 1;
+            sync_attempts.set(attempt);
+            if attempt <= 2 {
+                Err(std::io::Error::other("injected directory sync failure"))
+            } else {
+                Ok(())
+            }
+        };
+
+        let first =
+            load_or_create_master_key_with_sync(directory.path(), false, None, &sync_parent)
+                .expect_err("the publication sync failure must be returned");
+        assert!(matches!(first, CryptoError::CreateMasterKey { .. }));
+        assert!(directory.path().join("master.key").exists());
+        assert_eq!(sync_attempts.get(), 1);
+
+        let second =
+            load_or_create_master_key_with_sync(directory.path(), false, None, &sync_parent)
+                .expect_err("the next open must retry and return the sync failure");
+        assert!(matches!(second, CryptoError::CreateMasterKey { .. }));
+        assert_eq!(sync_attempts.get(), 2);
+
+        let key = load_or_create_master_key_with_sync(directory.path(), false, None, &sync_parent)
+            .expect("the key may be read only after the parent sync succeeds");
+        assert_eq!(sync_attempts.get(), 3);
+        assert_eq!(
+            fs::read(directory.path().join("master.key"))
+                .expect("the published key should be readable"),
+            key
+        );
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn restart_recovers_the_exact_master_key_publication_alias() {
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let key_path = directory.path().join("master.key");
+        let alias_path = directory
+            .path()
+            .join(format!(".master-key-{}.tmp", uuid::Uuid::new_v4()));
+        fs::write(&key_path, [13_u8; 32]).expect("master key");
+        fs::set_permissions(&key_path, fs::Permissions::from_mode(0o600)).expect("key mode");
+        fs::hard_link(&key_path, &alias_path).expect("publication alias");
+
+        let loaded =
+            load_or_create_master_key_with_sync(directory.path(), false, None, &|_| Ok(()))
+                .expect("same-inode publication alias should recover");
+
+        assert_eq!(loaded, [13_u8; 32]);
+        assert!(!alias_path.exists());
+        assert_eq!(fs::metadata(&key_path).expect("key metadata").nlink(), 1);
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn restart_rejects_substituted_and_unknown_master_key_aliases() {
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let key_path = directory.path().join("master.key");
+        let unknown_alias = directory.path().join("unknown-alias");
+        let substituted_alias = directory
+            .path()
+            .join(format!(".master-key-{}.tmp", uuid::Uuid::new_v4()));
+        fs::write(&key_path, [14_u8; 32]).expect("master key");
+        fs::set_permissions(&key_path, fs::Permissions::from_mode(0o600)).expect("key mode");
+        fs::hard_link(&key_path, &unknown_alias).expect("unknown key alias");
+        fs::write(&substituted_alias, [15_u8; 32]).expect("substituted alias");
+        fs::set_permissions(&substituted_alias, fs::Permissions::from_mode(0o600))
+            .expect("substituted alias mode");
+
+        let error = load_or_create_master_key_with_sync(directory.path(), false, None, &|_| Ok(()))
+            .expect_err("unknown hard link must remain rejected");
+
+        assert!(matches!(error, CryptoError::UnsafeMasterKeyMetadata { .. }));
+        assert_eq!(fs::read(&key_path).expect("key contents"), [14_u8; 32]);
+        assert_eq!(
+            fs::read(&substituted_alias).expect("substituted contents"),
+            [15_u8; 32]
+        );
+        assert_eq!(fs::metadata(&key_path).expect("key metadata").nlink(), 2);
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn existing_master_key_rejects_symbolic_links() {
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let target = directory.path().join("target.key");
+        let link = directory.path().join("master.key");
+        fs::write(&target, [7_u8; 32]).expect("target key");
+        fs::set_permissions(&target, fs::Permissions::from_mode(0o600)).expect("target mode");
+        std::os::unix::fs::symlink(&target, &link).expect("key symlink");
+
+        let error = super::load_or_create_master_key_with_sync(
+            directory.path(),
+            false,
+            Some(&link),
+            &|_| Ok(()),
+        )
+        .expect_err("symbolic-link key must fail");
+        assert!(matches!(error, super::CryptoError::ReadMasterKey { .. }));
+        assert_eq!(fs::read(target).expect("target contents"), [7_u8; 32]);
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn existing_master_key_rejects_fifos_without_waiting_for_a_writer() {
+        use std::{ffi::CString, os::unix::ffi::OsStrExt};
+
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let key = directory.path().join("master.key");
+        let key_name = CString::new(key.as_os_str().as_bytes()).expect("FIFO path");
+        let result = unsafe { libc::mkfifo(key_name.as_ptr(), 0o600) };
+        assert_eq!(result, 0, "FIFO should be created");
+
+        let error = super::load_or_create_master_key_with_sync(
+            directory.path(),
+            false,
+            Some(&key),
+            &|_| Ok(()),
+        )
+        .expect_err("FIFO key must fail without blocking");
+        assert!(matches!(
+            error,
+            super::CryptoError::UnsafeMasterKeyMetadata { .. }
+        ));
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn existing_master_key_rejects_character_devices() {
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let error = super::load_or_create_master_key_with_sync(
+            directory.path(),
+            false,
+            Some(std::path::Path::new("/dev/null")),
+            &|_| Ok(()),
+        )
+        .expect_err("device key must fail");
+        assert!(matches!(
+            error,
+            super::CryptoError::UnsafeMasterKeyMetadata { .. }
+        ));
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn existing_master_key_rejects_additional_hard_links() {
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let key = directory.path().join("master.key");
+        fs::write(&key, [8_u8; 32]).expect("master key");
+        fs::set_permissions(&key, fs::Permissions::from_mode(0o600)).expect("key mode");
+        fs::hard_link(&key, directory.path().join("alias.key")).expect("key alias");
+
+        let error = super::load_or_create_master_key_with_sync(
+            directory.path(),
+            false,
+            Some(&key),
+            &|_| Ok(()),
+        )
+        .expect_err("hard-linked key must fail");
+        assert!(matches!(
+            error,
+            super::CryptoError::UnsafeMasterKeyMetadata { .. }
+        ));
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn existing_master_key_rejects_broad_permissions() {
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let key = directory.path().join("master.key");
+        fs::write(&key, [9_u8; 32]).expect("master key");
+        fs::set_permissions(&key, fs::Permissions::from_mode(0o640)).expect("key mode");
+
+        let error = super::load_or_create_master_key_with_sync(
+            directory.path(),
+            false,
+            Some(&key),
+            &|_| Ok(()),
+        )
+        .expect_err("group-readable key must fail");
+        assert!(matches!(
+            error,
+            super::CryptoError::UnsafeMasterKeyMetadata { .. }
+        ));
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn existing_master_key_rejects_oversized_files_after_one_extra_byte() {
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let key = directory.path().join("master.key");
+        fs::write(&key, [11_u8; 4096]).expect("oversized master key");
+        fs::set_permissions(&key, fs::Permissions::from_mode(0o600)).expect("key mode");
+
+        let error = super::load_or_create_master_key_with_sync(
+            directory.path(),
+            false,
+            Some(&key),
+            &|_| Ok(()),
+        )
+        .expect_err("oversized key must fail");
+        assert!(matches!(
+            error,
+            super::CryptoError::InvalidMasterKeyLength { length: 4096, .. }
+        ));
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn existing_master_key_accepts_owner_read_only_mode() {
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let key = directory.path().join("master.key");
+        fs::write(&key, [10_u8; 32]).expect("master key");
+        fs::set_permissions(&key, fs::Permissions::from_mode(0o400)).expect("key mode");
+
+        let loaded = super::load_or_create_master_key_with_sync(
+            directory.path(),
+            false,
+            Some(&key),
+            &|_| Ok(()),
+        )
+        .expect("owner-read-only key");
+        assert_eq!(loaded, [10_u8; 32]);
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn existing_master_key_accepts_exact_owner_read_write_file() {
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let key = directory.path().join("master.key");
+        fs::write(&key, [12_u8; 32]).expect("master key");
+        fs::set_permissions(&key, fs::Permissions::from_mode(0o600)).expect("key mode");
+
+        let loaded = super::load_or_create_master_key_with_sync(
+            directory.path(),
+            false,
+            Some(&key),
+            &|_| Ok(()),
+        )
+        .expect("owner-read-write key");
+        assert_eq!(loaded, [12_u8; 32]);
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn root_owned_group_readable_secret_manager_modes_are_accepted() {
+        let path = std::path::Path::new("fixture-master.key");
+        for mode in [0o400, 0o440, 0o600, 0o640] {
+            super::validate_master_key_unix_permissions(path, 0, 10001, mode)
+                .expect("supported root-owned key mode");
+        }
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn unsafe_root_modes_and_unrelated_owners_are_rejected() {
+        let path = std::path::Path::new("fixture-master.key");
+        for mode in [0o444, 0o660, 0o700] {
+            assert!(
+                super::validate_master_key_unix_permissions(path, 0, 10001, mode).is_err(),
+                "root-owned mode {mode:o} must fail"
+            );
+        }
+        assert!(super::validate_master_key_unix_permissions(path, 10002, 10001, 0o400).is_err());
+    }
+}
diff --git a/src/database.rs b/src/database.rs
new file mode 100644
index 000000000..a8340037c
--- /dev/null
+++ b/src/database.rs
@@ -0,0 +1,474 @@
+use std::{
+    fs::{self, File, OpenOptions},
+    path::{Path, PathBuf},
+    sync::Arc,
+    time::Duration,
+};
+
+#[cfg(unix)]
+use percent_encoding::{AsciiSet, NON_ALPHANUMERIC, percent_encode};
+use sqlx::{
+    SqlitePool,
+    migrate::Migrator,
+    sqlite::{SqliteConnectOptions, SqliteJournalMode, SqlitePoolOptions, SqliteSynchronous},
+};
+use thiserror::Error;
+
+use crate::{
+    AppConfig,
+    approval::ApprovalError,
+    crypto::{CryptoError, Keyring, generate_secret, load_or_create_master_key},
+    unix_timestamp,
+};
+
+static MIGRATOR: Migrator = sqlx::migrate!("./migrations");
+const SENTINEL_KEY: &str = "boot_sentinel";
+const SENTINEL_PLAINTEXT: &[u8] = b"executor-boot-sentinel-v1";
+pub(crate) const SETUP_TOKEN_TTL_SECONDS: i64 = 15 * 60;
+
+#[derive(Debug, Error)]
+pub enum DatabaseError {
+    #[error(transparent)]
+    Approval(#[from] ApprovalError),
+    #[error(transparent)]
+    Crypto(#[from] CryptoError),
+    #[error(transparent)]
+    McpTemplates(#[from] crate::mcp::upstream::stdio::StdioTemplateError),
+    #[error("could not recover managed OAuth state")]
+    OAuthInitialization,
+    #[error("could not configure the SQLite database: {0}")]
+    Configuration(#[source] sqlx::Error),
+    #[error("could not run embedded SQLite migrations: {0}")]
+    Migration(#[source] sqlx::migrate::MigrateError),
+    #[error("the database boot sentinel is missing; refusing to guess the instance key")]
+    MissingBootSentinel,
+    #[error(
+        "the database boot sentinel could not be authenticated; the master key is wrong or the database was modified"
+    )]
+    InvalidBootSentinel,
+    #[error("could not initialize the setup claim: {0}")]
+    SetupClaim(#[source] sqlx::Error),
+    #[error("another Executor process is already using {0}")]
+    AlreadyRunning(PathBuf),
+    #[error("could not lock the Executor data directory at {path}: {source}")]
+    InstanceLock {
+        path: PathBuf,
+        source: std::io::Error,
+    },
+    #[error("could not secure the SQLite database file at {path}: {source}")]
+    SecureDatabaseFile {
+        path: PathBuf,
+        source: std::io::Error,
+    },
+    #[error("the SQLite database path cannot be represented safely on this platform")]
+    InvalidDatabasePath,
+}
+
+#[derive(Clone)]
+pub(crate) struct Database {
+    pub(crate) pool: SqlitePool,
+    pub(crate) keyring: Keyring,
+    _instance_lock: Arc<InstanceLock>,
+}
+
+struct InstanceLock {
+    _file: File,
+}
+
+pub(crate) struct OpenedDatabase {
+    pub(crate) database: Database,
+    pub(crate) setup_token: Option<String>,
+}
+
+impl Database {
+    pub(crate) async fn open(config: &AppConfig) -> Result<OpenedDatabase, DatabaseError> {
+        let database_path = config.data_dir.join("executor.db");
+        let options = sqlite_options(&database_path)?;
+        let instance_lock = Arc::new(InstanceLock::acquire(&config.data_dir)?);
+        let database_existed = database_path.exists();
+        let master_key = load_or_create_master_key(
+            &config.data_dir,
+            database_existed,
+            config.master_key_file.as_deref(),
+        )?;
+        let keyring = Keyring::from_master_key(master_key)?;
+        secure_database_file(&database_path)?;
+        let pool = SqlitePoolOptions::new()
+            .max_connections(8)
+            .acquire_timeout(Duration::from_secs(5))
+            .connect_with(options)
+            .await
+            .map_err(DatabaseError::Configuration)?;
+
+        MIGRATOR
+            .run(&pool)
+            .await
+            .map_err(DatabaseError::Migration)?;
+        verify_or_create_sentinel(&pool, &keyring, database_existed).await?;
+        crate::catalog::source_idempotency::recover_source_creation_idempotency(&pool)
+            .await
+            .map_err(DatabaseError::Configuration)?;
+        let setup_token = issue_setup_token_if_needed(&pool, &keyring).await?;
+
+        Ok(OpenedDatabase {
+            database: Database {
+                pool,
+                keyring,
+                _instance_lock: instance_lock,
+            },
+            setup_token,
+        })
+    }
+}
+
+impl InstanceLock {
+    fn acquire(data_dir: &Path) -> Result<Self, DatabaseError> {
+        fs::create_dir_all(data_dir).map_err(CryptoError::CreateDataDirectory)?;
+        secure_data_directory(data_dir).map_err(CryptoError::CreateDataDirectory)?;
+        let path = data_dir.join("executor.lock");
+        let mut options = OpenOptions::new();
+        options.read(true).write(true).create(true);
+        secure_open_options(&mut options);
+        let file = options
+            .open(&path)
+            .map_err(|source| DatabaseError::InstanceLock {
+                path: path.clone(),
+                source,
+            })?;
+        secure_file_permissions(&path).map_err(|source| DatabaseError::InstanceLock {
+            path: path.clone(),
+            source,
+        })?;
+        match file.try_lock() {
+            Ok(()) => Ok(Self { _file: file }),
+            Err(std::fs::TryLockError::WouldBlock) => {
+                Err(DatabaseError::AlreadyRunning(data_dir.to_path_buf()))
+            }
+            Err(std::fs::TryLockError::Error(source)) => {
+                Err(DatabaseError::InstanceLock { path, source })
+            }
+        }
+    }
+}
+
+fn sqlite_options(database_path: &Path) -> Result<SqliteConnectOptions, DatabaseError> {
+    Ok(SqliteConnectOptions::new()
+        .filename(sqlite_filename(database_path)?)
+        .create_if_missing(true)
+        .foreign_keys(true)
+        .journal_mode(SqliteJournalMode::Wal)
+        .synchronous(SqliteSynchronous::Full)
+        .busy_timeout(Duration::from_secs(5)))
+}
+
+#[cfg(unix)]
+const SQLITE_URI_PATH_ENCODE_SET: &AsciiSet = &NON_ALPHANUMERIC.remove(b'/');
+
+#[cfg(unix)]
+fn sqlite_filename(database_path: &Path) -> Result<PathBuf, DatabaseError> {
+    use std::os::unix::ffi::OsStrExt;
+
+    let path = database_path.as_os_str().as_bytes();
+    if path.contains(&0) {
+        return Err(DatabaseError::InvalidDatabasePath);
+    }
+
+    let prefix = if database_path.is_absolute() {
+        "file://"
+    } else {
+        "file:"
+    };
+    Ok(PathBuf::from(format!(
+        "{prefix}{}",
+        percent_encode(path, SQLITE_URI_PATH_ENCODE_SET)
+    )))
+}
+
+#[cfg(not(unix))]
+fn sqlite_filename(database_path: &Path) -> Result<PathBuf, DatabaseError> {
+    let path = database_path
+        .to_str()
+        .filter(|path| !path.contains('\0'))
+        .ok_or(DatabaseError::InvalidDatabasePath)?;
+    Ok(PathBuf::from(path))
+}
+
+async fn verify_or_create_sentinel(
+    pool: &SqlitePool,
+    keyring: &Keyring,
+    database_existed: bool,
+) -> Result<(), DatabaseError> {
+    let sentinel =
+        sqlx::query_scalar::<_, Vec<u8>>("SELECT value FROM instance_metadata WHERE key = ?")
+            .bind(SENTINEL_KEY)
+            .fetch_optional(pool)
+            .await
+            .map_err(DatabaseError::Configuration)?;
+
+    match sentinel {
+        Some(sealed) => {
+            let plaintext = keyring
+                .decrypt("boot-sentinel", "singleton", &sealed)
+                .map_err(|_| DatabaseError::InvalidBootSentinel)?;
+            if plaintext != SENTINEL_PLAINTEXT {
+                return Err(DatabaseError::InvalidBootSentinel);
+            }
+            Ok(())
+        }
+        None if database_existed && application_state_exists(pool).await? => {
+            Err(DatabaseError::MissingBootSentinel)
+        }
+        None => {
+            let sealed = keyring.encrypt("boot-sentinel", "singleton", SENTINEL_PLAINTEXT)?;
+            sqlx::query("INSERT INTO instance_metadata (key, value) VALUES (?, ?)")
+                .bind(SENTINEL_KEY)
+                .bind(sealed)
+                .execute(pool)
+                .await
+                .map_err(DatabaseError::Configuration)?;
+            Ok(())
+        }
+    }
+}
+
+async fn application_state_exists(pool: &SqlitePool) -> Result<bool, DatabaseError> {
+    sqlx::query_scalar::<_, i64>(
+        "SELECT EXISTS(SELECT 1 FROM setup_state) \
+         OR EXISTS(SELECT 1 FROM admins) \
+         OR EXISTS(SELECT 1 FROM admin_sessions) \
+         OR EXISTS(SELECT 1 FROM api_tokens) \
+         OR EXISTS(SELECT 1 FROM sources) \
+         OR EXISTS(SELECT 1 FROM source_credentials) \
+         OR EXISTS(SELECT 1 FROM source_artifacts) \
+         OR EXISTS(SELECT 1 FROM tools) \
+         OR EXISTS(SELECT 1 FROM request_logs) \
+         OR EXISTS(SELECT 1 FROM audit_events) \
+         OR EXISTS(SELECT 1 FROM approvals) \
+         OR EXISTS(SELECT 1 FROM catalog_state WHERE id = 1 AND revision <> 0) \
+         OR EXISTS(SELECT 1 FROM instance_metadata WHERE key <> ?)",
+    )
+    .bind(SENTINEL_KEY)
+    .fetch_one(pool)
+    .await
+    .map(|exists| exists != 0)
+    .map_err(DatabaseError::Configuration)
+}
+
+async fn issue_setup_token_if_needed(
+    pool: &SqlitePool,
+    keyring: &Keyring,
+) -> Result<Option<String>, DatabaseError> {
+    let has_admin =
+        sqlx::query_scalar::<_, i64>("SELECT EXISTS(SELECT 1 FROM admins WHERE id = 1)")
+            .fetch_one(pool)
+            .await
+            .map_err(DatabaseError::SetupClaim)?
+            != 0;
+
+    if has_admin {
+        return Ok(None);
+    }
+
+    let token = generate_secret("set_");
+    let digest = keyring.digest("setup-token", token.as_bytes());
+    sqlx::query(
+        "INSERT INTO setup_state (id, token_digest, created_at, used_at) VALUES (1, ?, ?, NULL) \
+         ON CONFLICT(id) DO UPDATE SET token_digest = excluded.token_digest, created_at = excluded.created_at, used_at = NULL",
+    )
+    .bind(digest.to_vec())
+    .bind(unix_timestamp())
+    .execute(pool)
+    .await
+    .map_err(DatabaseError::SetupClaim)?;
+
+    Ok(Some(token))
+}
+
+fn secure_database_file(path: &Path) -> Result<(), DatabaseError> {
+    let mut options = OpenOptions::new();
+    options.read(true).write(true).create(true);
+    secure_open_options(&mut options);
+    options
+        .open(path)
+        .map_err(|source| DatabaseError::SecureDatabaseFile {
+            path: path.to_path_buf(),
+            source,
+        })?;
+    secure_file_permissions(path).map_err(|source| DatabaseError::SecureDatabaseFile {
+        path: path.to_path_buf(),
+        source,
+    })
+}
+
+#[cfg(unix)]
+fn secure_data_directory(path: &Path) -> Result<(), std::io::Error> {
+    use std::os::unix::fs::PermissionsExt;
+
+    fs::set_permissions(path, fs::Permissions::from_mode(0o700))
+}
+
+#[cfg(not(unix))]
+fn secure_data_directory(_path: &Path) -> Result<(), std::io::Error> {
+    Ok(())
+}
+
+#[cfg(unix)]
+fn secure_open_options(options: &mut OpenOptions) {
+    use std::os::unix::fs::OpenOptionsExt;
+
+    options.mode(0o600);
+}
+
+#[cfg(not(unix))]
+fn secure_open_options(_options: &mut OpenOptions) {}
+
+#[cfg(unix)]
+fn secure_file_permissions(path: &Path) -> Result<(), std::io::Error> {
+    use std::os::unix::fs::PermissionsExt;
+
+    fs::set_permissions(path, fs::Permissions::from_mode(0o600))
+}
+
+#[cfg(not(unix))]
+fn secure_file_permissions(_path: &Path) -> Result<(), std::io::Error> {
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use std::{
+        collections::BTreeSet,
+        ffi::{OsStr, OsString},
+    };
+
+    use super::*;
+
+    async fn assert_database_path_round_trip(data_dir: &Path) {
+        let config = AppConfig::new(data_dir.to_path_buf());
+        let opened = Database::open(&config)
+            .await
+            .expect("database should open at the exact requested path");
+        sqlx::query("INSERT INTO instance_metadata (key, value) VALUES ('path-test', X'01')")
+            .execute(&opened.database.pool)
+            .await
+            .expect("path marker should be written");
+
+        let locked = Database::open(&config).await;
+        assert!(matches!(locked, Err(DatabaseError::AlreadyRunning(path)) if path == data_dir));
+
+        opened.database.pool.close().await;
+        drop(opened);
+
+        let database_path = data_dir.join("executor.db");
+        let header =
+            fs::read(&database_path).expect("the intended database file should be readable");
+        assert!(header.starts_with(b"SQLite format 3\0"));
+
+        let reopened = Database::open(&config)
+            .await
+            .expect("database should restart from the same path");
+        let marker = sqlx::query_scalar::<_, Vec<u8>>(
+            "SELECT value FROM instance_metadata WHERE key = 'path-test'",
+        )
+        .fetch_one(&reopened.database.pool)
+        .await
+        .expect("restart should read the marker from the intended file");
+        assert_eq!(marker, [1]);
+        reopened.database.pool.close().await;
+        drop(reopened);
+
+        let actual_files = fs::read_dir(data_dir)
+            .expect("data directory should be readable")
+            .map(|entry| {
+                entry
+                    .expect("data directory entry should be readable")
+                    .file_name()
+            })
+            .collect::<BTreeSet<_>>();
+        let allowed_files = [
+            "executor.db",
+            "executor.db-shm",
+            "executor.db-wal",
+            "executor.lock",
+            "master.key",
+        ]
+        .into_iter()
+        .map(OsString::from)
+        .collect::<BTreeSet<_>>();
+        assert!(actual_files.is_subset(&allowed_files));
+        assert!(actual_files.contains(OsStr::new("executor.db")));
+    }
+
+    #[tokio::test]
+    async fn sqlite_paths_preserve_reserved_space_and_unicode_characters() {
+        let root = tempfile::tempdir().expect("temporary directory should be created");
+        let names = [
+            "percent%2Fdirectory",
+            "question?directory",
+            "hash#directory",
+            "space directory",
+            "unicode-雪-directory",
+        ];
+
+        for name in names {
+            assert_database_path_round_trip(&root.path().join(name)).await;
+        }
+
+        let actual_directories = fs::read_dir(root.path())
+            .expect("temporary root should be readable")
+            .map(|entry| {
+                entry
+                    .expect("temporary root entry should be readable")
+                    .file_name()
+            })
+            .collect::<BTreeSet<_>>();
+        let expected_directories = names
+            .into_iter()
+            .map(OsString::from)
+            .collect::<BTreeSet<_>>();
+        assert_eq!(actual_directories, expected_directories);
+    }
+
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn sqlite_paths_preserve_non_utf8_bytes() {
+        use std::os::unix::ffi::OsStringExt;
+
+        let root = tempfile::tempdir().expect("temporary directory should be created");
+        let name = OsString::from_vec(b"non-utf8-\xff-directory".to_vec());
+        let data_dir = root.path().join(&name);
+
+        assert_database_path_round_trip(&data_dir).await;
+
+        let actual_directories = fs::read_dir(root.path())
+            .expect("temporary root should be readable")
+            .map(|entry| {
+                entry
+                    .expect("temporary root entry should be readable")
+                    .file_name()
+            })
+            .collect::<Vec<_>>();
+        assert_eq!(actual_directories, [name]);
+    }
+
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn sqlite_paths_reject_embedded_nul_bytes_before_filesystem_writes() {
+        use std::os::unix::ffi::{OsStrExt, OsStringExt};
+
+        let root = tempfile::tempdir().expect("temporary directory should be created");
+        let mut path = root.path().as_os_str().as_bytes().to_vec();
+        path.extend_from_slice(b"/bad\0path");
+        let config = AppConfig::new(PathBuf::from(OsString::from_vec(path)));
+        assert!(matches!(
+            Database::open(&config).await,
+            Err(DatabaseError::InvalidDatabasePath)
+        ));
+        assert_eq!(
+            fs::read_dir(root.path())
+                .expect("temporary root should be readable")
+                .count(),
+            0
+        );
+    }
+}
diff --git a/src/execution.rs b/src/execution.rs
new file mode 100644
index 000000000..a186f60b2
--- /dev/null
+++ b/src/execution.rs
@@ -0,0 +1,440 @@
+use std::{
+    collections::{HashMap, HashSet},
+    sync::{Arc, Mutex},
+    time::Duration,
+};
+
+use thiserror::Error;
+use tokio::sync::Notify;
+use uuid::Uuid;
+
+use crate::{
+    actor::ToolActor,
+    catalog::RequestSurface,
+    invocation::ToolCallService,
+    runtime::{
+        ConsoleEntry, ExecutionCancellation, ExecutionRequest, HostToolDispatcher,
+        InvocationContext, InvocationToolDispatcher, RuntimeFailure, RuntimeManager,
+        ToolCallRecord,
+    },
+};
+
+#[derive(Clone)]
+pub struct ExecutionService {
+    runtime: RuntimeManager,
+    tool_calls: ToolCallService,
+    active: ActiveExecutions,
+}
+
+#[derive(Clone, Debug)]
+pub struct ExecuteCodeRequest {
+    pub request_id: String,
+    pub actor: ToolActor,
+    pub surface: RequestSurface,
+    pub code: String,
+    pub timeout: Duration,
+}
+
+#[derive(Clone, Debug)]
+pub struct ExecuteCodeOutput {
+    pub execution_id: String,
+    pub result: serde_json::Value,
+    pub emits: Vec<serde_json::Value>,
+    pub console: Vec<ConsoleEntry>,
+    pub calls: Vec<ToolCallRecord>,
+}
+
+#[derive(Debug, Error)]
+pub enum ExecutionServiceError {
+    #[error("TypeScript source exceeded 1 MiB")]
+    SourceTooLarge,
+    #[error("execution timeout must be between 1 millisecond and 5 minutes")]
+    InvalidTimeout,
+    #[error("the TypeScript runtime is shutting down")]
+    ShuttingDown,
+    #[error("the API token is no longer active")]
+    OwnerRevoked,
+    #[error("the execution actor stopped unexpectedly")]
+    ActorFailed,
+    #[error(transparent)]
+    Runtime(#[from] RuntimeFailure),
+}
+
+impl ExecutionService {
+    pub fn new(runtime: RuntimeManager, tool_calls: ToolCallService) -> Self {
+        Self {
+            runtime,
+            tool_calls,
+            active: ActiveExecutions::default(),
+        }
+    }
+
+    pub async fn execute(
+        &self,
+        request: ExecuteCodeRequest,
+    ) -> Result<ExecuteCodeOutput, ExecutionServiceError> {
+        if request.code.len() > crate::runtime::MAX_SOURCE_BYTES {
+            return Err(ExecutionServiceError::SourceTooLarge);
+        }
+        if request.timeout.is_zero() || request.timeout > Duration::from_secs(300) {
+            return Err(ExecutionServiceError::InvalidTimeout);
+        }
+
+        let execution_id = Uuid::new_v4().to_string();
+        let cancellation = ExecutionCancellation::default();
+        let dispatcher = Arc::new(InvocationToolDispatcher::new(
+            self.tool_calls.clone(),
+            InvocationContext {
+                request_id: request.request_id,
+                actor: request.actor.clone(),
+                surface: request.surface,
+                execution_id: execution_id.clone(),
+            },
+        ));
+        let stopper = ExecutionStopper {
+            dispatcher: dispatcher.clone(),
+            cancellation: cancellation.clone(),
+            execution_id: execution_id.clone(),
+        };
+        if let Some(hook) = dispatcher.cancellation_hook(&execution_id) {
+            cancellation.register_cancel_hook(hook);
+        }
+        let active_execution =
+            match self
+                .active
+                .register(execution_id.clone(), request.actor.clone(), stopper.clone())
+            {
+                Ok(active_execution) => active_execution,
+                Err(error) => {
+                    dispatcher.discard_unstarted();
+                    return Err(error.into());
+                }
+            };
+        let runtime = self.runtime.clone();
+        let runtime_execution_id = execution_id.clone();
+        let runtime_cancellation = cancellation.clone();
+        let execution = tokio::spawn(async move {
+            let _active_execution = active_execution;
+            runtime
+                .execute(
+                    ExecutionRequest {
+                        execution_id: runtime_execution_id,
+                        code: request.code,
+                        timeout: request.timeout,
+                    },
+                    dispatcher,
+                    runtime_cancellation,
+                )
+                .await
+        });
+        let mut cancel_on_drop = CancelOnDrop(Some(stopper));
+        let output = match execution.await {
+            Ok(output) => {
+                cancel_on_drop.disarm();
+                output?
+            }
+            Err(_) => return Err(ExecutionServiceError::ActorFailed),
+        };
+        Ok(ExecuteCodeOutput {
+            execution_id,
+            result: output.result,
+            emits: output.emits,
+            console: output.console,
+            calls: output.tool_calls,
+        })
+    }
+
+    pub async fn revoke_owner(&self, owner_api_token_id: &str) {
+        self.active.revoke_owner(owner_api_token_id).await;
+    }
+
+    pub fn cancel_all(&self) {
+        self.active.cancel_all();
+    }
+
+    pub async fn shutdown(&self) {
+        self.active.shutdown().await;
+    }
+}
+
+#[derive(Clone, Default)]
+struct ActiveExecutions {
+    state: Arc<Mutex<ActiveExecutionState>>,
+    changed: Arc<Notify>,
+}
+
+#[derive(Default)]
+struct ActiveExecutionState {
+    shutting_down: bool,
+    revoked_owners: HashSet<String>,
+    entries: HashMap<String, ActiveExecution>,
+}
+
+struct ActiveExecution {
+    actor: ToolActor,
+    stopper: ExecutionStopper,
+}
+
+struct ActiveExecutionGuard {
+    execution_id: String,
+    state: Arc<Mutex<ActiveExecutionState>>,
+    changed: Arc<Notify>,
+}
+
+#[derive(Debug)]
+enum ExecutionRegistrationError {
+    ShuttingDown,
+    OwnerRevoked,
+}
+
+impl From<ExecutionRegistrationError> for ExecutionServiceError {
+    fn from(error: ExecutionRegistrationError) -> Self {
+        match error {
+            ExecutionRegistrationError::ShuttingDown => Self::ShuttingDown,
+            ExecutionRegistrationError::OwnerRevoked => Self::OwnerRevoked,
+        }
+    }
+}
+
+impl ActiveExecutions {
+    fn register(
+        &self,
+        execution_id: String,
+        actor: ToolActor,
+        stopper: ExecutionStopper,
+    ) -> Result<ActiveExecutionGuard, ExecutionRegistrationError> {
+        let mut state = self
+            .state
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        if state.shutting_down {
+            return Err(ExecutionRegistrationError::ShuttingDown);
+        }
+        if actor
+            .api_token_id()
+            .is_some_and(|token_id| state.revoked_owners.contains(token_id))
+        {
+            return Err(ExecutionRegistrationError::OwnerRevoked);
+        }
+        state
+            .entries
+            .insert(execution_id.clone(), ActiveExecution { actor, stopper });
+        Ok(ActiveExecutionGuard {
+            execution_id,
+            state: self.state.clone(),
+            changed: self.changed.clone(),
+        })
+    }
+
+    async fn revoke_owner(&self, owner_api_token_id: &str) {
+        let stoppers = {
+            let mut state = self
+                .state
+                .lock()
+                .unwrap_or_else(std::sync::PoisonError::into_inner);
+            state.revoked_owners.insert(owner_api_token_id.to_owned());
+            state
+                .entries
+                .values()
+                .filter(|execution| execution.actor.api_token_id() == Some(owner_api_token_id))
+                .map(|execution| execution.stopper.clone())
+                .collect::<Vec<_>>()
+        };
+        for stopper in stoppers {
+            stopper.stop().await;
+        }
+    }
+
+    fn cancel_all(&self) {
+        let stoppers = {
+            let mut state = self
+                .state
+                .lock()
+                .unwrap_or_else(std::sync::PoisonError::into_inner);
+            state.shutting_down = true;
+            state
+                .entries
+                .values()
+                .map(|execution| execution.stopper.clone())
+                .collect::<Vec<_>>()
+        };
+        for stopper in stoppers {
+            stopper.stop_in_background();
+        }
+    }
+
+    async fn shutdown(&self) {
+        let stoppers = {
+            let mut state = self
+                .state
+                .lock()
+                .unwrap_or_else(std::sync::PoisonError::into_inner);
+            state.shutting_down = true;
+            state
+                .entries
+                .values()
+                .map(|execution| execution.stopper.clone())
+                .collect::<Vec<_>>()
+        };
+        for stopper in stoppers {
+            stopper.stop().await;
+        }
+        loop {
+            let changed = self.changed.notified();
+            tokio::pin!(changed);
+            changed.as_mut().enable();
+            if self
+                .state
+                .lock()
+                .unwrap_or_else(std::sync::PoisonError::into_inner)
+                .entries
+                .is_empty()
+            {
+                return;
+            }
+            changed.await;
+        }
+    }
+}
+
+impl Drop for ActiveExecutionGuard {
+    fn drop(&mut self) {
+        self.state
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+            .entries
+            .remove(&self.execution_id);
+        self.changed.notify_waiters();
+    }
+}
+
+#[derive(Clone)]
+struct ExecutionStopper {
+    dispatcher: Arc<dyn HostToolDispatcher>,
+    cancellation: ExecutionCancellation,
+    execution_id: String,
+}
+
+impl ExecutionStopper {
+    async fn stop(self) {
+        self.dispatcher.execution_stopping(&self.execution_id).await;
+        self.cancellation.cancel();
+    }
+
+    fn stop_in_background(self) {
+        self.cancellation.cancel();
+        if let Ok(handle) = tokio::runtime::Handle::try_current() {
+            handle.spawn(async move {
+                self.dispatcher.execution_stopping(&self.execution_id).await;
+            });
+        }
+    }
+}
+
+struct CancelOnDrop(Option<ExecutionStopper>);
+
+impl CancelOnDrop {
+    fn disarm(&mut self) {
+        self.0 = None;
+    }
+}
+
+impl Drop for CancelOnDrop {
+    fn drop(&mut self) {
+        if let Some(stopper) = self.0.take() {
+            stopper.stop_in_background();
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::{
+        sync::{
+            Arc,
+            atomic::{AtomicBool, Ordering},
+        },
+        time::Duration,
+    };
+
+    use super::ActiveExecutions;
+    use crate::{actor::ToolActor, runtime::ExecutionCancellation};
+
+    #[tokio::test]
+    async fn shutdown_waits_for_detached_execution_cleanup() {
+        let executions = ActiveExecutions::default();
+        let cancellation = ExecutionCancellation::default();
+        struct TestDispatcher;
+        #[async_trait::async_trait]
+        impl crate::runtime::HostToolDispatcher for TestDispatcher {
+            async fn dispatch(
+                &self,
+                _: crate::runtime::ToolCall,
+                _: ExecutionCancellation,
+            ) -> crate::runtime::ToolResult {
+                unreachable!("test dispatcher is never called")
+            }
+        }
+        let stopper = super::ExecutionStopper {
+            dispatcher: std::sync::Arc::new(TestDispatcher),
+            cancellation: cancellation.clone(),
+            execution_id: "detached-execution".to_owned(),
+        };
+        let guard = executions
+            .register(
+                "detached-execution".to_owned(),
+                ToolActor::api_token("owner-token", None),
+                stopper,
+            )
+            .expect("execution should register");
+        let shutdown_executions = executions.clone();
+        let mut shutdown = tokio::spawn(async move {
+            shutdown_executions.shutdown().await;
+        });
+        tokio::time::timeout(Duration::from_secs(1), cancellation.cancelled())
+            .await
+            .expect("shutdown should cancel the execution");
+        assert!(
+            tokio::time::timeout(Duration::from_millis(25), &mut shutdown)
+                .await
+                .is_err(),
+            "shutdown must wait for the detached actor guard"
+        );
+        drop(guard);
+        tokio::time::timeout(Duration::from_secs(1), shutdown)
+            .await
+            .expect("shutdown should finish after cleanup")
+            .expect("shutdown task should not panic");
+    }
+
+    #[test]
+    fn background_stop_runs_cancellation_hooks_synchronously() {
+        let cancellation = ExecutionCancellation::default();
+        let stopped = Arc::new(AtomicBool::new(false));
+        let hook_stopped = stopped.clone();
+        cancellation.register_cancel_hook(Arc::new(move || {
+            hook_stopped.store(true, Ordering::Release);
+        }));
+        struct TestDispatcher;
+        #[async_trait::async_trait]
+        impl crate::runtime::HostToolDispatcher for TestDispatcher {
+            async fn dispatch(
+                &self,
+                _: crate::runtime::ToolCall,
+                _: ExecutionCancellation,
+            ) -> crate::runtime::ToolResult {
+                unreachable!("test dispatcher is never called")
+            }
+        }
+        let stopper = super::ExecutionStopper {
+            dispatcher: Arc::new(TestDispatcher),
+            cancellation: cancellation.clone(),
+            execution_id: "synchronous-stop".to_owned(),
+        };
+
+        stopper.stop_in_background();
+
+        assert!(stopped.load(Ordering::Acquire));
+        assert!(cancellation.is_cancelled());
+    }
+}
diff --git a/src/graphql.rs b/src/graphql.rs
new file mode 100644
index 000000000..a4e2ee6d8
--- /dev/null
+++ b/src/graphql.rs
@@ -0,0 +1,1673 @@
+use std::collections::{BTreeMap, BTreeSet};
+
+use serde::{Deserialize, Serialize};
+use serde_json::{Map, Value, json};
+use thiserror::Error;
+
+use crate::catalog::ToolMode;
+
+const MAX_DOCUMENT_BYTES: usize = 8 * 1024 * 1024;
+const MAX_TYPES: usize = 4_096;
+const MAX_TOTAL_FIELDS: usize = 100_000;
+const MAX_ROOT_FIELDS: usize = 2_048;
+const MAX_ARGUMENTS: usize = 128;
+const MAX_INPUT_FIELDS: usize = 1_024;
+pub(crate) const MAX_INPUT_OBJECT_DEPTH: usize = 64;
+const MAX_ENUM_VALUES: usize = 4_096;
+const MAX_NAME_BYTES: usize = 128;
+const MAX_DESCRIPTION_BYTES: usize = 16 * 1024;
+const MAX_TYPE_DEPTH: usize = 8;
+const MAX_SELECTION_DEPTH: usize = 2;
+const MAX_SELECTION_FIELDS: usize = 16;
+const MAX_GENERATED_DOCUMENT_BYTES: usize = 64 * 1024;
+const MAX_GENERATED_CATALOG_BYTES: usize = 32 * 1024 * 1024;
+
+pub const INTROSPECTION_QUERY: &str = r#"query ExecutorIntrospection {
+  __schema {
+    queryType { name }
+    mutationType { name }
+    subscriptionType { name }
+    types {
+      kind
+      name
+      description
+      fields(includeDeprecated: true) {
+        name
+        description
+        isDeprecated
+        args {
+          name
+          description
+          defaultValue
+          type { ...ExecutorTypeRef }
+        }
+        type { ...ExecutorTypeRef }
+      }
+      inputFields {
+        name
+        description
+        defaultValue
+        type { ...ExecutorTypeRef }
+      }
+      enumValues(includeDeprecated: true) { name isDeprecated }
+    }
+  }
+}
+
+fragment ExecutorTypeRef on __Type {
+  kind
+  name
+  ofType {
+    kind
+    name
+    ofType {
+      kind
+      name
+      ofType {
+        kind
+        name
+        ofType {
+          kind
+          name
+          ofType {
+            kind
+            name
+            ofType {
+              kind
+              name
+              ofType {
+                kind
+                name
+                ofType { kind name }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}"#;
+
+#[derive(Clone, Debug)]
+pub struct CompiledGraphql {
+    pub document: Value,
+    pub query_type: String,
+    pub mutation_type: Option<String>,
+    pub tools: Vec<CompiledGraphqlTool>,
+}
+
+#[derive(Clone, Debug)]
+pub struct CompiledGraphqlTool {
+    pub stable_key: String,
+    pub preferred_name: String,
+    pub display_name: String,
+    pub description: Option<String>,
+    pub input_schema: Value,
+    pub output_schema: Option<Value>,
+    pub intrinsic_mode: ToolMode,
+    pub binding: GraphqlBindingV1,
+}
+
+#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum GraphqlOperation {
+    Query,
+    Mutation,
+}
+
+impl GraphqlOperation {
+    pub const fn is_mutation(self) -> bool {
+        matches!(self, Self::Mutation)
+    }
+
+    fn keyword(self) -> &'static str {
+        match self {
+            Self::Query => "query",
+            Self::Mutation => "mutation",
+        }
+    }
+
+    fn stable_component(self) -> &'static str {
+        self.keyword()
+    }
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(tag = "kind", rename_all = "snake_case", deny_unknown_fields)]
+pub enum GraphqlTypeRef {
+    Named { name: String },
+    List { of_type: Box<GraphqlTypeRef> },
+    NonNull { of_type: Box<GraphqlTypeRef> },
+}
+
+impl GraphqlTypeRef {
+    pub fn graphql_type(&self) -> String {
+        match self {
+            Self::Named { name } => name.clone(),
+            Self::List { of_type } => format!("[{}]", of_type.graphql_type()),
+            Self::NonNull { of_type } => format!("{}!", of_type.graphql_type()),
+        }
+    }
+
+    fn named_type(&self) -> &str {
+        match self {
+            Self::Named { name } => name,
+            Self::List { of_type } | Self::NonNull { of_type } => of_type.named_type(),
+        }
+    }
+
+    fn is_non_null(&self) -> bool {
+        matches!(self, Self::NonNull { .. })
+    }
+
+    fn validate(&self, depth: usize) -> Result<(), GraphqlBindingError> {
+        if depth > MAX_TYPE_DEPTH {
+            return Err(GraphqlBindingError::LimitExceeded("type_depth"));
+        }
+        match self {
+            Self::Named { name } => validate_binding_name(name),
+            Self::List { of_type } => of_type.validate(depth + 1),
+            Self::NonNull { of_type } => {
+                if matches!(of_type.as_ref(), Self::NonNull { .. }) {
+                    return Err(GraphqlBindingError::InvalidType);
+                }
+                of_type.validate(depth + 1)
+            }
+        }
+    }
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct GraphqlVariableBinding {
+    pub name: String,
+    pub type_ref: GraphqlTypeRef,
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct GraphqlSelectionField {
+    pub name: String,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub fields: Vec<GraphqlSelectionField>,
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct GraphqlBindingV1 {
+    pub version: u32,
+    pub operation: GraphqlOperation,
+    pub field_name: String,
+    pub operation_name: String,
+    pub variables: Vec<GraphqlVariableBinding>,
+    pub selection: Vec<GraphqlSelectionField>,
+    pub document: String,
+}
+
+impl GraphqlBindingV1 {
+    pub fn canonical_document(&self) -> Result<String, GraphqlBindingError> {
+        validate_binding_name(&self.field_name)?;
+        validate_binding_name(&self.operation_name)?;
+        if self.variables.len() > MAX_ARGUMENTS {
+            return Err(GraphqlBindingError::LimitExceeded("variables"));
+        }
+        let mut previous = None;
+        for variable in &self.variables {
+            validate_binding_name(&variable.name)?;
+            variable.type_ref.validate(0)?;
+            if previous.is_some_and(|previous| previous >= variable.name.as_str()) {
+                return Err(GraphqlBindingError::NonCanonicalOrder);
+            }
+            previous = Some(variable.name.as_str());
+        }
+        validate_selection(&self.selection, 0)?;
+        canonical_document(
+            self.operation,
+            &self.operation_name,
+            &self.field_name,
+            &self.variables,
+            &self.selection,
+        )
+    }
+
+    pub fn validate(&self) -> Result<(), GraphqlBindingError> {
+        if self.version != 1 {
+            return Err(GraphqlBindingError::UnsupportedVersion);
+        }
+        let canonical = self.canonical_document()?;
+        if canonical != self.document {
+            return Err(GraphqlBindingError::NonCanonicalDocument);
+        }
+        Ok(())
+    }
+
+    pub fn stable_key(&self) -> Result<String, GraphqlBindingError> {
+        self.validate()?;
+        Ok(format!(
+            "graphql:v1:{}:{}",
+            self.operation.stable_component(),
+            self.field_name
+        ))
+    }
+}
+
+#[derive(Debug, Error, Eq, PartialEq)]
+pub enum GraphqlBindingError {
+    #[error("the GraphQL binding version is not supported")]
+    UnsupportedVersion,
+    #[error("the GraphQL binding contains an invalid name")]
+    InvalidName,
+    #[error("the GraphQL binding contains an invalid type")]
+    InvalidType,
+    #[error("the GraphQL binding is not in canonical order")]
+    NonCanonicalOrder,
+    #[error("the GraphQL binding document is not canonical")]
+    NonCanonicalDocument,
+    #[error("the GraphQL binding exceeds limit {0}")]
+    LimitExceeded(&'static str),
+}
+
+#[derive(Debug, Error, Eq, PartialEq)]
+pub enum GraphqlError {
+    #[error("the GraphQL introspection response is invalid: {0}")]
+    InvalidDocument(&'static str),
+    #[error("the GraphQL introspection response contains an unsupported type: {0}")]
+    UnsupportedType(String),
+    #[error("the GraphQL introspection response exceeds compiler limit {code}")]
+    LimitExceeded { code: &'static str },
+    #[error("a generated GraphQL binding is invalid")]
+    InvalidBinding,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+enum TypeKind {
+    Scalar,
+    Object,
+    Interface,
+    Union,
+    Enum,
+    InputObject,
+}
+
+#[derive(Clone, Debug)]
+struct TypeDefinition {
+    kind: TypeKind,
+    fields: Vec<FieldDefinition>,
+    input_fields: Vec<InputValueDefinition>,
+    enum_values: Vec<String>,
+}
+
+#[derive(Clone, Debug)]
+struct FieldDefinition {
+    name: String,
+    description: Option<String>,
+    deprecated: bool,
+    arguments: Vec<InputValueDefinition>,
+    type_ref: GraphqlTypeRef,
+}
+
+#[derive(Clone, Debug)]
+struct InputValueDefinition {
+    name: String,
+    description: Option<String>,
+    has_default: bool,
+    type_ref: GraphqlTypeRef,
+}
+
+pub fn compile_introspection(document: Value) -> Result<CompiledGraphql, GraphqlError> {
+    if serde_json::to_vec(&document)
+        .map_err(|_| invalid("the response cannot be encoded"))?
+        .len()
+        > MAX_DOCUMENT_BYTES
+    {
+        return Err(limit("document_bytes"));
+    }
+    let response = document
+        .as_object()
+        .ok_or_else(|| invalid("the response must be an object"))?;
+    if response
+        .get("errors")
+        .and_then(Value::as_array)
+        .is_some_and(|errors| !errors.is_empty())
+    {
+        return Err(invalid("the response contains GraphQL errors"));
+    }
+    let schema = response
+        .get("data")
+        .unwrap_or(&document)
+        .get("__schema")
+        .and_then(Value::as_object)
+        .ok_or_else(|| invalid("the response is missing data.__schema"))?;
+    let query_type = root_type_name(schema, "queryType")?
+        .ok_or_else(|| invalid("the schema has no query root"))?;
+    let mutation_type = root_type_name(schema, "mutationType")?;
+    let types = parse_types(schema)?;
+    let input_object_depths = InputObjectDepthIndex::new(&types);
+    require_root(&types, &query_type)?;
+    if let Some(name) = &mutation_type {
+        require_root(&types, name)?;
+    }
+
+    let mut generated_bytes = 0_usize;
+    let mut tools = compile_root(
+        &types,
+        &query_type,
+        GraphqlOperation::Query,
+        &input_object_depths,
+        &mut generated_bytes,
+        MAX_GENERATED_CATALOG_BYTES,
+    )?;
+    if let Some(name) = &mutation_type {
+        tools.extend(compile_root(
+            &types,
+            name,
+            GraphqlOperation::Mutation,
+            &input_object_depths,
+            &mut generated_bytes,
+            MAX_GENERATED_CATALOG_BYTES,
+        )?);
+    }
+    Ok(CompiledGraphql {
+        document,
+        query_type,
+        mutation_type,
+        tools,
+    })
+}
+
+fn parse_types(
+    schema: &Map<String, Value>,
+) -> Result<BTreeMap<String, TypeDefinition>, GraphqlError> {
+    let values = schema
+        .get("types")
+        .and_then(Value::as_array)
+        .ok_or_else(|| invalid("the schema types must be an array"))?;
+    if values.len() > MAX_TYPES {
+        return Err(limit("types"));
+    }
+    let mut types = BTreeMap::new();
+    let mut total_fields = 0_usize;
+    for value in values {
+        let value = value
+            .as_object()
+            .ok_or_else(|| invalid("a schema type must be an object"))?;
+        let name = required_name(value, "name")?;
+        let kind = parse_named_kind(required_string(value, "kind")?)?;
+        validate_optional_description(value.get("description"))?;
+        let fields = parse_fields(value.get("fields"))?;
+        let input_fields = parse_input_values(value.get("inputFields"), MAX_INPUT_FIELDS)?;
+        let enum_values = parse_enum_values(value.get("enumValues"))?;
+        total_fields = total_fields
+            .checked_add(fields.len())
+            .and_then(|count| count.checked_add(input_fields.len()))
+            .ok_or_else(|| limit("total_fields"))?;
+        if total_fields > MAX_TOTAL_FIELDS {
+            return Err(limit("total_fields"));
+        }
+        validate_type_shape(kind, &fields, &input_fields, &enum_values)?;
+        let definition = TypeDefinition {
+            kind,
+            fields,
+            input_fields,
+            enum_values,
+        };
+        if types.insert(name, definition).is_some() {
+            return Err(invalid("type names must be unique"));
+        }
+    }
+    Ok(types)
+}
+
+fn parse_fields(value: Option<&Value>) -> Result<Vec<FieldDefinition>, GraphqlError> {
+    let Some(value) = value else {
+        return Ok(Vec::new());
+    };
+    if value.is_null() {
+        return Ok(Vec::new());
+    }
+    let fields = value
+        .as_array()
+        .ok_or_else(|| invalid("type fields must be an array or null"))?;
+    let mut parsed = Vec::with_capacity(fields.len());
+    let mut names = BTreeSet::new();
+    for field in fields {
+        let field = field
+            .as_object()
+            .ok_or_else(|| invalid("a field must be an object"))?;
+        let name = required_name(field, "name")?;
+        if !names.insert(name.clone()) {
+            return Err(invalid("field names must be unique"));
+        }
+        let description = optional_description(field.get("description"))?;
+        let deprecated = field
+            .get("isDeprecated")
+            .and_then(Value::as_bool)
+            .ok_or_else(|| invalid("field deprecation must be a boolean"))?;
+        let arguments = parse_input_values(field.get("args"), MAX_ARGUMENTS)?;
+        let type_ref = parse_type_ref(
+            field
+                .get("type")
+                .ok_or_else(|| invalid("a field is missing its type"))?,
+            0,
+        )?;
+        parsed.push(FieldDefinition {
+            name,
+            description,
+            deprecated,
+            arguments,
+            type_ref,
+        });
+    }
+    parsed.sort_by(|left, right| left.name.cmp(&right.name));
+    Ok(parsed)
+}
+
+fn parse_input_values(
+    value: Option<&Value>,
+    maximum: usize,
+) -> Result<Vec<InputValueDefinition>, GraphqlError> {
+    let Some(value) = value else {
+        return Ok(Vec::new());
+    };
+    if value.is_null() {
+        return Ok(Vec::new());
+    }
+    let values = value
+        .as_array()
+        .ok_or_else(|| invalid("input values must be an array or null"))?;
+    if values.len() > maximum {
+        return Err(limit("input_values"));
+    }
+    let mut parsed = Vec::with_capacity(values.len());
+    let mut names = BTreeSet::new();
+    for value in values {
+        let value = value
+            .as_object()
+            .ok_or_else(|| invalid("an input value must be an object"))?;
+        let name = required_name(value, "name")?;
+        if !names.insert(name.clone()) {
+            return Err(invalid("input value names must be unique"));
+        }
+        let description = optional_description(value.get("description"))?;
+        let has_default = match value.get("defaultValue") {
+            None | Some(Value::Null) => false,
+            Some(Value::String(default)) => {
+                if default.len() > MAX_DESCRIPTION_BYTES {
+                    return Err(limit("default_value_bytes"));
+                }
+                true
+            }
+            Some(_) => return Err(invalid("an input default value must be a string or null")),
+        };
+        let type_ref = parse_type_ref(
+            value
+                .get("type")
+                .ok_or_else(|| invalid("an input value is missing its type"))?,
+            0,
+        )?;
+        parsed.push(InputValueDefinition {
+            name,
+            description,
+            has_default,
+            type_ref,
+        });
+    }
+    parsed.sort_by(|left, right| left.name.cmp(&right.name));
+    Ok(parsed)
+}
+
+fn parse_enum_values(value: Option<&Value>) -> Result<Vec<String>, GraphqlError> {
+    let Some(value) = value else {
+        return Ok(Vec::new());
+    };
+    if value.is_null() {
+        return Ok(Vec::new());
+    }
+    let values = value
+        .as_array()
+        .ok_or_else(|| invalid("enum values must be an array or null"))?;
+    if values.len() > MAX_ENUM_VALUES {
+        return Err(limit("enum_values"));
+    }
+    let mut parsed = BTreeSet::new();
+    for value in values {
+        let value = value
+            .as_object()
+            .ok_or_else(|| invalid("an enum value must be an object"))?;
+        let name = required_name(value, "name")?;
+        if !parsed.insert(name) {
+            return Err(invalid("enum value names must be unique"));
+        }
+    }
+    Ok(parsed.into_iter().collect())
+}
+
+fn parse_type_ref(value: &Value, depth: usize) -> Result<GraphqlTypeRef, GraphqlError> {
+    if depth > MAX_TYPE_DEPTH {
+        return Err(limit("type_depth"));
+    }
+    let value = value
+        .as_object()
+        .ok_or_else(|| invalid("a type reference must be an object"))?;
+    let kind = required_string(value, "kind")?;
+    match kind {
+        "NON_NULL" => {
+            if depth >= MAX_TYPE_DEPTH {
+                return Err(limit("type_depth"));
+            }
+            let of_type = parse_type_ref(
+                value
+                    .get("ofType")
+                    .ok_or_else(|| invalid("a wrapping type is missing ofType"))?,
+                depth + 1,
+            )?;
+            if matches!(of_type, GraphqlTypeRef::NonNull { .. }) {
+                return Err(invalid("NON_NULL cannot wrap NON_NULL"));
+            }
+            Ok(GraphqlTypeRef::NonNull {
+                of_type: Box::new(of_type),
+            })
+        }
+        "LIST" => {
+            if depth >= MAX_TYPE_DEPTH {
+                return Err(limit("type_depth"));
+            }
+            Ok(GraphqlTypeRef::List {
+                of_type: Box::new(parse_type_ref(
+                    value
+                        .get("ofType")
+                        .ok_or_else(|| invalid("a wrapping type is missing ofType"))?,
+                    depth + 1,
+                )?),
+            })
+        }
+        "SCALAR" | "OBJECT" | "INTERFACE" | "UNION" | "ENUM" | "INPUT_OBJECT" => {
+            Ok(GraphqlTypeRef::Named {
+                name: required_name(value, "name")?,
+            })
+        }
+        _ => Err(invalid("a type reference kind is invalid")),
+    }
+}
+
+fn compile_root(
+    types: &BTreeMap<String, TypeDefinition>,
+    root_name: &str,
+    operation: GraphqlOperation,
+    input_object_depths: &InputObjectDepthIndex,
+    generated_bytes: &mut usize,
+    max_generated_bytes: usize,
+) -> Result<Vec<CompiledGraphqlTool>, GraphqlError> {
+    let root = types
+        .get(root_name)
+        .ok_or_else(|| invalid("a root type does not exist"))?;
+    if root.fields.len() > MAX_ROOT_FIELDS {
+        return Err(limit("root_fields"));
+    }
+    let mut tools = Vec::with_capacity(root.fields.len());
+    for field in &root.fields {
+        let tool = compile_tool(types, field, operation, input_object_depths)?;
+        *generated_bytes = generated_bytes
+            .checked_add(generated_tool_bytes(&tool)?)
+            .ok_or_else(|| limit("generated_catalog_bytes"))?;
+        if *generated_bytes > max_generated_bytes {
+            return Err(limit("generated_catalog_bytes"));
+        }
+        tools.push(tool);
+    }
+    Ok(tools)
+}
+
+fn generated_tool_bytes(tool: &CompiledGraphqlTool) -> Result<usize, GraphqlError> {
+    let binding = serde_json::to_vec(&tool.binding)
+        .map_err(|_| invalid("a generated binding cannot be encoded"))?;
+    [
+        &tool.input_schema,
+        tool.output_schema.as_ref().unwrap_or(&Value::Null),
+    ]
+    .into_iter()
+    .try_fold(binding.len(), |total, value| {
+        let encoded = serde_json::to_vec(value)
+            .map_err(|_| invalid("a generated schema cannot be encoded"))?;
+        total
+            .checked_add(encoded.len())
+            .ok_or_else(|| limit("generated_catalog_bytes"))
+    })
+}
+
+fn compile_tool(
+    types: &BTreeMap<String, TypeDefinition>,
+    field: &FieldDefinition,
+    operation: GraphqlOperation,
+    input_object_depths: &InputObjectDepthIndex,
+) -> Result<CompiledGraphqlTool, GraphqlError> {
+    for argument in &field.arguments {
+        require_input_type(types, &argument.type_ref)?;
+    }
+    require_output_type(types, &field.type_ref)?;
+    let variables = field
+        .arguments
+        .iter()
+        .map(|argument| GraphqlVariableBinding {
+            name: argument.name.clone(),
+            type_ref: argument.type_ref.clone(),
+        })
+        .collect::<Vec<_>>();
+    let selection = build_selection(types, &field.type_ref, 0, &mut Vec::new())?;
+    let operation_name = "ExecutorOperation".to_owned();
+    let document = canonical_document(
+        operation,
+        &operation_name,
+        &field.name,
+        &variables,
+        &selection,
+    )
+    .map_err(|_| GraphqlError::InvalidBinding)?;
+    let binding = GraphqlBindingV1 {
+        version: 1,
+        operation,
+        field_name: field.name.clone(),
+        operation_name,
+        variables,
+        selection,
+        document,
+    };
+    binding
+        .validate()
+        .map_err(|_| GraphqlError::InvalidBinding)?;
+    Ok(CompiledGraphqlTool {
+        stable_key: format!("graphql:v1:{}:{}", operation.stable_component(), field.name),
+        preferred_name: field.name.clone(),
+        display_name: field.name.clone(),
+        description: field.description.clone(),
+        input_schema: build_input_schema(types, &field.arguments, input_object_depths)?,
+        output_schema: Some(build_output_schema(
+            types,
+            &field.type_ref,
+            &binding.selection,
+        )?),
+        intrinsic_mode: if field.deprecated {
+            ToolMode::Disabled
+        } else if operation == GraphqlOperation::Mutation {
+            ToolMode::Ask
+        } else {
+            ToolMode::Enabled
+        },
+        binding,
+    })
+}
+
+fn build_input_schema(
+    types: &BTreeMap<String, TypeDefinition>,
+    arguments: &[InputValueDefinition],
+    input_object_depths: &InputObjectDepthIndex,
+) -> Result<Value, GraphqlError> {
+    input_object_depths.validate(arguments)?;
+    let mut definitions = BTreeMap::new();
+    let mut active = BTreeSet::new();
+    let mut properties = Map::new();
+    let mut required = Vec::new();
+    for argument in arguments {
+        let mut schema =
+            input_schema_for_type(types, &argument.type_ref, &mut definitions, &mut active)?;
+        if let Some(description) = &argument.description
+            && let Some(object) = schema.as_object_mut()
+        {
+            object.insert("description".to_owned(), Value::String(description.clone()));
+        }
+        properties.insert(argument.name.clone(), schema);
+        if argument.type_ref.is_non_null() && !argument.has_default {
+            required.push(Value::String(argument.name.clone()));
+        }
+    }
+    let mut schema = Map::from_iter([
+        (
+            "$schema".to_owned(),
+            Value::String("https://json-schema.org/draft/2020-12/schema".to_owned()),
+        ),
+        ("type".to_owned(), Value::String("object".to_owned())),
+        ("properties".to_owned(), Value::Object(properties)),
+        ("additionalProperties".to_owned(), Value::Bool(false)),
+    ]);
+    if !required.is_empty() {
+        schema.insert("required".to_owned(), Value::Array(required));
+    }
+    if !definitions.is_empty() {
+        schema.insert(
+            "$defs".to_owned(),
+            Value::Object(definitions.into_iter().collect()),
+        );
+    }
+    Ok(Value::Object(schema))
+}
+
+struct InputObjectDepthIndex {
+    component_by_name: BTreeMap<String, usize>,
+    depth_by_component: Vec<usize>,
+}
+
+impl InputObjectDepthIndex {
+    fn new(types: &BTreeMap<String, TypeDefinition>) -> Self {
+        let names = types
+            .iter()
+            .filter_map(|(name, definition)| {
+                (definition.kind == TypeKind::InputObject).then_some(name.as_str())
+            })
+            .collect::<Vec<_>>();
+        let indices = names
+            .iter()
+            .enumerate()
+            .map(|(index, name)| (*name, index))
+            .collect::<BTreeMap<_, _>>();
+        let mut adjacency = vec![Vec::new(); names.len()];
+        for (index, name) in names.iter().enumerate() {
+            let definition = types
+                .get(*name)
+                .expect("input object names come from the type map");
+            for field in &definition.input_fields {
+                if let Some(target) = indices.get(field.type_ref.named_type()) {
+                    adjacency[index].push(*target);
+                }
+            }
+            adjacency[index].sort_unstable();
+            adjacency[index].dedup();
+        }
+
+        let mut visited = vec![false; names.len()];
+        let mut finish_order = Vec::with_capacity(names.len());
+        for root in 0..names.len() {
+            if visited[root] {
+                continue;
+            }
+            visited[root] = true;
+            let mut stack = vec![(root, 0_usize)];
+            while let Some((node, next_edge)) = stack.last_mut() {
+                if let Some(next) = adjacency[*node].get(*next_edge).copied() {
+                    *next_edge += 1;
+                    if !visited[next] {
+                        visited[next] = true;
+                        stack.push((next, 0));
+                    }
+                } else {
+                    finish_order.push(*node);
+                    stack.pop();
+                }
+            }
+        }
+
+        let mut reverse = vec![Vec::new(); names.len()];
+        for (source, targets) in adjacency.iter().enumerate() {
+            for target in targets {
+                reverse[*target].push(source);
+            }
+        }
+        let mut component_for = vec![usize::MAX; names.len()];
+        let mut component_sizes = Vec::new();
+        for root in finish_order.into_iter().rev() {
+            if component_for[root] != usize::MAX {
+                continue;
+            }
+            let component = component_sizes.len();
+            component_for[root] = component;
+            let mut size = 0_usize;
+            let mut stack = vec![root];
+            while let Some(node) = stack.pop() {
+                size = size.saturating_add(1);
+                for previous in &reverse[node] {
+                    if component_for[*previous] == usize::MAX {
+                        component_for[*previous] = component;
+                        stack.push(*previous);
+                    }
+                }
+            }
+            component_sizes.push(size.min(MAX_INPUT_OBJECT_DEPTH + 1));
+        }
+
+        let mut component_edges = vec![BTreeSet::new(); component_sizes.len()];
+        let mut indegree = vec![0_usize; component_sizes.len()];
+        for (source, targets) in adjacency.iter().enumerate() {
+            let source_component = component_for[source];
+            for target in targets {
+                let target_component = component_for[*target];
+                if source_component != target_component
+                    && component_edges[source_component].insert(target_component)
+                {
+                    indegree[target_component] += 1;
+                }
+            }
+        }
+        let mut ready = indegree
+            .iter()
+            .enumerate()
+            .filter_map(|(component, indegree)| (*indegree == 0).then_some(component))
+            .collect::<Vec<_>>();
+        let mut topological = Vec::with_capacity(component_sizes.len());
+        while let Some(component) = ready.pop() {
+            topological.push(component);
+            for target in &component_edges[component] {
+                indegree[*target] -= 1;
+                if indegree[*target] == 0 {
+                    ready.push(*target);
+                }
+            }
+        }
+        let mut depth_by_component = component_sizes.clone();
+        for component in topological.into_iter().rev() {
+            for target in &component_edges[component] {
+                let candidate = component_sizes[component]
+                    .saturating_add(depth_by_component[*target])
+                    .min(MAX_INPUT_OBJECT_DEPTH + 1);
+                depth_by_component[component] = depth_by_component[component].max(candidate);
+            }
+        }
+        let component_by_name = names
+            .into_iter()
+            .enumerate()
+            .map(|(index, name)| (name.to_owned(), component_for[index]))
+            .collect();
+        Self {
+            component_by_name,
+            depth_by_component,
+        }
+    }
+
+    fn validate(&self, arguments: &[InputValueDefinition]) -> Result<(), GraphqlError> {
+        let over_limit = arguments.iter().any(|argument| {
+            self.component_by_name
+                .get(argument.type_ref.named_type())
+                .is_some_and(|component| {
+                    self.depth_by_component[*component] > MAX_INPUT_OBJECT_DEPTH
+                })
+        });
+        if over_limit {
+            Err(limit("input_object_depth"))
+        } else {
+            Ok(())
+        }
+    }
+}
+
+fn input_schema_for_type(
+    types: &BTreeMap<String, TypeDefinition>,
+    type_ref: &GraphqlTypeRef,
+    definitions: &mut BTreeMap<String, Value>,
+    active: &mut BTreeSet<String>,
+) -> Result<Value, GraphqlError> {
+    match type_ref {
+        GraphqlTypeRef::NonNull { of_type } => Ok(non_null_schema(input_schema_for_type(
+            types,
+            of_type,
+            definitions,
+            active,
+        )?)),
+        GraphqlTypeRef::List { of_type } => Ok(json!({
+            "type": ["array", "null"],
+            "items": input_schema_for_type(types, of_type, definitions, active)?
+        })),
+        GraphqlTypeRef::Named { name } => {
+            let definition = types
+                .get(name)
+                .ok_or_else(|| GraphqlError::UnsupportedType(name.clone()))?;
+            let base = match definition.kind {
+                TypeKind::Scalar => input_scalar_schema(name),
+                TypeKind::Enum => {
+                    json!({ "type": ["string", "null"], "enum": nullable_enum(&definition.enum_values) })
+                }
+                TypeKind::InputObject => {
+                    ensure_input_definition(types, name, definitions, active)?;
+                    json!({ "anyOf": [{ "$ref": format!("#/$defs/{name}") }, { "type": "null" }] })
+                }
+                _ => return Err(GraphqlError::UnsupportedType(name.clone())),
+            };
+            Ok(base)
+        }
+    }
+}
+
+fn ensure_input_definition(
+    types: &BTreeMap<String, TypeDefinition>,
+    name: &str,
+    definitions: &mut BTreeMap<String, Value>,
+    active: &mut BTreeSet<String>,
+) -> Result<(), GraphqlError> {
+    if definitions.contains_key(name) || active.contains(name) {
+        return Ok(());
+    }
+    if definitions.len() >= MAX_TYPES {
+        return Err(limit("input_definitions"));
+    }
+    let definition = types
+        .get(name)
+        .filter(|definition| definition.kind == TypeKind::InputObject)
+        .ok_or_else(|| GraphqlError::UnsupportedType(name.to_owned()))?;
+    active.insert(name.to_owned());
+    let mut properties = Map::new();
+    let mut required = Vec::new();
+    for field in &definition.input_fields {
+        let mut schema = input_schema_for_type(types, &field.type_ref, definitions, active)?;
+        if let Some(description) = &field.description
+            && let Some(object) = schema.as_object_mut()
+        {
+            object.insert("description".to_owned(), Value::String(description.clone()));
+        }
+        properties.insert(field.name.clone(), schema);
+        if field.type_ref.is_non_null() && !field.has_default {
+            required.push(Value::String(field.name.clone()));
+        }
+    }
+    active.remove(name);
+    let mut schema = Map::from_iter([
+        ("type".to_owned(), Value::String("object".to_owned())),
+        ("properties".to_owned(), Value::Object(properties)),
+        ("additionalProperties".to_owned(), Value::Bool(false)),
+    ]);
+    if !required.is_empty() {
+        schema.insert("required".to_owned(), Value::Array(required));
+    }
+    definitions.insert(name.to_owned(), Value::Object(schema));
+    Ok(())
+}
+
+fn build_selection(
+    types: &BTreeMap<String, TypeDefinition>,
+    type_ref: &GraphqlTypeRef,
+    depth: usize,
+    stack: &mut Vec<String>,
+) -> Result<Vec<GraphqlSelectionField>, GraphqlError> {
+    let name = type_ref.named_type();
+    let definition = types
+        .get(name)
+        .ok_or_else(|| GraphqlError::UnsupportedType(name.to_owned()))?;
+    match definition.kind {
+        TypeKind::Scalar | TypeKind::Enum => Ok(Vec::new()),
+        TypeKind::Union => Ok(vec![GraphqlSelectionField {
+            name: "__typename".to_owned(),
+            fields: Vec::new(),
+        }]),
+        TypeKind::Object | TypeKind::Interface => {
+            let mut selection = vec![GraphqlSelectionField {
+                name: "__typename".to_owned(),
+                fields: Vec::new(),
+            }];
+            if depth >= MAX_SELECTION_DEPTH || stack.iter().any(|item| item == name) {
+                return Ok(selection);
+            }
+            stack.push(name.to_owned());
+            for field in &definition.fields {
+                if selection.len() >= MAX_SELECTION_FIELDS
+                    || field
+                        .arguments
+                        .iter()
+                        .any(|argument| argument.type_ref.is_non_null() && !argument.has_default)
+                {
+                    continue;
+                }
+                let field_type = types.get(field.type_ref.named_type()).ok_or_else(|| {
+                    GraphqlError::UnsupportedType(field.type_ref.named_type().to_owned())
+                })?;
+                let fields = match field_type.kind {
+                    TypeKind::Scalar | TypeKind::Enum => Vec::new(),
+                    TypeKind::Object | TypeKind::Interface | TypeKind::Union => {
+                        build_selection(types, &field.type_ref, depth + 1, stack)?
+                    }
+                    TypeKind::InputObject => continue,
+                };
+                selection.push(GraphqlSelectionField {
+                    name: field.name.clone(),
+                    fields,
+                });
+            }
+            stack.pop();
+            selection.sort_by(|left, right| left.name.cmp(&right.name));
+            Ok(selection)
+        }
+        TypeKind::InputObject => Err(GraphqlError::UnsupportedType(name.to_owned())),
+    }
+}
+
+fn build_output_schema(
+    types: &BTreeMap<String, TypeDefinition>,
+    type_ref: &GraphqlTypeRef,
+    selection: &[GraphqlSelectionField],
+) -> Result<Value, GraphqlError> {
+    match type_ref {
+        GraphqlTypeRef::NonNull { of_type } => Ok(non_null_schema(build_output_schema(
+            types, of_type, selection,
+        )?)),
+        GraphqlTypeRef::List { of_type } => Ok(json!({
+            "type": ["array", "null"],
+            "items": build_output_schema(types, of_type, selection)?
+        })),
+        GraphqlTypeRef::Named { name } => {
+            let definition = types
+                .get(name)
+                .ok_or_else(|| GraphqlError::UnsupportedType(name.clone()))?;
+            match definition.kind {
+                TypeKind::Scalar => Ok(scalar_schema(name)),
+                TypeKind::Enum => Ok(
+                    json!({ "type": ["string", "null"], "enum": nullable_enum(&definition.enum_values) }),
+                ),
+                TypeKind::Object | TypeKind::Interface | TypeKind::Union => {
+                    let mut properties = Map::new();
+                    for selected in selection {
+                        if selected.name == "__typename" {
+                            properties.insert(selected.name.clone(), json!({ "type": "string" }));
+                            continue;
+                        }
+                        let field = definition
+                            .fields
+                            .iter()
+                            .find(|field| field.name == selected.name)
+                            .ok_or_else(|| invalid("a generated selection field is missing"))?;
+                        properties.insert(
+                            selected.name.clone(),
+                            build_output_schema(types, &field.type_ref, &selected.fields)?,
+                        );
+                    }
+                    Ok(json!({
+                        "type": ["object", "null"],
+                        "properties": properties,
+                        "additionalProperties": false
+                    }))
+                }
+                TypeKind::InputObject => Err(GraphqlError::UnsupportedType(name.clone())),
+            }
+        }
+    }
+}
+
+fn scalar_schema(name: &str) -> Value {
+    match name {
+        "String" | "ID" => json!({ "type": ["string", "null"] }),
+        "Boolean" => json!({ "type": ["boolean", "null"] }),
+        "Int" => {
+            json!({ "type": ["integer", "null"], "minimum": -2147483648_i64, "maximum": 2147483647_i64 })
+        }
+        "Float" => json!({ "type": ["number", "null"] }),
+        _ => json!({ "type": ["string", "number", "boolean", "object", "array", "null"] }),
+    }
+}
+
+fn input_scalar_schema(name: &str) -> Value {
+    if name == "ID" {
+        json!({ "type": ["string", "integer", "null"] })
+    } else {
+        scalar_schema(name)
+    }
+}
+
+fn nullable_enum(values: &[String]) -> Vec<Value> {
+    values
+        .iter()
+        .cloned()
+        .map(Value::String)
+        .chain(std::iter::once(Value::Null))
+        .collect()
+}
+
+fn non_null_schema(mut schema: Value) -> Value {
+    let Some(object) = schema.as_object_mut() else {
+        return schema;
+    };
+    let singular_type = if let Some(Value::Array(types)) = object.get_mut("type") {
+        types.retain(|value| value != "null");
+        (types.len() == 1).then(|| types[0].clone())
+    } else {
+        None
+    };
+    if let Some(singular_type) = singular_type {
+        object.insert("type".to_owned(), singular_type);
+    }
+    if let Some(Value::Array(values)) = object.get_mut("enum") {
+        values.retain(|value| !value.is_null());
+    }
+    if let Some(Value::Array(alternatives)) = object.get_mut("anyOf") {
+        alternatives.retain(|alternative| alternative.get("type") != Some(&json!("null")));
+    }
+    schema
+}
+
+fn canonical_document(
+    operation: GraphqlOperation,
+    operation_name: &str,
+    field_name: &str,
+    variables: &[GraphqlVariableBinding],
+    selection: &[GraphqlSelectionField],
+) -> Result<String, GraphqlBindingError> {
+    let definitions = variables
+        .iter()
+        .map(|variable| format!("${}: {}", variable.name, variable.type_ref.graphql_type()))
+        .collect::<Vec<_>>();
+    let arguments = variables
+        .iter()
+        .map(|variable| format!("{}: ${}", variable.name, variable.name))
+        .collect::<Vec<_>>();
+    let mut document = format!("{} {}", operation.keyword(), operation_name);
+    if !definitions.is_empty() {
+        document.push('(');
+        document.push_str(&definitions.join(", "));
+        document.push(')');
+    }
+    document.push_str(" { result: ");
+    document.push_str(field_name);
+    if !arguments.is_empty() {
+        document.push('(');
+        document.push_str(&arguments.join(", "));
+        document.push(')');
+    }
+    render_selection(&mut document, selection);
+    document.push_str(" }");
+    if document.len() > MAX_GENERATED_DOCUMENT_BYTES {
+        return Err(GraphqlBindingError::LimitExceeded("document_bytes"));
+    }
+    Ok(document)
+}
+
+fn render_selection(document: &mut String, selection: &[GraphqlSelectionField]) {
+    if selection.is_empty() {
+        return;
+    }
+    document.push_str(" { ");
+    for (index, field) in selection.iter().enumerate() {
+        if index != 0 {
+            document.push(' ');
+        }
+        document.push_str(&field.name);
+        render_selection(document, &field.fields);
+    }
+    document.push_str(" }");
+}
+
+fn validate_selection(
+    selection: &[GraphqlSelectionField],
+    depth: usize,
+) -> Result<(), GraphqlBindingError> {
+    if depth > MAX_SELECTION_DEPTH + 1 {
+        return Err(GraphqlBindingError::LimitExceeded("selection_depth"));
+    }
+    if selection.len() > MAX_SELECTION_FIELDS {
+        return Err(GraphqlBindingError::LimitExceeded("selection_fields"));
+    }
+    let mut previous = None;
+    for field in selection {
+        validate_binding_name(&field.name)?;
+        if previous.is_some_and(|previous| previous >= field.name.as_str()) {
+            return Err(GraphqlBindingError::NonCanonicalOrder);
+        }
+        previous = Some(field.name.as_str());
+        validate_selection(&field.fields, depth + 1)?;
+    }
+    Ok(())
+}
+
+fn validate_binding_name(name: &str) -> Result<(), GraphqlBindingError> {
+    if valid_name(name) {
+        Ok(())
+    } else {
+        Err(GraphqlBindingError::InvalidName)
+    }
+}
+
+fn require_root(types: &BTreeMap<String, TypeDefinition>, name: &str) -> Result<(), GraphqlError> {
+    if types
+        .get(name)
+        .is_some_and(|root| root.kind == TypeKind::Object)
+    {
+        Ok(())
+    } else {
+        Err(invalid("a root type must be an object"))
+    }
+}
+
+fn require_input_type(
+    types: &BTreeMap<String, TypeDefinition>,
+    type_ref: &GraphqlTypeRef,
+) -> Result<(), GraphqlError> {
+    let name = type_ref.named_type();
+    if types.get(name).is_some_and(|definition| {
+        matches!(
+            definition.kind,
+            TypeKind::Scalar | TypeKind::Enum | TypeKind::InputObject
+        )
+    }) {
+        Ok(())
+    } else {
+        Err(GraphqlError::UnsupportedType(name.to_owned()))
+    }
+}
+
+fn require_output_type(
+    types: &BTreeMap<String, TypeDefinition>,
+    type_ref: &GraphqlTypeRef,
+) -> Result<(), GraphqlError> {
+    let name = type_ref.named_type();
+    if types.get(name).is_some_and(|definition| {
+        matches!(
+            definition.kind,
+            TypeKind::Scalar
+                | TypeKind::Enum
+                | TypeKind::Object
+                | TypeKind::Interface
+                | TypeKind::Union
+        )
+    }) {
+        Ok(())
+    } else {
+        Err(GraphqlError::UnsupportedType(name.to_owned()))
+    }
+}
+
+fn validate_type_shape(
+    kind: TypeKind,
+    fields: &[FieldDefinition],
+    input_fields: &[InputValueDefinition],
+    enum_values: &[String],
+) -> Result<(), GraphqlError> {
+    let valid = match kind {
+        TypeKind::Scalar => fields.is_empty() && input_fields.is_empty() && enum_values.is_empty(),
+        TypeKind::Object | TypeKind::Interface => input_fields.is_empty() && enum_values.is_empty(),
+        TypeKind::Union => fields.is_empty() && input_fields.is_empty() && enum_values.is_empty(),
+        TypeKind::Enum => fields.is_empty() && input_fields.is_empty(),
+        TypeKind::InputObject => fields.is_empty() && enum_values.is_empty(),
+    };
+    if valid {
+        Ok(())
+    } else {
+        Err(invalid(
+            "a named type has fields that do not match its kind",
+        ))
+    }
+}
+
+fn parse_named_kind(kind: &str) -> Result<TypeKind, GraphqlError> {
+    match kind {
+        "SCALAR" => Ok(TypeKind::Scalar),
+        "OBJECT" => Ok(TypeKind::Object),
+        "INTERFACE" => Ok(TypeKind::Interface),
+        "UNION" => Ok(TypeKind::Union),
+        "ENUM" => Ok(TypeKind::Enum),
+        "INPUT_OBJECT" => Ok(TypeKind::InputObject),
+        _ => Err(invalid("a named type kind is invalid")),
+    }
+}
+
+fn root_type_name(
+    schema: &Map<String, Value>,
+    field: &'static str,
+) -> Result<Option<String>, GraphqlError> {
+    match schema.get(field) {
+        None | Some(Value::Null) => Ok(None),
+        Some(Value::Object(root)) => Ok(Some(required_name(root, "name")?)),
+        Some(_) => Err(invalid("a root type reference must be an object or null")),
+    }
+}
+
+fn required_name(object: &Map<String, Value>, field: &'static str) -> Result<String, GraphqlError> {
+    let name = required_string(object, field)?;
+    if valid_name(name) {
+        Ok(name.to_owned())
+    } else {
+        Err(invalid("a GraphQL name is invalid"))
+    }
+}
+
+fn valid_name(name: &str) -> bool {
+    if name.is_empty() || name.len() > MAX_NAME_BYTES {
+        return false;
+    }
+    let mut bytes = name.bytes();
+    bytes
+        .next()
+        .is_some_and(|byte| byte == b'_' || byte.is_ascii_alphabetic())
+        && bytes.all(|byte| byte == b'_' || byte.is_ascii_alphanumeric())
+}
+
+fn required_string<'a>(
+    object: &'a Map<String, Value>,
+    field: &'static str,
+) -> Result<&'a str, GraphqlError> {
+    object
+        .get(field)
+        .and_then(Value::as_str)
+        .ok_or_else(|| invalid("a required string field is missing"))
+}
+
+fn optional_description(value: Option<&Value>) -> Result<Option<String>, GraphqlError> {
+    match value {
+        None | Some(Value::Null) => Ok(None),
+        Some(Value::String(value)) if value.len() <= MAX_DESCRIPTION_BYTES => {
+            Ok(Some(value.clone()))
+        }
+        Some(Value::String(_)) => Err(limit("description_bytes")),
+        Some(_) => Err(invalid("a description must be a string or null")),
+    }
+}
+
+fn validate_optional_description(value: Option<&Value>) -> Result<(), GraphqlError> {
+    optional_description(value).map(|_| ())
+}
+
+fn invalid(message: &'static str) -> GraphqlError {
+    GraphqlError::InvalidDocument(message)
+}
+
+fn limit(code: &'static str) -> GraphqlError {
+    GraphqlError::LimitExceeded { code }
+}
+
+#[cfg(test)]
+mod tests {
+    use serde_json::{Value, json};
+
+    use super::{
+        GraphqlBindingError, GraphqlError, GraphqlOperation, ToolMode, compile_introspection,
+        compile_root, parse_type_ref, parse_types,
+    };
+
+    fn named(kind: &str, name: &str) -> Value {
+        json!({ "kind": kind, "name": name, "ofType": null })
+    }
+
+    fn non_null(inner: Value) -> Value {
+        json!({ "kind": "NON_NULL", "name": null, "ofType": inner })
+    }
+
+    fn list(inner: Value) -> Value {
+        json!({ "kind": "LIST", "name": null, "ofType": inner })
+    }
+
+    fn schema() -> Value {
+        json!({
+            "data": {
+                "__schema": {
+                    "queryType": { "name": "Query" },
+                    "mutationType": { "name": "Mutation" },
+                    "subscriptionType": { "name": "Subscription" },
+                    "types": [
+                        { "kind": "SCALAR", "name": "String", "description": null, "fields": null, "inputFields": null, "enumValues": null },
+                        { "kind": "SCALAR", "name": "ID", "description": null, "fields": null, "inputFields": null, "enumValues": null },
+                        { "kind": "OBJECT", "name": "User", "description": null, "inputFields": null, "enumValues": null, "fields": [
+                            { "name": "name", "description": null, "isDeprecated": false, "args": [], "type": named("SCALAR", "String") }
+                        ] },
+                        { "kind": "OBJECT", "name": "Query", "description": null, "inputFields": null, "enumValues": null, "fields": [
+                            { "name": "user", "description": "Fetch user", "isDeprecated": false, "args": [
+                                { "name": "id", "description": null, "defaultValue": null, "type": non_null(named("SCALAR", "ID")) }
+                            ], "type": named("OBJECT", "User") }
+                        ] },
+                        { "kind": "OBJECT", "name": "Mutation", "description": null, "inputFields": null, "enumValues": null, "fields": [
+                            { "name": "removeUser", "description": null, "isDeprecated": true, "args": [], "type": named("SCALAR", "String") }
+                        ] }
+                    ]
+                }
+            }
+        })
+    }
+
+    fn input_object(name: &str, fields: Vec<Value>) -> Value {
+        json!({
+            "kind": "INPUT_OBJECT",
+            "name": name,
+            "description": null,
+            "fields": null,
+            "inputFields": fields,
+            "enumValues": null
+        })
+    }
+
+    fn input_field(name: &str, type_name: &str) -> Value {
+        json!({
+            "name": name,
+            "description": null,
+            "defaultValue": null,
+            "type": named("INPUT_OBJECT", type_name)
+        })
+    }
+
+    fn set_query_arguments(document: &mut Value, arguments: Vec<Value>) {
+        let query = document["data"]["__schema"]["types"]
+            .as_array_mut()
+            .expect("schema types are an array")
+            .iter_mut()
+            .find(|definition| definition["name"] == "Query")
+            .expect("query type exists");
+        query["fields"][0]["args"] = Value::Array(arguments);
+    }
+
+    fn push_schema_types(document: &mut Value, definitions: impl IntoIterator<Item = Value>) {
+        document["data"]["__schema"]["types"]
+            .as_array_mut()
+            .expect("schema types are an array")
+            .extend(definitions);
+    }
+
+    #[test]
+    fn compiles_root_fields_with_stable_modes_and_fixed_documents() {
+        let compiled = compile_introspection(schema()).expect("schema compiles");
+        assert_eq!(compiled.tools.len(), 2);
+        let query = &compiled.tools[0];
+        assert_eq!(query.stable_key, "graphql:v1:query:user");
+        assert_eq!(query.intrinsic_mode, ToolMode::Enabled);
+        assert_eq!(query.binding.operation, GraphqlOperation::Query);
+        assert_eq!(
+            query.binding.document,
+            "query ExecutorOperation($id: ID!) { result: user(id: $id) { __typename name } }"
+        );
+        assert_eq!(query.input_schema["required"], json!(["id"]));
+        assert_eq!(
+            query.input_schema["properties"]["id"]["type"],
+            json!(["string", "integer"])
+        );
+        let validator =
+            jsonschema::validator_for(&query.input_schema).expect("compiled input schema is valid");
+        assert!(validator.is_valid(&json!({ "id": 42 })));
+
+        let mutation = &compiled.tools[1];
+        assert_eq!(mutation.stable_key, "graphql:v1:mutation:removeUser");
+        assert_eq!(mutation.intrinsic_mode, ToolMode::Disabled);
+        assert_eq!(mutation.binding.operation, GraphqlOperation::Mutation);
+    }
+
+    #[test]
+    fn persisted_document_must_exactly_match_typed_metadata() {
+        let mut compiled = compile_introspection(schema()).expect("schema compiles");
+        compiled.tools[0].binding.document = "query Evil { result: adminSecrets }".to_owned();
+        assert_eq!(
+            compiled.tools[0].binding.validate(),
+            Err(GraphqlBindingError::NonCanonicalDocument)
+        );
+    }
+
+    #[test]
+    fn binding_identity_changes_when_a_field_is_coherently_rewritten() {
+        let compiled = compile_introspection(schema()).expect("schema compiles");
+        let original = &compiled.tools[0].binding;
+        let mut rewritten = original.clone();
+        rewritten.field_name = "otherUser".to_owned();
+        rewritten.document = rewritten
+            .canonical_document()
+            .expect("rewritten binding is canonical");
+
+        assert_ne!(
+            original.stable_key().expect("original binding is valid"),
+            rewritten.stable_key().expect("rewritten binding is valid")
+        );
+    }
+
+    #[test]
+    fn non_null_arguments_reject_null_at_every_required_layer() {
+        let mut document = schema();
+        document["data"]["__schema"]["types"][3]["fields"][0]["args"]
+            .as_array_mut()
+            .expect("query arguments are an array")
+            .push(json!({
+                "name": "tags",
+                "description": null,
+                "defaultValue": null,
+                "type": non_null(list(non_null(named("SCALAR", "String"))))
+            }));
+        let compiled = compile_introspection(document).expect("schema compiles");
+        let validator = jsonschema::validator_for(&compiled.tools[0].input_schema)
+            .expect("compiled input schema is valid");
+
+        assert!(validator.is_valid(&json!({ "id": "1", "tags": ["one"] })));
+        assert!(!validator.is_valid(&json!({ "id": null, "tags": ["one"] })));
+        assert!(!validator.is_valid(&json!({ "id": "1", "tags": null })));
+        assert!(!validator.is_valid(&json!({ "id": "1", "tags": [null] })));
+    }
+
+    #[test]
+    fn subscriptions_are_not_compiled() {
+        let compiled = compile_introspection(schema()).expect("schema compiles");
+        assert!(
+            compiled
+                .tools
+                .iter()
+                .all(|tool| !tool.stable_key.contains("subscription"))
+        );
+    }
+
+    #[test]
+    fn partial_introspection_errors_are_rejected() {
+        let mut document = schema();
+        document["errors"] = json!([{ "message": "partial" }]);
+        assert!(compile_introspection(document).is_err());
+    }
+
+    #[test]
+    fn aggregate_generated_catalog_budget_stops_schema_amplification() {
+        let document = schema();
+        let schema = document["data"]["__schema"]
+            .as_object()
+            .expect("test schema is an object");
+        let types = parse_types(schema).expect("test types parse");
+        let input_object_depths = super::InputObjectDepthIndex::new(&types);
+        let mut generated_bytes = 0;
+        let error = compile_root(
+            &types,
+            "Query",
+            GraphqlOperation::Query,
+            &input_object_depths,
+            &mut generated_bytes,
+            1,
+        )
+        .expect_err("generated output exceeding the aggregate budget is rejected");
+        assert_eq!(
+            error,
+            GraphqlError::LimitExceeded {
+                code: "generated_catalog_bytes"
+            }
+        );
+    }
+
+    #[test]
+    fn input_object_dependency_depth_is_bounded_independent_of_root_order() {
+        let mut document = schema();
+        let definitions = (0..=super::MAX_INPUT_OBJECT_DEPTH)
+            .map(|index| {
+                let name = format!("Input{index}");
+                let fields = if index == super::MAX_INPUT_OBJECT_DEPTH {
+                    vec![json!({
+                        "name": "value",
+                        "description": null,
+                        "defaultValue": null,
+                        "type": named("SCALAR", "String")
+                    })]
+                } else {
+                    vec![input_field("next", &format!("Input{}", index + 1))]
+                };
+                input_object(&name, fields)
+            })
+            .collect::<Vec<_>>();
+        push_schema_types(&mut document, definitions);
+        set_query_arguments(
+            &mut document,
+            vec![
+                input_field("aTail", &format!("Input{}", super::MAX_INPUT_OBJECT_DEPTH)),
+                input_field("zHead", "Input0"),
+            ],
+        );
+
+        assert_eq!(
+            compile_introspection(document).expect_err("deep input graph is rejected"),
+            GraphqlError::LimitExceeded {
+                code: "input_object_depth"
+            }
+        );
+    }
+
+    #[test]
+    fn maximum_input_object_dependency_depth_is_supported() {
+        let mut document = schema();
+        let definitions = (0..super::MAX_INPUT_OBJECT_DEPTH)
+            .map(|index| {
+                let name = format!("Input{index}");
+                let fields = if index + 1 == super::MAX_INPUT_OBJECT_DEPTH {
+                    vec![json!({
+                        "name": "value",
+                        "description": null,
+                        "defaultValue": null,
+                        "type": named("SCALAR", "String")
+                    })]
+                } else {
+                    vec![input_field("next", &format!("Input{}", index + 1))]
+                };
+                input_object(&name, fields)
+            })
+            .collect::<Vec<_>>();
+        push_schema_types(&mut document, definitions);
+        set_query_arguments(&mut document, vec![input_field("input", "Input0")]);
+
+        compile_introspection(document).expect("the maximum input depth compiles");
+    }
+
+    #[test]
+    fn bounded_recursive_input_objects_are_supported() {
+        let mut document = schema();
+        push_schema_types(
+            &mut document,
+            [
+                input_object("RecursiveA", vec![input_field("b", "RecursiveB")]),
+                input_object("RecursiveB", vec![input_field("a", "RecursiveA")]),
+            ],
+        );
+        set_query_arguments(&mut document, vec![input_field("recursive", "RecursiveA")]);
+
+        let compiled = compile_introspection(document).expect("bounded cycle compiles");
+        assert!(compiled.tools[0].input_schema["$defs"]["RecursiveA"].is_object());
+        assert!(compiled.tools[0].input_schema["$defs"]["RecursiveB"].is_object());
+    }
+
+    #[test]
+    fn wide_shallow_input_object_graphs_do_not_consume_the_depth_budget() {
+        let mut document = schema();
+        let leaf_count = super::MAX_INPUT_OBJECT_DEPTH + 1;
+        let root_fields = (0..leaf_count)
+            .map(|index| input_field(&format!("field{index}"), &format!("Leaf{index}")))
+            .collect::<Vec<_>>();
+        let definitions = std::iter::once(input_object("WideInput", root_fields))
+            .chain((0..leaf_count).map(|index| input_object(&format!("Leaf{index}"), Vec::new())));
+        push_schema_types(&mut document, definitions);
+        set_query_arguments(&mut document, vec![input_field("wide", "WideInput")]);
+
+        let compiled = compile_introspection(document).expect("wide shallow graph compiles");
+        assert_eq!(
+            compiled.tools[0].input_schema["$defs"]
+                .as_object()
+                .expect("input definitions exist")
+                .len(),
+            leaf_count + 1
+        );
+    }
+
+    #[test]
+    fn wrapper_depth_beyond_the_introspection_query_is_a_declared_limit() {
+        let mut type_ref = named("SCALAR", "String");
+        for _ in 0..=super::MAX_TYPE_DEPTH {
+            type_ref = list(type_ref);
+        }
+        assert_eq!(
+            parse_type_ref(&type_ref, 0),
+            Err(GraphqlError::LimitExceeded { code: "type_depth" })
+        );
+    }
+}
diff --git a/src/invocation/idempotency.rs b/src/invocation/idempotency.rs
new file mode 100644
index 000000000..49e012995
--- /dev/null
+++ b/src/invocation/idempotency.rs
@@ -0,0 +1,1889 @@
+use std::{
+    collections::BTreeMap,
+    sync::Arc,
+    time::{SystemTime, UNIX_EPOCH},
+};
+
+use base64::{Engine as _, engine::general_purpose::STANDARD};
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+use sqlx::{FromRow, SqlitePool};
+use subtle::ConstantTimeEq;
+use thiserror::Error;
+use uuid::Uuid;
+
+use crate::crypto::{CryptoError, Keyring};
+
+pub(crate) const IDEMPOTENCY_KEY_MAX_BYTES: usize = 255;
+pub(crate) const IDEMPOTENCY_TTL_SECONDS: i64 = 24 * 60 * 60;
+const MAX_ARGUMENT_BYTES: usize = 8 * 1024 * 1024;
+const MAX_RESPONSE_BODY_BYTES: usize = 8 * 1024 * 1024;
+const MAX_RESPONSE_HEADER_BYTES: usize = 64 * 1024;
+const MAX_RESPONSE_HEADERS: usize = 64;
+const MAX_RESPONSE_CIPHERTEXT_BYTES: i64 = 12 * 1024 * 1024;
+const MAX_TOTAL_RESPONSE_CIPHERTEXT_BYTES: i64 = 64 * 1024 * 1024;
+const MAX_RECORDS: i64 = 10_000;
+const MAX_RECORDS_PER_OWNER: i64 = 1_000;
+
+#[derive(Clone, Copy)]
+struct IdempotencyLimits {
+    records: i64,
+    records_per_owner: i64,
+    response_ciphertext_bytes: i64,
+}
+
+impl Default for IdempotencyLimits {
+    fn default() -> Self {
+        Self {
+            records: MAX_RECORDS,
+            records_per_owner: MAX_RECORDS_PER_OWNER,
+            response_ciphertext_bytes: MAX_TOTAL_RESPONSE_CIPHERTEXT_BYTES,
+        }
+    }
+}
+
+trait IdempotencyClock: Send + Sync + 'static {
+    fn now(&self) -> i64;
+}
+
+#[derive(Clone, Copy, Default)]
+struct SystemClock;
+
+impl IdempotencyClock for SystemClock {
+    fn now(&self) -> i64 {
+        SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .expect("system time must be after the Unix epoch")
+            .as_secs() as i64
+    }
+}
+
+#[derive(Clone)]
+pub(crate) struct GatewayIdempotencyStore {
+    pool: SqlitePool,
+    keyring: Keyring,
+    clock: Arc<dyn IdempotencyClock>,
+    limits: IdempotencyLimits,
+}
+
+#[derive(Clone, Copy)]
+pub(crate) struct IdempotencyOwner<'a> {
+    pub owner_api_token_id: &'a str,
+}
+
+pub(crate) struct IdempotencyRequest<'a> {
+    pub owner: IdempotencyOwner<'a>,
+    pub key: &'a str,
+    pub route: &'a str,
+    pub callable_path: &'a str,
+    pub arguments: &'a Value,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub(crate) enum IdempotencyState {
+    Reserved,
+    Executing,
+    Completed,
+    Indeterminate,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub(crate) enum IdempotencyResponseKind {
+    Tool,
+    Approval,
+}
+
+impl IdempotencyResponseKind {
+    const fn as_str(self) -> &'static str {
+        match self {
+            Self::Tool => "tool",
+            Self::Approval => "approval",
+        }
+    }
+}
+
+impl IdempotencyState {
+    const fn as_str(self) -> &'static str {
+        match self {
+            Self::Reserved => "reserved",
+            Self::Executing => "executing",
+            Self::Completed => "completed",
+            Self::Indeterminate => "indeterminate",
+        }
+    }
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub(crate) struct IdempotencyRecord {
+    pub id: String,
+    pub owner_api_token_id: String,
+    pub state: IdempotencyState,
+    pub approval_id: Option<String>,
+    pub response_kind: Option<IdempotencyResponseKind>,
+    pub created_at: i64,
+    pub updated_at: i64,
+    pub completed_at: Option<i64>,
+    pub expires_at: Option<i64>,
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+pub(crate) struct IdempotencyResponse {
+    pub status: u16,
+    pub headers: BTreeMap<String, String>,
+    pub body: Vec<u8>,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub(crate) enum IdempotencyClaim {
+    Fresh(IdempotencyRecord),
+    InProgress(IdempotencyRecord),
+    Replay {
+        record: IdempotencyRecord,
+        response: IdempotencyResponse,
+    },
+    Indeterminate(IdempotencyRecord),
+    Mismatch,
+}
+
+pub(crate) enum CorrelatedApproval {
+    Live(String),
+    Retired,
+}
+
+#[derive(Clone, Debug, Default, Eq, PartialEq)]
+pub(crate) struct IdempotencyRecovery {
+    pub indeterminate_executions: u64,
+    pub reserved: Vec<IdempotencyRecord>,
+}
+
+#[derive(Debug, Error)]
+pub(crate) enum IdempotencyError {
+    #[error("gateway idempotency storage failed: {0}")]
+    Database(#[from] sqlx::Error),
+    #[error("gateway idempotency protection failed: {0}")]
+    Crypto(#[from] CryptoError),
+    #[error("gateway idempotency JSON failed: {0}")]
+    Json(#[from] serde_json::Error),
+    #[error("the Idempotency-Key must contain between 1 and 255 visible ASCII bytes")]
+    InvalidKey,
+    #[error("gateway idempotency metadata is invalid")]
+    InvalidMetadata,
+    #[error("the gateway idempotency payload exceeds the allowed size")]
+    PayloadTooLarge,
+    #[error("gateway idempotency capacity has been reached")]
+    Capacity,
+    #[error("the gateway idempotency record was not found")]
+    NotFound,
+    #[error("the gateway idempotency record cannot transition from {0}")]
+    InvalidTransition(&'static str),
+    #[error("stored gateway idempotency data is invalid")]
+    CorruptData,
+}
+
+impl GatewayIdempotencyStore {
+    pub(crate) fn new(pool: SqlitePool, keyring: Keyring) -> Self {
+        Self {
+            pool,
+            keyring,
+            clock: Arc::new(SystemClock),
+            limits: IdempotencyLimits::default(),
+        }
+    }
+
+    #[cfg(test)]
+    fn with_clock(pool: SqlitePool, keyring: Keyring, clock: Arc<dyn IdempotencyClock>) -> Self {
+        Self {
+            pool,
+            keyring,
+            clock,
+            limits: IdempotencyLimits::default(),
+        }
+    }
+
+    #[cfg(test)]
+    fn with_limits(mut self, limits: IdempotencyLimits) -> Self {
+        self.limits = limits;
+        self
+    }
+
+    #[cfg(test)]
+    pub(super) fn with_response_ciphertext_capacity(mut self, bytes: i64) -> Self {
+        self.limits.response_ciphertext_bytes = bytes;
+        self
+    }
+
+    pub(crate) async fn claim(
+        &self,
+        request: IdempotencyRequest<'_>,
+    ) -> Result<IdempotencyClaim, IdempotencyError> {
+        validate_identifier(request.owner.owner_api_token_id, 128)?;
+        validate_key(request.key)?;
+        validate_identifier(request.route, 200)?;
+        let callable_path = canonical_callable_path(request.callable_path)?;
+        let canonical_arguments = canonical_json(request.arguments)?;
+        if canonical_arguments.len() > MAX_ARGUMENT_BYTES {
+            return Err(IdempotencyError::PayloadTooLarge);
+        }
+        let key_digest = self.key_digest(request.owner, request.key);
+        let request_digest = self.request_digest(
+            request.owner,
+            request.route,
+            &callable_path,
+            &canonical_arguments,
+        );
+        let id = Uuid::new_v4().to_string();
+        let observed_now = self.clock.now().max(0);
+        let mut transaction = self.pool.begin().await?;
+        let now = effective_now_in(&mut transaction, observed_now).await?;
+        delete_expired(&mut transaction, now).await?;
+        let inserted = sqlx::query(
+            "INSERT INTO gateway_invocation_idempotency ( \
+                 id, owner_api_token_id, key_digest, request_digest, state, created_at, updated_at \
+             ) SELECT ?, ?, ?, ?, 'reserved', ?, ? \
+             WHERE (SELECT COUNT(*) FROM gateway_invocation_idempotency) < ? \
+               AND (SELECT COUNT(*) FROM gateway_invocation_idempotency \
+                    WHERE owner_api_token_id = ?) < ? \
+             ON CONFLICT(owner_api_token_id, key_digest) DO NOTHING",
+        )
+        .bind(&id)
+        .bind(request.owner.owner_api_token_id)
+        .bind(key_digest.to_vec())
+        .bind(request_digest.to_vec())
+        .bind(now)
+        .bind(now)
+        .bind(self.limits.records)
+        .bind(request.owner.owner_api_token_id)
+        .bind(self.limits.records_per_owner)
+        .execute(&mut *transaction)
+        .await?;
+        if inserted.rows_affected() == 1 {
+            transaction.commit().await?;
+            return Ok(IdempotencyClaim::Fresh(IdempotencyRecord {
+                id,
+                owner_api_token_id: request.owner.owner_api_token_id.to_owned(),
+                state: IdempotencyState::Reserved,
+                approval_id: None,
+                response_kind: None,
+                created_at: now,
+                updated_at: now,
+                completed_at: None,
+                expires_at: None,
+            }));
+        }
+
+        let existing = fetch_by_key(
+            &mut transaction,
+            request.owner.owner_api_token_id,
+            &key_digest,
+        )
+        .await?;
+        let Some(existing) = existing else {
+            return Err(IdempotencyError::Capacity);
+        };
+        if !bool::from(
+            existing
+                .request_digest
+                .as_slice()
+                .ct_eq(request_digest.as_slice()),
+        ) {
+            transaction.commit().await?;
+            return Ok(IdempotencyClaim::Mismatch);
+        }
+        transaction.commit().await?;
+        let record = existing.record()?;
+        match record.state {
+            IdempotencyState::Reserved | IdempotencyState::Executing => {
+                Ok(IdempotencyClaim::InProgress(record))
+            }
+            IdempotencyState::Indeterminate => Ok(IdempotencyClaim::Indeterminate(record)),
+            IdempotencyState::Completed => {
+                if record.response_kind == Some(IdempotencyResponseKind::Approval)
+                    && record.approval_id.is_none()
+                {
+                    return Ok(IdempotencyClaim::Indeterminate(record));
+                }
+                let ciphertext = existing
+                    .response_ciphertext
+                    .as_deref()
+                    .ok_or(IdempotencyError::CorruptData)?;
+                let response = self.decrypt_response(&record.id, ciphertext)?;
+                Ok(IdempotencyClaim::Replay { record, response })
+            }
+        }
+    }
+
+    pub(crate) async fn lookup(
+        &self,
+        request: IdempotencyRequest<'_>,
+    ) -> Result<Option<IdempotencyClaim>, IdempotencyError> {
+        validate_identifier(request.owner.owner_api_token_id, 128)?;
+        validate_key(request.key)?;
+        validate_identifier(request.route, 200)?;
+        let callable_path = canonical_callable_path(request.callable_path)?;
+        let canonical_arguments = canonical_json(request.arguments)?;
+        if canonical_arguments.len() > MAX_ARGUMENT_BYTES {
+            return Err(IdempotencyError::PayloadTooLarge);
+        }
+        let key_digest = self.key_digest(request.owner, request.key);
+        let request_digest = self.request_digest(
+            request.owner,
+            request.route,
+            &callable_path,
+            &canonical_arguments,
+        );
+        let mut transaction = self.pool.begin().await?;
+        let now = effective_now_in(&mut transaction, self.clock.now().max(0)).await?;
+        delete_expired(&mut transaction, now).await?;
+        let existing = fetch_by_key(
+            &mut transaction,
+            request.owner.owner_api_token_id,
+            &key_digest,
+        )
+        .await?;
+        transaction.commit().await?;
+        let Some(existing) = existing else {
+            return Ok(None);
+        };
+        if !bool::from(
+            existing
+                .request_digest
+                .as_slice()
+                .ct_eq(request_digest.as_slice()),
+        ) {
+            return Ok(Some(IdempotencyClaim::Mismatch));
+        }
+        let record = existing.record()?;
+        Ok(Some(match record.state {
+            IdempotencyState::Reserved | IdempotencyState::Executing => {
+                IdempotencyClaim::InProgress(record)
+            }
+            IdempotencyState::Indeterminate => IdempotencyClaim::Indeterminate(record),
+            IdempotencyState::Completed => {
+                if record.response_kind == Some(IdempotencyResponseKind::Approval)
+                    && record.approval_id.is_none()
+                {
+                    return Ok(Some(IdempotencyClaim::Indeterminate(record)));
+                }
+                let ciphertext = existing
+                    .response_ciphertext
+                    .as_deref()
+                    .ok_or(IdempotencyError::CorruptData)?;
+                let response = self.decrypt_response(&record.id, ciphertext)?;
+                IdempotencyClaim::Replay { record, response }
+            }
+        }))
+    }
+
+    pub(crate) async fn mark_executing(&self, id: &str) -> Result<(), IdempotencyError> {
+        validate_identifier(id, 128)?;
+        let mut transaction = self.pool.begin().await?;
+        let now = effective_now_in(&mut transaction, self.clock.now().max(0)).await?;
+        let result = sqlx::query(
+            "UPDATE gateway_invocation_idempotency \
+             SET state = 'executing', updated_at = ? \
+             WHERE id = ? AND state = 'reserved'",
+        )
+        .bind(now)
+        .bind(id)
+        .execute(&mut *transaction)
+        .await?;
+        if result.rows_affected() != 1 {
+            let error = transition_error_in(&mut transaction, id).await?;
+            return Err(error);
+        }
+        transaction.commit().await?;
+        Ok(())
+    }
+
+    pub(crate) async fn release_reserved(&self, id: &str) -> Result<bool, IdempotencyError> {
+        validate_identifier(id, 128)?;
+        let result = sqlx::query(
+            "DELETE FROM gateway_invocation_idempotency AS idempotency \
+             WHERE idempotency.id = ? AND idempotency.state = 'reserved' \
+               AND NOT EXISTS ( \
+                   SELECT 1 FROM approval_correlations \
+                   WHERE approval_correlations.execution_id = 'gateway-idempotency:' || idempotency.id \
+                     AND approval_correlations.call_id = 'gateway' \
+                     AND approval_correlations.actor_kind = 'api_token' \
+                     AND approval_correlations.actor_id = idempotency.owner_api_token_id \
+               )",
+        )
+        .bind(id)
+        .execute(&self.pool)
+        .await?;
+        Ok(result.rows_affected() == 1)
+    }
+
+    pub(crate) async fn release_retryable_execution(
+        &self,
+        lease: &IdempotencyRecord,
+    ) -> Result<(), IdempotencyError> {
+        validate_identifier(&lease.id, 128)?;
+        validate_identifier(&lease.owner_api_token_id, 128)?;
+        if lease.state != IdempotencyState::Reserved
+            || lease.approval_id.is_some()
+            || lease.response_kind.is_some()
+            || lease.completed_at.is_some()
+            || lease.expires_at.is_some()
+        {
+            return Err(IdempotencyError::InvalidMetadata);
+        }
+        let mut transaction = self.pool.begin().await?;
+        let released = sqlx::query(
+            "DELETE FROM gateway_invocation_idempotency AS idempotency \
+             WHERE idempotency.id = ? AND idempotency.owner_api_token_id = ? \
+               AND idempotency.created_at = ? AND idempotency.state = 'executing' \
+               AND idempotency.approval_id IS NULL \
+               AND idempotency.response_kind IS NULL \
+               AND idempotency.response_ciphertext IS NULL \
+               AND NOT EXISTS ( \
+                   SELECT 1 FROM approval_correlations AS correlation \
+                   WHERE correlation.execution_id = 'gateway-idempotency:' || idempotency.id \
+                     AND correlation.call_id = 'gateway' \
+                     AND correlation.actor_kind = 'api_token' \
+                     AND correlation.actor_id = idempotency.owner_api_token_id \
+               )",
+        )
+        .bind(&lease.id)
+        .bind(&lease.owner_api_token_id)
+        .bind(lease.created_at)
+        .execute(&mut *transaction)
+        .await?;
+        if released.rows_affected() != 1 {
+            let current = sqlx::query_as::<_, (String, String, i64)>(
+                "SELECT owner_api_token_id, state, created_at \
+                 FROM gateway_invocation_idempotency WHERE id = ?",
+            )
+            .bind(&lease.id)
+            .fetch_optional(&mut *transaction)
+            .await?;
+            return Err(match current {
+                None => IdempotencyError::NotFound,
+                Some((owner_api_token_id, _, created_at))
+                    if owner_api_token_id != lease.owner_api_token_id
+                        || created_at != lease.created_at =>
+                {
+                    IdempotencyError::InvalidMetadata
+                }
+                Some((_, state, _)) => IdempotencyError::InvalidTransition(state_name(&state)?),
+            });
+        }
+        transaction.commit().await?;
+        Ok(())
+    }
+
+    pub(crate) async fn abandon(&self, id: &str) -> Result<(), IdempotencyError> {
+        validate_identifier(id, 128)?;
+        let mut transaction = self.pool.begin().await?;
+        let now = effective_now_in(&mut transaction, self.clock.now().max(0)).await?;
+        let expires_at = now
+            .checked_add(IDEMPOTENCY_TTL_SECONDS)
+            .ok_or(IdempotencyError::InvalidMetadata)?;
+        sqlx::query(
+            "DELETE FROM gateway_invocation_idempotency AS idempotency \
+             WHERE idempotency.id = ? AND idempotency.state = 'reserved' \
+               AND NOT EXISTS ( \
+                   SELECT 1 FROM approval_correlations AS correlation \
+                   WHERE correlation.execution_id = 'gateway-idempotency:' || idempotency.id \
+                     AND correlation.call_id = 'gateway' \
+                     AND correlation.actor_kind = 'api_token' \
+                     AND correlation.actor_id = idempotency.owner_api_token_id \
+               )",
+        )
+        .bind(id)
+        .execute(&mut *transaction)
+        .await?;
+        mark_executing_indeterminate_in(&mut transaction, id, now, expires_at).await?;
+        sqlx::query(
+            "UPDATE gateway_invocation_idempotency AS idempotency \
+             SET state = 'indeterminate', updated_at = ?, completed_at = ?, expires_at = ? \
+             WHERE idempotency.id = ? AND idempotency.state = 'reserved' \
+               AND EXISTS ( \
+                   SELECT 1 FROM approval_correlations AS correlation \
+                   LEFT JOIN approvals AS approval ON approval.id = correlation.approval_id \
+                   WHERE correlation.execution_id = 'gateway-idempotency:' || idempotency.id \
+                     AND correlation.call_id = 'gateway' \
+                     AND correlation.actor_kind = 'api_token' \
+                     AND correlation.actor_id = idempotency.owner_api_token_id \
+                     AND approval.id IS NULL \
+               )",
+        )
+        .bind(now)
+        .bind(now)
+        .bind(expires_at)
+        .bind(id)
+        .execute(&mut *transaction)
+        .await?;
+        transaction.commit().await?;
+        Ok(())
+    }
+
+    pub(crate) async fn mark_indeterminate(
+        &self,
+        id: &str,
+    ) -> Result<IdempotencyRecord, IdempotencyError> {
+        validate_identifier(id, 128)?;
+        let mut transaction = self.pool.begin().await?;
+        let now = effective_now_in(&mut transaction, self.clock.now().max(0)).await?;
+        let expires_at = now
+            .checked_add(IDEMPOTENCY_TTL_SECONDS)
+            .ok_or(IdempotencyError::InvalidMetadata)?;
+        let result = mark_indeterminate_in(&mut transaction, id, now, expires_at).await?;
+        if result == 0 {
+            let error = transition_error_in(&mut transaction, id).await?;
+            return Err(error);
+        }
+        transaction.commit().await?;
+        self.get(id).await?.ok_or(IdempotencyError::NotFound)
+    }
+
+    pub(crate) async fn complete(
+        &self,
+        id: &str,
+        kind: IdempotencyResponseKind,
+        response: &IdempotencyResponse,
+        approval_id: Option<&str>,
+    ) -> Result<IdempotencyRecord, IdempotencyError> {
+        validate_identifier(id, 128)?;
+        if let Err(error) = validate_response(response) {
+            self.mark_indeterminate_if_executing(id).await?;
+            return Err(error);
+        }
+        let encoded = encode_response(response)?;
+        let ciphertext = match self
+            .keyring
+            .encrypt("gateway-idempotency-response-v1", id, &encoded)
+        {
+            Ok(ciphertext) => ciphertext,
+            Err(error) => {
+                self.mark_indeterminate_if_executing(id).await?;
+                return Err(error.into());
+            }
+        };
+        let ciphertext_len =
+            i64::try_from(ciphertext.len()).map_err(|_| IdempotencyError::PayloadTooLarge)?;
+        if ciphertext_len > MAX_RESPONSE_CIPHERTEXT_BYTES {
+            self.mark_indeterminate_if_executing(id).await?;
+            return Err(IdempotencyError::PayloadTooLarge);
+        }
+        let observed_now = self.clock.now().max(0);
+        let mut transaction = self.pool.begin().await?;
+        let now = effective_now_in(&mut transaction, observed_now).await?;
+        let expires_at = now
+            .checked_add(IDEMPOTENCY_TTL_SECONDS)
+            .ok_or(IdempotencyError::InvalidMetadata)?;
+        let result = sqlx::query(
+            "UPDATE gateway_invocation_idempotency \
+             SET state = 'completed', approval_id = ?, response_kind = ?, response_ciphertext = ?, \
+                 updated_at = ?, completed_at = ?, expires_at = ? \
+             WHERE id = ? AND state IN ('reserved', 'executing') \
+               AND ? <= ? - ( \
+                   SELECT COALESCE(SUM(length(response_ciphertext)), 0) \
+                   FROM gateway_invocation_idempotency WHERE id <> ? \
+               )",
+        )
+        .bind(approval_id)
+        .bind(kind.as_str())
+        .bind(ciphertext)
+        .bind(now)
+        .bind(now)
+        .bind(expires_at)
+        .bind(id)
+        .bind(ciphertext_len)
+        .bind(self.limits.response_ciphertext_bytes)
+        .bind(id)
+        .execute(&mut *transaction)
+        .await?;
+        if result.rows_affected() != 1 {
+            let state = sqlx::query_scalar::<_, String>(
+                "SELECT state FROM gateway_invocation_idempotency WHERE id = ?",
+            )
+            .bind(id)
+            .fetch_optional(&mut *transaction)
+            .await?;
+            let error = match state.as_deref() {
+                Some("executing") => {
+                    mark_executing_indeterminate_in(&mut transaction, id, now, expires_at).await?;
+                    transaction.commit().await?;
+                    IdempotencyError::Capacity
+                }
+                Some("reserved") => IdempotencyError::Capacity,
+                Some(state) => IdempotencyError::InvalidTransition(state_name(state)?),
+                None => IdempotencyError::NotFound,
+            };
+            return Err(error);
+        }
+        transaction.commit().await?;
+        self.get(id).await?.ok_or(IdempotencyError::NotFound)
+    }
+
+    async fn mark_indeterminate_if_executing(&self, id: &str) -> Result<(), IdempotencyError> {
+        let mut transaction = self.pool.begin().await?;
+        let now = effective_now_in(&mut transaction, self.clock.now().max(0)).await?;
+        let expires_at = now
+            .checked_add(IDEMPOTENCY_TTL_SECONDS)
+            .ok_or(IdempotencyError::InvalidMetadata)?;
+        mark_executing_indeterminate_in(&mut transaction, id, now, expires_at).await?;
+        transaction.commit().await?;
+        Ok(())
+    }
+
+    pub(crate) async fn recover_startup(&self) -> Result<IdempotencyRecovery, IdempotencyError> {
+        let observed_now = self.clock.now().max(0);
+        let mut transaction = self.pool.begin().await?;
+        let now = effective_now_in(&mut transaction, observed_now).await?;
+        let expires_at = now
+            .checked_add(IDEMPOTENCY_TTL_SECONDS)
+            .ok_or(IdempotencyError::InvalidMetadata)?;
+        delete_expired(&mut transaction, now).await?;
+        let indeterminate = sqlx::query(
+            "UPDATE gateway_invocation_idempotency \
+             SET state = 'indeterminate', updated_at = ?, completed_at = ?, expires_at = ? \
+             WHERE state = 'executing'",
+        )
+        .bind(now)
+        .bind(now)
+        .bind(expires_at)
+        .execute(&mut *transaction)
+        .await?
+        .rows_affected();
+        let reserved = sqlx::query_as::<_, IdempotencyRow>(
+            "SELECT id, owner_api_token_id, request_digest, state, approval_id, response_kind, \
+                    response_ciphertext, created_at, updated_at, completed_at, expires_at \
+             FROM gateway_invocation_idempotency WHERE state = 'reserved' ORDER BY sequence",
+        )
+        .fetch_all(&mut *transaction)
+        .await?
+        .into_iter()
+        .map(|row| row.record())
+        .collect::<Result<Vec<_>, _>>()?;
+        transaction.commit().await?;
+        Ok(IdempotencyRecovery {
+            indeterminate_executions: indeterminate,
+            reserved,
+        })
+    }
+
+    pub(crate) async fn correlated_approval_id(
+        &self,
+        record: &IdempotencyRecord,
+    ) -> Result<Option<CorrelatedApproval>, IdempotencyError> {
+        let row = sqlx::query_as::<_, (String, Option<String>)>(
+            "SELECT correlation.approval_id, approval.id \
+             FROM approval_correlations AS correlation \
+             LEFT JOIN approvals AS approval ON approval.id = correlation.approval_id \
+             WHERE correlation.execution_id = ? AND correlation.call_id = 'gateway' \
+               AND correlation.actor_kind = 'api_token' AND correlation.actor_id = ?",
+        )
+        .bind(idempotency_execution_id(&record.id))
+        .bind(&record.owner_api_token_id)
+        .fetch_optional(&self.pool)
+        .await
+        .map_err(IdempotencyError::Database)?;
+        Ok(row.map(|(approval_id, live_id)| {
+            if live_id.is_some() {
+                CorrelatedApproval::Live(approval_id)
+            } else {
+                CorrelatedApproval::Retired
+            }
+        }))
+    }
+
+    async fn get(&self, id: &str) -> Result<Option<IdempotencyRecord>, IdempotencyError> {
+        let row = sqlx::query_as::<_, IdempotencyRow>(
+            "SELECT id, owner_api_token_id, request_digest, state, approval_id, response_kind, \
+                    response_ciphertext, created_at, updated_at, completed_at, expires_at \
+             FROM gateway_invocation_idempotency WHERE id = ?",
+        )
+        .bind(id)
+        .fetch_optional(&self.pool)
+        .await?;
+        row.map(|row| row.record()).transpose()
+    }
+
+    pub(crate) async fn state(
+        &self,
+        id: &str,
+    ) -> Result<Option<IdempotencyState>, IdempotencyError> {
+        validate_identifier(id, 128)?;
+        self.get(id)
+            .await
+            .map(|record| record.map(|record| record.state))
+    }
+
+    fn key_digest(&self, owner: IdempotencyOwner<'_>, key: &str) -> [u8; 32] {
+        let mut input = Vec::with_capacity(owner.owner_api_token_id.len() + key.len() + 16);
+        append_field(&mut input, owner.owner_api_token_id.as_bytes());
+        append_field(&mut input, key.as_bytes());
+        self.keyring.digest("gateway-idempotency-key-v1", &input)
+    }
+
+    fn request_digest(
+        &self,
+        owner: IdempotencyOwner<'_>,
+        route: &str,
+        callable_path: &str,
+        canonical_arguments: &[u8],
+    ) -> [u8; 32] {
+        let arguments_digest = self
+            .keyring
+            .digest("gateway-idempotency-arguments-v1", canonical_arguments);
+        let mut input = Vec::with_capacity(
+            owner.owner_api_token_id.len() + route.len() + callable_path.len() + 96,
+        );
+        input.extend_from_slice(b"executor-gateway-idempotency-request-v1");
+        append_field(&mut input, owner.owner_api_token_id.as_bytes());
+        append_field(&mut input, route.as_bytes());
+        append_field(&mut input, callable_path.as_bytes());
+        append_field(&mut input, &arguments_digest);
+        self.keyring
+            .digest("gateway-idempotency-request-v1", &input)
+    }
+
+    fn decrypt_response(
+        &self,
+        id: &str,
+        ciphertext: &[u8],
+    ) -> Result<IdempotencyResponse, IdempotencyError> {
+        let encoded = self
+            .keyring
+            .decrypt("gateway-idempotency-response-v1", id, ciphertext)?;
+        decode_response(&encoded)
+    }
+}
+
+#[derive(FromRow)]
+struct IdempotencyRow {
+    id: String,
+    owner_api_token_id: String,
+    request_digest: Vec<u8>,
+    state: String,
+    approval_id: Option<String>,
+    response_kind: Option<String>,
+    response_ciphertext: Option<Vec<u8>>,
+    created_at: i64,
+    updated_at: i64,
+    completed_at: Option<i64>,
+    expires_at: Option<i64>,
+}
+
+impl IdempotencyRow {
+    fn record(&self) -> Result<IdempotencyRecord, IdempotencyError> {
+        Ok(IdempotencyRecord {
+            id: self.id.clone(),
+            owner_api_token_id: self.owner_api_token_id.clone(),
+            state: parse_state(&self.state)?,
+            approval_id: self.approval_id.clone(),
+            response_kind: self
+                .response_kind
+                .as_deref()
+                .map(parse_response_kind)
+                .transpose()?,
+            created_at: self.created_at,
+            updated_at: self.updated_at,
+            completed_at: self.completed_at,
+            expires_at: self.expires_at,
+        })
+    }
+}
+
+async fn fetch_by_key(
+    transaction: &mut sqlx::Transaction<'_, sqlx::Sqlite>,
+    owner_api_token_id: &str,
+    key_digest: &[u8],
+) -> Result<Option<IdempotencyRow>, sqlx::Error> {
+    sqlx::query_as::<_, IdempotencyRow>(
+        "SELECT id, owner_api_token_id, request_digest, state, approval_id, response_kind, \
+                response_ciphertext, created_at, updated_at, completed_at, expires_at \
+         FROM gateway_invocation_idempotency \
+         WHERE owner_api_token_id = ? AND key_digest = ?",
+    )
+    .bind(owner_api_token_id)
+    .bind(key_digest)
+    .fetch_optional(&mut **transaction)
+    .await
+}
+
+async fn transition_error_in(
+    transaction: &mut sqlx::Transaction<'_, sqlx::Sqlite>,
+    id: &str,
+) -> Result<IdempotencyError, IdempotencyError> {
+    let state = sqlx::query_scalar::<_, String>(
+        "SELECT state FROM gateway_invocation_idempotency WHERE id = ?",
+    )
+    .bind(id)
+    .fetch_optional(&mut **transaction)
+    .await?;
+    Ok(match state {
+        Some(state) => IdempotencyError::InvalidTransition(state_name(&state)?),
+        None => IdempotencyError::NotFound,
+    })
+}
+
+async fn mark_indeterminate_in(
+    transaction: &mut sqlx::Transaction<'_, sqlx::Sqlite>,
+    id: &str,
+    now: i64,
+    expires_at: i64,
+) -> Result<u64, sqlx::Error> {
+    sqlx::query(
+        "UPDATE gateway_invocation_idempotency \
+         SET state = 'indeterminate', updated_at = ?, completed_at = ?, expires_at = ? \
+         WHERE id = ? AND state IN ('reserved', 'executing')",
+    )
+    .bind(now)
+    .bind(now)
+    .bind(expires_at)
+    .bind(id)
+    .execute(&mut **transaction)
+    .await
+    .map(|result| result.rows_affected())
+}
+
+async fn mark_executing_indeterminate_in(
+    transaction: &mut sqlx::Transaction<'_, sqlx::Sqlite>,
+    id: &str,
+    now: i64,
+    expires_at: i64,
+) -> Result<u64, sqlx::Error> {
+    sqlx::query(
+        "UPDATE gateway_invocation_idempotency \
+         SET state = 'indeterminate', updated_at = ?, completed_at = ?, expires_at = ? \
+         WHERE id = ? AND state = 'executing'",
+    )
+    .bind(now)
+    .bind(now)
+    .bind(expires_at)
+    .bind(id)
+    .execute(&mut **transaction)
+    .await
+    .map(|result| result.rows_affected())
+}
+
+async fn delete_expired(
+    transaction: &mut sqlx::Transaction<'_, sqlx::Sqlite>,
+    now: i64,
+) -> Result<(), sqlx::Error> {
+    sqlx::query(
+        "DELETE FROM gateway_invocation_idempotency \
+         WHERE state IN ('completed', 'indeterminate') AND expires_at <= ?",
+    )
+    .bind(now)
+    .execute(&mut **transaction)
+    .await?;
+    Ok(())
+}
+
+async fn effective_now_in(
+    transaction: &mut sqlx::Transaction<'_, sqlx::Sqlite>,
+    observed_now: i64,
+) -> Result<i64, sqlx::Error> {
+    sqlx::query(
+        "UPDATE gateway_idempotency_clock \
+         SET effective_now = MAX(effective_now, ?) WHERE id = 1",
+    )
+    .bind(observed_now)
+    .execute(&mut **transaction)
+    .await?;
+    sqlx::query_scalar("SELECT effective_now FROM gateway_idempotency_clock WHERE id = 1")
+        .fetch_one(&mut **transaction)
+        .await
+}
+
+pub(crate) fn validate_key(key: &str) -> Result<(), IdempotencyError> {
+    let bytes = key.as_bytes();
+    if bytes.is_empty()
+        || bytes.len() > IDEMPOTENCY_KEY_MAX_BYTES
+        || bytes.iter().any(|byte| !(0x21..=0x7e).contains(byte))
+    {
+        return Err(IdempotencyError::InvalidKey);
+    }
+    Ok(())
+}
+
+pub(crate) fn idempotency_execution_id(record_id: &str) -> String {
+    format!("gateway-idempotency:{record_id}")
+}
+
+fn validate_identifier(value: &str, max: usize) -> Result<(), IdempotencyError> {
+    if value.is_empty() || value.len() > max || value.contains('\0') {
+        return Err(IdempotencyError::InvalidMetadata);
+    }
+    Ok(())
+}
+
+pub(crate) fn canonical_callable_path(path: &str) -> Result<String, IdempotencyError> {
+    let path = path.strip_prefix("tools.").unwrap_or(path);
+    let mut segments = path.split('.');
+    let source = segments.next().unwrap_or_default();
+    let tool = segments.next().unwrap_or_default();
+    if source.is_empty()
+        || tool.is_empty()
+        || segments.next().is_some()
+        || source.len() + tool.len() + 7 > 512
+        || source.contains('\0')
+        || tool.contains('\0')
+    {
+        return Err(IdempotencyError::InvalidMetadata);
+    }
+    Ok(format!("tools.{source}.{tool}"))
+}
+
+fn canonical_json(value: &Value) -> Result<Vec<u8>, IdempotencyError> {
+    fn sort(value: &Value) -> Value {
+        match value {
+            Value::Object(object) => {
+                let sorted = object
+                    .iter()
+                    .map(|(key, value)| (key.clone(), sort(value)))
+                    .collect::<BTreeMap<_, _>>();
+                Value::Object(sorted.into_iter().collect())
+            }
+            Value::Array(values) => Value::Array(values.iter().map(sort).collect()),
+            value => value.clone(),
+        }
+    }
+    serde_json::to_vec(&sort(value)).map_err(IdempotencyError::Json)
+}
+
+fn append_field(target: &mut Vec<u8>, value: &[u8]) {
+    target.extend_from_slice(&(value.len() as u64).to_be_bytes());
+    target.extend_from_slice(value);
+}
+
+fn validate_response(response: &IdempotencyResponse) -> Result<(), IdempotencyError> {
+    if !(100..=599).contains(&response.status)
+        || response.body.len() > MAX_RESPONSE_BODY_BYTES
+        || response.headers.len() > MAX_RESPONSE_HEADERS
+    {
+        return Err(IdempotencyError::PayloadTooLarge);
+    }
+    let header_bytes = response
+        .headers
+        .iter()
+        .try_fold(0_usize, |total, (name, value)| {
+            if name.is_empty()
+                || name.contains(['\0', '\r', '\n'])
+                || value.contains(['\0', '\r', '\n'])
+            {
+                return None;
+            }
+            total.checked_add(name.len())?.checked_add(value.len())
+        });
+    if header_bytes.is_none_or(|bytes| bytes > MAX_RESPONSE_HEADER_BYTES) {
+        return Err(IdempotencyError::PayloadTooLarge);
+    }
+    Ok(())
+}
+
+#[derive(Deserialize, Serialize)]
+struct StoredResponse {
+    status: u16,
+    headers: BTreeMap<String, String>,
+    body_base64: String,
+}
+
+fn encode_response(response: &IdempotencyResponse) -> Result<Vec<u8>, IdempotencyError> {
+    serde_json::to_vec(&StoredResponse {
+        status: response.status,
+        headers: response.headers.clone(),
+        body_base64: STANDARD.encode(&response.body),
+    })
+    .map_err(IdempotencyError::Json)
+}
+
+fn decode_response(encoded: &[u8]) -> Result<IdempotencyResponse, IdempotencyError> {
+    let stored: StoredResponse = serde_json::from_slice(encoded)?;
+    validate_response(&IdempotencyResponse {
+        status: stored.status,
+        headers: stored.headers.clone(),
+        body: Vec::new(),
+    })?;
+    let body = STANDARD
+        .decode(stored.body_base64)
+        .map_err(|_| IdempotencyError::CorruptData)?;
+    let response = IdempotencyResponse {
+        status: stored.status,
+        headers: stored.headers,
+        body,
+    };
+    validate_response(&response)?;
+    Ok(response)
+}
+
+fn parse_state(state: &str) -> Result<IdempotencyState, IdempotencyError> {
+    match state {
+        "reserved" => Ok(IdempotencyState::Reserved),
+        "executing" => Ok(IdempotencyState::Executing),
+        "completed" => Ok(IdempotencyState::Completed),
+        "indeterminate" => Ok(IdempotencyState::Indeterminate),
+        _ => Err(IdempotencyError::CorruptData),
+    }
+}
+
+fn parse_response_kind(value: &str) -> Result<IdempotencyResponseKind, IdempotencyError> {
+    match value {
+        "tool" => Ok(IdempotencyResponseKind::Tool),
+        "approval" => Ok(IdempotencyResponseKind::Approval),
+        _ => Err(IdempotencyError::CorruptData),
+    }
+}
+
+fn state_name(state: &str) -> Result<&'static str, IdempotencyError> {
+    Ok(parse_state(state)?.as_str())
+}
+
+#[cfg(test)]
+mod tests {
+    use std::sync::{
+        Arc,
+        atomic::{AtomicI64, Ordering},
+    };
+
+    use serde_json::json;
+    use sqlx::sqlite::{SqliteConnectOptions, SqlitePoolOptions};
+
+    use super::*;
+
+    static MIGRATOR: sqlx::migrate::Migrator = sqlx::migrate!("./migrations");
+
+    struct ManualClock(AtomicI64);
+
+    impl ManualClock {
+        fn new(now: i64) -> Self {
+            Self(AtomicI64::new(now))
+        }
+
+        fn set(&self, now: i64) {
+            self.0.store(now, Ordering::SeqCst);
+        }
+    }
+
+    impl IdempotencyClock for ManualClock {
+        fn now(&self) -> i64 {
+            self.0.load(Ordering::SeqCst)
+        }
+    }
+
+    async fn store() -> (tempfile::TempDir, GatewayIdempotencyStore, Arc<ManualClock>) {
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let database_path = directory.path().join("idempotency.db");
+        let options = SqliteConnectOptions::new()
+            .filename(&database_path)
+            .create_if_missing(true)
+            .foreign_keys(true)
+            .busy_timeout(std::time::Duration::from_secs(5));
+        let pool = SqlitePoolOptions::new()
+            .max_connections(8)
+            .connect_with(options)
+            .await
+            .expect("database pool");
+        MIGRATOR.run(&pool).await.expect("migrations");
+        for owner in ["owner-a", "owner-b"] {
+            sqlx::query(
+                "INSERT INTO api_tokens (id, name, token_digest, token_prefix, token_suffix, created_at) \
+                 VALUES (?, ?, ?, 'tok_', 'tail', 1)",
+            )
+            .bind(owner)
+            .bind(owner)
+            .bind(owner.as_bytes())
+            .execute(&pool)
+            .await
+            .expect("owner token");
+        }
+        let clock = Arc::new(ManualClock::new(1_000));
+        let store = GatewayIdempotencyStore::with_clock(
+            pool,
+            Keyring::from_master_key([7; 32]).expect("keyring"),
+            clock.clone(),
+        );
+        (directory, store, clock)
+    }
+
+    fn request<'a>(
+        owner: &'a str,
+        key: &'a str,
+        path: &'a str,
+        arguments: &'a Value,
+    ) -> IdempotencyRequest<'a> {
+        IdempotencyRequest {
+            owner: IdempotencyOwner {
+                owner_api_token_id: owner,
+            },
+            key,
+            route: "POST /api/v1/gateway/tools/invoke",
+            callable_path: path,
+            arguments,
+        }
+    }
+
+    #[tokio::test]
+    async fn matching_requests_replay_and_mismatches_do_not_reuse() {
+        let (_directory, store, _clock) = store().await;
+        let first_arguments = json!({"alpha": 1, "nested": {"z": 2, "a": 3}});
+        let reordered_arguments = json!({"nested": {"a": 3, "z": 2}, "alpha": 1});
+        let fresh = store
+            .claim(request(
+                "owner-a",
+                "retry-key",
+                "source.tool",
+                &first_arguments,
+            ))
+            .await
+            .expect("fresh claim");
+        let IdempotencyClaim::Fresh(record) = fresh else {
+            panic!("first claim must be fresh");
+        };
+        let response = IdempotencyResponse {
+            status: 202,
+            headers: BTreeMap::from([("content-type".to_owned(), "application/json".to_owned())]),
+            body: br#"{"approval":{"id":"approval-1"}}"#.to_vec(),
+        };
+        store
+            .complete(&record.id, IdempotencyResponseKind::Tool, &response, None)
+            .await
+            .expect("completion");
+
+        let replay = store
+            .claim(request(
+                "owner-a",
+                "retry-key",
+                "tools.source.tool",
+                &reordered_arguments,
+            ))
+            .await
+            .expect("replay");
+        assert!(matches!(
+            replay,
+            IdempotencyClaim::Replay { response: replayed, .. } if replayed == response
+        ));
+        assert!(matches!(
+            store
+                .claim(request(
+                    "owner-a",
+                    "retry-key",
+                    "source.other",
+                    &first_arguments,
+                ))
+                .await
+                .expect("path mismatch"),
+            IdempotencyClaim::Mismatch
+        ));
+        let changed_route = IdempotencyRequest {
+            owner: IdempotencyOwner {
+                owner_api_token_id: "owner-a",
+            },
+            key: "retry-key",
+            route: "mcp tools/call changed",
+            callable_path: "source.tool",
+            arguments: &first_arguments,
+        };
+        assert!(matches!(
+            store.claim(changed_route).await.expect("route mismatch"),
+            IdempotencyClaim::Mismatch
+        ));
+        assert!(matches!(
+            store
+                .claim(request(
+                    "owner-a",
+                    "retry-key",
+                    "source.tool",
+                    &json!({"alpha": 2}),
+                ))
+                .await
+                .expect("argument mismatch"),
+            IdempotencyClaim::Mismatch
+        ));
+        assert!(matches!(
+            store
+                .claim(request(
+                    "owner-b",
+                    "retry-key",
+                    "source.tool",
+                    &first_arguments,
+                ))
+                .await
+                .expect("other owner"),
+            IdempotencyClaim::Fresh(_)
+        ));
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+    async fn concurrent_claims_elect_exactly_one_winner() {
+        let (_directory, store, _clock) = store().await;
+        let barrier = Arc::new(tokio::sync::Barrier::new(33));
+        let mut tasks = Vec::new();
+        for _ in 0..32 {
+            let store = store.clone();
+            let barrier = barrier.clone();
+            tasks.push(tokio::spawn(async move {
+                let arguments = json!({"value": 1});
+                barrier.wait().await;
+                store
+                    .claim(request(
+                        "owner-a",
+                        "concurrent-key",
+                        "source.tool",
+                        &arguments,
+                    ))
+                    .await
+            }));
+        }
+        barrier.wait().await;
+        let mut fresh = 0;
+        let mut in_progress = 0;
+        for task in tasks {
+            match task.await.expect("claim task").expect("claim") {
+                IdempotencyClaim::Fresh(_) => fresh += 1,
+                IdempotencyClaim::InProgress(_) => in_progress += 1,
+                other => panic!("unexpected claim: {other:?}"),
+            }
+        }
+        assert_eq!(fresh, 1);
+        assert_eq!(in_progress, 31);
+    }
+
+    #[tokio::test]
+    async fn startup_never_replays_an_uncertain_execution() {
+        let (_directory, store, _clock) = store().await;
+        let arguments = json!({"value": 1});
+        let fresh = store
+            .claim(request(
+                "owner-a",
+                "uncertain-key",
+                "source.tool",
+                &arguments,
+            ))
+            .await
+            .expect("claim");
+        let IdempotencyClaim::Fresh(record) = fresh else {
+            panic!("fresh claim expected");
+        };
+        store
+            .mark_executing(&record.id)
+            .await
+            .expect("execution boundary");
+        let recovery = store.recover_startup().await.expect("startup recovery");
+        assert_eq!(recovery.indeterminate_executions, 1);
+        assert!(matches!(
+            store
+                .claim(request(
+                    "owner-a",
+                    "uncertain-key",
+                    "source.tool",
+                    &arguments,
+                ))
+                .await
+                .expect("post-restart claim"),
+            IdempotencyClaim::Indeterminate(_)
+        ));
+    }
+
+    #[tokio::test]
+    async fn startup_never_replays_an_uncertain_mcp_approval_execution() {
+        let (_directory, store, _clock) = store().await;
+        let arguments = json!({"sideEffect": true});
+        let claim = store
+            .claim(request(
+                "owner-a",
+                "mcp-ask-crash",
+                "source.tool",
+                &arguments,
+            ))
+            .await
+            .expect("claim");
+        let IdempotencyClaim::Fresh(record) = claim else {
+            panic!("fresh claim expected");
+        };
+        sqlx::query(
+            "INSERT INTO approvals ( \
+                 id, execution_id, call_id, worker_generation, actor_kind, actor_id, \
+                 actor_api_token_id, surface, source_id, tool_id, callable_path_snapshot, \
+                 mode_provenance, source_revision, catalog_revision, tool_revision, \
+                 binding_revision, arguments_digest, arguments_ciphertext, \
+                 redacted_arguments_ciphertext, input_schema_ciphertext, \
+                 invocation_snapshot_ciphertext, status, created_at, updated_at, expires_at, \
+                 execution_started_at \
+             ) VALUES ( \
+                 'mcp-ask-approval', ?, 'gateway', 0, 'api_token', 'owner-a', \
+                 'owner-a', 'mcp', 'source-1', 'tool-1', 'tools.source.tool', \
+                 'intrinsic', 0, 0, 0, 0, zeroblob(32), zeroblob(42), zeroblob(42), \
+                 zeroblob(42), zeroblob(42), 'executing', 1, 1, 601, 1 \
+             )",
+        )
+        .bind(idempotency_execution_id(&record.id))
+        .execute(&store.pool)
+        .await
+        .expect("MCP Ask approval fixture");
+        store
+            .mark_executing(&record.id)
+            .await
+            .expect("approved call crosses execution boundary");
+
+        let recovery = store.recover_startup().await.expect("startup recovery");
+        assert_eq!(recovery.indeterminate_executions, 1);
+        assert!(matches!(
+            store
+                .claim(request(
+                    "owner-a",
+                    "mcp-ask-crash",
+                    "source.tool",
+                    &arguments,
+                ))
+                .await
+                .expect("post-crash retry"),
+            IdempotencyClaim::Indeterminate(_)
+        ));
+    }
+
+    #[tokio::test]
+    async fn abandoned_reservations_can_be_released_without_reusing_an_active_claim() {
+        let (_directory, store, _clock) = store().await;
+        let arguments = json!({"value": 1});
+        let fresh = store
+            .claim(request(
+                "owner-a",
+                "cancelled-key",
+                "source.tool",
+                &arguments,
+            ))
+            .await
+            .expect("claim");
+        let IdempotencyClaim::Fresh(record) = fresh else {
+            panic!("fresh claim expected");
+        };
+        assert!(
+            store
+                .release_reserved(&record.id)
+                .await
+                .expect("reservation release")
+        );
+        assert!(
+            !store
+                .release_reserved(&record.id)
+                .await
+                .expect("second release")
+        );
+        assert!(matches!(
+            store
+                .claim(request(
+                    "owner-a",
+                    "cancelled-key",
+                    "source.tool",
+                    &arguments,
+                ))
+                .await
+                .expect("replacement claim"),
+            IdempotencyClaim::Fresh(_)
+        ));
+    }
+
+    #[tokio::test]
+    async fn retryable_execution_release_reopens_the_same_key() {
+        let (_directory, store, _clock) = store().await;
+        let arguments = json!({"value": 1});
+        let IdempotencyClaim::Fresh(first) = store
+            .claim(request(
+                "owner-a",
+                "retryable-execution",
+                "source.tool",
+                &arguments,
+            ))
+            .await
+            .expect("first claim")
+        else {
+            panic!("first claim must be fresh");
+        };
+        store
+            .mark_executing(&first.id)
+            .await
+            .expect("execution boundary");
+        store
+            .release_retryable_execution(&first)
+            .await
+            .expect("known-safe execution releases");
+        assert_eq!(
+            store.state(&first.id).await.expect("released state reads"),
+            None
+        );
+
+        let IdempotencyClaim::Fresh(replacement) = store
+            .claim(request(
+                "owner-a",
+                "retryable-execution",
+                "source.tool",
+                &arguments,
+            ))
+            .await
+            .expect("replacement claim")
+        else {
+            panic!("the same key must be claimable again");
+        };
+        assert_ne!(replacement.id, first.id);
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+    async fn stale_retryable_release_cannot_delete_a_competing_replacement_claim() {
+        let (_directory, store, _clock) = store().await;
+        let arguments = json!({"value": 1});
+        let IdempotencyClaim::Fresh(first) = store
+            .claim(request(
+                "owner-a",
+                "retryable-race",
+                "source.tool",
+                &arguments,
+            ))
+            .await
+            .expect("first claim")
+        else {
+            panic!("first claim must be fresh");
+        };
+        store
+            .mark_executing(&first.id)
+            .await
+            .expect("first execution boundary");
+        store
+            .release_retryable_execution(&first)
+            .await
+            .expect("first execution releases");
+        let IdempotencyClaim::Fresh(replacement) = store
+            .claim(request(
+                "owner-a",
+                "retryable-race",
+                "source.tool",
+                &arguments,
+            ))
+            .await
+            .expect("replacement claim")
+        else {
+            panic!("replacement claim must be fresh");
+        };
+        store
+            .mark_executing(&replacement.id)
+            .await
+            .expect("replacement execution boundary");
+
+        let barrier = Arc::new(tokio::sync::Barrier::new(18));
+        let stale_store = store.clone();
+        let stale_barrier = barrier.clone();
+        let stale_lease = first.clone();
+        let stale_release = tokio::spawn(async move {
+            stale_barrier.wait().await;
+            stale_store.release_retryable_execution(&stale_lease).await
+        });
+        let mut claims = Vec::new();
+        for _ in 0..16 {
+            let store = store.clone();
+            let barrier = barrier.clone();
+            claims.push(tokio::spawn(async move {
+                let arguments = json!({"value": 1});
+                barrier.wait().await;
+                store
+                    .claim(request(
+                        "owner-a",
+                        "retryable-race",
+                        "source.tool",
+                        &arguments,
+                    ))
+                    .await
+            }));
+        }
+        barrier.wait().await;
+        assert!(matches!(
+            stale_release.await.expect("stale release task"),
+            Err(IdempotencyError::NotFound)
+        ));
+        for claim in claims {
+            assert!(matches!(
+                claim.await.expect("claim task").expect("competing claim"),
+                IdempotencyClaim::InProgress(record) if record.id == replacement.id
+            ));
+        }
+        assert_eq!(
+            store
+                .state(&replacement.id)
+                .await
+                .expect("replacement state reads"),
+            Some(IdempotencyState::Executing)
+        );
+    }
+
+    #[tokio::test]
+    async fn retryable_execution_release_fails_closed_after_ownership_or_state_changes() {
+        let (_directory, store, _clock) = store().await;
+        let arguments = json!({"value": 1});
+        let IdempotencyClaim::Fresh(owner_lease) = store
+            .claim(request(
+                "owner-a",
+                "retryable-owner-change",
+                "source.tool",
+                &arguments,
+            ))
+            .await
+            .expect("owner claim")
+        else {
+            panic!("owner claim must be fresh");
+        };
+        store
+            .mark_executing(&owner_lease.id)
+            .await
+            .expect("owner execution boundary");
+        let mut forged_owner_lease = owner_lease.clone();
+        forged_owner_lease.owner_api_token_id = "owner-b".to_owned();
+        assert!(matches!(
+            store.release_retryable_execution(&forged_owner_lease).await,
+            Err(IdempotencyError::InvalidMetadata)
+        ));
+        assert_eq!(
+            store
+                .state(&owner_lease.id)
+                .await
+                .expect("changed ownership state reads"),
+            Some(IdempotencyState::Executing)
+        );
+
+        let IdempotencyClaim::Fresh(state_lease) = store
+            .claim(request(
+                "owner-a",
+                "retryable-state-change",
+                "source.tool",
+                &arguments,
+            ))
+            .await
+            .expect("state claim")
+        else {
+            panic!("state claim must be fresh");
+        };
+        store
+            .mark_executing(&state_lease.id)
+            .await
+            .expect("state execution boundary");
+        store
+            .mark_indeterminate(&state_lease.id)
+            .await
+            .expect("fixture changes state");
+        assert!(matches!(
+            store.release_retryable_execution(&state_lease).await,
+            Err(IdempotencyError::InvalidTransition("indeterminate"))
+        ));
+    }
+
+    #[tokio::test]
+    async fn capacity_is_fail_closed_before_and_after_the_execution_boundary() {
+        let (_directory, store, _clock) = store().await;
+        let store = store.with_limits(IdempotencyLimits {
+            records: 2,
+            records_per_owner: 1,
+            response_ciphertext_bytes: 0,
+        });
+        let arguments = json!({"value": 1});
+        let fresh = store
+            .claim(request(
+                "owner-a",
+                "capacity-key",
+                "source.tool",
+                &arguments,
+            ))
+            .await
+            .expect("claim");
+        let IdempotencyClaim::Fresh(record) = fresh else {
+            panic!("fresh claim expected");
+        };
+        assert!(matches!(
+            store
+                .claim(request("owner-a", "second-key", "source.tool", &arguments,))
+                .await,
+            Err(IdempotencyError::Capacity)
+        ));
+        store
+            .mark_executing(&record.id)
+            .await
+            .expect("execution boundary");
+        assert!(matches!(
+            store
+                .complete(
+                    &record.id,
+                    IdempotencyResponseKind::Tool,
+                    &IdempotencyResponse {
+                        status: 200,
+                        headers: BTreeMap::new(),
+                        body: b"observed response".to_vec(),
+                    },
+                    None,
+                )
+                .await,
+            Err(IdempotencyError::Capacity)
+        ));
+        assert!(matches!(
+            store
+                .claim(request(
+                    "owner-a",
+                    "capacity-key",
+                    "source.tool",
+                    &arguments,
+                ))
+                .await
+                .expect("uncertain replay"),
+            IdempotencyClaim::Indeterminate(_)
+        ));
+    }
+
+    #[tokio::test]
+    async fn approval_retention_can_clear_a_terminal_reference() {
+        let (_directory, store, _clock) = store().await;
+        sqlx::query(
+            "INSERT INTO approvals ( \
+                 id, execution_id, call_id, worker_generation, actor_kind, actor_id, \
+                 actor_api_token_id, surface, source_id, tool_id, callable_path_snapshot, \
+                 mode_provenance, source_revision, catalog_revision, tool_revision, \
+                 binding_revision, arguments_digest, arguments_ciphertext, \
+                 redacted_arguments_ciphertext, input_schema_ciphertext, \
+                 invocation_snapshot_ciphertext, status, created_at, updated_at, expires_at \
+             ) VALUES ( \
+                 'approval-1', 'execution-1', 'call-1', 0, 'api_token', 'owner-a', \
+                 'owner-a', 'gateway', 'source-1', 'tool-1', 'tools.source.tool', \
+                 'intrinsic', 0, 0, 0, 0, zeroblob(32), zeroblob(42), zeroblob(42), \
+                 zeroblob(42), zeroblob(42), 'pending', 1, 1, 601 \
+             )",
+        )
+        .execute(&store.pool)
+        .await
+        .expect("approval fixture");
+        let arguments = json!({});
+        let fresh = store
+            .claim(request(
+                "owner-a",
+                "approval-key",
+                "source.tool",
+                &arguments,
+            ))
+            .await
+            .expect("claim");
+        let IdempotencyClaim::Fresh(record) = fresh else {
+            panic!("fresh claim expected");
+        };
+        store
+            .complete(
+                &record.id,
+                IdempotencyResponseKind::Approval,
+                &IdempotencyResponse {
+                    status: 202,
+                    headers: BTreeMap::new(),
+                    body: b"approval required".to_vec(),
+                },
+                Some("approval-1"),
+            )
+            .await
+            .expect("completion");
+        sqlx::query("DELETE FROM approvals WHERE id = 'approval-1'")
+            .execute(&store.pool)
+            .await
+            .expect("approval retention deletion");
+        let approval_id = sqlx::query_scalar::<_, Option<String>>(
+            "SELECT approval_id FROM gateway_invocation_idempotency WHERE id = ?",
+        )
+        .bind(record.id)
+        .fetch_one(&store.pool)
+        .await
+        .expect("idempotency record");
+        assert_eq!(approval_id, None);
+    }
+
+    #[tokio::test]
+    async fn retired_approval_correlation_never_reopens_a_reserved_key() {
+        let (_directory, store, _clock) = store().await;
+        let arguments = json!({});
+        let claim = store
+            .claim(request(
+                "owner-a",
+                "retired-approval-key",
+                "source.tool",
+                &arguments,
+            ))
+            .await
+            .expect("claim");
+        let IdempotencyClaim::Fresh(record) = claim else {
+            panic!("claim must be fresh");
+        };
+        sqlx::query(
+            "INSERT INTO approvals ( \
+                 id, execution_id, call_id, worker_generation, actor_kind, actor_id, \
+                 actor_api_token_id, surface, source_id, tool_id, callable_path_snapshot, \
+                 mode_provenance, source_revision, catalog_revision, tool_revision, \
+                 binding_revision, arguments_digest, arguments_ciphertext, \
+                 redacted_arguments_ciphertext, input_schema_ciphertext, \
+                 invocation_snapshot_ciphertext, status, created_at, updated_at, expires_at \
+             ) VALUES ( \
+                 'retired-approval', ?, 'gateway', 0, 'api_token', 'owner-a', \
+                 'owner-a', 'gateway', 'source-1', 'tool-1', 'tools.source.tool', \
+                 'intrinsic', 0, 0, 0, 0, zeroblob(32), zeroblob(42), zeroblob(42), \
+                 zeroblob(42), zeroblob(42), 'pending', 1, 1, 601 \
+             )",
+        )
+        .bind(idempotency_execution_id(&record.id))
+        .execute(&store.pool)
+        .await
+        .expect("approval fixture");
+        sqlx::query("DELETE FROM approvals WHERE id = 'retired-approval'")
+            .execute(&store.pool)
+            .await
+            .expect("approval retention deletion");
+        assert!(
+            !store
+                .release_reserved(&record.id)
+                .await
+                .expect("retired correlation blocks release")
+        );
+        let recovery = store.recover_startup().await.expect("startup recovery");
+        assert_eq!(recovery.reserved, vec![record.clone()]);
+        assert!(matches!(
+            store
+                .correlated_approval_id(&record)
+                .await
+                .expect("correlation lookup"),
+            Some(CorrelatedApproval::Retired)
+        ));
+        store
+            .mark_indeterminate(&record.id)
+            .await
+            .expect("retired reservation terminalizes");
+        assert!(matches!(
+            store
+                .claim(request(
+                    "owner-a",
+                    "retired-approval-key",
+                    "source.tool",
+                    &arguments,
+                ))
+                .await
+                .expect("post-restart retry"),
+            IdempotencyClaim::Indeterminate(_)
+        ));
+    }
+
+    #[tokio::test]
+    async fn terminal_keys_expire_after_twenty_four_hours() {
+        let (_directory, store, clock) = store().await;
+        let arguments = json!({});
+        let fresh = store
+            .claim(request(
+                "owner-a",
+                "expiring-key",
+                "source.tool",
+                &arguments,
+            ))
+            .await
+            .expect("claim");
+        let IdempotencyClaim::Fresh(record) = fresh else {
+            panic!("fresh claim expected");
+        };
+        store
+            .complete(
+                &record.id,
+                IdempotencyResponseKind::Tool,
+                &IdempotencyResponse {
+                    status: 200,
+                    headers: BTreeMap::new(),
+                    body: b"ok".to_vec(),
+                },
+                None,
+            )
+            .await
+            .expect("completion");
+        clock.set(1_000 + IDEMPOTENCY_TTL_SECONDS - 1);
+        assert!(matches!(
+            store
+                .claim(request(
+                    "owner-a",
+                    "expiring-key",
+                    "source.tool",
+                    &arguments,
+                ))
+                .await
+                .expect("retained replay"),
+            IdempotencyClaim::Replay { .. }
+        ));
+        clock.set(1_000 + IDEMPOTENCY_TTL_SECONDS);
+        assert!(matches!(
+            store
+                .claim(request(
+                    "owner-a",
+                    "expiring-key",
+                    "source.tool",
+                    &arguments,
+                ))
+                .await
+                .expect("reused expired key"),
+            IdempotencyClaim::Fresh(_)
+        ));
+    }
+
+    #[tokio::test]
+    async fn secrets_and_replay_payloads_are_not_stored_as_plaintext() {
+        let (_directory, store, _clock) = store().await;
+        let arguments = json!({"secret": "argument-plaintext-marker"});
+        let fresh = store
+            .claim(request(
+                "owner-a",
+                "raw-idempotency-key-marker",
+                "source.tool",
+                &arguments,
+            ))
+            .await
+            .expect("claim");
+        let IdempotencyClaim::Fresh(record) = fresh else {
+            panic!("fresh claim expected");
+        };
+        store
+            .complete(
+                &record.id,
+                IdempotencyResponseKind::Tool,
+                &IdempotencyResponse {
+                    status: 200,
+                    headers: BTreeMap::new(),
+                    body: b"response-plaintext-marker".to_vec(),
+                },
+                None,
+            )
+            .await
+            .expect("completion");
+        let stored = sqlx::query_as::<_, (Vec<u8>, Vec<u8>, Vec<u8>)>(
+            "SELECT key_digest, request_digest, response_ciphertext \
+             FROM gateway_invocation_idempotency WHERE id = ?",
+        )
+        .bind(record.id)
+        .fetch_one(&store.pool)
+        .await
+        .expect("stored row");
+        let mut bytes = Vec::new();
+        bytes.extend(stored.0);
+        bytes.extend(stored.1);
+        bytes.extend(stored.2);
+        let storage = String::from_utf8_lossy(&bytes);
+        assert!(!storage.contains("raw-idempotency-key-marker"));
+        assert!(!storage.contains("argument-plaintext-marker"));
+        assert!(!storage.contains("response-plaintext-marker"));
+    }
+
+    #[test]
+    fn key_validation_is_bounded_and_visible_ascii_only() {
+        assert!(validate_key("a").is_ok());
+        assert!(validate_key(&"x".repeat(255)).is_ok());
+        assert!(matches!(
+            validate_key(""),
+            Err(IdempotencyError::InvalidKey)
+        ));
+        assert!(matches!(
+            validate_key(&"x".repeat(256)),
+            Err(IdempotencyError::InvalidKey)
+        ));
+        assert!(matches!(
+            validate_key("contains space"),
+            Err(IdempotencyError::InvalidKey)
+        ));
+        assert!(matches!(
+            validate_key("non-ascii-é"),
+            Err(IdempotencyError::InvalidKey)
+        ));
+    }
+}
diff --git a/src/invocation/mod.rs b/src/invocation/mod.rs
new file mode 100644
index 000000000..680fe6de3
--- /dev/null
+++ b/src/invocation/mod.rs
@@ -0,0 +1,6874 @@
+use std::{
+    collections::{BTreeMap, HashMap, HashSet},
+    future::Future,
+    pin::Pin,
+    sync::atomic::{AtomicBool, Ordering},
+    sync::{Arc, Mutex},
+    time::{Duration, Instant},
+};
+
+use serde::{Deserialize, Serialize};
+use serde_json::{Value, json};
+use sqlx::SqlitePool;
+use thiserror::Error;
+
+use crate::{
+    actor::ToolActor,
+    approval::{
+        ApprovalAdminDetail, ApprovalDecision, ApprovalDeliveryIdentity, ApprovalError,
+        ApprovalOwnerDetail, ApprovalRecord, ApprovalStatus, ApprovalStore, ExecutionOutcome,
+        NewApproval,
+    },
+    catalog::{
+        CatalogError, CatalogStore, InvocationLease, ListToolsFilter, NewRequestLog,
+        RequestOutcome, RequestSurface, ToolBinding, ToolMode,
+    },
+    crypto::Keyring,
+    oauth::{OAuthBinding, OAuthError, OAuthService},
+    outbound::OutboundError,
+    protocols::{
+        PreparedProtocolInvocation, ProtocolError, ProtocolInvocationError, ProtocolRegistry,
+    },
+    request_logs::RequestLogSink,
+    tasks::TaskTracker,
+};
+use tokio::sync::{Notify, OwnedSemaphorePermit, RwLock, Semaphore, oneshot};
+
+mod idempotency;
+
+use idempotency::{
+    CorrelatedApproval, GatewayIdempotencyStore, IdempotencyClaim, IdempotencyError,
+    IdempotencyOwner, IdempotencyRecord, IdempotencyRequest, IdempotencyResponse,
+    IdempotencyResponseKind, idempotency_execution_id,
+};
+
+const APPROVAL_EXECUTION_CONCURRENCY: usize = 16;
+const GATEWAY_INVOKE_ROUTE: &str = "POST /api/v1/gateway/tools/invoke";
+
+pub const MAX_ARGUMENT_BYTES: usize = 8 * 1024 * 1024;
+pub const MAX_RESULT_BYTES: usize = 8 * 1024 * 1024;
+
+pub(crate) fn gateway_idempotency_key_is_valid(key: &str) -> bool {
+    idempotency::validate_key(key).is_ok()
+}
+
+#[derive(Clone, Debug)]
+pub struct ToolCall {
+    pub request_id: String,
+    pub actor: ToolActor,
+    pub surface: RequestSurface,
+    pub execution_id: String,
+    pub call_id: String,
+    /// Zero identifies a directly resumable call. Sandbox generations start at one and are never
+    /// replayed after their worker continuation has been lost.
+    pub worker_generation: u64,
+    pub path: String,
+    pub arguments: Value,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ToolResult {
+    pub ok: bool,
+    pub data: Option<Value>,
+    pub error: Option<PublicToolError>,
+    pub http: Option<ToolHttpMetadata>,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct PublicToolError {
+    pub code: String,
+    pub message: String,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct ToolHttpMetadata {
+    pub status: u16,
+    pub headers: BTreeMap<String, String>,
+    pub truncated: bool,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum ToolCallAdapterErrorCode {
+    ApprovalPersistenceUnavailable,
+    ApprovalPersistenceInterrupted,
+    IdempotencyMetadataInvalid,
+    IdempotencyFailed,
+    InvocationOutcomeUnknown,
+    OAuthConnectionFailed,
+    OAuthBindingChanged,
+    OpenApiOutcomeUnknown,
+    GraphqlOutcomeUnknown,
+    McpOutcomeUnknown,
+    McpProtocolUnavailable,
+    McpUpstreamUnauthorized,
+    McpUpstreamForbidden,
+    McpSessionConflict,
+    McpShuttingDown,
+    McpCapacity,
+    McpMessageTooLarge,
+}
+
+impl ToolCallAdapterErrorCode {
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::ApprovalPersistenceUnavailable => "approval_persistence_unavailable",
+            Self::ApprovalPersistenceInterrupted => "approval_persistence_interrupted",
+            Self::IdempotencyMetadataInvalid => "idempotency_metadata_invalid",
+            Self::IdempotencyFailed => "idempotency_failed",
+            Self::InvocationOutcomeUnknown => "invocation_outcome_unknown",
+            Self::OAuthConnectionFailed => "oauth_connection_failed",
+            Self::OAuthBindingChanged => "oauth_binding_changed",
+            Self::OpenApiOutcomeUnknown => "openapi_outcome_unknown",
+            Self::GraphqlOutcomeUnknown => "graphql_outcome_unknown",
+            Self::McpOutcomeUnknown => "mcp_outcome_unknown",
+            Self::McpProtocolUnavailable => "mcp_protocol_unavailable",
+            Self::McpUpstreamUnauthorized => "mcp_upstream_unauthorized",
+            Self::McpUpstreamForbidden => "mcp_upstream_forbidden",
+            Self::McpSessionConflict => "mcp_session_conflict",
+            Self::McpShuttingDown => "mcp_shutting_down",
+            Self::McpCapacity => "mcp_capacity",
+            Self::McpMessageTooLarge => "mcp_message_too_large",
+        }
+    }
+
+    const fn outcome_unknown(self) -> bool {
+        matches!(
+            self,
+            Self::InvocationOutcomeUnknown
+                | Self::OpenApiOutcomeUnknown
+                | Self::GraphqlOutcomeUnknown
+                | Self::McpOutcomeUnknown
+        )
+    }
+}
+
+impl From<ToolCallAdapterErrorCode> for String {
+    fn from(code: ToolCallAdapterErrorCode) -> Self {
+        code.as_str().to_owned()
+    }
+}
+
+#[derive(Debug, Error)]
+pub enum ToolCallOAuthError {
+    #[error("managed OAuth configuration is invalid")]
+    Validation { code: &'static str },
+    #[error("a managed OAuth connection is required")]
+    ConnectionRequired,
+    #[error("the managed OAuth connection changed")]
+    Conflict { code: &'static str },
+    #[error("the managed OAuth transaction is unauthorized")]
+    UnauthorizedTransaction,
+    #[error("managed OAuth authorization was denied")]
+    AuthorizationDenied,
+    #[error("the OAuth provider is unavailable")]
+    Upstream { code: &'static str },
+    #[error("managed OAuth failed internally")]
+    Internal,
+}
+
+impl ToolCallOAuthError {
+    pub const fn code(&self) -> &'static str {
+        match self {
+            Self::Validation { code } | Self::Conflict { code } | Self::Upstream { code } => code,
+            Self::ConnectionRequired => "oauth_connection_required",
+            Self::UnauthorizedTransaction => "oauth_transaction_unauthorized",
+            Self::AuthorizationDenied => "oauth_authorization_denied",
+            Self::Internal => "oauth_internal_error",
+        }
+    }
+}
+
+impl From<OAuthError> for ToolCallOAuthError {
+    fn from(error: OAuthError) -> Self {
+        match error {
+            OAuthError::Validation { code, .. } => Self::Validation { code },
+            OAuthError::NotFound => Self::ConnectionRequired,
+            OAuthError::Conflict { code, .. } => Self::Conflict { code },
+            OAuthError::UnauthorizedTransaction => Self::UnauthorizedTransaction,
+            OAuthError::AuthorizationDenied { .. } => Self::AuthorizationDenied,
+            OAuthError::Upstream { code } => Self::Upstream { code },
+            OAuthError::Internal => Self::Internal,
+        }
+    }
+}
+
+#[derive(Debug, Error)]
+pub enum ToolCallError {
+    #[error(transparent)]
+    Approval(#[from] ApprovalError),
+    #[error(transparent)]
+    Catalog(#[from] CatalogError),
+    #[error("{message}")]
+    Adapter {
+        code: ToolCallAdapterErrorCode,
+        message: String,
+    },
+    #[error(transparent)]
+    OAuth(#[from] ToolCallOAuthError),
+    #[error("tool arguments exceed the allowed size")]
+    ArgumentsTooLarge,
+    #[error("tool arguments do not match the input schema")]
+    InvalidArguments,
+    #[error("the invocation changed before it could execute")]
+    Stale,
+    #[error(transparent)]
+    Outbound(#[from] OutboundError),
+    #[error(transparent)]
+    Protocol(#[from] ProtocolError),
+    #[error("the tool result exceeds the allowed size")]
+    ResultTooLarge,
+}
+
+impl ToolCallError {
+    fn outcome_unknown(&self) -> bool {
+        matches!(
+            self,
+            Self::Adapter { code, .. } if code.outcome_unknown()
+        )
+    }
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+enum InvocationEffect {
+    ReadOnly,
+    MayHaveSideEffects,
+}
+
+impl InvocationEffect {
+    fn from_lease(lease: &InvocationLease) -> Self {
+        match lease.binding() {
+            ToolBinding::OpenapiV1(binding)
+                if matches!(binding.method.as_str(), "GET" | "HEAD" | "OPTIONS") =>
+            {
+                Self::ReadOnly
+            }
+            ToolBinding::GraphqlV1(binding) if !binding.operation.is_mutation() => Self::ReadOnly,
+            ToolBinding::OpenapiV1(_)
+            | ToolBinding::GraphqlV1(_)
+            | ToolBinding::McpHttpV1(_)
+            | ToolBinding::McpStdioV1(_) => Self::MayHaveSideEffects,
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+enum ExecutionFailurePhase {
+    PreDispatch,
+    ProtocolClassified,
+    PostDispatch,
+}
+
+#[derive(Debug)]
+struct InvocationExecutionError {
+    error: ToolCallError,
+    phase: ExecutionFailurePhase,
+    effect: InvocationEffect,
+}
+
+impl InvocationExecutionError {
+    fn new(error: ToolCallError, phase: ExecutionFailurePhase, effect: InvocationEffect) -> Self {
+        Self {
+            error,
+            phase,
+            effect,
+        }
+    }
+
+    fn outcome_unknown(&self) -> bool {
+        self.error.outcome_unknown()
+            || matches!(
+                (self.phase, self.effect),
+                (
+                    ExecutionFailurePhase::PostDispatch,
+                    InvocationEffect::MayHaveSideEffects
+                )
+            )
+    }
+
+    fn error(&self) -> &ToolCallError {
+        &self.error
+    }
+
+    fn stable_error_code(&self) -> &'static str {
+        if self.outcome_unknown() && !self.error.outcome_unknown() {
+            ToolCallAdapterErrorCode::InvocationOutcomeUnknown.as_str()
+        } else {
+            error_code(&self.error)
+        }
+    }
+
+    fn into_error(self) -> ToolCallError {
+        if self.outcome_unknown() && !self.error.outcome_unknown() {
+            protocol_adapter_error(
+                ToolCallAdapterErrorCode::InvocationOutcomeUnknown,
+                "The upstream operation may have completed, so it cannot be retried safely.",
+            )
+        } else {
+            self.error
+        }
+    }
+}
+
+#[derive(Clone)]
+pub struct ToolCallService {
+    catalog: CatalogStore,
+    protocols: ProtocolRegistry,
+    approvals: ApprovalStore,
+    approval_queries: ApprovalQueries,
+    idempotency: GatewayIdempotencyStore,
+    request_logs: RequestLogSink,
+    oauth: OAuthService,
+    approval_notifications: ApprovalNotificationRegistry,
+    global_approval_notify: Arc<Notify>,
+    expiry_slot: Arc<Semaphore>,
+    next_expiry_scan: Arc<Mutex<Instant>>,
+    approval_log_flush: Arc<Semaphore>,
+    approval_log_requested: Arc<AtomicBool>,
+    discovery_slots: Arc<Semaphore>,
+    execution_slots: Arc<Semaphore>,
+    in_flight_approvals: Arc<Mutex<HashSet<String>>>,
+    in_flight_mcp_settlements: Arc<Mutex<HashSet<String>>>,
+    in_flight_execution_cancellations: Arc<Mutex<HashSet<String>>>,
+    deferred_execution_cancellations: Arc<RwLock<HashSet<String>>>,
+    execution_stopping_flags: Arc<Mutex<HashMap<String, Arc<AtomicBool>>>>,
+    #[cfg(test)]
+    approval_cancellation_race_hook: Arc<Mutex<Option<Arc<ApprovalCancellationRaceHook>>>>,
+    #[cfg(test)]
+    approved_execution_hook: Arc<Mutex<Option<Arc<ApprovedExecutionHook>>>>,
+    #[cfg(test)]
+    cancel_execution_hook: Arc<Mutex<Option<Arc<CancelExecutionHook>>>>,
+    #[cfg(test)]
+    execution_cancellation_recovery_race_hook:
+        Arc<Mutex<Option<Arc<ExecutionCancellationRecoveryRaceHook>>>>,
+    #[cfg(test)]
+    retryable_release_race_hook: Arc<Mutex<Option<Arc<RetryableReleaseRaceHook>>>>,
+    background_tasks: TaskTracker,
+    durable_tasks: TaskTracker,
+}
+
+#[cfg(test)]
+#[derive(Default)]
+struct ApprovalCancellationRaceHook {
+    decision_read_acquired: Notify,
+    cancellation_write_queued: Notify,
+    release_decision: Notify,
+}
+
+#[cfg(test)]
+#[derive(Default)]
+struct ApprovedExecutionHook {
+    started: Notify,
+    release: Notify,
+    dispatches: std::sync::atomic::AtomicUsize,
+}
+
+#[cfg(test)]
+#[derive(Default)]
+struct CancelExecutionHook {
+    failures: std::sync::atomic::AtomicUsize,
+    block_retries: AtomicBool,
+    retry_waiters: std::sync::atomic::AtomicUsize,
+    retry_waiting: Notify,
+    release_retries: Notify,
+}
+
+#[cfg(test)]
+struct ExecutionCancellationRecoveryRaceHook {
+    old_finish_write_acquired: std::sync::Barrier,
+    release_old_finish: std::sync::Barrier,
+    new_mark_write_queued: Notify,
+}
+
+#[cfg(test)]
+impl Default for ExecutionCancellationRecoveryRaceHook {
+    fn default() -> Self {
+        Self {
+            old_finish_write_acquired: std::sync::Barrier::new(2),
+            release_old_finish: std::sync::Barrier::new(2),
+            new_mark_write_queued: Notify::new(),
+        }
+    }
+}
+
+#[cfg(test)]
+#[derive(Default)]
+struct RetryableReleaseRaceHook {
+    released: Notify,
+    continue_settlement: Notify,
+    cleanup_started: Notify,
+    cleanup_completed: Notify,
+}
+
+#[derive(Clone)]
+struct InvocationLogContext {
+    request_id: String,
+    actor_api_token_id: Option<String>,
+    surface: RequestSurface,
+    source_id: String,
+    tool_id: String,
+    path_snapshot: String,
+    started: Instant,
+}
+
+impl InvocationLogContext {
+    fn new(call: &ToolCall, source_id: String, tool_id: String, started: Instant) -> Self {
+        Self {
+            request_id: call.request_id.clone(),
+            actor_api_token_id: call.actor.api_token_id().map(str::to_owned),
+            surface: call.surface,
+            source_id,
+            tool_id,
+            path_snapshot: normalized_path_snapshot(&call.path),
+            started,
+        }
+    }
+
+    fn failed(&self, error_code: &str) -> NewRequestLog {
+        NewRequestLog {
+            request_id: self.request_id.clone(),
+            actor_api_token_id: self.actor_api_token_id.clone(),
+            surface: self.surface,
+            source_id: Some(self.source_id.clone()),
+            tool_id: Some(self.tool_id.clone()),
+            path_snapshot: Some(self.path_snapshot.clone()),
+            outcome: RequestOutcome::Failed,
+            error_code: Some(error_code.to_owned()),
+            duration_ms: u64::try_from(self.started.elapsed().as_millis()).unwrap_or(u64::MAX),
+            approval_id: None,
+            created_at: crate::unix_timestamp(),
+        }
+    }
+}
+
+struct DurableInvocationLogGuard {
+    context: Option<InvocationLogContext>,
+    request_logs: RequestLogSink,
+    tasks: TaskTracker,
+}
+
+impl DurableInvocationLogGuard {
+    fn new(
+        context: InvocationLogContext,
+        request_logs: RequestLogSink,
+        tasks: TaskTracker,
+    ) -> Self {
+        Self {
+            context: Some(context),
+            request_logs,
+            tasks,
+        }
+    }
+
+    fn disarm(&mut self) {
+        self.context = None;
+    }
+
+    async fn persist(&mut self, error_code: &str) {
+        let Some(context) = self.context.as_ref() else {
+            return;
+        };
+        persist_durable_request_log(&self.request_logs, context.failed(error_code)).await;
+        self.disarm();
+    }
+}
+
+impl Drop for DurableInvocationLogGuard {
+    fn drop(&mut self) {
+        let Some(context) = self.context.take() else {
+            return;
+        };
+        let log = context.failed(ToolCallAdapterErrorCode::InvocationOutcomeUnknown.as_str());
+        let request_logs = self.request_logs.clone();
+        let fallback_logs = request_logs.clone();
+        let fallback_log = log.clone();
+        if !self.tasks.spawn_supervised(move |_shutdown| async move {
+            persist_durable_request_log(&request_logs, log).await;
+        }) && !fallback_logs.try_record(fallback_log)
+        {
+            tracing::error!(
+                request_id = context.request_id,
+                "uncertain invocation request log could not be queued during shutdown"
+            );
+        }
+    }
+}
+
+async fn persist_durable_request_log(request_logs: &RequestLogSink, log: NewRequestLog) {
+    let mut delay = Duration::from_millis(25);
+    while !request_logs.record_durable(log.clone()).await {
+        tracing::warn!(
+            request_id = log.request_id,
+            "uncertain invocation request log persistence will retry"
+        );
+        tokio::time::sleep(delay).await;
+        delay = (delay * 2).min(Duration::from_secs(5));
+    }
+}
+
+#[derive(Clone)]
+pub struct ApprovalQueries {
+    approvals: ApprovalStore,
+}
+
+impl ApprovalQueries {
+    pub async fn get_admin(
+        &self,
+        approval_id: &str,
+    ) -> Result<Option<ApprovalAdminDetail>, ApprovalError> {
+        self.approvals.get_admin(approval_id).await
+    }
+
+    pub async fn get_for_token(
+        &self,
+        approval_id: &str,
+        actor_api_token_id: &str,
+    ) -> Result<Option<ApprovalOwnerDetail>, ApprovalError> {
+        self.approvals
+            .get_for_token(approval_id, actor_api_token_id)
+            .await
+    }
+
+    pub async fn list_admin(
+        &self,
+        query: crate::approval::ApprovalListQuery,
+    ) -> Result<crate::approval::ApprovalPage, ApprovalError> {
+        self.approvals.list_admin(query).await
+    }
+}
+
+#[derive(Debug)]
+pub enum ToolCallSubmission {
+    Completed(ToolResult),
+    ApprovalRequired(ApprovalRequired),
+}
+
+pub struct ApprovalRequired {
+    record: Box<ApprovalRecord>,
+    delivery: Option<ApprovalDeliveryTicket>,
+}
+
+impl std::fmt::Debug for ApprovalRequired {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("ApprovalRequired")
+            .field("record", &self.record)
+            .finish_non_exhaustive()
+    }
+}
+
+impl std::ops::Deref for ApprovalRequired {
+    type Target = ApprovalRecord;
+
+    fn deref(&self) -> &Self::Target {
+        &self.record
+    }
+}
+
+struct ApprovalDeliveryTicket {
+    identity: Option<ApprovalDeliveryIdentity>,
+    approvals: ApprovalStore,
+    notifications: ApprovalNotificationRegistry,
+    tasks: TaskTracker,
+}
+
+impl ApprovalDeliveryTicket {
+    async fn release(&mut self) {
+        let Some(identity) = self.identity.take() else {
+            return;
+        };
+        if let Err(error) = self.approvals.release_delivery_pin(&identity).await {
+            tracing::warn!(
+                approval_id = identity.approval_id,
+                error = %error,
+                "approval delivery pin release will retry"
+            );
+            self.identity = Some(identity);
+            return;
+        }
+        notify_registry(&self.notifications, &identity.approval_id);
+    }
+}
+
+impl Drop for ApprovalDeliveryTicket {
+    fn drop(&mut self) {
+        let Some(identity) = self.identity.take() else {
+            return;
+        };
+        let approvals = self.approvals.clone();
+        let notifications = self.notifications.clone();
+        self.tasks.spawn(async move {
+            let mut delay = Duration::from_millis(25);
+            loop {
+                match approvals.release_delivery_pin(&identity).await {
+                    Ok(_) => {
+                        notify_registry(&notifications, &identity.approval_id);
+                        return;
+                    }
+                    Err(error) => {
+                        tracing::warn!(
+                            approval_id = identity.approval_id,
+                            error = %error,
+                            "approval delivery pin cleanup will retry"
+                        );
+                        tokio::time::sleep(delay).await;
+                        delay = (delay * 2).min(Duration::from_secs(5));
+                    }
+                }
+            }
+        });
+    }
+}
+
+#[derive(Clone, Debug)]
+pub(crate) struct GatewayInvokeResponse {
+    pub response: IdempotencyResponse,
+    pub replayed: bool,
+}
+
+#[derive(Clone, Debug)]
+pub(crate) struct McpIdempotencyRequest {
+    pub owner_api_token_id: String,
+    pub key: String,
+    pub route: String,
+    pub callable_path: String,
+    pub arguments: Value,
+}
+
+#[derive(Clone, Debug)]
+pub(crate) struct McpIdempotencyBlob {
+    pub body: Vec<u8>,
+}
+
+pub(crate) enum McpIdempotencyClaim {
+    Fresh(Box<McpIdempotencyReservation>),
+    InProgress,
+    Replay(McpIdempotencyBlob),
+    Indeterminate,
+    Mismatch,
+}
+
+pub(crate) struct McpIdempotencyReservation {
+    guard: Option<IdempotencyReservationGuard>,
+}
+
+pub(crate) struct McpIdempotencyExecution {
+    guard: Option<IdempotencyExecutionGuard>,
+}
+
+#[derive(Clone, Debug)]
+pub(crate) struct McpIdempotentResponse {
+    pub result: ToolResult,
+    pub replayed: bool,
+}
+
+#[derive(Debug, Error)]
+pub(crate) enum GatewayInvokeError {
+    #[error(transparent)]
+    ToolCall(#[from] ToolCallError),
+    #[error("the Idempotency-Key is invalid")]
+    InvalidKey,
+    #[error("gateway idempotency capacity has been reached")]
+    Capacity,
+    #[error("gateway idempotency failed: {0}")]
+    Idempotency(String),
+    #[error("the Idempotency-Key was already used for a different invocation")]
+    KeyMismatch,
+    #[error("the idempotent invocation is still in progress")]
+    InProgress,
+    #[error("the idempotent invocation outcome is unknown")]
+    OutcomeUnknown,
+    #[error("the idempotent invocation wait was canceled")]
+    Canceled,
+}
+
+impl From<IdempotencyError> for GatewayInvokeError {
+    fn from(error: IdempotencyError) -> Self {
+        match error {
+            IdempotencyError::InvalidKey => Self::InvalidKey,
+            IdempotencyError::Capacity => Self::Capacity,
+            error => Self::Idempotency(error.to_string()),
+        }
+    }
+}
+
+#[derive(Debug, Error)]
+pub enum ApprovalWaitError {
+    #[error(transparent)]
+    Approval(#[from] ApprovalError),
+    #[error("approval wait was canceled")]
+    Canceled,
+}
+
+#[derive(Debug, Error)]
+pub enum ToolDiscoveryError {
+    #[error("tool search is busy")]
+    Busy,
+    #[error(transparent)]
+    Catalog(#[from] CatalogError),
+    #[error("tool discovery task was interrupted")]
+    Interrupted,
+}
+
+type ApprovalNotificationRegistry = Arc<Mutex<HashMap<String, ApprovalNotificationEntry>>>;
+
+struct ApprovalNotificationEntry {
+    notify: Arc<Notify>,
+    waiters: usize,
+}
+
+struct ApprovalWaitRegistration {
+    approval_id: String,
+    notify: Arc<Notify>,
+    registry: ApprovalNotificationRegistry,
+}
+
+struct IdempotencyReservationGuard {
+    record: IdempotencyRecord,
+    store: GatewayIdempotencyStore,
+    approvals: ApprovalStore,
+    tasks: TaskTracker,
+    armed: bool,
+}
+
+impl IdempotencyReservationGuard {
+    fn new(
+        record: IdempotencyRecord,
+        store: GatewayIdempotencyStore,
+        approvals: ApprovalStore,
+        tasks: TaskTracker,
+    ) -> Self {
+        Self {
+            record,
+            store,
+            approvals,
+            tasks,
+            armed: true,
+        }
+    }
+
+    fn disarm(&mut self) {
+        self.armed = false;
+    }
+}
+
+impl Drop for IdempotencyReservationGuard {
+    fn drop(&mut self) {
+        if !self.armed {
+            return;
+        }
+        let id = self.record.id.clone();
+        let record = self.record.clone();
+        let store = self.store.clone();
+        let approvals = self.approvals.clone();
+        self.tasks.spawn(async move {
+            let mut delay = Duration::from_millis(25);
+            loop {
+                match settle_abandoned_reservation(&store, &approvals, &record).await {
+                    Ok(()) => break,
+                    Err(error) => {
+                        tracing::warn!(idempotency_id = id, error = %error, "idempotency reservation cleanup will retry");
+                        tokio::time::sleep(delay).await;
+                        delay = (delay * 2).min(Duration::from_secs(5));
+                    }
+                }
+            }
+        });
+    }
+}
+
+async fn settle_abandoned_reservation(
+    store: &GatewayIdempotencyStore,
+    approvals: &ApprovalStore,
+    record: &IdempotencyRecord,
+) -> Result<(), String> {
+    match store
+        .correlated_approval_id(record)
+        .await
+        .map_err(|error| error.to_string())?
+    {
+        Some(CorrelatedApproval::Live(approval_id)) => {
+            let approval = approvals
+                .get_admin(&approval_id)
+                .await
+                .map_err(|error| error.to_string())?;
+            let Some(approval) = approval else {
+                return store
+                    .abandon(&record.id)
+                    .await
+                    .map_err(|error| error.to_string());
+            };
+            if approval.record.surface == RequestSurface::Mcp {
+                return Ok(());
+            }
+            let response = match approval_required_response(&approval.record) {
+                Ok(response) => response,
+                Err(_) => {
+                    terminalize_idempotency(store, &record.id).await;
+                    return Ok(());
+                }
+            };
+            match store
+                .complete(
+                    &record.id,
+                    IdempotencyResponseKind::Approval,
+                    &response,
+                    Some(&approval_id),
+                )
+                .await
+            {
+                Ok(_) | Err(IdempotencyError::InvalidTransition("completed" | "indeterminate")) => {
+                    Ok(())
+                }
+                Err(_) => {
+                    terminalize_idempotency(store, &record.id).await;
+                    Ok(())
+                }
+            }
+        }
+        Some(CorrelatedApproval::Retired) | None => store
+            .abandon(&record.id)
+            .await
+            .map_err(|error| error.to_string()),
+    }
+}
+
+struct IdempotencyExecutionGuard {
+    id: String,
+    store: GatewayIdempotencyStore,
+    tasks: TaskTracker,
+    armed: bool,
+    #[cfg(test)]
+    cleanup_hook: Option<Arc<RetryableReleaseRaceHook>>,
+}
+
+impl IdempotencyExecutionGuard {
+    fn new(id: String, store: GatewayIdempotencyStore, tasks: TaskTracker) -> Self {
+        Self {
+            id,
+            store,
+            tasks,
+            armed: true,
+            #[cfg(test)]
+            cleanup_hook: None,
+        }
+    }
+
+    fn disarm(&mut self) {
+        self.armed = false;
+    }
+
+    #[cfg(test)]
+    fn set_cleanup_hook(&mut self, hook: Option<Arc<RetryableReleaseRaceHook>>) {
+        self.cleanup_hook = hook;
+    }
+}
+
+impl Drop for IdempotencyExecutionGuard {
+    fn drop(&mut self) {
+        if !self.armed {
+            return;
+        }
+        let id = self.id.clone();
+        let store = self.store.clone();
+        #[cfg(test)]
+        let cleanup_hook = self.cleanup_hook.clone();
+        self.tasks.spawn(async move {
+            #[cfg(test)]
+            if let Some(hook) = cleanup_hook.as_ref() {
+                hook.cleanup_started.notify_one();
+            }
+            let mut delay = Duration::from_millis(25);
+            loop {
+                match store.mark_indeterminate(&id).await {
+                    Ok(_)
+                    | Err(IdempotencyError::InvalidTransition(
+                        "completed" | "indeterminate",
+                    ))
+                    | Err(IdempotencyError::NotFound) => break,
+                    Err(error) => {
+                        tracing::error!(idempotency_id = id, error = %error, "uncertain invocation terminalization will retry");
+                        tokio::time::sleep(delay).await;
+                        delay = (delay * 2).min(Duration::from_secs(5));
+                    }
+                }
+            }
+            #[cfg(test)]
+            if let Some(hook) = cleanup_hook {
+                hook.cleanup_completed.notify_one();
+            }
+        });
+    }
+}
+
+impl McpIdempotencyReservation {
+    pub(crate) async fn mark_executing(
+        mut self,
+    ) -> Result<McpIdempotencyExecution, GatewayInvokeError> {
+        let mut guard = self.guard.take().ok_or_else(|| {
+            GatewayInvokeError::Idempotency(
+                "idempotency reservation was already consumed".to_owned(),
+            )
+        })?;
+        guard.store.mark_executing(&guard.record.id).await?;
+        guard.disarm();
+        Ok(McpIdempotencyExecution {
+            guard: Some(IdempotencyExecutionGuard::new(
+                guard.record.id.clone(),
+                guard.store.clone(),
+                guard.tasks.clone(),
+            )),
+        })
+    }
+}
+
+impl McpIdempotencyExecution {
+    pub(crate) async fn mark_indeterminate(mut self) -> Result<(), GatewayInvokeError> {
+        let mut guard = self.guard.take().ok_or_else(|| {
+            GatewayInvokeError::Idempotency("idempotency execution was already consumed".to_owned())
+        })?;
+        guard.store.mark_indeterminate(&guard.id).await?;
+        guard.disarm();
+        Ok(())
+    }
+
+    pub(crate) async fn complete(
+        mut self,
+        response: McpIdempotencyBlob,
+    ) -> Result<(), GatewayInvokeError> {
+        let mut guard = self.guard.take().ok_or_else(|| {
+            GatewayInvokeError::Idempotency("idempotency execution was already consumed".to_owned())
+        })?;
+        let response = mcp_blob_response(response);
+        if let Err(error) = guard
+            .store
+            .complete(&guard.id, IdempotencyResponseKind::Tool, &response, None)
+            .await
+        {
+            tracing::error!(
+                idempotency_id = guard.id,
+                error = %error,
+                "post-dispatch MCP response persistence will recover as indeterminate"
+            );
+            return Err(GatewayInvokeError::OutcomeUnknown);
+        }
+        guard.disarm();
+        Ok(())
+    }
+}
+
+struct IdempotencyAskCompletionGuard {
+    id: String,
+    approval_id: String,
+    response: IdempotencyResponse,
+    store: GatewayIdempotencyStore,
+    tasks: TaskTracker,
+    armed: bool,
+}
+
+struct McpApprovalSettlementGuard {
+    service: ToolCallService,
+    record: IdempotencyRecord,
+    actor: ToolActor,
+    armed: bool,
+}
+
+impl McpApprovalSettlementGuard {
+    fn new(service: ToolCallService, record: IdempotencyRecord, actor: ToolActor) -> Self {
+        Self {
+            service,
+            record,
+            actor,
+            armed: true,
+        }
+    }
+
+    fn disarm(&mut self) {
+        self.armed = false;
+    }
+}
+
+impl Drop for McpApprovalSettlementGuard {
+    fn drop(&mut self) {
+        if self.armed {
+            self.service
+                .spawn_mcp_idempotency_settlement(self.record.clone(), self.actor.clone());
+        }
+    }
+}
+
+impl IdempotencyAskCompletionGuard {
+    fn new(
+        id: String,
+        approval_id: String,
+        response: IdempotencyResponse,
+        store: GatewayIdempotencyStore,
+        tasks: TaskTracker,
+    ) -> Self {
+        Self {
+            id,
+            approval_id,
+            response,
+            store,
+            tasks,
+            armed: true,
+        }
+    }
+
+    fn disarm(&mut self) {
+        self.armed = false;
+    }
+}
+
+impl Drop for IdempotencyAskCompletionGuard {
+    fn drop(&mut self) {
+        if !self.armed {
+            return;
+        }
+        let id = self.id.clone();
+        let approval_id = self.approval_id.clone();
+        let response = self.response.clone();
+        let store = self.store.clone();
+        self.tasks.spawn(async move {
+            match store
+                .complete(
+                    &id,
+                    IdempotencyResponseKind::Approval,
+                    &response,
+                    Some(&approval_id),
+                )
+                .await
+            {
+                Ok(_) | Err(IdempotencyError::InvalidTransition("completed")) => {}
+                Err(_) => terminalize_idempotency(&store, &id).await,
+            }
+        });
+    }
+}
+
+async fn terminalize_idempotency(store: &GatewayIdempotencyStore, id: &str) {
+    let mut delay = Duration::from_millis(25);
+    loop {
+        match store.mark_indeterminate(id).await {
+            Ok(_)
+            | Err(IdempotencyError::InvalidTransition("completed" | "indeterminate"))
+            | Err(IdempotencyError::NotFound) => return,
+            Err(error) => {
+                tracing::error!(idempotency_id = id, error = %error, "idempotency terminalization will retry");
+                tokio::time::sleep(delay).await;
+                delay = (delay * 2).min(Duration::from_secs(5));
+            }
+        }
+    }
+}
+
+impl Drop for ApprovalWaitRegistration {
+    fn drop(&mut self) {
+        let mut registry = self
+            .registry
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        let remove = registry.get_mut(&self.approval_id).is_some_and(|entry| {
+            if !Arc::ptr_eq(&entry.notify, &self.notify) {
+                return false;
+            }
+            entry.waiters = entry.waiters.saturating_sub(1);
+            entry.waiters == 0
+        });
+        if remove {
+            registry.remove(&self.approval_id);
+        }
+    }
+}
+
+impl ToolCallService {
+    pub(crate) fn new(
+        catalog: CatalogStore,
+        protocols: ProtocolRegistry,
+        pool: SqlitePool,
+        keyring: Keyring,
+        request_logs: RequestLogSink,
+        oauth: OAuthService,
+    ) -> Self {
+        let idempotency = GatewayIdempotencyStore::new(pool.clone(), keyring.clone());
+        let approvals = ApprovalStore::system(pool, keyring);
+        Self {
+            catalog,
+            protocols,
+            approval_queries: ApprovalQueries {
+                approvals: approvals.clone(),
+            },
+            approvals,
+            idempotency,
+            request_logs,
+            oauth,
+            approval_notifications: Arc::new(Mutex::new(HashMap::new())),
+            global_approval_notify: Arc::new(Notify::new()),
+            expiry_slot: Arc::new(Semaphore::new(1)),
+            next_expiry_scan: Arc::new(Mutex::new(Instant::now())),
+            approval_log_flush: Arc::new(Semaphore::new(1)),
+            approval_log_requested: Arc::new(AtomicBool::new(false)),
+            discovery_slots: Arc::new(Semaphore::new(1)),
+            execution_slots: Arc::new(Semaphore::new(APPROVAL_EXECUTION_CONCURRENCY)),
+            in_flight_approvals: Arc::new(Mutex::new(HashSet::new())),
+            in_flight_mcp_settlements: Arc::new(Mutex::new(HashSet::new())),
+            in_flight_execution_cancellations: Arc::new(Mutex::new(HashSet::new())),
+            deferred_execution_cancellations: Arc::new(RwLock::new(HashSet::new())),
+            execution_stopping_flags: Arc::new(Mutex::new(HashMap::new())),
+            #[cfg(test)]
+            approval_cancellation_race_hook: Arc::new(Mutex::new(None)),
+            #[cfg(test)]
+            approved_execution_hook: Arc::new(Mutex::new(None)),
+            #[cfg(test)]
+            cancel_execution_hook: Arc::new(Mutex::new(None)),
+            #[cfg(test)]
+            execution_cancellation_recovery_race_hook: Arc::new(Mutex::new(None)),
+            #[cfg(test)]
+            retryable_release_race_hook: Arc::new(Mutex::new(None)),
+            background_tasks: TaskTracker::default(),
+            durable_tasks: TaskTracker::default(),
+        }
+    }
+
+    pub fn approvals(&self) -> &ApprovalQueries {
+        &self.approval_queries
+    }
+
+    pub(crate) async fn claim_mcp_idempotency(
+        &self,
+        request: &McpIdempotencyRequest,
+    ) -> Result<McpIdempotencyClaim, GatewayInvokeError> {
+        if !token_is_active(self.catalog.pool(), &request.owner_api_token_id)
+            .await
+            .map_err(ToolCallError::Approval)?
+        {
+            return Err(ToolCallError::Approval(ApprovalError::OwnerTokenInactive).into());
+        }
+        let claim = self
+            .idempotency
+            .claim(IdempotencyRequest {
+                owner: IdempotencyOwner {
+                    owner_api_token_id: &request.owner_api_token_id,
+                },
+                key: &request.key,
+                route: &request.route,
+                callable_path: &request.callable_path,
+                arguments: &request.arguments,
+            })
+            .await?;
+        Ok(match claim {
+            IdempotencyClaim::Fresh(record) => {
+                McpIdempotencyClaim::Fresh(Box::new(McpIdempotencyReservation {
+                    guard: Some(IdempotencyReservationGuard::new(
+                        record,
+                        self.idempotency.clone(),
+                        self.approvals.clone(),
+                        self.background_tasks.clone(),
+                    )),
+                }))
+            }
+            IdempotencyClaim::InProgress(_) => McpIdempotencyClaim::InProgress,
+            IdempotencyClaim::Replay { response, .. } => {
+                McpIdempotencyClaim::Replay(mcp_response_blob(response)?)
+            }
+            IdempotencyClaim::Indeterminate(_) => McpIdempotencyClaim::Indeterminate,
+            IdempotencyClaim::Mismatch => McpIdempotencyClaim::Mismatch,
+        })
+    }
+
+    pub(crate) async fn wait_mcp_idempotency<C>(
+        &self,
+        request: &McpIdempotencyRequest,
+        cancellation: C,
+    ) -> Result<McpIdempotencyClaim, GatewayInvokeError>
+    where
+        C: Future<Output = ()> + Send,
+    {
+        tokio::pin!(cancellation);
+        let mut delay = Duration::from_millis(10);
+        loop {
+            match self.claim_mcp_idempotency(request).await? {
+                McpIdempotencyClaim::InProgress => {}
+                terminal => return Ok(terminal),
+            }
+            tokio::select! {
+                () = &mut cancellation => return Err(GatewayInvokeError::Canceled),
+                () = tokio::time::sleep(delay) => {}
+            }
+            delay = (delay * 2).min(Duration::from_millis(250));
+        }
+    }
+
+    pub(crate) fn discovery_slots(&self) -> Arc<Semaphore> {
+        self.discovery_slots.clone()
+    }
+
+    pub(crate) fn record_rejected_request(
+        &self,
+        request_id: &str,
+        actor_api_token_id: &str,
+        surface: RequestSurface,
+        path: &str,
+        error_code: &str,
+    ) {
+        self.record(NewRequestLog {
+            request_id: request_id.to_owned(),
+            actor_api_token_id: Some(actor_api_token_id.to_owned()),
+            surface,
+            source_id: None,
+            tool_id: None,
+            path_snapshot: Some(path.to_owned()),
+            outcome: RequestOutcome::Failed,
+            error_code: Some(error_code.to_owned()),
+            duration_ms: 0,
+            approval_id: None,
+            created_at: crate::unix_timestamp(),
+        });
+    }
+
+    pub(crate) async fn shutdown(&self) {
+        self.background_tasks.shutdown().await;
+        self.durable_tasks.shutdown().await;
+        self.request_logs.shutdown().await;
+        self.settle_idempotency_shutdown().await;
+        let mut delay = Duration::from_millis(25);
+        loop {
+            match self.approvals.clear_delivery_pins().await {
+                Ok(_) => break,
+                Err(error) => {
+                    tracing::error!(error = %error, "shutdown approval delivery cleanup will retry");
+                    tokio::time::sleep(delay).await;
+                    delay = (delay * 2).min(Duration::from_secs(5));
+                }
+            }
+        }
+        self.global_approval_notify.notify_waiters();
+    }
+
+    async fn settle_idempotency_shutdown(&self) {
+        let mut delay = Duration::from_millis(25);
+        loop {
+            let result = async {
+                let recovery = self
+                    .idempotency
+                    .recover_startup()
+                    .await
+                    .map_err(|error| error.to_string())?;
+                for reservation in recovery.reserved {
+                    settle_abandoned_reservation(&self.idempotency, &self.approvals, &reservation)
+                        .await?;
+                }
+                Ok::<_, String>(())
+            }
+            .await;
+            match result {
+                Ok(()) => return,
+                Err(error) => {
+                    tracing::error!(error, "shutdown idempotency settlement will retry");
+                    tokio::time::sleep(delay).await;
+                    delay = (delay * 2).min(Duration::from_secs(5));
+                }
+            }
+        }
+    }
+
+    pub(crate) fn abort_background_tasks(&self) {
+        self.background_tasks.abort_all();
+    }
+
+    pub(crate) async fn recover_startup(&self) -> Result<(), ApprovalError> {
+        let idempotency_recovery = self
+            .idempotency
+            .recover_startup()
+            .await
+            .map_err(idempotency_startup_error)?;
+        let mut mcp_settlements = Vec::new();
+        for reservation in idempotency_recovery.reserved {
+            let approval_id = self
+                .idempotency
+                .correlated_approval_id(&reservation)
+                .await
+                .map_err(idempotency_startup_error)?;
+            let approval = match approval_id {
+                Some(CorrelatedApproval::Live(approval_id)) => {
+                    match self.approvals.get_admin(&approval_id).await? {
+                        Some(approval) => approval,
+                        None => {
+                            terminalize_idempotency(&self.idempotency, &reservation.id).await;
+                            continue;
+                        }
+                    }
+                }
+                Some(CorrelatedApproval::Retired) => {
+                    self.idempotency
+                        .mark_indeterminate(&reservation.id)
+                        .await
+                        .map_err(idempotency_startup_error)?;
+                    continue;
+                }
+                None => {
+                    self.idempotency
+                        .release_reserved(&reservation.id)
+                        .await
+                        .map_err(idempotency_startup_error)?;
+                    continue;
+                }
+            };
+            if approval.record.surface == RequestSurface::Mcp {
+                if approval.record.status == ApprovalStatus::Executing {
+                    self.idempotency
+                        .mark_indeterminate(&reservation.id)
+                        .await
+                        .map_err(idempotency_startup_error)?;
+                    continue;
+                }
+                let Some(actor_api_token_id) = approval.record.actor_api_token_id.clone() else {
+                    terminalize_idempotency(&self.idempotency, &reservation.id).await;
+                    continue;
+                };
+                mcp_settlements.push((
+                    reservation,
+                    ToolActor::api_token(
+                        actor_api_token_id,
+                        approval.record.actor_name_snapshot.clone(),
+                    ),
+                ));
+                continue;
+            }
+            let response = match approval_required_response(&approval.record) {
+                Ok(response) => response,
+                Err(_) => {
+                    terminalize_idempotency(&self.idempotency, &reservation.id).await;
+                    continue;
+                }
+            };
+            if self
+                .idempotency
+                .complete(
+                    &reservation.id,
+                    IdempotencyResponseKind::Approval,
+                    &response,
+                    Some(&approval.record.id),
+                )
+                .await
+                .is_err()
+            {
+                terminalize_idempotency(&self.idempotency, &reservation.id).await;
+            }
+        }
+        let recovery = self.approvals.recover_startup().await?;
+        self.schedule_approval_log_flush_if_pending().await?;
+        for approval_id in &recovery.approved_ids {
+            if self
+                .approvals
+                .get_admin(approval_id)
+                .await?
+                .is_some_and(|detail| detail.record.worker_generation == 0)
+            {
+                self.spawn_approved(approval_id.clone());
+            }
+        }
+        for (reservation, actor) in mcp_settlements {
+            self.spawn_mcp_idempotency_settlement(reservation, actor);
+        }
+        Ok(())
+    }
+
+    pub async fn submit(&self, call: ToolCall) -> Result<ToolCallSubmission, ToolCallError> {
+        let started = Instant::now();
+        if let Some(actor_api_token_id) = call.actor.api_token_id()
+            && !token_is_active(self.catalog.pool(), actor_api_token_id).await?
+        {
+            self.record_attempt(
+                &call,
+                None,
+                None,
+                RequestOutcome::Denied,
+                Some("token_revoked"),
+                None,
+                started,
+            );
+            return Err(ApprovalError::OwnerTokenInactive.into());
+        }
+        let encoded_arguments =
+            serde_json::to_vec(&call.arguments).map_err(|_| ToolCallError::InvalidArguments)?;
+        if encoded_arguments.len() > MAX_ARGUMENT_BYTES {
+            self.record_attempt(
+                &call,
+                None,
+                None,
+                RequestOutcome::Failed,
+                Some("arguments_too_large"),
+                None,
+                started,
+            );
+            return Err(ToolCallError::ArgumentsTooLarge);
+        }
+        let preflight = match self.catalog.preflight_invocation(&call.path).await {
+            Ok(preflight) => preflight,
+            Err(error) => {
+                let outcome = if matches!(error, CatalogError::ToolDisabled { .. }) {
+                    RequestOutcome::Denied
+                } else {
+                    RequestOutcome::Failed
+                };
+                let error = ToolCallError::Catalog(error);
+                let code = error_code(&error);
+                self.record_attempt(&call, None, None, outcome, Some(code), None, started);
+                return Err(error);
+            }
+        };
+        if !preflight.arguments_are_valid(&call.arguments) {
+            self.record_attempt(
+                &call,
+                Some(preflight.lookup().source_id.clone()),
+                Some(preflight.lookup().tool_id.clone()),
+                RequestOutcome::Failed,
+                Some("invalid_tool_arguments"),
+                None,
+                started,
+            );
+            return Err(ToolCallError::InvalidArguments);
+        }
+        let token = preflight.revisions().clone();
+        let lookup = preflight.lookup().clone();
+        if lookup.requires_approval {
+            let input_schema = preflight.input_schema().clone();
+            drop(preflight);
+            let oauth_bindings = self
+                .oauth
+                .bindings_for_source(&lookup.source_id)
+                .await
+                .map_err(oauth_tool_error)?;
+            let invocation_snapshot = json!({
+                "version": 1,
+                "requestId": call.request_id.clone(),
+                "actorKind": call.actor.kind(),
+                "actorId": call.actor.id(),
+                "actorApiTokenId": call.actor.api_token_id(),
+                "surface": call.surface,
+                "executionId": call.execution_id.clone(),
+                "callId": call.call_id.clone(),
+                "path": lookup.callable_path.clone(),
+                "sourceId": lookup.source_id.clone(),
+                "toolId": lookup.tool_id.clone(),
+                "oauthBindings": oauth_bindings,
+            });
+            let service = self.clone();
+            let (completed, result) = oneshot::channel();
+            let spawned = self.background_tasks.spawn(async move {
+                let pending = service
+                    .approvals
+                    .create(NewApproval {
+                        execution_id: call.execution_id.clone(),
+                        call_id: call.call_id.clone(),
+                        worker_generation: call.worker_generation,
+                        actor: call.actor.clone(),
+                        surface: call.surface,
+                        callable_path_snapshot: lookup.callable_path.clone(),
+                        source_display_name_snapshot: Some(lookup.source_display_name.clone()),
+                        tool_display_name_snapshot: Some(lookup.tool_display_name.clone()),
+                        mode_provenance: lookup.mode_provenance,
+                        revisions: token,
+                        arguments: call.arguments.clone(),
+                        input_schema,
+                        output_schema: None,
+                        invocation_snapshot,
+                    })
+                    .await;
+                let submission = pending.map(|pending| {
+                    let approval_id = pending.record.id.clone();
+                    service.record_attempt(
+                        &call,
+                        Some(lookup.source_id),
+                        Some(lookup.tool_id),
+                        RequestOutcome::PendingApproval,
+                        Some("approval_required"),
+                        Some(approval_id),
+                        started,
+                    );
+                    let delivery = pending.delivery_pin.then(|| ApprovalDeliveryTicket {
+                        identity: Some(ApprovalDeliveryIdentity {
+                            approval_id: pending.record.id.clone(),
+                            actor: call.actor.clone(),
+                            execution_id: call.execution_id.clone(),
+                            call_id: call.call_id.clone(),
+                        }),
+                        approvals: service.approvals.clone(),
+                        notifications: service.approval_notifications.clone(),
+                        tasks: service.background_tasks.clone(),
+                    });
+                    ToolCallSubmission::ApprovalRequired(ApprovalRequired {
+                        record: Box::new(pending.record),
+                        delivery,
+                    })
+                });
+                let _ = completed.send(submission.map_err(ToolCallError::from));
+            });
+            if !spawned {
+                return Err(ToolCallError::Adapter {
+                    code: ToolCallAdapterErrorCode::ApprovalPersistenceUnavailable,
+                    message: "approval persistence is shutting down".to_owned(),
+                });
+            }
+            return result.await.unwrap_or_else(|_| {
+                Err(ToolCallError::Adapter {
+                    code: ToolCallAdapterErrorCode::ApprovalPersistenceInterrupted,
+                    message: "approval persistence was interrupted".to_owned(),
+                })
+            });
+        }
+        drop(preflight);
+        let lease = self
+            .catalog
+            .revalidate_invocation(&token)
+            .await?
+            .ok_or(ToolCallError::Stale)?;
+        let effect = InvocationEffect::from_lease(&lease);
+        let prepared = match prepare_with_lease(&self.protocols, lease, &call.arguments, None).await
+        {
+            Ok(prepared) => prepared,
+            Err(error) => {
+                self.record_attempt(
+                    &call,
+                    Some(lookup.source_id),
+                    Some(lookup.tool_id),
+                    RequestOutcome::Failed,
+                    Some(error_code(&error)),
+                    None,
+                    started,
+                );
+                return Err(error);
+            }
+        };
+        let log_context = InvocationLogContext::new(
+            &call,
+            lookup.source_id.clone(),
+            lookup.tool_id.clone(),
+            started,
+        );
+        let mut durable_log_guard =
+            matches!(effect, InvocationEffect::MayHaveSideEffects).then(|| {
+                DurableInvocationLogGuard::new(
+                    log_context.clone(),
+                    self.request_logs.clone(),
+                    self.durable_tasks.clone(),
+                )
+            });
+        let result = execute_prepared(&self.protocols, prepared, effect).await;
+        match result {
+            Ok(result) => {
+                if let Some(guard) = durable_log_guard.as_mut() {
+                    guard.disarm();
+                }
+                self.record_attempt(
+                    &call,
+                    Some(lookup.source_id),
+                    Some(lookup.tool_id),
+                    if result.ok {
+                        RequestOutcome::Succeeded
+                    } else {
+                        RequestOutcome::Failed
+                    },
+                    completed_failure_code(&result),
+                    None,
+                    started,
+                );
+                Ok(ToolCallSubmission::Completed(result))
+            }
+            Err(failure) => {
+                let outcome_unknown = failure.outcome_unknown();
+                let stable_error_code = failure.stable_error_code();
+                if outcome_unknown {
+                    if let Some(guard) = durable_log_guard.as_mut() {
+                        guard.persist(stable_error_code).await;
+                    } else {
+                        persist_durable_request_log(
+                            &self.request_logs,
+                            log_context.failed(stable_error_code),
+                        )
+                        .await;
+                    }
+                } else if let Some(guard) = durable_log_guard.as_mut() {
+                    guard.disarm();
+                }
+                let error = failure.into_error();
+                if !outcome_unknown {
+                    self.record_attempt(
+                        &call,
+                        Some(lookup.source_id),
+                        Some(lookup.tool_id),
+                        RequestOutcome::Failed,
+                        Some(error_code(&error)),
+                        None,
+                        started,
+                    );
+                }
+                Err(error)
+            }
+        }
+    }
+
+    pub(crate) async fn submit_mcp_idempotent<C>(
+        &self,
+        mut call: ToolCall,
+        route: &str,
+        key: &str,
+        cancellation: C,
+    ) -> Result<McpIdempotentResponse, GatewayInvokeError>
+    where
+        C: Future<Output = ()> + Send,
+    {
+        if call.surface != RequestSurface::Mcp {
+            return Err(IdempotencyError::InvalidMetadata.into());
+        }
+        let actor_api_token_id = call
+            .actor
+            .api_token_id()
+            .ok_or(IdempotencyError::InvalidMetadata)?
+            .to_owned();
+        if !token_is_active(self.catalog.pool(), &actor_api_token_id)
+            .await
+            .map_err(ToolCallError::Approval)?
+        {
+            return Err(ToolCallError::Approval(ApprovalError::OwnerTokenInactive).into());
+        }
+        let encoded_arguments =
+            serde_json::to_vec(&call.arguments).map_err(|_| ToolCallError::InvalidArguments)?;
+        if encoded_arguments.len() > MAX_ARGUMENT_BYTES {
+            return Err(ToolCallError::ArgumentsTooLarge.into());
+        }
+        let request_path = idempotency::canonical_callable_path(&call.path)?;
+        tokio::pin!(cancellation);
+        let request = || IdempotencyRequest {
+            owner: IdempotencyOwner {
+                owner_api_token_id: &actor_api_token_id,
+            },
+            key,
+            route,
+            callable_path: &request_path,
+            arguments: &call.arguments,
+        };
+        if let Some(claim) = self.idempotency.lookup(request()).await?
+            && let Some(response) = self
+                .resolve_mcp_idempotency_claim(claim, &call, &request, cancellation.as_mut(), true)
+                .await?
+        {
+            return Ok(response);
+        }
+
+        let (preflight, record) = loop {
+            let preflight = self
+                .catalog
+                .preflight_invocation(&call.path)
+                .await
+                .map_err(ToolCallError::Catalog)?;
+            if !preflight.arguments_are_valid(&call.arguments) {
+                return Err(ToolCallError::InvalidArguments.into());
+            }
+            match self.idempotency.claim(request()).await? {
+                IdempotencyClaim::Fresh(record) => break (preflight, record),
+                existing => {
+                    drop(preflight);
+                    if let Some(response) = self
+                        .resolve_mcp_idempotency_claim(
+                            existing,
+                            &call,
+                            &request,
+                            cancellation.as_mut(),
+                            true,
+                        )
+                        .await?
+                    {
+                        return Ok(response);
+                    }
+                }
+            }
+        };
+        let token = preflight.revisions().clone();
+        let lookup = preflight.lookup().clone();
+        let mut reservation = IdempotencyReservationGuard::new(
+            record,
+            self.idempotency.clone(),
+            self.approvals.clone(),
+            self.background_tasks.clone(),
+        );
+        call.execution_id = idempotency_execution_id(&reservation.record.id);
+        call.call_id = "gateway".to_owned();
+
+        if lookup.requires_approval {
+            let input_schema = preflight.input_schema().clone();
+            drop(preflight);
+            let oauth_bindings = self
+                .oauth
+                .bindings_for_source(&lookup.source_id)
+                .await
+                .map_err(oauth_tool_error)?;
+            let invocation_snapshot = json!({
+                "version": 1,
+                "requestId": call.request_id.clone(),
+                "actorKind": call.actor.kind(),
+                "actorId": call.actor.id(),
+                "actorApiTokenId": call.actor.api_token_id(),
+                "surface": call.surface,
+                "executionId": call.execution_id.clone(),
+                "callId": call.call_id.clone(),
+                "path": lookup.callable_path.clone(),
+                "sourceId": lookup.source_id.clone(),
+                "toolId": lookup.tool_id.clone(),
+                "oauthBindings": oauth_bindings,
+            });
+            let pending = self
+                .approvals
+                .create(NewApproval {
+                    execution_id: call.execution_id.clone(),
+                    call_id: call.call_id.clone(),
+                    worker_generation: call.worker_generation,
+                    actor: call.actor.clone(),
+                    surface: call.surface,
+                    callable_path_snapshot: lookup.callable_path,
+                    source_display_name_snapshot: Some(lookup.source_display_name),
+                    tool_display_name_snapshot: Some(lookup.tool_display_name),
+                    mode_provenance: lookup.mode_provenance,
+                    revisions: token,
+                    arguments: call.arguments.clone(),
+                    input_schema,
+                    output_schema: None,
+                    invocation_snapshot,
+                })
+                .await
+                .map_err(ToolCallError::Approval)?;
+            let approval = ApprovalRequired {
+                delivery: pending.delivery_pin.then(|| ApprovalDeliveryTicket {
+                    identity: Some(ApprovalDeliveryIdentity {
+                        approval_id: pending.record.id.clone(),
+                        actor: call.actor.clone(),
+                        execution_id: call.execution_id.clone(),
+                        call_id: call.call_id.clone(),
+                    }),
+                    approvals: self.approvals.clone(),
+                    notifications: self.approval_notifications.clone(),
+                    tasks: self.background_tasks.clone(),
+                }),
+                record: Box::new(pending.record),
+            };
+            reservation.disarm();
+            return self
+                .finish_mcp_idempotent_approval(
+                    &reservation.record,
+                    &call,
+                    approval,
+                    cancellation.as_mut(),
+                    false,
+                )
+                .await;
+        }
+
+        drop(preflight);
+        let lease = match self
+            .catalog
+            .revalidate_invocation(&token)
+            .await
+            .map_err(ToolCallError::Catalog)?
+        {
+            Some(lease) => lease,
+            None => {
+                self.idempotency
+                    .release_reserved(&reservation.record.id)
+                    .await?;
+                reservation.disarm();
+                return Err(ToolCallError::Stale.into());
+            }
+        };
+        let effect = InvocationEffect::from_lease(&lease);
+        let prepared = match prepare_with_lease(&self.protocols, lease, &call.arguments, None).await
+        {
+            Ok(prepared) => prepared,
+            Err(error) => {
+                self.idempotency
+                    .release_reserved(&reservation.record.id)
+                    .await?;
+                reservation.disarm();
+                return Err(error.into());
+            }
+        };
+        self.idempotency
+            .mark_executing(&reservation.record.id)
+            .await?;
+        reservation.disarm();
+        let mut execution_guard = IdempotencyExecutionGuard::new(
+            reservation.record.id.clone(),
+            self.idempotency.clone(),
+            self.background_tasks.clone(),
+        );
+        #[cfg(test)]
+        execution_guard.set_cleanup_hook(
+            self.retryable_release_race_hook
+                .lock()
+                .unwrap_or_else(std::sync::PoisonError::into_inner)
+                .clone(),
+        );
+        let execution = execute_prepared(&self.protocols, prepared, effect);
+        tokio::pin!(execution);
+        let execution_result = tokio::select! {
+            result = &mut execution => result,
+            () = &mut cancellation => {
+                self.idempotency
+                    .mark_indeterminate(&reservation.record.id)
+                    .await?;
+                execution_guard.disarm();
+                return Err(GatewayInvokeError::Canceled);
+            }
+        };
+        let result = match execution_result {
+            Ok(result) => result,
+            Err(failure) => {
+                self.settle_idempotent_execution_error(
+                    &reservation.record,
+                    &mut execution_guard,
+                    &failure,
+                )
+                .await?;
+                let error = failure.into_error();
+                return Err(error.into());
+            }
+        };
+        let response = tool_result_response(&result)?;
+        if let Err(error) = self
+            .idempotency
+            .complete(
+                &reservation.record.id,
+                IdempotencyResponseKind::Tool,
+                &response,
+                None,
+            )
+            .await
+        {
+            match self
+                .idempotency
+                .mark_indeterminate(&reservation.record.id)
+                .await
+            {
+                Ok(_) | Err(IdempotencyError::InvalidTransition("completed" | "indeterminate")) => {
+                    execution_guard.disarm();
+                }
+                Err(mark_error) => {
+                    tracing::error!(
+                        idempotency_id = reservation.record.id,
+                        error = %mark_error,
+                        completion_error = %error,
+                        "post-dispatch MCP idempotency recovery will continue in the background"
+                    );
+                }
+            }
+            return Err(GatewayInvokeError::OutcomeUnknown);
+        }
+        execution_guard.disarm();
+        Ok(McpIdempotentResponse {
+            result,
+            replayed: false,
+        })
+    }
+
+    pub(crate) async fn submit_gateway_idempotent(
+        &self,
+        mut call: ToolCall,
+        key: &str,
+    ) -> Result<GatewayInvokeResponse, GatewayInvokeError> {
+        let started = Instant::now();
+        let actor_api_token_id = call
+            .actor
+            .api_token_id()
+            .ok_or(IdempotencyError::InvalidMetadata)?
+            .to_owned();
+        if call.surface != RequestSurface::Gateway {
+            return Err(IdempotencyError::InvalidMetadata.into());
+        }
+        if !token_is_active(self.catalog.pool(), &actor_api_token_id)
+            .await
+            .map_err(ToolCallError::Approval)?
+        {
+            self.record_attempt(
+                &call,
+                None,
+                None,
+                RequestOutcome::Denied,
+                Some("token_revoked"),
+                None,
+                started,
+            );
+            return Err(ToolCallError::Approval(ApprovalError::OwnerTokenInactive).into());
+        }
+        let encoded_arguments =
+            serde_json::to_vec(&call.arguments).map_err(|_| ToolCallError::InvalidArguments)?;
+        if encoded_arguments.len() > MAX_ARGUMENT_BYTES {
+            self.record_attempt(
+                &call,
+                None,
+                None,
+                RequestOutcome::Failed,
+                Some("arguments_too_large"),
+                None,
+                started,
+            );
+            return Err(ToolCallError::ArgumentsTooLarge.into());
+        }
+        let request_path = idempotency::canonical_callable_path(&call.path)?;
+        if let Some(existing) = self
+            .idempotency
+            .lookup(IdempotencyRequest {
+                owner: IdempotencyOwner {
+                    owner_api_token_id: &actor_api_token_id,
+                },
+                key,
+                route: GATEWAY_INVOKE_ROUTE,
+                callable_path: &request_path,
+                arguments: &call.arguments,
+            })
+            .await?
+        {
+            match existing {
+                IdempotencyClaim::Replay { response, .. } => {
+                    return Ok(GatewayInvokeResponse {
+                        response,
+                        replayed: true,
+                    });
+                }
+                IdempotencyClaim::Mismatch => return Err(GatewayInvokeError::KeyMismatch),
+                IdempotencyClaim::Indeterminate(_) => {
+                    return Err(GatewayInvokeError::OutcomeUnknown);
+                }
+                IdempotencyClaim::InProgress(record) => {
+                    if record.state == idempotency::IdempotencyState::Reserved
+                        && let Some(response) = self
+                            .reconcile_idempotent_approval(
+                                &record,
+                                &actor_api_token_id,
+                                key,
+                                &request_path,
+                                &call.arguments,
+                            )
+                            .await?
+                    {
+                        return Ok(response);
+                    }
+                    return Err(GatewayInvokeError::InProgress);
+                }
+                IdempotencyClaim::Fresh(_) => {
+                    return Err(GatewayInvokeError::Idempotency(
+                        "lookup returned a fresh idempotency claim".to_owned(),
+                    ));
+                }
+            }
+        }
+        let preflight = match self.catalog.preflight_invocation(&call.path).await {
+            Ok(preflight) => preflight,
+            Err(error) => {
+                let outcome = if matches!(error, CatalogError::ToolDisabled { .. }) {
+                    RequestOutcome::Denied
+                } else {
+                    RequestOutcome::Failed
+                };
+                let error = ToolCallError::Catalog(error);
+                let code = error_code(&error);
+                self.record_attempt(&call, None, None, outcome, Some(code), None, started);
+                return Err(error.into());
+            }
+        };
+        if !preflight.arguments_are_valid(&call.arguments) {
+            self.record_attempt(
+                &call,
+                Some(preflight.lookup().source_id.clone()),
+                Some(preflight.lookup().tool_id.clone()),
+                RequestOutcome::Failed,
+                Some("invalid_tool_arguments"),
+                None,
+                started,
+            );
+            return Err(ToolCallError::InvalidArguments.into());
+        }
+        let token = preflight.revisions().clone();
+        let lookup = preflight.lookup().clone();
+        let claim = self
+            .idempotency
+            .claim(IdempotencyRequest {
+                owner: IdempotencyOwner {
+                    owner_api_token_id: &actor_api_token_id,
+                },
+                key,
+                route: GATEWAY_INVOKE_ROUTE,
+                callable_path: &lookup.callable_path,
+                arguments: &call.arguments,
+            })
+            .await?;
+        let record = match claim {
+            IdempotencyClaim::Fresh(record) => record,
+            IdempotencyClaim::Replay { response, .. } => {
+                return Ok(GatewayInvokeResponse {
+                    response,
+                    replayed: true,
+                });
+            }
+            IdempotencyClaim::Mismatch => return Err(GatewayInvokeError::KeyMismatch),
+            IdempotencyClaim::Indeterminate(_) => {
+                return Err(GatewayInvokeError::OutcomeUnknown);
+            }
+            IdempotencyClaim::InProgress(record) => {
+                if record.state == idempotency::IdempotencyState::Reserved
+                    && let Some(response) = self
+                        .reconcile_idempotent_approval(
+                            &record,
+                            &actor_api_token_id,
+                            key,
+                            &lookup.callable_path,
+                            &call.arguments,
+                        )
+                        .await?
+                {
+                    return Ok(response);
+                }
+                return Err(GatewayInvokeError::InProgress);
+            }
+        };
+        let mut reservation = IdempotencyReservationGuard::new(
+            record,
+            self.idempotency.clone(),
+            self.approvals.clone(),
+            self.background_tasks.clone(),
+        );
+        call.execution_id = idempotency_execution_id(&reservation.record.id);
+        call.call_id = "gateway".to_owned();
+
+        if lookup.requires_approval {
+            let input_schema = preflight.input_schema().clone();
+            let oauth_bindings = self
+                .oauth
+                .bindings_for_source(&lookup.source_id)
+                .await
+                .map_err(oauth_tool_error)?;
+            let invocation_snapshot = json!({
+                "version": 1,
+                "requestId": call.request_id.clone(),
+                "actorKind": call.actor.kind(),
+                "actorId": call.actor.id(),
+                "actorApiTokenId": call.actor.api_token_id(),
+                "surface": call.surface,
+                "executionId": call.execution_id.clone(),
+                "callId": call.call_id.clone(),
+                "path": lookup.callable_path.clone(),
+                "sourceId": lookup.source_id.clone(),
+                "toolId": lookup.tool_id.clone(),
+                "oauthBindings": oauth_bindings,
+            });
+            let pending = match self
+                .approvals
+                .create(NewApproval {
+                    execution_id: call.execution_id.clone(),
+                    call_id: call.call_id.clone(),
+                    worker_generation: call.worker_generation,
+                    actor: call.actor.clone(),
+                    surface: call.surface,
+                    callable_path_snapshot: lookup.callable_path.clone(),
+                    source_display_name_snapshot: Some(lookup.source_display_name.clone()),
+                    tool_display_name_snapshot: Some(lookup.tool_display_name.clone()),
+                    mode_provenance: lookup.mode_provenance,
+                    revisions: token,
+                    arguments: call.arguments.clone(),
+                    input_schema,
+                    output_schema: None,
+                    invocation_snapshot,
+                })
+                .await
+            {
+                Ok(pending) => pending,
+                Err(error) => {
+                    let existing = self
+                        .idempotency
+                        .correlated_approval_id(&reservation.record)
+                        .await?;
+                    if existing.is_none() {
+                        self.idempotency
+                            .release_reserved(&reservation.record.id)
+                            .await?;
+                    }
+                    return Err(ToolCallError::Approval(error).into());
+                }
+            };
+            let approval_id = pending.record.id.clone();
+            let mut response = approval_required_response(&pending.record)?;
+            let mut ask_completion = IdempotencyAskCompletionGuard::new(
+                reservation.record.id.clone(),
+                approval_id.clone(),
+                response.clone(),
+                self.idempotency.clone(),
+                self.background_tasks.clone(),
+            );
+            reservation.disarm();
+            let replayed = match self
+                .idempotency
+                .complete(
+                    &reservation.record.id,
+                    IdempotencyResponseKind::Approval,
+                    &response,
+                    Some(&approval_id),
+                )
+                .await
+            {
+                Ok(_) => {
+                    ask_completion.disarm();
+                    false
+                }
+                Err(IdempotencyError::InvalidTransition("completed")) => {
+                    let replayed = match self
+                        .idempotency
+                        .claim(IdempotencyRequest {
+                            owner: IdempotencyOwner {
+                                owner_api_token_id: &actor_api_token_id,
+                            },
+                            key,
+                            route: GATEWAY_INVOKE_ROUTE,
+                            callable_path: &lookup.callable_path,
+                            arguments: &call.arguments,
+                        })
+                        .await?
+                    {
+                        IdempotencyClaim::Replay {
+                            response: replay_response,
+                            ..
+                        } => {
+                            response = replay_response;
+                            true
+                        }
+                        _ => return Err(GatewayInvokeError::InProgress),
+                    };
+                    ask_completion.disarm();
+                    replayed
+                }
+                Err(error) => {
+                    terminalize_idempotency(&self.idempotency, &reservation.record.id).await;
+                    ask_completion.disarm();
+                    return Err(error.into());
+                }
+            };
+            self.record_attempt(
+                &call,
+                Some(lookup.source_id),
+                Some(lookup.tool_id),
+                RequestOutcome::PendingApproval,
+                Some("approval_required"),
+                Some(approval_id),
+                started,
+            );
+            drop(preflight);
+            return Ok(GatewayInvokeResponse { response, replayed });
+        }
+
+        drop(preflight);
+        let lease = match self.catalog.revalidate_invocation(&token).await {
+            Ok(Some(lease)) => lease,
+            Ok(None) => {
+                self.idempotency
+                    .release_reserved(&reservation.record.id)
+                    .await?;
+                reservation.disarm();
+                return Err(ToolCallError::Stale.into());
+            }
+            Err(error) => {
+                self.idempotency
+                    .release_reserved(&reservation.record.id)
+                    .await?;
+                reservation.disarm();
+                return Err(ToolCallError::Catalog(error).into());
+            }
+        };
+        let effect = InvocationEffect::from_lease(&lease);
+        let prepared = match prepare_with_lease(&self.protocols, lease, &call.arguments, None).await
+        {
+            Ok(prepared) => prepared,
+            Err(error) => {
+                self.idempotency
+                    .release_reserved(&reservation.record.id)
+                    .await?;
+                reservation.disarm();
+                return Err(error.into());
+            }
+        };
+        self.idempotency
+            .mark_executing(&reservation.record.id)
+            .await?;
+        reservation.disarm();
+        let mut execution_guard = IdempotencyExecutionGuard::new(
+            reservation.record.id.clone(),
+            self.idempotency.clone(),
+            self.background_tasks.clone(),
+        );
+        #[cfg(test)]
+        execution_guard.set_cleanup_hook(
+            self.retryable_release_race_hook
+                .lock()
+                .unwrap_or_else(std::sync::PoisonError::into_inner)
+                .clone(),
+        );
+        let result = match execute_prepared(&self.protocols, prepared, effect).await {
+            Ok(result) => result,
+            Err(failure) => {
+                let outcome_unknown = failure.outcome_unknown();
+                let stable_error_code = failure.stable_error_code();
+                self.settle_idempotent_execution_error(
+                    &reservation.record,
+                    &mut execution_guard,
+                    &failure,
+                )
+                .await?;
+                let error = failure.into_error();
+                if outcome_unknown {
+                    persist_durable_request_log(
+                        &self.request_logs,
+                        InvocationLogContext::new(&call, lookup.source_id, lookup.tool_id, started)
+                            .failed(stable_error_code),
+                    )
+                    .await;
+                } else {
+                    self.record_attempt(
+                        &call,
+                        Some(lookup.source_id),
+                        Some(lookup.tool_id),
+                        RequestOutcome::Failed,
+                        Some(error_code(&error)),
+                        None,
+                        started,
+                    );
+                }
+                return Err(error.into());
+            }
+        };
+        let response = tool_result_response(&result)?;
+        if let Err(error) = self
+            .idempotency
+            .complete(
+                &reservation.record.id,
+                IdempotencyResponseKind::Tool,
+                &response,
+                None,
+            )
+            .await
+        {
+            match self
+                .idempotency
+                .mark_indeterminate(&reservation.record.id)
+                .await
+            {
+                Ok(_) | Err(IdempotencyError::InvalidTransition("completed" | "indeterminate")) => {
+                    execution_guard.disarm();
+                }
+                Err(mark_error) => {
+                    tracing::error!(
+                        idempotency_id = reservation.record.id,
+                        error = %mark_error,
+                        completion_error = %error,
+                        "post-dispatch idempotency recovery will continue in the background"
+                    );
+                }
+            }
+            persist_durable_request_log(
+                &self.request_logs,
+                InvocationLogContext::new(&call, lookup.source_id, lookup.tool_id, started)
+                    .failed(ToolCallAdapterErrorCode::InvocationOutcomeUnknown.as_str()),
+            )
+            .await;
+            return Err(GatewayInvokeError::OutcomeUnknown);
+        }
+        execution_guard.disarm();
+        self.record_attempt(
+            &call,
+            Some(lookup.source_id),
+            Some(lookup.tool_id),
+            if result.ok {
+                RequestOutcome::Succeeded
+            } else {
+                RequestOutcome::Failed
+            },
+            completed_failure_code(&result),
+            None,
+            started,
+        );
+        Ok(GatewayInvokeResponse {
+            response,
+            replayed: false,
+        })
+    }
+
+    async fn settle_idempotent_execution_error(
+        &self,
+        record: &IdempotencyRecord,
+        execution_guard: &mut IdempotencyExecutionGuard,
+        failure: &InvocationExecutionError,
+    ) -> Result<(), GatewayInvokeError> {
+        if failure.outcome_unknown() {
+            match self.idempotency.mark_indeterminate(&record.id).await {
+                Ok(_) | Err(IdempotencyError::InvalidTransition("indeterminate")) => {
+                    execution_guard.disarm();
+                }
+                Err(idempotency_error) => {
+                    tracing::error!(
+                        idempotency_id = record.id,
+                        error = %idempotency_error,
+                        "uncertain invocation terminalization will continue in the background"
+                    );
+                }
+            }
+        } else {
+            self.idempotency.release_retryable_execution(record).await?;
+            #[cfg(test)]
+            let retryable_release_race_hook = self
+                .retryable_release_race_hook
+                .lock()
+                .unwrap_or_else(std::sync::PoisonError::into_inner)
+                .clone();
+            #[cfg(test)]
+            if let Some(hook) = retryable_release_race_hook {
+                hook.released.notify_one();
+                hook.continue_settlement.notified().await;
+            }
+            execution_guard.disarm();
+        }
+        Ok(())
+    }
+
+    async fn resolve_mcp_idempotency_claim<'a, C, F>(
+        &self,
+        mut claim: IdempotencyClaim,
+        call: &ToolCall,
+        request: &F,
+        mut cancellation: Pin<&mut C>,
+        replayed: bool,
+    ) -> Result<Option<McpIdempotentResponse>, GatewayInvokeError>
+    where
+        C: Future<Output = ()> + Send,
+        F: Fn() -> IdempotencyRequest<'a>,
+    {
+        let mut delay = Duration::from_millis(10);
+        loop {
+            match claim {
+                IdempotencyClaim::Fresh(_) => return Ok(None),
+                IdempotencyClaim::Mismatch => return Err(GatewayInvokeError::KeyMismatch),
+                IdempotencyClaim::Indeterminate(_) => {
+                    return Err(GatewayInvokeError::OutcomeUnknown);
+                }
+                IdempotencyClaim::Replay { record, response } => {
+                    if record.response_kind == Some(IdempotencyResponseKind::Tool) {
+                        return Ok(Some(McpIdempotentResponse {
+                            result: tool_result_from_response(&response)?,
+                            replayed,
+                        }));
+                    }
+                    let approval = self.idempotent_approval(&record, call).await?;
+                    return self
+                        .finish_mcp_idempotent_approval(
+                            &record,
+                            call,
+                            approval,
+                            cancellation,
+                            replayed,
+                        )
+                        .await
+                        .map(Some);
+                }
+                IdempotencyClaim::InProgress(record) => {
+                    if record.state == idempotency::IdempotencyState::Reserved
+                        && let Some(CorrelatedApproval::Live(_)) =
+                            self.idempotency.correlated_approval_id(&record).await?
+                    {
+                        let approval = self.idempotent_approval(&record, call).await?;
+                        return self
+                            .finish_mcp_idempotent_approval(
+                                &record,
+                                call,
+                                approval,
+                                cancellation,
+                                replayed,
+                            )
+                            .await
+                            .map(Some);
+                    }
+                }
+            }
+            tokio::select! {
+                () = &mut cancellation => return Err(GatewayInvokeError::Canceled),
+                () = tokio::time::sleep(delay) => {}
+            }
+            delay = (delay * 2).min(Duration::from_millis(250));
+            let Some(next_claim) = self.idempotency.lookup(request()).await? else {
+                return Ok(None);
+            };
+            claim = next_claim;
+        }
+    }
+
+    async fn idempotent_approval(
+        &self,
+        record: &IdempotencyRecord,
+        call: &ToolCall,
+    ) -> Result<ApprovalRequired, GatewayInvokeError> {
+        let approval_id = match self.idempotency.correlated_approval_id(record).await? {
+            Some(CorrelatedApproval::Live(approval_id)) => approval_id,
+            Some(CorrelatedApproval::Retired) | None => {
+                return Err(GatewayInvokeError::OutcomeUnknown);
+            }
+        };
+        let detail = self
+            .approvals
+            .get_for_actor(&approval_id, &call.actor)
+            .await
+            .map_err(ToolCallError::Approval)?
+            .ok_or(GatewayInvokeError::OutcomeUnknown)?;
+        if detail.record.execution_id != idempotency_execution_id(&record.id)
+            || detail.record.call_id != "gateway"
+            || detail.record.surface != RequestSurface::Mcp
+        {
+            return Err(GatewayInvokeError::OutcomeUnknown);
+        }
+        Ok(ApprovalRequired {
+            record: Box::new(detail.record),
+            delivery: None,
+        })
+    }
+
+    async fn finish_mcp_idempotent_approval<C>(
+        &self,
+        record: &IdempotencyRecord,
+        call: &ToolCall,
+        approval: ApprovalRequired,
+        cancellation: Pin<&mut C>,
+        replayed: bool,
+    ) -> Result<McpIdempotentResponse, GatewayInvokeError>
+    where
+        C: Future<Output = ()> + Send,
+    {
+        let mut settlement_guard =
+            McpApprovalSettlementGuard::new(self.clone(), record.clone(), call.actor.clone());
+        let approval_id = approval.id.clone();
+        let approval_execution_id = approval.execution_id.clone();
+        let idempotency_execution_id = idempotency_execution_id(&record.id);
+        let approval_wait = self.wait_for_approval(
+            approval,
+            &call.actor,
+            &idempotency_execution_id,
+            "gateway",
+            cancellation,
+        );
+        let idempotency_failure = self.wait_for_mcp_indeterminate(&record.id);
+        tokio::pin!(approval_wait);
+        tokio::pin!(idempotency_failure);
+        let approval_result = tokio::select! {
+            detail = &mut approval_wait => detail,
+            result = &mut idempotency_failure => {
+                result?;
+                return Err(GatewayInvokeError::OutcomeUnknown);
+            }
+        };
+        let detail = match approval_result {
+            Ok(detail) => detail,
+            Err(ApprovalWaitError::Approval(error)) => {
+                return Err(GatewayInvokeError::ToolCall(ToolCallError::Approval(error)));
+            }
+            Err(ApprovalWaitError::Canceled) => {
+                self.cancel_mcp_approval_execution(&approval_execution_id)
+                    .await
+                    .map_err(ToolCallError::Approval)?;
+                self.notify_approval(&approval_id);
+                if let Some(detail) = self
+                    .approvals
+                    .get_for_actor(&approval_id, &call.actor)
+                    .await
+                    .map_err(ToolCallError::Approval)?
+                {
+                    if detail.record.status.is_terminal() {
+                        let result = terminal_approval_result(detail.record.status, detail.result)?;
+                        self.complete_mcp_approval_result(record, &result).await?;
+                        settlement_guard.disarm();
+                    } else if detail.record.status == ApprovalStatus::Executing {
+                        match self.idempotency.mark_indeterminate(&record.id).await {
+                            Ok(_) | Err(IdempotencyError::InvalidTransition("indeterminate")) => {}
+                            Err(IdempotencyError::InvalidTransition("completed")) => {}
+                            Err(error) => return Err(error.into()),
+                        }
+                        settlement_guard.disarm();
+                    }
+                }
+                return Err(GatewayInvokeError::Canceled);
+            }
+        };
+        let result = terminal_approval_result(detail.record.status, detail.result)?;
+        self.complete_mcp_approval_result(record, &result).await?;
+        settlement_guard.disarm();
+        Ok(McpIdempotentResponse { result, replayed })
+    }
+
+    async fn wait_for_mcp_indeterminate(&self, id: &str) -> Result<(), GatewayInvokeError> {
+        loop {
+            match self.idempotency.state(id).await? {
+                Some(idempotency::IdempotencyState::Indeterminate) => return Ok(()),
+                Some(
+                    idempotency::IdempotencyState::Reserved
+                    | idempotency::IdempotencyState::Executing
+                    | idempotency::IdempotencyState::Completed,
+                ) => {}
+                None => return Err(GatewayInvokeError::OutcomeUnknown),
+            }
+            tokio::time::sleep(Duration::from_millis(25)).await;
+        }
+    }
+
+    async fn complete_mcp_approval_result(
+        &self,
+        record: &IdempotencyRecord,
+        result: &ToolResult,
+    ) -> Result<(), GatewayInvokeError> {
+        if !matches!(
+            record.state,
+            idempotency::IdempotencyState::Reserved | idempotency::IdempotencyState::Executing
+        ) {
+            return Ok(());
+        }
+        let response = tool_result_response(result)?;
+        match self
+            .idempotency
+            .complete(&record.id, IdempotencyResponseKind::Tool, &response, None)
+            .await
+        {
+            Ok(_) | Err(IdempotencyError::InvalidTransition("completed")) => Ok(()),
+            Err(IdempotencyError::InvalidTransition("indeterminate")) => {
+                Err(GatewayInvokeError::OutcomeUnknown)
+            }
+            Err(error) => {
+                tracing::error!(
+                    idempotency_id = record.id,
+                    error = %error,
+                    "post-dispatch approval response persistence is indeterminate"
+                );
+                Err(GatewayInvokeError::OutcomeUnknown)
+            }
+        }
+    }
+
+    fn spawn_mcp_idempotency_settlement(&self, record: IdempotencyRecord, actor: ToolActor) {
+        if !self
+            .in_flight_mcp_settlements
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+            .insert(record.id.clone())
+        {
+            return;
+        }
+        let service = self.clone();
+        let settlement_id = record.id.clone();
+        let spawned = self.background_tasks.spawn(async move {
+            let call = ToolCall {
+                request_id: format!("mcp-idempotency-settlement:{}", record.id),
+                actor,
+                surface: RequestSurface::Mcp,
+                execution_id: idempotency_execution_id(&record.id),
+                call_id: "gateway".to_owned(),
+                worker_generation: 0,
+                path: "executor.settlement".to_owned(),
+                arguments: Value::Null,
+            };
+            let result = async {
+                let approval = service.idempotent_approval(&record, &call).await?;
+                let cancellation = std::future::pending::<()>();
+                tokio::pin!(cancellation);
+                service
+                    .finish_mcp_idempotent_approval(
+                        &record,
+                        &call,
+                        approval,
+                        cancellation.as_mut(),
+                        false,
+                    )
+                    .await
+            }
+            .await;
+            if let Err(error) = result {
+                tracing::warn!(
+                    idempotency_id = record.id,
+                    error = %error,
+                    "MCP approval idempotency settlement stopped"
+                );
+            }
+            service
+                .in_flight_mcp_settlements
+                .lock()
+                .unwrap_or_else(std::sync::PoisonError::into_inner)
+                .remove(&record.id);
+        });
+        if !spawned {
+            self.in_flight_mcp_settlements
+                .lock()
+                .unwrap_or_else(std::sync::PoisonError::into_inner)
+                .remove(&settlement_id);
+        }
+    }
+
+    async fn reconcile_idempotent_approval(
+        &self,
+        record: &IdempotencyRecord,
+        actor_api_token_id: &str,
+        key: &str,
+        callable_path: &str,
+        arguments: &Value,
+    ) -> Result<Option<GatewayInvokeResponse>, GatewayInvokeError> {
+        let approval_id = match self.idempotency.correlated_approval_id(record).await? {
+            Some(CorrelatedApproval::Live(approval_id)) => approval_id,
+            Some(CorrelatedApproval::Retired) => {
+                self.idempotency.mark_indeterminate(&record.id).await?;
+                return Err(GatewayInvokeError::OutcomeUnknown);
+            }
+            None => return Ok(None),
+        };
+        let Some(approval) = self
+            .approvals
+            .get_admin(&approval_id)
+            .await
+            .map_err(ToolCallError::Approval)?
+        else {
+            terminalize_idempotency(&self.idempotency, &record.id).await;
+            return Err(GatewayInvokeError::OutcomeUnknown);
+        };
+        let response = match approval_required_response(&approval.record) {
+            Ok(response) => response,
+            Err(_) => {
+                terminalize_idempotency(&self.idempotency, &record.id).await;
+                return Err(GatewayInvokeError::OutcomeUnknown);
+            }
+        };
+        match self
+            .idempotency
+            .complete(
+                &record.id,
+                IdempotencyResponseKind::Approval,
+                &response,
+                Some(&approval_id),
+            )
+            .await
+        {
+            Ok(_) => Ok(Some(GatewayInvokeResponse {
+                response,
+                replayed: true,
+            })),
+            Err(IdempotencyError::InvalidTransition("completed")) => {
+                match self
+                    .idempotency
+                    .claim(IdempotencyRequest {
+                        owner: IdempotencyOwner {
+                            owner_api_token_id: actor_api_token_id,
+                        },
+                        key,
+                        route: GATEWAY_INVOKE_ROUTE,
+                        callable_path,
+                        arguments,
+                    })
+                    .await?
+                {
+                    IdempotencyClaim::Replay { response, .. } => Ok(Some(GatewayInvokeResponse {
+                        response,
+                        replayed: true,
+                    })),
+                    _ => Err(GatewayInvokeError::InProgress),
+                }
+            }
+            Err(_) => {
+                terminalize_idempotency(&self.idempotency, &record.id).await;
+                Err(GatewayInvokeError::OutcomeUnknown)
+            }
+        }
+    }
+
+    pub async fn discover_search(
+        &self,
+        call: &ToolCall,
+        query: String,
+        namespace: Option<String>,
+        limit: u32,
+        offset: u32,
+    ) -> Result<crate::catalog::DiscoveryPage, ToolDiscoveryError> {
+        let started = Instant::now();
+        let permit = match self.discovery_slots.clone().try_acquire_owned() {
+            Ok(permit) => permit,
+            Err(_) => {
+                self.record_attempt(
+                    call,
+                    None,
+                    None,
+                    RequestOutcome::Failed,
+                    Some("search_busy"),
+                    None,
+                    started,
+                );
+                return Err(ToolDiscoveryError::Busy);
+            }
+        };
+        let catalog = self.catalog.clone();
+        let result = tokio::spawn(async move {
+            let result = catalog
+                .search_tools(&query, namespace.as_deref(), limit, offset)
+                .await;
+            drop(permit);
+            result
+        })
+        .await
+        .map_err(|_| ToolDiscoveryError::Interrupted)?;
+        self.record_discovery_result(call, started, &result);
+        result.map_err(ToolDiscoveryError::Catalog)
+    }
+
+    pub async fn discover_describe(
+        &self,
+        call: &ToolCall,
+        path: &str,
+    ) -> Result<crate::catalog::DescribedTool, ToolDiscoveryError> {
+        let started = Instant::now();
+        let result = self.catalog.describe_tool(path).await;
+        self.record_discovery_result(call, started, &result);
+        result.map_err(ToolDiscoveryError::Catalog)
+    }
+
+    pub async fn discover_sources(&self, call: &ToolCall) -> Result<Value, ToolDiscoveryError> {
+        let started = Instant::now();
+        let _permit = match self.discovery_slots.clone().try_acquire_owned() {
+            Ok(permit) => permit,
+            Err(_) => {
+                self.record_attempt(
+                    call,
+                    None,
+                    None,
+                    RequestOutcome::Failed,
+                    Some("search_busy"),
+                    None,
+                    started,
+                );
+                return Err(ToolDiscoveryError::Busy);
+            }
+        };
+        let sources = self.catalog.list_sources().await;
+        let sources = match sources {
+            Ok(sources) => sources,
+            Err(error) => {
+                self.record_attempt(
+                    call,
+                    None,
+                    None,
+                    RequestOutcome::Failed,
+                    Some(catalog_error_code(&error)),
+                    None,
+                    started,
+                );
+                return Err(ToolDiscoveryError::Catalog(error));
+            }
+        };
+        let mut visible = Vec::new();
+        for source in sources {
+            let mut tool_count = 0usize;
+            for mode in [ToolMode::Enabled, ToolMode::Ask] {
+                let tools = match self
+                    .catalog
+                    .list_tools(ListToolsFilter {
+                        source_id: Some(source.id.clone()),
+                        effective_mode: Some(mode),
+                        limit: 1,
+                        ..Default::default()
+                    })
+                    .await
+                {
+                    Ok(tools) => tools,
+                    Err(error) => {
+                        self.record_attempt(
+                            call,
+                            None,
+                            None,
+                            RequestOutcome::Failed,
+                            Some(catalog_error_code(&error)),
+                            None,
+                            started,
+                        );
+                        return Err(ToolDiscoveryError::Catalog(error));
+                    }
+                };
+                tool_count = tool_count.saturating_add(tools.total);
+            }
+            if tool_count == 0 {
+                continue;
+            }
+            visible.push(json!({
+                "id": source.id,
+                "kind": source.kind,
+                "slug": source.slug,
+                "displayName": source.display_name,
+                "description": source.description,
+                "toolCount": tool_count,
+            }));
+        }
+        self.record_attempt(
+            call,
+            None,
+            None,
+            RequestOutcome::Succeeded,
+            None,
+            None,
+            started,
+        );
+        Ok(Value::Array(visible))
+    }
+
+    fn record_discovery_result<T>(
+        &self,
+        call: &ToolCall,
+        started: Instant,
+        result: &Result<T, CatalogError>,
+    ) {
+        let (outcome, code) = match result {
+            Ok(_) => (RequestOutcome::Succeeded, None),
+            Err(CatalogError::ToolDisabled { .. }) => {
+                (RequestOutcome::Denied, Some("tool_disabled"))
+            }
+            Err(error) => (RequestOutcome::Failed, Some(catalog_error_code(error))),
+        };
+        self.record_attempt(call, None, None, outcome, code, None, started);
+    }
+
+    pub async fn decide(
+        &self,
+        approval_id: &str,
+        request_id: &str,
+        expected_revision: i64,
+        decision: ApprovalDecision,
+        admin_id: i64,
+    ) -> Result<ApprovalAdminDetail, ApprovalError> {
+        let cancellation_guard = if decision == ApprovalDecision::Approve
+            && let Some(detail) = self.approvals.get_admin(approval_id).await?
+        {
+            let guard = self.deferred_execution_cancellations.read().await;
+            if guard.contains(&detail.record.execution_id)
+                || self.execution_is_stopping(&detail.record.execution_id)
+            {
+                drop(guard);
+                self.cancel_execution(&detail.record.execution_id).await?;
+                return Err(ApprovalError::InvalidTransition {
+                    status: crate::approval::ApprovalStatus::Canceled,
+                });
+            }
+            Some(guard)
+        } else {
+            None
+        };
+        #[cfg(test)]
+        let race_hook = {
+            self.approval_cancellation_race_hook
+                .lock()
+                .unwrap_or_else(std::sync::PoisonError::into_inner)
+                .clone()
+        };
+        #[cfg(test)]
+        if cancellation_guard.is_some()
+            && let Some(hook) = race_hook
+        {
+            hook.decision_read_acquired.notify_one();
+            hook.release_decision.notified().await;
+        }
+        let result = self
+            .approvals
+            .decide(
+                approval_id,
+                request_id,
+                expected_revision,
+                decision,
+                admin_id,
+            )
+            .await;
+        drop(cancellation_guard);
+        let result = result?;
+        if result.record.status.is_terminal() {
+            self.schedule_approval_log_flush_if_pending().await?;
+        }
+        if result.record.status == crate::approval::ApprovalStatus::Approved && !result.idempotent {
+            self.spawn_approved(result.record.id.clone());
+        }
+        self.notify_approval(approval_id);
+        self.approvals
+            .get_admin(approval_id)
+            .await?
+            .ok_or(ApprovalError::NotFound)
+    }
+
+    pub async fn cancel_execution(&self, execution_id: &str) -> Result<u64, ApprovalError> {
+        #[cfg(test)]
+        let cancel_hook = {
+            self.cancel_execution_hook
+                .lock()
+                .unwrap_or_else(std::sync::PoisonError::into_inner)
+                .clone()
+        };
+        #[cfg(test)]
+        if let Some(hook) = cancel_hook {
+            if hook
+                .failures
+                .fetch_update(Ordering::SeqCst, Ordering::SeqCst, |remaining| {
+                    remaining.checked_sub(1)
+                })
+                .is_ok()
+            {
+                hook.block_retries.store(true, Ordering::SeqCst);
+                return Err(ApprovalError::Database(sqlx::Error::Protocol(
+                    "forced cancellation persistence failure".to_owned(),
+                )));
+            }
+            if hook.block_retries.load(Ordering::SeqCst) {
+                let release = hook.release_retries.notified();
+                tokio::pin!(release);
+                release.as_mut().enable();
+                hook.retry_waiters.fetch_add(1, Ordering::SeqCst);
+                hook.retry_waiting.notify_one();
+                release.await;
+            }
+        }
+        let affected = self.approvals.cancel_execution(execution_id).await?;
+        if affected > 0 {
+            self.schedule_approval_log_flush();
+            self.global_approval_notify.notify_waiters();
+        }
+        Ok(affected)
+    }
+
+    async fn cancel_mcp_approval_execution(
+        &self,
+        execution_id: &str,
+    ) -> Result<u64, ApprovalError> {
+        #[cfg(test)]
+        if let Some(hook) = self
+            .approval_cancellation_race_hook
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+            .clone()
+        {
+            hook.cancellation_write_queued.notify_one();
+        }
+        let mut fence = self.deferred_execution_cancellations.write().await;
+        let stopping = self.execution_stopping_flag(execution_id);
+        stopping.store(true, Ordering::Release);
+        fence.insert(execution_id.to_owned());
+        let result = self.cancel_execution(execution_id).await;
+        if result.is_ok() {
+            fence.remove(execution_id);
+            self.clear_execution_stopping_flag(execution_id);
+        } else {
+            drop(fence);
+            self.defer_execution_cancellation(execution_id);
+        }
+        result
+    }
+
+    pub(crate) async fn mark_execution_lost(&self, execution_id: &str) {
+        #[cfg(test)]
+        let recovery_race_hook = {
+            self.execution_cancellation_recovery_race_hook
+                .lock()
+                .unwrap_or_else(std::sync::PoisonError::into_inner)
+                .clone()
+        };
+        #[cfg(test)]
+        if let Some(hook) = recovery_race_hook {
+            hook.new_mark_write_queued.notify_one();
+        }
+        let mut fence = self.deferred_execution_cancellations.write().await;
+        self.execution_stopping_flag(execution_id)
+            .store(true, Ordering::Release);
+        fence.insert(execution_id.to_owned());
+    }
+
+    pub(crate) async fn cancel_lost_execution(&self, execution_id: &str) {
+        self.mark_execution_lost(execution_id).await;
+        if !self
+            .in_flight_execution_cancellations
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+            .insert(execution_id.to_owned())
+        {
+            return;
+        }
+        let mut retry_delay = Duration::from_millis(50);
+        for attempt in 0..3 {
+            match self.cancel_execution(execution_id).await {
+                Ok(_) => {
+                    self.finish_execution_cancellation_recovery(execution_id)
+                        .await;
+                    return;
+                }
+                Err(error) => {
+                    tracing::warn!(
+                        execution_id,
+                        error = %error,
+                        "execution approval cleanup failed"
+                    );
+                    if attempt < 2 {
+                        tokio::time::sleep(retry_delay).await;
+                        retry_delay = (retry_delay * 2).min(Duration::from_secs(5));
+                    }
+                }
+            }
+        }
+        self.spawn_deferred_execution_cancellation(execution_id.to_owned());
+    }
+
+    fn defer_execution_cancellation(&self, execution_id: &str) {
+        if !self
+            .in_flight_execution_cancellations
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+            .insert(execution_id.to_owned())
+        {
+            return;
+        }
+        self.spawn_deferred_execution_cancellation(execution_id.to_owned());
+    }
+
+    fn spawn_deferred_execution_cancellation(&self, deferred_execution_id: String) {
+        let service = self.clone();
+        let recovery_execution_id = deferred_execution_id.clone();
+        if !self.background_tasks.spawn(async move {
+            let mut retry_delay = Duration::from_millis(100);
+            loop {
+                if !service
+                    .execution_cancellation_is_deferred(&deferred_execution_id)
+                    .await
+                {
+                    return;
+                }
+                match service.cancel_execution(&deferred_execution_id).await {
+                    Ok(_) => {
+                        service
+                            .finish_execution_cancellation_recovery(&deferred_execution_id)
+                            .await;
+                        return;
+                    }
+                    Err(error) => {
+                        tracing::warn!(
+                            execution_id = deferred_execution_id,
+                            error = %error,
+                            "deferred execution approval cleanup failed"
+                        );
+                        tokio::time::sleep(retry_delay).await;
+                        retry_delay = (retry_delay * 2).min(Duration::from_secs(5));
+                    }
+                }
+            }
+        }) {
+            self.in_flight_execution_cancellations
+                .lock()
+                .unwrap_or_else(std::sync::PoisonError::into_inner)
+                .remove(&recovery_execution_id);
+            tracing::warn!(
+                execution_id = recovery_execution_id,
+                "execution cleanup deferred until startup recovery"
+            );
+        }
+    }
+
+    async fn execution_cancellation_is_deferred(&self, execution_id: &str) -> bool {
+        let deferred = self.deferred_execution_cancellations.write().await;
+        if deferred.contains(execution_id) {
+            true
+        } else {
+            self.in_flight_execution_cancellations
+                .lock()
+                .unwrap_or_else(std::sync::PoisonError::into_inner)
+                .remove(execution_id);
+            false
+        }
+    }
+
+    async fn finish_execution_cancellation_recovery(&self, execution_id: &str) {
+        let mut deferred = self.deferred_execution_cancellations.write().await;
+        #[cfg(test)]
+        let recovery_race_hook = {
+            self.execution_cancellation_recovery_race_hook
+                .lock()
+                .unwrap_or_else(std::sync::PoisonError::into_inner)
+                .clone()
+        };
+        #[cfg(test)]
+        if let Some(hook) = recovery_race_hook {
+            hook.old_finish_write_acquired.wait();
+            hook.release_old_finish.wait();
+        }
+        deferred.remove(execution_id);
+        self.clear_execution_stopping_flag(execution_id);
+        self.in_flight_execution_cancellations
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+            .remove(execution_id);
+    }
+
+    pub(crate) fn execution_stopping_flag(&self, execution_id: &str) -> Arc<AtomicBool> {
+        self.execution_stopping_flags
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+            .entry(execution_id.to_owned())
+            .or_insert_with(|| Arc::new(AtomicBool::new(false)))
+            .clone()
+    }
+
+    fn execution_is_stopping(&self, execution_id: &str) -> bool {
+        self.execution_stopping_flags
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+            .get(execution_id)
+            .is_some_and(|stopping| stopping.load(Ordering::Acquire))
+    }
+
+    pub(crate) fn clear_execution_stopping_flag(&self, execution_id: &str) {
+        self.execution_stopping_flags
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+            .remove(execution_id);
+    }
+
+    pub async fn expire_approvals(&self) -> Result<u64, ApprovalError> {
+        let affected = self.approvals.expire_pending().await?;
+        if affected > 0 {
+            self.schedule_approval_log_flush();
+            self.global_approval_notify.notify_waiters();
+        }
+        Ok(affected)
+    }
+
+    pub async fn revoke_owner_token(
+        &self,
+        actor_api_token_id: &str,
+    ) -> Result<bool, ApprovalError> {
+        let revoked = self
+            .approvals
+            .revoke_owner_token(actor_api_token_id)
+            .await?;
+        if revoked {
+            self.schedule_approval_log_flush();
+            self.global_approval_notify.notify_waiters();
+        }
+        Ok(revoked)
+    }
+
+    pub async fn cancel_approval(
+        &self,
+        approval_id: &str,
+        actor_api_token_id: &str,
+        expected_revision: i64,
+    ) -> Result<ApprovalRecord, ApprovalError> {
+        let record = self
+            .approvals
+            .cancel_token_owner(approval_id, actor_api_token_id, expected_revision)
+            .await?;
+        self.schedule_approval_log_flush();
+        self.notify_approval(approval_id);
+        Ok(record)
+    }
+
+    pub async fn wait_for_approval<C>(
+        &self,
+        mut approval: ApprovalRequired,
+        actor: &ToolActor,
+        execution_id: &str,
+        call_id: &str,
+        cancellation: C,
+    ) -> Result<ApprovalOwnerDetail, ApprovalWaitError>
+    where
+        C: Future<Output = ()> + Send,
+    {
+        let approval_id = approval.id.clone();
+        if approval.actor_kind != actor.kind()
+            || approval.actor_id != actor.id()
+            || approval.execution_id != execution_id
+            || approval.call_id != call_id
+        {
+            return Err(ApprovalError::NotFound.into());
+        }
+        tokio::pin!(cancellation);
+        let registration = self.register_approval_wait(&approval_id);
+        loop {
+            let targeted_notification = registration.notify.notified();
+            tokio::pin!(targeted_notification);
+            targeted_notification.as_mut().enable();
+            let global_notification = self.global_approval_notify.notified();
+            tokio::pin!(global_notification);
+            global_notification.as_mut().enable();
+            let detail = self
+                .approvals
+                .get_for_actor(&approval_id, actor)
+                .await?
+                .ok_or(ApprovalError::NotFound)?;
+            if detail.record.execution_id != execution_id || detail.record.call_id != call_id {
+                return Err(ApprovalError::NotFound.into());
+            }
+            if detail.record.status.is_terminal() {
+                if let Some(delivery) = approval.delivery.as_mut() {
+                    delivery.release().await;
+                }
+                return Ok(detail);
+            }
+            let now = crate::unix_timestamp();
+            let until_expiry = u64::try_from(detail.record.expires_at.saturating_sub(now))
+                .unwrap_or(0)
+                .clamp(1, 30);
+            tokio::select! {
+                () = &mut cancellation => {
+                    if let Some(delivery) = approval.delivery.as_mut() {
+                        delivery.release().await;
+                    }
+                    return Err(ApprovalWaitError::Canceled);
+                },
+                () = &mut targeted_notification => {}
+                () = &mut global_notification => {}
+                () = tokio::time::sleep(Duration::from_secs(until_expiry)) => {
+                    let should_scan = {
+                        let now = Instant::now();
+                        let mut next_scan = self
+                            .next_expiry_scan
+                            .lock()
+                            .unwrap_or_else(std::sync::PoisonError::into_inner);
+                        if now >= *next_scan {
+                            *next_scan = now + Duration::from_secs(30);
+                            true
+                        } else {
+                            false
+                        }
+                    };
+                    if should_scan
+                        && let Ok(_permit) = self.expiry_slot.clone().try_acquire_owned()
+                    {
+                        self.expire_approvals().await?;
+                    }
+                }
+            }
+        }
+    }
+
+    fn spawn_approved(&self, approval_id: String) {
+        if !self
+            .in_flight_approvals
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+            .insert(approval_id.clone())
+        {
+            return;
+        }
+        let worker_service = self.clone();
+        let worker_approval_id = approval_id.clone();
+        let (worker_completed, worker_result) = oneshot::channel();
+        let worker = async move {
+            let Ok(_permit) = worker_service.execution_slots.clone().acquire_owned().await else {
+                let _ = worker_completed.send(Err(ToolCallError::Approval(
+                    ApprovalError::InvalidTransition {
+                        status: crate::approval::ApprovalStatus::Approved,
+                    },
+                )));
+                return;
+            };
+            let result = worker_service.execute_approved(&worker_approval_id).await;
+            let _ = worker_completed.send(result);
+        };
+        let monitor_service = self.clone();
+        let monitor_approval_id = approval_id.clone();
+        let monitor = async move {
+            let failure_code = match worker_result.await {
+                Ok(Ok(())) => None,
+                Ok(Err(error)) => {
+                    tracing::warn!(approval_id = monitor_approval_id, error = %error, "approved tool call did not execute");
+                    Some("execution_task_failed")
+                }
+                Err(_) => {
+                    tracing::error!(
+                        approval_id = monitor_approval_id,
+                        "approved tool call task stopped unexpectedly"
+                    );
+                    Some("execution_task_interrupted")
+                }
+            };
+            if let Some(failure_code) = failure_code {
+                monitor_service
+                    .finalize_abandoned_execution(&monitor_approval_id, failure_code)
+                    .await;
+            }
+            monitor_service
+                .in_flight_approvals
+                .lock()
+                .unwrap_or_else(std::sync::PoisonError::into_inner)
+                .remove(&monitor_approval_id);
+        };
+        if !self.background_tasks.spawn_pair(worker, monitor) {
+            self.in_flight_approvals
+                .lock()
+                .unwrap_or_else(std::sync::PoisonError::into_inner)
+                .remove(&approval_id);
+        }
+    }
+
+    async fn finalize_abandoned_execution(&self, approval_id: &str, failure_code: &str) {
+        for attempt in 0..3 {
+            let result = async {
+                let Some(detail) = self.approvals.get_admin(approval_id).await? else {
+                    return Ok::<_, ApprovalError>(());
+                };
+                match detail.record.status {
+                    crate::approval::ApprovalStatus::Approved => {
+                        self.approvals
+                            .mark_stale(approval_id, detail.record.revision, failure_code)
+                            .await?;
+                    }
+                    crate::approval::ApprovalStatus::Executing => {
+                        self.approvals
+                            .finish(
+                                approval_id,
+                                detail.record.revision,
+                                ExecutionOutcome::Interrupted,
+                                &serde_json::to_value(error_result(&ToolCallError::Stale))
+                                    .map_err(ApprovalError::Json)?,
+                                Some(failure_code),
+                            )
+                            .await?;
+                    }
+                    _ => {}
+                }
+                self.schedule_approval_log_flush_if_pending().await?;
+                Ok(())
+            }
+            .await;
+            match result {
+                Ok(()) => {
+                    self.notify_approval(approval_id);
+                    return;
+                }
+                Err(error) if attempt < 2 => {
+                    tracing::warn!(approval_id, error = %error, "retrying approval task finalization");
+                    tokio::time::sleep(Duration::from_millis(50 * (attempt + 1))).await;
+                }
+                Err(error) => {
+                    tracing::error!(approval_id, error = %error, "approval task finalization failed");
+                }
+            }
+        }
+    }
+
+    async fn execute_approved(&self, approval_id: &str) -> Result<(), ToolCallError> {
+        let Some(detail) = self.approvals.get_admin(approval_id).await? else {
+            return Ok(());
+        };
+        let record = detail.record;
+        if record.status != crate::approval::ApprovalStatus::Approved {
+            return Ok(());
+        }
+        let expected_revision = record.revision;
+        let expected_oauth_bindings = match self
+            .approvals
+            .invocation_snapshot(approval_id)
+            .await?
+            .and_then(|snapshot| snapshot.get("oauthBindings").cloned())
+            .map(serde_json::from_value::<Vec<OAuthBinding>>)
+        {
+            Some(Ok(bindings)) => bindings,
+            Some(Err(_)) | None => {
+                self.approvals
+                    .mark_stale(approval_id, expected_revision, "oauth_binding_stale")
+                    .await?;
+                self.schedule_approval_log_flush();
+                self.notify_approval(approval_id);
+                self.wait_for_delivery_release(approval_id).await?;
+                return Ok(());
+            }
+        };
+        if !self
+            .oauth
+            .bindings_match(&record.revisions.source_id, &expected_oauth_bindings)
+            .await
+            .unwrap_or(false)
+        {
+            self.approvals
+                .mark_stale(approval_id, expected_revision, "oauth_binding_stale")
+                .await?;
+            self.schedule_approval_log_flush();
+            self.notify_approval(approval_id);
+            self.wait_for_delivery_release(approval_id).await?;
+            return Ok(());
+        }
+        let token = record.revisions.clone().into();
+        let lease = match self.catalog.revalidate_invocation(&token).await {
+            Ok(Some(lease)) => lease,
+            Ok(None) => {
+                self.approvals
+                    .mark_stale(approval_id, expected_revision, "approval_stale")
+                    .await?;
+                self.schedule_approval_log_flush();
+                self.notify_approval(approval_id);
+                self.wait_for_delivery_release(approval_id).await?;
+                return Ok(());
+            }
+            Err(error) => {
+                let failure_code = error_code(&ToolCallError::Catalog(error));
+                self.approvals
+                    .mark_stale(approval_id, expected_revision, failure_code)
+                    .await?;
+                self.schedule_approval_log_flush();
+                self.notify_approval(approval_id);
+                self.wait_for_delivery_release(approval_id).await?;
+                return Ok(());
+            }
+        };
+        let cancellation_guard = self.deferred_execution_cancellations.read().await;
+        if cancellation_guard.contains(&record.execution_id)
+            || self.execution_is_stopping(&record.execution_id)
+        {
+            drop(cancellation_guard);
+            self.cancel_execution(&record.execution_id).await?;
+            self.wait_for_delivery_release(approval_id).await?;
+            return Ok(());
+        }
+        let snapshot = match self
+            .approvals
+            .claim_execution(approval_id, record.worker_generation, expected_revision)
+            .await
+        {
+            Ok(snapshot) => snapshot,
+            Err(
+                ApprovalError::RevisionConflict { .. } | ApprovalError::InvalidTransition { .. },
+            ) => {
+                return Ok(());
+            }
+            Err(error) => return Err(error.into()),
+        };
+        if self.execution_is_stopping(&record.execution_id) {
+            drop(cancellation_guard);
+            let result = ToolResult {
+                ok: false,
+                data: None,
+                error: Some(PublicToolError {
+                    code: "execution_cancelled".to_owned(),
+                    message: "The execution was canceled before the tool call started.".to_owned(),
+                }),
+                http: None,
+            };
+            self.approvals
+                .finish(
+                    approval_id,
+                    snapshot.record.revision,
+                    ExecutionOutcome::Interrupted,
+                    &serde_json::to_value(result).map_err(ApprovalError::Json)?,
+                    Some("execution_cancelled"),
+                )
+                .await?;
+            self.schedule_approval_log_flush();
+            self.notify_approval(approval_id);
+            self.wait_for_delivery_release(approval_id).await?;
+            return Ok(());
+        }
+        if !lease.arguments_are_valid(&snapshot.arguments) {
+            let result = error_result(&ToolCallError::InvalidArguments);
+            self.approvals
+                .finish(
+                    approval_id,
+                    snapshot.record.revision,
+                    ExecutionOutcome::Failed,
+                    &serde_json::to_value(result).map_err(ApprovalError::Json)?,
+                    Some("invalid_tool_arguments"),
+                )
+                .await?;
+            self.schedule_approval_log_flush();
+            self.notify_approval(approval_id);
+            self.wait_for_delivery_release(approval_id).await?;
+            return Ok(());
+        }
+        let mut mcp_idempotency_execution = if record.surface == RequestSurface::Mcp {
+            let id = record
+                .execution_id
+                .strip_prefix("gateway-idempotency:")
+                .filter(|id| !id.is_empty() && record.call_id == "gateway")
+                .ok_or_else(|| ToolCallError::Adapter {
+                    code: ToolCallAdapterErrorCode::IdempotencyMetadataInvalid,
+                    message: "The MCP approval idempotency metadata is invalid.".to_owned(),
+                })?
+                .to_owned();
+            self.idempotency
+                .mark_executing(&id)
+                .await
+                .map_err(idempotency_tool_call_error)?;
+            Some(IdempotencyExecutionGuard::new(
+                id,
+                self.idempotency.clone(),
+                self.background_tasks.clone(),
+            ))
+        } else {
+            None
+        };
+        drop(cancellation_guard);
+        #[cfg(test)]
+        let execution_hook = {
+            self.approved_execution_hook
+                .lock()
+                .unwrap_or_else(std::sync::PoisonError::into_inner)
+                .clone()
+        };
+        #[cfg(test)]
+        let result = if let Some(hook) = execution_hook {
+            hook.dispatches.fetch_add(1, Ordering::SeqCst);
+            hook.started.notify_one();
+            hook.release.notified().await;
+            Ok(ToolResult {
+                ok: true,
+                data: Some(json!({ "ok": true })),
+                error: None,
+                http: None,
+            })
+        } else {
+            execute_with_lease(
+                &self.protocols,
+                lease,
+                &snapshot.arguments,
+                Some(&expected_oauth_bindings),
+            )
+            .await
+        };
+        #[cfg(not(test))]
+        let result = execute_with_lease(
+            &self.protocols,
+            lease,
+            &snapshot.arguments,
+            Some(&expected_oauth_bindings),
+        )
+        .await;
+        if result
+            .as_ref()
+            .is_err_and(InvocationExecutionError::outcome_unknown)
+            && let Some(execution) = mcp_idempotency_execution.as_mut()
+        {
+            self.idempotency
+                .mark_indeterminate(&execution.id)
+                .await
+                .map_err(idempotency_tool_call_error)?;
+            execution.disarm();
+        }
+        let completed_failure_code = result
+            .as_ref()
+            .ok()
+            .and_then(|result| completed_failure_code(result).map(str::to_owned));
+        let (tool_result, outcome, failure_code) = match result {
+            Ok(result) if result.ok => (result, ExecutionOutcome::Succeeded, None),
+            Ok(result) => (
+                result,
+                ExecutionOutcome::Failed,
+                completed_failure_code.as_deref(),
+            ),
+            Err(failure) if failure.outcome_unknown() => (
+                outcome_unknown_result(&failure),
+                ExecutionOutcome::Interrupted,
+                Some(failure.stable_error_code()),
+            ),
+            Err(failure) => (
+                error_result(failure.error()),
+                ExecutionOutcome::Failed,
+                Some(error_code(failure.error())),
+            ),
+        };
+        let result_json = serde_json::to_value(&tool_result).map_err(ApprovalError::Json)?;
+        let approval_finish = self
+            .approvals
+            .finish(
+                approval_id,
+                snapshot.record.revision,
+                outcome,
+                &result_json,
+                failure_code,
+            )
+            .await;
+        if let Err(error) = approval_finish {
+            if let Some(execution) = mcp_idempotency_execution.as_mut()
+                && execution.armed
+            {
+                self.idempotency
+                    .mark_indeterminate(&execution.id)
+                    .await
+                    .map_err(idempotency_tool_call_error)?;
+                execution.disarm();
+            }
+            return Err(error.into());
+        }
+        if let Some(execution) = mcp_idempotency_execution.as_mut()
+            && execution.armed
+        {
+            let response =
+                tool_result_response(&tool_result).map_err(idempotency_tool_call_error)?;
+            match self
+                .idempotency
+                .complete(
+                    &execution.id,
+                    IdempotencyResponseKind::Tool,
+                    &response,
+                    None,
+                )
+                .await
+            {
+                Ok(_) | Err(IdempotencyError::InvalidTransition("completed")) => {
+                    execution.disarm();
+                }
+                Err(error) => {
+                    self.schedule_approval_log_flush();
+                    self.notify_approval(approval_id);
+                    return Err(idempotency_tool_call_error(error));
+                }
+            }
+        }
+        self.schedule_approval_log_flush();
+        self.notify_approval(approval_id);
+        self.wait_for_delivery_release(approval_id).await?;
+        Ok(())
+    }
+
+    async fn wait_for_delivery_release(&self, approval_id: &str) -> Result<(), ApprovalError> {
+        let registration = self.register_approval_wait(approval_id);
+        loop {
+            let notification = registration.notify.notified();
+            tokio::pin!(notification);
+            notification.as_mut().enable();
+            if !self.approvals.delivery_pin_exists(approval_id).await? {
+                return Ok(());
+            }
+            notification.await;
+        }
+    }
+
+    fn register_approval_wait(&self, approval_id: &str) -> ApprovalWaitRegistration {
+        let mut registry = self
+            .approval_notifications
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        let entry =
+            registry
+                .entry(approval_id.to_owned())
+                .or_insert_with(|| ApprovalNotificationEntry {
+                    notify: Arc::new(Notify::new()),
+                    waiters: 0,
+                });
+        entry.waiters = entry.waiters.saturating_add(1);
+        let notify = entry.notify.clone();
+        ApprovalWaitRegistration {
+            approval_id: approval_id.to_owned(),
+            notify,
+            registry: self.approval_notifications.clone(),
+        }
+    }
+
+    fn notify_approval(&self, approval_id: &str) {
+        notify_registry(&self.approval_notifications, approval_id);
+    }
+
+    #[allow(clippy::too_many_arguments)]
+    fn record_attempt(
+        &self,
+        call: &ToolCall,
+        source_id: Option<String>,
+        tool_id: Option<String>,
+        outcome: RequestOutcome,
+        error_code: Option<&str>,
+        approval_id: Option<String>,
+        started: Instant,
+    ) {
+        let path = normalized_path_snapshot(&call.path);
+        self.record(NewRequestLog {
+            request_id: call.request_id.clone(),
+            actor_api_token_id: call.actor.api_token_id().map(str::to_owned),
+            surface: call.surface,
+            source_id,
+            tool_id,
+            path_snapshot: Some(path),
+            outcome,
+            error_code: error_code.map(str::to_owned),
+            duration_ms: u64::try_from(started.elapsed().as_millis()).unwrap_or(u64::MAX),
+            approval_id,
+            created_at: crate::unix_timestamp(),
+        });
+    }
+
+    fn record(&self, log: NewRequestLog) {
+        self.request_logs.try_record(log);
+    }
+
+    fn schedule_approval_log_flush(&self) {
+        self.approval_log_requested.store(true, Ordering::Release);
+        let Ok(permit) = self.approval_log_flush.clone().try_acquire_owned() else {
+            return;
+        };
+        let service = self.clone();
+        self.background_tasks.spawn(async move {
+            service.flush_approval_logs(permit).await;
+        });
+    }
+
+    async fn schedule_approval_log_flush_if_pending(&self) -> Result<(), ApprovalError> {
+        if !self.approvals.log_outbox(1).await?.is_empty() {
+            self.schedule_approval_log_flush();
+        }
+        Ok(())
+    }
+
+    async fn flush_approval_logs(&self, permit: OwnedSemaphorePermit) {
+        let mut retry_delay = Duration::from_millis(50);
+        loop {
+            self.approval_log_requested.store(false, Ordering::Release);
+            let events = match self.approvals.log_outbox(256).await {
+                Ok(events) => events,
+                Err(error) => {
+                    tracing::warn!(error = %error, "approval log outbox could not be read");
+                    tokio::time::sleep(retry_delay).await;
+                    retry_delay = (retry_delay * 2).min(Duration::from_secs(5));
+                    continue;
+                }
+            };
+            if events.is_empty() {
+                if self.approval_log_requested.load(Ordering::Acquire) {
+                    continue;
+                }
+                drop(permit);
+                if self.approval_log_requested.swap(false, Ordering::AcqRel) {
+                    self.schedule_approval_log_flush();
+                }
+                return;
+            }
+            for event in events {
+                let request_id = event.request_id.clone();
+                while !self.request_logs.record_durable(event.clone()).await {
+                    tracing::warn!(
+                        request_id,
+                        "approval terminal log persistence will be retried"
+                    );
+                    tokio::time::sleep(retry_delay).await;
+                    retry_delay = (retry_delay * 2).min(Duration::from_secs(5));
+                }
+                loop {
+                    match self.approvals.acknowledge_log_outbox(&request_id).await {
+                        Ok(()) => break,
+                        Err(error) => {
+                            tracing::warn!(request_id, error = %error, "approval log outbox acknowledgement will be retried");
+                            tokio::time::sleep(retry_delay).await;
+                            retry_delay = (retry_delay * 2).min(Duration::from_secs(5));
+                        }
+                    }
+                }
+                retry_delay = Duration::from_millis(50);
+            }
+        }
+    }
+}
+
+fn notify_registry(registry: &ApprovalNotificationRegistry, approval_id: &str) {
+    let notify = registry
+        .lock()
+        .unwrap_or_else(std::sync::PoisonError::into_inner)
+        .get(approval_id)
+        .map(|entry| entry.notify.clone());
+    if let Some(notify) = notify {
+        notify.notify_waiters();
+    }
+}
+
+fn oauth_tool_error(error: OAuthError) -> ToolCallError {
+    ToolCallOAuthError::from(error).into()
+}
+
+async fn execute_with_lease(
+    protocols: &ProtocolRegistry,
+    lease: InvocationLease,
+    arguments: &Value,
+    expected_oauth_bindings: Option<&[OAuthBinding]>,
+) -> Result<ToolResult, InvocationExecutionError> {
+    let effect = InvocationEffect::from_lease(&lease);
+    let prepared = prepare_with_lease(protocols, lease, arguments, expected_oauth_bindings)
+        .await
+        .map_err(|error| {
+            InvocationExecutionError::new(error, ExecutionFailurePhase::PreDispatch, effect)
+        })?;
+    execute_prepared(protocols, prepared, effect).await
+}
+
+async fn prepare_with_lease(
+    protocols: &ProtocolRegistry,
+    lease: InvocationLease,
+    arguments: &Value,
+    expected_oauth_bindings: Option<&[OAuthBinding]>,
+) -> Result<PreparedProtocolInvocation, ToolCallError> {
+    protocols
+        .prepare_invocation(lease, arguments, expected_oauth_bindings)
+        .await
+        .map_err(ToolCallError::Protocol)
+}
+
+async fn execute_prepared(
+    protocols: &ProtocolRegistry,
+    prepared: PreparedProtocolInvocation,
+    effect: InvocationEffect,
+) -> Result<ToolResult, InvocationExecutionError> {
+    let response = protocols
+        .execute_invocation(prepared)
+        .await
+        .map_err(protocol_invocation_error)
+        .map_err(|error| {
+            InvocationExecutionError::new(error, ExecutionFailurePhase::ProtocolClassified, effect)
+        })?;
+    let result = ToolResult {
+        ok: response.ok,
+        data: response.data,
+        error: response.error.map(|error| PublicToolError {
+            code: error.code,
+            message: error.message,
+        }),
+        http: response.http.map(|http| ToolHttpMetadata {
+            status: http.status,
+            headers: http.headers,
+            truncated: http.truncated,
+        }),
+    };
+    if serde_json::to_vec(&result).is_ok_and(|encoded| encoded.len() > MAX_RESULT_BYTES) {
+        return Err(InvocationExecutionError::new(
+            ToolCallError::ResultTooLarge,
+            ExecutionFailurePhase::PostDispatch,
+            effect,
+        ));
+    }
+    Ok(result)
+}
+
+fn protocol_invocation_error(error: ProtocolInvocationError) -> ToolCallError {
+    match error {
+        ProtocolInvocationError::OpenApi(error) => {
+            let outcome_unknown = error.outcome_unknown();
+            let _stable_protocol_code = error.code();
+            let mapped = match error {
+                crate::protocols::openapi::OpenApiExecutionError::Outbound {
+                    outcome_unknown: true,
+                    ..
+                }
+                | crate::protocols::openapi::OpenApiExecutionError::Indeterminate => {
+                    protocol_adapter_error(
+                        ToolCallAdapterErrorCode::OpenApiOutcomeUnknown,
+                        "The upstream OpenAPI operation may have completed, so it cannot be retried safely.",
+                    )
+                }
+                crate::protocols::openapi::OpenApiExecutionError::InsecureTransport
+                | crate::protocols::openapi::OpenApiExecutionError::Outbound {
+                    source: OutboundError::InsecureTransport,
+                    ..
+                } => ToolCallError::Protocol(ProtocolError::new(
+                    crate::protocols::ProtocolErrorCategory::Conflict,
+                    "insecure_openapi_transport",
+                    "OpenAPI requests must use HTTPS, except for loopback HTTP.",
+                )),
+                crate::protocols::openapi::OpenApiExecutionError::Outbound { source, .. } => {
+                    ToolCallError::Outbound(source)
+                }
+                crate::protocols::openapi::OpenApiExecutionError::OAuth(error) => {
+                    ToolCallOAuthError::from(error).into()
+                }
+            };
+            debug_assert_eq!(mapped.outcome_unknown(), outcome_unknown);
+            mapped
+        }
+        ProtocolInvocationError::Graphql(error) => {
+            let outcome_unknown = error.outcome_unknown();
+            let mapped = match error {
+                crate::protocols::graphql::GraphqlInvocationError::Outbound {
+                    outcome_unknown: true,
+                    ..
+                }
+                | crate::protocols::graphql::GraphqlInvocationError::Indeterminate => {
+                    protocol_adapter_error(
+                        ToolCallAdapterErrorCode::GraphqlOutcomeUnknown,
+                        "The upstream GraphQL mutation may have completed, so it cannot be retried safely.",
+                    )
+                }
+                crate::protocols::graphql::GraphqlInvocationError::Outbound { source, .. } => {
+                    ToolCallError::Outbound(source)
+                }
+                crate::protocols::graphql::GraphqlInvocationError::OAuth(error) => {
+                    ToolCallOAuthError::from(error).into()
+                }
+            };
+            debug_assert_eq!(mapped.outcome_unknown(), outcome_unknown);
+            mapped
+        }
+        ProtocolInvocationError::Mcp(error) => {
+            let outcome_unknown = error.outcome_unknown();
+            let mapped = match error {
+                crate::protocols::mcp::McpInvocationError::AuthorizationSetup(error) => {
+                    ToolCallError::Protocol(error)
+                }
+                crate::protocols::mcp::McpInvocationError::HttpSetup(error) => {
+                    mcp_http_setup_error(error)
+                }
+                crate::protocols::mcp::McpInvocationError::HttpCall(_)
+                | crate::protocols::mcp::McpInvocationError::StdioCall(_) => {
+                    protocol_adapter_error(
+                        ToolCallAdapterErrorCode::McpOutcomeUnknown,
+                        "The upstream MCP tool call may have completed, so it cannot be retried safely.",
+                    )
+                }
+                crate::protocols::mcp::McpInvocationError::StdioSetup(error) => {
+                    mcp_stdio_setup_error(error)
+                }
+                crate::protocols::mcp::McpInvocationError::ShuttingDown => protocol_adapter_error(
+                    ToolCallAdapterErrorCode::McpShuttingDown,
+                    "MCP connections are shutting down. Retry after the service is available.",
+                ),
+            };
+            debug_assert_eq!(mapped.outcome_unknown(), outcome_unknown);
+            mapped
+        }
+    }
+}
+
+fn mcp_http_setup_error(error: crate::mcp::upstream::http::StreamableHttpError) -> ToolCallError {
+    use crate::mcp::upstream::http::StreamableHttpError;
+
+    match error {
+        StreamableHttpError::Outbound(error) => ToolCallError::Outbound(error),
+        StreamableHttpError::InsecureEndpoint => ToolCallError::Protocol(ProtocolError::new(
+            crate::protocols::ProtocolErrorCategory::InvalidInput,
+            "invalid_mcp_endpoint",
+            "MCP HTTP endpoints must use HTTPS, except for loopback HTTP.",
+        )),
+        StreamableHttpError::HttpStatus(reqwest::StatusCode::UNAUTHORIZED) => {
+            protocol_adapter_error(
+                ToolCallAdapterErrorCode::McpUpstreamUnauthorized,
+                "The upstream MCP server rejected its configured authorization.",
+            )
+        }
+        StreamableHttpError::HttpStatus(reqwest::StatusCode::FORBIDDEN) => protocol_adapter_error(
+            ToolCallAdapterErrorCode::McpUpstreamForbidden,
+            "The upstream MCP server denied its configured authorization.",
+        ),
+        StreamableHttpError::HttpStatus(
+            reqwest::StatusCode::REQUEST_TIMEOUT | reqwest::StatusCode::GATEWAY_TIMEOUT,
+        ) => ToolCallError::Outbound(OutboundError::Timeout),
+        StreamableHttpError::SessionExpired
+        | StreamableHttpError::SessionInvalidated
+        | StreamableHttpError::SessionChanged
+        | StreamableHttpError::NotInitialized
+        | StreamableHttpError::AlreadyInitialized => protocol_adapter_error(
+            ToolCallAdapterErrorCode::McpSessionConflict,
+            "The MCP session changed before the tool call was dispatched.",
+        ),
+        StreamableHttpError::ReservedHeader
+        | StreamableHttpError::InvalidProtocolVersion
+        | StreamableHttpError::InvalidClientInfo
+        | StreamableHttpError::InvalidRequest
+        | StreamableHttpError::InvalidUtf8
+        | StreamableHttpError::UnsupportedContentType
+        | StreamableHttpError::InvalidResponse
+        | StreamableHttpError::HttpStatus(_)
+        | StreamableHttpError::InvalidSessionId
+        | StreamableHttpError::ProtocolVersionMismatch
+        | StreamableHttpError::JsonRpc { .. }
+        | StreamableHttpError::Json(_) => protocol_adapter_error(
+            ToolCallAdapterErrorCode::McpProtocolUnavailable,
+            "The upstream MCP server was unavailable or returned an invalid setup response.",
+        ),
+    }
+}
+
+fn mcp_stdio_setup_error(error: crate::mcp::upstream::stdio::StdioTransportError) -> ToolCallError {
+    use crate::mcp::upstream::stdio::StdioTransportError;
+
+    match error {
+        StdioTransportError::Timeout => ToolCallError::Outbound(OutboundError::Timeout),
+        StdioTransportError::TooManyInFlight => protocol_adapter_error(
+            ToolCallAdapterErrorCode::McpCapacity,
+            "MCP execution capacity has been reached. Retry later.",
+        ),
+        StdioTransportError::RequestTooLarge | StdioTransportError::ResponseTooLarge => {
+            protocol_adapter_error(
+                ToolCallAdapterErrorCode::McpMessageTooLarge,
+                "The MCP request or response exceeds the allowed size.",
+            )
+        }
+        StdioTransportError::RestartRequiresInitialization
+        | StdioTransportError::NotInitialized
+        | StdioTransportError::AlreadyInitialized => protocol_adapter_error(
+            ToolCallAdapterErrorCode::McpSessionConflict,
+            "The MCP session changed before the tool call was dispatched.",
+        ),
+        StdioTransportError::Template(_)
+        | StdioTransportError::InvalidLimits
+        | StdioTransportError::Spawn
+        | StdioTransportError::Closed
+        | StdioTransportError::InvalidResponse
+        | StdioTransportError::JsonRpc { .. }
+        | StdioTransportError::ProcessExited { .. }
+        | StdioTransportError::AmbiguousToolCall
+        | StdioTransportError::DuplicateRequestId
+        | StdioTransportError::UnexpectedResponseId
+        | StdioTransportError::Encode
+        | StdioTransportError::Decode
+        | StdioTransportError::InvalidRequest
+        | StdioTransportError::ProtocolVersionMismatch => protocol_adapter_error(
+            ToolCallAdapterErrorCode::McpProtocolUnavailable,
+            "The upstream MCP server was unavailable or returned an invalid setup response.",
+        ),
+    }
+}
+
+fn protocol_adapter_error(code: ToolCallAdapterErrorCode, message: &'static str) -> ToolCallError {
+    ToolCallError::Adapter {
+        code,
+        message: message.to_owned(),
+    }
+}
+
+fn completed_failure_code(result: &ToolResult) -> Option<&str> {
+    (!result.ok).then(|| {
+        result
+            .error
+            .as_ref()
+            .map(|error| error.code.as_str())
+            .unwrap_or("upstream_http_error")
+    })
+}
+
+fn tool_result_response(result: &ToolResult) -> Result<IdempotencyResponse, IdempotencyError> {
+    Ok(IdempotencyResponse {
+        status: 200,
+        headers: BTreeMap::from([("content-type".to_owned(), "application/json".to_owned())]),
+        body: serde_json::to_vec(result)?,
+    })
+}
+
+fn tool_result_from_response(
+    response: &IdempotencyResponse,
+) -> Result<ToolResult, GatewayInvokeError> {
+    if response.status != 200 {
+        return Err(GatewayInvokeError::Idempotency(
+            "stored MCP idempotency response has an invalid status".to_owned(),
+        ));
+    }
+    serde_json::from_slice(&response.body)
+        .map_err(IdempotencyError::Json)
+        .map_err(GatewayInvokeError::from)
+}
+
+fn mcp_blob_response(response: McpIdempotencyBlob) -> IdempotencyResponse {
+    IdempotencyResponse {
+        status: 200,
+        headers: BTreeMap::from([("content-type".to_owned(), "application/json".to_owned())]),
+        body: response.body,
+    }
+}
+
+fn mcp_response_blob(
+    response: IdempotencyResponse,
+) -> Result<McpIdempotencyBlob, GatewayInvokeError> {
+    if response.status != 200 {
+        return Err(GatewayInvokeError::Idempotency(
+            "stored MCP idempotency response has an invalid status".to_owned(),
+        ));
+    }
+    Ok(McpIdempotencyBlob {
+        body: response.body,
+    })
+}
+
+fn terminal_approval_result(
+    status: ApprovalStatus,
+    result: Option<Value>,
+) -> Result<ToolResult, GatewayInvokeError> {
+    match status {
+        ApprovalStatus::Succeeded | ApprovalStatus::Failed => result
+            .ok_or_else(|| {
+                GatewayInvokeError::Idempotency("terminal approval result is missing".to_owned())
+            })
+            .and_then(|result| {
+                serde_json::from_value(result)
+                    .map_err(IdempotencyError::Json)
+                    .map_err(GatewayInvokeError::from)
+            }),
+        ApprovalStatus::Denied => Ok(approval_failure_result(
+            "approval_denied",
+            "The tool call was denied.",
+        )),
+        ApprovalStatus::Expired => Ok(approval_failure_result(
+            "approval_expired",
+            "The tool approval expired.",
+        )),
+        ApprovalStatus::Canceled => Ok(approval_failure_result(
+            "approval_canceled",
+            "The tool call was canceled.",
+        )),
+        ApprovalStatus::Stale => Ok(approval_failure_result(
+            "approval_stale",
+            "The tool changed before approval completed.",
+        )),
+        ApprovalStatus::Interrupted => Ok(approval_failure_result(
+            "approval_interrupted",
+            "The approved tool call was interrupted.",
+        )),
+        ApprovalStatus::Pending | ApprovalStatus::Approved | ApprovalStatus::Executing => {
+            Err(GatewayInvokeError::Idempotency(
+                "approval wait returned a nonterminal state".to_owned(),
+            ))
+        }
+    }
+}
+
+fn approval_failure_result(code: &str, message: &str) -> ToolResult {
+    ToolResult {
+        ok: false,
+        data: None,
+        error: Some(PublicToolError {
+            code: code.to_owned(),
+            message: message.to_owned(),
+        }),
+        http: None,
+    }
+}
+
+fn approval_required_response(
+    approval: &ApprovalRecord,
+) -> Result<IdempotencyResponse, IdempotencyError> {
+    Ok(IdempotencyResponse {
+        status: 202,
+        headers: BTreeMap::from([("content-type".to_owned(), "application/json".to_owned())]),
+        body: serde_json::to_vec(&json!({
+            "status": "approval_required",
+            "approval": {
+                "id": approval.id,
+                "status": ApprovalStatus::Pending,
+                "revision": 0,
+                "path": approval.callable_path_snapshot,
+                "createdAt": approval.created_at,
+                "expiresAt": approval.expires_at,
+                "statusUrl": format!("/api/v1/gateway/approvals/{}", approval.id),
+            }
+        }))?,
+    })
+}
+
+fn normalized_path_snapshot(path: &str) -> String {
+    let path = if path.starts_with("tools.") {
+        path.to_owned()
+    } else {
+        format!("tools.{path}")
+    };
+    if path.len() <= 512 && !path.contains('\0') {
+        path
+    } else {
+        "tools.invoke".to_owned()
+    }
+}
+
+async fn token_is_active(pool: &SqlitePool, token_id: &str) -> Result<bool, ApprovalError> {
+    sqlx::query_scalar::<_, i64>(
+        "SELECT EXISTS(SELECT 1 FROM api_tokens WHERE id = ? AND revoked_at IS NULL)",
+    )
+    .bind(token_id)
+    .fetch_one(pool)
+    .await
+    .map(|active| active != 0)
+    .map_err(ApprovalError::Database)
+}
+
+fn idempotency_startup_error(error: IdempotencyError) -> ApprovalError {
+    match error {
+        IdempotencyError::Database(error) => ApprovalError::Database(error),
+        IdempotencyError::Crypto(error) => ApprovalError::Crypto(error),
+        IdempotencyError::Json(error) => ApprovalError::Json(error),
+        IdempotencyError::InvalidKey
+        | IdempotencyError::InvalidMetadata
+        | IdempotencyError::PayloadTooLarge
+        | IdempotencyError::Capacity
+        | IdempotencyError::NotFound
+        | IdempotencyError::InvalidTransition(_)
+        | IdempotencyError::CorruptData => {
+            ApprovalError::CorruptData("gateway idempotency recovery")
+        }
+    }
+}
+
+fn idempotency_tool_call_error(_error: IdempotencyError) -> ToolCallError {
+    ToolCallError::Adapter {
+        code: ToolCallAdapterErrorCode::IdempotencyFailed,
+        message: "The idempotent tool call could not be completed safely.".to_owned(),
+    }
+}
+
+fn error_code(error: &ToolCallError) -> &'static str {
+    match error {
+        ToolCallError::Approval(_) => "approval_error",
+        ToolCallError::Catalog(CatalogError::Validation { code, .. }) => code,
+        ToolCallError::Catalog(CatalogError::NotFound { entity: "source" }) => "source_not_found",
+        ToolCallError::Catalog(CatalogError::NotFound { .. })
+        | ToolCallError::Catalog(CatalogError::ToolNotFound { .. }) => "tool_not_found",
+        ToolCallError::Catalog(CatalogError::ToolDisabled { .. }) => "tool_disabled",
+        ToolCallError::Catalog(CatalogError::RevisionConflict { .. }) => "revision_conflict",
+        ToolCallError::Catalog(_) => "catalog_error",
+        ToolCallError::Adapter { code, .. } => code.as_str(),
+        ToolCallError::OAuth(error) => error.code(),
+        ToolCallError::ArgumentsTooLarge => "arguments_too_large",
+        ToolCallError::InvalidArguments => "invalid_tool_arguments",
+        ToolCallError::Stale => "invocation_stale",
+        ToolCallError::Outbound(error) => error.code(),
+        ToolCallError::Protocol(error) => error.code,
+        ToolCallError::ResultTooLarge => "result_too_large",
+    }
+}
+
+fn catalog_error_code(error: &CatalogError) -> &'static str {
+    match error {
+        CatalogError::Validation { code, .. } => code,
+        CatalogError::NotFound { entity: "source" } => "source_not_found",
+        CatalogError::NotFound { .. } | CatalogError::ToolNotFound { .. } => "tool_not_found",
+        CatalogError::ToolDisabled { .. } => "tool_disabled",
+        CatalogError::RevisionConflict { .. } => "revision_conflict",
+        CatalogError::Database(_)
+        | CatalogError::Crypto(_)
+        | CatalogError::Json(_)
+        | CatalogError::CorruptData(_) => "internal_error",
+    }
+}
+
+fn error_result(error: &ToolCallError) -> ToolResult {
+    ToolResult {
+        ok: false,
+        data: None,
+        error: Some(PublicToolError {
+            code: error_code(error).to_owned(),
+            message: "The tool call could not be completed safely.".to_owned(),
+        }),
+        http: None,
+    }
+}
+
+fn outcome_unknown_result(failure: &InvocationExecutionError) -> ToolResult {
+    ToolResult {
+        ok: false,
+        data: None,
+        error: Some(PublicToolError {
+            code: failure.stable_error_code().to_owned(),
+            message: "The upstream operation may have completed, so it cannot be retried safely."
+                .to_owned(),
+        }),
+        http: None,
+    }
+}
+
+#[cfg(test)]
+mod idempotency_guard_tests {
+    use std::{collections::BTreeMap, future::pending, time::Duration};
+
+    use serde_json::json;
+    use sqlx::sqlite::{SqliteConnectOptions, SqlitePoolOptions};
+    use tokio::{
+        io::{AsyncReadExt, AsyncWriteExt},
+        net::TcpListener,
+    };
+
+    use super::*;
+    use crate::{
+        AppConfig, ExecutorApp,
+        catalog::{
+            ArtifactKind, AuditContext, CreateSource, CredentialPayload, InitialCatalogSnapshot,
+            SourceKind, StagedArtifact, StagedTool, StagedToolBinding, ToolBinding, ToolMode,
+        },
+        openapi::{OpenApiBinding, OpenApiSecurityAlternative},
+        runtime::{
+            ExecutionCancellation, HostToolDispatcher, InvocationContext, InvocationToolDispatcher,
+            ToolCall as RuntimeToolCall, ToolResult as RuntimeToolResult,
+        },
+    };
+
+    static MIGRATOR: sqlx::migrate::Migrator = sqlx::migrate!("./migrations");
+
+    #[test]
+    fn completed_protocol_failures_preserve_their_stable_error_code() {
+        let result = ToolResult {
+            ok: false,
+            data: None,
+            error: Some(PublicToolError {
+                code: "graphql_error".to_owned(),
+                message: "sanitized".to_owned(),
+            }),
+            http: None,
+        };
+        assert_eq!(completed_failure_code(&result), Some("graphql_error"));
+    }
+
+    #[derive(Clone, Copy, Debug, Eq, PartialEq)]
+    enum ExpectedExecutionError {
+        Adapter(ToolCallAdapterErrorCode),
+        OAuth(&'static str),
+        Outbound(&'static str),
+        Protocol(&'static str),
+    }
+
+    fn assert_execution_error(error: ToolCallError, expected: ExpectedExecutionError) {
+        match (error, expected) {
+            (
+                ToolCallError::Adapter { code, message },
+                ExpectedExecutionError::Adapter(expected),
+            ) => {
+                assert_eq!(code, expected);
+                assert!(!message.contains("secret upstream detail"));
+            }
+            (ToolCallError::Outbound(error), ExpectedExecutionError::Outbound(expected)) => {
+                assert_eq!(error.code(), expected);
+            }
+            (ToolCallError::OAuth(error), ExpectedExecutionError::OAuth(expected)) => {
+                assert_eq!(error.code(), expected);
+            }
+            (ToolCallError::Protocol(error), ExpectedExecutionError::Protocol(expected)) => {
+                assert_eq!(error.code, expected);
+            }
+            (error, expected) => panic!("unexpected mapped error {error:?}, expected {expected:?}"),
+        }
+    }
+
+    #[test]
+    fn protocol_execution_errors_preserve_retry_safety_and_stable_codes() {
+        use crate::protocols::{graphql, mcp, openapi};
+
+        let safe_openapi = protocol_invocation_error(ProtocolInvocationError::OpenApi(
+            openapi::OpenApiExecutionError::Outbound {
+                source: OutboundError::Timeout,
+                outcome_unknown: false,
+            },
+        ));
+        assert!(!safe_openapi.outcome_unknown());
+        assert_execution_error(
+            safe_openapi,
+            ExpectedExecutionError::Outbound("upstream_timeout"),
+        );
+        let ambiguous_openapi = protocol_invocation_error(ProtocolInvocationError::OpenApi(
+            openapi::OpenApiExecutionError::Outbound {
+                source: OutboundError::Request,
+                outcome_unknown: true,
+            },
+        ));
+        assert!(ambiguous_openapi.outcome_unknown());
+        assert_execution_error(
+            ambiguous_openapi,
+            ExpectedExecutionError::Adapter(ToolCallAdapterErrorCode::OpenApiOutcomeUnknown),
+        );
+        assert_execution_error(
+            protocol_invocation_error(ProtocolInvocationError::OpenApi(
+                openapi::OpenApiExecutionError::Indeterminate,
+            )),
+            ExpectedExecutionError::Adapter(ToolCallAdapterErrorCode::OpenApiOutcomeUnknown),
+        );
+        let insecure_openapi = protocol_invocation_error(ProtocolInvocationError::OpenApi(
+            openapi::OpenApiExecutionError::InsecureTransport,
+        ));
+        assert!(!insecure_openapi.outcome_unknown());
+        assert_execution_error(
+            insecure_openapi,
+            ExpectedExecutionError::Protocol("insecure_openapi_transport"),
+        );
+        let insecure_openapi_hop = protocol_invocation_error(ProtocolInvocationError::OpenApi(
+            openapi::OpenApiExecutionError::Outbound {
+                source: OutboundError::InsecureTransport,
+                outcome_unknown: false,
+            },
+        ));
+        assert!(!insecure_openapi_hop.outcome_unknown());
+        assert_execution_error(
+            insecure_openapi_hop,
+            ExpectedExecutionError::Protocol("insecure_openapi_transport"),
+        );
+        assert_execution_error(
+            protocol_invocation_error(ProtocolInvocationError::OpenApi(
+                openapi::OpenApiExecutionError::OAuth(OAuthError::Conflict {
+                    code: "oauth_binding_changed",
+                    message: "secret upstream detail",
+                }),
+            )),
+            ExpectedExecutionError::OAuth("oauth_binding_changed"),
+        );
+
+        let safe_graphql = protocol_invocation_error(ProtocolInvocationError::Graphql(
+            graphql::GraphqlInvocationError::Outbound {
+                source: OutboundError::DnsResolution,
+                outcome_unknown: false,
+            },
+        ));
+        assert!(!safe_graphql.outcome_unknown());
+        assert_execution_error(
+            safe_graphql,
+            ExpectedExecutionError::Outbound("dns_resolution_failed"),
+        );
+        let ambiguous_graphql = protocol_invocation_error(ProtocolInvocationError::Graphql(
+            graphql::GraphqlInvocationError::Outbound {
+                source: OutboundError::Request,
+                outcome_unknown: true,
+            },
+        ));
+        assert!(ambiguous_graphql.outcome_unknown());
+        assert_execution_error(
+            ambiguous_graphql,
+            ExpectedExecutionError::Adapter(ToolCallAdapterErrorCode::GraphqlOutcomeUnknown),
+        );
+        assert_execution_error(
+            protocol_invocation_error(ProtocolInvocationError::Graphql(
+                graphql::GraphqlInvocationError::Indeterminate,
+            )),
+            ExpectedExecutionError::Adapter(ToolCallAdapterErrorCode::GraphqlOutcomeUnknown),
+        );
+        assert_execution_error(
+            protocol_invocation_error(ProtocolInvocationError::Graphql(
+                graphql::GraphqlInvocationError::OAuth(OAuthError::Upstream {
+                    code: "oauth_provider_timeout",
+                }),
+            )),
+            ExpectedExecutionError::OAuth("oauth_provider_timeout"),
+        );
+
+        assert_execution_error(
+            protocol_invocation_error(ProtocolInvocationError::Mcp(
+                mcp::McpInvocationError::AuthorizationSetup(ProtocolError::new(
+                    crate::protocols::ProtocolErrorCategory::Conflict,
+                    "oauth_binding_changed",
+                    "safe",
+                )),
+            )),
+            ExpectedExecutionError::Protocol("oauth_binding_changed"),
+        );
+        let insecure_mcp = protocol_invocation_error(ProtocolInvocationError::Mcp(
+            mcp::McpInvocationError::HttpSetup(
+                crate::mcp::upstream::http::StreamableHttpError::InsecureEndpoint,
+            ),
+        ));
+        assert!(!insecure_mcp.outcome_unknown());
+        assert_execution_error(
+            insecure_mcp,
+            ExpectedExecutionError::Protocol("invalid_mcp_endpoint"),
+        );
+        let ambiguous_mcp = protocol_invocation_error(ProtocolInvocationError::Mcp(
+            mcp::McpInvocationError::HttpCall(
+                crate::mcp::upstream::http::StreamableHttpError::InvalidResponse,
+            ),
+        ));
+        assert!(ambiguous_mcp.outcome_unknown());
+        assert_execution_error(
+            ambiguous_mcp,
+            ExpectedExecutionError::Adapter(ToolCallAdapterErrorCode::McpOutcomeUnknown),
+        );
+        assert_execution_error(
+            protocol_invocation_error(ProtocolInvocationError::Mcp(
+                mcp::McpInvocationError::StdioCall(
+                    crate::mcp::upstream::stdio::StdioTransportError::Decode,
+                ),
+            )),
+            ExpectedExecutionError::Adapter(ToolCallAdapterErrorCode::McpOutcomeUnknown),
+        );
+        assert_execution_error(
+            protocol_invocation_error(ProtocolInvocationError::Mcp(
+                mcp::McpInvocationError::ShuttingDown,
+            )),
+            ExpectedExecutionError::Adapter(ToolCallAdapterErrorCode::McpShuttingDown),
+        );
+    }
+
+    #[test]
+    fn oauth_errors_preserve_sanitized_typed_reasons() {
+        #[derive(Clone, Copy)]
+        enum Expected {
+            Validation,
+            Required,
+            Conflict,
+            Unauthorized,
+            Denied,
+            Upstream,
+            Internal,
+        }
+
+        let cases = [
+            (
+                OAuthError::Validation {
+                    code: "oauth_scope_invalid",
+                    message: "secret upstream detail",
+                },
+                Expected::Validation,
+                "oauth_scope_invalid",
+            ),
+            (
+                OAuthError::NotFound,
+                Expected::Required,
+                "oauth_connection_required",
+            ),
+            (
+                OAuthError::Conflict {
+                    code: "oauth_binding_changed",
+                    message: "secret upstream detail",
+                },
+                Expected::Conflict,
+                "oauth_binding_changed",
+            ),
+            (
+                OAuthError::UnauthorizedTransaction,
+                Expected::Unauthorized,
+                "oauth_transaction_unauthorized",
+            ),
+            (
+                OAuthError::AuthorizationDenied {
+                    connection_id: "secret-connection-id".to_owned(),
+                },
+                Expected::Denied,
+                "oauth_authorization_denied",
+            ),
+            (
+                OAuthError::Upstream {
+                    code: "oauth_provider_timeout",
+                },
+                Expected::Upstream,
+                "oauth_provider_timeout",
+            ),
+            (
+                OAuthError::Internal,
+                Expected::Internal,
+                "oauth_internal_error",
+            ),
+        ];
+
+        for (source, expected, code) in cases {
+            let ToolCallError::OAuth(mapped) = oauth_tool_error(source) else {
+                panic!("OAuth errors must remain typed");
+            };
+            assert_eq!(mapped.code(), code);
+            assert!(matches!(
+                (mapped, expected),
+                (ToolCallOAuthError::Validation { .. }, Expected::Validation)
+                    | (ToolCallOAuthError::ConnectionRequired, Expected::Required)
+                    | (ToolCallOAuthError::Conflict { .. }, Expected::Conflict)
+                    | (
+                        ToolCallOAuthError::UnauthorizedTransaction,
+                        Expected::Unauthorized
+                    )
+                    | (ToolCallOAuthError::AuthorizationDenied, Expected::Denied)
+                    | (ToolCallOAuthError::Upstream { .. }, Expected::Upstream)
+                    | (ToolCallOAuthError::Internal, Expected::Internal)
+            ));
+        }
+    }
+
+    #[test]
+    fn mcp_http_setup_error_mapping_is_typed_and_exhaustive() {
+        use crate::mcp::upstream::http::StreamableHttpError;
+
+        assert_execution_error(
+            mcp_http_setup_error(StreamableHttpError::InsecureEndpoint),
+            ExpectedExecutionError::Protocol("invalid_mcp_endpoint"),
+        );
+        let protocol_unavailable = [
+            StreamableHttpError::ReservedHeader,
+            StreamableHttpError::InvalidProtocolVersion,
+            StreamableHttpError::InvalidClientInfo,
+            StreamableHttpError::InvalidRequest,
+            StreamableHttpError::InvalidUtf8,
+            StreamableHttpError::UnsupportedContentType,
+            StreamableHttpError::InvalidResponse,
+            StreamableHttpError::HttpStatus(reqwest::StatusCode::INTERNAL_SERVER_ERROR),
+            StreamableHttpError::InvalidSessionId,
+            StreamableHttpError::ProtocolVersionMismatch,
+            StreamableHttpError::JsonRpc {
+                code: -32_603,
+                message: "secret upstream detail".to_owned(),
+                data: Some(json!({ "secret": "secret upstream detail" })),
+            },
+            StreamableHttpError::Json(
+                serde_json::from_str::<Value>("{").expect_err("invalid JSON fixture"),
+            ),
+        ];
+        for error in protocol_unavailable {
+            assert_execution_error(
+                mcp_http_setup_error(error),
+                ExpectedExecutionError::Adapter(ToolCallAdapterErrorCode::McpProtocolUnavailable),
+            );
+        }
+        for error in [
+            StreamableHttpError::SessionExpired,
+            StreamableHttpError::SessionInvalidated,
+            StreamableHttpError::SessionChanged,
+            StreamableHttpError::NotInitialized,
+            StreamableHttpError::AlreadyInitialized,
+        ] {
+            assert_execution_error(
+                mcp_http_setup_error(error),
+                ExpectedExecutionError::Adapter(ToolCallAdapterErrorCode::McpSessionConflict),
+            );
+        }
+        for (status, expected) in [
+            (
+                reqwest::StatusCode::UNAUTHORIZED,
+                ToolCallAdapterErrorCode::McpUpstreamUnauthorized,
+            ),
+            (
+                reqwest::StatusCode::FORBIDDEN,
+                ToolCallAdapterErrorCode::McpUpstreamForbidden,
+            ),
+        ] {
+            assert_execution_error(
+                mcp_http_setup_error(StreamableHttpError::HttpStatus(status)),
+                ExpectedExecutionError::Adapter(expected),
+            );
+        }
+        for status in [
+            reqwest::StatusCode::REQUEST_TIMEOUT,
+            reqwest::StatusCode::GATEWAY_TIMEOUT,
+        ] {
+            assert_execution_error(
+                mcp_http_setup_error(StreamableHttpError::HttpStatus(status)),
+                ExpectedExecutionError::Outbound("upstream_timeout"),
+            );
+        }
+        assert_execution_error(
+            mcp_http_setup_error(StreamableHttpError::Outbound(OutboundError::Connection)),
+            ExpectedExecutionError::Outbound("upstream_connection_failed"),
+        );
+    }
+
+    #[tokio::test]
+    async fn mcp_static_and_managed_auth_rejections_are_not_binding_conflicts() {
+        use crate::mcp::upstream::http::{StreamableHttpConfig, StreamableHttpTransport};
+
+        async fn rejected_setup(
+            token: &'static str,
+            status: reqwest::StatusCode,
+        ) -> Result<ToolCallError, String> {
+            let listener = TcpListener::bind("127.0.0.1:0")
+                .await
+                .map_err(|error| format!("MCP fixture bind failed: {error}"))?;
+            let mut config = StreamableHttpConfig::new(format!(
+                "http://{}/mcp",
+                listener
+                    .local_addr()
+                    .map_err(|error| format!("MCP fixture address failed: {error}"))?
+            ));
+            config.allow_private_networks = true;
+            config.headers.insert(
+                reqwest::header::AUTHORIZATION,
+                reqwest::header::HeaderValue::from_str(&format!("Bearer {token}"))
+                    .map_err(|error| format!("MCP fixture authorization failed: {error}"))?,
+            );
+            let server = async move {
+                let (mut connection, _) = listener
+                    .accept()
+                    .await
+                    .map_err(|error| format!("MCP fixture accept failed: {error}"))?;
+                let mut request = vec![0_u8; 4096];
+                let read = connection
+                    .read(&mut request)
+                    .await
+                    .map_err(|error| format!("MCP fixture read failed: {error}"))?;
+                let request = String::from_utf8_lossy(&request[..read]);
+                if !request.contains(&format!("authorization: Bearer {token}")) {
+                    return Err(
+                        "MCP fixture did not receive its configured authorization".to_owned()
+                    );
+                }
+                let response = format!(
+                    "HTTP/1.1 {} {}\r\nContent-Length: 0\r\nConnection: close\r\n\r\n",
+                    status.as_u16(),
+                    status.canonical_reason().unwrap_or("Rejected")
+                );
+                connection
+                    .write_all(response.as_bytes())
+                    .await
+                    .map_err(|error| format!("MCP fixture response failed: {error}"))?;
+                Ok::<(), String>(())
+            };
+            let client = async move {
+                let transport = StreamableHttpTransport::new(config)
+                    .map_err(|error| format!("MCP transport setup failed early: {error}"))?;
+                match transport.initialize().await {
+                    Ok(_) => Err("MCP setup unexpectedly succeeded".to_owned()),
+                    Err(error) => Ok(error),
+                }
+            };
+            let (server_result, client_result) = tokio::join!(server, client);
+            server_result?;
+            let setup_error = client_result?;
+            Ok(mcp_http_setup_error(setup_error))
+        }
+
+        let static_auth = rejected_setup("static-token", reqwest::StatusCode::UNAUTHORIZED)
+            .await
+            .expect("static MCP authorization rejection should be observed");
+        assert_execution_error(
+            static_auth,
+            ExpectedExecutionError::Adapter(ToolCallAdapterErrorCode::McpUpstreamUnauthorized),
+        );
+
+        let managed_oauth = rejected_setup("managed-oauth-token", reqwest::StatusCode::FORBIDDEN)
+            .await
+            .expect("managed OAuth MCP rejection should be observed");
+        assert_execution_error(
+            managed_oauth,
+            ExpectedExecutionError::Adapter(ToolCallAdapterErrorCode::McpUpstreamForbidden),
+        );
+
+        let binding_race = protocol_invocation_error(ProtocolInvocationError::Mcp(
+            crate::protocols::mcp::McpInvocationError::AuthorizationSetup(ProtocolError::new(
+                crate::protocols::ProtocolErrorCategory::Conflict,
+                "oauth_binding_changed",
+                "The managed OAuth connection changed.",
+            )),
+        ));
+        assert_execution_error(
+            binding_race,
+            ExpectedExecutionError::Protocol("oauth_binding_changed"),
+        );
+    }
+
+    #[test]
+    fn mcp_stdio_setup_error_mapping_is_typed_and_exhaustive() {
+        use crate::mcp::upstream::stdio::{StdioTemplateError, StdioTransportError};
+
+        for error in [
+            StdioTransportError::Template(StdioTemplateError::UnknownTemplate),
+            StdioTransportError::InvalidLimits,
+            StdioTransportError::Spawn,
+            StdioTransportError::Closed,
+            StdioTransportError::InvalidResponse,
+            StdioTransportError::JsonRpc { code: -32_603 },
+            StdioTransportError::ProcessExited {
+                code: Some(1),
+                stderr_truncated: true,
+            },
+            StdioTransportError::AmbiguousToolCall,
+            StdioTransportError::DuplicateRequestId,
+            StdioTransportError::UnexpectedResponseId,
+            StdioTransportError::Encode,
+            StdioTransportError::Decode,
+            StdioTransportError::InvalidRequest,
+            StdioTransportError::ProtocolVersionMismatch,
+        ] {
+            assert_execution_error(
+                mcp_stdio_setup_error(error),
+                ExpectedExecutionError::Adapter(ToolCallAdapterErrorCode::McpProtocolUnavailable),
+            );
+        }
+        for error in [
+            StdioTransportError::RestartRequiresInitialization,
+            StdioTransportError::NotInitialized,
+            StdioTransportError::AlreadyInitialized,
+        ] {
+            assert_execution_error(
+                mcp_stdio_setup_error(error),
+                ExpectedExecutionError::Adapter(ToolCallAdapterErrorCode::McpSessionConflict),
+            );
+        }
+        assert_execution_error(
+            mcp_stdio_setup_error(StdioTransportError::Timeout),
+            ExpectedExecutionError::Outbound("upstream_timeout"),
+        );
+        assert_execution_error(
+            mcp_stdio_setup_error(StdioTransportError::TooManyInFlight),
+            ExpectedExecutionError::Adapter(ToolCallAdapterErrorCode::McpCapacity),
+        );
+        for error in [
+            StdioTransportError::RequestTooLarge,
+            StdioTransportError::ResponseTooLarge,
+        ] {
+            assert_execution_error(
+                mcp_stdio_setup_error(error),
+                ExpectedExecutionError::Adapter(ToolCallAdapterErrorCode::McpMessageTooLarge),
+            );
+        }
+    }
+
+    async fn app_with_openapi_tool_at(
+        server_url: &str,
+        method: &str,
+        mode: ToolMode,
+    ) -> (tempfile::TempDir, ExecutorApp) {
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+            .await
+            .expect("Executor should open");
+        sqlx::query(
+            "INSERT INTO api_tokens \
+             (id, name, token_digest, token_prefix, token_suffix, created_at) \
+             VALUES ('mcp-owner', 'MCP owner', x'010203', 'exr_test', 'test', 1)",
+        )
+        .execute(app.pool())
+        .await
+        .expect("owner token");
+        sqlx::query(
+            "INSERT INTO admins (id, username, password_hash, created_at) \
+             VALUES (1, 'admin', 'unused', 1)",
+        )
+        .execute(app.pool())
+        .await
+        .expect("admin");
+        app.catalog()
+            .create_source_with_catalog(
+                CreateSource {
+                    kind: SourceKind::Openapi,
+                    preferred_slug: "mcp-approval".to_owned(),
+                    display_name: "MCP approval source".to_owned(),
+                    description: None,
+                    configuration: json!({
+                        "spec": { "type": "inline" },
+                        "allowPrivateNetwork": true
+                    })
+                    .as_object()
+                    .expect("source configuration should be an object")
+                    .clone(),
+                },
+                &CredentialPayload {
+                    schema_version: 1,
+                    payload: json!({
+                        "locator": { "type": "inline" },
+                        "credentials": { "schemes": {} }
+                    }),
+                },
+                InitialCatalogSnapshot {
+                    artifacts: vec![StagedArtifact {
+                        kind: ArtifactKind::OpenapiDocument,
+                        stable_key: "document".to_owned(),
+                        content: json!({ "openapi": "3.1.0" }),
+                    }],
+                    tools: vec![StagedTool {
+                        stable_key: "write".to_owned(),
+                        preferred_name: "write".to_owned(),
+                        display_name: "Write".to_owned(),
+                        description: None,
+                        input_schema: if mode == ToolMode::Ask {
+                            json!({
+                                "type": "object",
+                                "additionalProperties": false,
+                                "required": ["value"],
+                                "properties": { "value": { "type": "string" } }
+                            })
+                        } else {
+                            json!({
+                                "type": "object",
+                                "additionalProperties": false
+                            })
+                        },
+                        output_schema: None,
+                        input_typescript: None,
+                        output_typescript: None,
+                        typescript_definitions: BTreeMap::new(),
+                        intrinsic_mode: mode,
+                    }],
+                },
+                vec![StagedToolBinding {
+                    stable_key: "write".to_owned(),
+                    binding: ToolBinding::OpenapiV1(OpenApiBinding {
+                        version: 1,
+                        method: method.to_owned(),
+                        path_template: "/write".to_owned(),
+                        server_url: server_url.to_owned(),
+                        parameters: Vec::new(),
+                        request_body: None,
+                        security: vec![OpenApiSecurityAlternative {
+                            requirements: Vec::new(),
+                        }],
+                    }),
+                }],
+                AuditContext::system(Some("mcp-approval-test")),
+            )
+            .await
+            .expect("Ask tool should import");
+        (directory, app)
+    }
+
+    async fn app_with_mcp_ask_tool_at(server_url: &str) -> (tempfile::TempDir, ExecutorApp) {
+        app_with_openapi_tool_at(server_url, "POST", ToolMode::Ask).await
+    }
+
+    fn gateway_tool_call(request_id: &str) -> ToolCall {
+        ToolCall {
+            request_id: request_id.to_owned(),
+            actor: ToolActor::api_token("mcp-owner", Some("Gateway owner".to_owned())),
+            surface: RequestSurface::Gateway,
+            execution_id: request_id.to_owned(),
+            call_id: "gateway".to_owned(),
+            worker_generation: 0,
+            path: "mcp_approval.write".to_owned(),
+            arguments: json!({}),
+        }
+    }
+
+    async fn accept_requests_and_close(
+        listener: TcpListener,
+        method: &'static str,
+        count: usize,
+    ) -> Result<(), String> {
+        for _ in 0..count {
+            let (mut connection, _) = listener
+                .accept()
+                .await
+                .map_err(|error| format!("upstream accept failed: {error}"))?;
+            let mut request = vec![0_u8; 4096];
+            let read = connection
+                .read(&mut request)
+                .await
+                .map_err(|error| format!("upstream request read failed: {error}"))?;
+            let expected = format!("{method} /write HTTP/1.1");
+            if !String::from_utf8_lossy(&request[..read]).starts_with(&expected) {
+                return Err(format!("unexpected upstream request, expected {expected}"));
+            }
+        }
+        Ok(())
+    }
+
+    async fn serve_large_json_responses(
+        listener: TcpListener,
+        method: &'static str,
+        count: usize,
+    ) -> Result<(), String> {
+        let body = format!(r#"{{"value":"{}"}}"#, "x".repeat(MAX_RESULT_BYTES));
+        let headers = format!(
+            "HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: {}\r\nConnection: close\r\n\r\n",
+            body.len()
+        );
+        for _ in 0..count {
+            let (mut connection, _) = listener
+                .accept()
+                .await
+                .map_err(|error| format!("upstream accept failed: {error}"))?;
+            let mut request = vec![0_u8; 4096];
+            let read = connection
+                .read(&mut request)
+                .await
+                .map_err(|error| format!("upstream request read failed: {error}"))?;
+            let expected = format!("{method} /write HTTP/1.1");
+            if !String::from_utf8_lossy(&request[..read]).starts_with(&expected) {
+                return Err(format!("unexpected upstream request, expected {expected}"));
+            }
+            connection
+                .write_all(headers.as_bytes())
+                .await
+                .map_err(|error| format!("upstream response headers failed: {error}"))?;
+            connection
+                .write_all(body.as_bytes())
+                .await
+                .map_err(|error| format!("upstream response body failed: {error}"))?;
+        }
+        Ok(())
+    }
+
+    async fn serve_success_json_responses(
+        listener: TcpListener,
+        method: &'static str,
+        count: usize,
+    ) -> Result<(), String> {
+        let body = r#"{"ok":true}"#;
+        let response = format!(
+            "HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{body}",
+            body.len()
+        );
+        for _ in 0..count {
+            let (mut connection, _) = listener
+                .accept()
+                .await
+                .map_err(|error| format!("upstream accept failed: {error}"))?;
+            let mut request = vec![0_u8; 4096];
+            let read = connection
+                .read(&mut request)
+                .await
+                .map_err(|error| format!("upstream request read failed: {error}"))?;
+            let expected = format!("{method} /write HTTP/1.1");
+            if !String::from_utf8_lossy(&request[..read]).starts_with(&expected) {
+                return Err(format!("unexpected upstream request, expected {expected}"));
+            }
+            connection
+                .write_all(response.as_bytes())
+                .await
+                .map_err(|error| format!("upstream response failed: {error}"))?;
+        }
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn safe_query_transport_failures_release_the_key_for_retry() {
+        let listener = TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("test port should bind");
+        let server_url = format!(
+            "http://{}",
+            listener
+                .local_addr()
+                .expect("listener should have an address")
+        );
+        let (_directory, app) =
+            app_with_openapi_tool_at(&server_url, "GET", ToolMode::Enabled).await;
+        let scenario = tokio::time::timeout(Duration::from_secs(10), async {
+            tokio::try_join!(accept_requests_and_close(listener, "GET", 2), async {
+                for attempt in 1..=2 {
+                    let error = match app
+                        .tool_calls()
+                        .submit_gateway_idempotent(
+                            gateway_tool_call(&format!("safe-query-{attempt}")),
+                            "safe-query-retry",
+                        )
+                        .await
+                    {
+                        Ok(_) => return Err(format!("safe query attempt {attempt} succeeded")),
+                        Err(error) => error,
+                    };
+                    if !matches!(
+                        &error,
+                        GatewayInvokeError::ToolCall(ToolCallError::Outbound(
+                            OutboundError::Connection | OutboundError::Request
+                        ))
+                    ) {
+                        return Err(format!("unexpected safe query failure: {error:?}"));
+                    }
+                    let retained = sqlx::query_scalar::<_, i64>(
+                        "SELECT COUNT(*) FROM gateway_invocation_idempotency \
+                         WHERE owner_api_token_id = 'mcp-owner'",
+                    )
+                    .fetch_one(app.pool())
+                    .await
+                    .map_err(|error| format!("idempotency row count failed: {error}"))?;
+                    if retained != 0 {
+                        return Err(format!(
+                            "attempt {attempt} retained {retained} idempotency rows"
+                        ));
+                    }
+                }
+                Ok::<(), String>(())
+            })
+        })
+        .await;
+        let shutdown = tokio::time::timeout(Duration::from_secs(5), app.shutdown()).await;
+        shutdown.expect("safe query application shutdown should be bounded");
+        scenario
+            .expect("safe query scenario should settle every future")
+            .expect("safe query retries should both release their claims");
+    }
+
+    #[tokio::test]
+    async fn cancellation_after_retryable_release_finishes_cleanup_before_shutdown() {
+        let listener = TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("test upstream should bind");
+        let server_url = format!(
+            "http://{}",
+            listener
+                .local_addr()
+                .expect("listener should have an address")
+        );
+        let (_directory, app) =
+            app_with_openapi_tool_at(&server_url, "GET", ToolMode::Enabled).await;
+        let hook = Arc::new(RetryableReleaseRaceHook::default());
+        *app.tool_calls()
+            .retryable_release_race_hook
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner) = Some(hook.clone());
+
+        let service = app.tool_calls().clone();
+        let invocation = tokio::spawn(async move {
+            service
+                .submit_gateway_idempotent(
+                    gateway_tool_call("cancel-after-retryable-release"),
+                    "cancel-after-retryable-release",
+                )
+                .await
+        });
+        tokio::time::timeout(
+            Duration::from_secs(2),
+            accept_requests_and_close(listener, "GET", 1),
+        )
+        .await
+        .expect("the query should reach its upstream")
+        .expect("the query request should be valid");
+        tokio::time::timeout(Duration::from_secs(2), hook.released.notified())
+            .await
+            .expect("the retryable idempotency row should be released");
+        let retained = sqlx::query_scalar::<_, i64>(
+            "SELECT COUNT(*) FROM gateway_invocation_idempotency \
+             WHERE owner_api_token_id = 'mcp-owner'",
+        )
+        .fetch_one(app.pool())
+        .await
+        .expect("idempotency row count should read");
+        assert_eq!(retained, 0);
+
+        invocation.abort();
+        assert!(
+            invocation
+                .await
+                .expect_err("the paused invocation should be canceled")
+                .is_cancelled()
+        );
+        tokio::time::timeout(Duration::from_secs(2), hook.cleanup_started.notified())
+            .await
+            .expect("the canceled execution guard should start cleanup");
+        tokio::time::timeout(Duration::from_secs(2), hook.cleanup_completed.notified())
+            .await
+            .expect("cleanup should accept an already released row as terminal");
+
+        tokio::time::timeout(Duration::from_secs(5), app.shutdown())
+            .await
+            .expect("shutdown after retryable-release cancellation should be bounded");
+    }
+
+    #[tokio::test]
+    async fn graceful_shutdown_drains_a_paused_request_log_before_recovery() {
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+            .await
+            .expect("Executor should open");
+        let pause = app.tool_calls().request_logs.pause_next_write();
+        app.tool_calls().record_rejected_request(
+            "paused-request-log-shutdown",
+            "missing-token",
+            RequestSurface::Gateway,
+            "tools.paused",
+            "paused_failure",
+        );
+        tokio::time::timeout(Duration::from_secs(2), pause.reached())
+            .await
+            .expect("request-log consumer should reach the pause");
+
+        app.begin_shutdown();
+        let shutdown = tokio::spawn(app.shutdown());
+        pause.release();
+        assert!(
+            tokio::time::timeout(Duration::from_secs(2), pause.finished())
+                .await
+                .expect("graceful shutdown should let the paused write finish")
+        );
+        tokio::time::timeout(Duration::from_secs(5), shutdown)
+            .await
+            .expect("shutdown after a paused request log should be bounded")
+            .expect("shutdown task should not panic");
+    }
+
+    #[tokio::test]
+    async fn plain_runtime_post_oversized_result_is_durably_outcome_unknown() {
+        let listener = TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("test upstream should bind");
+        let server_url = format!(
+            "http://{}",
+            listener
+                .local_addr()
+                .expect("listener should have an address")
+        );
+        let (_directory, app) =
+            app_with_openapi_tool_at(&server_url, "POST", ToolMode::Enabled).await;
+        let dispatcher = InvocationToolDispatcher::new(
+            app.tool_calls().clone(),
+            InvocationContext {
+                request_id: "plain-ts-post".to_owned(),
+                actor: ToolActor::api_token("mcp-owner", Some("Runtime owner".to_owned())),
+                surface: RequestSurface::Cli,
+                execution_id: "plain-ts-execution".to_owned(),
+            },
+        );
+        let (upstream, result) = tokio::join!(
+            serve_large_json_responses(listener, "POST", 1),
+            dispatcher.dispatch(
+                RuntimeToolCall {
+                    execution_id: "plain-ts-execution".to_owned(),
+                    worker_generation: 1,
+                    call_id: 1,
+                    path: "mcp_approval.write".to_owned(),
+                    arguments: json!({}),
+                },
+                ExecutionCancellation::default(),
+            )
+        );
+        upstream.expect("one POST should reach the upstream");
+        assert!(
+            matches!(
+                &result,
+            RuntimeToolResult::Failure { code, .. }
+                if code == ToolCallAdapterErrorCode::InvocationOutcomeUnknown.as_str()
+            ),
+            "unexpected plain runtime result: {result:?}"
+        );
+        let log = app
+            .catalog()
+            .request_log("plain-ts-post:call:1")
+            .await
+            .expect("uncertain plain runtime call should be durably logged");
+        assert_eq!(log.outcome, RequestOutcome::Failed);
+        assert_eq!(
+            log.error_code.as_deref(),
+            Some(ToolCallAdapterErrorCode::InvocationOutcomeUnknown.as_str())
+        );
+        tokio::time::timeout(Duration::from_secs(5), app.shutdown())
+            .await
+            .expect("plain runtime outcome-unknown shutdown should be bounded");
+    }
+
+    #[tokio::test]
+    async fn runtime_cancellation_after_post_receipt_durably_records_outcome_unknown() {
+        let listener = TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("test upstream should bind");
+        let server_url = format!(
+            "http://{}",
+            listener
+                .local_addr()
+                .expect("listener should have an address")
+        );
+        let (_directory, app) =
+            app_with_openapi_tool_at(&server_url, "POST", ToolMode::Enabled).await;
+        let upstream_calls = Arc::new(std::sync::atomic::AtomicUsize::new(0));
+        let counted_calls = upstream_calls.clone();
+        let (received, receipt) = oneshot::channel();
+        let (release, released) = oneshot::channel();
+        let upstream = tokio::spawn(async move {
+            let (mut connection, _) = listener.accept().await.expect("POST should connect");
+            counted_calls.fetch_add(1, Ordering::SeqCst);
+            let mut request = vec![0_u8; 4096];
+            let read = connection
+                .read(&mut request)
+                .await
+                .expect("POST should be readable");
+            assert!(String::from_utf8_lossy(&request[..read]).starts_with("POST /write HTTP/1.1"));
+            let _ = received.send(());
+            let _ = released.await;
+            let _ = connection
+                .write_all(
+                    b"HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: 11\r\nConnection: close\r\n\r\n{\"ok\":true}",
+                )
+                .await;
+        });
+        let dispatcher = Arc::new(InvocationToolDispatcher::new(
+            app.tool_calls().clone(),
+            InvocationContext {
+                request_id: "cancel-after-receipt".to_owned(),
+                actor: ToolActor::api_token("mcp-owner", Some("Runtime owner".to_owned())),
+                surface: RequestSurface::Cli,
+                execution_id: "cancel-after-receipt-execution".to_owned(),
+            },
+        ));
+        let cancellation = ExecutionCancellation::default();
+        let dispatched = {
+            let dispatcher = dispatcher.clone();
+            let cancellation = cancellation.clone();
+            tokio::spawn(async move {
+                dispatcher
+                    .dispatch(
+                        RuntimeToolCall {
+                            execution_id: "cancel-after-receipt-execution".to_owned(),
+                            worker_generation: 1,
+                            call_id: 1,
+                            path: "mcp_approval.write".to_owned(),
+                            arguments: json!({}),
+                        },
+                        cancellation,
+                    )
+                    .await
+            })
+        };
+        tokio::time::timeout(Duration::from_secs(2), receipt)
+            .await
+            .expect("POST should reach the upstream before cancellation")
+            .expect("receipt signal should send");
+        cancellation.cancel();
+        let result = tokio::time::timeout(Duration::from_secs(2), dispatched)
+            .await
+            .expect("runtime cancellation should return promptly")
+            .expect("dispatch task should not panic");
+        assert!(matches!(
+            result,
+            RuntimeToolResult::InternalFailure { code } if code == "execution_cancelled"
+        ));
+        let log = tokio::time::timeout(Duration::from_secs(2), async {
+            loop {
+                if let Ok(log) = app
+                    .catalog()
+                    .request_log("cancel-after-receipt:call:1")
+                    .await
+                {
+                    break log;
+                }
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .expect("cancellation recovery should durably persist its request log");
+        assert_eq!(
+            log.error_code.as_deref(),
+            Some(ToolCallAdapterErrorCode::InvocationOutcomeUnknown.as_str())
+        );
+        assert_eq!(upstream_calls.load(Ordering::SeqCst), 1);
+        let _ = release.send(());
+        upstream.await.expect("upstream task should not panic");
+        tokio::time::timeout(Duration::from_secs(5), app.shutdown())
+            .await
+            .expect("cancel-after-receipt shutdown should be bounded");
+    }
+
+    #[tokio::test]
+    async fn approved_non_mcp_oversized_mutation_is_durably_outcome_unknown() {
+        let listener = TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("test upstream should bind");
+        let server_url = format!(
+            "http://{}",
+            listener
+                .local_addr()
+                .expect("listener should have an address")
+        );
+        let (_directory, app) =
+            app_with_openapi_tool_at(&server_url, "POST", ToolMode::Enabled).await;
+        let tool = app
+            .catalog()
+            .list_tools(ListToolsFilter {
+                limit: 1,
+                ..Default::default()
+            })
+            .await
+            .expect("test tool should list")
+            .items
+            .into_iter()
+            .next()
+            .expect("test tool should exist");
+        app.catalog()
+            .set_tool_mode(
+                &tool.id,
+                Some(ToolMode::Ask),
+                tool.revision,
+                AuditContext::system(Some("ask-oversized-mode")),
+            )
+            .await
+            .expect("test tool should switch to Ask mode");
+        let upstream = tokio::spawn(serve_large_json_responses(listener, "POST", 1));
+        let dispatcher = Arc::new(InvocationToolDispatcher::new(
+            app.tool_calls().clone(),
+            InvocationContext {
+                request_id: "ask-oversized-post".to_owned(),
+                actor: ToolActor::api_token("mcp-owner", Some("Runtime owner".to_owned())),
+                surface: RequestSurface::Cli,
+                execution_id: "ask-oversized-execution".to_owned(),
+            },
+        ));
+        let dispatched = {
+            let dispatcher = dispatcher.clone();
+            tokio::spawn(async move {
+                dispatcher
+                    .dispatch(
+                        RuntimeToolCall {
+                            execution_id: "ask-oversized-execution".to_owned(),
+                            worker_generation: 1,
+                            call_id: 1,
+                            path: "mcp_approval.write".to_owned(),
+                            arguments: json!({}),
+                        },
+                        ExecutionCancellation::default(),
+                    )
+                    .await
+            })
+        };
+        let approval = tokio::time::timeout(Duration::from_secs(2), async {
+            loop {
+                if let Some(approval) = app
+                    .tool_calls()
+                    .approvals()
+                    .list_admin(crate::approval::ApprovalListQuery {
+                        before_sequence: None,
+                        limit: 1,
+                        status: None,
+                    })
+                    .await
+                    .expect("approvals should list")
+                    .items
+                    .into_iter()
+                    .next()
+                {
+                    break approval;
+                }
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .expect("Ask approval should appear");
+        app.tool_calls()
+            .decide(
+                &approval.id,
+                "approve-oversized-post",
+                approval.revision,
+                ApprovalDecision::Approve,
+                1,
+            )
+            .await
+            .expect("Ask approval should persist");
+        let result = tokio::time::timeout(Duration::from_secs(15), dispatched)
+            .await
+            .expect("approved POST should settle")
+            .expect("dispatch task should not panic");
+        upstream.abort();
+        let _ = upstream.await;
+        assert!(
+            matches!(
+                &result,
+                RuntimeToolResult::Failure { code, .. }
+                    if code == ToolCallAdapterErrorCode::InvocationOutcomeUnknown.as_str()
+            ),
+            "unexpected approved runtime result: {result:?}"
+        );
+        let terminal = app
+            .tool_calls()
+            .approvals()
+            .get_admin(&approval.id)
+            .await
+            .expect("approval should read")
+            .expect("approval should remain stored");
+        assert_eq!(terminal.record.status, ApprovalStatus::Interrupted);
+        assert_eq!(
+            terminal.record.failure_code.as_deref(),
+            Some(ToolCallAdapterErrorCode::InvocationOutcomeUnknown.as_str())
+        );
+        let logged_code = tokio::time::timeout(Duration::from_secs(2), async {
+            loop {
+                if let Some(code) = sqlx::query_scalar::<_, String>(
+                    "SELECT error_code FROM request_logs \
+                     WHERE approval_id = ? AND error_code = ?",
+                )
+                .bind(&approval.id)
+                .bind(ToolCallAdapterErrorCode::InvocationOutcomeUnknown.as_str())
+                .fetch_optional(app.pool())
+                .await
+                .expect("approval request log should read")
+                {
+                    break code;
+                }
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .expect("approval outbox should durably flush");
+        assert_eq!(
+            logged_code,
+            ToolCallAdapterErrorCode::InvocationOutcomeUnknown.as_str()
+        );
+        tokio::time::timeout(Duration::from_secs(5), app.shutdown())
+            .await
+            .expect("approved outcome-unknown shutdown should be bounded");
+    }
+
+    #[tokio::test]
+    async fn post_dispatch_response_capacity_returns_stable_outcome_unknown() {
+        let listener = TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("test upstream should bind");
+        let server_url = format!(
+            "http://{}",
+            listener
+                .local_addr()
+                .expect("listener should have an address")
+        );
+        let (_directory, app) =
+            app_with_openapi_tool_at(&server_url, "POST", ToolMode::Enabled).await;
+        let upstream = tokio::spawn(serve_success_json_responses(listener, "POST", 1));
+        let mut capacity_service = app.tool_calls().clone();
+        capacity_service.idempotency = capacity_service
+            .idempotency
+            .clone()
+            .with_response_ciphertext_capacity(0);
+        let first = capacity_service
+            .submit_gateway_idempotent(
+                gateway_tool_call("response-capacity-first"),
+                "response-capacity",
+            )
+            .await
+            .expect_err("post-dispatch response capacity must be indeterminate");
+        assert!(matches!(first, GatewayInvokeError::OutcomeUnknown));
+        upstream
+            .await
+            .expect("upstream task should not panic")
+            .expect("exactly one POST should reach upstream");
+        let retry = capacity_service
+            .submit_gateway_idempotent(
+                gateway_tool_call("response-capacity-retry"),
+                "response-capacity",
+            )
+            .await
+            .expect_err("same-key retry must remain indeterminate");
+        assert!(matches!(retry, GatewayInvokeError::OutcomeUnknown));
+        let state = sqlx::query_scalar::<_, String>(
+            "SELECT state FROM gateway_invocation_idempotency \
+             WHERE owner_api_token_id = 'mcp-owner'",
+        )
+        .fetch_one(app.pool())
+        .await
+        .expect("idempotency state should read");
+        assert_eq!(state, "indeterminate");
+        let log = app
+            .catalog()
+            .request_log("response-capacity-first")
+            .await
+            .expect("post-dispatch capacity should be durably logged");
+        assert_eq!(
+            log.error_code.as_deref(),
+            Some(ToolCallAdapterErrorCode::InvocationOutcomeUnknown.as_str())
+        );
+        tokio::time::timeout(Duration::from_secs(5), app.shutdown())
+            .await
+            .expect("response-capacity shutdown should be bounded");
+    }
+
+    #[tokio::test]
+    async fn repeated_cancellation_recovery_coalesces_to_one_worker() {
+        let (_directory, app) = app_with_mcp_ask_tool_at("http://127.0.0.1:9").await;
+        let hook = Arc::new(CancelExecutionHook::default());
+        hook.block_retries.store(true, Ordering::SeqCst);
+        *app.tool_calls()
+            .cancel_execution_hook
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner) = Some(hook.clone());
+        let execution_id = "repeated-cancellation-recovery";
+        app.tool_calls().mark_execution_lost(execution_id).await;
+        for _ in 0..64 {
+            app.tool_calls().defer_execution_cancellation(execution_id);
+        }
+        tokio::time::timeout(Duration::from_secs(2), async {
+            while hook.retry_waiters.load(Ordering::SeqCst) < 1 {
+                hook.retry_waiting.notified().await;
+            }
+        })
+        .await
+        .expect("the keyed cancellation worker should start");
+        assert_eq!(hook.retry_waiters.load(Ordering::SeqCst), 1);
+        assert_eq!(
+            app.tool_calls()
+                .in_flight_execution_cancellations
+                .lock()
+                .unwrap_or_else(std::sync::PoisonError::into_inner)
+                .len(),
+            1
+        );
+        for _ in 0..64 {
+            app.tool_calls().defer_execution_cancellation(execution_id);
+        }
+        tokio::task::yield_now().await;
+        assert_eq!(hook.retry_waiters.load(Ordering::SeqCst), 1);
+        hook.block_retries.store(false, Ordering::SeqCst);
+        hook.release_retries.notify_waiters();
+        tokio::time::timeout(Duration::from_secs(2), async {
+            loop {
+                let in_flight = app
+                    .tool_calls()
+                    .in_flight_execution_cancellations
+                    .lock()
+                    .unwrap_or_else(std::sync::PoisonError::into_inner)
+                    .contains(execution_id);
+                if !in_flight {
+                    break;
+                }
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .expect("the keyed cancellation worker should finish");
+        assert!(
+            !app.tool_calls()
+                .deferred_execution_cancellations
+                .read()
+                .await
+                .contains(execution_id)
+        );
+        tokio::time::timeout(Duration::from_secs(5), app.shutdown())
+            .await
+            .expect("coalesced cancellation shutdown should be bounded");
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+    async fn newer_lost_signal_stays_fenced_while_older_recovery_finishes() {
+        let (_directory, app) = app_with_mcp_ask_tool_at("http://127.0.0.1:9").await;
+        let execution_id = "old-finish-new-mark-approve";
+        let submission = app
+            .tool_calls()
+            .submit(ToolCall {
+                request_id: "old-finish-new-mark-approve-request".to_owned(),
+                actor: ToolActor::api_token("mcp-owner", Some("Runtime owner".to_owned())),
+                surface: RequestSurface::Cli,
+                execution_id: execution_id.to_owned(),
+                call_id: "1".to_owned(),
+                worker_generation: 1,
+                path: "mcp_approval.write".to_owned(),
+                arguments: json!({ "value": "write once" }),
+            })
+            .await
+            .expect("Ask submission should persist");
+        let ToolCallSubmission::ApprovalRequired(approval) = submission else {
+            panic!("Ask submission should require approval");
+        };
+        let approval_id = approval.id.clone();
+        let approval_revision = approval.revision;
+        drop(approval);
+
+        let execution_hook = Arc::new(ApprovedExecutionHook::default());
+        *app.tool_calls()
+            .approved_execution_hook
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner) = Some(execution_hook.clone());
+        let cancel_hook = Arc::new(CancelExecutionHook::default());
+        cancel_hook.block_retries.store(true, Ordering::SeqCst);
+        *app.tool_calls()
+            .cancel_execution_hook
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner) = Some(cancel_hook.clone());
+
+        app.tool_calls().mark_execution_lost(execution_id).await;
+        app.tool_calls()
+            .in_flight_execution_cancellations
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+            .insert(execution_id.to_owned());
+        let race_hook = Arc::new(ExecutionCancellationRecoveryRaceHook::default());
+        *app.tool_calls()
+            .execution_cancellation_recovery_race_hook
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner) = Some(race_hook.clone());
+
+        let old_finish = {
+            let service = app.tool_calls().clone();
+            let execution_id = execution_id.to_owned();
+            tokio::spawn(async move {
+                service
+                    .finish_execution_cancellation_recovery(&execution_id)
+                    .await;
+            })
+        };
+        race_hook.old_finish_write_acquired.wait();
+
+        let new_recovery = {
+            let service = app.tool_calls().clone();
+            let execution_id = execution_id.to_owned();
+            tokio::spawn(async move {
+                service.cancel_lost_execution(&execution_id).await;
+            })
+        };
+        tokio::time::timeout(
+            Duration::from_secs(2),
+            race_hook.new_mark_write_queued.notified(),
+        )
+        .await
+        .expect("the newer lost signal should queue behind the older recovery");
+
+        let decision = {
+            let service = app.tool_calls().clone();
+            let approval_id = approval_id.clone();
+            tokio::spawn(async move {
+                service
+                    .decide(
+                        &approval_id,
+                        "approve-after-new-lost-signal",
+                        approval_revision,
+                        ApprovalDecision::Approve,
+                        1,
+                    )
+                    .await
+            })
+        };
+        tokio::task::yield_now().await;
+        assert!(!new_recovery.is_finished());
+        assert!(!decision.is_finished());
+
+        race_hook.release_old_finish.wait();
+        old_finish
+            .await
+            .expect("the older recovery should finish without panicking");
+        tokio::time::timeout(Duration::from_secs(2), async {
+            while cancel_hook.retry_waiters.load(Ordering::SeqCst) < 2 {
+                cancel_hook.retry_waiting.notified().await;
+            }
+        })
+        .await
+        .expect("both recovery and approval should remain behind cancellation persistence");
+        assert_eq!(execution_hook.dispatches.load(Ordering::SeqCst), 0);
+        let pending = app
+            .tool_calls()
+            .approvals()
+            .get_admin(&approval_id)
+            .await
+            .expect("approval should read while cancellation is blocked")
+            .expect("approval should remain stored");
+        assert_eq!(pending.record.status, ApprovalStatus::Pending);
+
+        *app.tool_calls()
+            .execution_cancellation_recovery_race_hook
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner) = None;
+        cancel_hook.block_retries.store(false, Ordering::SeqCst);
+        cancel_hook.release_retries.notify_waiters();
+        new_recovery
+            .await
+            .expect("the newer recovery should finish without panicking");
+        let decision = decision
+            .await
+            .expect("the racing approval task should not panic");
+        assert!(matches!(
+            decision,
+            Err(ApprovalError::InvalidTransition {
+                status: ApprovalStatus::Canceled
+            })
+        ));
+        let terminal = app
+            .tool_calls()
+            .approvals()
+            .get_admin(&approval_id)
+            .await
+            .expect("approval should read after recovery")
+            .expect("approval should remain stored after recovery");
+        assert_eq!(terminal.record.status, ApprovalStatus::Canceled);
+        assert_eq!(execution_hook.dispatches.load(Ordering::SeqCst), 0);
+        assert!(
+            !app.tool_calls()
+                .deferred_execution_cancellations
+                .read()
+                .await
+                .contains(execution_id)
+        );
+        assert!(
+            !app.tool_calls()
+                .in_flight_execution_cancellations
+                .lock()
+                .unwrap_or_else(std::sync::PoisonError::into_inner)
+                .contains(execution_id)
+        );
+        tokio::time::timeout(Duration::from_secs(5), app.shutdown())
+            .await
+            .expect("interleaved cancellation shutdown should be bounded");
+    }
+
+    #[tokio::test]
+    async fn oversized_mutation_result_is_indeterminate_after_dispatch() {
+        let listener = TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("test upstream should bind");
+        let server_url = format!(
+            "http://{}",
+            listener
+                .local_addr()
+                .expect("listener should have an address")
+        );
+        let (_directory, app) =
+            app_with_openapi_tool_at(&server_url, "POST", ToolMode::Enabled).await;
+        let scenario = tokio::time::timeout(Duration::from_secs(15), async {
+            tokio::try_join!(serve_large_json_responses(listener, "POST", 1), async {
+                let first = match app
+                    .tool_calls()
+                    .submit_gateway_idempotent(
+                        gateway_tool_call("oversized-mutation-first"),
+                        "oversized-mutation",
+                    )
+                    .await
+                {
+                    Ok(_) => return Err("oversized mutation unexpectedly succeeded".to_owned()),
+                    Err(error) => error,
+                };
+                if !matches!(
+                    first,
+                    GatewayInvokeError::ToolCall(ToolCallError::Adapter {
+                        code: ToolCallAdapterErrorCode::InvocationOutcomeUnknown,
+                        ..
+                    })
+                ) {
+                    return Err(format!("unexpected oversized mutation failure: {first:?}"));
+                }
+                let state = sqlx::query_scalar::<_, String>(
+                    "SELECT state FROM gateway_invocation_idempotency \
+                     WHERE owner_api_token_id = 'mcp-owner'",
+                )
+                .fetch_one(app.pool())
+                .await
+                .map_err(|error| format!("idempotency state failed: {error}"))?;
+                if state != "indeterminate" {
+                    return Err(format!("oversized mutation settled as {state}"));
+                }
+                let replay = match app
+                    .tool_calls()
+                    .submit_gateway_idempotent(
+                        gateway_tool_call("oversized-mutation-retry"),
+                        "oversized-mutation",
+                    )
+                    .await
+                {
+                    Ok(_) => return Err("oversized mutation retry succeeded".to_owned()),
+                    Err(error) => error,
+                };
+                if !matches!(replay, GatewayInvokeError::OutcomeUnknown) {
+                    return Err(format!("unexpected oversized mutation retry: {replay:?}"));
+                }
+                Ok::<(), String>(())
+            })
+        })
+        .await;
+        app.shutdown().await;
+        scenario
+            .expect("oversized mutation scenario should settle every future")
+            .expect("oversized mutation should remain indeterminate");
+    }
+
+    #[tokio::test]
+    async fn oversized_query_result_releases_the_key_for_retry() {
+        let listener = TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("test upstream should bind");
+        let server_url = format!(
+            "http://{}",
+            listener
+                .local_addr()
+                .expect("listener should have an address")
+        );
+        let (_directory, app) =
+            app_with_openapi_tool_at(&server_url, "GET", ToolMode::Enabled).await;
+        let scenario = tokio::time::timeout(Duration::from_secs(20), async {
+            tokio::try_join!(serve_large_json_responses(listener, "GET", 2), async {
+                for attempt in 1..=2 {
+                    let error = match app
+                        .tool_calls()
+                        .submit_gateway_idempotent(
+                            gateway_tool_call(&format!("oversized-query-{attempt}")),
+                            "oversized-query",
+                        )
+                        .await
+                    {
+                        Ok(_) => {
+                            return Err(format!(
+                                "oversized query attempt {attempt} unexpectedly succeeded"
+                            ));
+                        }
+                        Err(error) => error,
+                    };
+                    if !matches!(
+                        error,
+                        GatewayInvokeError::ToolCall(ToolCallError::ResultTooLarge)
+                    ) {
+                        return Err(format!("unexpected oversized query failure: {error:?}"));
+                    }
+                    let retained = sqlx::query_scalar::<_, i64>(
+                        "SELECT COUNT(*) FROM gateway_invocation_idempotency \
+                         WHERE owner_api_token_id = 'mcp-owner'",
+                    )
+                    .fetch_one(app.pool())
+                    .await
+                    .map_err(|error| format!("idempotency row count failed: {error}"))?;
+                    if retained != 0 {
+                        return Err(format!(
+                            "oversized query attempt {attempt} retained {retained} claims"
+                        ));
+                    }
+                }
+                Ok::<(), String>(())
+            })
+        })
+        .await;
+        app.shutdown().await;
+        scenario
+            .expect("oversized query scenario should settle every future")
+            .expect("oversized query retries should both release their claims");
+    }
+
+    #[tokio::test]
+    async fn ambiguous_mutation_transport_failures_remain_indeterminate() {
+        let listener = TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("test upstream should bind");
+        let server_url = format!(
+            "http://{}",
+            listener
+                .local_addr()
+                .expect("listener should have an address")
+        );
+        let upstream = tokio::spawn(async move {
+            let (mut connection, _) = listener.accept().await.expect("request should connect");
+            let mut request = vec![0_u8; 4096];
+            let read = connection
+                .read(&mut request)
+                .await
+                .expect("request should be readable");
+            assert!(String::from_utf8_lossy(&request[..read]).starts_with("POST /write HTTP/1.1"));
+        });
+        let (_directory, app) =
+            app_with_openapi_tool_at(&server_url, "POST", ToolMode::Enabled).await;
+
+        let first = app
+            .tool_calls()
+            .submit_gateway_idempotent(
+                gateway_tool_call("ambiguous-mutation-first"),
+                "ambiguous-mutation",
+            )
+            .await
+            .expect_err("post-dispatch disconnect should be uncertain");
+        assert!(
+            matches!(
+                &first,
+                GatewayInvokeError::ToolCall(ToolCallError::Adapter {
+                    code: ToolCallAdapterErrorCode::OpenApiOutcomeUnknown,
+                    ..
+                })
+            ),
+            "unexpected ambiguous mutation failure: {first:?}"
+        );
+        upstream.await.expect("upstream task should finish");
+        let state = sqlx::query_scalar::<_, String>(
+            "SELECT state FROM gateway_invocation_idempotency \
+             WHERE owner_api_token_id = 'mcp-owner'",
+        )
+        .fetch_one(app.pool())
+        .await
+        .expect("idempotency state should read");
+        assert_eq!(state, "indeterminate");
+
+        let replay = app
+            .tool_calls()
+            .submit_gateway_idempotent(
+                gateway_tool_call("ambiguous-mutation-retry"),
+                "ambiguous-mutation",
+            )
+            .await
+            .expect_err("same-key retry must preserve uncertainty");
+        assert!(matches!(replay, GatewayInvokeError::OutcomeUnknown));
+        app.shutdown().await;
+    }
+
+    #[tokio::test]
+    async fn canceled_pre_execution_task_releases_its_reservation() {
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let pool = SqlitePoolOptions::new()
+            .max_connections(4)
+            .connect_with(
+                SqliteConnectOptions::new()
+                    .filename(directory.path().join("guard.db"))
+                    .create_if_missing(true)
+                    .foreign_keys(true)
+                    .busy_timeout(Duration::from_secs(2)),
+            )
+            .await
+            .expect("database pool");
+        MIGRATOR.run(&pool).await.expect("migrations");
+        sqlx::query(
+            "INSERT INTO api_tokens (id, name, token_digest, token_prefix, token_suffix, created_at) \
+             VALUES ('owner', 'Owner', zeroblob(32), 'tok_', 'tail', 1)",
+        )
+        .execute(&pool)
+        .await
+        .expect("owner token");
+        let store = GatewayIdempotencyStore::new(
+            pool.clone(),
+            Keyring::from_master_key([9; 32]).expect("keyring"),
+        );
+        let arguments = json!({});
+        let claim = store
+            .claim(IdempotencyRequest {
+                owner: IdempotencyOwner {
+                    owner_api_token_id: "owner",
+                },
+                key: "canceled-call",
+                route: GATEWAY_INVOKE_ROUTE,
+                callable_path: "tools.source.tool",
+                arguments: &arguments,
+            })
+            .await
+            .expect("reservation");
+        let IdempotencyClaim::Fresh(record) = claim else {
+            panic!("claim must be fresh");
+        };
+        let tasks = TaskTracker::default();
+        let (ready, waiting) = oneshot::channel();
+        let guard_store = store.clone();
+        let guard_tasks = tasks.clone();
+        let guard_approvals = ApprovalStore::system(
+            pool.clone(),
+            Keyring::from_master_key([9; 32]).expect("guard keyring"),
+        );
+        let task = tokio::spawn(async move {
+            let _guard =
+                IdempotencyReservationGuard::new(record, guard_store, guard_approvals, guard_tasks);
+            let _ = ready.send(());
+            pending::<()>().await;
+        });
+        waiting.await.expect("guard task starts");
+        task.abort();
+        let _ = task.await;
+        tokio::time::timeout(Duration::from_secs(2), async {
+            loop {
+                let count = sqlx::query_scalar::<_, i64>(
+                    "SELECT COUNT(*) FROM gateway_invocation_idempotency",
+                )
+                .fetch_one(&pool)
+                .await
+                .expect("idempotency rows count");
+                if count == 0 {
+                    break;
+                }
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .expect("reservation is released without restart");
+
+        let execution_claim = store
+            .claim(IdempotencyRequest {
+                owner: IdempotencyOwner {
+                    owner_api_token_id: "owner",
+                },
+                key: "canceled-execution",
+                route: GATEWAY_INVOKE_ROUTE,
+                callable_path: "tools.source.tool",
+                arguments: &arguments,
+            })
+            .await
+            .expect("execution reservation");
+        let IdempotencyClaim::Fresh(execution_record) = execution_claim else {
+            panic!("execution claim must be fresh");
+        };
+        store
+            .mark_executing(&execution_record.id)
+            .await
+            .expect("execution boundary");
+        let (ready, waiting) = oneshot::channel();
+        let execution_store = store.clone();
+        let execution_tasks = tasks.clone();
+        let execution_id = execution_record.id.clone();
+        let task = tokio::spawn(async move {
+            let _guard =
+                IdempotencyExecutionGuard::new(execution_id, execution_store, execution_tasks);
+            let _ = ready.send(());
+            pending::<()>().await;
+        });
+        waiting.await.expect("execution guard task starts");
+        task.abort();
+        let _ = task.await;
+        tokio::time::timeout(Duration::from_secs(2), async {
+            loop {
+                let state = sqlx::query_scalar::<_, String>(
+                    "SELECT state FROM gateway_invocation_idempotency WHERE id = ?",
+                )
+                .bind(&execution_record.id)
+                .fetch_one(&pool)
+                .await
+                .expect("execution state reads");
+                if state == "indeterminate" {
+                    break;
+                }
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .expect("aborted execution becomes indeterminate without restart");
+
+        let ask_claim = store
+            .claim(IdempotencyRequest {
+                owner: IdempotencyOwner {
+                    owner_api_token_id: "owner",
+                },
+                key: "canceled-ask-completion",
+                route: GATEWAY_INVOKE_ROUTE,
+                callable_path: "tools.source.tool",
+                arguments: &arguments,
+            })
+            .await
+            .expect("Ask reservation");
+        let IdempotencyClaim::Fresh(ask_record) = ask_claim else {
+            panic!("Ask claim must be fresh");
+        };
+        sqlx::query(
+            "INSERT INTO approvals ( \
+                 id, execution_id, call_id, worker_generation, actor_kind, actor_id, \
+                 actor_api_token_id, surface, source_id, tool_id, callable_path_snapshot, \
+                 mode_provenance, source_revision, catalog_revision, tool_revision, \
+                 binding_revision, arguments_digest, arguments_ciphertext, \
+                 redacted_arguments_ciphertext, input_schema_ciphertext, \
+                 invocation_snapshot_ciphertext, status, created_at, updated_at, expires_at \
+             ) VALUES ( \
+                 'guard-approval', ?, 'gateway', 0, 'api_token', 'owner', 'owner', \
+                 'gateway', 'source', 'tool', 'tools.source.tool', 'intrinsic', \
+                 0, 0, 0, 0, zeroblob(32), zeroblob(42), zeroblob(42), zeroblob(42), \
+                 zeroblob(42), 'pending', 1, 1, 601 \
+             )",
+        )
+        .bind(idempotency_execution_id(&ask_record.id))
+        .execute(&pool)
+        .await
+        .expect("Ask approval fixture");
+        let response = IdempotencyResponse {
+            status: 202,
+            headers: BTreeMap::new(),
+            body: b"approval required".to_vec(),
+        };
+        let mut lock = pool.acquire().await.expect("writer connection");
+        sqlx::query("BEGIN IMMEDIATE")
+            .execute(&mut *lock)
+            .await
+            .expect("writer lock");
+        let (ready, waiting) = oneshot::channel();
+        let completion_store = store.clone();
+        let completion_tasks = tasks.clone();
+        let completion_record = ask_record.clone();
+        let completion_response = response.clone();
+        let task = tokio::spawn(async move {
+            let mut guard = IdempotencyAskCompletionGuard::new(
+                completion_record.id.clone(),
+                "guard-approval".to_owned(),
+                completion_response.clone(),
+                completion_store.clone(),
+                completion_tasks,
+            );
+            let _ = ready.send(());
+            if completion_store
+                .complete(
+                    &completion_record.id,
+                    IdempotencyResponseKind::Approval,
+                    &completion_response,
+                    Some("guard-approval"),
+                )
+                .await
+                .is_ok()
+            {
+                guard.disarm();
+            }
+        });
+        waiting.await.expect("Ask completion starts");
+        tokio::time::sleep(Duration::from_millis(25)).await;
+        task.abort();
+        let _ = task.await;
+        sqlx::query("ROLLBACK")
+            .execute(&mut *lock)
+            .await
+            .expect("writer lock releases");
+        drop(lock);
+        tokio::time::timeout(Duration::from_secs(2), async {
+            loop {
+                let state = sqlx::query_scalar::<_, String>(
+                    "SELECT state FROM gateway_invocation_idempotency WHERE id = ?",
+                )
+                .bind(&ask_record.id)
+                .fetch_one(&pool)
+                .await
+                .expect("Ask completion state reads");
+                if state == "completed" {
+                    break;
+                }
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .expect("dropped Ask completion is durably finished");
+        tasks.shutdown().await;
+    }
+
+    #[tokio::test]
+    async fn explicit_mcp_ask_cancellation_blocks_later_approval_and_replays_canceled() {
+        let listener = TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("test upstream should bind");
+        let server_url = format!(
+            "http://{}",
+            listener
+                .local_addr()
+                .expect("listener should have an address")
+        );
+        let upstream_count = Arc::new(std::sync::atomic::AtomicUsize::new(0));
+        let server_count = upstream_count.clone();
+        let (stop_server, mut server_stopped) = oneshot::channel::<()>();
+        let upstream = tokio::spawn(async move {
+            loop {
+                tokio::select! {
+                    biased;
+                    _ = &mut server_stopped => break,
+                    accepted = listener.accept() => {
+                        let (mut connection, _) = accepted.expect("upstream should accept");
+                        server_count.fetch_add(1, Ordering::SeqCst);
+                        let mut request = vec![0_u8; 4096];
+                        let _ = connection.read(&mut request).await;
+                        let _ = connection.write_all(
+                            b"HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: 11\r\nConnection: close\r\n\r\n{\"ok\":true}",
+                        ).await;
+                    }
+                }
+            }
+        });
+        let (_directory, app) = app_with_mcp_ask_tool_at(&server_url).await;
+        let race_hook = Arc::new(ApprovalCancellationRaceHook::default());
+        *app.tool_calls()
+            .approval_cancellation_race_hook
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner) = Some(race_hook.clone());
+        let service = app.tool_calls().clone();
+        let call = ToolCall {
+            request_id: "mcp-ask-request".to_owned(),
+            actor: ToolActor::api_token("mcp-owner", Some("MCP owner".to_owned())),
+            surface: RequestSurface::Mcp,
+            execution_id: "downstream-session".to_owned(),
+            call_id: "rpc-42".to_owned(),
+            worker_generation: 0,
+            path: "mcp_approval.write".to_owned(),
+            arguments: json!({ "value": "write once" }),
+        };
+        let retry_call = call.clone();
+        let (cancel, canceled) = oneshot::channel::<()>();
+        let submission = tokio::spawn(async move {
+            service
+                .submit_mcp_idempotent(call, "POST /mcp tools/call", "session:rpc-42", async {
+                    let _ = canceled.await;
+                })
+                .await
+        });
+
+        let approval_id = tokio::time::timeout(Duration::from_secs(2), async {
+            loop {
+                if let Some(approval_id) = sqlx::query_scalar::<_, String>(
+                    "SELECT approval_id FROM approval_correlations \
+                     WHERE execution_id LIKE 'gateway-idempotency:%' AND call_id = 'gateway'",
+                )
+                .fetch_optional(app.pool())
+                .await
+                .expect("approval correlation should read")
+                {
+                    break approval_id;
+                }
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .expect("approval correlation should appear");
+        let pending_approval = app
+            .tool_calls()
+            .approvals()
+            .get_admin(&approval_id)
+            .await
+            .expect("approval should read before cancellation")
+            .expect("approval should exist before cancellation");
+        let decision_service = app.tool_calls().clone();
+        let decision_approval_id = approval_id.clone();
+        let decision = tokio::spawn(async move {
+            decision_service
+                .decide(
+                    &decision_approval_id,
+                    "approve-racing-cancel",
+                    pending_approval.record.revision,
+                    ApprovalDecision::Approve,
+                    1,
+                )
+                .await
+        });
+        tokio::time::timeout(
+            Duration::from_secs(2),
+            race_hook.decision_read_acquired.notified(),
+        )
+        .await
+        .expect("approval should hold the cancellation read fence");
+        cancel.send(()).expect("wait cancellation should send");
+        tokio::time::timeout(Duration::from_secs(2), async {
+            loop {
+                let delivery_pin = sqlx::query_scalar::<_, i64>(
+                    "SELECT EXISTS(SELECT 1 FROM approval_delivery_pins WHERE approval_id = ?)",
+                )
+                .bind(&approval_id)
+                .fetch_one(app.pool())
+                .await
+                .expect("approval delivery pin should read");
+                if delivery_pin == 0 {
+                    break;
+                }
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .expect("explicit cancellation should release delivery before fencing execution");
+        tokio::time::timeout(
+            Duration::from_secs(2),
+            race_hook.cancellation_write_queued.notified(),
+        )
+        .await
+        .expect("cancellation should queue behind the approval read fence");
+        race_hook.release_decision.notify_one();
+        let canceled = submission
+            .await
+            .expect("submission task should not panic")
+            .expect_err("submission wait should be canceled");
+        assert!(matches!(canceled, GatewayInvokeError::Canceled));
+
+        let _ = decision.await.expect("decision task should not panic");
+        tokio::time::timeout(Duration::from_secs(2), async {
+            loop {
+                let after_later_approval = app
+                    .tool_calls()
+                    .approvals()
+                    .get_admin(&approval_id)
+                    .await
+                    .expect("approval should reread")
+                    .expect("approval should remain stored");
+                if after_later_approval.record.status == ApprovalStatus::Canceled {
+                    break;
+                }
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .expect("cancellation should win before approved execution starts");
+
+        tokio::time::timeout(Duration::from_secs(2), async {
+            loop {
+                let state = sqlx::query_scalar::<_, String>(
+                    "SELECT state FROM gateway_invocation_idempotency \
+                     WHERE owner_api_token_id = 'mcp-owner'",
+                )
+                .fetch_one(app.pool())
+                .await
+                .expect("idempotency state should read");
+                if state == "completed" {
+                    break;
+                }
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .expect("settlement worker should complete the idempotency row");
+
+        let replay = app
+            .tool_calls()
+            .submit_mcp_idempotent(
+                retry_call,
+                "POST /mcp tools/call",
+                "session:rpc-42",
+                pending(),
+            )
+            .await
+            .expect("exact retry should replay");
+        assert!(replay.replayed);
+        assert!(!replay.result.ok);
+        assert_eq!(
+            replay
+                .result
+                .error
+                .as_ref()
+                .map(|error| error.code.as_str()),
+            Some("approval_canceled")
+        );
+        let (rows, state, response_kind) = sqlx::query_as::<_, (i64, String, String)>(
+            "SELECT COUNT(*), MIN(state), MIN(response_kind) \
+             FROM gateway_invocation_idempotency WHERE owner_api_token_id = 'mcp-owner'",
+        )
+        .fetch_one(app.pool())
+        .await
+        .expect("idempotency row should read");
+        assert_eq!(rows, 1);
+        assert_eq!(state, "completed");
+        assert_eq!(response_kind, "tool");
+        stop_server.send(()).expect("upstream shutdown should send");
+        upstream.await.expect("upstream task should not panic");
+        assert_eq!(upstream_count.load(Ordering::SeqCst), 0);
+        app.shutdown().await;
+    }
+
+    #[tokio::test]
+    async fn cancellation_storage_failure_keeps_execution_fenced_until_retry_succeeds() {
+        let (_directory, app) = app_with_mcp_ask_tool_at("http://127.0.0.1:9").await;
+        let execution_hook = Arc::new(ApprovedExecutionHook::default());
+        *app.tool_calls()
+            .approved_execution_hook
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner) = Some(execution_hook.clone());
+        let cancel_hook = Arc::new(CancelExecutionHook::default());
+        cancel_hook.failures.store(1, Ordering::SeqCst);
+        *app.tool_calls()
+            .cancel_execution_hook
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner) = Some(cancel_hook.clone());
+        let call = ToolCall {
+            request_id: "mcp-cancel-storage-failure".to_owned(),
+            actor: ToolActor::api_token("mcp-owner", Some("MCP owner".to_owned())),
+            surface: RequestSurface::Mcp,
+            execution_id: "downstream-session".to_owned(),
+            call_id: "rpc-cancel-storage-failure".to_owned(),
+            worker_generation: 0,
+            path: "mcp_approval.write".to_owned(),
+            arguments: json!({ "value": "write once" }),
+        };
+        let retry_call = call.clone();
+        let service = app.tool_calls().clone();
+        let (cancel, canceled) = oneshot::channel::<()>();
+        let submission = tokio::spawn(async move {
+            service
+                .submit_mcp_idempotent(
+                    call,
+                    "POST /mcp tools/call",
+                    "session:cancel-storage-failure",
+                    async {
+                        let _ = canceled.await;
+                    },
+                )
+                .await
+        });
+        let approval = tokio::time::timeout(Duration::from_secs(2), async {
+            loop {
+                if let Some(detail) = app
+                    .tool_calls()
+                    .approvals()
+                    .list_admin(crate::approval::ApprovalListQuery {
+                        before_sequence: None,
+                        limit: 1,
+                        status: None,
+                    })
+                    .await
+                    .expect("approvals should list")
+                    .items
+                    .into_iter()
+                    .next()
+                {
+                    break detail;
+                }
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .expect("approval should appear");
+        cancel.send(()).expect("explicit cancellation should send");
+        let first_result = tokio::time::timeout(Duration::from_secs(2), submission)
+            .await
+            .expect("storage failure should return to the original request")
+            .expect("submission task should not panic")
+            .expect_err("forced cancellation storage failure should surface");
+        assert!(matches!(
+            first_result,
+            GatewayInvokeError::ToolCall(ToolCallError::Approval(ApprovalError::Database(_)))
+        ));
+        tokio::time::timeout(Duration::from_secs(2), async {
+            while cancel_hook.retry_waiters.load(Ordering::SeqCst) < 1 {
+                cancel_hook.retry_waiting.notified().await;
+            }
+        })
+        .await
+        .expect("deferred cancellation retry should start");
+
+        let decision_service = app.tool_calls().clone();
+        let approval_id = approval.id.clone();
+        let decision = tokio::spawn(async move {
+            decision_service
+                .decide(
+                    &approval_id,
+                    "approve-while-cancel-retries",
+                    approval.revision,
+                    ApprovalDecision::Approve,
+                    1,
+                )
+                .await
+        });
+        tokio::time::timeout(Duration::from_secs(2), async {
+            while cancel_hook.retry_waiters.load(Ordering::SeqCst) < 2 {
+                cancel_hook.retry_waiting.notified().await;
+            }
+        })
+        .await
+        .expect("approval should remain blocked behind cancellation retry");
+        assert!(!decision.is_finished());
+        assert_eq!(execution_hook.dispatches.load(Ordering::SeqCst), 0);
+        cancel_hook.block_retries.store(false, Ordering::SeqCst);
+        cancel_hook.release_retries.notify_waiters();
+        let decision_result = decision.await.expect("decision task should not panic");
+        assert!(decision_result.is_err());
+
+        tokio::time::timeout(Duration::from_secs(2), async {
+            loop {
+                let detail = app
+                    .tool_calls()
+                    .approvals()
+                    .get_admin(&approval.id)
+                    .await
+                    .expect("approval should read")
+                    .expect("approval should remain stored");
+                if detail.record.status == ApprovalStatus::Canceled {
+                    break;
+                }
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .expect("cancellation retry should persist the canceled state");
+        let replay = app
+            .tool_calls()
+            .submit_mcp_idempotent(
+                retry_call,
+                "POST /mcp tools/call",
+                "session:cancel-storage-failure",
+                pending(),
+            )
+            .await
+            .expect("retry should replay canceled result");
+        assert!(replay.replayed);
+        assert_eq!(
+            replay
+                .result
+                .error
+                .as_ref()
+                .map(|error| error.code.as_str()),
+            Some("approval_canceled")
+        );
+        assert_eq!(execution_hook.dispatches.load(Ordering::SeqCst), 0);
+        app.shutdown().await;
+    }
+
+    #[tokio::test]
+    async fn approval_finish_failure_makes_current_and_replay_outcomes_unknown() {
+        let (_directory, app) = app_with_mcp_ask_tool_at("http://127.0.0.1:9").await;
+        let execution_hook = Arc::new(ApprovedExecutionHook::default());
+        *app.tool_calls()
+            .approved_execution_hook
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner) = Some(execution_hook.clone());
+        sqlx::query(
+            "CREATE TRIGGER fail_mcp_approval_finish \
+             BEFORE UPDATE OF status ON approvals \
+             WHEN OLD.status = 'executing' \
+              AND NEW.status IN ('succeeded', 'failed', 'interrupted') \
+             BEGIN SELECT RAISE(ABORT, 'forced approval finish failure'); END",
+        )
+        .execute(app.pool())
+        .await
+        .expect("finish failure trigger should install");
+
+        let call = ToolCall {
+            request_id: "mcp-finish-failure".to_owned(),
+            actor: ToolActor::api_token("mcp-owner", Some("MCP owner".to_owned())),
+            surface: RequestSurface::Mcp,
+            execution_id: "downstream-session".to_owned(),
+            call_id: "rpc-finish-failure".to_owned(),
+            worker_generation: 0,
+            path: "mcp_approval.write".to_owned(),
+            arguments: json!({ "value": "write once" }),
+        };
+        let retry_call = call.clone();
+        let service = app.tool_calls().clone();
+        let submission = tokio::spawn(async move {
+            service
+                .submit_mcp_idempotent(
+                    call,
+                    "POST /mcp tools/call",
+                    "session:finish-failure",
+                    pending(),
+                )
+                .await
+        });
+        let approval = tokio::time::timeout(Duration::from_secs(2), async {
+            loop {
+                if let Some(detail) = app
+                    .tool_calls()
+                    .approvals()
+                    .list_admin(crate::approval::ApprovalListQuery {
+                        before_sequence: None,
+                        limit: 1,
+                        status: None,
+                    })
+                    .await
+                    .expect("approvals should list")
+                    .items
+                    .into_iter()
+                    .next()
+                {
+                    break detail;
+                }
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .expect("approval should appear");
+
+        app.tool_calls()
+            .decide(
+                &approval.id,
+                "approve-for-finish-failure",
+                approval.revision,
+                ApprovalDecision::Approve,
+                1,
+            )
+            .await
+            .expect("approval decision should persist");
+        tokio::time::timeout(Duration::from_secs(2), execution_hook.started.notified())
+            .await
+            .expect("approved execution should reach dispatch");
+        execution_hook.release.notify_one();
+
+        tokio::time::timeout(Duration::from_secs(2), async {
+            loop {
+                let state = sqlx::query_scalar::<_, String>(
+                    "SELECT state FROM gateway_invocation_idempotency \
+                     WHERE owner_api_token_id = 'mcp-owner'",
+                )
+                .fetch_one(app.pool())
+                .await
+                .expect("idempotency state should read");
+                if state == "indeterminate" {
+                    break;
+                }
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .expect("finish failure should first make the invocation indeterminate");
+        let unfinished_approval = app
+            .tool_calls()
+            .approvals()
+            .get_admin(&approval.id)
+            .await
+            .expect("approval should read after finish failure")
+            .expect("approval should remain stored after finish failure");
+        assert_eq!(unfinished_approval.record.status, ApprovalStatus::Executing);
+
+        let current = tokio::time::timeout(Duration::from_secs(2), submission)
+            .await
+            .expect("current request should finish")
+            .expect("submission task should not panic")
+            .expect_err("failed terminal persistence should be uncertain");
+        assert!(matches!(current, GatewayInvokeError::OutcomeUnknown));
+        let replay = app
+            .tool_calls()
+            .submit_mcp_idempotent(
+                retry_call,
+                "POST /mcp tools/call",
+                "session:finish-failure",
+                pending(),
+            )
+            .await
+            .expect_err("retry should preserve the uncertain outcome");
+        assert!(matches!(replay, GatewayInvokeError::OutcomeUnknown));
+        let state = sqlx::query_scalar::<_, String>(
+            "SELECT state FROM gateway_invocation_idempotency \
+             WHERE owner_api_token_id = 'mcp-owner'",
+        )
+        .fetch_one(app.pool())
+        .await
+        .expect("idempotency state should read");
+        assert_eq!(state, "indeterminate");
+        app.shutdown().await;
+    }
+
+    #[tokio::test]
+    async fn explicit_cancellation_after_execution_starts_returns_and_stays_indeterminate() {
+        let (_directory, app) = app_with_mcp_ask_tool_at("http://127.0.0.1:9").await;
+        let execution_hook = Arc::new(ApprovedExecutionHook::default());
+        *app.tool_calls()
+            .approved_execution_hook
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner) = Some(execution_hook.clone());
+        let call = ToolCall {
+            request_id: "mcp-cancel-executing".to_owned(),
+            actor: ToolActor::api_token("mcp-owner", Some("MCP owner".to_owned())),
+            surface: RequestSurface::Mcp,
+            execution_id: "downstream-session".to_owned(),
+            call_id: "rpc-cancel-executing".to_owned(),
+            worker_generation: 0,
+            path: "mcp_approval.write".to_owned(),
+            arguments: json!({ "value": "write once" }),
+        };
+        let retry_call = call.clone();
+        let service = app.tool_calls().clone();
+        let (cancel, canceled) = oneshot::channel::<()>();
+        let submission = tokio::spawn(async move {
+            service
+                .submit_mcp_idempotent(
+                    call,
+                    "POST /mcp tools/call",
+                    "session:cancel-executing",
+                    async {
+                        let _ = canceled.await;
+                    },
+                )
+                .await
+        });
+        let approval = tokio::time::timeout(Duration::from_secs(2), async {
+            loop {
+                if let Some(detail) = app
+                    .tool_calls()
+                    .approvals()
+                    .list_admin(crate::approval::ApprovalListQuery {
+                        before_sequence: None,
+                        limit: 1,
+                        status: None,
+                    })
+                    .await
+                    .expect("approvals should list")
+                    .items
+                    .into_iter()
+                    .next()
+                {
+                    break detail;
+                }
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .expect("approval should appear");
+        app.tool_calls()
+            .decide(
+                &approval.id,
+                "approve-before-cancel",
+                approval.revision,
+                ApprovalDecision::Approve,
+                1,
+            )
+            .await
+            .expect("approval should persist");
+        tokio::time::timeout(Duration::from_secs(2), execution_hook.started.notified())
+            .await
+            .expect("execution should reach dispatch");
+        let executing = app
+            .tool_calls()
+            .approvals()
+            .get_admin(&approval.id)
+            .await
+            .expect("approval should read while upstream is blocked")
+            .expect("approval should remain stored");
+        assert_eq!(executing.record.status, ApprovalStatus::Executing);
+
+        cancel.send(()).expect("explicit cancellation should send");
+        let canceled = tokio::time::timeout(Duration::from_secs(2), submission)
+            .await
+            .expect("cancellation should not wait for upstream")
+            .expect("submission task should not panic")
+            .expect_err("executing request cancellation should return canceled");
+        assert!(matches!(canceled, GatewayInvokeError::Canceled));
+        let state = sqlx::query_scalar::<_, String>(
+            "SELECT state FROM gateway_invocation_idempotency \
+             WHERE owner_api_token_id = 'mcp-owner'",
+        )
+        .fetch_one(app.pool())
+        .await
+        .expect("idempotency state should read");
+        assert_eq!(state, "indeterminate");
+
+        execution_hook.release.notify_one();
+        let retry = app
+            .tool_calls()
+            .submit_mcp_idempotent(
+                retry_call,
+                "POST /mcp tools/call",
+                "session:cancel-executing",
+                pending(),
+            )
+            .await
+            .expect_err("completed upstream work must not become a deterministic replay");
+        assert!(matches!(retry, GatewayInvokeError::OutcomeUnknown));
+        let final_state = sqlx::query_scalar::<_, String>(
+            "SELECT state FROM gateway_invocation_idempotency \
+             WHERE owner_api_token_id = 'mcp-owner'",
+        )
+        .fetch_one(app.pool())
+        .await
+        .expect("final idempotency state should read");
+        assert_eq!(final_state, "indeterminate");
+        app.shutdown().await;
+    }
+
+    #[tokio::test]
+    async fn generic_mcp_boundary_replays_exact_blobs_and_terminalizes_drops() {
+        let directory = tempfile::tempdir().expect("temporary directory");
+        let pool = SqlitePoolOptions::new()
+            .max_connections(4)
+            .connect_with(
+                SqliteConnectOptions::new()
+                    .filename(directory.path().join("mcp-boundary.db"))
+                    .create_if_missing(true)
+                    .foreign_keys(true)
+                    .busy_timeout(Duration::from_secs(2)),
+            )
+            .await
+            .expect("database pool");
+        MIGRATOR.run(&pool).await.expect("migrations");
+        sqlx::query(
+            "INSERT INTO api_tokens (id, name, token_digest, token_prefix, token_suffix, created_at) \
+             VALUES ('mcp-owner', 'MCP owner', zeroblob(32), 'tok_', 'tail', 1)",
+        )
+        .execute(&pool)
+        .await
+        .expect("owner token");
+        let keyring = Keyring::from_master_key([11; 32]).expect("keyring");
+        let store = GatewayIdempotencyStore::new(pool.clone(), keyring.clone());
+        let approvals = ApprovalStore::system(pool, keyring);
+        let tasks = TaskTracker::default();
+        let arguments = json!({ "code": "return 1" });
+        let request = || IdempotencyRequest {
+            owner: IdempotencyOwner {
+                owner_api_token_id: "mcp-owner",
+            },
+            key: "session:request-1",
+            route: "mcp tools/call",
+            callable_path: "executor.execute",
+            arguments: &arguments,
+        };
+        let IdempotencyClaim::Fresh(record) =
+            store.claim(request()).await.expect("fresh reservation")
+        else {
+            panic!("fresh reservation expected");
+        };
+        let reservation = McpIdempotencyReservation {
+            guard: Some(IdempotencyReservationGuard::new(
+                record,
+                store.clone(),
+                approvals.clone(),
+                tasks.clone(),
+            )),
+        };
+        reservation
+            .mark_executing()
+            .await
+            .expect("execution boundary")
+            .complete(McpIdempotencyBlob {
+                body: br#"{"result":1}"#.to_vec(),
+            })
+            .await
+            .expect("durable completion");
+        let IdempotencyClaim::Replay { response, .. } =
+            store.claim(request()).await.expect("exact replay")
+        else {
+            panic!("completed request must replay");
+        };
+        assert_eq!(response.body, br#"{"result":1}"#);
+
+        let dropped_arguments = json!({ "code": "return 2" });
+        let dropped_request = || IdempotencyRequest {
+            owner: IdempotencyOwner {
+                owner_api_token_id: "mcp-owner",
+            },
+            key: "session:request-2",
+            route: "mcp tools/call",
+            callable_path: "executor.execute",
+            arguments: &dropped_arguments,
+        };
+        let IdempotencyClaim::Fresh(record) = store
+            .claim(dropped_request())
+            .await
+            .expect("second reservation")
+        else {
+            panic!("fresh second reservation expected");
+        };
+        let execution = McpIdempotencyReservation {
+            guard: Some(IdempotencyReservationGuard::new(
+                record,
+                store.clone(),
+                approvals,
+                tasks.clone(),
+            )),
+        }
+        .mark_executing()
+        .await
+        .expect("second execution boundary");
+        drop(execution);
+        tokio::time::timeout(Duration::from_secs(2), async {
+            loop {
+                if matches!(
+                    store.claim(dropped_request()).await.expect("dropped claim"),
+                    IdempotencyClaim::Indeterminate(_)
+                ) {
+                    break;
+                }
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .expect("dropped execution becomes indeterminate");
+        tasks.shutdown().await;
+    }
+}
diff --git a/src/lib.rs b/src/lib.rs
new file mode 100644
index 000000000..30b51f3d9
--- /dev/null
+++ b/src/lib.rs
@@ -0,0 +1,335 @@
+use std::{
+    net::SocketAddr,
+    path::PathBuf,
+    sync::Arc,
+    time::{SystemTime, UNIX_EPOCH},
+};
+
+use axum::Router;
+use directories::ProjectDirs;
+use ipnet::IpNet;
+use sqlx::SqlitePool;
+use thiserror::Error;
+use url::Url;
+
+pub mod actor;
+mod api;
+pub mod approval;
+pub mod catalog;
+pub mod cli;
+pub mod crypto;
+mod database;
+pub mod execution;
+pub mod graphql;
+pub use approval::invocation;
+pub(crate) mod mcp;
+pub(crate) mod oauth;
+pub mod openapi;
+pub mod outbound;
+pub(crate) mod protocols;
+mod request_logs;
+pub mod runtime;
+pub mod service;
+mod tasks;
+pub mod web_assets;
+
+pub use database::DatabaseError;
+
+pub const DEFAULT_BIND_ADDRESS: &str = "127.0.0.1:4788";
+pub const DEFAULT_ORIGIN: &str = "http://127.0.0.1:4788";
+
+#[derive(Clone)]
+pub struct AppConfig {
+    pub(crate) data_dir: PathBuf,
+    pub(crate) master_key_file: Option<PathBuf>,
+    pub(crate) origin: Url,
+    pub(crate) session_ttl_seconds: i64,
+    pub(crate) trusted_proxies: Arc<[IpNet]>,
+    pub(crate) runtime_executable: Option<PathBuf>,
+    pub(crate) mcp_stdio_templates_file: Option<PathBuf>,
+}
+
+impl AppConfig {
+    pub fn new(data_dir: PathBuf) -> Self {
+        Self {
+            data_dir,
+            master_key_file: None,
+            origin: Url::parse(DEFAULT_ORIGIN).expect("the default public origin is valid"),
+            session_ttl_seconds: 8 * 60 * 60,
+            trusted_proxies: Arc::from([]),
+            runtime_executable: None,
+            mcp_stdio_templates_file: None,
+        }
+    }
+
+    pub fn system_default() -> Result<Self, ConfigError> {
+        let project_dirs =
+            ProjectDirs::from("dev", "Executor", "Executor").ok_or(ConfigError::NoDataDirectory)?;
+        Ok(Self::new(project_dirs.data_local_dir().to_path_buf()))
+    }
+
+    pub fn with_master_key_file(mut self, master_key_file: Option<PathBuf>) -> Self {
+        self.master_key_file = master_key_file;
+        self
+    }
+
+    pub fn with_trusted_proxies(mut self, trusted_proxies: Vec<IpNet>) -> Self {
+        self.trusted_proxies = Arc::from(trusted_proxies);
+        self
+    }
+
+    pub fn with_runtime_executable(mut self, executable: PathBuf) -> Self {
+        self.runtime_executable = Some(executable);
+        self
+    }
+
+    pub fn with_mcp_stdio_templates_file(mut self, path: Option<PathBuf>) -> Self {
+        self.mcp_stdio_templates_file = path;
+        self
+    }
+
+    pub fn with_origin(mut self, origin: &str) -> Result<Self, ConfigError> {
+        self.origin = parse_public_origin(origin)?;
+        Ok(self)
+    }
+
+    pub fn with_default_origin_for_bind(self, bind: SocketAddr) -> Result<Self, ConfigError> {
+        if bind.ip().is_unspecified() {
+            return Err(ConfigError::PublicOriginRequiredForUnspecifiedBind(bind));
+        }
+        self.with_origin(&format!("http://{bind}"))
+    }
+
+    pub fn public_origin(&self) -> String {
+        self.origin.origin().ascii_serialization()
+    }
+
+    pub fn validate_bind(
+        &self,
+        bind: SocketAddr,
+        allow_unsafe_http_non_loopback: bool,
+    ) -> Result<(), ConfigError> {
+        if self.origin.scheme() == "http"
+            && !bind.ip().is_loopback()
+            && !allow_unsafe_http_non_loopback
+        {
+            return Err(ConfigError::UnsafePlaintextNonLoopbackBind(bind));
+        }
+        Ok(())
+    }
+}
+
+#[derive(Debug, Error)]
+pub enum ConfigError {
+    #[error("could not determine a platform data directory")]
+    NoDataDirectory,
+    #[error("the public origin is not a valid URL: {0}")]
+    InvalidPublicOrigin(#[source] url::ParseError),
+    #[error("the public origin must use http or https")]
+    UnsupportedPublicOriginScheme,
+    #[error("the public origin must contain only scheme, host, and optional port")]
+    PublicOriginHasExtraComponents,
+    #[error(
+        "--public-origin is required when --bind uses unspecified address {0}; Executor cannot infer the browser-visible host"
+    )]
+    PublicOriginRequiredForUnspecifiedBind(SocketAddr),
+    #[error(
+        "refusing plaintext HTTP on non-loopback bind {0}; use --allow-unsafe-http-non-loopback only when transport security is provided elsewhere"
+    )]
+    UnsafePlaintextNonLoopbackBind(SocketAddr),
+}
+
+pub struct ExecutorApp {
+    router: Router,
+    setup_token: Option<String>,
+    pool: SqlitePool,
+    catalog: catalog::CatalogStore,
+    tool_calls: invocation::ToolCallService,
+    execution: execution::ExecutionService,
+    mcp_connections: Arc<mcp::manager::McpConnectionManager>,
+    #[cfg(test)]
+    mcp: mcp::downstream::McpState,
+    api_tasks: tasks::TaskTracker,
+}
+
+#[derive(Clone)]
+pub struct ExecutorShutdown {
+    mcp_connections: Arc<mcp::manager::McpConnectionManager>,
+    execution: execution::ExecutionService,
+    api_tasks: tasks::TaskTracker,
+    tool_calls: invocation::ToolCallService,
+}
+
+impl ExecutorShutdown {
+    pub fn begin(&self) {
+        self.mcp_connections.begin_shutdown();
+        self.execution.cancel_all();
+        self.api_tasks.abort_all();
+        self.tool_calls.abort_background_tasks();
+    }
+}
+
+impl ExecutorApp {
+    pub async fn open(config: AppConfig) -> Result<Self, DatabaseError> {
+        let stdio_templates = match config.mcp_stdio_templates_file.as_deref() {
+            Some(path) => mcp::upstream::stdio::StdioTemplateRegistry::load(path)?,
+            None => mcp::upstream::stdio::StdioTemplateRegistry::default(),
+        };
+        let mcp_connections = Arc::new(mcp::manager::McpConnectionManager::new(stdio_templates));
+        let opened = database::Database::open(&config).await?;
+        let pool = opened.database.pool.clone();
+        let catalog = catalog::CatalogStore::new(pool.clone(), opened.database.keyring.clone());
+        let request_logs =
+            request_logs::RequestLogSink::new(opened.database.clone(), catalog.clone());
+        let oauth = oauth::OAuthService::new(
+            pool.clone(),
+            opened.database.keyring.clone(),
+            config.public_origin(),
+            outbound::OutboundPolicy::default(),
+        );
+        oauth
+            .recover_startup()
+            .await
+            .map_err(|_| DatabaseError::OAuthInitialization)?;
+        let sources =
+            protocols::SourceService::new(catalog.clone(), mcp_connections.clone(), oauth.clone());
+        let protocol_registry = sources.registry().clone();
+        let tool_calls = invocation::ToolCallService::new(
+            catalog.clone(),
+            protocol_registry,
+            pool.clone(),
+            opened.database.keyring.clone(),
+            request_logs.clone(),
+            oauth.clone(),
+        );
+        tool_calls.recover_startup().await?;
+        let api_tasks = tasks::TaskTracker::default();
+        let runtime =
+            runtime::RuntimeManager::new(config.runtime_executable.clone().unwrap_or_else(|| {
+                std::env::current_exe().unwrap_or_else(|_| PathBuf::from("executor"))
+            }));
+        let execution = execution::ExecutionService::new(runtime, tool_calls.clone());
+        let dummy_password_hash = crypto::hash_password("executor-dummy-login-password")?;
+        let mcp = mcp::downstream::McpState::new(
+            opened.database.clone(),
+            catalog.clone(),
+            tool_calls.clone(),
+            execution.clone(),
+            api_tasks.clone(),
+            config.public_origin(),
+        );
+        if let Err(error) = sources.restore_mcp_watchers().await {
+            tracing::warn!(
+                code = error.code,
+                "existing MCP source watchers could not be fully restored"
+            );
+        }
+        let router = api::router(
+            opened.database,
+            catalog.clone(),
+            api::ApiServices::new(
+                sources,
+                tool_calls.clone(),
+                execution.clone(),
+                mcp.clone(),
+                oauth.clone(),
+            ),
+            request_logs,
+            api_tasks.clone(),
+            &config,
+            dummy_password_hash,
+        );
+        Ok(Self {
+            router,
+            setup_token: opened.setup_token,
+            pool,
+            catalog,
+            tool_calls,
+            execution,
+            mcp_connections,
+            #[cfg(test)]
+            mcp,
+            api_tasks,
+        })
+    }
+
+    pub fn router(&self) -> Router {
+        self.router.clone()
+    }
+
+    pub fn setup_token(&self) -> Option<&str> {
+        self.setup_token.as_deref()
+    }
+
+    pub fn pool(&self) -> &SqlitePool {
+        &self.pool
+    }
+
+    pub fn catalog(&self) -> &catalog::CatalogStore {
+        &self.catalog
+    }
+
+    pub fn tool_calls(&self) -> &invocation::ToolCallService {
+        &self.tool_calls
+    }
+
+    pub fn executions(&self) -> &execution::ExecutionService {
+        &self.execution
+    }
+
+    #[cfg(test)]
+    pub(crate) fn mcp_state(&self) -> &mcp::downstream::McpState {
+        &self.mcp
+    }
+
+    pub fn begin_shutdown(&self) {
+        self.shutdown_handle().begin();
+    }
+
+    pub fn shutdown_handle(&self) -> ExecutorShutdown {
+        ExecutorShutdown {
+            mcp_connections: self.mcp_connections.clone(),
+            execution: self.execution.clone(),
+            api_tasks: self.api_tasks.clone(),
+            tool_calls: self.tool_calls.clone(),
+        }
+    }
+
+    pub async fn shutdown(self) {
+        self.begin_shutdown();
+        self.execution.shutdown().await;
+        self.api_tasks.shutdown().await;
+        self.tool_calls.shutdown().await;
+        self.mcp_connections.shutdown().await;
+        self.pool.close().await;
+    }
+}
+
+impl Drop for ExecutorApp {
+    fn drop(&mut self) {
+        self.begin_shutdown();
+    }
+}
+
+fn parse_public_origin(origin: &str) -> Result<Url, ConfigError> {
+    let parsed = Url::parse(origin).map_err(ConfigError::InvalidPublicOrigin)?;
+    if !matches!(parsed.scheme(), "http" | "https") || parsed.host().is_none() {
+        return Err(ConfigError::UnsupportedPublicOriginScheme);
+    }
+    if !parsed.username().is_empty()
+        || parsed.password().is_some()
+        || parsed.path() != "/"
+        || parsed.query().is_some()
+        || parsed.fragment().is_some()
+    {
+        return Err(ConfigError::PublicOriginHasExtraComponents);
+    }
+    Ok(parsed)
+}
+
+pub(crate) fn unix_timestamp() -> i64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .expect("system time must be after the Unix epoch")
+        .as_secs() as i64
+}
diff --git a/src/main.rs b/src/main.rs
new file mode 100644
index 000000000..46cfa978f
--- /dev/null
+++ b/src/main.rs
@@ -0,0 +1,270 @@
+use std::{
+    net::SocketAddr,
+    os::fd::{FromRawFd, OwnedFd, RawFd},
+    path::PathBuf,
+};
+
+use anyhow::{Context, Result};
+use clap::{Args, Parser, Subcommand};
+use executor::{AppConfig, DEFAULT_BIND_ADDRESS, ExecutorApp, cli};
+use ipnet::IpNet;
+use tokio::net::TcpListener;
+use tracing::info;
+use tracing_subscriber::EnvFilter;
+
+#[derive(Parser)]
+#[command(name = "executor", about = "The local Executor gateway", version)]
+struct Cli {
+    #[arg(
+        long,
+        global = true,
+        env = "EXECUTOR_BASE_URL",
+        default_value = cli::DEFAULT_BASE_URL
+    )]
+    base_url: String,
+    #[arg(
+        long,
+        global = true,
+        env = "EXECUTOR_API_TOKEN",
+        hide_env_values = true
+    )]
+    api_token: Option<String>,
+    #[arg(long, global = true)]
+    json: bool,
+    #[arg(
+        long,
+        global = true,
+        help = "Allow API tokens over plaintext HTTP to a non-loopback server"
+    )]
+    allow_insecure_http: bool,
+    #[command(subcommand)]
+    command: Command,
+}
+
+#[derive(Subcommand)]
+enum Command {
+    Server(ServerArgs),
+    Call(cli::CallArgs),
+    Tools(cli::ToolsArgs),
+    Open,
+    Mcp,
+    Service(executor::service::ServiceArgs),
+    #[command(hide = true)]
+    SandboxWorker(SandboxWorkerArgs),
+}
+
+#[derive(Args)]
+struct SandboxWorkerArgs {
+    #[arg(long)]
+    ipc_fd: std::os::fd::RawFd,
+    #[arg(long)]
+    generation: u64,
+}
+
+#[derive(Args)]
+struct ServerArgs {
+    #[arg(long, default_value = DEFAULT_BIND_ADDRESS)]
+    bind: SocketAddr,
+    #[arg(long, env = "EXECUTOR_DATA_DIR")]
+    data_dir: Option<PathBuf>,
+    #[arg(long, env = "EXECUTOR_MASTER_KEY_FILE")]
+    master_key_file: Option<PathBuf>,
+    #[arg(long, env = "EXECUTOR_MCP_STDIO_TEMPLATES_FILE")]
+    mcp_stdio_templates: Option<PathBuf>,
+    #[arg(long, env = "EXECUTOR_PUBLIC_ORIGIN")]
+    public_origin: Option<String>,
+    #[arg(
+        long = "trusted-proxy",
+        env = "EXECUTOR_TRUSTED_PROXIES",
+        value_delimiter = ',',
+        value_name = "CIDR",
+        help = "Trust X-Forwarded-For only from these proxy CIDRs (repeat or comma-separate)"
+    )]
+    trusted_proxies: Vec<IpNet>,
+    #[arg(long)]
+    allow_unsafe_http_non_loopback: bool,
+}
+
+#[tokio::main]
+async fn main() -> Result<()> {
+    tracing_subscriber::fmt()
+        .with_env_filter(
+            EnvFilter::try_from_default_env().unwrap_or_else(|_| EnvFilter::new("executor=info")),
+        )
+        .init();
+
+    let arguments = Cli::parse();
+    let connection = cli::ConnectionOptions {
+        base_url: arguments.base_url,
+        api_token: arguments.api_token,
+        json: arguments.json,
+        allow_insecure_http: arguments.allow_insecure_http,
+    };
+    match arguments.command {
+        Command::Server(args) => run_server(args).await,
+        Command::Call(args) => cli::call(connection, args).await,
+        Command::Tools(args) => cli::tools(connection, args).await,
+        Command::Open => cli::open(&connection),
+        Command::Mcp => cli::mcp(connection).await,
+        Command::Service(args) => executor::service::execute(args)?.emit(),
+        Command::SandboxWorker(args) => {
+            let ipc = take_worker_socket(args.ipc_fd)?;
+            executor::runtime::worker_main(ipc, args.generation)
+                .await
+                .map_err(anyhow::Error::from)
+        }
+    }
+}
+
+fn take_worker_socket(raw_fd: RawFd) -> Result<OwnedFd> {
+    if raw_fd != 3 || unsafe { libc::fcntl(raw_fd, libc::F_GETFD) } == -1 {
+        anyhow::bail!("sandbox IPC descriptor is invalid");
+    }
+    let mut socket_type = 0;
+    let mut socket_type_length = std::mem::size_of::<libc::c_int>() as libc::socklen_t;
+    let socket_result = unsafe {
+        libc::getsockopt(
+            raw_fd,
+            libc::SOL_SOCKET,
+            libc::SO_TYPE,
+            std::ptr::from_mut(&mut socket_type).cast(),
+            &mut socket_type_length,
+        )
+    };
+    let mut peer = std::mem::MaybeUninit::<libc::sockaddr_storage>::uninit();
+    let mut peer_length = std::mem::size_of::<libc::sockaddr_storage>() as libc::socklen_t;
+    let peer_result =
+        unsafe { libc::getpeername(raw_fd, peer.as_mut_ptr().cast(), &mut peer_length) };
+    if socket_result == -1 || socket_type != libc::SOCK_STREAM || peer_result == -1 {
+        anyhow::bail!("sandbox IPC descriptor is not a connected stream socket");
+    }
+    let peer = unsafe { peer.assume_init() };
+    if i32::from(peer.ss_family) != libc::AF_UNIX {
+        anyhow::bail!("sandbox IPC descriptor is not a Unix socket");
+    }
+    Ok(unsafe { OwnedFd::from_raw_fd(raw_fd) })
+}
+
+async fn run_server(args: ServerArgs) -> Result<()> {
+    let mut config = match args.data_dir {
+        Some(data_dir) => AppConfig::new(data_dir),
+        None => AppConfig::system_default()?,
+    };
+    config = config
+        .with_master_key_file(args.master_key_file)
+        .with_mcp_stdio_templates_file(args.mcp_stdio_templates)
+        .with_trusted_proxies(args.trusted_proxies);
+    let listener = TcpListener::bind(args.bind)
+        .await
+        .with_context(|| format!("could not bind Executor to {}", args.bind))?;
+    let bound_address = listener
+        .local_addr()
+        .context("could not determine Executor's bound address")?;
+    config = match args.public_origin {
+        Some(public_origin) => config.with_origin(&public_origin)?,
+        None => config.with_default_origin_for_bind(bound_address)?,
+    };
+    config.validate_bind(bound_address, args.allow_unsafe_http_non_loopback)?;
+    let app = ExecutorApp::open(config.clone())
+        .await
+        .context("Executor could not initialize")?;
+
+    if let Some(setup_token) = app.setup_token() {
+        println!("Complete first-boot setup at:");
+        println!("{}/setup#token={setup_token}", config.public_origin());
+    }
+
+    info!(address = %bound_address, "Executor is listening");
+    let router = app.router();
+    let shutdown = app.shutdown_handle();
+    let server_result = axum::serve(
+        listener,
+        router.into_make_service_with_connect_info::<SocketAddr>(),
+    )
+    .with_graceful_shutdown(async move {
+        shutdown_signal().await;
+        shutdown.begin();
+    })
+    .await
+    .context("Executor server stopped unexpectedly");
+    app.shutdown().await;
+    server_result
+}
+
+#[cfg(unix)]
+async fn shutdown_signal() {
+    let mut terminate =
+        match tokio::signal::unix::signal(tokio::signal::unix::SignalKind::terminate()) {
+            Ok(terminate) => terminate,
+            Err(error) => {
+                tracing::error!(error = %error, "could not listen for the terminate signal");
+                let _ = tokio::signal::ctrl_c().await;
+                return;
+            }
+        };
+    tokio::select! {
+        result = tokio::signal::ctrl_c() => {
+            if let Err(error) = result {
+                tracing::error!(error = %error, "could not listen for the interrupt signal");
+            }
+        }
+        _ = terminate.recv() => {}
+    }
+}
+
+#[cfg(not(unix))]
+async fn shutdown_signal() {
+    let _ = tokio::signal::ctrl_c().await;
+}
+
+#[cfg(test)]
+mod tests {
+    use clap::Parser;
+
+    use super::*;
+
+    #[test]
+    fn parses_retained_client_commands_and_global_connection_flags() {
+        let cli = Cli::try_parse_from([
+            "executor",
+            "--base-url",
+            "http://localhost:9000",
+            "--api-token",
+            "secret",
+            "--json",
+            "call",
+            "github",
+            "issues_create",
+            r#"{"title":"Bug"}"#,
+        ])
+        .expect("call command");
+        assert_eq!(cli.base_url, "http://localhost:9000");
+        assert_eq!(cli.api_token.as_deref(), Some("secret"));
+        assert!(cli.json);
+        let Command::Call(arguments) = cli.command else {
+            panic!("expected call command");
+        };
+        assert_eq!(arguments.values.len(), 3);
+
+        assert!(Cli::try_parse_from(["executor", "tools", "sources"]).is_ok());
+        assert!(Cli::try_parse_from(["executor", "mcp"]).is_ok());
+        assert!(Cli::try_parse_from(["executor", "open"]).is_ok());
+        for action in ["status", "start", "stop", "restart", "remove"] {
+            assert!(Cli::try_parse_from(["executor", "service", action]).is_ok());
+        }
+        assert!(Cli::try_parse_from(["executor", "service", "install", "--no-start"]).is_ok());
+    }
+
+    #[test]
+    fn reports_the_cargo_package_version() {
+        let Err(error) = Cli::try_parse_from(["executor", "--version"]) else {
+            panic!("expected clap to display the version");
+        };
+
+        assert_eq!(error.kind(), clap::error::ErrorKind::DisplayVersion);
+        assert_eq!(
+            error.to_string(),
+            format!("executor {}\n", env!("CARGO_PKG_VERSION"))
+        );
+    }
+}
diff --git a/src/mcp/discovery/mod.rs b/src/mcp/discovery/mod.rs
new file mode 100644
index 000000000..fefd86566
--- /dev/null
+++ b/src/mcp/discovery/mod.rs
@@ -0,0 +1,531 @@
+use std::{
+    collections::{BTreeMap, HashSet},
+    future::Future,
+    sync::{Arc, Mutex},
+};
+
+use async_trait::async_trait;
+use serde::{Deserialize, Serialize};
+use serde_json::{Map, Value, json};
+use thiserror::Error;
+
+use crate::catalog::{
+    ArtifactKind, CatalogSnapshot, InitialCatalogSnapshot, McpToolBindingV1, StagedArtifact,
+    StagedTool, StagedToolBinding, ToolBinding, ToolMode,
+};
+
+const CAPABILITIES_ARTIFACT_KEY: &str = "mcp-server";
+
+#[derive(Clone, Copy, Debug)]
+pub struct DiscoveryLimits {
+    pub max_pages: usize,
+    pub max_tools: usize,
+    pub max_cursor_bytes: usize,
+    pub max_tool_name_characters: usize,
+    pub max_title_characters: usize,
+    pub max_description_characters: usize,
+    pub max_schema_bytes: usize,
+    pub max_tool_bytes: usize,
+    pub max_total_tool_bytes: usize,
+    pub max_capabilities_bytes: usize,
+}
+
+impl Default for DiscoveryLimits {
+    fn default() -> Self {
+        Self {
+            max_pages: 1_000,
+            max_tools: 100_000,
+            max_cursor_bytes: 8 * 1024,
+            max_tool_name_characters: 128,
+            max_title_characters: 300,
+            max_description_characters: 4_000,
+            max_schema_bytes: 2 * 1024 * 1024,
+            max_tool_bytes: 5 * 1024 * 1024,
+            max_total_tool_bytes: 32 * 1024 * 1024,
+            max_capabilities_bytes: 8 * 1024 * 1024,
+        }
+    }
+}
+
+#[derive(Clone, Debug, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct DiscoveryBasis {
+    pub expected_source_revision: i64,
+    pub expected_credential_revision: Option<i64>,
+    pub protocol_version: String,
+    pub server_name: String,
+    pub server_version: String,
+    pub server_title: Option<String>,
+    pub instructions: Option<String>,
+    pub capabilities: Value,
+    pub tools_list_changed: bool,
+}
+
+#[derive(Clone, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct McpToolAnnotations {
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub title: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub read_only_hint: Option<bool>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub destructive_hint: Option<bool>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub idempotent_hint: Option<bool>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub open_world_hint: Option<bool>,
+}
+
+#[derive(Clone, Debug, Deserialize, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct DiscoveredMcpTool {
+    pub name: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub title: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub description: Option<String>,
+    pub input_schema: Value,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub output_schema: Option<Value>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub annotations: Option<McpToolAnnotations>,
+    #[serde(default, skip_serializing_if = "Map::is_empty", rename = "_meta")]
+    pub meta: Map<String, Value>,
+}
+
+#[derive(Clone, Debug, Deserialize, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ToolPage {
+    pub tools: Vec<DiscoveredMcpTool>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub next_cursor: Option<String>,
+}
+
+#[async_trait]
+pub trait ToolPageFetcher: Send {
+    type Error: std::error::Error + Send + Sync + 'static;
+
+    async fn fetch_tools_page(&mut self, cursor: Option<&str>) -> Result<ToolPage, Self::Error>;
+}
+
+#[derive(Clone, Debug)]
+pub struct DiscoveryPlan {
+    pub basis: DiscoveryBasis,
+    pub artifacts: Vec<StagedArtifact>,
+    pub tools: Vec<StagedTool>,
+    pub bindings: Vec<StagedToolBinding>,
+}
+
+impl DiscoveryPlan {
+    pub fn catalog_snapshot(&self) -> CatalogSnapshot {
+        CatalogSnapshot {
+            expected_source_revision: self.basis.expected_source_revision,
+            expected_credential_revision: self.basis.expected_credential_revision,
+            artifacts: self.artifacts.clone(),
+            tools: self.tools.clone(),
+        }
+    }
+
+    pub fn initial_catalog_snapshot(&self) -> InitialCatalogSnapshot {
+        InitialCatalogSnapshot {
+            artifacts: self.artifacts.clone(),
+            tools: self.tools.clone(),
+        }
+    }
+}
+
+#[derive(Debug, Error)]
+pub enum DiscoveryError {
+    #[error("MCP tools/list failed: {0}")]
+    Fetch(#[source] Box<dyn std::error::Error + Send + Sync>),
+    #[error("MCP discovery exceeded the {maximum} page limit")]
+    TooManyPages { maximum: usize },
+    #[error("MCP discovery exceeded the {maximum} tool limit")]
+    TooManyTools { maximum: usize },
+    #[error("MCP tools/list returned an invalid cursor")]
+    InvalidCursor,
+    #[error("MCP tools/list returned a cursor cycle")]
+    CursorCycle,
+    #[error("MCP tools/list returned duplicate tool name {name:?}")]
+    DuplicateTool { name: String },
+    #[error("MCP tool {tool:?} is invalid: {message}")]
+    InvalidTool { tool: String, message: &'static str },
+    #[error("MCP server discovery metadata is too large")]
+    CapabilitiesTooLarge,
+    #[error("MCP server capabilities must be a JSON object")]
+    InvalidCapabilities,
+    #[error("MCP tools/list returned too much tool metadata")]
+    ToolMetadataTooLarge,
+}
+
+pub async fn discover<F: ToolPageFetcher>(
+    fetcher: &mut F,
+    basis: DiscoveryBasis,
+) -> Result<DiscoveryPlan, DiscoveryError> {
+    discover_with_limits(fetcher, basis, DiscoveryLimits::default()).await
+}
+
+pub async fn discover_with_limits<F: ToolPageFetcher>(
+    fetcher: &mut F,
+    basis: DiscoveryBasis,
+    limits: DiscoveryLimits,
+) -> Result<DiscoveryPlan, DiscoveryError> {
+    let artifact = capabilities_artifact(&basis, limits)?;
+    let mut cursor = None;
+    let mut seen_cursors = HashSet::new();
+    let mut seen_tools = HashSet::new();
+    let mut staged = Vec::new();
+    let mut total_tool_bytes = 0usize;
+
+    loop {
+        if seen_cursors.len() >= limits.max_pages {
+            return Err(DiscoveryError::TooManyPages {
+                maximum: limits.max_pages,
+            });
+        }
+        if !seen_cursors.insert(cursor.clone()) {
+            return Err(DiscoveryError::CursorCycle);
+        }
+
+        let page = fetcher
+            .fetch_tools_page(cursor.as_deref())
+            .await
+            .map_err(|error| DiscoveryError::Fetch(Box::new(error)))?;
+        let next_count = staged
+            .len()
+            .checked_add(page.tools.len())
+            .filter(|count| *count <= limits.max_tools)
+            .ok_or(DiscoveryError::TooManyTools {
+                maximum: limits.max_tools,
+            })?;
+        staged.reserve(next_count - staged.len());
+
+        for tool in page.tools {
+            let tool_bytes = serde_json::to_vec(&tool)
+                .map_err(|_| DiscoveryError::ToolMetadataTooLarge)?
+                .len();
+            if tool_bytes > limits.max_tool_bytes {
+                return Err(invalid_tool(&tool.name, "tool metadata is too large"));
+            }
+            total_tool_bytes = total_tool_bytes
+                .checked_add(tool_bytes)
+                .filter(|bytes| *bytes <= limits.max_total_tool_bytes)
+                .ok_or(DiscoveryError::ToolMetadataTooLarge)?;
+            validate_tool(&tool, limits)?;
+            if !seen_tools.insert(tool.name.clone()) {
+                return Err(DiscoveryError::DuplicateTool { name: tool.name });
+            }
+            staged.push(tool);
+        }
+
+        cursor = match page.next_cursor {
+            Some(next) => {
+                if next.is_empty()
+                    || next.len() > limits.max_cursor_bytes
+                    || next.chars().any(char::is_control)
+                {
+                    return Err(DiscoveryError::InvalidCursor);
+                }
+                let next = Some(next);
+                if seen_cursors.contains(&next) {
+                    return Err(DiscoveryError::CursorCycle);
+                }
+                next
+            }
+            None => break,
+        };
+    }
+
+    staged.sort_by(|left, right| left.name.cmp(&right.name));
+    let tools = staged.iter().map(staged_tool).collect();
+    let bindings = staged
+        .into_iter()
+        .map(|tool| StagedToolBinding {
+            stable_key: tool.name.clone(),
+            binding: ToolBinding::McpHttpV1(McpToolBindingV1 {
+                version: 1,
+                tool_name: tool.name,
+            }),
+        })
+        .collect();
+
+    Ok(DiscoveryPlan {
+        basis,
+        artifacts: vec![artifact],
+        tools,
+        bindings,
+    })
+}
+
+pub fn bindings_for_source_kind(mut plan: DiscoveryPlan, source_is_stdio: bool) -> DiscoveryPlan {
+    if source_is_stdio {
+        for binding in &mut plan.bindings {
+            if let ToolBinding::McpHttpV1(definition) = &binding.binding {
+                binding.binding = ToolBinding::McpStdioV1(definition.clone());
+            }
+        }
+    }
+    plan
+}
+
+fn capabilities_artifact(
+    basis: &DiscoveryBasis,
+    limits: DiscoveryLimits,
+) -> Result<StagedArtifact, DiscoveryError> {
+    if !basis.capabilities.is_object() {
+        return Err(DiscoveryError::InvalidCapabilities);
+    }
+    let content = json!({
+        "protocolVersion": basis.protocol_version,
+        "serverInfo": {
+            "name": basis.server_name,
+            "version": basis.server_version,
+            "title": basis.server_title,
+        },
+        "instructions": basis.instructions,
+        "capabilities": basis.capabilities,
+        "toolsListChanged": basis.tools_list_changed,
+    });
+    if serde_json::to_vec(&content)
+        .map(|encoded| encoded.len() > limits.max_capabilities_bytes)
+        .unwrap_or(true)
+    {
+        return Err(DiscoveryError::CapabilitiesTooLarge);
+    }
+    Ok(StagedArtifact {
+        kind: ArtifactKind::McpCapabilities,
+        stable_key: CAPABILITIES_ARTIFACT_KEY.to_owned(),
+        content,
+    })
+}
+
+fn validate_tool(tool: &DiscoveredMcpTool, limits: DiscoveryLimits) -> Result<(), DiscoveryError> {
+    validate_text(
+        &tool.name,
+        limits.max_tool_name_characters,
+        &tool.name,
+        "name must contain 1 to 128 non-control characters",
+        false,
+    )?;
+    if tool.name.trim() != tool.name {
+        return Err(invalid_tool(
+            &tool.name,
+            "name must not have leading or trailing whitespace",
+        ));
+    }
+    if let Some(title) = tool.title.as_deref()
+        && !title.is_empty()
+    {
+        validate_text(
+            title,
+            limits.max_title_characters,
+            &tool.name,
+            "title is too long or contains control characters",
+            false,
+        )?;
+    }
+    if let Some(description) = tool.description.as_deref()
+        && !description.is_empty()
+    {
+        validate_text(
+            description,
+            limits.max_description_characters,
+            &tool.name,
+            "description is too long or contains disallowed control characters",
+            true,
+        )?;
+    }
+    if let Some(title) = tool
+        .annotations
+        .as_ref()
+        .and_then(|annotations| annotations.title.as_deref())
+        && !title.is_empty()
+    {
+        validate_text(
+            title,
+            limits.max_title_characters,
+            &tool.name,
+            "annotation title is too long or contains control characters",
+            false,
+        )?;
+    }
+    validate_schema(&tool.input_schema, &tool.name, limits.max_schema_bytes)?;
+    if let Some(schema) = &tool.output_schema {
+        validate_schema(schema, &tool.name, limits.max_schema_bytes)?;
+    }
+    Ok(())
+}
+
+fn validate_text(
+    value: &str,
+    maximum: usize,
+    tool: &str,
+    message: &'static str,
+    allow_layout_controls: bool,
+) -> Result<(), DiscoveryError> {
+    if value.is_empty()
+        || value.chars().count() > maximum
+        || value.chars().any(|character| {
+            character.is_control() && !(allow_layout_controls && matches!(character, '\n' | '\t'))
+        })
+    {
+        return Err(invalid_tool(tool, message));
+    }
+    Ok(())
+}
+
+fn validate_schema(schema: &Value, tool: &str, maximum_bytes: usize) -> Result<(), DiscoveryError> {
+    schema
+        .as_object()
+        .ok_or_else(|| invalid_tool(tool, "schema must be a JSON object"))?;
+    if serde_json::to_vec(schema)
+        .map(|encoded| encoded.len() > maximum_bytes)
+        .unwrap_or(true)
+    {
+        return Err(invalid_tool(tool, "schema is too large"));
+    }
+    Ok(())
+}
+
+fn invalid_tool(tool: &str, message: &'static str) -> DiscoveryError {
+    DiscoveryError::InvalidTool {
+        tool: tool.to_owned(),
+        message,
+    }
+}
+
+fn staged_tool(tool: &DiscoveredMcpTool) -> StagedTool {
+    let intrinsic_mode = match tool.annotations.as_ref() {
+        Some(annotations)
+            if annotations.read_only_hint == Some(true)
+                && annotations.destructive_hint != Some(true) =>
+        {
+            ToolMode::Enabled
+        }
+        _ => ToolMode::Ask,
+    };
+    StagedTool {
+        stable_key: tool.name.clone(),
+        preferred_name: tool.name.clone(),
+        display_name: tool
+            .title
+            .clone()
+            .filter(|title| !title.is_empty())
+            .or_else(|| {
+                tool.annotations
+                    .as_ref()
+                    .and_then(|annotations| annotations.title.clone())
+                    .filter(|title| !title.is_empty())
+            })
+            .unwrap_or_else(|| tool.name.clone()),
+        description: tool
+            .description
+            .clone()
+            .filter(|description| !description.is_empty()),
+        input_schema: tool.input_schema.clone(),
+        output_schema: tool.output_schema.clone(),
+        input_typescript: None,
+        output_typescript: None,
+        typescript_definitions: BTreeMap::new(),
+        intrinsic_mode,
+    }
+}
+
+#[derive(Clone, Default)]
+pub struct ListChangedCoalescer {
+    state: Arc<Mutex<CoalescerState>>,
+}
+
+#[derive(Default)]
+struct CoalescerState {
+    requested_generation: u64,
+    completed_generation: u64,
+    running: bool,
+}
+
+impl ListChangedCoalescer {
+    /// Marks the catalog dirty and returns whether no refresh runner is currently active.
+    ///
+    /// A notification callback may use the return value as a hint to spawn a runner. More than
+    /// one callback can observe `true` before the first runner starts, which is harmless because
+    /// `refresh_pending` admits only one runner.
+    pub fn notify_changed(&self) -> bool {
+        let mut state = self.state.lock().expect("coalescer mutex poisoned");
+        state.requested_generation = state.requested_generation.saturating_add(1);
+        !state.running
+    }
+
+    pub fn has_pending(&self) -> bool {
+        let state = self.state.lock().expect("coalescer mutex poisoned");
+        state.requested_generation != state.completed_generation
+    }
+
+    pub async fn refresh_pending<F, Fut, Error>(&self, mut refresh: F) -> Result<usize, Error>
+    where
+        F: FnMut() -> Fut,
+        Fut: Future<Output = Result<(), Error>>,
+    {
+        let Some(mut ownership) = CoalescerOwnership::acquire(self.state.clone()) else {
+            return Ok(0);
+        };
+        let mut refresh_count = 0;
+        loop {
+            let Some(target) = ownership.next_target_or_finish() else {
+                return Ok(refresh_count);
+            };
+            refresh().await?;
+            refresh_count += 1;
+            ownership.complete(target);
+        }
+    }
+}
+
+struct CoalescerOwnership {
+    state: Arc<Mutex<CoalescerState>>,
+    finished: bool,
+}
+
+impl CoalescerOwnership {
+    fn acquire(state: Arc<Mutex<CoalescerState>>) -> Option<Self> {
+        {
+            let mut current = state.lock().expect("coalescer mutex poisoned");
+            if current.running {
+                return None;
+            }
+            current.running = true;
+        }
+        Some(Self {
+            state,
+            finished: false,
+        })
+    }
+
+    fn next_target_or_finish(&mut self) -> Option<u64> {
+        let mut state = self.state.lock().expect("coalescer mutex poisoned");
+        if state.requested_generation == state.completed_generation {
+            state.running = false;
+            self.finished = true;
+            None
+        } else {
+            Some(state.requested_generation)
+        }
+    }
+
+    fn complete(&mut self, generation: u64) {
+        self.state
+            .lock()
+            .expect("coalescer mutex poisoned")
+            .completed_generation = generation;
+    }
+}
+
+impl Drop for CoalescerOwnership {
+    fn drop(&mut self) {
+        if !self.finished {
+            self.state.lock().expect("coalescer mutex poisoned").running = false;
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/src/mcp/discovery/tests.rs b/src/mcp/discovery/tests.rs
new file mode 100644
index 000000000..c095da430
--- /dev/null
+++ b/src/mcp/discovery/tests.rs
@@ -0,0 +1,566 @@
+use std::{collections::VecDeque, convert::Infallible, sync::Arc};
+
+use serde_json::json;
+use tokio::sync::{Barrier, Mutex};
+
+use super::*;
+use crate::{
+    AppConfig, ExecutorApp,
+    catalog::{
+        AuditContext, CatalogError, CreateSource, CredentialPayload, ListToolsFilter, SourceKind,
+        ToolBinding,
+    },
+};
+
+struct Fetcher {
+    pages: VecDeque<ToolPage>,
+    cursors: Vec<Option<String>>,
+}
+
+struct FailingFetcher {
+    calls: usize,
+}
+
+#[async_trait]
+impl ToolPageFetcher for FailingFetcher {
+    type Error = std::io::Error;
+
+    async fn fetch_tools_page(&mut self, _cursor: Option<&str>) -> Result<ToolPage, Self::Error> {
+        self.calls += 1;
+        if self.calls == 1 {
+            Ok(ToolPage {
+                tools: vec![tool("partial")],
+                next_cursor: Some("next".to_owned()),
+            })
+        } else {
+            Err(std::io::Error::other("transient upstream failure"))
+        }
+    }
+}
+
+#[async_trait]
+impl ToolPageFetcher for Fetcher {
+    type Error = Infallible;
+
+    async fn fetch_tools_page(&mut self, cursor: Option<&str>) -> Result<ToolPage, Self::Error> {
+        self.cursors.push(cursor.map(str::to_owned));
+        Ok(self.pages.pop_front().expect("test page exists"))
+    }
+}
+
+fn basis() -> DiscoveryBasis {
+    DiscoveryBasis {
+        expected_source_revision: 7,
+        expected_credential_revision: Some(3),
+        protocol_version: "2025-11-25".to_owned(),
+        server_name: "fixture".to_owned(),
+        server_version: "1.2.3".to_owned(),
+        server_title: Some("Fixture server".to_owned()),
+        instructions: None,
+        capabilities: json!({ "tools": { "listChanged": true } }),
+        tools_list_changed: true,
+    }
+}
+
+fn tool(name: &str) -> DiscoveredMcpTool {
+    DiscoveredMcpTool {
+        name: name.to_owned(),
+        title: None,
+        description: Some(format!("Run {name}")),
+        input_schema: json!({ "type": "object", "properties": {} }),
+        output_schema: None,
+        annotations: None,
+        meta: Map::new(),
+    }
+}
+
+fn read_only_tool(name: &str) -> DiscoveredMcpTool {
+    DiscoveredMcpTool {
+        annotations: Some(McpToolAnnotations {
+            read_only_hint: Some(true),
+            destructive_hint: Some(false),
+            ..McpToolAnnotations::default()
+        }),
+        ..tool(name)
+    }
+}
+
+#[tokio::test]
+async fn pages_all_tools_before_returning_an_atomic_stable_plan() {
+    let mut fetcher = Fetcher {
+        pages: VecDeque::from([
+            ToolPage {
+                tools: vec![tool("zeta")],
+                next_cursor: Some("page-2".to_owned()),
+            },
+            ToolPage {
+                tools: vec![read_only_tool("alpha")],
+                next_cursor: None,
+            },
+        ]),
+        cursors: Vec::new(),
+    };
+    let plan = discover(&mut fetcher, basis())
+        .await
+        .expect("discovery succeeds");
+
+    assert_eq!(fetcher.cursors, [None, Some("page-2".to_owned())]);
+    assert_eq!(
+        plan.tools
+            .iter()
+            .map(|tool| tool.stable_key.as_str())
+            .collect::<Vec<_>>(),
+        ["alpha", "zeta"]
+    );
+    assert_eq!(plan.catalog_snapshot().expected_source_revision, 7);
+    assert_eq!(
+        plan.catalog_snapshot().expected_credential_revision,
+        Some(3)
+    );
+    assert_eq!(plan.artifacts[0].kind, ArtifactKind::McpCapabilities);
+    assert_eq!(plan.tools[0].stable_key, "alpha");
+    assert_eq!(plan.tools[0].intrinsic_mode, ToolMode::Enabled);
+    assert_eq!(plan.tools[1].stable_key, "zeta");
+    assert_eq!(plan.tools[1].intrinsic_mode, ToolMode::Ask);
+    assert!(plan.bindings.iter().all(|binding| matches!(
+        &binding.binding,
+        ToolBinding::McpHttpV1(definition) if definition.tool_name == binding.stable_key
+    )));
+}
+
+#[tokio::test]
+async fn exact_name_is_identity_across_reordering_and_stdio_conversion() {
+    let page = |tools| Fetcher {
+        pages: VecDeque::from([ToolPage {
+            tools,
+            next_cursor: None,
+        }]),
+        cursors: Vec::new(),
+    };
+    let mut first = page(vec![tool("a.b"), tool("a-b")]);
+    let mut second = page(vec![tool("a-b"), tool("a.b")]);
+    let first = discover(&mut first, basis()).await.unwrap();
+    let second = bindings_for_source_kind(discover(&mut second, basis()).await.unwrap(), true);
+    assert_eq!(
+        first
+            .tools
+            .iter()
+            .map(|tool| &tool.stable_key)
+            .collect::<Vec<_>>(),
+        second
+            .tools
+            .iter()
+            .map(|tool| &tool.stable_key)
+            .collect::<Vec<_>>()
+    );
+    assert!(
+        second
+            .bindings
+            .iter()
+            .all(|binding| matches!(binding.binding, ToolBinding::McpStdioV1(_)))
+    );
+}
+
+#[tokio::test]
+async fn destructive_annotations_choose_conservative_intrinsic_modes() {
+    let mut destructive = tool("destructive");
+    destructive.annotations = Some(McpToolAnnotations {
+        read_only_hint: Some(true),
+        destructive_hint: Some(true),
+        ..McpToolAnnotations::default()
+    });
+    let mut non_destructive = tool("non-destructive");
+    non_destructive.annotations = Some(McpToolAnnotations {
+        destructive_hint: Some(false),
+        ..McpToolAnnotations::default()
+    });
+    let mut fetcher = Fetcher {
+        pages: VecDeque::from([ToolPage {
+            tools: vec![
+                destructive,
+                non_destructive,
+                tool("unspecified"),
+                read_only_tool("safe"),
+            ],
+            next_cursor: None,
+        }]),
+        cursors: Vec::new(),
+    };
+    let plan = discover(&mut fetcher, basis()).await.unwrap();
+    let modes = plan
+        .tools
+        .iter()
+        .map(|tool| (tool.stable_key.as_str(), tool.intrinsic_mode))
+        .collect::<Vec<_>>();
+    assert_eq!(
+        modes,
+        [
+            ("destructive", ToolMode::Ask),
+            ("non-destructive", ToolMode::Ask),
+            ("safe", ToolMode::Enabled),
+            ("unspecified", ToolMode::Ask),
+        ]
+    );
+}
+
+#[tokio::test]
+async fn rejects_cursor_cycles_duplicates_invalid_schemas_and_limits_without_partial_plan() {
+    let mut failed = FailingFetcher { calls: 0 };
+    assert!(matches!(
+        discover(&mut failed, basis()).await,
+        Err(DiscoveryError::Fetch(_))
+    ));
+
+    let mut cycle = Fetcher {
+        pages: VecDeque::from([
+            ToolPage {
+                tools: vec![],
+                next_cursor: Some("again".to_owned()),
+            },
+            ToolPage {
+                tools: vec![],
+                next_cursor: Some("again".to_owned()),
+            },
+        ]),
+        cursors: Vec::new(),
+    };
+    assert!(matches!(
+        discover(&mut cycle, basis()).await,
+        Err(DiscoveryError::CursorCycle)
+    ));
+
+    let mut duplicates = Fetcher {
+        pages: VecDeque::from([ToolPage {
+            tools: vec![tool("same"), tool("same")],
+            next_cursor: None,
+        }]),
+        cursors: Vec::new(),
+    };
+    assert!(matches!(
+        discover(&mut duplicates, basis()).await,
+        Err(DiscoveryError::DuplicateTool { .. })
+    ));
+
+    let mut invalid = tool("invalid");
+    invalid.input_schema = json!(true);
+    let mut invalid = Fetcher {
+        pages: VecDeque::from([ToolPage {
+            tools: vec![invalid],
+            next_cursor: None,
+        }]),
+        cursors: Vec::new(),
+    };
+    assert!(matches!(
+        discover(&mut invalid, basis()).await,
+        Err(DiscoveryError::InvalidTool { .. })
+    ));
+
+    let mut limited = Fetcher {
+        pages: VecDeque::from([ToolPage {
+            tools: vec![tool("one"), tool("two")],
+            next_cursor: None,
+        }]),
+        cursors: Vec::new(),
+    };
+    let limits = DiscoveryLimits {
+        max_tools: 1,
+        ..DiscoveryLimits::default()
+    };
+    assert!(matches!(
+        discover_with_limits(&mut limited, basis(), limits).await,
+        Err(DiscoveryError::TooManyTools { maximum: 1 })
+    ));
+
+    let mut variant = tool("schema-variants");
+    variant.title = Some(String::new());
+    variant.description = Some(String::new());
+    variant.annotations = Some(McpToolAnnotations {
+        title: Some(String::new()),
+        ..McpToolAnnotations::default()
+    });
+    variant.input_schema = json!({});
+    variant.output_schema = Some(json!({ "allOf": [{ "type": "object" }] }));
+    let mut schema_variants = Fetcher {
+        pages: VecDeque::from([ToolPage {
+            tools: vec![variant],
+            next_cursor: None,
+        }]),
+        cursors: Vec::new(),
+    };
+    let normalized = discover(&mut schema_variants, basis())
+        .await
+        .expect("object schemas need not declare type at the root");
+    assert_eq!(normalized.tools[0].display_name, "schema-variants");
+    assert_eq!(normalized.tools[0].description, None);
+}
+
+#[tokio::test]
+async fn list_changed_bursts_coalesce_and_failed_refresh_remains_pending() {
+    let coalescer = ListChangedCoalescer::default();
+    assert!(coalescer.notify_changed());
+    let started = Arc::new(Barrier::new(2));
+    let release = Arc::new(Barrier::new(2));
+    let calls = Arc::new(Mutex::new(0usize));
+    let runner = {
+        let coalescer = coalescer.clone();
+        let started = started.clone();
+        let release = release.clone();
+        let calls = calls.clone();
+        tokio::spawn(async move {
+            coalescer
+                .refresh_pending(|| {
+                    let started = started.clone();
+                    let release = release.clone();
+                    let calls = calls.clone();
+                    async move {
+                        let mut count = calls.lock().await;
+                        *count += 1;
+                        let first = *count == 1;
+                        drop(count);
+                        if first {
+                            started.wait().await;
+                            release.wait().await;
+                        }
+                        Ok::<_, &'static str>(())
+                    }
+                })
+                .await
+        })
+    };
+    started.wait().await;
+    for _ in 0..20 {
+        assert!(!coalescer.notify_changed());
+    }
+    release.wait().await;
+    assert_eq!(runner.await.unwrap().unwrap(), 2);
+    assert_eq!(*calls.lock().await, 2);
+
+    assert!(coalescer.notify_changed());
+    assert_eq!(
+        coalescer
+            .refresh_pending(|| async { Err::<(), _>("transient") })
+            .await,
+        Err("transient")
+    );
+    assert!(coalescer.has_pending());
+    assert_eq!(
+        coalescer
+            .refresh_pending(|| async { Ok::<_, &'static str>(()) })
+            .await
+            .unwrap(),
+        1
+    );
+    assert!(!coalescer.has_pending());
+}
+
+#[tokio::test]
+async fn catalog_commit_is_atomic_cas_guarded_and_preserves_tombstone_identity() {
+    let directory = tempfile::tempdir().unwrap();
+    let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+        .await
+        .unwrap();
+    let mut initial_fetcher = Fetcher {
+        pages: VecDeque::from([ToolPage {
+            tools: vec![tool("alpha"), tool("beta")],
+            next_cursor: None,
+        }]),
+        cursors: Vec::new(),
+    };
+    let initial = discover(&mut initial_fetcher, basis()).await.unwrap();
+    let (source, _) = app
+        .catalog()
+        .create_source_with_catalog(
+            CreateSource {
+                kind: SourceKind::McpHttp,
+                preferred_slug: "mcp-fixture".to_owned(),
+                display_name: "MCP fixture".to_owned(),
+                description: None,
+                configuration: Map::new(),
+            },
+            &CredentialPayload {
+                schema_version: 1,
+                payload: json!({}),
+            },
+            initial.initial_catalog_snapshot(),
+            initial.bindings,
+            AuditContext::system(Some("mcp-create")),
+        )
+        .await
+        .unwrap();
+    let mut wrong_kind_fetcher = Fetcher {
+        pages: VecDeque::from([ToolPage {
+            tools: vec![tool("alpha"), tool("beta")],
+            next_cursor: None,
+        }]),
+        cursors: Vec::new(),
+    };
+    let mut wrong_kind_basis = basis();
+    wrong_kind_basis.expected_source_revision = source.revision;
+    wrong_kind_basis.expected_credential_revision = Some(0);
+    let wrong_kind = bindings_for_source_kind(
+        discover(&mut wrong_kind_fetcher, wrong_kind_basis)
+            .await
+            .unwrap(),
+        true,
+    );
+    assert!(matches!(
+        app.catalog()
+            .sync_catalog_with_bindings(
+                &source.id,
+                wrong_kind.catalog_snapshot(),
+                wrong_kind.bindings,
+                AuditContext::system(Some("mcp-wrong-kind")),
+            )
+            .await,
+        Err(CatalogError::Validation {
+            code: "invalid_source_kind",
+            ..
+        })
+    ));
+    assert_eq!(
+        app.catalog().source(&source.id).await.unwrap().revision,
+        source.revision
+    );
+    let mut mismatched_fetcher = Fetcher {
+        pages: VecDeque::from([ToolPage {
+            tools: vec![tool("alpha"), tool("beta")],
+            next_cursor: None,
+        }]),
+        cursors: Vec::new(),
+    };
+    let mut mismatch_basis = basis();
+    mismatch_basis.expected_source_revision = source.revision;
+    mismatch_basis.expected_credential_revision = Some(0);
+    let mut mismatched = discover(&mut mismatched_fetcher, mismatch_basis)
+        .await
+        .unwrap();
+    let ToolBinding::McpHttpV1(definition) = &mut mismatched.bindings[0].binding else {
+        panic!("HTTP discovery creates HTTP bindings")
+    };
+    definition.tool_name = "another-upstream-tool".to_owned();
+    assert!(matches!(
+        app.catalog()
+            .sync_catalog_with_bindings(
+                &source.id,
+                mismatched.catalog_snapshot(),
+                mismatched.bindings,
+                AuditContext::system(Some("mcp-mismatched-name")),
+            )
+            .await,
+        Err(CatalogError::Validation {
+            code: "invalid_tool_binding",
+            ..
+        })
+    ));
+    let initial_page = app
+        .catalog()
+        .list_tools(ListToolsFilter {
+            source_id: Some(source.id.clone()),
+            include_tombstoned: true,
+            limit: 100,
+            ..ListToolsFilter::default()
+        })
+        .await
+        .unwrap();
+    let beta_id = initial_page
+        .items
+        .iter()
+        .find(|tool| tool.stable_key == "beta")
+        .unwrap()
+        .id
+        .clone();
+
+    let mut refresh_basis = basis();
+    refresh_basis.expected_source_revision = source.revision;
+    refresh_basis.expected_credential_revision = Some(0);
+    let mut removed_fetcher = Fetcher {
+        pages: VecDeque::from([ToolPage {
+            tools: vec![tool("alpha")],
+            next_cursor: None,
+        }]),
+        cursors: Vec::new(),
+    };
+    let removed = discover(&mut removed_fetcher, refresh_basis).await.unwrap();
+    app.catalog()
+        .sync_catalog_with_bindings(
+            &source.id,
+            removed.catalog_snapshot(),
+            removed.bindings.clone(),
+            AuditContext::system(Some("mcp-remove")),
+        )
+        .await
+        .unwrap();
+    let stale_error = app
+        .catalog()
+        .sync_catalog_with_bindings(
+            &source.id,
+            removed.catalog_snapshot(),
+            removed.bindings,
+            AuditContext::system(Some("mcp-stale")),
+        )
+        .await
+        .unwrap_err();
+    assert!(matches!(
+        stale_error,
+        CatalogError::RevisionConflict {
+            scope: "source",
+            ..
+        }
+    ));
+    let tombstoned_page = app
+        .catalog()
+        .list_tools(ListToolsFilter {
+            source_id: Some(source.id.clone()),
+            include_tombstoned: true,
+            limit: 100,
+            ..ListToolsFilter::default()
+        })
+        .await
+        .unwrap();
+    let tombstoned = tombstoned_page
+        .items
+        .iter()
+        .find(|tool| tool.stable_key == "beta")
+        .unwrap();
+    assert_eq!(tombstoned.id, beta_id);
+    assert!(!tombstoned.present);
+
+    let refreshed_source = app.catalog().source(&source.id).await.unwrap();
+    let mut restore_basis = basis();
+    restore_basis.expected_source_revision = refreshed_source.revision;
+    restore_basis.expected_credential_revision = Some(0);
+    let mut restore_fetcher = Fetcher {
+        pages: VecDeque::from([ToolPage {
+            tools: vec![tool("beta"), tool("alpha")],
+            next_cursor: None,
+        }]),
+        cursors: Vec::new(),
+    };
+    let restored = discover(&mut restore_fetcher, restore_basis).await.unwrap();
+    app.catalog()
+        .sync_catalog_with_bindings(
+            &source.id,
+            restored.catalog_snapshot(),
+            restored.bindings,
+            AuditContext::system(Some("mcp-restore")),
+        )
+        .await
+        .unwrap();
+    let restored_page = app
+        .catalog()
+        .list_tools(ListToolsFilter {
+            source_id: Some(source.id),
+            include_tombstoned: true,
+            limit: 100,
+            ..ListToolsFilter::default()
+        })
+        .await
+        .unwrap();
+    let restored_beta = restored_page
+        .items
+        .iter()
+        .find(|tool| tool.stable_key == "beta")
+        .unwrap();
+    assert_eq!(restored_beta.id, beta_id);
+    assert!(restored_beta.present);
+}
diff --git a/src/mcp/downstream/mod.rs b/src/mcp/downstream/mod.rs
new file mode 100644
index 000000000..ed4773adf
--- /dev/null
+++ b/src/mcp/downstream/mod.rs
@@ -0,0 +1,2033 @@
+use std::{
+    collections::HashMap,
+    future::Future,
+    sync::atomic::{AtomicBool, Ordering},
+    sync::{Arc, Mutex},
+    time::{Duration, Instant},
+};
+
+use axum::{
+    Router,
+    extract::{DefaultBodyLimit, Extension, State},
+    http::{HeaderMap, HeaderValue, StatusCode, header},
+    middleware::{self, Next},
+    response::{IntoResponse, Response},
+    routing::post,
+};
+use rmcp::model::ProtocolVersion;
+use serde::{Deserialize, Serialize};
+use serde_json::{Map, Value, json};
+use sha2::{Digest, Sha256};
+use tokio::sync::{Notify, OwnedSemaphorePermit, Semaphore};
+use url::Url;
+use uuid::Uuid;
+
+use crate::{
+    actor::ToolActor,
+    catalog::{CatalogError, CatalogStore, RequestSurface},
+    database::Database,
+    execution::{ExecuteCodeRequest, ExecutionService, ExecutionServiceError},
+    invocation::{
+        GatewayInvokeError, McpIdempotencyBlob, McpIdempotencyClaim, McpIdempotencyRequest,
+        ToolCall, ToolCallError, ToolCallService, ToolResult,
+    },
+    tasks::TaskTracker,
+    unix_timestamp,
+};
+
+const PROTOCOL_VERSION: &str = "2025-11-25";
+const SESSION_HEADER: &str = "mcp-session-id";
+const PROTOCOL_HEADER: &str = "mcp-protocol-version";
+const MAX_MCP_BODY_BYTES: usize = crate::invocation::MAX_ARGUMENT_BYTES + 64 * 1024;
+const MAX_BEARER_TOKEN_BYTES: usize = 512;
+const MAX_SESSIONS: usize = 4_096;
+const MAX_SESSIONS_PER_TOKEN: usize = 32;
+const MAX_ACTIVE_REQUESTS: usize = 4_096;
+const MAX_PRE_CANCELS_PER_SESSION: usize = 128;
+const MAX_CONCURRENT_BODIES: usize = 16;
+const MAX_CONCURRENT_BODIES_PER_TOKEN: usize = 4;
+const MAX_CONCURRENT_EXECUTIONS: usize = 16;
+const MAX_CONCURRENT_EXECUTIONS_PER_TOKEN: usize = 4;
+const SESSION_TTL: Duration = Duration::from_secs(8 * 60 * 60);
+const UNINITIALIZED_SESSION_TTL: Duration = Duration::from_secs(5 * 60);
+const DEFAULT_EXECUTION_TIMEOUT_MILLIS: u64 = 30_000;
+const MAX_EXECUTION_TIMEOUT_MILLIS: u64 = 300_000;
+const PRE_CANCEL_TTL: Duration = Duration::from_secs(60);
+
+#[derive(Clone)]
+pub(crate) struct McpState {
+    database: Database,
+    _catalog: CatalogStore,
+    tool_calls: ToolCallService,
+    execution: ExecutionService,
+    origin: Arc<str>,
+    origin_url: Url,
+    sessions: Arc<Mutex<HashMap<String, Session>>>,
+    cancellations: CancellationRegistry,
+    tasks: TaskTracker,
+    body_limiter: McpRequestLimiter,
+    execution_limiter: McpRequestLimiter,
+    #[cfg(test)]
+    session_registration_race_hook: Arc<Mutex<Option<Arc<SessionRegistrationRaceHook>>>>,
+}
+
+#[derive(Clone)]
+struct McpRequestLimiter {
+    global: Arc<Semaphore>,
+    by_token: Arc<Mutex<HashMap<String, Arc<Semaphore>>>>,
+    per_token: usize,
+}
+
+struct McpRequestPermits {
+    _global: OwnedSemaphorePermit,
+    _token: OwnedSemaphorePermit,
+}
+
+impl McpRequestLimiter {
+    fn new(global: usize, per_token: usize) -> Self {
+        Self {
+            global: Arc::new(Semaphore::new(global)),
+            by_token: Arc::new(Mutex::new(HashMap::new())),
+            per_token,
+        }
+    }
+
+    fn try_acquire(&self, token_id: &str) -> Option<Arc<McpRequestPermits>> {
+        let global = self.global.clone().try_acquire_owned().ok()?;
+        let token_slots = {
+            let mut slots = self
+                .by_token
+                .lock()
+                .unwrap_or_else(std::sync::PoisonError::into_inner);
+            slots
+                .entry(token_id.to_owned())
+                .or_insert_with(|| Arc::new(Semaphore::new(self.per_token)))
+                .clone()
+        };
+        let token = token_slots.try_acquire_owned().ok()?;
+        Some(Arc::new(McpRequestPermits {
+            _global: global,
+            _token: token,
+        }))
+    }
+}
+
+#[derive(Clone, Default)]
+struct CancellationRegistry {
+    entries: Arc<Mutex<HashMap<String, CancellationEntry>>>,
+}
+
+struct CancellationEntry {
+    notify: Arc<Notify>,
+    canceled: Arc<AtomicBool>,
+    waiters: usize,
+    created_at: Instant,
+}
+
+struct CancellationRegistration {
+    key: String,
+    notify: Arc<Notify>,
+    canceled: Arc<AtomicBool>,
+    registry: CancellationRegistry,
+}
+
+#[derive(Clone)]
+struct CancellationSignal {
+    notify: Arc<Notify>,
+    canceled: Arc<AtomicBool>,
+}
+
+enum SessionRequestRegistrationError {
+    SessionEnded,
+    Capacity,
+}
+
+#[cfg(test)]
+#[derive(Default)]
+struct SessionRegistrationRaceHook {
+    validation_complete: Notify,
+    continue_registration: Notify,
+}
+
+#[derive(Clone)]
+struct Session {
+    token_id: String,
+    token_name: String,
+    initialized: bool,
+    last_seen: Instant,
+}
+
+#[derive(Clone)]
+struct Identity {
+    token_id: String,
+    token_name: String,
+}
+
+#[derive(Debug, Deserialize)]
+struct IncomingMessage {
+    jsonrpc: Option<String>,
+    id: Option<Value>,
+    method: Option<String>,
+    #[serde(default)]
+    params: Value,
+}
+
+struct EnvelopeShape {
+    has_method: bool,
+    has_params: bool,
+    has_result: bool,
+    has_error: bool,
+    error_valid: bool,
+}
+
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct InitializeParams {
+    protocol_version: ProtocolVersion,
+    capabilities: Value,
+    client_info: Value,
+    #[serde(rename = "_meta")]
+    meta: Option<Value>,
+}
+
+#[derive(Deserialize, Default)]
+#[serde(deny_unknown_fields)]
+struct ListToolsParams {
+    cursor: Option<String>,
+    #[serde(rename = "_meta")]
+    meta: Option<Value>,
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct CallToolParams {
+    name: String,
+    #[serde(default = "empty_arguments")]
+    arguments: Map<String, Value>,
+    #[serde(rename = "_meta")]
+    meta: Option<Value>,
+}
+
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct ExecuteArguments {
+    code: String,
+    timeout_ms: Option<u64>,
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct DirectCallArguments {
+    path: String,
+    #[serde(default = "empty_arguments")]
+    arguments: Map<String, Value>,
+}
+
+#[derive(Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+struct SearchArguments {
+    query: String,
+    namespace: Option<String>,
+    #[serde(default = "default_search_limit")]
+    limit: u32,
+    #[serde(default)]
+    offset: u32,
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct DescribeArguments {
+    path: String,
+}
+
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct CancelledParams {
+    request_id: Value,
+}
+
+#[derive(Serialize)]
+struct McpTool {
+    name: String,
+    title: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    description: Option<String>,
+    #[serde(rename = "inputSchema")]
+    input_schema: Value,
+    #[serde(rename = "outputSchema", skip_serializing_if = "Option::is_none")]
+    output_schema: Option<Value>,
+}
+
+impl McpState {
+    pub(crate) fn new(
+        database: Database,
+        catalog: CatalogStore,
+        tool_calls: ToolCallService,
+        execution: ExecutionService,
+        tasks: TaskTracker,
+        origin: String,
+    ) -> Self {
+        let origin_url = Url::parse(&origin).expect("validated application origins are URLs");
+        Self {
+            database,
+            _catalog: catalog,
+            tool_calls,
+            execution,
+            origin: Arc::from(origin),
+            origin_url,
+            sessions: Arc::new(Mutex::new(HashMap::new())),
+            cancellations: CancellationRegistry::default(),
+            tasks,
+            body_limiter: McpRequestLimiter::new(
+                MAX_CONCURRENT_BODIES,
+                MAX_CONCURRENT_BODIES_PER_TOKEN,
+            ),
+            execution_limiter: McpRequestLimiter::new(
+                MAX_CONCURRENT_EXECUTIONS,
+                MAX_CONCURRENT_EXECUTIONS_PER_TOKEN,
+            ),
+            #[cfg(test)]
+            session_registration_race_hook: Arc::new(Mutex::new(None)),
+        }
+    }
+
+    pub(crate) fn revoke_token(&self, token_id: &str) {
+        let mut sessions = self
+            .sessions
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        let revoked_sessions = sessions
+            .iter()
+            .filter(|(_, session)| session.token_id == token_id)
+            .map(|(session_id, _)| session_id.clone())
+            .collect::<Vec<_>>();
+        for session_id in revoked_sessions {
+            sessions.remove(&session_id);
+            self.cancellations.cancel_session(&session_id);
+        }
+    }
+
+    fn create_session(&self, identity: &Identity) -> Result<String, TransportError> {
+        let now = Instant::now();
+        let mut sessions = self
+            .sessions
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        self.prune_expired_sessions(&mut sessions, now);
+        if sessions
+            .values()
+            .filter(|session| session.token_id == identity.token_id)
+            .count()
+            >= MAX_SESSIONS_PER_TOKEN
+        {
+            return Err(TransportError::service_unavailable(
+                "session_capacity",
+                "The API token has reached its MCP session limit.",
+            ));
+        }
+        if sessions.len() >= MAX_SESSIONS {
+            return Err(TransportError::service_unavailable(
+                "session_capacity",
+                "The MCP session limit has been reached.",
+            ));
+        }
+        let id = Uuid::new_v4().to_string();
+        sessions.insert(
+            id.clone(),
+            Session {
+                token_id: identity.token_id.clone(),
+                token_name: identity.token_name.clone(),
+                initialized: false,
+                last_seen: now,
+            },
+        );
+        Ok(id)
+    }
+
+    fn require_session(
+        &self,
+        headers: &HeaderMap,
+        identity: &Identity,
+        require_initialized: bool,
+    ) -> Result<(String, Session), TransportError> {
+        require_protocol_version(headers)?;
+        let id = unique_text_header(headers, SESSION_HEADER)?.ok_or_else(|| {
+            TransportError::bad_request(
+                "missing_session",
+                "Mcp-Session-Id is required after initialization.",
+            )
+        })?;
+        if id.len() > 128 || !id.bytes().all(|byte| (0x21..=0x7e).contains(&byte)) {
+            return Err(TransportError::bad_request(
+                "invalid_session",
+                "Mcp-Session-Id is invalid.",
+            ));
+        }
+        let now = Instant::now();
+        let mut sessions = self
+            .sessions
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        self.prune_expired_sessions(&mut sessions, now);
+        let session = sessions.get_mut(id).ok_or_else(|| {
+            TransportError::not_found("session_not_found", "The MCP session does not exist.")
+        })?;
+        if session.token_id != identity.token_id {
+            return Err(TransportError::not_found(
+                "session_not_found",
+                "The MCP session does not exist.",
+            ));
+        }
+        if require_initialized && !session.initialized {
+            return Err(TransportError::bad_request(
+                "session_not_initialized",
+                "The MCP initialization handshake is incomplete.",
+            ));
+        }
+        session.last_seen = now;
+        Ok((id.to_owned(), session.clone()))
+    }
+
+    fn register_session_request(
+        &self,
+        session_id: &str,
+        token_id: &str,
+        request_key: String,
+    ) -> Result<CancellationRegistration, SessionRequestRegistrationError> {
+        let mut sessions = self
+            .sessions
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        self.prune_expired_sessions(&mut sessions, Instant::now());
+        let active = sessions
+            .get(session_id)
+            .is_some_and(|session| session.initialized && session.token_id == token_id);
+        if !active {
+            return Err(SessionRequestRegistrationError::SessionEnded);
+        }
+        self.cancellations
+            .register(request_key)
+            .ok_or(SessionRequestRegistrationError::Capacity)
+    }
+
+    fn terminate_session(&self, session_id: &str, token_id: &str) -> bool {
+        let mut sessions = self
+            .sessions
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        let owned = sessions
+            .get(session_id)
+            .is_some_and(|session| session.token_id == token_id);
+        if owned {
+            sessions.remove(session_id);
+            self.cancellations.cancel_session(session_id);
+        }
+        owned
+    }
+
+    fn prune_expired_sessions(&self, sessions: &mut HashMap<String, Session>, now: Instant) {
+        let expired = sessions
+            .iter()
+            .filter(|(_, session)| {
+                let ttl = if session.initialized {
+                    SESSION_TTL
+                } else {
+                    UNINITIALIZED_SESSION_TTL
+                };
+                now.saturating_duration_since(session.last_seen) >= ttl
+            })
+            .map(|(session_id, _)| session_id.clone())
+            .collect::<Vec<_>>();
+        for session_id in expired {
+            sessions.remove(&session_id);
+            self.cancellations.cancel_session(&session_id);
+        }
+    }
+}
+
+impl CancellationRegistry {
+    fn register(&self, key: String) -> Option<CancellationRegistration> {
+        let mut entries = self
+            .entries
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        let now = Instant::now();
+        entries.retain(|_, entry| {
+            entry.waiters > 0 || now.saturating_duration_since(entry.created_at) < PRE_CANCEL_TTL
+        });
+        if !entries.contains_key(&key) && entries.len() >= MAX_ACTIVE_REQUESTS {
+            return None;
+        }
+        let entry = entries
+            .entry(key.clone())
+            .or_insert_with(|| CancellationEntry {
+                notify: Arc::new(Notify::new()),
+                canceled: Arc::new(AtomicBool::new(false)),
+                waiters: 0,
+                created_at: now,
+            });
+        entry.waiters = entry.waiters.saturating_add(1);
+        Some(CancellationRegistration {
+            key,
+            notify: entry.notify.clone(),
+            canceled: entry.canceled.clone(),
+            registry: self.clone(),
+        })
+    }
+
+    fn cancel(&self, key: &str) {
+        let now = Instant::now();
+        let mut entries = self
+            .entries
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        entries.retain(|_, entry| {
+            entry.waiters > 0 || now.saturating_duration_since(entry.created_at) < PRE_CANCEL_TTL
+        });
+        let session_prefix = key
+            .split_once('\0')
+            .map(|(session, _)| format!("{session}\0"));
+        let session_tombstones = session_prefix.as_deref().map_or(0, |prefix| {
+            entries
+                .iter()
+                .filter(|(entry_key, entry)| entry.waiters == 0 && entry_key.starts_with(prefix))
+                .count()
+        });
+        if !entries.contains_key(key)
+            && entries.len() < MAX_ACTIVE_REQUESTS
+            && session_tombstones < MAX_PRE_CANCELS_PER_SESSION
+        {
+            entries.insert(
+                key.to_owned(),
+                CancellationEntry {
+                    notify: Arc::new(Notify::new()),
+                    canceled: Arc::new(AtomicBool::new(true)),
+                    waiters: 0,
+                    created_at: now,
+                },
+            );
+        }
+        if let Some(entry) = entries.get(key) {
+            entry.canceled.store(true, Ordering::Release);
+            entry.notify.notify_waiters();
+        }
+    }
+
+    fn cancel_session(&self, session_id: &str) {
+        let prefix = format!("{session_id}\0");
+        let signals = self
+            .entries
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+            .iter()
+            .filter(|(key, _)| key.starts_with(&prefix))
+            .map(|(_, entry)| (entry.notify.clone(), entry.canceled.clone()))
+            .collect::<Vec<_>>();
+        for (notify, canceled) in signals {
+            canceled.store(true, Ordering::Release);
+            notify.notify_waiters();
+        }
+    }
+}
+
+impl Drop for CancellationRegistration {
+    fn drop(&mut self) {
+        let mut entries = self
+            .registry
+            .entries
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        let remove = entries.get_mut(&self.key).is_some_and(|entry| {
+            if !Arc::ptr_eq(&entry.notify, &self.notify) {
+                return false;
+            }
+            entry.waiters = entry.waiters.saturating_sub(1);
+            entry.waiters == 0
+        });
+        if remove {
+            entries.remove(&self.key);
+        }
+    }
+}
+
+pub(crate) fn router<S>(state: McpState) -> Router<S>
+where
+    S: Clone + Send + Sync + 'static,
+{
+    let guard_state = state.clone();
+    Router::new()
+        .route(
+            "/mcp",
+            post(handle_post)
+                .get(handle_get)
+                .delete(handle_delete)
+                .options(handle_options),
+        )
+        .layer(DefaultBodyLimit::max(MAX_MCP_BODY_BYTES))
+        .route_layer(middleware::from_fn_with_state(
+            guard_state,
+            connection_guard,
+        ))
+        .with_state(state)
+}
+
+async fn connection_guard(
+    State(state): State<McpState>,
+    mut request: axum::extract::Request,
+    next: Next,
+) -> Response {
+    if request.method() != axum::http::Method::OPTIONS {
+        if let Err(error) = validate_connection(&state, request.headers()) {
+            return error.into_response();
+        }
+        let identity = match authenticate(&state, request.headers()).await {
+            Ok(identity) => identity,
+            Err(error) => return error.into_response(),
+        };
+        if request.method() == axum::http::Method::POST {
+            let Some(permits) = state.body_limiter.try_acquire(&identity.token_id) else {
+                return TransportError::too_many_requests(
+                    "mcp_busy",
+                    "The MCP endpoint is busy. Try again shortly.",
+                )
+                .into_response();
+            };
+            request.extensions_mut().insert(permits);
+        }
+        request.extensions_mut().insert(identity);
+    }
+    next.run(request).await
+}
+
+async fn handle_options(State(state): State<McpState>, headers: HeaderMap) -> Response {
+    if let Err(error) = validate_origin(&state, &headers) {
+        return error.into_response();
+    }
+    let mut response = StatusCode::NO_CONTENT.into_response();
+    add_cors_headers(response.headers_mut(), &state);
+    response.headers_mut().insert(
+        header::ALLOW,
+        HeaderValue::from_static("POST, GET, DELETE, OPTIONS"),
+    );
+    response
+}
+
+async fn handle_get(
+    State(state): State<McpState>,
+    Extension(identity): Extension<Identity>,
+    headers: HeaderMap,
+) -> Response {
+    if let Err(error) = validate_connection(&state, &headers) {
+        return error.into_response();
+    }
+    if let Err(error) = state.require_session(&headers, &identity, true) {
+        return error.into_response();
+    }
+    let mut response = StatusCode::METHOD_NOT_ALLOWED.into_response();
+    response.headers_mut().insert(
+        header::ALLOW,
+        HeaderValue::from_static("POST, DELETE, OPTIONS"),
+    );
+    add_cors_headers(response.headers_mut(), &state);
+    response
+}
+
+async fn handle_delete(
+    State(state): State<McpState>,
+    Extension(identity): Extension<Identity>,
+    headers: HeaderMap,
+) -> Response {
+    if let Err(error) = validate_connection(&state, &headers) {
+        return error.into_response();
+    }
+    let (session_id, session) = match state.require_session(&headers, &identity, false) {
+        Ok(session) => session,
+        Err(error) => return error.into_response(),
+    };
+    if !state.terminate_session(&session_id, &session.token_id) {
+        return TransportError::not_found("session_not_found", "The MCP session does not exist.")
+            .into_response();
+    }
+    let mut response = StatusCode::NO_CONTENT.into_response();
+    add_cors_headers(response.headers_mut(), &state);
+    response
+}
+
+async fn handle_post(
+    State(state): State<McpState>,
+    Extension(identity): Extension<Identity>,
+    Extension(request_permits): Extension<Arc<McpRequestPermits>>,
+    headers: HeaderMap,
+    body: axum::body::Bytes,
+) -> Response {
+    drop(request_permits);
+    if let Err(error) = validate_connection(&state, &headers) {
+        return error.into_response();
+    }
+    if let Err(error) = validate_post_headers(&headers) {
+        return error.into_response();
+    }
+    let raw_message = match serde_json::from_slice::<Value>(&body) {
+        Ok(message) => message,
+        Err(_) => return rpc_error_response(None, -32700, "Parse error", None, &state),
+    };
+    let Some(object) = raw_message.as_object() else {
+        return rpc_error_response(None, -32600, "Invalid Request", None, &state);
+    };
+    let shape = EnvelopeShape {
+        has_method: object.contains_key("method"),
+        has_params: object.contains_key("params"),
+        has_result: object.contains_key("result"),
+        has_error: object.contains_key("error"),
+        error_valid: object.get("error").is_none_or(valid_jsonrpc_error),
+    };
+    let message = match serde_json::from_value::<IncomingMessage>(raw_message) {
+        Ok(message) => message,
+        Err(_) => return rpc_error_response(None, -32600, "Invalid Request", None, &state),
+    };
+    if message.jsonrpc.as_deref() != Some("2.0")
+        || message.id.as_ref().is_some_and(|id| !valid_request_id(id))
+        || (shape.has_method && message.method.is_none())
+    {
+        return rpc_error_response(message.id, -32600, "Invalid Request", None, &state);
+    }
+    if !shape.has_method {
+        let response_shape = message.id.is_some()
+            && (shape.has_result ^ shape.has_error)
+            && !shape.has_params
+            && shape.error_valid;
+        if !response_shape {
+            return TransportError::bad_request(
+                "invalid_jsonrpc_message",
+                "The JSON-RPC response is invalid.",
+            )
+            .into_response();
+        }
+        if let Err(error) = state.require_session(&headers, &identity, true) {
+            return error.into_response();
+        }
+        let mut response = StatusCode::ACCEPTED.into_response();
+        add_cors_headers(response.headers_mut(), &state);
+        return response;
+    }
+    if shape.has_result || shape.has_error {
+        return TransportError::bad_request(
+            "invalid_jsonrpc_message",
+            "A JSON-RPC request cannot contain response fields.",
+        )
+        .into_response();
+    }
+    let method = message.method.as_deref().unwrap_or_default();
+    if method == "initialize" {
+        return initialize(state, headers, identity, message).await;
+    }
+    let (session_id, session) = match state.require_session(&headers, &identity, false) {
+        Ok(session) => session,
+        Err(error) => return error.into_response(),
+    };
+    if message.id.is_none() {
+        return handle_notification(state, session_id, session, message).await;
+    }
+    if !session.initialized {
+        return rpc_error_response(
+            message.id,
+            -32600,
+            "Initialization handshake incomplete",
+            None,
+            &state,
+        );
+    }
+    match method {
+        "ping" => rpc_result_response(message.id, json!({}), None, &state),
+        "tools/list" => list_tools(&state, message).await,
+        "tools/call" => call_tool(&state, &session_id, session, message).await,
+        _ => rpc_error_response(message.id, -32601, "Method not found", None, &state),
+    }
+}
+
+async fn initialize(
+    state: McpState,
+    headers: HeaderMap,
+    identity: Identity,
+    message: IncomingMessage,
+) -> Response {
+    let Some(id) = message.id else {
+        return rpc_error_response(None, -32600, "Invalid Request", None, &state);
+    };
+    match unique_text_header(&headers, SESSION_HEADER) {
+        Ok(None) => {}
+        Ok(Some(_)) => {
+            return TransportError::bad_request(
+                "unexpected_session",
+                "Initialization must not include Mcp-Session-Id.",
+            )
+            .into_response();
+        }
+        Err(error) => return error.into_response(),
+    }
+    let params = match serde_json::from_value::<InitializeParams>(message.params) {
+        Ok(params) => params,
+        Err(_) => return rpc_error_response(Some(id), -32602, "Invalid params", None, &state),
+    };
+    if params.protocol_version != ProtocolVersion::V_2025_11_25 {
+        return rpc_error_response(
+            Some(id),
+            -32602,
+            "Unsupported protocol version",
+            Some(json!({ "supported": [PROTOCOL_VERSION] })),
+            &state,
+        );
+    }
+    let client_info_valid = params.client_info.as_object().is_some_and(|client_info| {
+        client_info
+            .get("name")
+            .and_then(Value::as_str)
+            .is_some_and(|name| !name.is_empty())
+            && client_info
+                .get("version")
+                .and_then(Value::as_str)
+                .is_some_and(|version| !version.is_empty())
+    });
+    if !params.capabilities.is_object() || !client_info_valid {
+        return rpc_error_response(Some(id), -32602, "Invalid params", None, &state);
+    }
+    let _ = params.meta;
+    let session_id = match state.create_session(&identity) {
+        Ok(session_id) => session_id,
+        Err(error) => return error.into_response(),
+    };
+    rpc_result_response(
+        Some(id),
+        json!({
+            "protocolVersion": ProtocolVersion::V_2025_11_25,
+            "capabilities": { "tools": { "listChanged": false } },
+            "serverInfo": {
+                "name": "executor",
+                "title": "Executor",
+                "version": env!("CARGO_PKG_VERSION")
+            },
+            "instructions": "Executor exposes the globally enabled tool catalog. Tools in Ask mode pause until approved by the administrator."
+        }),
+        Some(&session_id),
+        &state,
+    )
+}
+
+async fn handle_notification(
+    state: McpState,
+    session_id: String,
+    _session: Session,
+    message: IncomingMessage,
+) -> Response {
+    if message.method.as_deref() == Some("notifications/initialized") {
+        let mut sessions = state
+            .sessions
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        if let Some(session) = sessions.get_mut(&session_id) {
+            session.initialized = true;
+            session.last_seen = Instant::now();
+        }
+    } else if message.method.as_deref() == Some("notifications/cancelled")
+        && let Ok(params) = serde_json::from_value::<CancelledParams>(message.params)
+        && valid_request_id(&params.request_id)
+    {
+        state.cancellations.cancel(&request_cancellation_key(
+            &session_id,
+            &rpc_id_string(&params.request_id),
+        ));
+    }
+    let mut response = StatusCode::ACCEPTED.into_response();
+    add_cors_headers(response.headers_mut(), &state);
+    response
+}
+
+async fn list_tools(state: &McpState, message: IncomingMessage) -> Response {
+    let id = message.id;
+    let params = match decode_optional_params::<ListToolsParams>(message.params) {
+        Ok(params) => params,
+        Err(()) => return rpc_error_response(id, -32602, "Invalid params", None, state),
+    };
+    let _ = params.meta;
+    if params.cursor.is_some() {
+        return rpc_error_response(id, -32602, "Invalid cursor", None, state);
+    }
+    rpc_result_response(id, json!({ "tools": virtual_tools() }), None, state)
+}
+
+async fn call_tool(
+    state: &McpState,
+    session_id: &str,
+    session: Session,
+    message: IncomingMessage,
+) -> Response {
+    let id = message.id;
+    let params = match serde_json::from_value::<CallToolParams>(message.params) {
+        Ok(params) => params,
+        Err(_) => return rpc_error_response(id, -32602, "Invalid params", None, state),
+    };
+    if params.name.is_empty() || params.name.len() > 512 {
+        return rpc_error_response(id, -32602, "Invalid params", None, state);
+    }
+    if !matches!(
+        params.name.as_str(),
+        "execute" | "call" | "search" | "describe" | "sources"
+    ) {
+        return rpc_error_response(
+            id,
+            -32602,
+            "The requested tool does not exist.",
+            None,
+            state,
+        );
+    }
+    let _ = params.meta;
+    let correlation = rpc_id_string(id.as_ref().expect("request IDs are present for calls"));
+    #[cfg(test)]
+    {
+        let hook = state
+            .session_registration_race_hook
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+            .clone();
+        if let Some(hook) = hook {
+            hook.validation_complete.notify_one();
+            hook.continue_registration.notified().await;
+        }
+    }
+    let Some(execution_permits) = state.execution_limiter.try_acquire(&session.token_id) else {
+        return rpc_error_response(
+            id,
+            -32603,
+            "The MCP execution limit was reached.",
+            None,
+            state,
+        );
+    };
+    let cancellation = match state.register_session_request(
+        session_id,
+        &session.token_id,
+        request_cancellation_key(session_id, &correlation),
+    ) {
+        Ok(cancellation) => cancellation,
+        Err(SessionRequestRegistrationError::SessionEnded) => {
+            return idempotency_error(id, GatewayInvokeError::Canceled, state);
+        }
+        Err(SessionRequestRegistrationError::Capacity) => {
+            return rpc_error_response(
+                id,
+                -32603,
+                "The MCP request limit was reached.",
+                None,
+                state,
+            );
+        }
+    };
+    if cancellation.canceled.load(Ordering::Acquire) {
+        return idempotency_error(id, GatewayInvokeError::Canceled, state);
+    }
+    let session_id = session_id.to_owned();
+    let task_state = state.clone();
+    let detached = async move {
+        let _execution_permits = execution_permits;
+        let state = &task_state;
+        let execution_id = format!("mcp:{session_id}:{correlation}");
+        let token_id = session.token_id.clone();
+        let actor = ToolActor::api_token(token_id.clone(), Some(session.token_name));
+        let arguments = Value::Object(params.arguments);
+        let idempotency_key = mcp_idempotency_key(&session_id, &correlation);
+        match params.name.as_str() {
+            "execute" => {
+                let request = idempotency_request(
+                    &token_id,
+                    &idempotency_key,
+                    "executor.execute",
+                    &arguments,
+                );
+                match prepare_execute(arguments) {
+                    Ok(arguments) => {
+                        let request_log_id =
+                            mcp_execution_request_id(&token_id, &session_id, &correlation);
+                        run_idempotent_virtual(
+                            state,
+                            &request,
+                            execute_virtual(state, &actor, &request_log_id, arguments),
+                            cancellation_signal(&cancellation),
+                        )
+                        .await
+                    }
+                    Err(error) => Err(error),
+                }
+            }
+            "call" => {
+                call_virtual(
+                    state,
+                    &actor,
+                    &execution_id,
+                    &correlation,
+                    arguments,
+                    &idempotency_key,
+                    cancellation_signal(&cancellation),
+                )
+                .await
+            }
+            "search" => {
+                let request =
+                    idempotency_request(&token_id, &idempotency_key, "executor.search", &arguments);
+                match prepare_search(arguments) {
+                    Ok(arguments) => {
+                        run_idempotent_virtual(
+                            state,
+                            &request,
+                            search_virtual(state, &actor, &execution_id, &correlation, arguments),
+                            cancellation_signal(&cancellation),
+                        )
+                        .await
+                    }
+                    Err(error) => Err(error),
+                }
+            }
+            "describe" => {
+                let request = idempotency_request(
+                    &token_id,
+                    &idempotency_key,
+                    "executor.describe",
+                    &arguments,
+                );
+                match prepare_describe(arguments) {
+                    Ok(arguments) => {
+                        run_idempotent_virtual(
+                            state,
+                            &request,
+                            describe_virtual(state, &actor, &execution_id, &correlation, arguments),
+                            cancellation_signal(&cancellation),
+                        )
+                        .await
+                    }
+                    Err(error) => Err(error),
+                }
+            }
+            "sources" => {
+                let request = idempotency_request(
+                    &token_id,
+                    &idempotency_key,
+                    "executor.sources",
+                    &arguments,
+                );
+                match prepare_sources(arguments) {
+                    Ok(()) => {
+                        run_idempotent_virtual(
+                            state,
+                            &request,
+                            sources_virtual(state, &actor, &execution_id, &correlation),
+                            cancellation_signal(&cancellation),
+                        )
+                        .await
+                    }
+                    Err(error) => Err(error),
+                }
+            }
+            _ => unreachable!("virtual tool names were validated before dispatch"),
+        }
+    };
+    let (completed, result) = tokio::sync::oneshot::channel();
+    if !state.tasks.spawn(async move {
+        let _ = completed.send(detached.await);
+    }) {
+        return rpc_error_response(id, -32603, "MCP service is shutting down", None, state);
+    }
+    let result = match result.await {
+        Ok(result) => result,
+        Err(_) => return rpc_error_response(id, -32603, "Internal error", None, state),
+    };
+    match result {
+        Ok(result) => tool_result_response(id, result, state),
+        Err(VirtualToolError::Execution(error)) => {
+            tracing::warn!(error = %error, "MCP TypeScript execution failed");
+            tool_result_response(
+                id,
+                failure_result("execution_failed", "TypeScript execution failed."),
+                state,
+            )
+        }
+        Err(VirtualToolError::InvalidArguments) => {
+            rpc_error_response(id, -32602, "Invalid params", None, state)
+        }
+        Err(VirtualToolError::Idempotency(error)) => idempotency_error(id, error, state),
+    }
+}
+
+fn idempotency_request(
+    token_id: &str,
+    key: &str,
+    callable_path: &str,
+    arguments: &Value,
+) -> McpIdempotencyRequest {
+    McpIdempotencyRequest {
+        owner_api_token_id: token_id.to_owned(),
+        key: key.to_owned(),
+        route: "POST /mcp tools/call".to_owned(),
+        callable_path: callable_path.to_owned(),
+        arguments: arguments.clone(),
+    }
+}
+
+#[derive(Debug)]
+enum VirtualToolError {
+    InvalidArguments,
+    Execution(ExecutionServiceError),
+    Idempotency(GatewayInvokeError),
+}
+
+async fn run_idempotent_virtual<F>(
+    state: &McpState,
+    request: &McpIdempotencyRequest,
+    operation: F,
+    cancellation: CancellationSignal,
+) -> Result<ToolResult, VirtualToolError>
+where
+    F: Future<Output = Result<ToolResult, VirtualToolError>>,
+{
+    let claim = state
+        .tool_calls
+        .claim_mcp_idempotency(request)
+        .await
+        .map_err(VirtualToolError::Idempotency)?;
+    let reservation = match claim {
+        McpIdempotencyClaim::Fresh(reservation) => *reservation,
+        McpIdempotencyClaim::Replay(response) => return decode_idempotent_result(response),
+        McpIdempotencyClaim::InProgress => {
+            match state
+                .tool_calls
+                .wait_mcp_idempotency(request, cancellation.wait())
+                .await
+                .map_err(VirtualToolError::Idempotency)?
+            {
+                McpIdempotencyClaim::Fresh(reservation) => *reservation,
+                McpIdempotencyClaim::Replay(response) => {
+                    return decode_idempotent_result(response);
+                }
+                McpIdempotencyClaim::Indeterminate => {
+                    return Err(VirtualToolError::Idempotency(
+                        GatewayInvokeError::OutcomeUnknown,
+                    ));
+                }
+                McpIdempotencyClaim::Mismatch => {
+                    return Err(VirtualToolError::Idempotency(
+                        GatewayInvokeError::KeyMismatch,
+                    ));
+                }
+                McpIdempotencyClaim::InProgress => {
+                    return Err(VirtualToolError::Idempotency(
+                        GatewayInvokeError::InProgress,
+                    ));
+                }
+            }
+        }
+        McpIdempotencyClaim::Indeterminate => {
+            return Err(VirtualToolError::Idempotency(
+                GatewayInvokeError::OutcomeUnknown,
+            ));
+        }
+        McpIdempotencyClaim::Mismatch => {
+            return Err(VirtualToolError::Idempotency(
+                GatewayInvokeError::KeyMismatch,
+            ));
+        }
+    };
+    let execution = reservation
+        .mark_executing()
+        .await
+        .map_err(VirtualToolError::Idempotency)?;
+    let result = tokio::select! {
+        result = operation => match result {
+            Ok(result) => result,
+            Err(error) => {
+                execution
+                    .mark_indeterminate()
+                    .await
+                    .map_err(VirtualToolError::Idempotency)?;
+                return Err(error);
+            }
+        },
+        () = cancellation.wait() => {
+            execution
+                .mark_indeterminate()
+                .await
+                .map_err(VirtualToolError::Idempotency)?;
+            return Err(VirtualToolError::Idempotency(GatewayInvokeError::Canceled));
+        }
+    };
+    let body = serde_json::to_vec(&result).map_err(|_| {
+        VirtualToolError::Idempotency(GatewayInvokeError::Idempotency(
+            "MCP result serialization failed".to_owned(),
+        ))
+    })?;
+    execution
+        .complete(McpIdempotencyBlob { body })
+        .await
+        .map_err(VirtualToolError::Idempotency)?;
+    Ok(result)
+}
+
+fn decode_idempotent_result(response: McpIdempotencyBlob) -> Result<ToolResult, VirtualToolError> {
+    serde_json::from_slice(&response.body).map_err(|_| {
+        VirtualToolError::Idempotency(GatewayInvokeError::Idempotency(
+            "stored MCP response was invalid".to_owned(),
+        ))
+    })
+}
+
+async fn call_virtual(
+    state: &McpState,
+    actor: &ToolActor,
+    execution_id: &str,
+    call_id: &str,
+    arguments: Value,
+    idempotency_key: &str,
+    cancellation: CancellationSignal,
+) -> Result<ToolResult, VirtualToolError> {
+    let arguments = serde_json::from_value::<DirectCallArguments>(arguments)
+        .map_err(|_| VirtualToolError::InvalidArguments)?;
+    if arguments.path.is_empty() || arguments.path.len() > 512 {
+        return Err(VirtualToolError::InvalidArguments);
+    }
+    let response = state
+        .tool_calls
+        .submit_mcp_idempotent(
+            ToolCall {
+                request_id: Uuid::new_v4().to_string(),
+                actor: actor.clone(),
+                surface: RequestSurface::Mcp,
+                execution_id: execution_id.to_owned(),
+                call_id: call_id.to_owned(),
+                worker_generation: 0,
+                path: arguments.path,
+                arguments: Value::Object(arguments.arguments),
+            },
+            "POST /mcp tools/call",
+            idempotency_key,
+            cancellation.wait(),
+        )
+        .await
+        .map_err(VirtualToolError::Idempotency)?;
+    if response.replayed {
+        tracing::debug!("replayed durable MCP call result");
+    }
+    Ok(response.result)
+}
+
+async fn execute_virtual(
+    state: &McpState,
+    actor: &ToolActor,
+    request_log_id: &str,
+    arguments: ExecuteArguments,
+) -> Result<ToolResult, VirtualToolError> {
+    let timeout_ms = arguments
+        .timeout_ms
+        .unwrap_or(DEFAULT_EXECUTION_TIMEOUT_MILLIS);
+    if !(1..=MAX_EXECUTION_TIMEOUT_MILLIS).contains(&timeout_ms) {
+        return Err(VirtualToolError::InvalidArguments);
+    }
+    let output = state
+        .execution
+        .execute(ExecuteCodeRequest {
+            request_id: request_log_id.to_owned(),
+            actor: actor.clone(),
+            surface: RequestSurface::Mcp,
+            code: arguments.code,
+            timeout: Duration::from_millis(timeout_ms),
+        })
+        .await
+        .map_err(VirtualToolError::Execution)?;
+    Ok(success_result(json!({
+        "executionId": output.execution_id,
+        "result": output.result,
+        "emits": output.emits,
+        "console": output.console,
+        "calls": output.calls
+    })))
+}
+
+fn prepare_execute(arguments: Value) -> Result<ExecuteArguments, VirtualToolError> {
+    let arguments = serde_json::from_value::<ExecuteArguments>(arguments)
+        .map_err(|_| VirtualToolError::InvalidArguments)?;
+    let timeout_ms = arguments
+        .timeout_ms
+        .unwrap_or(DEFAULT_EXECUTION_TIMEOUT_MILLIS);
+    if arguments.code.len() > crate::runtime::MAX_SOURCE_BYTES
+        || !(1..=MAX_EXECUTION_TIMEOUT_MILLIS).contains(&timeout_ms)
+    {
+        return Err(VirtualToolError::InvalidArguments);
+    }
+    Ok(arguments)
+}
+
+async fn search_virtual(
+    state: &McpState,
+    actor: &ToolActor,
+    execution_id: &str,
+    call_id: &str,
+    arguments: SearchArguments,
+) -> Result<ToolResult, VirtualToolError> {
+    let call = discovery_call(
+        actor,
+        execution_id,
+        call_id,
+        "executor.search",
+        serde_json::to_value(&arguments).expect("search arguments serialize"),
+    );
+    let result = match state
+        .tool_calls
+        .discover_search(
+            &call,
+            arguments.query,
+            arguments.namespace,
+            arguments.limit,
+            arguments.offset,
+        )
+        .await
+    {
+        Ok(result) => result,
+        Err(error) => {
+            tracing::warn!(error = %error, "MCP tool search failed");
+            return Ok(failure_result("discovery_failed", "Tool search failed."));
+        }
+    };
+    Ok(success_result(
+        serde_json::to_value(result).expect("discovery result serializes"),
+    ))
+}
+
+fn prepare_search(arguments: Value) -> Result<SearchArguments, VirtualToolError> {
+    let arguments = serde_json::from_value::<SearchArguments>(arguments)
+        .map_err(|_| VirtualToolError::InvalidArguments)?;
+    if !(1..=100).contains(&arguments.limit) {
+        return Err(VirtualToolError::InvalidArguments);
+    }
+    Ok(arguments)
+}
+
+async fn describe_virtual(
+    state: &McpState,
+    actor: &ToolActor,
+    execution_id: &str,
+    call_id: &str,
+    arguments: DescribeArguments,
+) -> Result<ToolResult, VirtualToolError> {
+    let call = discovery_call(
+        actor,
+        execution_id,
+        call_id,
+        "executor.describe",
+        json!({ "path": arguments.path }),
+    );
+    let result = match state
+        .tool_calls
+        .discover_describe(&call, &arguments.path)
+        .await
+    {
+        Ok(result) => result,
+        Err(error) => {
+            tracing::warn!(error = %error, "MCP tool description failed");
+            return Ok(failure_result(
+                "discovery_failed",
+                "Tool description failed.",
+            ));
+        }
+    };
+    Ok(success_result(
+        serde_json::to_value(result).expect("description serializes"),
+    ))
+}
+
+fn prepare_describe(arguments: Value) -> Result<DescribeArguments, VirtualToolError> {
+    let arguments = serde_json::from_value::<DescribeArguments>(arguments)
+        .map_err(|_| VirtualToolError::InvalidArguments)?;
+    if arguments.path.is_empty() || arguments.path.len() > 512 {
+        return Err(VirtualToolError::InvalidArguments);
+    }
+    Ok(arguments)
+}
+
+async fn sources_virtual(
+    state: &McpState,
+    actor: &ToolActor,
+    execution_id: &str,
+    call_id: &str,
+) -> Result<ToolResult, VirtualToolError> {
+    let call = discovery_call(actor, execution_id, call_id, "executor.sources", json!({}));
+    let result = match state.tool_calls.discover_sources(&call).await {
+        Ok(result) => result,
+        Err(error) => {
+            tracing::warn!(error = %error, "MCP source discovery failed");
+            return Ok(failure_result(
+                "discovery_failed",
+                "Source discovery failed.",
+            ));
+        }
+    };
+    Ok(success_result(json!({ "sources": result })))
+}
+
+fn prepare_sources(arguments: Value) -> Result<(), VirtualToolError> {
+    if arguments
+        .as_object()
+        .is_none_or(|arguments| !arguments.is_empty())
+    {
+        return Err(VirtualToolError::InvalidArguments);
+    }
+    Ok(())
+}
+
+fn discovery_call(
+    actor: &ToolActor,
+    execution_id: &str,
+    call_id: &str,
+    path: &str,
+    arguments: Value,
+) -> ToolCall {
+    ToolCall {
+        request_id: Uuid::new_v4().to_string(),
+        actor: actor.clone(),
+        surface: RequestSurface::Mcp,
+        execution_id: execution_id.to_owned(),
+        call_id: call_id.to_owned(),
+        worker_generation: 0,
+        path: path.to_owned(),
+        arguments,
+    }
+}
+
+fn success_result(data: Value) -> ToolResult {
+    ToolResult {
+        ok: true,
+        data: Some(data),
+        error: None,
+        http: None,
+    }
+}
+
+fn failure_result(code: &str, message: &str) -> ToolResult {
+    ToolResult {
+        ok: false,
+        data: None,
+        error: Some(crate::invocation::PublicToolError {
+            code: code.to_owned(),
+            message: message.to_owned(),
+        }),
+        http: None,
+    }
+}
+
+fn virtual_tools() -> Vec<McpTool> {
+    vec![
+        McpTool {
+            name: "execute".to_owned(),
+            title: "Execute TypeScript".to_owned(),
+            description: Some(
+                "Run sandboxed TypeScript that can discover and call multiple Executor tools concurrently."
+                    .to_owned(),
+            ),
+            input_schema: json!({
+                "type": "object",
+                "additionalProperties": false,
+                "required": ["code"],
+                "properties": {
+                    "code": { "type": "string" },
+                    "timeoutMs": { "type": "integer", "minimum": 1, "maximum": MAX_EXECUTION_TIMEOUT_MILLIS }
+                }
+            }),
+            output_schema: Some(generic_output_schema()),
+        },
+        McpTool {
+            name: "call".to_owned(),
+            title: "Call Tool".to_owned(),
+            description: Some(
+                "Call one enabled Executor tool. Ask-mode tools wait for administrator approval."
+                    .to_owned(),
+            ),
+            input_schema: json!({
+                "type": "object",
+                "additionalProperties": false,
+                "required": ["path"],
+                "properties": {
+                    "path": { "type": "string" },
+                    "arguments": { "type": "object", "additionalProperties": true }
+                }
+            }),
+            output_schema: None,
+        },
+        McpTool {
+            name: "search".to_owned(),
+            title: "Search Tools".to_owned(),
+            description: Some("Search the enabled global Executor tool catalog.".to_owned()),
+            input_schema: json!({
+                "type": "object",
+                "additionalProperties": false,
+                "required": ["query"],
+                "properties": {
+                    "query": { "type": "string" },
+                    "namespace": { "type": "string" },
+                    "limit": { "type": "integer", "minimum": 1, "maximum": 100, "default": 20 },
+                    "offset": { "type": "integer", "minimum": 0, "default": 0 }
+                }
+            }),
+            output_schema: Some(generic_output_schema()),
+        },
+        McpTool {
+            name: "describe".to_owned(),
+            title: "Describe Tool".to_owned(),
+            description: Some("Read the schemas and metadata for one enabled Executor tool.".to_owned()),
+            input_schema: json!({
+                "type": "object",
+                "additionalProperties": false,
+                "required": ["path"],
+                "properties": { "path": { "type": "string" } }
+            }),
+            output_schema: Some(generic_output_schema()),
+        },
+        McpTool {
+            name: "sources".to_owned(),
+            title: "List Sources".to_owned(),
+            description: Some("List sources with tools visible through the global catalog.".to_owned()),
+            input_schema: json!({ "type": "object", "additionalProperties": false }),
+            output_schema: Some(json!({
+                "type": "object",
+                "additionalProperties": false,
+                "required": ["sources"],
+                "properties": {
+                    "sources": { "type": "array", "items": { "type": "object" } }
+                }
+            })),
+        },
+    ]
+}
+
+fn generic_output_schema() -> Value {
+    json!({ "type": "object", "additionalProperties": true })
+}
+
+fn tool_result_response(id: Option<Value>, result: ToolResult, state: &McpState) -> Response {
+    let serialized = serde_json::to_string(&result).unwrap_or_else(|_| "null".to_owned());
+    let structured = result
+        .data
+        .as_ref()
+        .and_then(Value::as_object)
+        .map(|object| Value::Object(object.clone()));
+    let mut response = Map::from_iter([
+        (
+            "content".to_owned(),
+            json!([{ "type": "text", "text": serialized }]),
+        ),
+        ("isError".to_owned(), Value::Bool(!result.ok)),
+    ]);
+    if let Some(structured) = structured {
+        response.insert("structuredContent".to_owned(), structured);
+    }
+    rpc_result_response(id, Value::Object(response), None, state)
+}
+
+fn idempotency_error(id: Option<Value>, error: GatewayInvokeError, state: &McpState) -> Response {
+    let (code, message) = match error {
+        GatewayInvokeError::ToolCall(error) => return tool_call_failure(id, error, state),
+        GatewayInvokeError::KeyMismatch => (-32600, "The JSON-RPC request ID was reused."),
+        GatewayInvokeError::OutcomeUnknown => (-32603, "The prior invocation outcome is unknown."),
+        GatewayInvokeError::InProgress => (-32603, "The invocation is still in progress."),
+        GatewayInvokeError::Canceled => (-32603, "The invocation wait was canceled."),
+        GatewayInvokeError::InvalidKey
+        | GatewayInvokeError::Capacity
+        | GatewayInvokeError::Idempotency(_) => {
+            tracing::warn!(error = %error, "MCP idempotent invocation failed");
+            (-32603, "The invocation could not be completed safely.")
+        }
+    };
+    rpc_error_response(id, code, message, None, state)
+}
+
+fn tool_call_failure(id: Option<Value>, error: ToolCallError, state: &McpState) -> Response {
+    match error {
+        ToolCallError::Catalog(CatalogError::ToolNotFound { .. })
+        | ToolCallError::Catalog(CatalogError::NotFound { .. })
+        | ToolCallError::Catalog(CatalogError::ToolDisabled { .. })
+        | ToolCallError::InvalidArguments
+        | ToolCallError::ArgumentsTooLarge => rpc_error_response(
+            id,
+            -32602,
+            "The tool or its arguments are invalid.",
+            None,
+            state,
+        ),
+        error => {
+            tracing::warn!(error = %error, "MCP tool invocation failed");
+            tool_result_response(
+                id,
+                failure_result(
+                    "tool_call_failed",
+                    "The tool call could not be completed safely.",
+                ),
+                state,
+            )
+        }
+    }
+}
+
+fn rpc_result_response(
+    id: Option<Value>,
+    result: Value,
+    session_id: Option<&str>,
+    state: &McpState,
+) -> Response {
+    json_response(
+        StatusCode::OK,
+        json!({ "jsonrpc": "2.0", "id": id.unwrap_or(Value::Null), "result": result }),
+        session_id,
+        state,
+    )
+}
+
+fn rpc_error_response(
+    id: Option<Value>,
+    code: i64,
+    message: &'static str,
+    data: Option<Value>,
+    state: &McpState,
+) -> Response {
+    json_response(
+        StatusCode::OK,
+        json!({
+            "jsonrpc": "2.0",
+            "id": id.unwrap_or(Value::Null),
+            "error": { "code": code, "message": message, "data": data }
+        }),
+        None,
+        state,
+    )
+}
+
+fn json_response(
+    status: StatusCode,
+    body: Value,
+    session_id: Option<&str>,
+    state: &McpState,
+) -> Response {
+    let mut response = (status, axum::Json(body)).into_response();
+    if let Some(session_id) = session_id {
+        response.headers_mut().insert(
+            SESSION_HEADER,
+            HeaderValue::from_str(session_id).expect("UUID session IDs are valid headers"),
+        );
+    }
+    add_cors_headers(response.headers_mut(), state);
+    response
+}
+
+#[derive(Debug)]
+struct TransportError {
+    status: StatusCode,
+    code: &'static str,
+    message: &'static str,
+    authenticate: bool,
+}
+
+impl TransportError {
+    fn bad_request(code: &'static str, message: &'static str) -> Self {
+        Self::new(StatusCode::BAD_REQUEST, code, message)
+    }
+
+    fn unauthorized(code: &'static str, message: &'static str) -> Self {
+        Self {
+            status: StatusCode::UNAUTHORIZED,
+            code,
+            message,
+            authenticate: true,
+        }
+    }
+
+    fn forbidden(code: &'static str, message: &'static str) -> Self {
+        Self::new(StatusCode::FORBIDDEN, code, message)
+    }
+
+    fn not_found(code: &'static str, message: &'static str) -> Self {
+        Self::new(StatusCode::NOT_FOUND, code, message)
+    }
+
+    fn not_acceptable(code: &'static str, message: &'static str) -> Self {
+        Self::new(StatusCode::NOT_ACCEPTABLE, code, message)
+    }
+
+    fn service_unavailable(code: &'static str, message: &'static str) -> Self {
+        Self::new(StatusCode::SERVICE_UNAVAILABLE, code, message)
+    }
+
+    fn too_many_requests(code: &'static str, message: &'static str) -> Self {
+        Self::new(StatusCode::TOO_MANY_REQUESTS, code, message)
+    }
+
+    fn new(status: StatusCode, code: &'static str, message: &'static str) -> Self {
+        Self {
+            status,
+            code,
+            message,
+            authenticate: false,
+        }
+    }
+}
+
+impl IntoResponse for TransportError {
+    fn into_response(self) -> Response {
+        let mut response = (
+            self.status,
+            axum::Json(json!({ "error": { "code": self.code, "message": self.message } })),
+        )
+            .into_response();
+        if self.authenticate {
+            response.headers_mut().insert(
+                header::WWW_AUTHENTICATE,
+                HeaderValue::from_static("Bearer realm=\"executor-mcp\""),
+            );
+        }
+        response
+    }
+}
+
+async fn authenticate(state: &McpState, headers: &HeaderMap) -> Result<Identity, TransportError> {
+    let authorization =
+        unique_text_header(headers, header::AUTHORIZATION.as_str())?.ok_or_else(|| {
+            TransportError::unauthorized("unauthorized", "A valid Executor API token is required.")
+        })?;
+    let mut parts = authorization.split_ascii_whitespace();
+    let scheme = parts.next();
+    let token = parts.next();
+    if !scheme.is_some_and(|scheme| scheme.eq_ignore_ascii_case("bearer"))
+        || token.is_none()
+        || parts.next().is_some()
+    {
+        return Err(TransportError::unauthorized(
+            "unauthorized",
+            "A valid Executor API token is required.",
+        ));
+    }
+    let token = token.unwrap_or_default();
+    if token.is_empty() || token.len() > MAX_BEARER_TOKEN_BYTES {
+        return Err(TransportError::unauthorized(
+            "unauthorized",
+            "A valid Executor API token is required.",
+        ));
+    }
+    let digest = state.database.keyring.digest("api-token", token.as_bytes());
+    let identity = sqlx::query_as::<_, (String, String, Option<i64>)>(
+        "SELECT id, name, last_used_at FROM api_tokens WHERE token_digest = ? AND revoked_at IS NULL",
+    )
+    .bind(digest.to_vec())
+    .fetch_optional(&state.database.pool)
+    .await
+    .map_err(|error| {
+        tracing::error!(error = %error, "MCP token authentication failed");
+        TransportError::new(
+            StatusCode::INTERNAL_SERVER_ERROR,
+            "internal_error",
+            "The request could not be authenticated.",
+        )
+    })?
+    .ok_or_else(|| {
+        TransportError::unauthorized(
+            "unauthorized",
+            "A valid Executor API token is required.",
+        )
+    })?;
+    let now = unix_timestamp();
+    if identity
+        .2
+        .is_none_or(|last_used_at| last_used_at <= now - 60)
+    {
+        let _ = sqlx::query(
+            "UPDATE api_tokens SET last_used_at = ? WHERE id = ? AND revoked_at IS NULL AND (last_used_at IS NULL OR last_used_at <= ?)",
+        )
+        .bind(now)
+        .bind(&identity.0)
+        .bind(now - 60)
+        .execute(&state.database.pool)
+        .await;
+    }
+    Ok(Identity {
+        token_id: identity.0,
+        token_name: identity.1,
+    })
+}
+
+fn validate_origin(state: &McpState, headers: &HeaderMap) -> Result<(), TransportError> {
+    let Some(origin) = unique_text_header(headers, header::ORIGIN.as_str())? else {
+        return Ok(());
+    };
+    if origin == state.origin.as_ref() {
+        Ok(())
+    } else {
+        Err(TransportError::forbidden(
+            "invalid_origin",
+            "The request Origin does not match this Executor instance.",
+        ))
+    }
+}
+
+fn validate_connection(state: &McpState, headers: &HeaderMap) -> Result<(), TransportError> {
+    validate_host(state, headers)?;
+    validate_origin(state, headers)
+}
+
+fn validate_host(state: &McpState, headers: &HeaderMap) -> Result<(), TransportError> {
+    let host = unique_text_header(headers, header::HOST.as_str())?.ok_or_else(|| {
+        TransportError::bad_request("missing_host", "Host is required for the MCP endpoint.")
+    })?;
+    if host.len() > 512 || host.contains(['/', '\\', '@', '#', '?']) {
+        return Err(TransportError::forbidden(
+            "invalid_host",
+            "Host does not match this Executor instance.",
+        ));
+    }
+    let candidate =
+        Url::parse(&format!("{}://{host}", state.origin_url.scheme())).map_err(|_| {
+            TransportError::forbidden(
+                "invalid_host",
+                "Host does not match this Executor instance.",
+            )
+        })?;
+    let matches = candidate.host() == state.origin_url.host()
+        && candidate.port_or_known_default() == state.origin_url.port_or_known_default();
+    if matches {
+        Ok(())
+    } else {
+        Err(TransportError::forbidden(
+            "invalid_host",
+            "Host does not match this Executor instance.",
+        ))
+    }
+}
+
+fn validate_post_headers(headers: &HeaderMap) -> Result<(), TransportError> {
+    let content_type =
+        unique_text_header(headers, header::CONTENT_TYPE.as_str())?.ok_or_else(|| {
+            TransportError::new(
+                StatusCode::UNSUPPORTED_MEDIA_TYPE,
+                "unsupported_content_type",
+                "POST /mcp requires Content-Type: application/json.",
+            )
+        })?;
+    let mut content_type_parts = content_type.split(';');
+    let media_type_matches = content_type_parts
+        .next()
+        .is_some_and(|value| value.trim().eq_ignore_ascii_case("application/json"));
+    let parameters_valid = content_type_parts.all(|parameter| {
+        parameter
+            .trim()
+            .split_once('=')
+            .is_some_and(|(name, value)| {
+                name.trim().eq_ignore_ascii_case("charset")
+                    && value.trim().trim_matches('"').eq_ignore_ascii_case("utf-8")
+            })
+    });
+    if !media_type_matches || !parameters_valid {
+        return Err(TransportError::new(
+            StatusCode::UNSUPPORTED_MEDIA_TYPE,
+            "unsupported_content_type",
+            "POST /mcp requires Content-Type: application/json.",
+        ));
+    }
+    if !accepts(headers, "application/json") || !accepts(headers, "text/event-stream") {
+        return Err(TransportError::not_acceptable(
+            "unsupported_accept",
+            "POST /mcp requires Accept for application/json and text/event-stream.",
+        ));
+    }
+    Ok(())
+}
+
+fn require_protocol_version(headers: &HeaderMap) -> Result<(), TransportError> {
+    let version = unique_text_header(headers, PROTOCOL_HEADER)?.ok_or_else(|| {
+        TransportError::bad_request(
+            "missing_protocol_version",
+            "MCP-Protocol-Version is required after initialization.",
+        )
+    })?;
+    if version == PROTOCOL_VERSION {
+        Ok(())
+    } else {
+        Err(TransportError::bad_request(
+            "unsupported_protocol_version",
+            "MCP-Protocol-Version is not supported.",
+        ))
+    }
+}
+
+fn unique_text_header<'a>(
+    headers: &'a HeaderMap,
+    name: &str,
+) -> Result<Option<&'a str>, TransportError> {
+    let values = headers.get_all(name);
+    let mut values = values.iter();
+    let Some(value) = values.next() else {
+        return Ok(None);
+    };
+    if values.next().is_some() {
+        return Err(TransportError::bad_request(
+            "duplicate_header",
+            "A security-sensitive header was repeated.",
+        ));
+    }
+    value.to_str().map(Some).map_err(|_| {
+        TransportError::bad_request("invalid_header", "A request header is not valid text.")
+    })
+}
+
+fn accepts(headers: &HeaderMap, expected: &str) -> bool {
+    headers
+        .get_all(header::ACCEPT)
+        .iter()
+        .filter_map(|value| value.to_str().ok())
+        .flat_map(|value| value.split(','))
+        .any(|item| {
+            let mut segments = item.split(';');
+            let media_type = segments.next().unwrap_or_default().trim();
+            let rejected = segments.any(|parameter| {
+                parameter
+                    .trim()
+                    .split_once('=')
+                    .is_some_and(|(name, value)| {
+                        name.trim().eq_ignore_ascii_case("q")
+                            && value
+                                .trim()
+                                .parse::<f32>()
+                                .is_ok_and(|quality| quality <= 0.0)
+                    })
+            });
+            !rejected && (media_type == "*/*" || media_type.eq_ignore_ascii_case(expected))
+        })
+}
+
+fn add_cors_headers(headers: &mut HeaderMap, state: &McpState) {
+    if let Ok(origin) = HeaderValue::from_str(&state.origin) {
+        headers.insert(header::ACCESS_CONTROL_ALLOW_ORIGIN, origin);
+    }
+    headers.insert(header::VARY, HeaderValue::from_static("Origin"));
+    headers.insert(
+        header::ACCESS_CONTROL_ALLOW_METHODS,
+        HeaderValue::from_static("POST, GET, DELETE, OPTIONS"),
+    );
+    headers.insert(
+        header::ACCESS_CONTROL_ALLOW_HEADERS,
+        HeaderValue::from_static(
+            "Authorization, Content-Type, Accept, MCP-Session-Id, MCP-Protocol-Version",
+        ),
+    );
+    headers.insert(
+        header::ACCESS_CONTROL_EXPOSE_HEADERS,
+        HeaderValue::from_static("MCP-Session-Id"),
+    );
+}
+
+fn decode_optional_params<T>(value: Value) -> Result<T, ()>
+where
+    T: for<'de> Deserialize<'de> + Default,
+{
+    if value.is_null() {
+        Ok(T::default())
+    } else {
+        serde_json::from_value(value).map_err(|_| ())
+    }
+}
+
+fn empty_arguments() -> Map<String, Value> {
+    Map::new()
+}
+
+fn default_search_limit() -> u32 {
+    20
+}
+
+fn rpc_id_string(id: &Value) -> String {
+    match id {
+        Value::String(value) => format!("s:{value}"),
+        Value::Number(value) => format!("n:{value}"),
+        _ => "invalid".to_owned(),
+    }
+}
+
+fn mcp_idempotency_key(session_id: &str, request_id: &str) -> String {
+    let mut digest = Sha256::new();
+    digest.update(b"executor-mcp-idempotency-v1");
+    digest.update((session_id.len() as u64).to_be_bytes());
+    digest.update(session_id.as_bytes());
+    digest.update((request_id.len() as u64).to_be_bytes());
+    digest.update(request_id.as_bytes());
+    format!("mcp_{:x}", digest.finalize())
+}
+
+fn mcp_execution_request_id(token_id: &str, session_id: &str, request_id: &str) -> String {
+    let token_digest = mcp_request_log_digest(b"executor-mcp-request-log-token-v1", &[token_id]);
+    let session_digest =
+        mcp_request_log_digest(b"executor-mcp-request-log-session-v1", &[session_id]);
+    let request_digest = mcp_request_log_digest(
+        b"executor-mcp-request-log-v1",
+        &[token_id, session_id, request_id],
+    );
+    format!(
+        "mcp:{}:{}:{}",
+        &token_digest[..16],
+        &session_digest[..16],
+        request_digest
+    )
+}
+
+fn mcp_request_log_digest(domain: &[u8], fields: &[&str]) -> String {
+    let mut digest = Sha256::new();
+    digest.update(domain);
+    for field in fields {
+        digest.update((field.len() as u64).to_be_bytes());
+        digest.update(field.as_bytes());
+    }
+    format!("{:x}", digest.finalize())
+}
+
+fn request_cancellation_key(session_id: &str, request_id: &str) -> String {
+    format!("{session_id}\0{request_id}")
+}
+
+fn cancellation_signal(registration: &CancellationRegistration) -> CancellationSignal {
+    CancellationSignal {
+        notify: registration.notify.clone(),
+        canceled: registration.canceled.clone(),
+    }
+}
+
+impl CancellationSignal {
+    async fn wait(&self) {
+        if self.canceled.load(Ordering::Acquire) {
+            return;
+        }
+        let notified = self.notify.notified();
+        tokio::pin!(notified);
+        notified.as_mut().enable();
+        if self.canceled.load(Ordering::Acquire) {
+            return;
+        }
+        notified.await;
+    }
+}
+
+fn valid_request_id(id: &Value) -> bool {
+    match id {
+        Value::String(value) => value.len() <= 256 && !value.contains('\0'),
+        Value::Number(_) => true,
+        _ => false,
+    }
+}
+
+fn valid_jsonrpc_error(error: &Value) -> bool {
+    error.as_object().is_some_and(|error| {
+        error.get("code").and_then(Value::as_i64).is_some()
+            && error.get("message").and_then(Value::as_str).is_some()
+    })
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/src/mcp/downstream/tests.rs b/src/mcp/downstream/tests.rs
new file mode 100644
index 000000000..f9fe2c6af
--- /dev/null
+++ b/src/mcp/downstream/tests.rs
@@ -0,0 +1,1251 @@
+use std::{collections::BTreeMap, sync::Arc};
+
+use axum::{
+    Router,
+    body::Body,
+    http::{HeaderMap, HeaderValue, Method, Request, Response, StatusCode, header},
+};
+use http_body_util::BodyExt;
+use serde_json::{Value, json};
+use tower::ServiceExt;
+
+use super::{
+    CancellationRegistry, McpRequestLimiter, PROTOCOL_HEADER, PROTOCOL_VERSION, SESSION_HEADER,
+    SessionRegistrationRaceHook, accepts, cancellation_signal, mcp_execution_request_id,
+    mcp_idempotency_key, rpc_id_string, valid_request_id, virtual_tools,
+};
+use crate::{
+    AppConfig, ExecutorApp,
+    catalog::{
+        ArtifactKind, AuditContext, CreateSource, CredentialPayload, InitialCatalogSnapshot,
+        SourceKind, StagedArtifact, StagedTool, StagedToolBinding, ToolBinding, ToolMode,
+    },
+    invocation::{McpIdempotencyClaim, McpIdempotencyRequest},
+    openapi::{OpenApiBinding, OpenApiSecurityAlternative},
+};
+
+const ORIGIN: &str = "http://127.0.0.1:4788";
+const PASSWORD: &str = "correct-horse-battery-staple";
+
+#[test]
+fn accept_parsing_requires_each_supported_transport_type() {
+    let mut headers = HeaderMap::new();
+    headers.insert(
+        header::ACCEPT,
+        HeaderValue::from_static("application/json, text/event-stream"),
+    );
+    assert!(accepts(&headers, "application/json"));
+    assert!(accepts(&headers, "text/event-stream"));
+    assert!(!accepts(&headers, "image/png"));
+
+    headers.insert(
+        header::ACCEPT,
+        HeaderValue::from_static("application/json;q=0, text/event-stream"),
+    );
+    assert!(!accepts(&headers, "application/json"));
+}
+
+#[test]
+fn advertised_protocol_is_the_stable_revision() {
+    assert_eq!(PROTOCOL_VERSION, "2025-11-25");
+}
+
+#[test]
+fn only_five_stable_virtual_tools_are_advertised() {
+    let tools = virtual_tools();
+    assert_eq!(
+        tools
+            .iter()
+            .map(|tool| tool.name.as_str())
+            .collect::<Vec<_>>(),
+        ["execute", "call", "search", "describe", "sources"]
+    );
+    let sources = tools
+        .iter()
+        .find(|tool| tool.name == "sources")
+        .expect("sources tool");
+    assert_eq!(
+        sources.output_schema.as_ref().expect("output schema"),
+        &json!({
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["sources"],
+            "properties": {
+                "sources": { "type": "array", "items": { "type": "object" } }
+            }
+        })
+    );
+}
+
+#[test]
+fn request_ids_are_bounded_strings_or_numbers() {
+    assert!(valid_request_id(&serde_json::json!(42)));
+    assert!(valid_request_id(&serde_json::json!("request")));
+    assert!(!valid_request_id(&serde_json::Value::Null));
+    assert!(!valid_request_id(&serde_json::json!(true)));
+    assert!(!valid_request_id(&serde_json::json!("x".repeat(257))));
+    assert_ne!(
+        mcp_idempotency_key("session", &rpc_id_string(&json!(1))),
+        mcp_idempotency_key("session", &rpc_id_string(&json!("1")))
+    );
+}
+
+#[test]
+fn execute_request_log_ids_are_safe_deterministic_and_bounded() {
+    let token_id = "token-private-identity";
+    let session_id = "session-private-identity";
+    let raw_request_id = "request-private-identity".repeat(8);
+    let rpc_request_id = json!(raw_request_id.clone());
+    assert!(valid_request_id(&rpc_request_id));
+    let correlation = rpc_id_string(&rpc_request_id);
+
+    let request_log_id = mcp_execution_request_id(token_id, session_id, &correlation);
+    assert_eq!(
+        request_log_id,
+        mcp_execution_request_id(token_id, session_id, &correlation)
+    );
+    assert_eq!(request_log_id.len(), 102);
+    assert!(!request_log_id.contains(token_id));
+    assert!(!request_log_id.contains(session_id));
+    assert!(!request_log_id.contains(raw_request_id.as_str()));
+    assert_ne!(
+        request_log_id,
+        mcp_execution_request_id("another-token", session_id, &correlation)
+    );
+    assert_ne!(
+        request_log_id,
+        mcp_execution_request_id(token_id, "another-session", &correlation)
+    );
+
+    let longest_request_id = json!("x".repeat(256));
+    assert!(valid_request_id(&longest_request_id));
+    let longest_request_log_id =
+        mcp_execution_request_id(token_id, session_id, &rpc_id_string(&longest_request_id));
+    assert_eq!(longest_request_log_id.len(), 102);
+    assert_eq!(
+        format!("{longest_request_log_id}:call:{}", u64::MAX).len(),
+        128
+    );
+}
+
+#[tokio::test]
+async fn cancellation_arriving_before_call_registration_is_consumed() {
+    let registry = CancellationRegistry::default();
+    registry.cancel("session\0s:request");
+    let registration = registry
+        .register("session\0s:request".to_owned())
+        .expect("pre-canceled request can register");
+    tokio::time::timeout(
+        std::time::Duration::from_millis(50),
+        cancellation_signal(&registration).wait(),
+    )
+    .await
+    .expect("pre-cancel signal resolves before side effects");
+}
+
+#[test]
+fn request_limiter_is_per_token_and_releases_with_detached_work() {
+    let limiter = McpRequestLimiter::new(16, 4);
+    let permits = (0..4)
+        .map(|_| limiter.try_acquire("token-a").expect("token slot"))
+        .collect::<Vec<_>>();
+    assert!(limiter.try_acquire("token-a").is_none());
+    let other = limiter
+        .try_acquire("token-b")
+        .expect("another token keeps an independent allowance");
+    drop(permits);
+    assert!(limiter.try_acquire("token-a").is_some());
+    drop(other);
+}
+
+#[tokio::test]
+async fn saturated_execution_slots_do_not_block_cancellation_control() {
+    let execution_limiter = McpRequestLimiter::new(16, 4);
+    let _executions = (0..4)
+        .map(|_| {
+            execution_limiter
+                .try_acquire("token-a")
+                .expect("execution permit")
+        })
+        .collect::<Vec<_>>();
+    assert!(execution_limiter.try_acquire("token-a").is_none());
+
+    let registry = CancellationRegistry::default();
+    let registration = registry
+        .register("session\0s:request".to_owned())
+        .expect("control registration");
+    registry.cancel("session\0s:request");
+    tokio::time::timeout(
+        std::time::Duration::from_millis(50),
+        cancellation_signal(&registration).wait(),
+    )
+    .await
+    .expect("cancellation remains available under execution saturation");
+}
+
+#[tokio::test]
+async fn expired_session_cancels_pending_ask_before_it_can_execute() {
+    let directory = tempfile::tempdir().expect("temporary directory");
+    let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+        .await
+        .expect("Executor opens");
+    configure_ask_tool(&app).await;
+    let router = app.router();
+    let setup = send_json(
+        router.clone(),
+        Method::POST,
+        "/api/v1/setup",
+        json!({
+            "setupToken": app.setup_token().expect("setup token"),
+            "username": "admin",
+            "password": PASSWORD
+        }),
+        &[(header::ORIGIN.as_str(), ORIGIN)],
+    )
+    .await;
+    assert_eq!(setup.status(), StatusCode::CREATED);
+    let login = send_json(
+        router.clone(),
+        Method::POST,
+        "/api/v1/session",
+        json!({ "username": "admin", "password": PASSWORD }),
+        &[(header::ORIGIN.as_str(), ORIGIN)],
+    )
+    .await;
+    let cookie = response_cookies(&login);
+    let login_body = response_json(login).await;
+    let csrf = login_body["csrfToken"].as_str().expect("CSRF token");
+    let token = response_json(
+        send_json(
+            router.clone(),
+            Method::POST,
+            "/api/v1/tokens",
+            json!({ "name": "Expiring MCP" }),
+            &[
+                (header::COOKIE.as_str(), &cookie),
+                (header::ORIGIN.as_str(), ORIGIN),
+                ("x-executor-csrf", csrf),
+                ("idempotency-key", "mcp-expiring-token"),
+            ],
+        )
+        .await,
+    )
+    .await["token"]
+        .as_str()
+        .expect("API token")
+        .to_owned();
+    let authorization = format!("Bearer {token}");
+    let transport_headers = [
+        (header::HOST.as_str(), "127.0.0.1:4788"),
+        (header::ORIGIN.as_str(), ORIGIN),
+        (header::AUTHORIZATION.as_str(), authorization.as_str()),
+        (
+            header::ACCEPT.as_str(),
+            "application/json, text/event-stream",
+        ),
+    ];
+    let initialized = send_json(
+        router.clone(),
+        Method::POST,
+        "/mcp",
+        json!({
+            "jsonrpc": "2.0",
+            "id": "expiry-initialize",
+            "method": "initialize",
+            "params": {
+                "protocolVersion": PROTOCOL_VERSION,
+                "capabilities": {},
+                "clientInfo": { "name": "expiry-test", "version": "1" }
+            }
+        }),
+        &transport_headers,
+    )
+    .await;
+    let session = initialized
+        .headers()
+        .get(SESSION_HEADER)
+        .expect("session header")
+        .to_str()
+        .expect("session text")
+        .to_owned();
+    let session_headers = [
+        (header::HOST.as_str(), "127.0.0.1:4788"),
+        (header::ORIGIN.as_str(), ORIGIN),
+        (header::AUTHORIZATION.as_str(), authorization.as_str()),
+        (
+            header::ACCEPT.as_str(),
+            "application/json, text/event-stream",
+        ),
+        (SESSION_HEADER, session.as_str()),
+        (PROTOCOL_HEADER, PROTOCOL_VERSION),
+    ];
+    assert_eq!(
+        send_json(
+            router.clone(),
+            Method::POST,
+            "/mcp",
+            json!({ "jsonrpc": "2.0", "method": "notifications/initialized" }),
+            &session_headers,
+        )
+        .await
+        .status(),
+        StatusCode::ACCEPTED
+    );
+    let pending_ask = spawn_mcp_call(
+        router.clone(),
+        authorization.clone(),
+        session.clone(),
+        "expiry-ask",
+        "call",
+        json!({
+            "path": "expiry_approval.write",
+            "arguments": { "value": "must not execute" }
+        }),
+    );
+    let approval_id = tokio::time::timeout(std::time::Duration::from_secs(2), async {
+        loop {
+            if let Some(approval_id) = sqlx::query_scalar::<_, String>(
+                "SELECT id FROM approvals WHERE status = 'pending' ORDER BY sequence DESC LIMIT 1",
+            )
+            .fetch_optional(app.pool())
+            .await
+            .expect("approval query")
+            {
+                break approval_id;
+            }
+            tokio::task::yield_now().await;
+        }
+    })
+    .await
+    .expect("Ask approval should become pending");
+    {
+        let mut sessions = app
+            .mcp_state()
+            .sessions
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        sessions
+            .get_mut(&session)
+            .expect("active session")
+            .last_seen =
+            std::time::Instant::now() - super::SESSION_TTL - std::time::Duration::from_secs(1);
+    }
+    let expired = send_json(
+        router,
+        Method::POST,
+        "/mcp",
+        json!({ "jsonrpc": "2.0", "id": "expiry-trigger", "method": "ping" }),
+        &session_headers,
+    )
+    .await;
+    assert_eq!(expired.status(), StatusCode::NOT_FOUND);
+    let canceled = tokio::time::timeout(std::time::Duration::from_secs(2), pending_ask)
+        .await
+        .expect("expiry should release the pending Ask")
+        .expect("request task");
+    assert_eq!(response_json(canceled).await["error"]["code"], -32603);
+    let approval_status =
+        sqlx::query_scalar::<_, String>("SELECT status FROM approvals WHERE id = ?")
+            .bind(approval_id)
+            .fetch_one(app.pool())
+            .await
+            .expect("approval status");
+    assert_eq!(approval_status, "canceled");
+    app.shutdown().await;
+}
+
+#[tokio::test]
+async fn streamable_http_lifecycle_is_authenticated_session_bound_and_finite() {
+    let directory = tempfile::tempdir().expect("temporary directory");
+    let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+        .await
+        .expect("Executor opens");
+    let router = app.router();
+    let unauthenticated_oversized = send_json(
+        router.clone(),
+        Method::POST,
+        "/mcp",
+        json!({ "padding": "x".repeat(9 * 1024 * 1024) }),
+        &[
+            (header::HOST.as_str(), "127.0.0.1:4788"),
+            (header::ORIGIN.as_str(), ORIGIN),
+        ],
+    )
+    .await;
+    assert_eq!(unauthenticated_oversized.status(), StatusCode::UNAUTHORIZED);
+    let invalid_origin_before_auth = send_json(
+        router.clone(),
+        Method::POST,
+        "/mcp",
+        json!({}),
+        &[
+            (header::HOST.as_str(), "127.0.0.1:4788"),
+            (header::ORIGIN.as_str(), "https://attacker.invalid"),
+        ],
+    )
+    .await;
+    assert_eq!(invalid_origin_before_auth.status(), StatusCode::FORBIDDEN);
+    let setup = send_json(
+        router.clone(),
+        Method::POST,
+        "/api/v1/setup",
+        json!({
+            "setupToken": app.setup_token().expect("setup token"),
+            "username": "admin",
+            "password": PASSWORD
+        }),
+        &[(header::ORIGIN.as_str(), ORIGIN)],
+    )
+    .await;
+    assert_eq!(setup.status(), StatusCode::CREATED);
+    let login = send_json(
+        router.clone(),
+        Method::POST,
+        "/api/v1/session",
+        json!({ "username": "admin", "password": PASSWORD }),
+        &[(header::ORIGIN.as_str(), ORIGIN)],
+    )
+    .await;
+    let cookie = response_cookies(&login);
+    let login_body = response_json(login).await;
+    let csrf = login_body["csrfToken"].as_str().expect("CSRF token");
+    let token_response = send_json(
+        router.clone(),
+        Method::POST,
+        "/api/v1/tokens",
+        json!({ "name": "MCP" }),
+        &[
+            (header::COOKIE.as_str(), &cookie),
+            (header::ORIGIN.as_str(), ORIGIN),
+            ("x-executor-csrf", csrf),
+            ("idempotency-key", "mcp-stream-primary-token"),
+        ],
+    )
+    .await;
+    let token_body = response_json(token_response).await;
+    let token_id = token_body["id"].as_str().expect("token ID").to_owned();
+    let token = token_body["token"].as_str().expect("API token").to_owned();
+    let authorization = format!("Bearer {token}");
+    let transport_headers = [
+        (header::HOST.as_str(), "127.0.0.1:4788"),
+        (header::ORIGIN.as_str(), ORIGIN),
+        (header::AUTHORIZATION.as_str(), authorization.as_str()),
+        (
+            header::ACCEPT.as_str(),
+            "application/json, text/event-stream",
+        ),
+    ];
+
+    let wrong_host = send_json(
+        router.clone(),
+        Method::POST,
+        "/mcp",
+        json!({ "jsonrpc": "2.0", "id": 1, "method": "initialize", "params": {} }),
+        &[(header::HOST.as_str(), "attacker.invalid")],
+    )
+    .await;
+    assert_eq!(wrong_host.status(), StatusCode::FORBIDDEN);
+
+    let initialized = send_json(
+        router.clone(),
+        Method::POST,
+        "/mcp",
+        json!({
+            "jsonrpc": "2.0",
+            "id": 1,
+            "method": "initialize",
+            "params": {
+                "protocolVersion": PROTOCOL_VERSION,
+                "capabilities": {},
+                "clientInfo": { "name": "test", "version": "1" }
+            }
+        }),
+        &transport_headers,
+    )
+    .await;
+    assert_eq!(initialized.status(), StatusCode::OK);
+    let session = initialized
+        .headers()
+        .get(SESSION_HEADER)
+        .expect("session header")
+        .to_str()
+        .expect("session text")
+        .to_owned();
+    let body = response_json(initialized).await;
+    assert_eq!(body["result"]["protocolVersion"], PROTOCOL_VERSION);
+
+    let session_headers = [
+        (header::HOST.as_str(), "127.0.0.1:4788"),
+        (header::ORIGIN.as_str(), ORIGIN),
+        (header::AUTHORIZATION.as_str(), authorization.as_str()),
+        (
+            header::ACCEPT.as_str(),
+            "application/json, text/event-stream",
+        ),
+        (SESSION_HEADER, session.as_str()),
+        (PROTOCOL_HEADER, PROTOCOL_VERSION),
+    ];
+    let notification = send_json(
+        router.clone(),
+        Method::POST,
+        "/mcp",
+        json!({ "jsonrpc": "2.0", "method": "notifications/initialized" }),
+        &session_headers,
+    )
+    .await;
+    assert_eq!(notification.status(), StatusCode::ACCEPTED);
+    let client_response = send_json(
+        router.clone(),
+        Method::POST,
+        "/mcp",
+        json!({ "jsonrpc": "2.0", "id": "server-request", "result": {} }),
+        &session_headers,
+    )
+    .await;
+    assert_eq!(client_response.status(), StatusCode::ACCEPTED);
+    let null_response = send_json(
+        router.clone(),
+        Method::POST,
+        "/mcp",
+        json!({ "jsonrpc": "2.0", "id": "server-null", "result": null }),
+        &session_headers,
+    )
+    .await;
+    assert_eq!(null_response.status(), StatusCode::ACCEPTED);
+    for invalid_envelope in [
+        json!({ "jsonrpc": "2.0", "id": 20, "method": "ping", "result": {} }),
+        json!({ "jsonrpc": "2.0", "id": 21, "result": {}, "error": { "code": -1, "message": "bad" } }),
+        json!({ "jsonrpc": "2.0", "id": 22, "error": { "message": "missing code" } }),
+        json!({ "jsonrpc": "2.0", "id": 23, "result": {}, "params": {} }),
+    ] {
+        let invalid = send_json(
+            router.clone(),
+            Method::POST,
+            "/mcp",
+            invalid_envelope,
+            &session_headers,
+        )
+        .await;
+        assert_eq!(invalid.status(), StatusCode::BAD_REQUEST);
+    }
+    let missing_protocol = send_json(
+        router.clone(),
+        Method::POST,
+        "/mcp",
+        json!({ "jsonrpc": "2.0", "id": "missing-version", "method": "ping" }),
+        &session_headers[..5],
+    )
+    .await;
+    assert_eq!(missing_protocol.status(), StatusCode::BAD_REQUEST);
+    let tools = send_json(
+        router.clone(),
+        Method::POST,
+        "/mcp",
+        json!({ "jsonrpc": "2.0", "id": "tools", "method": "tools/list" }),
+        &session_headers,
+    )
+    .await;
+    let body = response_json(tools).await;
+    assert_eq!(body["result"]["tools"].as_array().map(Vec::len), Some(5));
+
+    for (request_id, name, invalid_arguments, corrected_arguments) in [
+        (
+            "invalid-search",
+            "search",
+            json!({ "query": "tool", "limit": 0 }),
+            json!({ "query": "tool" }),
+        ),
+        (
+            "invalid-describe",
+            "describe",
+            json!({ "path": "" }),
+            json!({ "path": "missing.tool" }),
+        ),
+        (
+            "invalid-sources",
+            "sources",
+            json!({ "unexpected": true }),
+            json!({}),
+        ),
+    ] {
+        let invalid_call = json!({
+            "jsonrpc": "2.0",
+            "id": request_id,
+            "method": "tools/call",
+            "params": { "name": name, "arguments": invalid_arguments }
+        });
+        for _ in 0..2 {
+            let invalid = response_json(
+                send_json(
+                    router.clone(),
+                    Method::POST,
+                    "/mcp",
+                    invalid_call.clone(),
+                    &session_headers,
+                )
+                .await,
+            )
+            .await;
+            assert_eq!(invalid["error"]["code"], -32602);
+        }
+        let corrected = response_json(
+            send_json(
+                router.clone(),
+                Method::POST,
+                "/mcp",
+                json!({
+                    "jsonrpc": "2.0",
+                    "id": request_id,
+                    "method": "tools/call",
+                    "params": { "name": name, "arguments": corrected_arguments }
+                }),
+                &session_headers,
+            )
+            .await,
+        )
+        .await;
+        assert!(corrected.get("result").is_some());
+    }
+
+    let sources_call = json!({
+        "jsonrpc": "2.0",
+        "id": "stable-call",
+        "method": "tools/call",
+        "params": { "name": "sources", "arguments": {} }
+    });
+    let first_sources = response_json(
+        send_json(
+            router.clone(),
+            Method::POST,
+            "/mcp",
+            sources_call.clone(),
+            &session_headers,
+        )
+        .await,
+    )
+    .await;
+    assert!(first_sources["result"]["structuredContent"]["sources"].is_array());
+    let replayed_sources = response_json(
+        send_json(
+            router.clone(),
+            Method::POST,
+            "/mcp",
+            sources_call,
+            &session_headers,
+        )
+        .await,
+    )
+    .await;
+    assert_eq!(replayed_sources, first_sources);
+    let mismatched = response_json(
+        send_json(
+            router.clone(),
+            Method::POST,
+            "/mcp",
+            json!({
+                "jsonrpc": "2.0",
+                "id": "stable-call",
+                "method": "tools/call",
+                "params": { "name": "search", "arguments": { "query": "tool" } }
+            }),
+            &session_headers,
+        )
+        .await,
+    )
+    .await;
+    assert_eq!(mismatched["error"]["code"], -32600);
+
+    let get = send_empty(
+        router.clone(),
+        Method::GET,
+        "/mcp",
+        &[
+            (header::HOST.as_str(), "127.0.0.1:4788"),
+            (header::ORIGIN.as_str(), ORIGIN),
+            (header::AUTHORIZATION.as_str(), authorization.as_str()),
+            (header::ACCEPT.as_str(), "text/event-stream"),
+            (SESSION_HEADER, session.as_str()),
+            (PROTOCOL_HEADER, PROTOCOL_VERSION),
+        ],
+    )
+    .await;
+    assert_eq!(get.status(), StatusCode::METHOD_NOT_ALLOWED);
+    assert_eq!(
+        get.headers().get(header::ALLOW),
+        Some(&HeaderValue::from_static("POST, DELETE, OPTIONS"))
+    );
+
+    let idempotency_rows_before_delete_race =
+        sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM gateway_invocation_idempotency")
+            .fetch_one(app.pool())
+            .await
+            .expect("idempotency count");
+    let delete_hook = Arc::new(SessionRegistrationRaceHook::default());
+    *app.mcp_state()
+        .session_registration_race_hook
+        .lock()
+        .unwrap_or_else(std::sync::PoisonError::into_inner) = Some(delete_hook.clone());
+    let pending_delete_race = spawn_mcp_call(
+        router.clone(),
+        authorization.clone(),
+        session.clone(),
+        "delete-race",
+        "sources",
+        json!({}),
+    );
+    tokio::time::timeout(
+        std::time::Duration::from_secs(1),
+        delete_hook.validation_complete.notified(),
+    )
+    .await
+    .expect("tools/call should pause after session validation");
+    let deleted = send_empty(router.clone(), Method::DELETE, "/mcp", &session_headers).await;
+    assert_eq!(deleted.status(), StatusCode::NO_CONTENT);
+    delete_hook.continue_registration.notify_one();
+    let delete_race_response =
+        tokio::time::timeout(std::time::Duration::from_secs(1), pending_delete_race)
+            .await
+            .expect("deleted session request should stop")
+            .expect("request task");
+    assert_eq!(
+        response_json(delete_race_response).await["error"]["code"],
+        -32603
+    );
+    *app.mcp_state()
+        .session_registration_race_hook
+        .lock()
+        .unwrap_or_else(std::sync::PoisonError::into_inner) = None;
+    let idempotency_rows_after_delete_race =
+        sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM gateway_invocation_idempotency")
+            .fetch_one(app.pool())
+            .await
+            .expect("idempotency count");
+    assert_eq!(
+        idempotency_rows_after_delete_race,
+        idempotency_rows_before_delete_race
+    );
+    let after_delete = send_json(
+        router.clone(),
+        Method::POST,
+        "/mcp",
+        json!({ "jsonrpc": "2.0", "id": 2, "method": "ping" }),
+        &session_headers,
+    )
+    .await;
+    assert_eq!(after_delete.status(), StatusCode::NOT_FOUND);
+
+    let second_token = response_json(
+        send_json(
+            router.clone(),
+            Method::POST,
+            "/api/v1/tokens",
+            json!({ "name": "Other MCP" }),
+            &[
+                (header::COOKIE.as_str(), &cookie),
+                (header::ORIGIN.as_str(), ORIGIN),
+                ("x-executor-csrf", csrf),
+                ("idempotency-key", "mcp-stream-secondary-token"),
+            ],
+        )
+        .await,
+    )
+    .await["token"]
+        .as_str()
+        .expect("second token")
+        .to_owned();
+    let new_session_response = send_json(
+        router.clone(),
+        Method::POST,
+        "/mcp",
+        json!({
+            "jsonrpc": "2.0",
+            "id": 9,
+            "method": "initialize",
+            "params": {
+                "protocolVersion": PROTOCOL_VERSION,
+                "capabilities": {},
+                "clientInfo": { "name": "test", "version": "1" }
+            }
+        }),
+        &transport_headers,
+    )
+    .await;
+    let new_session = new_session_response
+        .headers()
+        .get(SESSION_HEADER)
+        .expect("new session")
+        .to_str()
+        .expect("session text")
+        .to_owned();
+    let new_session_headers = [
+        (header::HOST.as_str(), "127.0.0.1:4788"),
+        (header::ORIGIN.as_str(), ORIGIN),
+        (header::AUTHORIZATION.as_str(), authorization.as_str()),
+        (
+            header::ACCEPT.as_str(),
+            "application/json, text/event-stream",
+        ),
+        (SESSION_HEADER, new_session.as_str()),
+        (PROTOCOL_HEADER, PROTOCOL_VERSION),
+    ];
+    assert_eq!(
+        send_json(
+            router.clone(),
+            Method::POST,
+            "/mcp",
+            json!({ "jsonrpc": "2.0", "method": "notifications/initialized" }),
+            &new_session_headers,
+        )
+        .await
+        .status(),
+        StatusCode::ACCEPTED
+    );
+    let other_authorization = format!("Bearer {second_token}");
+    let cross_token = send_json(
+        router.clone(),
+        Method::POST,
+        "/mcp",
+        json!({ "jsonrpc": "2.0", "id": 10, "method": "ping" }),
+        &[
+            (header::HOST.as_str(), "127.0.0.1:4788"),
+            (header::ORIGIN.as_str(), ORIGIN),
+            (header::AUTHORIZATION.as_str(), &other_authorization),
+            (
+                header::ACCEPT.as_str(),
+                "application/json, text/event-stream",
+            ),
+            (SESSION_HEADER, &new_session),
+            (PROTOCOL_HEADER, PROTOCOL_VERSION),
+        ],
+    )
+    .await;
+    assert_eq!(cross_token.status(), StatusCode::NOT_FOUND);
+    for request_id in 100..131 {
+        let extra_session = send_json(
+            router.clone(),
+            Method::POST,
+            "/mcp",
+            json!({
+                "jsonrpc": "2.0",
+                "id": request_id,
+                "method": "initialize",
+                "params": {
+                    "protocolVersion": PROTOCOL_VERSION,
+                    "capabilities": {},
+                    "clientInfo": { "name": "capacity-test", "version": "1" }
+                }
+            }),
+            &transport_headers,
+        )
+        .await;
+        assert_eq!(extra_session.status(), StatusCode::OK);
+    }
+    let token_capacity = send_json(
+        router.clone(),
+        Method::POST,
+        "/mcp",
+        json!({
+            "jsonrpc": "2.0",
+            "id": 131,
+            "method": "initialize",
+            "params": {
+                "protocolVersion": PROTOCOL_VERSION,
+                "capabilities": {},
+                "clientInfo": { "name": "capacity-test", "version": "1" }
+            }
+        }),
+        &transport_headers,
+    )
+    .await;
+    assert_eq!(token_capacity.status(), StatusCode::SERVICE_UNAVAILABLE);
+    let idempotency_rows_before_revoke_race =
+        sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM gateway_invocation_idempotency")
+            .fetch_one(app.pool())
+            .await
+            .expect("idempotency count");
+    let revoke_hook = Arc::new(SessionRegistrationRaceHook::default());
+    *app.mcp_state()
+        .session_registration_race_hook
+        .lock()
+        .unwrap_or_else(std::sync::PoisonError::into_inner) = Some(revoke_hook.clone());
+    let pending_revoke_race = spawn_mcp_call(
+        router.clone(),
+        authorization.clone(),
+        new_session.clone(),
+        "revoke-race",
+        "sources",
+        json!({}),
+    );
+    tokio::time::timeout(
+        std::time::Duration::from_secs(1),
+        revoke_hook.validation_complete.notified(),
+    )
+    .await
+    .expect("tools/call should pause after session validation");
+    let revoked = send_empty(
+        router.clone(),
+        Method::DELETE,
+        &format!("/api/v1/tokens/{token_id}"),
+        &[
+            (header::COOKIE.as_str(), &cookie),
+            (header::ORIGIN.as_str(), ORIGIN),
+            ("x-executor-csrf", csrf),
+        ],
+    )
+    .await;
+    assert_eq!(revoked.status(), StatusCode::NO_CONTENT);
+    revoke_hook.continue_registration.notify_one();
+    let revoke_race_response =
+        tokio::time::timeout(std::time::Duration::from_secs(1), pending_revoke_race)
+            .await
+            .expect("revoked token request should stop")
+            .expect("request task");
+    assert_eq!(
+        response_json(revoke_race_response).await["error"]["code"],
+        -32603
+    );
+    *app.mcp_state()
+        .session_registration_race_hook
+        .lock()
+        .unwrap_or_else(std::sync::PoisonError::into_inner) = None;
+    let idempotency_rows_after_revoke_race =
+        sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM gateway_invocation_idempotency")
+            .fetch_one(app.pool())
+            .await
+            .expect("idempotency count");
+    assert_eq!(
+        idempotency_rows_after_revoke_race,
+        idempotency_rows_before_revoke_race
+    );
+    let revoked_session = send_json(
+        router.clone(),
+        Method::POST,
+        "/mcp",
+        json!({ "jsonrpc": "2.0", "id": 11, "method": "ping" }),
+        &[
+            (header::HOST.as_str(), "127.0.0.1:4788"),
+            (header::ORIGIN.as_str(), ORIGIN),
+            (header::AUTHORIZATION.as_str(), &authorization),
+            (
+                header::ACCEPT.as_str(),
+                "application/json, text/event-stream",
+            ),
+            (SESSION_HEADER, &new_session),
+            (PROTOCOL_HEADER, PROTOCOL_VERSION),
+        ],
+    )
+    .await;
+    assert_eq!(revoked_session.status(), StatusCode::UNAUTHORIZED);
+
+    let preflight = send_empty(
+        router.clone(),
+        Method::OPTIONS,
+        "/mcp",
+        &[(header::ORIGIN.as_str(), ORIGIN)],
+    )
+    .await;
+    assert_eq!(preflight.status(), StatusCode::NO_CONTENT);
+
+    let shutdown_authorization = format!("Bearer {second_token}");
+    let shutdown_transport_headers = [
+        (header::HOST.as_str(), "127.0.0.1:4788"),
+        (header::ORIGIN.as_str(), ORIGIN),
+        (
+            header::AUTHORIZATION.as_str(),
+            shutdown_authorization.as_str(),
+        ),
+        (
+            header::ACCEPT.as_str(),
+            "application/json, text/event-stream",
+        ),
+    ];
+    let shutdown_initialized = send_json(
+        router.clone(),
+        Method::POST,
+        "/mcp",
+        json!({
+            "jsonrpc": "2.0",
+            "id": "shutdown-initialize",
+            "method": "initialize",
+            "params": {
+                "protocolVersion": PROTOCOL_VERSION,
+                "capabilities": {},
+                "clientInfo": { "name": "shutdown-test", "version": "1" }
+            }
+        }),
+        &shutdown_transport_headers,
+    )
+    .await;
+    let shutdown_session = shutdown_initialized
+        .headers()
+        .get(SESSION_HEADER)
+        .expect("shutdown session")
+        .to_str()
+        .expect("session text")
+        .to_owned();
+    let shutdown_session_headers = [
+        (header::HOST.as_str(), "127.0.0.1:4788"),
+        (header::ORIGIN.as_str(), ORIGIN),
+        (
+            header::AUTHORIZATION.as_str(),
+            shutdown_authorization.as_str(),
+        ),
+        (
+            header::ACCEPT.as_str(),
+            "application/json, text/event-stream",
+        ),
+        (SESSION_HEADER, shutdown_session.as_str()),
+        (PROTOCOL_HEADER, PROTOCOL_VERSION),
+    ];
+    let shutdown_notification = send_json(
+        router.clone(),
+        Method::POST,
+        "/mcp",
+        json!({ "jsonrpc": "2.0", "method": "notifications/initialized" }),
+        &shutdown_session_headers,
+    )
+    .await;
+    assert_eq!(shutdown_notification.status(), StatusCode::ACCEPTED);
+
+    let (second_token_id,): (String,) =
+        sqlx::query_as("SELECT id FROM api_tokens WHERE name = 'Other MCP'")
+            .fetch_one(app.pool())
+            .await
+            .expect("second token ID");
+    let shutdown_request_id = json!("shutdown-pending");
+    let shutdown_correlation = rpc_id_string(&shutdown_request_id);
+    let shutdown_idempotency = McpIdempotencyRequest {
+        owner_api_token_id: second_token_id,
+        key: mcp_idempotency_key(&shutdown_session, &shutdown_correlation),
+        route: "POST /mcp tools/call".to_owned(),
+        callable_path: "executor.sources".to_owned(),
+        arguments: json!({}),
+    };
+    let reservation = match app
+        .tool_calls()
+        .claim_mcp_idempotency(&shutdown_idempotency)
+        .await
+        .expect("idempotency claim")
+    {
+        McpIdempotencyClaim::Fresh(reservation) => *reservation,
+        _ => panic!("new shutdown request should own a fresh reservation"),
+    };
+    let execution = reservation
+        .mark_executing()
+        .await
+        .expect("pending idempotency execution");
+    let pending_authorization = shutdown_authorization.clone();
+    let pending_session = shutdown_session.clone();
+    let pending_request = tokio::spawn(async move {
+        let headers = [
+            (header::HOST.as_str(), "127.0.0.1:4788"),
+            (header::ORIGIN.as_str(), ORIGIN),
+            (
+                header::AUTHORIZATION.as_str(),
+                pending_authorization.as_str(),
+            ),
+            (
+                header::ACCEPT.as_str(),
+                "application/json, text/event-stream",
+            ),
+            (SESSION_HEADER, pending_session.as_str()),
+            (PROTOCOL_HEADER, PROTOCOL_VERSION),
+        ];
+        send_json(
+            router,
+            Method::POST,
+            "/mcp",
+            json!({
+                "jsonrpc": "2.0",
+                "id": shutdown_request_id,
+                "method": "tools/call",
+                "params": { "name": "sources", "arguments": {} }
+            }),
+            &headers,
+        )
+        .await
+    });
+    tokio::time::sleep(std::time::Duration::from_millis(50)).await;
+    assert!(!pending_request.is_finished());
+    app.begin_shutdown();
+    let shutdown_response =
+        tokio::time::timeout(std::time::Duration::from_secs(1), pending_request)
+            .await
+            .expect("pre-drain shutdown should release the pending handler")
+            .expect("request task");
+    assert_eq!(
+        response_json(shutdown_response).await["error"]["code"],
+        -32603
+    );
+    execution
+        .mark_indeterminate()
+        .await
+        .expect("clean up synthetic execution");
+    app.shutdown().await;
+}
+
+fn spawn_mcp_call(
+    router: Router,
+    authorization: String,
+    session: String,
+    request_id: &'static str,
+    name: &'static str,
+    arguments: Value,
+) -> tokio::task::JoinHandle<Response<Body>> {
+    tokio::spawn(async move {
+        let headers = [
+            (header::HOST.as_str(), "127.0.0.1:4788"),
+            (header::ORIGIN.as_str(), ORIGIN),
+            (header::AUTHORIZATION.as_str(), authorization.as_str()),
+            (
+                header::ACCEPT.as_str(),
+                "application/json, text/event-stream",
+            ),
+            (SESSION_HEADER, session.as_str()),
+            (PROTOCOL_HEADER, PROTOCOL_VERSION),
+        ];
+        send_json(
+            router,
+            Method::POST,
+            "/mcp",
+            json!({
+                "jsonrpc": "2.0",
+                "id": request_id,
+                "method": "tools/call",
+                "params": { "name": name, "arguments": arguments }
+            }),
+            &headers,
+        )
+        .await
+    })
+}
+
+async fn configure_ask_tool(app: &ExecutorApp) {
+    app.catalog()
+        .create_source_with_catalog(
+            CreateSource {
+                kind: SourceKind::Openapi,
+                preferred_slug: "expiry-approval".to_owned(),
+                display_name: "Expiry approval source".to_owned(),
+                description: None,
+                configuration: json!({
+                    "spec": { "type": "inline" },
+                    "allowPrivateNetwork": true
+                })
+                .as_object()
+                .expect("source configuration object")
+                .clone(),
+            },
+            &CredentialPayload {
+                schema_version: 1,
+                payload: json!({
+                    "locator": { "type": "inline" },
+                    "credentials": { "schemes": {} }
+                }),
+            },
+            InitialCatalogSnapshot {
+                artifacts: vec![StagedArtifact {
+                    kind: ArtifactKind::OpenapiDocument,
+                    stable_key: "document".to_owned(),
+                    content: json!({ "openapi": "3.1.0" }),
+                }],
+                tools: vec![StagedTool {
+                    stable_key: "write".to_owned(),
+                    preferred_name: "write".to_owned(),
+                    display_name: "Write".to_owned(),
+                    description: None,
+                    input_schema: json!({
+                        "type": "object",
+                        "additionalProperties": false,
+                        "required": ["value"],
+                        "properties": { "value": { "type": "string" } }
+                    }),
+                    output_schema: None,
+                    input_typescript: None,
+                    output_typescript: None,
+                    typescript_definitions: BTreeMap::new(),
+                    intrinsic_mode: ToolMode::Ask,
+                }],
+            },
+            vec![StagedToolBinding {
+                stable_key: "write".to_owned(),
+                binding: ToolBinding::OpenapiV1(OpenApiBinding {
+                    version: 1,
+                    method: "POST".to_owned(),
+                    path_template: "/write".to_owned(),
+                    server_url: "http://127.0.0.1:9".to_owned(),
+                    parameters: Vec::new(),
+                    request_body: None,
+                    security: vec![OpenApiSecurityAlternative {
+                        requirements: Vec::new(),
+                    }],
+                }),
+            }],
+            AuditContext::system(Some("mcp-expiry-test")),
+        )
+        .await
+        .expect("Ask tool should import");
+}
+
+async fn send_json(
+    router: Router,
+    method: Method,
+    uri: &str,
+    body: Value,
+    headers: &[(&str, &str)],
+) -> Response<Body> {
+    let mut request = Request::builder()
+        .method(method)
+        .uri(uri)
+        .header(header::CONTENT_TYPE, "application/json");
+    for (name, value) in headers {
+        request = request.header(*name, *value);
+    }
+    router
+        .oneshot(request.body(Body::from(body.to_string())).expect("request"))
+        .await
+        .expect("router response")
+}
+
+async fn send_empty(
+    router: Router,
+    method: Method,
+    uri: &str,
+    headers: &[(&str, &str)],
+) -> Response<Body> {
+    let mut request = Request::builder().method(method).uri(uri);
+    for (name, value) in headers {
+        request = request.header(*name, *value);
+    }
+    router
+        .oneshot(request.body(Body::empty()).expect("request"))
+        .await
+        .expect("router response")
+}
+
+async fn response_json(response: Response<Body>) -> Value {
+    let body = response
+        .into_body()
+        .collect()
+        .await
+        .expect("response body")
+        .to_bytes();
+    serde_json::from_slice(&body).expect("JSON response")
+}
+
+fn response_cookies(response: &Response<Body>) -> String {
+    response
+        .headers()
+        .get_all(header::SET_COOKIE)
+        .iter()
+        .map(|value| {
+            value
+                .to_str()
+                .expect("cookie text")
+                .split(';')
+                .next()
+                .expect("cookie pair")
+        })
+        .collect::<Vec<_>>()
+        .join("; ")
+}
diff --git a/src/mcp/manager.rs b/src/mcp/manager.rs
new file mode 100644
index 000000000..b07a9c544
--- /dev/null
+++ b/src/mcp/manager.rs
@@ -0,0 +1,1567 @@
+use std::{
+    collections::{HashMap, HashSet},
+    future::Future,
+    sync::{
+        Arc, Mutex, Weak,
+        atomic::{AtomicBool, AtomicU64, AtomicUsize, Ordering},
+    },
+    time::Duration,
+};
+
+use thiserror::Error;
+use tokio::sync::Notify;
+
+use super::upstream::stdio::StdioTemplateRegistry;
+
+const SHUTDOWN_GRACE: Duration = Duration::from_secs(5);
+
+#[derive(Clone)]
+pub(crate) struct McpConnectionManager {
+    inner: Arc<ManagerInner>,
+}
+
+struct ManagerInner {
+    stdio_templates: Arc<StdioTemplateRegistry>,
+    shutting_down: AtomicBool,
+    active_operations: AtomicUsize,
+    idle: Notify,
+    source_deletions: Mutex<HashMap<String, Weak<tokio::sync::Mutex<()>>>>,
+    watcher_operations: tokio::sync::Mutex<()>,
+    watcher_reconciliations: Arc<tokio::sync::Mutex<()>>,
+    lifecycle: Arc<tokio::sync::Mutex<()>>,
+    watcher_state: Mutex<WatcherState>,
+    next_watcher_generation: AtomicU64,
+}
+
+#[derive(Default)]
+struct WatcherState {
+    active: HashMap<String, WatcherTask>,
+    retired_sources: HashSet<String>,
+    latest_source_revisions: HashMap<String, i64>,
+    pending: Vec<PendingWatcherTask>,
+}
+
+struct PendingWatcherTask {
+    source_id: String,
+    task: tokio::task::JoinHandle<()>,
+}
+
+struct WatcherTask {
+    generation: u64,
+    source_revision: i64,
+    cancel: Option<tokio::sync::oneshot::Sender<()>>,
+    task: tokio::task::JoinHandle<()>,
+}
+
+pub(crate) struct McpOperationGuard {
+    inner: Arc<ManagerInner>,
+}
+
+#[derive(Clone)]
+pub(crate) struct WatcherRevisionLease {
+    inner: Arc<ManagerInner>,
+    source_id: String,
+    generation: u64,
+}
+
+pub(crate) struct WatcherRevisionGuard {
+    inner: Arc<ManagerInner>,
+    source_id: String,
+    generation: u64,
+    expected_revision: i64,
+    _lifecycle: tokio::sync::OwnedMutexGuard<()>,
+}
+
+pub(crate) struct SourceRevisionLease {
+    inner: Arc<ManagerInner>,
+    entries: HashMap<String, SourceRevisionEntry>,
+    _lifecycle: tokio::sync::OwnedMutexGuard<()>,
+}
+
+#[derive(Clone, Copy)]
+struct SourceRevisionEntry {
+    generation: Option<u64>,
+    installed_revision: Option<i64>,
+    expected_catalog_revision: i64,
+}
+
+#[derive(Debug, Error)]
+#[error("MCP connections are shutting down")]
+pub(crate) struct McpShuttingDown;
+
+impl McpConnectionManager {
+    pub(crate) fn new(stdio_templates: StdioTemplateRegistry) -> Self {
+        Self {
+            inner: Arc::new(ManagerInner {
+                stdio_templates: Arc::new(stdio_templates),
+                shutting_down: AtomicBool::new(false),
+                active_operations: AtomicUsize::new(0),
+                idle: Notify::new(),
+                source_deletions: Mutex::new(HashMap::new()),
+                watcher_operations: tokio::sync::Mutex::new(()),
+                watcher_reconciliations: Arc::new(tokio::sync::Mutex::new(())),
+                lifecycle: Arc::new(tokio::sync::Mutex::new(())),
+                watcher_state: Mutex::new(WatcherState::default()),
+                next_watcher_generation: AtomicU64::new(1),
+            }),
+        }
+    }
+
+    pub(crate) fn stdio_templates(&self) -> &Arc<StdioTemplateRegistry> {
+        &self.inner.stdio_templates
+    }
+
+    pub(crate) async fn lock_source_deletion(
+        &self,
+        source_id: &str,
+    ) -> tokio::sync::OwnedMutexGuard<()> {
+        let deletion = {
+            let mut deletions = self
+                .inner
+                .source_deletions
+                .lock()
+                .expect("MCP source deletion mutex poisoned");
+            deletions.retain(|_, deletion| deletion.strong_count() > 0);
+            if let Some(deletion) = deletions.get(source_id).and_then(Weak::upgrade) {
+                deletion
+            } else {
+                let deletion = Arc::new(tokio::sync::Mutex::new(()));
+                deletions.insert(source_id.to_owned(), Arc::downgrade(&deletion));
+                deletion
+            }
+        };
+        deletion.lock_owned().await
+    }
+
+    pub(crate) fn begin_operation(&self) -> Result<McpOperationGuard, McpShuttingDown> {
+        if self.inner.shutting_down.load(Ordering::Acquire) {
+            return Err(McpShuttingDown);
+        }
+        self.inner.active_operations.fetch_add(1, Ordering::AcqRel);
+        if self.inner.shutting_down.load(Ordering::Acquire) {
+            if self.inner.active_operations.fetch_sub(1, Ordering::AcqRel) == 1 {
+                self.inner.idle.notify_waiters();
+            }
+            return Err(McpShuttingDown);
+        }
+        Ok(McpOperationGuard {
+            inner: self.inner.clone(),
+        })
+    }
+
+    pub(crate) fn begin_shutdown(&self) {
+        self.inner.shutting_down.store(true, Ordering::Release);
+        let mut state = self
+            .inner
+            .watcher_state
+            .lock()
+            .expect("MCP watcher mutex poisoned");
+        for watcher in state.active.values_mut() {
+            cancel_watcher(watcher);
+        }
+        prune_finished_tasks(&mut state.pending);
+        drop(state);
+        if self.inner.active_operations.load(Ordering::Acquire) == 0 {
+            self.inner.idle.notify_waiters();
+        }
+    }
+
+    /// Replaces a source watcher after its predecessor has completely stopped.
+    ///
+    /// `Ok(false)` means the source was retired or superseded while an install was prepared.
+    pub(crate) async fn replace_watcher<Factory, Watcher>(
+        &self,
+        source_id: String,
+        source_revision: i64,
+        factory: Factory,
+    ) -> Result<bool, McpShuttingDown>
+    where
+        Factory: FnOnce(tokio::sync::oneshot::Receiver<()>, WatcherRevisionLease) -> Watcher
+            + Send
+            + 'static,
+        Watcher: Future<Output = ()> + Send + 'static,
+    {
+        let _operation = self.inner.watcher_operations.lock().await;
+        if self.inner.shutting_down.load(Ordering::Acquire) {
+            return Err(McpShuttingDown);
+        }
+
+        let (previous, pending) = {
+            let _lifecycle = self.inner.lifecycle.lock().await;
+            let mut state = self
+                .inner
+                .watcher_state
+                .lock()
+                .expect("MCP watcher mutex poisoned");
+            prune_finished_tasks(&mut state.pending);
+            if state.retired_sources.contains(&source_id) {
+                return Ok(false);
+            }
+            if state
+                .latest_source_revisions
+                .get(&source_id)
+                .is_some_and(|latest| *latest > source_revision)
+            {
+                return Ok(false);
+            }
+            state
+                .latest_source_revisions
+                .insert(source_id.clone(), source_revision);
+            let previous = state.active.remove(&source_id);
+            let pending = take_pending_tasks(&mut state, &source_id);
+            (previous, pending)
+        };
+        if let Some(previous) = previous {
+            stop_and_join_watcher(previous).await;
+        }
+        join_tasks(pending).await;
+
+        let (cancel, canceled) = tokio::sync::oneshot::channel();
+        let (start, mut started) = tokio::sync::oneshot::channel();
+        let generation = self
+            .inner
+            .next_watcher_generation
+            .fetch_add(1, Ordering::Relaxed);
+        let inner = self.inner.clone();
+        let cleanup_source_id = source_id.clone();
+        let revision_lease = WatcherRevisionLease {
+            inner: self.inner.clone(),
+            source_id: source_id.clone(),
+            generation,
+        };
+        let mut canceled = canceled;
+        let task = tokio::spawn(async move {
+            let _cleanup = WatcherCleanup {
+                inner: inner.clone(),
+                source_id: cleanup_source_id.clone(),
+                generation,
+            };
+            tokio::select! {
+                start = &mut started => {
+                    if start.is_ok() {
+                        factory(canceled, revision_lease).await;
+                    }
+                }
+                _ = &mut canceled => {}
+            }
+        });
+        let mut replacement = Some(WatcherTask {
+            generation,
+            source_revision,
+            cancel: Some(cancel),
+            task,
+        });
+        let installed = {
+            let _lifecycle = self.inner.lifecycle.lock().await;
+            let mut state = self
+                .inner
+                .watcher_state
+                .lock()
+                .expect("MCP watcher mutex poisoned");
+            prune_finished_tasks(&mut state.pending);
+            if self.inner.shutting_down.load(Ordering::Acquire) {
+                None
+            } else if state.retired_sources.contains(&source_id)
+                || state
+                    .latest_source_revisions
+                    .get(&source_id)
+                    .is_some_and(|latest| *latest > source_revision)
+            {
+                Some(false)
+            } else {
+                state
+                    .active
+                    .insert(source_id, replacement.take().expect("replacement exists"));
+                Some(true)
+            }
+        };
+
+        match installed {
+            Some(true) => {
+                let _ = start.send(());
+                Ok(true)
+            }
+            Some(false) => {
+                stop_and_join_watcher(replacement.expect("uninstalled replacement exists")).await;
+                Ok(false)
+            }
+            None => {
+                stop_and_join_watcher(replacement.expect("uninstalled replacement exists")).await;
+                Err(McpShuttingDown)
+            }
+        }
+    }
+
+    pub(crate) async fn stop_watcher_at_revision(
+        &self,
+        source_id: &str,
+        source_revision: i64,
+    ) -> bool {
+        let _lifecycle = self.inner.lifecycle.lock().await;
+        let mut state = self
+            .inner
+            .watcher_state
+            .lock()
+            .expect("MCP watcher mutex poisoned");
+        prune_finished_tasks(&mut state.pending);
+        if state
+            .latest_source_revisions
+            .get(source_id)
+            .is_some_and(|latest| *latest > source_revision)
+        {
+            return false;
+        }
+        state
+            .latest_source_revisions
+            .insert(source_id.to_owned(), source_revision);
+        let watcher = state.active.remove(source_id);
+        if let Some(mut watcher) = watcher {
+            if watcher.source_revision > source_revision {
+                state.active.insert(source_id.to_owned(), watcher);
+                return false;
+            }
+            cancel_watcher(&mut watcher);
+            state.pending.push(PendingWatcherTask {
+                source_id: source_id.to_owned(),
+                task: watcher.task,
+            });
+        }
+        true
+    }
+
+    pub(crate) async fn stop_watcher_and_wait_at_revision(
+        &self,
+        source_id: &str,
+        source_revision: i64,
+    ) -> bool {
+        let _operation = self.inner.watcher_operations.lock().await;
+        let (watcher, pending) = {
+            let _lifecycle = self.inner.lifecycle.lock().await;
+            let mut state = self
+                .inner
+                .watcher_state
+                .lock()
+                .expect("MCP watcher mutex poisoned");
+            prune_finished_tasks(&mut state.pending);
+            if state
+                .latest_source_revisions
+                .get(source_id)
+                .is_some_and(|latest| *latest > source_revision)
+            {
+                return false;
+            }
+            state
+                .latest_source_revisions
+                .insert(source_id.to_owned(), source_revision);
+            if state
+                .active
+                .get(source_id)
+                .is_some_and(|watcher| watcher.source_revision > source_revision)
+            {
+                return false;
+            }
+            let watcher = state.active.remove(source_id);
+            let pending = take_pending_tasks(&mut state, source_id);
+            (watcher, pending)
+        };
+        if let Some(watcher) = watcher {
+            stop_and_join_watcher(watcher).await;
+        }
+        join_tasks(pending).await;
+        true
+    }
+
+    pub(crate) async fn stop_watcher_and_wait_at_least_revision(
+        &self,
+        source_id: &str,
+        source_revision: i64,
+    ) {
+        let _operation = self.inner.watcher_operations.lock().await;
+        let (watcher, pending) = {
+            let _lifecycle = self.inner.lifecycle.lock().await;
+            let mut state = self
+                .inner
+                .watcher_state
+                .lock()
+                .expect("MCP watcher mutex poisoned");
+            prune_finished_tasks(&mut state.pending);
+            let revision = state
+                .latest_source_revisions
+                .get(source_id)
+                .copied()
+                .unwrap_or(source_revision)
+                .max(source_revision);
+            state
+                .latest_source_revisions
+                .insert(source_id.to_owned(), revision);
+            let watcher = state.active.remove(source_id);
+            let pending = take_pending_tasks(&mut state, source_id);
+            (watcher, pending)
+        };
+        if let Some(watcher) = watcher {
+            stop_and_join_watcher(watcher).await;
+        }
+        join_tasks(pending).await;
+    }
+
+    pub(crate) async fn retire_source(&self, source_id: &str) {
+        let _operation = self.inner.watcher_operations.lock().await;
+        let (watcher, pending) = {
+            let _lifecycle = self.inner.lifecycle.lock().await;
+            let mut state = self
+                .inner
+                .watcher_state
+                .lock()
+                .expect("MCP watcher mutex poisoned");
+            prune_finished_tasks(&mut state.pending);
+            state.retired_sources.insert(source_id.to_owned());
+            let watcher = state.active.remove(source_id);
+            let pending = take_pending_tasks(&mut state, source_id);
+            (watcher, pending)
+        };
+        if let Some(watcher) = watcher {
+            stop_and_join_watcher(watcher).await;
+        }
+        join_tasks(pending).await;
+    }
+
+    pub(crate) async fn unretire_source(&self, source_id: &str) {
+        let _operation = self.inner.watcher_operations.lock().await;
+        let _lifecycle = self.inner.lifecycle.lock().await;
+        self.inner
+            .watcher_state
+            .lock()
+            .expect("MCP watcher mutex poisoned")
+            .retired_sources
+            .remove(source_id);
+    }
+
+    pub(crate) fn has_watcher(&self, source_id: &str) -> bool {
+        let mut state = self
+            .inner
+            .watcher_state
+            .lock()
+            .expect("MCP watcher mutex poisoned");
+        let finished = state
+            .active
+            .get(source_id)
+            .is_some_and(|watcher| watcher.task.is_finished());
+        if finished {
+            let watcher = state.active.remove(source_id).expect("watcher exists");
+            state.pending.push(PendingWatcherTask {
+                source_id: source_id.to_owned(),
+                task: watcher.task,
+            });
+            false
+        } else {
+            state.active.contains_key(source_id)
+        }
+    }
+
+    pub(crate) fn watcher_revision(&self, source_id: &str) -> Option<i64> {
+        self.inner
+            .watcher_state
+            .lock()
+            .expect("MCP watcher mutex poisoned")
+            .active
+            .get(source_id)
+            .map(|watcher| watcher.source_revision)
+    }
+
+    pub(crate) async fn lock_watcher_reconciliation(&self) -> tokio::sync::OwnedMutexGuard<()> {
+        self.inner
+            .watcher_reconciliations
+            .clone()
+            .lock_owned()
+            .await
+    }
+
+    #[cfg(test)]
+    pub(crate) fn watcher_generation(&self, source_id: &str) -> Option<u64> {
+        self.inner
+            .watcher_state
+            .lock()
+            .expect("MCP watcher mutex poisoned")
+            .active
+            .get(source_id)
+            .map(|watcher| watcher.generation)
+    }
+
+    /// Observes committed catalog revisions and leases the watcher revision registry while a
+    /// catalog mutation is applied.
+    ///
+    /// A `None` result means one of the observations was already stale. Callers should reload the
+    /// catalog revisions and try again before applying their mutation.
+    pub(crate) async fn lock_source_revisions(
+        &self,
+        observed_revisions: impl IntoIterator<Item = (String, i64)>,
+    ) -> Option<SourceRevisionLease> {
+        let mut observed = HashMap::new();
+        for (source_id, revision) in observed_revisions {
+            if observed
+                .insert(source_id, revision)
+                .is_some_and(|previous| previous != revision)
+            {
+                return None;
+            }
+        }
+
+        let lifecycle = self.inner.lifecycle.clone().lock_owned().await;
+        let mut state = self
+            .inner
+            .watcher_state
+            .lock()
+            .expect("MCP watcher mutex poisoned");
+        if observed.iter().any(|(source_id, observed_revision)| {
+            state
+                .latest_source_revisions
+                .get(source_id)
+                .is_some_and(|latest| *latest > *observed_revision)
+                || state
+                    .active
+                    .get(source_id)
+                    .is_some_and(|watcher| watcher.source_revision > *observed_revision)
+        }) {
+            return None;
+        }
+
+        let mut entries = HashMap::with_capacity(observed.len());
+        for (source_id, observed_revision) in observed {
+            let (generation, installed_revision) = state
+                .active
+                .get(&source_id)
+                .map_or((None, None), |watcher| {
+                    (Some(watcher.generation), Some(watcher.source_revision))
+                });
+            state
+                .latest_source_revisions
+                .insert(source_id.clone(), observed_revision);
+            entries.insert(
+                source_id,
+                SourceRevisionEntry {
+                    generation,
+                    installed_revision,
+                    expected_catalog_revision: observed_revision,
+                },
+            );
+        }
+        drop(state);
+        Some(SourceRevisionLease {
+            inner: self.inner.clone(),
+            entries,
+            _lifecycle: lifecycle,
+        })
+    }
+
+    pub(crate) async fn shutdown(&self) {
+        self.begin_shutdown();
+        let wait_for_idle = async {
+            loop {
+                let notified = self.inner.idle.notified();
+                if self.inner.active_operations.load(Ordering::Acquire) == 0 {
+                    break;
+                }
+                notified.await;
+            }
+        };
+        if tokio::time::timeout(SHUTDOWN_GRACE, wait_for_idle)
+            .await
+            .is_err()
+        {
+            tracing::warn!("MCP connections did not drain before the shutdown deadline");
+        }
+
+        let _operation = self.inner.watcher_operations.lock().await;
+        let watchers = {
+            let _lifecycle = self.inner.lifecycle.lock().await;
+            let mut state = self
+                .inner
+                .watcher_state
+                .lock()
+                .expect("MCP watcher mutex poisoned");
+            for watcher in state.active.values_mut() {
+                cancel_watcher(watcher);
+            }
+            let mut watchers = state
+                .active
+                .drain()
+                .map(|(_, watcher)| watcher.task)
+                .collect::<Vec<_>>();
+            watchers.extend(state.pending.drain(..).map(|pending| pending.task));
+            watchers
+        };
+        drain_tasks(watchers).await;
+    }
+}
+
+impl WatcherRevisionLease {
+    pub(crate) fn current_revision(&self) -> Option<i64> {
+        let state = self
+            .inner
+            .watcher_state
+            .lock()
+            .expect("MCP watcher mutex poisoned");
+        state.active.get(&self.source_id).and_then(|watcher| {
+            (watcher.generation == self.generation
+                && state.latest_source_revisions.get(&self.source_id)
+                    == Some(&watcher.source_revision))
+            .then_some(watcher.source_revision)
+        })
+    }
+
+    pub(crate) async fn lock_revision(
+        &self,
+        expected_revision: i64,
+    ) -> Option<WatcherRevisionGuard> {
+        let lifecycle = self.inner.lifecycle.clone().lock_owned().await;
+        let state = self
+            .inner
+            .watcher_state
+            .lock()
+            .expect("MCP watcher mutex poisoned");
+        let is_current = state.active.get(&self.source_id).is_some_and(|watcher| {
+            watcher.generation == self.generation && watcher.source_revision == expected_revision
+        });
+        if !is_current
+            || state.latest_source_revisions.get(&self.source_id) != Some(&expected_revision)
+        {
+            return None;
+        }
+
+        drop(state);
+        Some(WatcherRevisionGuard {
+            inner: self.inner.clone(),
+            source_id: self.source_id.clone(),
+            generation: self.generation,
+            expected_revision,
+            _lifecycle: lifecycle,
+        })
+    }
+}
+
+impl SourceRevisionLease {
+    pub(crate) fn source_ids(&self) -> impl Iterator<Item = &str> {
+        self.entries.keys().map(String::as_str)
+    }
+
+    pub(crate) fn advance(self, committed_revisions: &HashMap<String, i64>) -> bool {
+        if self.entries.len() != committed_revisions.len()
+            || self.entries.iter().any(|(source_id, entry)| {
+                committed_revisions
+                    .get(source_id)
+                    .is_none_or(|revision| *revision < entry.expected_catalog_revision)
+            })
+        {
+            return false;
+        }
+
+        let mut state = self
+            .inner
+            .watcher_state
+            .lock()
+            .expect("MCP watcher mutex poisoned");
+        let current = self.entries.iter().all(|(source_id, entry)| {
+            state.latest_source_revisions.get(source_id) == Some(&entry.expected_catalog_revision)
+                && match (
+                    entry.generation,
+                    entry.installed_revision,
+                    state.active.get(source_id),
+                ) {
+                    (Some(generation), Some(installed_revision), Some(watcher)) => {
+                        watcher.generation == generation
+                            && watcher.source_revision == installed_revision
+                    }
+                    (Some(_), Some(_), None) | (None, None, None) => true,
+                    (Some(_), None, _) | (None, Some(_), _) | (None, None, Some(_)) => false,
+                }
+        });
+        if !current {
+            return false;
+        }
+
+        for (source_id, entry) in &self.entries {
+            let revision = committed_revisions[source_id];
+            if let Some(watcher) = state.active.get_mut(source_id) {
+                debug_assert_eq!(entry.generation, Some(watcher.generation));
+                if entry.installed_revision == Some(entry.expected_catalog_revision) {
+                    watcher.source_revision = revision;
+                }
+            }
+            state
+                .latest_source_revisions
+                .insert(source_id.clone(), revision);
+        }
+        true
+    }
+}
+
+impl WatcherRevisionGuard {
+    pub(crate) fn advance(self, new_revision: i64) -> bool {
+        if new_revision < self.expected_revision {
+            return false;
+        }
+
+        let mut state = self
+            .inner
+            .watcher_state
+            .lock()
+            .expect("MCP watcher mutex poisoned");
+        let is_current = state.active.get(&self.source_id).is_some_and(|watcher| {
+            watcher.generation == self.generation
+                && watcher.source_revision == self.expected_revision
+        });
+        if !is_current
+            || state.latest_source_revisions.get(&self.source_id) != Some(&self.expected_revision)
+        {
+            return false;
+        }
+        state
+            .active
+            .get_mut(&self.source_id)
+            .expect("current watcher exists")
+            .source_revision = new_revision;
+        state
+            .latest_source_revisions
+            .insert(self.source_id.clone(), new_revision);
+        true
+    }
+}
+
+struct WatcherCleanup {
+    inner: Arc<ManagerInner>,
+    source_id: String,
+    generation: u64,
+}
+
+impl Drop for WatcherCleanup {
+    fn drop(&mut self) {
+        retire_watcher_if_current(&self.inner, &self.source_id, self.generation);
+    }
+}
+
+fn cancel_watcher(watcher: &mut WatcherTask) {
+    if let Some(cancel) = watcher.cancel.take() {
+        let _ = cancel.send(());
+    }
+}
+
+async fn stop_and_join_watcher(mut watcher: WatcherTask) {
+    cancel_watcher(&mut watcher);
+    stop_and_join_task(watcher.task).await;
+}
+
+async fn join_tasks(tasks: Vec<tokio::task::JoinHandle<()>>) {
+    for task in tasks {
+        stop_and_join_task(task).await;
+    }
+}
+
+async fn stop_and_join_task(mut task: tokio::task::JoinHandle<()>) {
+    if tokio::time::timeout(SHUTDOWN_GRACE, &mut task)
+        .await
+        .is_err()
+    {
+        task.abort();
+        let _ = task.await;
+    }
+}
+
+async fn drain_tasks(tasks: Vec<tokio::task::JoinHandle<()>>) {
+    let deadline = tokio::time::Instant::now() + SHUTDOWN_GRACE;
+    let mut tasks = tasks.into_iter();
+    while let Some(mut task) = tasks.next() {
+        if tokio::time::timeout_at(deadline, &mut task).await.is_err() {
+            tracing::warn!("MCP source watchers did not stop before the shutdown deadline");
+            task.abort();
+            let _ = task.await;
+            let remaining = tasks.collect::<Vec<_>>();
+            for task in &remaining {
+                task.abort();
+            }
+            for task in remaining {
+                let _ = task.await;
+            }
+            return;
+        }
+    }
+}
+
+fn prune_finished_tasks(tasks: &mut Vec<PendingWatcherTask>) {
+    tasks.retain(|pending| !pending.task.is_finished());
+}
+
+fn take_pending_tasks(
+    state: &mut WatcherState,
+    source_id: &str,
+) -> Vec<tokio::task::JoinHandle<()>> {
+    let mut matching = Vec::new();
+    let mut remaining = Vec::with_capacity(state.pending.len());
+    for pending in state.pending.drain(..) {
+        if pending.source_id == source_id {
+            matching.push(pending.task);
+        } else {
+            remaining.push(pending);
+        }
+    }
+    state.pending = remaining;
+    matching
+}
+
+fn retire_watcher_if_current(inner: &ManagerInner, source_id: &str, generation: u64) {
+    let mut state = inner
+        .watcher_state
+        .lock()
+        .expect("MCP watcher mutex poisoned");
+    if state
+        .active
+        .get(source_id)
+        .is_some_and(|watcher| watcher.generation == generation)
+    {
+        let watcher = state
+            .active
+            .remove(source_id)
+            .expect("current watcher exists");
+        state.pending.push(PendingWatcherTask {
+            source_id: source_id.to_owned(),
+            task: watcher.task,
+        });
+    }
+}
+
+impl Drop for McpOperationGuard {
+    fn drop(&mut self) {
+        if self.inner.active_operations.fetch_sub(1, Ordering::AcqRel) == 1 {
+            self.inner.idle.notify_waiters();
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::sync::atomic::AtomicBool;
+
+    use super::*;
+
+    #[tokio::test]
+    async fn shutdown_rejects_new_work_and_waits_for_active_operations() {
+        let manager = McpConnectionManager::new(StdioTemplateRegistry::default());
+        let operation = manager.begin_operation().expect("operation starts");
+        manager.begin_shutdown();
+        assert!(manager.begin_operation().is_err());
+
+        let waiting = tokio::spawn({
+            let manager = manager.clone();
+            async move { manager.shutdown().await }
+        });
+        tokio::task::yield_now().await;
+        assert!(!waiting.is_finished());
+        drop(operation);
+        waiting.await.expect("shutdown task completes");
+    }
+
+    #[tokio::test]
+    async fn watcher_replacement_waits_for_old_cleanup_and_natural_exit_is_removed() {
+        let manager = McpConnectionManager::new(StdioTemplateRegistry::default());
+        let old_started = Arc::new(Notify::new());
+        let release_old = Arc::new(Notify::new());
+        manager
+            .replace_watcher("source".to_owned(), 1, {
+                let old_started = old_started.clone();
+                let release_old = release_old.clone();
+                move |mut canceled, _revision_lease| async move {
+                    old_started.notify_one();
+                    let _ = (&mut canceled).await;
+                    release_old.notified().await;
+                }
+            })
+            .await
+            .expect("first watcher installs");
+        old_started.notified().await;
+
+        let replacement_started = Arc::new(AtomicBool::new(false));
+        let replacing = tokio::spawn({
+            let manager = manager.clone();
+            let replacement_started = replacement_started.clone();
+            async move {
+                manager
+                    .replace_watcher(
+                        "source".to_owned(),
+                        2,
+                        move |_canceled, _revision_lease| async move {
+                            replacement_started.store(true, Ordering::Release);
+                        },
+                    )
+                    .await
+            }
+        });
+        tokio::task::yield_now().await;
+        assert!(!replacement_started.load(Ordering::Acquire));
+        assert!(!replacing.is_finished());
+        release_old.notify_one();
+        assert!(replacing.await.expect("replacement task completes").is_ok());
+        tokio::time::timeout(Duration::from_secs(1), async {
+            while !replacement_started.load(Ordering::Acquire) {
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .expect("replacement starts after old cleanup");
+        tokio::time::timeout(Duration::from_secs(1), async {
+            while manager.has_watcher("source") {
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .expect("naturally completed watcher removes its registry entry");
+    }
+
+    #[tokio::test]
+    async fn retired_source_atomically_rejects_install_until_unretired() {
+        let manager = McpConnectionManager::new(StdioTemplateRegistry::default());
+        manager.retire_source("source").await;
+        let started = Arc::new(AtomicBool::new(false));
+        let installed = manager
+            .replace_watcher("source".to_owned(), 1, {
+                let started = started.clone();
+                move |_canceled, _revision_lease| async move {
+                    started.store(true, Ordering::Release);
+                }
+            })
+            .await
+            .expect("manager remains available");
+        assert!(!installed);
+        assert!(!started.load(Ordering::Acquire));
+        assert!(!manager.has_watcher("source"));
+
+        manager.unretire_source("source").await;
+        assert!(
+            manager
+                .replace_watcher(
+                    "source".to_owned(),
+                    1,
+                    move |_canceled, _revision_lease| async {},
+                )
+                .await
+                .expect("source installs after rollback")
+        );
+    }
+
+    #[tokio::test]
+    async fn stale_install_and_stop_cannot_replace_a_newer_watcher() {
+        let manager = McpConnectionManager::new(StdioTemplateRegistry::default());
+        let canceled = Arc::new(Notify::new());
+        manager
+            .replace_watcher("source".to_owned(), 2, {
+                let canceled = canceled.clone();
+                move |mut stop, _revision_lease| async move {
+                    let _ = (&mut stop).await;
+                    canceled.notify_one();
+                }
+            })
+            .await
+            .expect("new watcher installs");
+
+        assert!(
+            !manager
+                .replace_watcher(
+                    "source".to_owned(),
+                    1,
+                    move |_stop, _revision_lease| async {},
+                )
+                .await
+                .expect("stale install is ignored")
+        );
+        assert!(!manager.stop_watcher_at_revision("source", 1).await);
+        assert!(!manager.stop_watcher_and_wait_at_revision("source", 1).await);
+        assert!(manager.has_watcher("source"));
+        assert!(
+            tokio::time::timeout(Duration::from_millis(10), canceled.notified())
+                .await
+                .is_err()
+        );
+        assert!(manager.stop_watcher_and_wait_at_revision("source", 2).await);
+    }
+
+    #[tokio::test]
+    async fn stale_watcher_generation_cannot_advance_a_replacement_revision() {
+        let manager = McpConnectionManager::new(StdioTemplateRegistry::default());
+        let (lease_sender, lease_receiver) = tokio::sync::oneshot::channel();
+        manager
+            .replace_watcher(
+                "source".to_owned(),
+                1,
+                move |mut stop, revision_lease| async move {
+                    assert!(lease_sender.send(revision_lease).is_ok());
+                    let _ = (&mut stop).await;
+                },
+            )
+            .await
+            .expect("first watcher installs");
+        let stale_lease = lease_receiver.await.expect("first watcher provides lease");
+
+        manager
+            .replace_watcher(
+                "source".to_owned(),
+                1,
+                move |mut stop, _revision_lease| async move {
+                    let _ = (&mut stop).await;
+                },
+            )
+            .await
+            .expect("replacement watcher installs");
+
+        assert!(stale_lease.lock_revision(1).await.is_none());
+        assert!(manager.has_watcher("source"));
+        assert!(manager.stop_watcher_and_wait_at_revision("source", 1).await);
+    }
+
+    #[tokio::test]
+    async fn active_revision_advance_fences_stale_install_and_stop() {
+        let manager = McpConnectionManager::new(StdioTemplateRegistry::default());
+        let (lease_sender, lease_receiver) = tokio::sync::oneshot::channel();
+        manager
+            .replace_watcher(
+                "source".to_owned(),
+                1,
+                move |mut stop, revision_lease| async move {
+                    assert!(lease_sender.send(revision_lease).is_ok());
+                    let _ = (&mut stop).await;
+                },
+            )
+            .await
+            .expect("watcher installs");
+        let revision_lease = lease_receiver.await.expect("watcher provides lease");
+
+        assert!(
+            revision_lease
+                .lock_revision(1)
+                .await
+                .expect("active revision locks")
+                .advance(2)
+        );
+        assert!(revision_lease.lock_revision(1).await.is_none());
+        assert!(
+            !revision_lease
+                .lock_revision(2)
+                .await
+                .expect("current revision locks")
+                .advance(1)
+        );
+        assert!(
+            !manager
+                .replace_watcher(
+                    "source".to_owned(),
+                    1,
+                    move |_stop, _revision_lease| async {},
+                )
+                .await
+                .expect("stale install is ignored")
+        );
+        assert!(!manager.stop_watcher_at_revision("source", 1).await);
+        assert!(!manager.stop_watcher_and_wait_at_revision("source", 1).await);
+        assert!(manager.has_watcher("source"));
+        assert!(manager.stop_watcher_and_wait_at_revision("source", 2).await);
+    }
+
+    #[tokio::test]
+    async fn source_mutation_lease_rebases_active_and_inactive_revision_authority() {
+        let manager = McpConnectionManager::new(StdioTemplateRegistry::default());
+        let (lease_sender, lease_receiver) = tokio::sync::oneshot::channel();
+        manager
+            .replace_watcher(
+                "active".to_owned(),
+                3,
+                move |mut stop, revision_lease| async move {
+                    assert!(lease_sender.send(revision_lease).is_ok());
+                    let _ = (&mut stop).await;
+                },
+            )
+            .await
+            .expect("watcher installs");
+        let watcher_lease = lease_receiver.await.expect("watcher provides lease");
+
+        let source_lease = manager
+            .lock_source_revisions([("active".to_owned(), 3), ("inactive".to_owned(), 7)])
+            .await
+            .expect("observed revisions lease");
+        assert!(source_lease.advance(&HashMap::from([
+            ("active".to_owned(), 4),
+            ("inactive".to_owned(), 8),
+        ])));
+
+        assert_eq!(watcher_lease.current_revision(), Some(4));
+        assert!(watcher_lease.lock_revision(3).await.is_none());
+        assert!(watcher_lease.lock_revision(4).await.is_some());
+        assert!(
+            !manager
+                .replace_watcher(
+                    "inactive".to_owned(),
+                    7,
+                    move |_stop, _revision_lease| async {},
+                )
+                .await
+                .expect("stale inactive install is ignored")
+        );
+        assert!(manager.stop_watcher_and_wait_at_revision("active", 4).await);
+    }
+
+    #[tokio::test]
+    async fn higher_catalog_observation_does_not_promote_a_stale_watcher_generation() {
+        let manager = McpConnectionManager::new(StdioTemplateRegistry::default());
+        let (old_sender, old_receiver) = tokio::sync::oneshot::channel();
+        manager
+            .replace_watcher(
+                "source".to_owned(),
+                3,
+                move |mut stop, revision_lease| async move {
+                    assert!(old_sender.send(revision_lease).is_ok());
+                    let _ = (&mut stop).await;
+                },
+            )
+            .await
+            .expect("old watcher installs");
+        let old = old_receiver.await.expect("old watcher provides lease");
+
+        let source_lease = manager
+            .lock_source_revisions([("source".to_owned(), 4)])
+            .await
+            .expect("newer catalog observation leases");
+        assert_eq!(old.current_revision(), None);
+        assert!(source_lease.advance(&HashMap::from([("source".to_owned(), 5)])));
+        assert_eq!(old.current_revision(), None);
+        assert!(old.lock_revision(3).await.is_none());
+        assert!(old.lock_revision(5).await.is_none());
+
+        let (current_sender, current_receiver) = tokio::sync::oneshot::channel();
+        assert!(
+            manager
+                .replace_watcher(
+                    "source".to_owned(),
+                    5,
+                    move |mut stop, revision_lease| async move {
+                        current_sender.send(revision_lease).ok();
+                        let _ = (&mut stop).await;
+                    },
+                )
+                .await
+                .expect("current watcher installs")
+        );
+        let current = current_receiver
+            .await
+            .expect("current watcher provides lease");
+        assert_eq!(current.current_revision(), Some(5));
+        assert!(manager.stop_watcher_and_wait_at_revision("source", 5).await);
+    }
+
+    #[tokio::test]
+    async fn source_mutation_lease_waits_for_watcher_commit_and_rejects_stale_observation() {
+        let manager = McpConnectionManager::new(StdioTemplateRegistry::default());
+        let (lease_sender, lease_receiver) = tokio::sync::oneshot::channel();
+        manager
+            .replace_watcher(
+                "source".to_owned(),
+                1,
+                move |mut stop, revision_lease| async move {
+                    assert!(lease_sender.send(revision_lease).is_ok());
+                    let _ = (&mut stop).await;
+                },
+            )
+            .await
+            .expect("watcher installs");
+        let watcher_lease = lease_receiver.await.expect("watcher provides lease");
+        let watcher_commit = watcher_lease
+            .lock_revision(1)
+            .await
+            .expect("watcher revision locks");
+
+        let attempted = Arc::new(Notify::new());
+        let source_mutation = tokio::spawn({
+            let manager = manager.clone();
+            let attempted = attempted.clone();
+            async move {
+                attempted.notify_one();
+                manager
+                    .lock_source_revisions([("source".to_owned(), 1)])
+                    .await
+            }
+        });
+        attempted.notified().await;
+        assert!(!source_mutation.is_finished());
+
+        assert!(watcher_commit.advance(2));
+        assert!(
+            source_mutation
+                .await
+                .expect("source mutation task joins")
+                .is_none()
+        );
+        assert_eq!(watcher_lease.current_revision(), Some(2));
+        assert!(manager.stop_watcher_and_wait_at_revision("source", 2).await);
+    }
+
+    #[tokio::test]
+    async fn manual_refresh_replaces_the_old_watcher_revision_lease() {
+        let manager = McpConnectionManager::new(StdioTemplateRegistry::default());
+        let (old_lease_sender, old_lease_receiver) = tokio::sync::oneshot::channel();
+        let old_stopped = Arc::new(Notify::new());
+        manager
+            .replace_watcher("source".to_owned(), 1, {
+                let old_stopped = old_stopped.clone();
+                move |mut stop, revision_lease| async move {
+                    assert!(old_lease_sender.send(revision_lease).is_ok());
+                    let _ = (&mut stop).await;
+                    old_stopped.notify_one();
+                }
+            })
+            .await
+            .expect("initial watcher installs");
+        let old_lease = old_lease_receiver
+            .await
+            .expect("initial watcher provides its revision lease");
+
+        let (refreshed_lease_sender, refreshed_lease_receiver) = tokio::sync::oneshot::channel();
+        assert!(
+            manager
+                .replace_watcher(
+                    "source".to_owned(),
+                    2,
+                    move |mut stop, revision_lease| async move {
+                        assert!(refreshed_lease_sender.send(revision_lease).is_ok());
+                        let _ = (&mut stop).await;
+                    },
+                )
+                .await
+                .expect("manual refresh installs its committed revision")
+        );
+        old_stopped.notified().await;
+        let refreshed_lease = refreshed_lease_receiver
+            .await
+            .expect("refreshed watcher provides its revision lease");
+
+        assert!(old_lease.lock_revision(1).await.is_none());
+        assert!(refreshed_lease.lock_revision(1).await.is_none());
+        assert!(refreshed_lease.lock_revision(2).await.is_some());
+        assert!(manager.stop_watcher_and_wait_at_revision("source", 2).await);
+    }
+
+    #[tokio::test]
+    async fn credential_rotation_guard_drains_before_shutdown_and_blocks_reinstall() {
+        let manager = McpConnectionManager::new(StdioTemplateRegistry::default());
+        let rotation_started = Arc::new(Notify::new());
+        let allow_commit = Arc::new(Notify::new());
+        let committed = Arc::new(AtomicBool::new(false));
+        let reinstall_started = Arc::new(AtomicBool::new(false));
+        let rotating = tokio::spawn({
+            let manager = manager.clone();
+            let rotation_started = rotation_started.clone();
+            let allow_commit = allow_commit.clone();
+            let committed = committed.clone();
+            let reinstall_started = reinstall_started.clone();
+            async move {
+                let operation = manager
+                    .begin_operation()
+                    .expect("credential rotation begins before shutdown");
+                rotation_started.notify_one();
+                allow_commit.notified().await;
+                committed.store(true, Ordering::Release);
+                let reinstall = manager
+                    .replace_watcher(
+                        "source".to_owned(),
+                        2,
+                        move |_stop, _revision_lease| async move {
+                            reinstall_started.store(true, Ordering::Release);
+                        },
+                    )
+                    .await;
+                drop(operation);
+                reinstall
+            }
+        });
+        rotation_started.notified().await;
+
+        manager.begin_shutdown();
+        let shutdown = tokio::spawn({
+            let manager = manager.clone();
+            async move { manager.shutdown().await }
+        });
+        tokio::task::yield_now().await;
+        assert!(!shutdown.is_finished());
+
+        allow_commit.notify_one();
+        assert!(
+            rotating
+                .await
+                .expect("credential rotation task joins")
+                .is_err(),
+            "watcher reinstall is rejected once shutdown starts"
+        );
+        shutdown.await.expect("shutdown drains credential rotation");
+        assert!(committed.load(Ordering::Acquire));
+        assert!(!reinstall_started.load(Ordering::Acquire));
+        assert!(!manager.has_watcher("source"));
+    }
+
+    #[tokio::test]
+    async fn revision_guard_blocks_replacement_and_stop_across_a_paused_commit() {
+        let manager = McpConnectionManager::new(StdioTemplateRegistry::default());
+        let (old_lease_sender, old_lease_receiver) = tokio::sync::oneshot::channel();
+        manager
+            .replace_watcher(
+                "source".to_owned(),
+                1,
+                move |mut stop, revision_lease| async move {
+                    assert!(old_lease_sender.send(revision_lease).is_ok());
+                    let _ = (&mut stop).await;
+                },
+            )
+            .await
+            .expect("first watcher installs");
+        let old_lease = old_lease_receiver
+            .await
+            .expect("first watcher provides lease");
+        let revision_guard = old_lease
+            .lock_revision(1)
+            .await
+            .expect("first watcher locks its revision");
+
+        let (new_lease_sender, new_lease_receiver) = tokio::sync::oneshot::channel();
+        let replacement_attempted = Arc::new(Notify::new());
+        let replacing = tokio::spawn({
+            let manager = manager.clone();
+            let replacement_attempted = replacement_attempted.clone();
+            async move {
+                replacement_attempted.notify_one();
+                manager
+                    .replace_watcher(
+                        "source".to_owned(),
+                        2,
+                        move |mut stop, revision_lease| async move {
+                            assert!(new_lease_sender.send(revision_lease).is_ok());
+                            let _ = (&mut stop).await;
+                        },
+                    )
+                    .await
+            }
+        });
+        replacement_attempted.notified().await;
+        assert!(!replacing.is_finished());
+
+        assert!(revision_guard.advance(2));
+        assert!(
+            replacing
+                .await
+                .expect("replacement task completes")
+                .expect("manager remains available")
+        );
+        let new_lease = new_lease_receiver
+            .await
+            .expect("replacement watcher provides lease");
+        assert!(old_lease.lock_revision(2).await.is_none());
+
+        let revision_guard = new_lease
+            .lock_revision(2)
+            .await
+            .expect("replacement watcher locks its revision");
+        let stop_attempted = Arc::new(Notify::new());
+        let stopping = tokio::spawn({
+            let manager = manager.clone();
+            let stop_attempted = stop_attempted.clone();
+            async move {
+                stop_attempted.notify_one();
+                manager.stop_watcher_at_revision("source", 2).await
+            }
+        });
+        stop_attempted.notified().await;
+        assert!(!stopping.is_finished());
+
+        assert!(revision_guard.advance(3));
+        assert!(!stopping.await.expect("stop task completes"));
+        assert!(manager.has_watcher("source"));
+        assert!(manager.stop_watcher_and_wait_at_revision("source", 3).await);
+    }
+
+    #[tokio::test]
+    async fn replacement_releases_lifecycle_before_joining_the_old_watcher() {
+        let manager = McpConnectionManager::new(StdioTemplateRegistry::default());
+        let watcher_manager = manager.clone();
+        manager
+            .replace_watcher(
+                "source".to_owned(),
+                1,
+                move |mut stop, revision_lease| async move {
+                    let _ = (&mut stop).await;
+                    assert!(!watcher_manager.stop_watcher_at_revision("source", 1).await);
+                    assert!(revision_lease.lock_revision(1).await.is_none());
+                },
+            )
+            .await
+            .expect("first watcher installs");
+
+        let installed = tokio::time::timeout(
+            Duration::from_secs(1),
+            manager.replace_watcher(
+                "source".to_owned(),
+                2,
+                move |_stop, _revision_lease| async {},
+            ),
+        )
+        .await
+        .expect("replacement does not deadlock on the revision lifecycle")
+        .expect("manager remains available");
+        assert!(installed);
+    }
+
+    #[tokio::test]
+    async fn panicked_watcher_is_removed_from_the_active_registry() {
+        let manager = McpConnectionManager::new(StdioTemplateRegistry::default());
+        manager
+            .replace_watcher(
+                "source".to_owned(),
+                1,
+                move |_stop, _revision_lease| async move {
+                    panic!("watcher fixture panic");
+                },
+            )
+            .await
+            .expect("watcher installs");
+        tokio::time::timeout(Duration::from_secs(1), async {
+            while manager.has_watcher("source") {
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .expect("panicked watcher is removed");
+        manager.shutdown().await;
+    }
+
+    #[tokio::test]
+    async fn replacement_waits_for_a_nonblocking_self_stop_to_finish() {
+        let manager = McpConnectionManager::new(StdioTemplateRegistry::default());
+        let started = Arc::new(Notify::new());
+        let release = Arc::new(Notify::new());
+        manager
+            .replace_watcher("source".to_owned(), 1, {
+                let started = started.clone();
+                let release = release.clone();
+                move |mut canceled, _revision_lease| async move {
+                    started.notify_one();
+                    let _ = (&mut canceled).await;
+                    release.notified().await;
+                }
+            })
+            .await
+            .expect("watcher installs");
+        started.notified().await;
+        assert!(manager.stop_watcher_at_revision("source", 1).await);
+
+        let replacement_started = Arc::new(AtomicBool::new(false));
+        let replacing = tokio::spawn({
+            let manager = manager.clone();
+            let replacement_started = replacement_started.clone();
+            async move {
+                manager
+                    .replace_watcher(
+                        "source".to_owned(),
+                        2,
+                        move |_canceled, _revision_lease| async move {
+                            replacement_started.store(true, Ordering::Release);
+                        },
+                    )
+                    .await
+            }
+        });
+        tokio::task::yield_now().await;
+        assert!(!replacing.is_finished());
+        assert!(!replacement_started.load(Ordering::Acquire));
+        release.notify_one();
+        assert!(replacing.await.expect("replacement task completes").is_ok());
+    }
+
+    #[tokio::test]
+    async fn concurrent_replacement_and_retirement_leave_no_watcher() {
+        let manager = McpConnectionManager::new(StdioTemplateRegistry::default());
+        let old_started = Arc::new(Notify::new());
+        let release_old = Arc::new(Notify::new());
+        manager
+            .replace_watcher("source".to_owned(), 1, {
+                let old_started = old_started.clone();
+                let release_old = release_old.clone();
+                move |mut canceled, _revision_lease| async move {
+                    old_started.notify_one();
+                    let _ = (&mut canceled).await;
+                    release_old.notified().await;
+                }
+            })
+            .await
+            .expect("watcher installs");
+        old_started.notified().await;
+
+        let replacing = tokio::spawn({
+            let manager = manager.clone();
+            async move {
+                manager
+                    .replace_watcher(
+                        "source".to_owned(),
+                        2,
+                        move |mut canceled, _revision_lease| async move {
+                            let _ = (&mut canceled).await;
+                        },
+                    )
+                    .await
+            }
+        });
+        tokio::task::yield_now().await;
+        let retiring = tokio::spawn({
+            let manager = manager.clone();
+            async move { manager.retire_source("source").await }
+        });
+        release_old.notify_one();
+
+        replacing
+            .await
+            .expect("replacement task completes")
+            .expect("manager remains available");
+        retiring.await.expect("retirement task completes");
+        assert!(!manager.has_watcher("source"));
+        assert!(
+            !manager
+                .replace_watcher(
+                    "source".to_owned(),
+                    3,
+                    move |_canceled, _revision_lease| async {},
+                )
+                .await
+                .expect("manager remains available")
+        );
+    }
+
+    #[tokio::test]
+    async fn shutdown_drains_a_nonblocking_self_stop() {
+        let manager = McpConnectionManager::new(StdioTemplateRegistry::default());
+        let started = Arc::new(Notify::new());
+        let release = Arc::new(Notify::new());
+        manager
+            .replace_watcher("source".to_owned(), 1, {
+                let started = started.clone();
+                let release = release.clone();
+                move |mut canceled, _revision_lease| async move {
+                    started.notify_one();
+                    let _ = (&mut canceled).await;
+                    release.notified().await;
+                }
+            })
+            .await
+            .expect("watcher installs");
+        started.notified().await;
+        assert!(manager.stop_watcher_at_revision("source", 1).await);
+
+        let shutdown = tokio::spawn({
+            let manager = manager.clone();
+            async move { manager.shutdown().await }
+        });
+        tokio::task::yield_now().await;
+        assert!(!shutdown.is_finished());
+        release.notify_one();
+        shutdown.await.expect("shutdown drains stopped watcher");
+    }
+}
diff --git a/src/mcp/mod.rs b/src/mcp/mod.rs
new file mode 100644
index 000000000..ca902a81c
--- /dev/null
+++ b/src/mcp/mod.rs
@@ -0,0 +1,4 @@
+pub mod discovery;
+pub mod downstream;
+pub(crate) mod manager;
+pub mod upstream;
diff --git a/src/mcp/upstream/http/mod.rs b/src/mcp/upstream/http/mod.rs
new file mode 100644
index 000000000..e83a22205
--- /dev/null
+++ b/src/mcp/upstream/http/mod.rs
@@ -0,0 +1,1665 @@
+use std::{
+    sync::{
+        Arc, Mutex as StateMutex, MutexGuard,
+        atomic::{AtomicUsize, Ordering},
+    },
+    time::Duration,
+};
+
+use reqwest::{
+    Method, StatusCode,
+    header::{ACCEPT, CONTENT_TYPE, HeaderMap, HeaderName, HeaderValue},
+};
+use rmcp::model::{CallToolResult, ProtocolVersion};
+use serde_json::{Map, Value, json};
+use thiserror::Error;
+use tokio::sync::{Notify, RwLock as AsyncRwLock, broadcast, oneshot};
+use url::{Host, Url};
+
+#[cfg(test)]
+use crate::outbound::OutboundResponse;
+use crate::outbound::{
+    HardenedHttpClient, OutboundError, OutboundPolicy, OutboundRequest, OutboundStreamResponse,
+    parse_url,
+};
+
+pub const DEFAULT_PROTOCOL_VERSION: &str = "2025-11-25";
+const SUPPORTED_PROTOCOL_VERSIONS: [&str; 2] = [DEFAULT_PROTOCOL_VERSION, "2025-06-18"];
+
+pub(crate) fn is_supported_protocol_version(version: &str) -> bool {
+    SUPPORTED_PROTOCOL_VERSIONS.contains(&version)
+}
+
+const MCP_SESSION_ID: HeaderName = HeaderName::from_static("mcp-session-id");
+const MCP_PROTOCOL_VERSION: HeaderName = HeaderName::from_static("mcp-protocol-version");
+const LAST_EVENT_ID: HeaderName = HeaderName::from_static("last-event-id");
+const MAX_SESSION_ID_BYTES: usize = 1024;
+const MAX_SSE_EVENTS: usize = 1024;
+const MAX_SSE_RECONNECTS: usize = 3;
+const MAX_LOGICAL_STREAM_BYTES: usize = 16 * 1024 * 1024;
+const MCP_TOTAL_TIMEOUT: Duration = Duration::from_secs(30);
+const NOTIFICATION_IDLE_TIMEOUT: Duration = Duration::from_secs(5 * 60);
+const SESSION_TERMINATION_TIMEOUT: Duration = Duration::from_secs(2);
+
+#[derive(Clone)]
+pub struct StreamableHttpConfig {
+    pub endpoint: String,
+    pub headers: HeaderMap,
+    pub allow_private_networks: bool,
+    pub protocol_version: String,
+    pub client_name: String,
+    pub client_version: String,
+}
+
+impl StreamableHttpConfig {
+    pub fn new(endpoint: impl Into<String>) -> Self {
+        Self {
+            endpoint: endpoint.into(),
+            headers: HeaderMap::new(),
+            allow_private_networks: false,
+            protocol_version: DEFAULT_PROTOCOL_VERSION.to_owned(),
+            client_name: "executor".to_owned(),
+            client_version: env!("CARGO_PKG_VERSION").to_owned(),
+        }
+    }
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct ListToolsPage {
+    pub tools: Vec<Value>,
+    pub next_cursor: Option<String>,
+}
+
+#[derive(Debug, Error)]
+pub enum StreamableHttpError {
+    #[error("the MCP HTTP configuration contains a reserved header")]
+    ReservedHeader,
+    #[error("the MCP protocol version is invalid")]
+    InvalidProtocolVersion,
+    #[error("the MCP client name or version is invalid")]
+    InvalidClientInfo,
+    #[error("the MCP request is not a valid JSON-RPC message")]
+    InvalidRequest,
+    #[error("the MCP response is not valid UTF-8")]
+    InvalidUtf8,
+    #[error("the MCP response has an unsupported content type")]
+    UnsupportedContentType,
+    #[error("the MCP response is malformed")]
+    InvalidResponse,
+    #[error("the MCP server returned HTTP {0}")]
+    HttpStatus(StatusCode),
+    #[error("the MCP session expired")]
+    SessionExpired,
+    #[error("the MCP session was invalidated while the request was in flight")]
+    SessionInvalidated,
+    #[error("the MCP server returned an invalid session identifier")]
+    InvalidSessionId,
+    #[error("the MCP server changed the active session identifier")]
+    SessionChanged,
+    #[error("the MCP server selected an unsupported protocol version")]
+    ProtocolVersionMismatch,
+    #[error("MCP HTTP endpoints must use HTTPS, except for loopback HTTP")]
+    InsecureEndpoint,
+    #[error("the MCP transport has not been initialized")]
+    NotInitialized,
+    #[error("the MCP transport is already initialized")]
+    AlreadyInitialized,
+    #[error("the MCP server returned a JSON-RPC error")]
+    JsonRpc {
+        code: i64,
+        message: String,
+        data: Option<Value>,
+    },
+    #[error(transparent)]
+    Json(#[from] serde_json::Error),
+    #[error(transparent)]
+    Outbound(#[from] OutboundError),
+}
+
+#[derive(Default)]
+struct TransportState {
+    session_id: Option<String>,
+    negotiated_protocol_version: Option<ProtocolVersion>,
+    initialized: bool,
+    generation: u64,
+}
+
+#[derive(Default)]
+struct SessionTerminationTracker {
+    pending: AtomicUsize,
+    drained: Notify,
+}
+
+impl SessionTerminationTracker {
+    fn start(self: &Arc<Self>) -> SessionTerminationPermit {
+        self.pending.fetch_add(1, Ordering::AcqRel);
+        SessionTerminationPermit {
+            tracker: self.clone(),
+        }
+    }
+
+    async fn wait(&self) {
+        while self.pending.load(Ordering::Acquire) != 0 {
+            self.drained.notified().await;
+        }
+    }
+
+    fn has_pending(&self) -> bool {
+        self.pending.load(Ordering::Acquire) != 0
+    }
+}
+
+struct SessionTerminationPermit {
+    tracker: Arc<SessionTerminationTracker>,
+}
+
+impl Drop for SessionTerminationPermit {
+    fn drop(&mut self) {
+        self.tracker.pending.fetch_sub(1, Ordering::AcqRel);
+        self.tracker.drained.notify_one();
+    }
+}
+
+#[cfg(test)]
+#[derive(Default)]
+struct InitializationCleanupInterleave {
+    drained: Notify,
+    resume: Notify,
+}
+
+struct InitializationGuard {
+    state: Arc<StateMutex<TransportState>>,
+    client: HardenedHttpClient,
+    endpoint: Url,
+    headers: HeaderMap,
+    requested_protocol_version: ProtocolVersion,
+    session_terminations: Arc<SessionTerminationTracker>,
+    generation: u64,
+    committed: bool,
+}
+
+impl InitializationGuard {
+    fn new(transport: &StreamableHttpTransport, generation: u64) -> Self {
+        Self {
+            state: transport.state.clone(),
+            client: transport.client.clone(),
+            endpoint: transport.endpoint.clone(),
+            headers: transport.headers.clone(),
+            requested_protocol_version: transport.requested_protocol_version.clone(),
+            session_terminations: transport.session_terminations.clone(),
+            generation,
+            committed: false,
+        }
+    }
+
+    fn commit(&mut self) {
+        self.committed = true;
+    }
+}
+
+impl Drop for InitializationGuard {
+    fn drop(&mut self) {
+        if self.committed {
+            return;
+        }
+        let cleanup = {
+            let mut state = self
+                .state
+                .lock()
+                .unwrap_or_else(std::sync::PoisonError::into_inner);
+            if state.generation != self.generation {
+                return;
+            }
+            state.generation = state.generation.wrapping_add(1);
+            let session_id = state.session_id.take();
+            let protocol_version = state
+                .negotiated_protocol_version
+                .take()
+                .unwrap_or_else(|| self.requested_protocol_version.clone());
+            state.initialized = false;
+            session_id.map(|session_id| {
+                (
+                    session_id,
+                    protocol_version,
+                    self.session_terminations.start(),
+                )
+            })
+        };
+        if let Some((session_id, protocol_version, permit)) = cleanup {
+            let _ = spawn_session_termination(
+                self.client.clone(),
+                self.endpoint.clone(),
+                self.headers.clone(),
+                session_id,
+                protocol_version,
+                permit,
+            );
+        }
+    }
+}
+
+#[derive(Clone)]
+/// Hardened request-response Streamable HTTP transport.
+///
+/// SSE responses are processed incrementally with bounded events, bytes, and
+/// deadlines. Interrupted streams resume through GET and `Last-Event-ID` when
+/// the server supplied both a session and an event identifier.
+pub struct StreamableHttpTransport {
+    endpoint: Url,
+    headers: HeaderMap,
+    client: HardenedHttpClient,
+    requested_protocol_version: ProtocolVersion,
+    client_name: Arc<str>,
+    client_version: Arc<str>,
+    state: Arc<StateMutex<TransportState>>,
+    lifecycle: Arc<AsyncRwLock<()>>,
+    session_terminations: Arc<SessionTerminationTracker>,
+    #[cfg(test)]
+    initialization_cleanup_interleave:
+        Arc<StateMutex<Option<Arc<InitializationCleanupInterleave>>>>,
+    tool_list_changed: broadcast::Sender<()>,
+}
+
+impl StreamableHttpTransport {
+    pub fn new(config: StreamableHttpConfig) -> Result<Self, StreamableHttpError> {
+        validate_custom_headers(&config.headers)?;
+        let requested_protocol_version =
+            serde_json::from_value::<ProtocolVersion>(Value::String(config.protocol_version))
+                .map_err(|_| StreamableHttpError::InvalidProtocolVersion)?;
+        if requested_protocol_version != ProtocolVersion::V_2025_11_25 {
+            return Err(StreamableHttpError::InvalidProtocolVersion);
+        }
+        if config.client_name.trim().is_empty()
+            || config.client_version.trim().is_empty()
+            || config.client_name.len() > 256
+            || config.client_version.len() > 256
+        {
+            return Err(StreamableHttpError::InvalidClientInfo);
+        }
+        let policy = OutboundPolicy {
+            allow_private_networks: config.allow_private_networks,
+            require_https_or_loopback: true,
+            max_redirects: 0,
+            ..OutboundPolicy::default()
+        };
+        if let Ok(endpoint) = Url::parse(&config.endpoint)
+            && endpoint.scheme() == "http"
+        {
+            validate_transport_endpoint(&endpoint)?;
+        }
+        let endpoint = parse_url(&config.endpoint, &policy)?;
+        validate_transport_endpoint(&endpoint)?;
+        let (tool_list_changed, _) = broadcast::channel(16);
+        Ok(Self {
+            endpoint,
+            headers: config.headers,
+            client: HardenedHttpClient::new(policy),
+            requested_protocol_version,
+            client_name: Arc::from(config.client_name),
+            client_version: Arc::from(config.client_version),
+            state: Arc::new(StateMutex::new(TransportState::default())),
+            lifecycle: Arc::new(AsyncRwLock::new(())),
+            session_terminations: Arc::new(SessionTerminationTracker::default()),
+            #[cfg(test)]
+            initialization_cleanup_interleave: Arc::new(StateMutex::new(None)),
+            tool_list_changed,
+        })
+    }
+
+    pub async fn initialize(&self) -> Result<Value, StreamableHttpError> {
+        validate_transport_endpoint(&self.endpoint)?;
+        let _lifecycle = self.lifecycle.write().await;
+        let generation = loop {
+            self.session_terminations.wait().await;
+            #[cfg(test)]
+            {
+                let interleave = self
+                    .initialization_cleanup_interleave
+                    .lock()
+                    .unwrap_or_else(std::sync::PoisonError::into_inner)
+                    .take();
+                if let Some(interleave) = interleave {
+                    interleave.drained.notify_one();
+                    interleave.resume.notified().await;
+                }
+            }
+            let state = self.lock_state();
+            if self.session_terminations.has_pending() {
+                continue;
+            }
+            if state.initialized {
+                return Err(StreamableHttpError::AlreadyInitialized);
+            }
+            break state.generation;
+        };
+        let mut initialization = InitializationGuard::new(self, generation);
+
+        let id = json!(0);
+        let result = self
+            .request_result(
+                json!({
+                    "jsonrpc": "2.0",
+                    "id": id,
+                    "method": "initialize",
+                    "params": {
+                        "protocolVersion": self.requested_protocol_version,
+                        "capabilities": {},
+                        "clientInfo": {
+                            "name": self.client_name.as_ref(),
+                            "version": self.client_version.as_ref()
+                        }
+                    }
+                }),
+                &id,
+                false,
+                true,
+            )
+            .await?;
+        let Some(selected_version_value) = result
+            .as_object()
+            .and_then(|result| result.get("protocolVersion"))
+        else {
+            return Err(StreamableHttpError::InvalidResponse);
+        };
+        let selected_version =
+            serde_json::from_value::<ProtocolVersion>(selected_version_value.clone())
+                .map_err(|_| StreamableHttpError::InvalidResponse)?;
+        if !is_supported_protocol_version(selected_version.as_str()) {
+            return Err(StreamableHttpError::ProtocolVersionMismatch);
+        }
+        self.lock_state().negotiated_protocol_version = Some(selected_version);
+
+        let notification = json!({
+            "jsonrpc": "2.0",
+            "method": "notifications/initialized"
+        });
+        self.send_internal(notification, false, false).await?;
+        self.lock_state().initialized = true;
+        initialization.commit();
+        Ok(result)
+    }
+
+    pub async fn list_tools(
+        &self,
+        cursor: Option<&str>,
+        id: Value,
+    ) -> Result<ListToolsPage, StreamableHttpError> {
+        validate_id(&id)?;
+        let mut params = Map::new();
+        if let Some(cursor) = cursor {
+            params.insert("cursor".to_owned(), Value::String(cursor.to_owned()));
+        }
+        let result = self
+            .request_result(
+                json!({
+                    "jsonrpc": "2.0",
+                    "id": id,
+                    "method": "tools/list",
+                    "params": params
+                }),
+                &id,
+                true,
+                false,
+            )
+            .await?;
+        let result = result
+            .as_object()
+            .ok_or(StreamableHttpError::InvalidResponse)?;
+        let tools = result
+            .get("tools")
+            .and_then(Value::as_array)
+            .cloned()
+            .ok_or(StreamableHttpError::InvalidResponse)?;
+        if tools.iter().any(|tool| !tool.is_object()) {
+            return Err(StreamableHttpError::InvalidResponse);
+        }
+        let next_cursor = match result.get("nextCursor") {
+            None | Some(Value::Null) => None,
+            Some(Value::String(cursor)) => Some(cursor.clone()),
+            Some(_) => return Err(StreamableHttpError::InvalidResponse),
+        };
+        Ok(ListToolsPage { tools, next_cursor })
+    }
+
+    pub async fn call_tool(
+        &self,
+        name: &str,
+        arguments: Value,
+        id: Value,
+    ) -> Result<Value, StreamableHttpError> {
+        validate_id(&id)?;
+        if name.is_empty() || name.len() > 1024 || !arguments.is_object() {
+            return Err(StreamableHttpError::InvalidRequest);
+        }
+        let result = self
+            .request_result(
+                json!({
+                    "jsonrpc": "2.0",
+                    "id": id,
+                    "method": "tools/call",
+                    "params": { "name": name, "arguments": arguments }
+                }),
+                &id,
+                true,
+                false,
+            )
+            .await?;
+        validate_call_tool_result(&result)?;
+        Ok(result)
+    }
+
+    pub async fn terminate(&self) -> Result<(), StreamableHttpError> {
+        validate_transport_endpoint(&self.endpoint)?;
+        let _lifecycle = self.lifecycle.write().await;
+        let cleanup = loop {
+            self.session_terminations.wait().await;
+            let mut state = self.lock_state();
+            if self.session_terminations.has_pending() {
+                continue;
+            }
+            state.generation = state.generation.wrapping_add(1);
+            let session_id = state.session_id.take();
+            let protocol_version = state.negotiated_protocol_version.take();
+            state.initialized = false;
+            break session_id.map(|session_id| {
+                (
+                    session_id,
+                    protocol_version,
+                    self.session_terminations.start(),
+                )
+            });
+        };
+        let Some((session_id, protocol_version, permit)) = cleanup else {
+            return Ok(());
+        };
+        let protocol_version =
+            protocol_version.unwrap_or_else(|| self.requested_protocol_version.clone());
+        let result = spawn_session_termination(
+            self.client.clone(),
+            self.endpoint.clone(),
+            self.headers.clone(),
+            session_id,
+            protocol_version,
+            permit,
+        )?;
+        let status = result
+            .await
+            .map_err(|_| StreamableHttpError::InvalidResponse)??;
+        if status.is_success() || status == StatusCode::NOT_FOUND {
+            Ok(())
+        } else {
+            Err(StreamableHttpError::HttpStatus(status))
+        }
+    }
+
+    #[cfg(test)]
+    async fn session_id(&self) -> Option<String> {
+        self.lock_state().session_id.clone()
+    }
+
+    /// Signals are coalescible. A lagged receiver should perform one refresh
+    /// and then continue receiving rather than attempting to count events.
+    pub fn subscribe_tool_list_changed(&self) -> broadcast::Receiver<()> {
+        self.tool_list_changed.subscribe()
+    }
+
+    /// Runs the optional standalone GET SSE stream until it closes or fails.
+    /// The caller owns cancellation and may restart this future after errors.
+    pub async fn listen_notifications(&self) -> Result<(), StreamableHttpError> {
+        validate_transport_endpoint(&self.endpoint)?;
+        let (session_id, protocol_version, generation) = {
+            let state = self.lock_state();
+            if !state.initialized {
+                return Err(StreamableHttpError::NotInitialized);
+            }
+            (
+                state.session_id.clone(),
+                state.negotiated_protocol_version.clone(),
+                state.generation,
+            )
+        };
+        let protocol_version = protocol_version.ok_or(StreamableHttpError::NotInitialized)?;
+        let mut response = self
+            .open_notification_stream(session_id.as_deref(), &protocol_version, None, true)
+            .await?;
+        let mut decoder = SseDecoder::default();
+        loop {
+            if self.lock_state().generation != generation {
+                return Err(StreamableHttpError::SessionInvalidated);
+            }
+            if response.status == StatusCode::NOT_FOUND {
+                self.reset_state_if_generation(generation).await;
+                return Err(StreamableHttpError::SessionExpired);
+            }
+            if response.status != StatusCode::OK {
+                return Err(StreamableHttpError::HttpStatus(response.status));
+            }
+            self.accept_response_session_or_reset(&response.headers, generation, false)
+                .await?;
+            if response.declared_response_too_large() {
+                return Err(OutboundError::ResponseBodyTooLarge.into());
+            }
+            if response_content_type(&response.headers)? != ResponseContentType::Sse {
+                return Err(StreamableHttpError::UnsupportedContentType);
+            }
+            loop {
+                match response.next_chunk().await {
+                    Ok(Some(chunk)) => {
+                        for event in decoder.push(&chunk)? {
+                            if let Some(message) = event.message {
+                                self.handle_server_message(&message, generation).await?;
+                            }
+                        }
+                    }
+                    Ok(None) => break,
+                    Err(error) if resumable_stream_error(&error) => {
+                        decoder.reset_stream();
+                        break;
+                    }
+                    Err(error) => return Err(error.into()),
+                }
+            }
+            for event in decoder.finish()? {
+                if let Some(message) = event.message {
+                    self.handle_server_message(&message, generation).await?;
+                }
+            }
+            let last_event_id = decoder.last_event_id().map(str::to_owned);
+            let retry_delay = decoder.retry_delay();
+            if !retry_delay.is_zero() {
+                tokio::time::sleep(retry_delay).await;
+            }
+            self.ensure_generation(generation).await?;
+            decoder.reset_connection_limits();
+            response = self
+                .open_notification_stream(
+                    session_id.as_deref(),
+                    &protocol_version,
+                    last_event_id.as_deref(),
+                    true,
+                )
+                .await?;
+        }
+    }
+
+    async fn request_result(
+        &self,
+        request: Value,
+        id: &Value,
+        require_initialized: bool,
+        accept_new_session: bool,
+    ) -> Result<Value, StreamableHttpError> {
+        let messages = self
+            .send_internal(request, require_initialized, accept_new_session)
+            .await?;
+        response_result(messages, id)
+    }
+
+    async fn send_internal(
+        &self,
+        message: Value,
+        require_initialized: bool,
+        accept_new_session: bool,
+    ) -> Result<Vec<Value>, StreamableHttpError> {
+        let _lifecycle = if require_initialized {
+            Some(self.lifecycle.read().await)
+        } else {
+            None
+        };
+        tokio::time::timeout(
+            MCP_TOTAL_TIMEOUT,
+            self.send_internal_with_deadline(message, require_initialized, accept_new_session),
+        )
+        .await
+        .map_err(|_| StreamableHttpError::Outbound(OutboundError::Timeout))?
+    }
+
+    async fn send_internal_with_deadline(
+        &self,
+        message: Value,
+        require_initialized: bool,
+        accept_new_session: bool,
+    ) -> Result<Vec<Value>, StreamableHttpError> {
+        validate_transport_endpoint(&self.endpoint)?;
+        validate_outgoing_message(&message)?;
+        let (session_id, protocol_version, generation) = {
+            let state = self.lock_state();
+            if require_initialized && !state.initialized {
+                return Err(StreamableHttpError::NotInitialized);
+            }
+            (
+                state.session_id.clone(),
+                state.negotiated_protocol_version.clone(),
+                state.generation,
+            )
+        };
+        let mut headers = self.headers.clone();
+        headers.insert(
+            ACCEPT,
+            HeaderValue::from_static("application/json, text/event-stream"),
+        );
+        headers.insert(CONTENT_TYPE, HeaderValue::from_static("application/json"));
+        if let Some(session_id) = session_id.as_deref() {
+            headers.insert(
+                MCP_SESSION_ID,
+                HeaderValue::from_str(session_id)
+                    .map_err(|_| StreamableHttpError::InvalidSessionId)?,
+            );
+        }
+        if let Some(protocol_version) = protocol_version.as_ref() {
+            headers.insert(
+                MCP_PROTOCOL_VERSION,
+                HeaderValue::from_str(protocol_version.as_str())
+                    .map_err(|_| StreamableHttpError::InvalidProtocolVersion)?,
+            );
+        }
+        let awaited_id = message
+            .as_object()
+            .and_then(|message| message.get("method"))
+            .and_then(|_| message.get("id"))
+            .cloned();
+        let response = self
+            .client
+            .execute_streaming_headers_first(OutboundRequest {
+                method: Method::POST,
+                url: self.endpoint.clone(),
+                headers,
+                body: serde_json::to_vec(&message)?,
+            })
+            .await?;
+        self.accept_streaming_response(
+            response,
+            generation,
+            accept_new_session,
+            session_id.as_deref(),
+            protocol_version.as_ref(),
+            awaited_id.as_ref(),
+        )
+        .await
+    }
+
+    async fn accept_streaming_response(
+        &self,
+        mut response: OutboundStreamResponse,
+        generation: u64,
+        accept_new_session: bool,
+        session_id: Option<&str>,
+        protocol_version: Option<&ProtocolVersion>,
+        awaited_id: Option<&Value>,
+    ) -> Result<Vec<Value>, StreamableHttpError> {
+        if self.lock_state().generation != generation {
+            return Err(StreamableHttpError::SessionInvalidated);
+        }
+        if response.status == StatusCode::NOT_FOUND && session_id.is_some() {
+            self.reset_state_if_generation(generation).await;
+            return Err(StreamableHttpError::SessionExpired);
+        }
+        if !response.status.is_success() {
+            return Err(StreamableHttpError::HttpStatus(response.status));
+        }
+        if let Err(error) = self
+            .accept_response_session(&response.headers, generation, accept_new_session)
+            .await
+        {
+            if matches!(
+                error,
+                StreamableHttpError::InvalidSessionId | StreamableHttpError::SessionChanged
+            ) {
+                self.terminate_state_session_if_generation(generation).await;
+            }
+            return Err(error);
+        }
+        if response.declared_response_too_large() {
+            return Err(OutboundError::ResponseBodyTooLarge.into());
+        }
+        let active_session_id = {
+            let state = self.lock_state();
+            if state.generation != generation {
+                return Err(StreamableHttpError::SessionInvalidated);
+            }
+            state.session_id.clone()
+        };
+        if awaited_id.is_none() {
+            if response.status == StatusCode::ACCEPTED && response.next_chunk().await?.is_none() {
+                self.ensure_generation(generation).await?;
+                return Ok(Vec::new());
+            }
+            return Err(StreamableHttpError::InvalidResponse);
+        }
+        if response.status == StatusCode::ACCEPTED || response.status == StatusCode::NO_CONTENT {
+            return Err(StreamableHttpError::InvalidResponse);
+        }
+
+        match response_content_type(&response.headers)? {
+            ResponseContentType::Json => {
+                let body = collect_stream_body(&mut response).await?;
+                if body.is_empty() {
+                    return Err(StreamableHttpError::InvalidResponse);
+                }
+                self.ensure_generation(generation).await?;
+                let messages = flatten_json_messages(serde_json::from_slice(&body)?)?;
+                self.handle_server_requests(&messages, generation).await?;
+                Ok(messages)
+            }
+            ResponseContentType::Sse => {
+                self.read_sse_with_resume(
+                    response,
+                    generation,
+                    active_session_id.as_deref(),
+                    protocol_version,
+                    awaited_id,
+                )
+                .await
+            }
+        }
+    }
+
+    async fn read_sse_with_resume(
+        &self,
+        mut response: OutboundStreamResponse,
+        generation: u64,
+        session_id: Option<&str>,
+        protocol_version: Option<&ProtocolVersion>,
+        awaited_id: Option<&Value>,
+    ) -> Result<Vec<Value>, StreamableHttpError> {
+        let mut decoder = SseDecoder::default();
+        let mut messages = Vec::new();
+        let mut reconnects = 0_usize;
+        let mut total_bytes = 0_usize;
+        loop {
+            self.ensure_generation(generation).await?;
+            loop {
+                match response.next_chunk().await {
+                    Ok(Some(chunk)) => {
+                        total_bytes = total_bytes.checked_add(chunk.len()).ok_or(
+                            StreamableHttpError::Outbound(OutboundError::ResponseBodyTooLarge),
+                        )?;
+                        if total_bytes > MAX_LOGICAL_STREAM_BYTES {
+                            return Err(OutboundError::ResponseBodyTooLarge.into());
+                        }
+                        for event in decoder.push(&chunk)? {
+                            if let Some(message) = event.message {
+                                let is_response =
+                                    self.handle_server_message(&message, generation).await?;
+                                let complete = is_response && message.get("id") == awaited_id;
+                                if is_response {
+                                    messages.push(message);
+                                }
+                                if complete {
+                                    self.ensure_generation(generation).await?;
+                                    return Ok(messages);
+                                }
+                            }
+                        }
+                    }
+                    Ok(None) => break,
+                    Err(error)
+                        if resumable_stream_error(&error) && decoder.last_event_id().is_some() =>
+                    {
+                        decoder.reset_stream();
+                        break;
+                    }
+                    Err(error) => return Err(error.into()),
+                }
+            }
+            for event in decoder.finish()? {
+                if let Some(message) = event.message {
+                    let is_response = self.handle_server_message(&message, generation).await?;
+                    let complete = is_response && message.get("id") == awaited_id;
+                    if is_response {
+                        messages.push(message);
+                    }
+                    if complete {
+                        self.ensure_generation(generation).await?;
+                        return Ok(messages);
+                    }
+                }
+            }
+            if awaited_id.is_none() && !messages.is_empty() {
+                return Ok(messages);
+            }
+            let last_event_id = decoder
+                .last_event_id()
+                .ok_or(StreamableHttpError::InvalidResponse)?
+                .to_owned();
+            let retry_delay = decoder.retry_delay();
+            response = loop {
+                if reconnects >= MAX_SSE_RECONNECTS {
+                    return Err(StreamableHttpError::InvalidResponse);
+                }
+                reconnects += 1;
+                if !retry_delay.is_zero() {
+                    tokio::time::sleep(retry_delay).await;
+                }
+                self.ensure_generation(generation).await?;
+                match self
+                    .resume_stream(session_id, protocol_version, &last_event_id)
+                    .await
+                {
+                    Ok(response) if response.status == StatusCode::NOT_FOUND => {
+                        self.reset_state_if_generation(generation).await;
+                        return Err(StreamableHttpError::SessionExpired);
+                    }
+                    Ok(response) if response.status.is_server_error() => continue,
+                    Ok(response) if response.status != StatusCode::OK => {
+                        return Err(StreamableHttpError::HttpStatus(response.status));
+                    }
+                    Ok(response) => break response,
+                    Err(StreamableHttpError::Outbound(error)) if resumable_stream_error(&error) => {
+                        continue;
+                    }
+                    Err(error) => return Err(error),
+                }
+            };
+            self.ensure_generation(generation).await?;
+            self.accept_response_session_or_reset(&response.headers, generation, false)
+                .await?;
+            if response.declared_response_too_large() {
+                return Err(OutboundError::ResponseBodyTooLarge.into());
+            }
+            if response_content_type(&response.headers)? != ResponseContentType::Sse {
+                return Err(StreamableHttpError::UnsupportedContentType);
+            }
+            decoder.reset_stream();
+        }
+    }
+
+    async fn resume_stream(
+        &self,
+        session_id: Option<&str>,
+        protocol_version: Option<&ProtocolVersion>,
+        last_event_id: &str,
+    ) -> Result<OutboundStreamResponse, StreamableHttpError> {
+        self.open_notification_stream(
+            session_id,
+            protocol_version.unwrap_or(&self.requested_protocol_version),
+            Some(last_event_id),
+            false,
+        )
+        .await
+    }
+
+    async fn open_notification_stream(
+        &self,
+        session_id: Option<&str>,
+        protocol_version: &ProtocolVersion,
+        last_event_id: Option<&str>,
+        long_lived: bool,
+    ) -> Result<OutboundStreamResponse, StreamableHttpError> {
+        validate_transport_endpoint(&self.endpoint)?;
+        let mut headers = self.headers.clone();
+        headers.insert(ACCEPT, HeaderValue::from_static("text/event-stream"));
+        if let Some(session_id) = session_id {
+            headers.insert(
+                MCP_SESSION_ID,
+                HeaderValue::from_str(session_id)
+                    .map_err(|_| StreamableHttpError::InvalidSessionId)?,
+            );
+        }
+        if let Some(last_event_id) = last_event_id {
+            headers.insert(
+                LAST_EVENT_ID,
+                HeaderValue::from_str(last_event_id)
+                    .map_err(|_| StreamableHttpError::InvalidResponse)?,
+            );
+        }
+        headers.insert(
+            MCP_PROTOCOL_VERSION,
+            HeaderValue::from_str(protocol_version.as_str())
+                .map_err(|_| StreamableHttpError::InvalidProtocolVersion)?,
+        );
+        let request = OutboundRequest {
+            method: Method::GET,
+            url: self.endpoint.clone(),
+            headers,
+            body: Vec::new(),
+        };
+        if long_lived {
+            self.client
+                .execute_long_lived_streaming(request, NOTIFICATION_IDLE_TIMEOUT)
+                .await
+                .map_err(Into::into)
+        } else {
+            self.client
+                .execute_streaming_headers_first(request)
+                .await
+                .map_err(Into::into)
+        }
+    }
+
+    async fn handle_server_requests(
+        &self,
+        messages: &[Value],
+        generation: u64,
+    ) -> Result<(), StreamableHttpError> {
+        for message in messages {
+            self.handle_server_message(message, generation).await?;
+        }
+        Ok(())
+    }
+
+    async fn handle_server_message(
+        &self,
+        message: &Value,
+        generation: u64,
+    ) -> Result<bool, StreamableHttpError> {
+        let request = match classify_incoming_message(message)? {
+            IncomingMessage::Response => return Ok(true),
+            IncomingMessage::Notification { method } => {
+                if method == "notifications/tools/list_changed" {
+                    let _ = self.tool_list_changed.send(());
+                }
+                return Ok(false);
+            }
+            IncomingMessage::Request(request) => request,
+        };
+        let response = if request.method == "ping" {
+            json!({ "jsonrpc": "2.0", "id": request.id, "result": {} })
+        } else {
+            json!({
+                "jsonrpc": "2.0",
+                "id": request.id,
+                "error": { "code": -32601, "message": "Method not found" }
+            })
+        };
+        self.post_auxiliary_response(response, generation).await?;
+        Ok(false)
+    }
+
+    async fn post_auxiliary_response(
+        &self,
+        response: Value,
+        generation: u64,
+    ) -> Result<(), StreamableHttpError> {
+        validate_transport_endpoint(&self.endpoint)?;
+        validate_outgoing_message(&response)?;
+        let (session_id, protocol_version) = {
+            let state = self.lock_state();
+            if state.generation != generation {
+                return Err(StreamableHttpError::SessionInvalidated);
+            }
+            (
+                state.session_id.clone(),
+                state
+                    .negotiated_protocol_version
+                    .clone()
+                    .unwrap_or_else(|| self.requested_protocol_version.clone()),
+            )
+        };
+        let mut headers = self.headers.clone();
+        headers.insert(
+            ACCEPT,
+            HeaderValue::from_static("application/json, text/event-stream"),
+        );
+        headers.insert(CONTENT_TYPE, HeaderValue::from_static("application/json"));
+        if let Some(session_id) = session_id.as_deref() {
+            headers.insert(
+                MCP_SESSION_ID,
+                HeaderValue::from_str(session_id)
+                    .map_err(|_| StreamableHttpError::InvalidSessionId)?,
+            );
+        }
+        headers.insert(
+            MCP_PROTOCOL_VERSION,
+            HeaderValue::from_str(protocol_version.as_str())
+                .map_err(|_| StreamableHttpError::InvalidProtocolVersion)?,
+        );
+        let auxiliary = self
+            .client
+            .execute_streaming_headers_first(OutboundRequest {
+                method: Method::POST,
+                url: self.endpoint.clone(),
+                headers,
+                body: serde_json::to_vec(&response)?,
+            })
+            .await?;
+        self.ensure_generation(generation).await?;
+        if auxiliary.status == StatusCode::NOT_FOUND && session_id.is_some() {
+            self.reset_state_if_generation(generation).await;
+            return Err(StreamableHttpError::SessionExpired);
+        }
+        self.accept_response_session_or_reset(&auxiliary.headers, generation, false)
+            .await?;
+        if auxiliary.declared_response_too_large() {
+            return Err(OutboundError::ResponseBodyTooLarge.into());
+        }
+        if auxiliary.status != StatusCode::ACCEPTED {
+            return Err(StreamableHttpError::InvalidResponse);
+        }
+        let mut auxiliary = auxiliary;
+        if auxiliary.next_chunk().await?.is_some() {
+            return Err(StreamableHttpError::InvalidResponse);
+        }
+        Ok(())
+    }
+
+    async fn accept_response_session(
+        &self,
+        headers: &HeaderMap,
+        generation: u64,
+        accept_new_session: bool,
+    ) -> Result<(), StreamableHttpError> {
+        let mut session_values = headers.get_all(&MCP_SESSION_ID).iter();
+        let Some(session_id) = session_values.next() else {
+            return Ok(());
+        };
+        if session_values.next().is_some() {
+            return Err(StreamableHttpError::InvalidSessionId);
+        }
+        let session_id = session_id
+            .to_str()
+            .map_err(|_| StreamableHttpError::InvalidSessionId)?;
+        validate_session_id(session_id)?;
+        let mut state = self.lock_state();
+        if state.generation != generation {
+            return Err(StreamableHttpError::SessionInvalidated);
+        }
+        match state.session_id.as_deref() {
+            Some(current) if current != session_id => Err(StreamableHttpError::SessionChanged),
+            Some(_) => Ok(()),
+            None if accept_new_session => {
+                state.session_id = Some(session_id.to_owned());
+                Ok(())
+            }
+            None => Err(StreamableHttpError::InvalidSessionId),
+        }
+    }
+
+    async fn accept_response_session_or_reset(
+        &self,
+        headers: &HeaderMap,
+        generation: u64,
+        accept_new_session: bool,
+    ) -> Result<(), StreamableHttpError> {
+        match self
+            .accept_response_session(headers, generation, accept_new_session)
+            .await
+        {
+            Ok(()) => Ok(()),
+            Err(error)
+                if matches!(
+                    error,
+                    StreamableHttpError::InvalidSessionId | StreamableHttpError::SessionChanged
+                ) =>
+            {
+                self.terminate_state_session_if_generation(generation).await;
+                Err(error)
+            }
+            Err(error) => Err(error),
+        }
+    }
+
+    fn lock_state(&self) -> MutexGuard<'_, TransportState> {
+        self.state
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+    }
+
+    async fn ensure_generation(&self, generation: u64) -> Result<(), StreamableHttpError> {
+        if self.lock_state().generation == generation {
+            Ok(())
+        } else {
+            Err(StreamableHttpError::SessionInvalidated)
+        }
+    }
+
+    #[cfg(test)]
+    async fn reset_state(&self) {
+        let mut state = self.lock_state();
+        state.generation = state.generation.wrapping_add(1);
+        state.session_id = None;
+        state.negotiated_protocol_version = None;
+        state.initialized = false;
+    }
+
+    async fn reset_state_if_generation(&self, generation: u64) {
+        let mut state = self.lock_state();
+        if state.generation == generation {
+            state.generation = state.generation.wrapping_add(1);
+            state.session_id = None;
+            state.negotiated_protocol_version = None;
+            state.initialized = false;
+        }
+    }
+
+    async fn terminate_state_session_if_generation(&self, generation: u64) {
+        let cleanup = {
+            let mut state = self.lock_state();
+            if state.generation != generation {
+                return;
+            }
+            state.generation = state.generation.wrapping_add(1);
+            let session_id = state.session_id.take();
+            let protocol_version = state
+                .negotiated_protocol_version
+                .take()
+                .unwrap_or_else(|| self.requested_protocol_version.clone());
+            state.initialized = false;
+            session_id.map(|session_id| {
+                (
+                    session_id,
+                    protocol_version,
+                    self.session_terminations.start(),
+                )
+            })
+        };
+        if let Some((session_id, protocol_version, permit)) = cleanup {
+            let _ = spawn_session_termination(
+                self.client.clone(),
+                self.endpoint.clone(),
+                self.headers.clone(),
+                session_id,
+                protocol_version,
+                permit,
+            );
+        }
+    }
+}
+
+fn spawn_session_termination(
+    client: HardenedHttpClient,
+    endpoint: Url,
+    mut headers: HeaderMap,
+    session_id: String,
+    protocol_version: ProtocolVersion,
+    permit: SessionTerminationPermit,
+) -> Result<oneshot::Receiver<Result<StatusCode, StreamableHttpError>>, StreamableHttpError> {
+    validate_transport_endpoint(&endpoint)?;
+    let session_id =
+        HeaderValue::from_str(&session_id).map_err(|_| StreamableHttpError::InvalidSessionId)?;
+    let protocol_version = HeaderValue::from_str(protocol_version.as_str())
+        .map_err(|_| StreamableHttpError::InvalidProtocolVersion)?;
+    headers.insert(MCP_SESSION_ID, session_id);
+    headers.insert(MCP_PROTOCOL_VERSION, protocol_version);
+    let runtime =
+        tokio::runtime::Handle::try_current().map_err(|_| StreamableHttpError::InvalidResponse)?;
+    let (result_tx, result_rx) = oneshot::channel();
+    let cleanup = async move {
+        let _permit = permit;
+        let result = tokio::time::timeout(
+            SESSION_TERMINATION_TIMEOUT,
+            client.execute(OutboundRequest {
+                method: Method::DELETE,
+                url: endpoint,
+                headers,
+                body: Vec::new(),
+            }),
+        )
+        .await
+        .map_err(|_| StreamableHttpError::Outbound(OutboundError::Timeout))
+        .and_then(|response| response.map(|response| response.status).map_err(Into::into));
+        let _ = result_tx.send(result);
+    };
+    drop(runtime.spawn(cleanup));
+    Ok(result_rx)
+}
+
+fn validate_transport_endpoint(endpoint: &Url) -> Result<(), StreamableHttpError> {
+    if endpoint.scheme() == "https"
+        || (endpoint.scheme() == "http" && is_loopback_endpoint(endpoint))
+    {
+        Ok(())
+    } else {
+        Err(StreamableHttpError::InsecureEndpoint)
+    }
+}
+
+fn is_loopback_endpoint(endpoint: &Url) -> bool {
+    match endpoint.host() {
+        Some(Host::Ipv4(address)) => address.is_loopback(),
+        Some(Host::Ipv6(address)) => address.is_loopback(),
+        Some(Host::Domain(domain)) => {
+            let domain = domain.strip_suffix('.').unwrap_or(domain);
+            domain.eq_ignore_ascii_case("localhost")
+                || domain
+                    .to_ascii_lowercase()
+                    .strip_suffix(".localhost")
+                    .is_some_and(|prefix| !prefix.is_empty())
+        }
+        None => false,
+    }
+}
+
+fn validate_custom_headers(headers: &HeaderMap) -> Result<(), StreamableHttpError> {
+    if headers.contains_key(ACCEPT)
+        || headers.contains_key(CONTENT_TYPE)
+        || headers.contains_key(&MCP_SESSION_ID)
+        || headers.contains_key(&MCP_PROTOCOL_VERSION)
+        || headers.contains_key(&LAST_EVENT_ID)
+    {
+        Err(StreamableHttpError::ReservedHeader)
+    } else {
+        Ok(())
+    }
+}
+
+fn validate_session_id(value: &str) -> Result<(), StreamableHttpError> {
+    if value.is_empty()
+        || value.len() > MAX_SESSION_ID_BYTES
+        || !value.bytes().all(|byte| byte.is_ascii_graphic())
+    {
+        Err(StreamableHttpError::InvalidSessionId)
+    } else {
+        Ok(())
+    }
+}
+
+fn resumable_stream_error(error: &OutboundError) -> bool {
+    matches!(
+        error,
+        OutboundError::Timeout | OutboundError::Connection | OutboundError::Request
+    )
+}
+
+fn validate_id(id: &Value) -> Result<(), StreamableHttpError> {
+    if id.is_string()
+        || id
+            .as_number()
+            .is_some_and(|number| number.as_i64().is_some() || number.as_u64().is_some())
+    {
+        Ok(())
+    } else {
+        Err(StreamableHttpError::InvalidRequest)
+    }
+}
+
+fn validate_call_tool_result(result: &Value) -> Result<(), StreamableHttpError> {
+    if result
+        .get("structuredContent")
+        .is_some_and(|structured_content| !structured_content.is_object())
+    {
+        return Err(StreamableHttpError::InvalidResponse);
+    }
+    serde_json::from_value::<CallToolResult>(result.clone())
+        .map_err(|_| StreamableHttpError::InvalidResponse)?;
+    Ok(())
+}
+
+fn validate_outgoing_message(message: &Value) -> Result<(), StreamableHttpError> {
+    let messages = match message {
+        Value::Object(_) => std::slice::from_ref(message),
+        _ => return Err(StreamableHttpError::InvalidRequest),
+    };
+    for message in messages {
+        let message = message
+            .as_object()
+            .ok_or(StreamableHttpError::InvalidRequest)?;
+        if message.get("jsonrpc").and_then(Value::as_str) != Some("2.0") {
+            return Err(StreamableHttpError::InvalidRequest);
+        }
+        let has_method = message.get("method").and_then(Value::as_str).is_some();
+        let has_result = message.contains_key("result");
+        let has_error = message.contains_key("error");
+        if has_method && (has_result || has_error) {
+            return Err(StreamableHttpError::InvalidRequest);
+        }
+        if has_method {
+            if let Some(id) = message.get("id") {
+                validate_id(id)?;
+            }
+        } else {
+            let id = message
+                .get("id")
+                .ok_or(StreamableHttpError::InvalidRequest)?;
+            validate_id(id)?;
+            if has_result == has_error {
+                return Err(StreamableHttpError::InvalidRequest);
+            }
+        }
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+fn parse_response_messages(response: &OutboundResponse) -> Result<Vec<Value>, StreamableHttpError> {
+    match response_content_type(&response.headers)? {
+        ResponseContentType::Json => flatten_json_messages(serde_json::from_slice(&response.body)?),
+        ResponseContentType::Sse => parse_sse(&response.body),
+    }
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+enum ResponseContentType {
+    Json,
+    Sse,
+}
+
+fn response_content_type(headers: &HeaderMap) -> Result<ResponseContentType, StreamableHttpError> {
+    let mut content_types = headers.get_all(CONTENT_TYPE).iter();
+    let content_type = content_types
+        .next()
+        .and_then(|value| value.to_str().ok())
+        .and_then(|value| value.split(';').next())
+        .map(str::trim)
+        .ok_or(StreamableHttpError::UnsupportedContentType)?;
+    if content_types.next().is_some() {
+        return Err(StreamableHttpError::UnsupportedContentType);
+    }
+    if content_type.eq_ignore_ascii_case("application/json") {
+        Ok(ResponseContentType::Json)
+    } else if content_type.eq_ignore_ascii_case("text/event-stream") {
+        Ok(ResponseContentType::Sse)
+    } else {
+        Err(StreamableHttpError::UnsupportedContentType)
+    }
+}
+
+async fn collect_stream_body(
+    response: &mut OutboundStreamResponse,
+) -> Result<Vec<u8>, StreamableHttpError> {
+    let mut body = Vec::new();
+    while let Some(chunk) = response.next_chunk().await? {
+        body.extend_from_slice(&chunk);
+    }
+    Ok(body)
+}
+
+fn flatten_json_messages(value: Value) -> Result<Vec<Value>, StreamableHttpError> {
+    match value {
+        Value::Object(_) => Ok(vec![value]),
+        _ => Err(StreamableHttpError::InvalidResponse),
+    }
+}
+
+#[cfg(test)]
+fn parse_sse(body: &[u8]) -> Result<Vec<Value>, StreamableHttpError> {
+    let mut decoder = SseDecoder::default();
+    let mut messages = Vec::new();
+    for event in decoder.push(body)?.into_iter().chain(decoder.finish()?) {
+        if let Some(message) = event.message {
+            messages.push(message);
+        }
+    }
+    if messages.is_empty() {
+        Err(StreamableHttpError::InvalidResponse)
+    } else {
+        Ok(messages)
+    }
+}
+
+struct SseEvent {
+    message: Option<Value>,
+}
+
+struct SseDecoder {
+    pending: Vec<u8>,
+    scan_offset: usize,
+    data: String,
+    has_data: bool,
+    event_id: Option<String>,
+    last_event_id: Option<String>,
+    event_count: usize,
+    retry_delay: Duration,
+    event_bytes: usize,
+    stream_start: bool,
+}
+
+impl Default for SseDecoder {
+    fn default() -> Self {
+        Self {
+            pending: Vec::new(),
+            scan_offset: 0,
+            data: String::new(),
+            has_data: false,
+            event_id: None,
+            last_event_id: None,
+            event_count: 0,
+            retry_delay: Duration::from_millis(250),
+            event_bytes: 0,
+            stream_start: true,
+        }
+    }
+}
+
+impl SseDecoder {
+    fn push(&mut self, chunk: &[u8]) -> Result<Vec<SseEvent>, StreamableHttpError> {
+        self.pending.extend_from_slice(chunk);
+        let mut consumed = 0_usize;
+        let mut events = Vec::new();
+        let mut cursor = self.scan_offset.min(self.pending.len());
+        while cursor < self.pending.len() {
+            let delimiter = match self.pending[cursor] {
+                b'\n' => Some((cursor, 1)),
+                b'\r' if cursor + 1 < self.pending.len() => Some((
+                    cursor,
+                    if self.pending[cursor + 1] == b'\n' {
+                        2
+                    } else {
+                        1
+                    },
+                )),
+                b'\r' => None,
+                _ => {
+                    cursor += 1;
+                    continue;
+                }
+            };
+            let Some((end, delimiter_bytes)) = delimiter else {
+                break;
+            };
+            let line = self.pending[consumed..end].to_vec();
+            consumed = end + delimiter_bytes;
+            cursor = consumed;
+            if let Some(event) = self.line(&line)? {
+                events.push(event);
+            }
+        }
+        self.pending.drain(..consumed);
+        self.scan_offset = self.pending.len();
+        if self.pending.last() == Some(&b'\r') {
+            self.scan_offset = self.scan_offset.saturating_sub(1);
+        }
+        if self.pending.len() > MAX_LOGICAL_STREAM_BYTES {
+            return Err(StreamableHttpError::InvalidResponse);
+        }
+        Ok(events)
+    }
+
+    fn finish(&mut self) -> Result<Vec<SseEvent>, StreamableHttpError> {
+        let mut events = Vec::new();
+        if self.pending.last() == Some(&b'\r') {
+            let mut line = std::mem::take(&mut self.pending);
+            line.pop();
+            if let Some(event) = self.line(&line)? {
+                events.push(event);
+            }
+        }
+        self.pending.clear();
+        self.scan_offset = 0;
+        self.data.clear();
+        self.has_data = false;
+        self.event_id = None;
+        self.event_bytes = 0;
+        Ok(events)
+    }
+
+    fn line(&mut self, line: &[u8]) -> Result<Option<SseEvent>, StreamableHttpError> {
+        let line = if self.stream_start {
+            self.stream_start = false;
+            line.strip_prefix(&[0xef, 0xbb, 0xbf]).unwrap_or(line)
+        } else {
+            line
+        };
+        self.event_bytes = self
+            .event_bytes
+            .checked_add(line.len())
+            .ok_or(StreamableHttpError::InvalidResponse)?;
+        if self.event_bytes > MAX_LOGICAL_STREAM_BYTES {
+            return Err(StreamableHttpError::InvalidResponse);
+        }
+        let line = std::str::from_utf8(line).map_err(|_| StreamableHttpError::InvalidUtf8)?;
+        if line.is_empty() {
+            return self.dispatch();
+        }
+        if line.starts_with(':') {
+            return Ok(None);
+        }
+        let (field, value) = line.split_once(':').unwrap_or((line, ""));
+        let value = value.strip_prefix(' ').unwrap_or(value);
+        match field {
+            "data" => {
+                if self.has_data {
+                    self.data.push('\n');
+                }
+                self.data.push_str(value);
+                self.has_data = true;
+                if self.data.len() > MAX_LOGICAL_STREAM_BYTES {
+                    return Err(StreamableHttpError::InvalidResponse);
+                }
+            }
+            "id" if !value.contains('\0') => {
+                if value.len() > MAX_SESSION_ID_BYTES {
+                    return Err(StreamableHttpError::InvalidResponse);
+                }
+                self.event_id = Some(value.to_owned());
+            }
+            "retry" => {
+                if let Ok(milliseconds) = value.parse::<u64>() {
+                    self.retry_delay = Duration::from_millis(milliseconds.clamp(50, 10_000));
+                }
+            }
+            _ => {}
+        }
+        Ok(None)
+    }
+
+    fn dispatch(&mut self) -> Result<Option<SseEvent>, StreamableHttpError> {
+        self.event_bytes = 0;
+        if !self.has_data && self.event_id.is_none() {
+            return Ok(None);
+        }
+        self.event_count = self
+            .event_count
+            .checked_add(1)
+            .ok_or(StreamableHttpError::InvalidResponse)?;
+        if self.event_count > MAX_SSE_EVENTS {
+            return Err(StreamableHttpError::InvalidResponse);
+        }
+        if let Some(event_id) = self.event_id.take() {
+            if event_id.is_empty() {
+                self.last_event_id = None;
+            } else {
+                self.last_event_id = Some(event_id);
+            }
+        }
+        let data = std::mem::take(&mut self.data);
+        self.has_data = false;
+        let message: Option<Value> = if data.is_empty() {
+            None
+        } else {
+            Some(serde_json::from_str(&data)?)
+        };
+        if message.as_ref().is_some_and(|message| !message.is_object()) {
+            return Err(StreamableHttpError::InvalidResponse);
+        }
+        Ok(Some(SseEvent { message }))
+    }
+
+    fn last_event_id(&self) -> Option<&str> {
+        self.last_event_id.as_deref()
+    }
+
+    fn reset_stream(&mut self) {
+        self.pending.clear();
+        self.scan_offset = 0;
+        self.data.clear();
+        self.has_data = false;
+        self.event_id = None;
+        self.event_bytes = 0;
+        self.stream_start = true;
+    }
+
+    fn retry_delay(&self) -> Duration {
+        self.retry_delay
+    }
+
+    fn reset_connection_limits(&mut self) {
+        self.reset_stream();
+        self.event_count = 0;
+    }
+}
+
+struct ServerRequest {
+    id: Value,
+    method: String,
+}
+
+enum IncomingMessage {
+    Response,
+    Request(ServerRequest),
+    Notification { method: String },
+}
+
+fn classify_incoming_message(message: &Value) -> Result<IncomingMessage, StreamableHttpError> {
+    let message = message
+        .as_object()
+        .ok_or(StreamableHttpError::InvalidResponse)?;
+    if message.get("jsonrpc").and_then(Value::as_str) != Some("2.0") {
+        return Err(StreamableHttpError::InvalidResponse);
+    }
+    let method = message.get("method").and_then(Value::as_str);
+    let has_result = message.contains_key("result");
+    let has_error = message.contains_key("error");
+    if let Some(method) = method {
+        if has_result || has_error {
+            return Err(StreamableHttpError::InvalidResponse);
+        }
+        return match message.get("id") {
+            Some(id) => {
+                validate_id(id).map_err(|_| StreamableHttpError::InvalidResponse)?;
+                Ok(IncomingMessage::Request(ServerRequest {
+                    id: id.clone(),
+                    method: method.to_owned(),
+                }))
+            }
+            None => Ok(IncomingMessage::Notification {
+                method: method.to_owned(),
+            }),
+        };
+    }
+    let id = message
+        .get("id")
+        .ok_or(StreamableHttpError::InvalidResponse)?;
+    validate_id(id).map_err(|_| StreamableHttpError::InvalidResponse)?;
+    if has_result == has_error {
+        return Err(StreamableHttpError::InvalidResponse);
+    }
+    Ok(IncomingMessage::Response)
+}
+
+fn response_result(messages: Vec<Value>, id: &Value) -> Result<Value, StreamableHttpError> {
+    let response = messages
+        .into_iter()
+        .find(|message| message.get("id") == Some(id))
+        .ok_or(StreamableHttpError::InvalidResponse)?;
+    let response = response
+        .as_object()
+        .ok_or(StreamableHttpError::InvalidResponse)?;
+    if response.get("jsonrpc").and_then(Value::as_str) != Some("2.0") {
+        return Err(StreamableHttpError::InvalidResponse);
+    }
+    if let Some(error) = response.get("error") {
+        let error = error
+            .as_object()
+            .ok_or(StreamableHttpError::InvalidResponse)?;
+        return Err(StreamableHttpError::JsonRpc {
+            code: error
+                .get("code")
+                .and_then(Value::as_i64)
+                .ok_or(StreamableHttpError::InvalidResponse)?,
+            message: error
+                .get("message")
+                .and_then(Value::as_str)
+                .ok_or(StreamableHttpError::InvalidResponse)?
+                .to_owned(),
+            data: error.get("data").cloned(),
+        });
+    }
+    response
+        .get("result")
+        .cloned()
+        .ok_or(StreamableHttpError::InvalidResponse)
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/src/mcp/upstream/http/tests.rs b/src/mcp/upstream/http/tests.rs
new file mode 100644
index 000000000..b6ebdf70f
--- /dev/null
+++ b/src/mcp/upstream/http/tests.rs
@@ -0,0 +1,1980 @@
+use std::{collections::VecDeque, sync::Arc};
+
+use serde_json::{Value, json};
+use tokio::{
+    io::{AsyncReadExt, AsyncWriteExt},
+    net::TcpListener,
+    sync::Mutex,
+};
+
+use super::{
+    StreamableHttpConfig, StreamableHttpError, StreamableHttpTransport, parse_response_messages,
+};
+use crate::outbound::OutboundResponse;
+
+struct TestServer {
+    endpoint: String,
+    requests: Arc<Mutex<Vec<String>>>,
+    task: tokio::task::JoinHandle<()>,
+}
+
+impl TestServer {
+    async fn start(responses: Vec<String>) -> Self {
+        let listener = TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("test listener binds");
+        let endpoint = format!(
+            "http://{}/mcp",
+            listener.local_addr().expect("listener has an address")
+        );
+        let requests = Arc::new(Mutex::new(Vec::new()));
+        let captured = requests.clone();
+        let responses = Arc::new(Mutex::new(VecDeque::from(responses)));
+        let task = tokio::spawn(async move {
+            loop {
+                let Some(response) = responses.lock().await.pop_front() else {
+                    break;
+                };
+                let (mut stream, _) = listener.accept().await.expect("request is accepted");
+                let mut bytes = vec![0_u8; 64 * 1024];
+                let read = stream.read(&mut bytes).await.expect("request is read");
+                captured
+                    .lock()
+                    .await
+                    .push(String::from_utf8_lossy(&bytes[..read]).into_owned());
+                stream
+                    .write_all(response.as_bytes())
+                    .await
+                    .expect("response is written");
+            }
+        });
+        Self {
+            endpoint,
+            requests,
+            task,
+        }
+    }
+
+    async fn finish(self) -> Vec<String> {
+        self.task.await.expect("test server completes");
+        Arc::try_unwrap(self.requests)
+            .expect("request capture has one owner")
+            .into_inner()
+    }
+}
+
+fn response(status: &str, headers: &[(&str, &str)], body: &str) -> String {
+    let mut response = format!("HTTP/1.1 {status}\r\n");
+    for (name, value) in headers {
+        response.push_str(name);
+        response.push_str(": ");
+        response.push_str(value);
+        response.push_str("\r\n");
+    }
+    response.push_str(&format!(
+        "Content-Length: {}\r\nConnection: close\r\n\r\n{body}",
+        body.len()
+    ));
+    response
+}
+
+fn make_transport(endpoint: String) -> StreamableHttpTransport {
+    let mut config = StreamableHttpConfig::new(endpoint);
+    config.allow_private_networks = true;
+    StreamableHttpTransport::new(config).expect("test transport is valid")
+}
+
+#[tokio::test]
+async fn initialization_pins_session_and_protocol_for_followup_requests() {
+    let initialize = json!({
+        "jsonrpc": "2.0",
+        "id": 0,
+        "result": {
+            "protocolVersion": "2025-11-25",
+            "capabilities": {},
+            "serverInfo": { "name": "test", "version": "1" }
+        }
+    })
+    .to_string();
+    let tools = json!({
+        "jsonrpc": "2.0",
+        "id": 1,
+        "result": { "tools": [{ "name": "ping", "inputSchema": { "type": "object" } }] }
+    })
+    .to_string();
+    let server = TestServer::start(vec![
+        response(
+            "200 OK",
+            &[
+                ("Content-Type", "application/json"),
+                ("Mcp-Session-Id", "session-1"),
+            ],
+            &initialize,
+        ),
+        response("202 Accepted", &[], ""),
+        response("200 OK", &[("Content-Type", "application/json")], &tools),
+    ])
+    .await;
+    let transport = make_transport(server.endpoint.clone());
+
+    transport
+        .initialize()
+        .await
+        .expect("initialization succeeds");
+    let page = transport
+        .list_tools(None, json!(1))
+        .await
+        .expect("tools list succeeds");
+    assert_eq!(page.tools[0]["name"], "ping");
+    assert_eq!(transport.session_id().await.as_deref(), Some("session-1"));
+
+    let requests = server.finish().await;
+    assert!(
+        !requests[0]
+            .to_ascii_lowercase()
+            .contains("mcp-protocol-version:")
+    );
+    for request in &requests[1..] {
+        let request = request.to_ascii_lowercase();
+        assert!(request.contains("mcp-session-id: session-1"));
+        assert!(request.contains("mcp-protocol-version: 2025-11-25"));
+        assert!(request.contains("accept: application/json, text/event-stream"));
+        assert!(!request.contains("last-event-id:"));
+    }
+}
+
+#[tokio::test]
+async fn initialization_negotiates_legacy_and_pins_followup_headers() {
+    let initialize = json!({
+        "jsonrpc": "2.0",
+        "id": 0,
+        "result": {
+            "protocolVersion": "2025-06-18",
+            "capabilities": {},
+            "serverInfo": { "name": "legacy", "version": "1" }
+        }
+    })
+    .to_string();
+    let tools = json!({
+        "jsonrpc": "2.0",
+        "id": 1,
+        "result": { "tools": [] }
+    })
+    .to_string();
+    let server = TestServer::start(vec![
+        response(
+            "200 OK",
+            &[
+                ("Content-Type", "application/json"),
+                ("Mcp-Session-Id", "legacy-session"),
+            ],
+            &initialize,
+        ),
+        response("202 Accepted", &[], ""),
+        response("200 OK", &[("Content-Type", "application/json")], &tools),
+        response("204 No Content", &[], ""),
+    ])
+    .await;
+    let transport = make_transport(server.endpoint.clone());
+
+    transport
+        .initialize()
+        .await
+        .expect("legacy protocol negotiation succeeds");
+    transport
+        .list_tools(None, json!(1))
+        .await
+        .expect("legacy tools list succeeds");
+    transport
+        .terminate()
+        .await
+        .expect("legacy session termination succeeds");
+
+    let requests = server.finish().await;
+    assert!(requests[0].contains("\"protocolVersion\":\"2025-11-25\""));
+    assert!(
+        !requests[0]
+            .to_ascii_lowercase()
+            .contains("mcp-protocol-version:")
+    );
+    for request in &requests[1..] {
+        let request = request.to_ascii_lowercase();
+        assert!(request.contains("mcp-session-id: legacy-session"));
+        assert!(request.contains("mcp-protocol-version: 2025-06-18"));
+    }
+}
+
+#[tokio::test]
+async fn call_tool_accepts_sse_and_rejects_server_requests() {
+    let initialize = json!({
+        "jsonrpc": "2.0",
+        "id": 0,
+        "result": { "protocolVersion": "2025-11-25", "capabilities": {} }
+    })
+    .to_string();
+    let call_sse = concat!(
+        "event: message\n",
+        "data: {\"jsonrpc\":\"2.0\",\"id\":7,\"method\":\"ping\"}\n\n",
+        "event: message\n",
+        "data: {\"jsonrpc\":\"2.0\",\"id\":7,\"result\":{\"content\":[]}}\n\n"
+    );
+    let server_request = "data: {\"jsonrpc\":\"2.0\",\"id\":\"server-1\",\"method\":\"elicitation/create\",\"params\":{}}\n\n";
+    let server = TestServer::start(vec![
+        response(
+            "200 OK",
+            &[("Content-Type", "application/json")],
+            &initialize,
+        ),
+        response("202 Accepted", &[], ""),
+        response("200 OK", &[("Content-Type", "text/event-stream")], call_sse),
+        response("202 Accepted", &[], ""),
+        response(
+            "200 OK",
+            &[("Content-Type", "text/event-stream")],
+            server_request,
+        ),
+        response("202 Accepted", &[], ""),
+    ])
+    .await;
+    let transport = make_transport(server.endpoint.clone());
+    transport
+        .initialize()
+        .await
+        .expect("initialization succeeds");
+
+    let result = transport
+        .call_tool("ping", json!({}), json!(7))
+        .await
+        .expect("SSE tool response succeeds");
+    assert_eq!(result, json!({ "content": [] }));
+    let error = transport
+        .send_internal(
+            json!({
+                "jsonrpc": "2.0",
+                "id": 8,
+                "method": "tools/list",
+                "params": {}
+            }),
+            true,
+            false,
+        )
+        .await
+        .expect_err("server request is rejected");
+    assert!(matches!(error, StreamableHttpError::InvalidResponse));
+    let requests = server.finish().await;
+    assert!(requests[3].contains("\"id\":7"));
+    assert!(requests[3].contains("\"result\":{}"));
+    assert!(requests[5].contains("\"code\":-32601"));
+}
+
+#[tokio::test]
+async fn call_tool_rejects_malformed_success_results() {
+    let initialize = json!({
+        "jsonrpc": "2.0",
+        "id": 0,
+        "result": { "protocolVersion": "2025-11-25", "capabilities": {} }
+    })
+    .to_string();
+    let valid = json!({
+        "content": [],
+        "structuredContent": { "status": "ok" },
+        "isError": false
+    });
+    let malformed = [
+        json!({ "content": "not-an-array" }),
+        json!({ "content": [{ "text": "missing content type" }] }),
+        json!({ "unexpected": true }),
+        json!({ "content": [], "structuredContent": "not-an-object" }),
+        json!({ "content": [], "structuredContent": [] }),
+        json!({ "content": [], "structuredContent": null }),
+    ];
+    let mut responses = vec![
+        response(
+            "200 OK",
+            &[("Content-Type", "application/json")],
+            &initialize,
+        ),
+        response("202 Accepted", &[], ""),
+        response(
+            "200 OK",
+            &[("Content-Type", "application/json")],
+            &json!({ "jsonrpc": "2.0", "id": 1, "result": valid.clone() }).to_string(),
+        ),
+    ];
+    responses.extend(malformed.iter().enumerate().map(|(index, result)| {
+        response(
+            "200 OK",
+            &[("Content-Type", "application/json")],
+            &json!({ "jsonrpc": "2.0", "id": index + 2, "result": result }).to_string(),
+        )
+    }));
+    let server = TestServer::start(responses).await;
+    let transport = make_transport(server.endpoint.clone());
+    transport
+        .initialize()
+        .await
+        .expect("initialization succeeds");
+
+    let result = transport
+        .call_tool("valid", json!({}), json!(1))
+        .await
+        .expect("object structured content is valid");
+    assert_eq!(result, valid);
+    for (index, _) in malformed.iter().enumerate() {
+        assert!(matches!(
+            transport
+                .call_tool("invalid", json!({}), json!(index + 2))
+                .await,
+            Err(StreamableHttpError::InvalidResponse)
+        ));
+    }
+    server.finish().await;
+}
+
+#[tokio::test]
+async fn changed_and_expired_sessions_fail_closed() {
+    let initialize = json!({
+        "jsonrpc": "2.0",
+        "id": 0,
+        "result": { "protocolVersion": "2025-11-25", "capabilities": {} }
+    })
+    .to_string();
+    let tools = json!({ "jsonrpc": "2.0", "id": 1, "result": { "tools": [] } }).to_string();
+    let changed = TestServer::start(vec![
+        response(
+            "200 OK",
+            &[
+                ("Content-Type", "application/json"),
+                ("Mcp-Session-Id", "one"),
+            ],
+            &initialize,
+        ),
+        response("202 Accepted", &[], ""),
+        response(
+            "200 OK",
+            &[
+                ("Content-Type", "application/json"),
+                ("Mcp-Session-Id", "two"),
+            ],
+            &tools,
+        ),
+    ])
+    .await;
+    let transport = make_transport(changed.endpoint.clone());
+    transport
+        .initialize()
+        .await
+        .expect("initialization succeeds");
+    assert!(matches!(
+        transport.list_tools(None, json!(1)).await,
+        Err(StreamableHttpError::SessionChanged)
+    ));
+    changed.finish().await;
+
+    let expired = TestServer::start(vec![
+        response(
+            "200 OK",
+            &[
+                ("Content-Type", "application/json"),
+                ("Mcp-Session-Id", "one"),
+            ],
+            &initialize,
+        ),
+        response("202 Accepted", &[], ""),
+        response("404 Not Found", &[], ""),
+    ])
+    .await;
+    let transport = make_transport(expired.endpoint.clone());
+    transport
+        .initialize()
+        .await
+        .expect("initialization succeeds");
+    assert!(matches!(
+        transport.list_tools(None, json!(1)).await,
+        Err(StreamableHttpError::SessionExpired)
+    ));
+    assert_eq!(transport.session_id().await, None);
+    expired.finish().await;
+}
+
+#[tokio::test]
+async fn initialization_header_conflicts_delete_the_issued_session_once() {
+    let initialize = json!({
+        "jsonrpc": "2.0",
+        "id": 0,
+        "result": { "protocolVersion": "2025-11-25", "capabilities": {} }
+    })
+    .to_string();
+    for notification_headers in [
+        vec![("Mcp-Session-Id", "session-b")],
+        vec![
+            ("Mcp-Session-Id", "session-a"),
+            ("Mcp-Session-Id", "session-a"),
+        ],
+    ] {
+        let server = TestServer::start(vec![
+            response(
+                "200 OK",
+                &[
+                    ("Content-Type", "application/json"),
+                    ("Mcp-Session-Id", "session-a"),
+                ],
+                &initialize,
+            ),
+            response("202 Accepted", &notification_headers, ""),
+            response("204 No Content", &[], ""),
+        ])
+        .await;
+        let transport = make_transport(server.endpoint.clone());
+
+        assert!(matches!(
+            transport.initialize().await,
+            Err(StreamableHttpError::SessionChanged | StreamableHttpError::InvalidSessionId)
+        ));
+        assert_eq!(transport.session_id().await, None);
+        let requests = server.finish().await;
+        assert_eq!(requests.len(), 3);
+        assert!(requests[2].starts_with("DELETE /mcp HTTP/1.1"));
+        assert!(
+            requests[2]
+                .to_ascii_lowercase()
+                .contains("mcp-session-id: session-a")
+        );
+    }
+}
+
+#[tokio::test]
+async fn termination_uses_delete_and_clears_memory() {
+    let initialize = json!({
+        "jsonrpc": "2.0",
+        "id": 0,
+        "result": { "protocolVersion": "2025-11-25", "capabilities": {} }
+    })
+    .to_string();
+    let server = TestServer::start(vec![
+        response(
+            "200 OK",
+            &[
+                ("Content-Type", "application/json"),
+                ("Mcp-Session-Id", "one"),
+            ],
+            &initialize,
+        ),
+        response("202 Accepted", &[], ""),
+        response("204 No Content", &[], ""),
+    ])
+    .await;
+    let transport = make_transport(server.endpoint.clone());
+    transport
+        .initialize()
+        .await
+        .expect("initialization succeeds");
+    transport.terminate().await.expect("termination succeeds");
+    assert_eq!(transport.session_id().await, None);
+
+    let requests = server.finish().await;
+    assert!(requests[2].starts_with("DELETE /mcp HTTP/1.1"));
+    assert!(
+        requests[2]
+            .to_ascii_lowercase()
+            .contains("mcp-session-id: one")
+    );
+}
+
+#[tokio::test]
+async fn termination_invalidates_before_waiting_for_delete_response() {
+    let listener = TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("test listener binds");
+    let endpoint = format!(
+        "http://{}/mcp",
+        listener.local_addr().expect("listener has an address")
+    );
+    let (accepted_tx, accepted_rx) = tokio::sync::oneshot::channel();
+    let server = tokio::spawn(async move {
+        let (mut stream, _) = listener.accept().await.expect("DELETE is accepted");
+        let mut request = vec![0_u8; 8192];
+        let read = stream.read(&mut request).await.expect("DELETE is read");
+        assert!(read > 0, "DELETE request is not empty");
+        accepted_tx.send(()).expect("test signal sends");
+        tokio::time::sleep(std::time::Duration::from_millis(200)).await;
+        stream
+            .write_all(b"HTTP/1.1 204 No Content\r\nContent-Length: 0\r\n\r\n")
+            .await
+            .expect("DELETE response writes");
+    });
+    let transport = make_transport(endpoint);
+    {
+        let mut state = transport.lock_state();
+        state.initialized = true;
+        state.session_id = Some("terminating".to_owned());
+        state.negotiated_protocol_version = Some(rmcp::model::ProtocolVersion::V_2025_11_25);
+    }
+    let terminating = {
+        let transport = transport.clone();
+        tokio::spawn(async move { transport.terminate().await })
+    };
+    accepted_rx.await.expect("DELETE reaches the server");
+
+    assert!(matches!(
+        transport.list_tools(None, json!(1)).await,
+        Err(StreamableHttpError::NotInitialized)
+    ));
+    terminating
+        .await
+        .expect("termination task completes")
+        .expect("termination succeeds");
+    server.await.expect("server task completes");
+}
+
+#[tokio::test]
+async fn aborted_termination_keeps_cleanup_owned_until_delete_finishes() {
+    let listener = TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("test listener binds");
+    let endpoint = format!(
+        "http://{}/mcp",
+        listener.local_addr().expect("listener has an address")
+    );
+    let (delete_started_tx, delete_started_rx) = tokio::sync::oneshot::channel();
+    let (release_delete_tx, release_delete_rx) = tokio::sync::oneshot::channel();
+    let (retry_seen_tx, mut retry_seen_rx) = tokio::sync::oneshot::channel();
+    let server = tokio::spawn(async move {
+        let (mut delete, _) = listener.accept().await.expect("DELETE accepts");
+        let mut request = vec![0_u8; 8192];
+        let read = delete.read(&mut request).await.expect("DELETE reads");
+        let request = String::from_utf8_lossy(&request[..read]);
+        assert!(request.starts_with("DELETE /mcp HTTP/1.1"));
+        assert!(
+            request
+                .to_ascii_lowercase()
+                .contains("mcp-session-id: abort-owned")
+        );
+        delete_started_tx.send(()).expect("DELETE start signals");
+        let delete_response = tokio::spawn(async move {
+            release_delete_rx.await.expect("DELETE release signals");
+            delete
+                .write_all(b"HTTP/1.1 204 No Content\r\nContent-Length: 0\r\n\r\n")
+                .await
+                .expect("DELETE response writes after caller cancellation");
+        });
+
+        let (mut retry, _) = listener.accept().await.expect("retry initialize accepts");
+        retry_seen_tx.send(()).expect("retry signal sends");
+        let mut request = vec![0_u8; 8192];
+        let read = retry
+            .read(&mut request)
+            .await
+            .expect("retry initialize reads");
+        assert!(String::from_utf8_lossy(&request[..read]).starts_with("POST /mcp HTTP/1.1"));
+        retry
+            .write_all(
+                b"HTTP/1.1 500 Internal Server Error\r\nContent-Length: 0\r\nConnection: close\r\n\r\n",
+            )
+            .await
+            .expect("retry error response writes");
+        delete_response.await.expect("DELETE responder joins");
+        assert!(
+            tokio::time::timeout(std::time::Duration::from_millis(200), listener.accept())
+                .await
+                .is_err(),
+            "caller cancellation must not duplicate DELETE"
+        );
+    });
+    let transport = make_transport(endpoint);
+    {
+        let mut state = transport.lock_state();
+        state.initialized = true;
+        state.session_id = Some("abort-owned".to_owned());
+        state.negotiated_protocol_version = Some(rmcp::model::ProtocolVersion::V_2025_11_25);
+    }
+    let terminating = {
+        let transport = transport.clone();
+        tokio::spawn(async move { transport.terminate().await })
+    };
+    delete_started_rx.await.expect("DELETE reaches server");
+    terminating.abort();
+    assert!(
+        terminating
+            .await
+            .expect_err("terminate task is aborted")
+            .is_cancelled()
+    );
+    let retry = {
+        let transport = transport.clone();
+        tokio::spawn(async move { transport.initialize().await })
+    };
+    assert!(
+        tokio::time::timeout(std::time::Duration::from_millis(100), &mut retry_seen_rx)
+            .await
+            .is_err(),
+        "initialize stays gated while the owned DELETE is pending"
+    );
+    release_delete_tx.send(()).expect("DELETE releases");
+    tokio::time::timeout(std::time::Duration::from_secs(1), retry_seen_rx)
+        .await
+        .expect("initialize reaches server after DELETE")
+        .expect("retry signal arrives");
+    assert!(matches!(
+        retry.await.expect("retry task joins"),
+        Err(StreamableHttpError::HttpStatus(
+            reqwest::StatusCode::INTERNAL_SERVER_ERROR
+        ))
+    ));
+    server.await.expect("cancellation server joins");
+}
+
+#[tokio::test]
+async fn old_and_unknown_protocol_versions_discard_the_server_session() {
+    for (protocol_version, session_id) in [
+        ("2025-03-26", "old-session"),
+        ("2099-01-01", "unknown-session"),
+    ] {
+        let initialize = json!({
+            "jsonrpc": "2.0",
+            "id": 0,
+            "result": { "protocolVersion": protocol_version, "capabilities": {} }
+        })
+        .to_string();
+        let server = TestServer::start(vec![
+            response(
+                "200 OK",
+                &[
+                    ("Content-Type", "application/json"),
+                    ("Mcp-Session-Id", session_id),
+                ],
+                &initialize,
+            ),
+            response("204 No Content", &[], ""),
+        ])
+        .await;
+        let transport = make_transport(server.endpoint.clone());
+
+        assert!(matches!(
+            transport.initialize().await,
+            Err(StreamableHttpError::ProtocolVersionMismatch)
+        ));
+        assert_eq!(transport.session_id().await, None);
+        assert!(matches!(
+            transport.list_tools(None, json!(1)).await,
+            Err(StreamableHttpError::NotInitialized)
+        ));
+        let requests = server.finish().await;
+        assert_eq!(requests.len(), 2);
+        let cleanup = requests[1].to_ascii_lowercase();
+        assert!(cleanup.starts_with("delete /mcp http/1.1"));
+        assert!(cleanup.contains(&format!("mcp-session-id: {session_id}")));
+        assert!(cleanup.contains("mcp-protocol-version: 2025-11-25"));
+    }
+}
+
+#[tokio::test]
+async fn aborted_initialize_discards_provisional_session_state() {
+    let listener = TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("test listener binds");
+    let endpoint = format!(
+        "http://{}/mcp",
+        listener.local_addr().expect("listener has an address")
+    );
+    let (headers_tx, headers_rx) = tokio::sync::oneshot::channel();
+    let (delete_tx, delete_rx) = tokio::sync::oneshot::channel();
+    let server = tokio::spawn(async move {
+        let (mut stream, _) = listener.accept().await.expect("initialize is accepted");
+        let mut request = vec![0_u8; 8192];
+        let read = stream.read(&mut request).await.expect("initialize is read");
+        assert!(read > 0, "initialize request is not empty");
+        stream
+            .write_all(
+                b"HTTP/1.1 200 OK\r\nContent-Type: text/event-stream\r\nMcp-Session-Id: provisional\r\n\r\n",
+            )
+            .await
+            .expect("initialize headers write");
+        stream.flush().await.expect("initialize headers flush");
+        headers_tx.send(()).expect("header signal sends");
+        let (mut cleanup, _) = listener.accept().await.expect("cleanup DELETE is accepted");
+        let mut request = vec![0_u8; 8192];
+        let read = cleanup
+            .read(&mut request)
+            .await
+            .expect("cleanup DELETE is read");
+        cleanup
+            .write_all(b"HTTP/1.1 204 No Content\r\nContent-Length: 0\r\n\r\n")
+            .await
+            .expect("cleanup DELETE response writes");
+        delete_tx
+            .send(String::from_utf8_lossy(&request[..read]).into_owned())
+            .expect("cleanup request signal sends");
+    });
+    let transport = make_transport(endpoint);
+    let initializing = {
+        let transport = transport.clone();
+        tokio::spawn(async move { transport.initialize().await })
+    };
+    headers_rx.await.expect("initialize headers arrive");
+    tokio::time::timeout(std::time::Duration::from_secs(1), async {
+        while transport.session_id().await.as_deref() != Some("provisional") {
+            tokio::task::yield_now().await;
+        }
+    })
+    .await
+    .expect("provisional session is recorded");
+    initializing.abort();
+    let _ = initializing.await;
+
+    let delete = tokio::time::timeout(std::time::Duration::from_secs(1), delete_rx)
+        .await
+        .expect("cleanup DELETE arrives")
+        .expect("cleanup request is captured");
+    assert!(delete.starts_with("DELETE /mcp HTTP/1.1"));
+    assert!(
+        delete
+            .to_ascii_lowercase()
+            .contains("mcp-session-id: provisional")
+    );
+
+    {
+        let state = transport.lock_state();
+        assert!(!state.initialized);
+        assert_eq!(state.session_id, None);
+        assert_eq!(state.negotiated_protocol_version, None);
+    }
+    transport
+        .terminate()
+        .await
+        .expect("already cleaned transport terminates without another DELETE");
+    server.await.expect("cleanup server completes");
+}
+
+#[tokio::test]
+async fn failed_initializations_do_not_accumulate_server_sessions() {
+    let initialize = json!({
+        "jsonrpc": "2.0",
+        "id": 0,
+        "result": { "protocolVersion": "2025-03-26", "capabilities": {} }
+    })
+    .to_string();
+    let mut responses = Vec::new();
+    for index in 0..3 {
+        responses.push(response(
+            "200 OK",
+            &[
+                ("Content-Type", "application/json"),
+                ("Mcp-Session-Id", &format!("ledger-{index}")),
+            ],
+            &initialize,
+        ));
+        responses.push(response("204 No Content", &[], ""));
+    }
+    let server = TestServer::start(responses).await;
+    let transport = make_transport(server.endpoint.clone());
+
+    for _ in 0..3 {
+        assert!(matches!(
+            transport.initialize().await,
+            Err(StreamableHttpError::ProtocolVersionMismatch)
+        ));
+    }
+
+    let requests = server.finish().await;
+    assert_eq!(requests.len(), 6);
+    for (index, pair) in requests.chunks_exact(2).enumerate() {
+        assert!(pair[0].starts_with("POST /mcp HTTP/1.1"));
+        assert!(pair[1].starts_with("DELETE /mcp HTTP/1.1"));
+        assert!(
+            pair[1]
+                .to_ascii_lowercase()
+                .contains(&format!("mcp-session-id: ledger-{index}"))
+        );
+    }
+}
+
+#[tokio::test]
+async fn initialization_retry_waits_for_the_previous_session_delete() {
+    let listener = TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("test listener binds");
+    let endpoint = format!(
+        "http://{}/mcp",
+        listener.local_addr().expect("listener has an address")
+    );
+    let initialize = json!({
+        "jsonrpc": "2.0",
+        "id": 0,
+        "result": { "protocolVersion": "2025-03-26", "capabilities": {} }
+    })
+    .to_string();
+    let (delete_started_tx, delete_started_rx) = tokio::sync::oneshot::channel();
+    let (release_delete_tx, release_delete_rx) = tokio::sync::oneshot::channel();
+    let (retry_seen_tx, mut retry_seen_rx) = tokio::sync::oneshot::channel();
+    let server = tokio::spawn(async move {
+        let (mut delete, _) = listener.accept().await.expect("first DELETE accepts");
+        let mut request = vec![0_u8; 8192];
+        let read = delete.read(&mut request).await.expect("first DELETE reads");
+        let request = String::from_utf8_lossy(&request[..read]);
+        assert!(request.starts_with("DELETE /mcp HTTP/1.1"));
+        assert!(
+            request
+                .to_ascii_lowercase()
+                .contains("mcp-session-id: ledger-first")
+        );
+        delete_started_tx.send(()).expect("DELETE start signals");
+        let delete_response = tokio::spawn(async move {
+            release_delete_rx.await.expect("DELETE release signals");
+            delete
+                .write_all(b"HTTP/1.1 204 No Content\r\nContent-Length: 0\r\n\r\n")
+                .await
+                .expect("first DELETE response writes");
+        });
+
+        {
+            let (mut stream, _) = listener.accept().await.expect("retry initialize accepts");
+            retry_seen_tx.send(()).expect("retry signal sends");
+            let mut request = vec![0_u8; 8192];
+            let read = stream
+                .read(&mut request)
+                .await
+                .expect("retry initialize reads");
+            assert!(String::from_utf8_lossy(&request[..read]).starts_with("POST /mcp HTTP/1.1"));
+            stream
+                .write_all(
+                    response(
+                        "200 OK",
+                        &[
+                            ("Content-Type", "application/json"),
+                            ("Mcp-Session-Id", "ledger-second"),
+                        ],
+                        &initialize,
+                    )
+                    .as_bytes(),
+                )
+                .await
+                .expect("retry initialize response writes");
+        }
+        delete_response.await.expect("first DELETE responder joins");
+
+        let (mut cleanup, _) = listener.accept().await.expect("second DELETE accepts");
+        let mut request = vec![0_u8; 8192];
+        let read = cleanup
+            .read(&mut request)
+            .await
+            .expect("second DELETE reads");
+        let request = String::from_utf8_lossy(&request[..read]);
+        assert!(request.starts_with("DELETE /mcp HTTP/1.1"));
+        assert!(
+            request
+                .to_ascii_lowercase()
+                .contains("mcp-session-id: ledger-second")
+        );
+        cleanup
+            .write_all(b"HTTP/1.1 204 No Content\r\nContent-Length: 0\r\n\r\n")
+            .await
+            .expect("second DELETE response writes");
+    });
+    let transport = make_transport(endpoint);
+    let generation = {
+        let mut state = transport.lock_state();
+        state.initialized = true;
+        state.session_id = Some("ledger-first".to_owned());
+        state.negotiated_protocol_version = Some(rmcp::model::ProtocolVersion::V_2025_11_25);
+        state.generation
+    };
+    let interleave = Arc::new(super::InitializationCleanupInterleave::default());
+    *transport
+        .initialization_cleanup_interleave
+        .lock()
+        .unwrap_or_else(std::sync::PoisonError::into_inner) = Some(interleave.clone());
+    let retry = {
+        let transport = transport.clone();
+        tokio::spawn(async move { transport.initialize().await })
+    };
+    interleave.drained.notified().await;
+    let changed_headers = [(super::MCP_SESSION_ID, "listener-changed".parse().unwrap())]
+        .into_iter()
+        .collect();
+    assert!(matches!(
+        transport
+            .accept_response_session_or_reset(&changed_headers, generation, false)
+            .await,
+        Err(StreamableHttpError::SessionChanged)
+    ));
+    delete_started_rx.await.expect("first DELETE starts");
+    interleave.resume.notify_one();
+    assert!(
+        tokio::time::timeout(std::time::Duration::from_millis(100), &mut retry_seen_rx)
+            .await
+            .is_err(),
+        "retry must not allocate a session while DELETE is pending"
+    );
+    release_delete_tx.send(()).expect("first DELETE releases");
+    tokio::time::timeout(std::time::Duration::from_secs(1), retry_seen_rx)
+        .await
+        .expect("retry reaches server after DELETE")
+        .expect("retry signal arrives");
+    assert!(matches!(
+        retry.await.expect("retry task joins"),
+        Err(StreamableHttpError::ProtocolVersionMismatch)
+    ));
+    server.await.expect("session ledger server joins");
+}
+
+#[tokio::test]
+async fn listener_invalidation_and_terminate_share_one_delete_owner() {
+    let listener = TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("test listener binds");
+    let endpoint = format!(
+        "http://{}/mcp",
+        listener.local_addr().expect("listener has an address")
+    );
+    let server = tokio::spawn(async move {
+        let (mut stream, _) = listener.accept().await.expect("DELETE accepts");
+        let mut request = vec![0_u8; 8192];
+        let read = stream.read(&mut request).await.expect("DELETE reads");
+        let request = String::from_utf8_lossy(&request[..read]).into_owned();
+        stream
+            .write_all(b"HTTP/1.1 204 No Content\r\nContent-Length: 0\r\n\r\n")
+            .await
+            .expect("DELETE response writes");
+        assert!(
+            tokio::time::timeout(std::time::Duration::from_millis(200), listener.accept())
+                .await
+                .is_err(),
+            "only one path may issue DELETE"
+        );
+        request
+    });
+    let transport = make_transport(endpoint);
+    let generation = {
+        let mut state = transport.lock_state();
+        state.initialized = true;
+        state.session_id = Some("shared-owner".to_owned());
+        state.negotiated_protocol_version = Some(rmcp::model::ProtocolVersion::V_2025_11_25);
+        state.generation
+    };
+    let start = Arc::new(tokio::sync::Barrier::new(3));
+    let listener_invalidation = {
+        let transport = transport.clone();
+        let start = start.clone();
+        tokio::spawn(async move {
+            let headers = [(super::MCP_SESSION_ID, "changed".parse().unwrap())]
+                .into_iter()
+                .collect();
+            start.wait().await;
+            transport
+                .accept_response_session_or_reset(&headers, generation, false)
+                .await
+        })
+    };
+    let termination = {
+        let transport = transport.clone();
+        let start = start.clone();
+        tokio::spawn(async move {
+            start.wait().await;
+            transport.terminate().await
+        })
+    };
+    start.wait().await;
+
+    assert!(matches!(
+        listener_invalidation
+            .await
+            .expect("listener invalidation joins"),
+        Err(StreamableHttpError::SessionChanged | StreamableHttpError::SessionInvalidated)
+    ));
+    termination
+        .await
+        .expect("termination joins")
+        .expect("termination succeeds");
+    let request = server.await.expect("DELETE server joins");
+    assert!(request.starts_with("DELETE /mcp HTTP/1.1"));
+    assert!(
+        request
+            .to_ascii_lowercase()
+            .contains("mcp-session-id: shared-owner")
+    );
+}
+
+#[tokio::test]
+async fn initialized_notification_requires_empty_202() {
+    let initialize = json!({
+        "jsonrpc": "2.0",
+        "id": 0,
+        "result": { "protocolVersion": "2025-11-25", "capabilities": {} }
+    })
+    .to_string();
+    let server = TestServer::start(vec![
+        response(
+            "200 OK",
+            &[("Content-Type", "application/json")],
+            &initialize,
+        ),
+        response("204 No Content", &[], ""),
+    ])
+    .await;
+    let transport = make_transport(server.endpoint.clone());
+
+    assert!(matches!(
+        transport.initialize().await,
+        Err(StreamableHttpError::InvalidResponse)
+    ));
+    assert_eq!(transport.session_id().await, None);
+    server.finish().await;
+
+    let server = TestServer::start(vec![
+        response(
+            "200 OK",
+            &[("Content-Type", "application/json")],
+            &initialize,
+        ),
+        response(
+            "200 OK",
+            &[("Content-Type", "application/json")],
+            &json!({ "jsonrpc": "2.0", "method": "notifications/progress" }).to_string(),
+        ),
+    ])
+    .await;
+    let transport = make_transport(server.endpoint.clone());
+    assert!(matches!(
+        transport.initialize().await,
+        Err(StreamableHttpError::InvalidResponse)
+    ));
+    server.finish().await;
+}
+
+#[tokio::test]
+async fn interrupted_sse_resumes_with_last_event_id() {
+    let initialize = json!({
+        "jsonrpc": "2.0",
+        "id": 0,
+        "result": { "protocolVersion": "2025-11-25", "capabilities": {} }
+    })
+    .to_string();
+    let resumed = "id: event-2\ndata: {\"jsonrpc\":\"2.0\",\"id\":1,\"result\":{\"tools\":[]}}\n\n";
+    let server = TestServer::start(vec![
+        response(
+            "200 OK",
+            &[
+                ("Content-Type", "application/json"),
+                ("Mcp-Session-Id", "resume-session"),
+            ],
+            &initialize,
+        ),
+        response("202 Accepted", &[], ""),
+        response(
+            "200 OK",
+            &[("Content-Type", "text/event-stream")],
+            "id: event-1\ndata:\n\n",
+        ),
+        response("503 Service Unavailable", &[], ""),
+        response("200 OK", &[("Content-Type", "text/event-stream")], resumed),
+    ])
+    .await;
+    let transport = make_transport(server.endpoint.clone());
+    transport
+        .initialize()
+        .await
+        .expect("initialization succeeds");
+
+    let page = transport
+        .list_tools(None, json!(1))
+        .await
+        .expect("resumed list succeeds");
+    assert!(page.tools.is_empty());
+    let requests = server.finish().await;
+    for request in &requests[3..=4] {
+        assert!(request.starts_with("GET /mcp HTTP/1.1"));
+        assert!(
+            request
+                .to_ascii_lowercase()
+                .contains("last-event-id: event-1")
+        );
+    }
+}
+
+#[tokio::test]
+async fn initialize_sse_resume_uses_newly_assigned_session() {
+    let initialize = json!({
+        "jsonrpc": "2.0",
+        "id": 0,
+        "result": { "protocolVersion": "2025-11-25", "capabilities": {} }
+    })
+    .to_string();
+    let server = TestServer::start(vec![
+        response(
+            "200 OK",
+            &[
+                ("Content-Type", "text/event-stream"),
+                ("Mcp-Session-Id", "initialize-session"),
+            ],
+            "id: initialize-1\ndata:\n\n",
+        ),
+        response(
+            "200 OK",
+            &[("Content-Type", "text/event-stream")],
+            &format!("data: {initialize}\n\n"),
+        ),
+        response("202 Accepted", &[], ""),
+    ])
+    .await;
+    let transport = make_transport(server.endpoint.clone());
+
+    transport
+        .initialize()
+        .await
+        .expect("stateful initialize resumes");
+    let requests = server.finish().await;
+    let resume = requests[1].to_ascii_lowercase();
+    assert!(resume.starts_with("get /mcp http/1.1"));
+    assert!(resume.contains("mcp-session-id: initialize-session"));
+    assert!(resume.contains("last-event-id: initialize-1"));
+    let initialized = requests[2].to_ascii_lowercase();
+    assert!(initialized.starts_with("post /mcp http/1.1"));
+    assert!(initialized.contains("mcp-session-id: initialize-session"));
+    assert!(initialized.contains("mcp-protocol-version: 2025-11-25"));
+}
+
+#[tokio::test]
+async fn stateless_sse_also_resumes_with_last_event_id() {
+    let initialize = json!({
+        "jsonrpc": "2.0",
+        "id": 0,
+        "result": { "protocolVersion": "2025-11-25", "capabilities": {} }
+    })
+    .to_string();
+    let server = TestServer::start(vec![
+        response(
+            "200 OK",
+            &[("Content-Type", "application/json")],
+            &initialize,
+        ),
+        response("202 Accepted", &[], ""),
+        response(
+            "200 OK",
+            &[("Content-Type", "text/event-stream")],
+            "id: stateless-1\ndata:\n\n",
+        ),
+        response(
+            "200 OK",
+            &[("Content-Type", "text/event-stream")],
+            "data: {\"jsonrpc\":\"2.0\",\"id\":2,\"result\":{\"tools\":[]}}\n\n",
+        ),
+    ])
+    .await;
+    let transport = make_transport(server.endpoint.clone());
+    transport
+        .initialize()
+        .await
+        .expect("initialization succeeds");
+    transport
+        .list_tools(None, json!(2))
+        .await
+        .expect("stateless resume succeeds");
+
+    let requests = server.finish().await;
+    let resumed = requests[3].to_ascii_lowercase();
+    assert!(resumed.starts_with("get /mcp http/1.1"));
+    assert!(resumed.contains("last-event-id: stateless-1"));
+    assert!(!resumed.contains("mcp-session-id:"));
+}
+
+#[tokio::test]
+async fn matching_sse_response_returns_before_stream_eof() {
+    let listener = TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("test listener binds");
+    let endpoint = format!(
+        "http://{}/mcp",
+        listener.local_addr().expect("listener has an address")
+    );
+    let task = tokio::spawn(async move {
+        let initialize = json!({
+            "jsonrpc": "2.0",
+            "id": 0,
+            "result": { "protocolVersion": "2025-11-25", "capabilities": {} }
+        })
+        .to_string();
+        for response in [
+            response(
+                "200 OK",
+                &[
+                    ("Content-Type", "application/json"),
+                    ("Mcp-Session-Id", "stream-session"),
+                ],
+                &initialize,
+            ),
+            response("202 Accepted", &[], ""),
+        ] {
+            let (mut stream, _) = listener.accept().await.expect("request is accepted");
+            let mut request = vec![0_u8; 8192];
+            let read = stream.read(&mut request).await.expect("request is read");
+            assert!(read > 0, "request is not empty");
+            stream
+                .write_all(response.as_bytes())
+                .await
+                .expect("response is written");
+        }
+        let (mut stream, _) = listener.accept().await.expect("tool request is accepted");
+        let mut request = vec![0_u8; 8192];
+        let read = stream
+            .read(&mut request)
+            .await
+            .expect("tool request is read");
+        assert!(read > 0, "tool request is not empty");
+        stream
+            .write_all(
+                b"HTTP/1.1 200 OK\r\nContent-Type: text/event-stream\r\n\r\nid: result-1\ndata: {\"jsonrpc\":\"2.0\",\"id\":9,\"result\":{\"content\":[]}}\n\n",
+            )
+            .await
+            .expect("stream event is written");
+        stream.flush().await.expect("stream event is flushed");
+        tokio::time::sleep(std::time::Duration::from_secs(2)).await;
+    });
+    let transport = make_transport(endpoint);
+    transport
+        .initialize()
+        .await
+        .expect("initialization succeeds");
+
+    let result = tokio::time::timeout(
+        std::time::Duration::from_millis(500),
+        transport.call_tool("ping", json!({}), json!(9)),
+    )
+    .await
+    .expect("matching response does not wait for EOF")
+    .expect("tool call succeeds");
+    assert_eq!(result, json!({ "content": [] }));
+    task.abort();
+}
+
+#[tokio::test]
+async fn notification_get_stream_signals_tool_list_changes() {
+    let initialize = json!({
+        "jsonrpc": "2.0",
+        "id": 0,
+        "result": { "protocolVersion": "2025-11-25", "capabilities": {} }
+    })
+    .to_string();
+    let notification = "id: changed-1\ndata: {\"jsonrpc\":\"2.0\",\"method\":\"notifications/tools/list_changed\"}\n\n";
+    let server = TestServer::start(vec![
+        response(
+            "200 OK",
+            &[
+                ("Content-Type", "application/json"),
+                ("Mcp-Session-Id", "notify-session"),
+            ],
+            &initialize,
+        ),
+        response("202 Accepted", &[], ""),
+        response(
+            "200 OK",
+            &[("Content-Type", "text/event-stream")],
+            notification,
+        ),
+    ])
+    .await;
+    let transport = make_transport(server.endpoint.clone());
+    transport
+        .initialize()
+        .await
+        .expect("initialization succeeds");
+    let mut changes = transport.subscribe_tool_list_changed();
+    let listener_transport = transport.clone();
+    let listener = tokio::spawn(async move { listener_transport.listen_notifications().await });
+
+    tokio::time::timeout(std::time::Duration::from_secs(1), changes.recv())
+        .await
+        .expect("change signal arrives before timeout")
+        .expect("change channel remains open");
+    let requests = server.finish().await;
+    assert!(requests[2].starts_with("GET /mcp HTTP/1.1"));
+    listener.abort();
+}
+
+#[test]
+fn sse_parser_handles_multiline_data_and_rejects_empty_streams() {
+    let body = b"id: prime\ndata:\n\nevent: message\ndata: {\"jsonrpc\":\"2.0\",\ndata: \"id\":1,\"result\":{}}\n\n";
+    let parsed = parse_response_messages(&OutboundResponse {
+        status: reqwest::StatusCode::OK,
+        headers: [(
+            reqwest::header::CONTENT_TYPE,
+            "text/event-stream".parse().unwrap(),
+        )]
+        .into_iter()
+        .collect(),
+        body: body.to_vec(),
+        final_url: "https://example.com/mcp".parse().unwrap(),
+    })
+    .expect("multiline SSE data parses");
+    assert_eq!(
+        parsed,
+        vec![json!({ "jsonrpc": "2.0", "id": 1, "result": {} })]
+    );
+
+    let empty = parse_response_messages(&OutboundResponse {
+        status: reqwest::StatusCode::OK,
+        headers: [(
+            reqwest::header::CONTENT_TYPE,
+            "text/event-stream".parse().unwrap(),
+        )]
+        .into_iter()
+        .collect(),
+        body: b": keepalive\n\n".to_vec(),
+        final_url: "https://example.com/mcp".parse().unwrap(),
+    });
+    assert!(matches!(empty, Err(StreamableHttpError::InvalidResponse)));
+}
+
+#[test]
+fn public_networks_are_the_default_and_protocol_headers_are_reserved() {
+    let denied =
+        StreamableHttpTransport::new(StreamableHttpConfig::new("http://127.0.0.1:1234/mcp"));
+    assert!(matches!(
+        denied,
+        Err(StreamableHttpError::Outbound(
+            crate::outbound::OutboundError::PrivateAddress
+        ))
+    ));
+
+    let mut config = StreamableHttpConfig::new("https://example.com/mcp");
+    config
+        .headers
+        .insert("mcp-session-id", "injected".parse().unwrap());
+    assert!(matches!(
+        StreamableHttpTransport::new(config),
+        Err(StreamableHttpError::ReservedHeader)
+    ));
+
+    let mut config = StreamableHttpConfig::new("https://example.com/mcp");
+    config
+        .headers
+        .insert("last-event-id", "leaked".parse().unwrap());
+    assert!(matches!(
+        StreamableHttpTransport::new(config),
+        Err(StreamableHttpError::ReservedHeader)
+    ));
+}
+
+#[test]
+fn only_https_and_loopback_http_endpoints_pass_transport_policy() {
+    for endpoint in [
+        "https://example.com/mcp",
+        "https://10.0.0.1/mcp",
+        "http://127.0.0.1:1/mcp",
+        "http://[::1]:1/mcp",
+        "http://localhost:1/mcp",
+        "http://service.localhost:1/mcp",
+        "http://LOCALHOST.:1/mcp",
+    ] {
+        let mut config = StreamableHttpConfig::new(endpoint);
+        config.allow_private_networks = true;
+        assert!(
+            StreamableHttpTransport::new(config).is_ok(),
+            "{endpoint} should be allowed"
+        );
+    }
+
+    for endpoint in [
+        "http://example.com/mcp",
+        "http://10.0.0.1/mcp",
+        "http://0.0.0.0/mcp",
+    ] {
+        let mut config = StreamableHttpConfig::new(endpoint);
+        config.allow_private_networks = true;
+        assert!(matches!(
+            StreamableHttpTransport::new(config),
+            Err(StreamableHttpError::InsecureEndpoint)
+        ));
+    }
+}
+
+#[tokio::test]
+async fn insecure_static_credentials_are_rejected_without_a_request() {
+    let listener = TcpListener::bind("0.0.0.0:0")
+        .await
+        .expect("test listener binds");
+    let endpoint = format!(
+        "http://0.0.0.0:{}/mcp",
+        listener
+            .local_addr()
+            .expect("listener has an address")
+            .port()
+    );
+    let mut config = StreamableHttpConfig::new(endpoint);
+    config.allow_private_networks = true;
+    config.headers.insert(
+        reqwest::header::AUTHORIZATION,
+        "Bearer static-secret".parse().unwrap(),
+    );
+
+    assert!(matches!(
+        StreamableHttpTransport::new(config),
+        Err(StreamableHttpError::InsecureEndpoint)
+    ));
+    assert!(
+        tokio::time::timeout(std::time::Duration::from_millis(100), listener.accept())
+            .await
+            .is_err(),
+        "insecure configuration must make zero requests"
+    );
+}
+
+#[tokio::test]
+async fn endpoint_recheck_blocks_managed_credentials_before_init_and_dispatch() {
+    let listener = TcpListener::bind("0.0.0.0:0")
+        .await
+        .expect("test listener binds");
+    let insecure_endpoint = format!(
+        "http://0.0.0.0:{}/mcp",
+        listener
+            .local_addr()
+            .expect("listener has an address")
+            .port()
+    );
+    let mut transport = make_transport("http://127.0.0.1:1/mcp".to_owned());
+    transport.endpoint = insecure_endpoint.parse().expect("test endpoint parses");
+    transport.headers.insert(
+        reqwest::header::AUTHORIZATION,
+        "Bearer managed-secret".parse().unwrap(),
+    );
+
+    assert!(matches!(
+        transport.initialize().await,
+        Err(StreamableHttpError::InsecureEndpoint)
+    ));
+    {
+        let mut state = transport.lock_state();
+        state.initialized = true;
+        state.negotiated_protocol_version = Some(rmcp::model::ProtocolVersion::V_2025_11_25);
+    }
+    assert!(matches!(
+        transport.call_tool("blocked", json!({}), json!(1)).await,
+        Err(StreamableHttpError::InsecureEndpoint)
+    ));
+    assert!(
+        tokio::time::timeout(std::time::Duration::from_millis(100), listener.accept())
+            .await
+            .is_err(),
+        "endpoint rechecks must make zero requests"
+    );
+}
+
+#[tokio::test]
+async fn poisoned_localhost_resolution_blocks_static_and_managed_credentials() {
+    let route = std::net::UdpSocket::bind("0.0.0.0:0").expect("route probe binds");
+    route
+        .connect("192.0.2.1:9")
+        .expect("route probe selects an interface");
+    let target_ip = route.local_addr().expect("route has an address").ip();
+    assert!(!target_ip.is_loopback());
+    let target = TcpListener::bind(std::net::SocketAddr::new(target_ip, 0))
+        .await
+        .expect("non-loopback target binds");
+    let endpoint = format!(
+        "http://poison.localhost:{}/mcp",
+        target.local_addr().expect("target has an address").port()
+    );
+    let poisoned_addresses = vec![target_ip, "8.8.8.8".parse().expect("public IP parses")];
+
+    let mut static_config = StreamableHttpConfig::new(endpoint.clone());
+    static_config.allow_private_networks = true;
+    static_config.headers.insert(
+        reqwest::header::AUTHORIZATION,
+        "Bearer static-secret".parse().unwrap(),
+    );
+    let mut static_transport = StreamableHttpTransport::new(static_config)
+        .expect("localhost-like URL is syntactically valid");
+    static_transport.client = static_transport
+        .client
+        .clone()
+        .with_test_dns_resolution("poison.localhost", poisoned_addresses.clone());
+    assert!(matches!(
+        static_transport.initialize().await,
+        Err(StreamableHttpError::Outbound(
+            crate::outbound::OutboundError::InsecureTransport
+        ))
+    ));
+
+    let mut managed_config = StreamableHttpConfig::new(endpoint);
+    managed_config.allow_private_networks = true;
+    managed_config.headers.insert(
+        reqwest::header::AUTHORIZATION,
+        "Bearer managed-secret".parse().unwrap(),
+    );
+    let mut managed_transport = StreamableHttpTransport::new(managed_config)
+        .expect("localhost-like managed URL is syntactically valid");
+    managed_transport.client = managed_transport
+        .client
+        .clone()
+        .with_test_dns_resolution("poison.localhost", poisoned_addresses);
+    {
+        let mut state = managed_transport.lock_state();
+        state.initialized = true;
+        state.negotiated_protocol_version = Some(rmcp::model::ProtocolVersion::V_2025_11_25);
+    }
+    assert!(matches!(
+        managed_transport
+            .call_tool("blocked", json!({}), json!(1))
+            .await,
+        Err(StreamableHttpError::Outbound(
+            crate::outbound::OutboundError::InsecureTransport
+        ))
+    ));
+    assert!(
+        tokio::time::timeout(std::time::Duration::from_millis(100), target.accept())
+            .await
+            .is_err(),
+        "poisoned localhost target must receive zero credentialed requests"
+    );
+}
+
+#[tokio::test]
+async fn localhost_name_resolving_to_loopback_remains_allowed() {
+    let initialize = json!({
+        "jsonrpc": "2.0",
+        "id": 0,
+        "result": { "protocolVersion": "2025-11-25", "capabilities": {} }
+    })
+    .to_string();
+    let server = TestServer::start(vec![
+        response(
+            "200 OK",
+            &[("Content-Type", "application/json")],
+            &initialize,
+        ),
+        response("202 Accepted", &[], ""),
+    ])
+    .await;
+    let port = url::Url::parse(&server.endpoint)
+        .expect("server endpoint parses")
+        .port()
+        .expect("server endpoint has a port");
+    let mut config = StreamableHttpConfig::new(format!("http://safe.localhost:{port}/mcp"));
+    config.allow_private_networks = true;
+    let mut transport =
+        StreamableHttpTransport::new(config).expect("localhost-like endpoint is valid");
+    transport.client = transport.client.clone().with_test_dns_resolution(
+        "safe.localhost",
+        vec!["127.0.0.1".parse().expect("loopback IP parses")],
+    );
+
+    transport
+        .initialize()
+        .await
+        .expect("resolved loopback HTTP initializes");
+    assert_eq!(server.finish().await.len(), 2);
+}
+
+#[tokio::test]
+async fn credentialed_redirects_are_not_followed() {
+    let redirect_target = TcpListener::bind("0.0.0.0:0")
+        .await
+        .expect("redirect target binds");
+    let location = format!(
+        "http://0.0.0.0:{}/credential-sink",
+        redirect_target
+            .local_addr()
+            .expect("redirect target has an address")
+            .port()
+    );
+    let server =
+        TestServer::start(vec![response("302 Found", &[("Location", &location)], "")]).await;
+    let mut transport = make_transport(server.endpoint.clone());
+    transport.headers.insert(
+        reqwest::header::AUTHORIZATION,
+        "Bearer redirect-secret".parse().unwrap(),
+    );
+
+    assert!(matches!(
+        transport.initialize().await,
+        Err(StreamableHttpError::HttpStatus(reqwest::StatusCode::FOUND))
+    ));
+    let requests = server.finish().await;
+    assert_eq!(requests.len(), 1);
+    assert!(
+        requests[0]
+            .to_ascii_lowercase()
+            .contains("authorization: bearer redirect-secret")
+    );
+    assert!(
+        tokio::time::timeout(
+            std::time::Duration::from_millis(100),
+            redirect_target.accept()
+        )
+        .await
+        .is_err(),
+        "redirect target must receive zero requests"
+    );
+}
+
+#[test]
+fn response_error_data_is_structured_and_sanitizable_by_the_caller() {
+    let error = super::response_result(
+        vec![json!({
+            "jsonrpc": "2.0",
+            "id": "call",
+            "error": { "code": -32602, "message": "bad args", "data": { "secret": true } }
+        })],
+        &Value::String("call".to_owned()),
+    )
+    .expect_err("JSON-RPC error is returned");
+    assert!(matches!(
+        error,
+        StreamableHttpError::JsonRpc { code: -32602, .. }
+    ));
+}
+
+#[test]
+fn outgoing_json_rpc_rejects_fractional_and_ambiguous_responses() {
+    for message in [
+        json!({ "jsonrpc": "2.0", "id": 1.5, "method": "tools/list" }),
+        json!({ "jsonrpc": "2.0", "result": {} }),
+        json!({ "jsonrpc": "2.0", "id": 1, "result": {}, "error": { "code": -1, "message": "bad" } }),
+    ] {
+        assert!(matches!(
+            super::validate_outgoing_message(&message),
+            Err(StreamableHttpError::InvalidRequest)
+        ));
+    }
+}
+
+#[tokio::test]
+async fn notifications_are_validated_and_never_classified_as_responses() {
+    let transport = make_transport("http://127.0.0.1:1/mcp".to_owned());
+    let mut changes = transport.subscribe_tool_list_changed();
+    let generation = transport.lock_state().generation;
+    assert!(matches!(
+        transport
+            .handle_server_message(
+                &json!({
+                    "method": "notifications/tools/list_changed",
+                    "result": {}
+                }),
+                generation,
+            )
+            .await,
+        Err(StreamableHttpError::InvalidResponse)
+    ));
+    assert!(matches!(
+        changes.try_recv(),
+        Err(tokio::sync::broadcast::error::TryRecvError::Empty)
+    ));
+    assert!(
+        !transport
+            .handle_server_message(
+                &json!({ "jsonrpc": "2.0", "method": "notifications/progress", "params": {} }),
+                generation,
+            )
+            .await
+            .expect("valid notification is accepted")
+    );
+}
+
+#[test]
+fn sse_retry_is_bounded_and_retained_for_reconnect() {
+    let mut decoder = super::SseDecoder::default();
+    assert_eq!(decoder.retry_delay(), std::time::Duration::from_millis(250));
+    decoder
+        .push(b"retry: 60000\nid: one\ndata:\n\n")
+        .expect("retry event parses");
+    assert_eq!(decoder.retry_delay(), std::time::Duration::from_secs(10));
+    assert_eq!(decoder.last_event_id(), Some("one"));
+    decoder
+        .push(b"retry: 0\nid: two\ndata:\n\n")
+        .expect("minimum retry event parses");
+    assert_eq!(decoder.retry_delay(), std::time::Duration::from_millis(50));
+}
+
+#[test]
+fn unterminated_sse_event_is_discarded_without_advancing_cursor() {
+    let mut decoder = super::SseDecoder::default();
+    let events = decoder
+        .push(b"id: truncated\ndata: {\"jsonrpc\":\"2.0\",\"id\":1,\"result\":{}}")
+        .expect("partial event bytes are buffered");
+    assert!(events.is_empty());
+    assert!(
+        decoder
+            .finish()
+            .expect("partial event is discarded")
+            .is_empty()
+    );
+    assert_eq!(decoder.last_event_id(), None);
+}
+
+#[test]
+fn sse_accepts_bom_and_all_standard_line_endings_across_chunks() {
+    for body in [
+        b"data: {\"jsonrpc\":\"2.0\",\"id\":1,\"result\":{}}\n\n".as_slice(),
+        b"data: {\"jsonrpc\":\"2.0\",\"id\":1,\"result\":{}}\r\n\r\n".as_slice(),
+        b"data: {\"jsonrpc\":\"2.0\",\"id\":1,\"result\":{}}\r\r".as_slice(),
+    ] {
+        let parsed = super::parse_sse(body).expect("standard SSE line endings parse");
+        assert_eq!(parsed[0]["id"], 1);
+    }
+
+    let mut decoder = super::SseDecoder::default();
+    assert!(
+        decoder
+            .push(&[0xef])
+            .expect("BOM prefix buffers")
+            .is_empty()
+    );
+    assert!(
+        decoder
+            .push(b"\xbb\xbfdata: {\"jsonrpc\":\"2.0\",\"id\":2,\"result\":{}}\r")
+            .expect("split BOM and CR buffer")
+            .is_empty()
+    );
+    let mut events = decoder.push(b"\r").expect("lone CR boundary parses");
+    events.extend(decoder.finish().expect("stream finishes"));
+    assert_eq!(events[0].message.as_ref().expect("message exists")["id"], 2);
+}
+
+#[test]
+fn sse_trickle_and_many_data_lines_remain_linearly_bounded() {
+    let mut decoder = super::SseDecoder::default();
+    for _ in 0..10_000 {
+        assert!(decoder.push(b"x").expect("trickle byte buffers").is_empty());
+        assert_eq!(decoder.scan_offset, decoder.pending.len());
+    }
+    assert!(
+        decoder
+            .finish()
+            .expect("trickle stream finishes")
+            .is_empty()
+    );
+
+    let mut body = Vec::new();
+    for _ in 0..10_000 {
+        body.extend_from_slice(b"data:\n");
+    }
+    body.extend_from_slice(b"data: {\"jsonrpc\":\"2.0\",\"id\":3,\"result\":{}}\n\n");
+    let messages = super::parse_sse(&body).expect("many bounded data lines parse");
+    assert_eq!(messages[0]["id"], 3);
+}
+
+#[tokio::test]
+async fn generation_change_during_retry_delay_prevents_stale_resume_get() {
+    let initialize = json!({
+        "jsonrpc": "2.0",
+        "id": 0,
+        "result": { "protocolVersion": "2025-11-25", "capabilities": {} }
+    })
+    .to_string();
+    let server = TestServer::start(vec![
+        response(
+            "200 OK",
+            &[
+                ("Content-Type", "application/json"),
+                ("Mcp-Session-Id", "retry-session"),
+            ],
+            &initialize,
+        ),
+        response("202 Accepted", &[], ""),
+        response(
+            "200 OK",
+            &[("Content-Type", "text/event-stream")],
+            "retry: 100\nid: retry-1\ndata:\n\n",
+        ),
+    ])
+    .await;
+    let transport = make_transport(server.endpoint.clone());
+    transport
+        .initialize()
+        .await
+        .expect("initialization succeeds");
+    let listing = {
+        let transport = transport.clone();
+        tokio::spawn(async move { transport.list_tools(None, json!(4)).await })
+    };
+    tokio::time::sleep(std::time::Duration::from_millis(20)).await;
+    transport.reset_state().await;
+
+    assert!(matches!(
+        listing.await.expect("listing task completes"),
+        Err(StreamableHttpError::SessionInvalidated)
+    ));
+    let requests = server.finish().await;
+    assert_eq!(requests.len(), 3);
+}
+
+#[tokio::test]
+async fn stale_responses_cannot_restore_an_invalidated_session() {
+    let transport = make_transport("http://127.0.0.1:1/mcp".to_owned());
+    {
+        let mut state = transport.lock_state();
+        state.initialized = true;
+        state.session_id = Some("old".to_owned());
+    }
+    let generation = transport.lock_state().generation;
+    transport.reset_state().await;
+    let response = OutboundResponse {
+        status: reqwest::StatusCode::OK,
+        headers: [(super::MCP_SESSION_ID, "old".parse().unwrap())]
+            .into_iter()
+            .collect(),
+        body: Vec::new(),
+        final_url: "http://127.0.0.1:1/mcp".parse().unwrap(),
+    };
+
+    assert!(matches!(
+        transport
+            .accept_response_session(&response.headers, generation, false)
+            .await,
+        Err(StreamableHttpError::SessionInvalidated)
+    ));
+    assert_eq!(transport.session_id().await, None);
+}
+
+#[tokio::test]
+async fn only_initialize_can_establish_a_session() {
+    let transport = make_transport("http://127.0.0.1:1/mcp".to_owned());
+    transport.lock_state().initialized = true;
+    let generation = transport.lock_state().generation;
+    let response = OutboundResponse {
+        status: reqwest::StatusCode::OK,
+        headers: [(super::MCP_SESSION_ID, "late".parse().unwrap())]
+            .into_iter()
+            .collect(),
+        body: Vec::new(),
+        final_url: "http://127.0.0.1:1/mcp".parse().unwrap(),
+    };
+
+    assert!(matches!(
+        transport
+            .accept_response_session(&response.headers, generation, false)
+            .await,
+        Err(StreamableHttpError::InvalidSessionId)
+    ));
+    assert_eq!(transport.session_id().await, None);
+}
+
+#[tokio::test]
+async fn invalid_resumed_session_header_invalidates_local_state() {
+    let transport = make_transport("http://127.0.0.1:1/mcp".to_owned());
+    {
+        let mut state = transport.lock_state();
+        state.initialized = true;
+        state.session_id = Some("expected".to_owned());
+    }
+    let generation = transport.lock_state().generation;
+    let headers = [(super::MCP_SESSION_ID, "changed".parse().unwrap())]
+        .into_iter()
+        .collect();
+
+    assert!(matches!(
+        transport
+            .accept_response_session_or_reset(&headers, generation, false)
+            .await,
+        Err(StreamableHttpError::SessionChanged)
+    ));
+    assert_eq!(transport.session_id().await, None);
+    assert!(matches!(
+        transport.list_tools(None, json!(1)).await,
+        Err(StreamableHttpError::NotInitialized)
+    ));
+}
+
+#[tokio::test]
+async fn auxiliary_responses_enforce_session_expiry_and_header_pinning() {
+    for (status, response_headers, expected_changed) in [
+        ("404 Not Found", Vec::new(), false),
+        ("202 Accepted", vec![("Mcp-Session-Id", "different")], true),
+    ] {
+        let server = TestServer::start(vec![response(status, &response_headers, "")]).await;
+        let transport = make_transport(server.endpoint.clone());
+        {
+            let mut state = transport.lock_state();
+            state.initialized = true;
+            state.session_id = Some("expected".to_owned());
+            state.negotiated_protocol_version = Some(rmcp::model::ProtocolVersion::V_2025_11_25);
+        }
+        let generation = transport.lock_state().generation;
+        let error = transport
+            .post_auxiliary_response(
+                json!({ "jsonrpc": "2.0", "id": "server", "result": {} }),
+                generation,
+            )
+            .await
+            .expect_err("invalid auxiliary session response is rejected");
+        if expected_changed {
+            assert!(matches!(error, StreamableHttpError::SessionChanged));
+        } else {
+            assert!(matches!(error, StreamableHttpError::SessionExpired));
+        }
+        assert_eq!(transport.session_id().await, None);
+        server.finish().await;
+    }
+}
+
+#[tokio::test]
+async fn auxiliary_headers_invalidate_session_before_stalled_or_oversized_body() {
+    let listener = TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("test listener binds");
+    let endpoint = format!(
+        "http://{}/mcp",
+        listener.local_addr().expect("listener has an address")
+    );
+    let server = tokio::spawn(async move {
+        let (mut stream, _) = listener.accept().await.expect("auxiliary POST accepts");
+        let mut request = vec![0_u8; 8192];
+        let read = stream
+            .read(&mut request)
+            .await
+            .expect("auxiliary POST reads");
+        assert!(read > 0, "auxiliary request is not empty");
+        stream
+            .write_all(b"HTTP/1.1 404 Not Found\r\n\r\n")
+            .await
+            .expect("stalled 404 headers write");
+        stream.flush().await.expect("stalled 404 headers flush");
+        tokio::time::sleep(std::time::Duration::from_secs(2)).await;
+    });
+    let transport = make_transport(endpoint);
+    {
+        let mut state = transport.lock_state();
+        state.initialized = true;
+        state.session_id = Some("expected".to_owned());
+        state.negotiated_protocol_version = Some(rmcp::model::ProtocolVersion::V_2025_11_25);
+    }
+    let generation = transport.lock_state().generation;
+    let error = tokio::time::timeout(
+        std::time::Duration::from_millis(300),
+        transport.post_auxiliary_response(
+            json!({ "jsonrpc": "2.0", "id": "server", "result": {} }),
+            generation,
+        ),
+    )
+    .await
+    .expect("404 invalidates before stalled body")
+    .expect_err("stalled 404 expires session");
+    assert!(matches!(error, StreamableHttpError::SessionExpired));
+    assert_eq!(transport.session_id().await, None);
+    server.abort();
+
+    let server = TestServer::start(vec![
+        "HTTP/1.1 202 Accepted\r\nMcp-Session-Id: changed\r\nContent-Length: 16777217\r\n\r\n"
+            .to_owned(),
+    ])
+    .await;
+    let transport = make_transport(server.endpoint.clone());
+    {
+        let mut state = transport.lock_state();
+        state.initialized = true;
+        state.session_id = Some("expected".to_owned());
+        state.negotiated_protocol_version = Some(rmcp::model::ProtocolVersion::V_2025_11_25);
+    }
+    let generation = transport.lock_state().generation;
+    assert!(matches!(
+        transport
+            .post_auxiliary_response(
+                json!({ "jsonrpc": "2.0", "id": "server", "result": {} }),
+                generation,
+            )
+            .await,
+        Err(StreamableHttpError::SessionChanged)
+    ));
+    assert_eq!(transport.session_id().await, None);
+    server.finish().await;
+}
diff --git a/src/mcp/upstream/mod.rs b/src/mcp/upstream/mod.rs
new file mode 100644
index 000000000..e6c514207
--- /dev/null
+++ b/src/mcp/upstream/mod.rs
@@ -0,0 +1,2 @@
+pub mod http;
+pub mod stdio;
diff --git a/src/mcp/upstream/stdio/mod.rs b/src/mcp/upstream/stdio/mod.rs
new file mode 100644
index 000000000..2bdd654ee
--- /dev/null
+++ b/src/mcp/upstream/stdio/mod.rs
@@ -0,0 +1,2870 @@
+use std::{
+    collections::{BTreeMap, HashMap},
+    future::pending,
+    io,
+    io::Read as _,
+    path::{Path, PathBuf},
+    process::{ExitStatus, Stdio},
+    sync::atomic::{AtomicU64, Ordering},
+    time::Duration,
+};
+
+use rmcp::model::ProtocolVersion;
+use serde::{Deserialize, Serialize};
+use serde_json::{Value, json};
+use thiserror::Error;
+use tokio::{
+    io::{AsyncBufReadExt, AsyncRead, AsyncReadExt, AsyncWrite, AsyncWriteExt, BufReader},
+    process::{Child, ChildStdout, Command},
+    sync::{OwnedSemaphorePermit, Semaphore, broadcast, mpsc, oneshot},
+    task::JoinHandle,
+    time::{Instant, timeout, timeout_at},
+};
+
+const MAX_TEMPLATE_NAME_BYTES: usize = 64;
+const MAX_ARGUMENTS: usize = 128;
+const MAX_ENVIRONMENT_ENTRIES: usize = 128;
+const MAX_ARGUMENT_BYTES: usize = 8 * 1024;
+const MAX_ENVIRONMENT_VALUE_BYTES: usize = 16 * 1024;
+const MAX_TEMPLATE_BYTES: usize = 128 * 1024;
+const MAX_TEMPLATES: usize = 256;
+const MAX_CONFIG_FILE_BYTES: u64 = 1024 * 1024;
+const TOOL_LIST_CHANGED_CAPACITY: usize = 64;
+const LIFECYCLE_STATE_MASK: u64 = 0b11;
+const LIFECYCLE_UNINITIALIZED: u64 = 0;
+const LIFECYCLE_INITIALIZING: u64 = 1;
+const LIFECYCLE_INITIALIZED: u64 = 2;
+const MAX_LIFECYCLE_GENERATION: u64 = u64::MAX >> 2;
+pub const DEFAULT_PROTOCOL_VERSION: ProtocolVersion = ProtocolVersion::V_2025_11_25;
+
+fn lifecycle_word(generation: u64, state: u64) -> u64 {
+    ((generation & MAX_LIFECYCLE_GENERATION) << 2) | (state & LIFECYCLE_STATE_MASK)
+}
+
+fn lifecycle_state(word: u64) -> u64 {
+    word & LIFECYCLE_STATE_MASK
+}
+
+fn lifecycle_generation(word: u64) -> u64 {
+    word >> 2
+}
+
+fn acquire_lifecycle_generation(lifecycle: &AtomicU64) -> Result<u64, StdioTransportError> {
+    let mut current = lifecycle.load(Ordering::Acquire);
+    loop {
+        if lifecycle_state(current) != LIFECYCLE_UNINITIALIZED {
+            return Err(StdioTransportError::AlreadyInitialized);
+        }
+        let generation =
+            (lifecycle_generation(current).wrapping_add(1) & MAX_LIFECYCLE_GENERATION).max(1);
+        let next = lifecycle_word(generation, LIFECYCLE_INITIALIZING);
+        match lifecycle.compare_exchange_weak(current, next, Ordering::AcqRel, Ordering::Acquire) {
+            Ok(_) => return Ok(generation),
+            Err(observed) => current = observed,
+        }
+    }
+}
+
+fn reset_lifecycle_generation(lifecycle: &AtomicU64, generation: u64) {
+    let _ = lifecycle.fetch_update(Ordering::AcqRel, Ordering::Acquire, |current| {
+        (lifecycle_generation(current) == generation)
+            .then(|| lifecycle_word(generation, LIFECYCLE_UNINITIALIZED))
+    });
+}
+
+fn reset_lifecycle_current(lifecycle: &AtomicU64) {
+    let _ = lifecycle.fetch_update(Ordering::AcqRel, Ordering::Acquire, |current| {
+        Some(lifecycle_word(
+            lifecycle_generation(current),
+            LIFECYCLE_UNINITIALIZED,
+        ))
+    });
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct StdioTemplate {
+    pub name: String,
+    pub executable: PathBuf,
+    #[serde(default)]
+    pub cwd: Option<PathBuf>,
+    #[serde(default)]
+    pub arguments: Vec<String>,
+    #[serde(default)]
+    pub environment: BTreeMap<String, String>,
+    #[serde(default)]
+    pub secret_environment: Vec<String>,
+}
+
+#[derive(Clone)]
+pub(crate) struct TrustedStdioTemplate {
+    name: String,
+    executable: PathBuf,
+    cwd: Option<PathBuf>,
+    arguments: Vec<String>,
+    environment: BTreeMap<String, String>,
+    secret_environment: Vec<String>,
+}
+
+impl std::fmt::Debug for TrustedStdioTemplate {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("TrustedStdioTemplate")
+            .field("name", &self.name)
+            .field("secret_environment", &self.secret_environment)
+            .finish_non_exhaustive()
+    }
+}
+
+impl TrustedStdioTemplate {
+    pub(crate) fn validate(template: StdioTemplate) -> Result<Self, StdioTemplateError> {
+        validate_template_name(&template.name)?;
+        if !template.executable.is_absolute() {
+            return Err(StdioTemplateError::ExecutableMustBeAbsolute);
+        }
+        let executable = std::fs::canonicalize(&template.executable)
+            .map_err(|_| StdioTemplateError::ExecutableUnavailable)?;
+        let metadata = std::fs::metadata(&executable)
+            .map_err(|_| StdioTemplateError::ExecutableUnavailable)?;
+        if !metadata.is_file() {
+            return Err(StdioTemplateError::ExecutableUnavailable);
+        }
+        validate_executable_permissions(&metadata)?;
+        let cwd = match template.cwd {
+            Some(cwd) => {
+                if !cwd.is_absolute() {
+                    return Err(StdioTemplateError::CwdMustBeAbsolute);
+                }
+                let cwd =
+                    std::fs::canonicalize(cwd).map_err(|_| StdioTemplateError::CwdUnavailable)?;
+                if !std::fs::metadata(&cwd)
+                    .map_err(|_| StdioTemplateError::CwdUnavailable)?
+                    .is_dir()
+                {
+                    return Err(StdioTemplateError::CwdUnavailable);
+                }
+                Some(cwd)
+            }
+            None => None,
+        };
+        validate_arguments(&template.arguments)?;
+        validate_environment(&template.environment)?;
+        validate_secret_environment(&template.secret_environment, &template.environment)?;
+
+        Ok(Self {
+            name: template.name,
+            executable,
+            cwd,
+            arguments: template.arguments,
+            environment: template.environment,
+            secret_environment: template.secret_environment,
+        })
+    }
+}
+
+#[derive(Clone, Debug, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct StdioTemplateDescriptor {
+    pub name: String,
+    pub secret_fields: Vec<String>,
+}
+
+#[derive(Clone, Debug, Default)]
+pub struct StdioTemplateRegistry {
+    templates: BTreeMap<String, TrustedStdioTemplate>,
+}
+
+impl StdioTemplateRegistry {
+    pub fn new(templates: Vec<StdioTemplate>) -> Result<Self, StdioTemplateError> {
+        if templates.len() > MAX_TEMPLATES {
+            return Err(StdioTemplateError::TooManyTemplates);
+        }
+        let mut registry = Self::default();
+        for template in templates {
+            let template = TrustedStdioTemplate::validate(template)?;
+            if registry
+                .templates
+                .insert(template.name.clone(), template)
+                .is_some()
+            {
+                return Err(StdioTemplateError::DuplicateName);
+            }
+        }
+        Ok(registry)
+    }
+
+    pub fn load(path: impl AsRef<Path>) -> Result<Self, StdioTemplateError> {
+        let file = std::fs::File::open(path).map_err(|_| StdioTemplateError::ConfigRead)?;
+        if file
+            .metadata()
+            .map_err(|_| StdioTemplateError::ConfigRead)?
+            .len()
+            > MAX_CONFIG_FILE_BYTES
+        {
+            return Err(StdioTemplateError::ConfigTooLarge);
+        }
+        let mut bytes = Vec::new();
+        file.take(MAX_CONFIG_FILE_BYTES + 1)
+            .read_to_end(&mut bytes)
+            .map_err(|_| StdioTemplateError::ConfigRead)?;
+        if bytes.len() as u64 > MAX_CONFIG_FILE_BYTES {
+            return Err(StdioTemplateError::ConfigTooLarge);
+        }
+        let config: StdioTemplateFile =
+            serde_json::from_slice(&bytes).map_err(|_| StdioTemplateError::ConfigInvalid)?;
+        Self::new(config.templates)
+    }
+
+    pub(crate) fn template(&self, name: &str) -> Result<&TrustedStdioTemplate, StdioTemplateError> {
+        self.templates
+            .get(name)
+            .ok_or(StdioTemplateError::UnknownTemplate)
+    }
+
+    pub fn descriptors(&self) -> Vec<StdioTemplateDescriptor> {
+        self.templates
+            .values()
+            .map(|template| StdioTemplateDescriptor {
+                name: template.name.clone(),
+                secret_fields: template.secret_environment.clone(),
+            })
+            .collect()
+    }
+
+    pub async fn connect_with_secrets(
+        &self,
+        name: &str,
+        secrets: &BTreeMap<String, String>,
+        limits: StdioTransportLimits,
+    ) -> Result<StdioClient, StdioTransportError> {
+        let mut template = self.template(name)?.clone();
+        validate_secret_overlay(&template.secret_environment, secrets)?;
+        template.environment.extend(secrets.clone());
+        validate_environment(&template.environment)?;
+        StdioClient::connect(template, limits).await
+    }
+}
+
+#[derive(Debug, Error)]
+pub enum StdioTemplateError {
+    #[error("the stdio template configuration could not be read")]
+    ConfigRead,
+    #[error("the stdio template configuration is too large")]
+    ConfigTooLarge,
+    #[error("the stdio template configuration is invalid")]
+    ConfigInvalid,
+    #[error("the stdio template configuration has too many templates")]
+    TooManyTemplates,
+    #[error("the stdio template name is invalid")]
+    InvalidName,
+    #[error("stdio template names must be unique")]
+    DuplicateName,
+    #[error("the named stdio template does not exist")]
+    UnknownTemplate,
+    #[error("the stdio executable must be an absolute path")]
+    ExecutableMustBeAbsolute,
+    #[error("the stdio executable is unavailable")]
+    ExecutableUnavailable,
+    #[error("the stdio executable is not executable")]
+    ExecutableNotExecutable,
+    #[error("the stdio working directory must be an absolute path")]
+    CwdMustBeAbsolute,
+    #[error("the stdio working directory is unavailable")]
+    CwdUnavailable,
+    #[error("the stdio template has too many arguments")]
+    TooManyArguments,
+    #[error("a stdio template argument is too large")]
+    ArgumentTooLarge,
+    #[error("the stdio template has too many environment entries")]
+    TooManyEnvironmentEntries,
+    #[error("a stdio template environment entry is invalid")]
+    InvalidEnvironmentEntry,
+    #[error("the stdio template is too large")]
+    TemplateTooLarge,
+    #[error("the stdio template secret fields are invalid")]
+    InvalidSecretFields,
+    #[error("the supplied stdio template secrets do not match the approved fields")]
+    InvalidSecretOverlay,
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct StdioTemplateFile {
+    templates: Vec<StdioTemplate>,
+}
+
+#[derive(Clone, Copy, Debug)]
+pub struct StdioTransportLimits {
+    pub max_message_bytes: usize,
+    pub max_stderr_bytes: usize,
+    pub request_timeout: Duration,
+    pub shutdown_grace: Duration,
+    pub initial_restart_backoff: Duration,
+    pub max_restart_backoff: Duration,
+    pub command_queue_capacity: usize,
+}
+
+impl Default for StdioTransportLimits {
+    fn default() -> Self {
+        Self {
+            max_message_bytes: 16 * 1024 * 1024,
+            max_stderr_bytes: 64 * 1024,
+            request_timeout: Duration::from_secs(60),
+            shutdown_grace: Duration::from_secs(2),
+            initial_restart_backoff: Duration::from_millis(100),
+            max_restart_backoff: Duration::from_secs(5),
+            command_queue_capacity: 256,
+        }
+    }
+}
+
+impl StdioTransportLimits {
+    fn validate(self) -> Result<Self, StdioTransportError> {
+        if self.max_message_bytes == 0
+            || self.max_message_bytes > 32 * 1024 * 1024
+            || self.max_stderr_bytes == 0
+            || self.max_stderr_bytes > 1024 * 1024
+            || self.request_timeout.is_zero()
+            || self.request_timeout > Duration::from_secs(5 * 60)
+            || self.shutdown_grace.is_zero()
+            || self.shutdown_grace > Duration::from_secs(30)
+            || self.initial_restart_backoff.is_zero()
+            || self.initial_restart_backoff > Duration::from_secs(30)
+            || self.max_restart_backoff < self.initial_restart_backoff
+            || self.max_restart_backoff > Duration::from_secs(30)
+            || self.request_timeout <= self.max_restart_backoff
+            || self.command_queue_capacity == 0
+            || self.command_queue_capacity > 4_096
+        {
+            return Err(StdioTransportError::InvalidLimits);
+        }
+        Ok(self)
+    }
+}
+
+#[derive(Clone, Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct McpServerInfo {
+    pub name: String,
+    pub version: String,
+    #[serde(default)]
+    pub title: Option<String>,
+}
+
+#[derive(Clone, Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct InitializeResult {
+    pub protocol_version: ProtocolVersion,
+    #[serde(default)]
+    pub capabilities: Value,
+    #[serde(default)]
+    pub server_info: Option<McpServerInfo>,
+    #[serde(default)]
+    pub instructions: Option<String>,
+}
+
+#[derive(Clone, Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct McpTool {
+    pub name: String,
+    #[serde(default)]
+    pub title: Option<String>,
+    #[serde(default)]
+    pub description: Option<String>,
+    #[serde(default)]
+    pub input_schema: Value,
+    #[serde(default)]
+    pub output_schema: Option<Value>,
+    #[serde(default)]
+    pub annotations: Option<Value>,
+}
+
+#[derive(Clone, Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ListToolsResult {
+    #[serde(default)]
+    pub tools: Vec<McpTool>,
+    #[serde(default)]
+    pub next_cursor: Option<String>,
+}
+
+#[derive(Clone, Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct CallToolResult {
+    #[serde(default)]
+    pub content: Vec<Value>,
+    #[serde(default)]
+    pub structured_content: Option<Value>,
+    #[serde(default)]
+    pub is_error: bool,
+}
+
+#[derive(Debug, Error)]
+pub enum StdioTransportError {
+    #[error(transparent)]
+    Template(#[from] StdioTemplateError),
+    #[error("the stdio transport limits are invalid")]
+    InvalidLimits,
+    #[error("the stdio process could not be started")]
+    Spawn,
+    #[error("the stdio transport command queue is closed")]
+    Closed,
+    #[error("the stdio transport must be initialized again after restart")]
+    RestartRequiresInitialization,
+    #[error("the stdio transport has not been initialized")]
+    NotInitialized,
+    #[error("the stdio transport is already initialized")]
+    AlreadyInitialized,
+    #[error("the stdio request timed out")]
+    Timeout,
+    #[error("the stdio request is too large")]
+    RequestTooLarge,
+    #[error("the stdio response is too large")]
+    ResponseTooLarge,
+    #[error("the stdio server returned an invalid JSON-RPC message")]
+    InvalidResponse,
+    #[error("the stdio server returned JSON-RPC error code {code}")]
+    JsonRpc { code: i64 },
+    #[error("the stdio process exited unexpectedly")]
+    ProcessExited {
+        code: Option<i32>,
+        stderr_truncated: bool,
+    },
+    #[error("the tool call outcome is unknown because the stdio transport disconnected")]
+    AmbiguousToolCall,
+    #[error("the stdio request ID is already in flight")]
+    DuplicateRequestId,
+    #[error("the stdio transport has too many requests in flight")]
+    TooManyInFlight,
+    #[error("the stdio response did not match an in-flight request")]
+    UnexpectedResponseId,
+    #[error("the stdio request could not be encoded")]
+    Encode,
+    #[error("the stdio response could not be decoded")]
+    Decode,
+    #[error("the stdio request is invalid")]
+    InvalidRequest,
+    #[error("the stdio server selected an unsupported protocol version")]
+    ProtocolVersionMismatch,
+}
+
+pub struct StdioClient {
+    commands: mpsc::Sender<ClientCommand>,
+    tool_list_changed: broadcast::Sender<()>,
+    queue_bytes: std::sync::Arc<Semaphore>,
+    lifecycle: std::sync::Arc<AtomicU64>,
+    actor: Option<JoinHandle<()>>,
+    next_request_id: AtomicU64,
+    request_timeout: Duration,
+    max_message_bytes: usize,
+}
+
+#[derive(Clone)]
+pub(crate) struct StdioLifecycleMonitor {
+    lifecycle: std::sync::Arc<AtomicU64>,
+}
+
+impl StdioLifecycleMonitor {
+    pub(crate) fn is_initialized(&self) -> bool {
+        lifecycle_state(self.lifecycle.load(Ordering::Acquire)) == LIFECYCLE_INITIALIZED
+    }
+
+    #[cfg(test)]
+    pub(crate) fn initialized_fixture() -> Self {
+        Self {
+            lifecycle: std::sync::Arc::new(AtomicU64::new(lifecycle_word(
+                1,
+                LIFECYCLE_INITIALIZED,
+            ))),
+        }
+    }
+
+    #[cfg(test)]
+    pub(crate) fn disconnect_fixture(&self) {
+        reset_lifecycle_current(&self.lifecycle);
+    }
+}
+
+impl StdioClient {
+    pub(crate) async fn connect(
+        template: TrustedStdioTemplate,
+        limits: StdioTransportLimits,
+    ) -> Result<Self, StdioTransportError> {
+        let limits = limits.validate()?;
+        let process = RunningProcess::spawn(&template, limits).await?;
+        let (commands, receiver) = mpsc::channel(limits.command_queue_capacity);
+        let (tool_list_changed, _) = broadcast::channel(TOOL_LIST_CHANGED_CAPACITY);
+        let queue_bytes =
+            std::sync::Arc::new(Semaphore::new(limits.max_message_bytes.saturating_mul(2)));
+        let lifecycle =
+            std::sync::Arc::new(AtomicU64::new(lifecycle_word(0, LIFECYCLE_UNINITIALIZED)));
+        let actor = tokio::spawn(run_actor(
+            template,
+            limits,
+            process,
+            receiver,
+            tool_list_changed.clone(),
+            lifecycle.clone(),
+        ));
+        Ok(Self {
+            commands,
+            tool_list_changed,
+            queue_bytes,
+            lifecycle,
+            actor: Some(actor),
+            next_request_id: AtomicU64::new(1),
+            request_timeout: limits.request_timeout,
+            max_message_bytes: limits.max_message_bytes,
+        })
+    }
+
+    pub async fn initialize(
+        &self,
+        protocol_version: ProtocolVersion,
+        client_info: Value,
+        capabilities: Value,
+    ) -> Result<InitializeResult, StdioTransportError> {
+        let generation = acquire_lifecycle_generation(&self.lifecycle)?;
+        let mut guard =
+            InitializationGuard::new(self.lifecycle.clone(), self.commands.clone(), generation);
+        let result = self
+            .initialize_inner(protocol_version, client_info, capabilities, generation)
+            .await;
+        if result.is_err() {
+            self.reset_transport(generation).await;
+        }
+        match result {
+            Ok(initialized) => {
+                self.lifecycle
+                    .compare_exchange(
+                        lifecycle_word(generation, LIFECYCLE_INITIALIZING),
+                        lifecycle_word(generation, LIFECYCLE_INITIALIZED),
+                        Ordering::AcqRel,
+                        Ordering::Acquire,
+                    )
+                    .map_err(|_| StdioTransportError::Closed)?;
+                guard.disarm();
+                let _ = self
+                    .commands
+                    .try_send(ClientCommand::Healthy { generation });
+                Ok(initialized)
+            }
+            Err(error) => {
+                if lifecycle_state(self.lifecycle.load(Ordering::Acquire))
+                    == LIFECYCLE_UNINITIALIZED
+                {
+                    guard.disarm();
+                }
+                Err(error)
+            }
+        }
+    }
+
+    async fn initialize_inner(
+        &self,
+        protocol_version: ProtocolVersion,
+        client_info: Value,
+        capabilities: Value,
+        generation: u64,
+    ) -> Result<InitializeResult, StdioTransportError> {
+        if protocol_version != DEFAULT_PROTOCOL_VERSION
+            || !client_info.is_object()
+            || !capabilities.is_object()
+        {
+            return Err(StdioTransportError::InvalidRequest);
+        }
+        let result = self
+            .request(
+                self.next_id(),
+                "initialize",
+                json!({
+                    "protocolVersion": protocol_version,
+                    "clientInfo": client_info,
+                    "capabilities": capabilities,
+                }),
+                RequestSemantics::Replayable,
+                Some(generation),
+            )
+            .await?;
+        let initialized: InitializeResult =
+            serde_json::from_value(result).map_err(|_| StdioTransportError::Decode)?;
+        if initialized.protocol_version != DEFAULT_PROTOCOL_VERSION {
+            return Err(StdioTransportError::ProtocolVersionMismatch);
+        }
+        if !initialized.capabilities.is_object() {
+            return Err(StdioTransportError::Decode);
+        }
+        self.notify("notifications/initialized", json!({}), Some(generation))
+            .await?;
+        Ok(initialized)
+    }
+
+    pub async fn list_tools(
+        &self,
+        cursor: Option<&str>,
+    ) -> Result<ListToolsResult, StdioTransportError> {
+        self.require_initialized()?;
+        if cursor.is_some_and(|cursor| cursor.len() > 16 * 1024) {
+            return Err(StdioTransportError::InvalidRequest);
+        }
+        let params = cursor.map_or_else(|| json!({}), |cursor| json!({ "cursor": cursor }));
+        let result = self
+            .request(
+                self.next_id(),
+                "tools/list",
+                params,
+                RequestSemantics::Replayable,
+                None,
+            )
+            .await?;
+        let result: ListToolsResult =
+            serde_json::from_value(result).map_err(|_| StdioTransportError::Decode)?;
+        if result.tools.iter().any(|tool| {
+            tool.name.is_empty() || tool.name.len() > 1_024 || !tool.input_schema.is_object()
+        }) {
+            return Err(StdioTransportError::Decode);
+        }
+        Ok(result)
+    }
+
+    pub async fn call_tool(
+        &self,
+        name: &str,
+        arguments: Value,
+        request_id: u64,
+    ) -> Result<CallToolResult, StdioTransportError> {
+        self.require_initialized()?;
+        if name.is_empty() || name.len() > 1_024 || !arguments.is_object() {
+            return Err(StdioTransportError::InvalidRequest);
+        }
+        let result = self
+            .request(
+                request_id,
+                "tools/call",
+                json!({ "name": name, "arguments": arguments }),
+                RequestSemantics::AmbiguousAfterWrite,
+                None,
+            )
+            .await?;
+        if result
+            .get("structuredContent")
+            .is_some_and(|structured_content| !structured_content.is_object())
+        {
+            return Err(StdioTransportError::Decode);
+        }
+        let result: CallToolResult =
+            serde_json::from_value(result).map_err(|_| StdioTransportError::Decode)?;
+        if result.content.iter().any(|content| !content.is_object()) {
+            return Err(StdioTransportError::Decode);
+        }
+        Ok(result)
+    }
+
+    fn require_initialized(&self) -> Result<(), StdioTransportError> {
+        if lifecycle_state(self.lifecycle.load(Ordering::Acquire)) == LIFECYCLE_INITIALIZED {
+            Ok(())
+        } else {
+            Err(StdioTransportError::NotInitialized)
+        }
+    }
+
+    pub fn subscribe_tool_list_changed(&self) -> broadcast::Receiver<()> {
+        self.tool_list_changed.subscribe()
+    }
+
+    #[cfg(test)]
+    pub(crate) fn is_initialized(&self) -> bool {
+        lifecycle_state(self.lifecycle.load(Ordering::Acquire)) == LIFECYCLE_INITIALIZED
+    }
+
+    pub(crate) fn lifecycle_monitor(&self) -> StdioLifecycleMonitor {
+        StdioLifecycleMonitor {
+            lifecycle: self.lifecycle.clone(),
+        }
+    }
+
+    pub async fn shutdown(mut self) {
+        let (completed, completion) = oneshot::channel();
+        let _ = self
+            .commands
+            .send(ClientCommand::Shutdown {
+                completed: Some(completed),
+            })
+            .await;
+        let _ = completion.await;
+        if let Some(actor) = self.actor.take() {
+            let _ = actor.await;
+        }
+    }
+
+    fn next_id(&self) -> u64 {
+        self.next_request_id.fetch_add(1, Ordering::Relaxed)
+    }
+
+    async fn request(
+        &self,
+        id: u64,
+        method: &str,
+        params: Value,
+        semantics: RequestSemantics,
+        generation: Option<u64>,
+    ) -> Result<Value, StdioTransportError> {
+        let payload = encode_message(
+            &json!({ "jsonrpc": "2.0", "id": id, "method": method, "params": params }),
+            self.max_message_bytes,
+        )?;
+        let deadline = Instant::now() + self.request_timeout;
+        let permit = timeout_at(
+            deadline,
+            self.queue_bytes
+                .clone()
+                .acquire_many_owned(payload.len().max(1) as u32),
+        )
+        .await
+        .map_err(|_| StdioTransportError::Timeout)?
+        .map_err(|_| StdioTransportError::Closed)?;
+        let (reply, response) = oneshot::channel();
+        timeout_at(
+            deadline,
+            self.commands.send(ClientCommand::Request {
+                id,
+                payload,
+                permit,
+                initialization: method == "initialize",
+                generation,
+                semantics,
+                deadline,
+                reply,
+            }),
+        )
+        .await
+        .map_err(|_| StdioTransportError::Timeout)?
+        .map_err(|_| StdioTransportError::Closed)?;
+        match timeout_at(deadline, response).await {
+            Ok(response) => response.map_err(|_| StdioTransportError::Closed)?,
+            Err(_) => Err(match semantics {
+                RequestSemantics::Replayable => StdioTransportError::Timeout,
+                RequestSemantics::AmbiguousAfterWrite => StdioTransportError::AmbiguousToolCall,
+            }),
+        }
+    }
+
+    async fn notify(
+        &self,
+        method: &str,
+        params: Value,
+        generation: Option<u64>,
+    ) -> Result<(), StdioTransportError> {
+        let payload = encode_message(
+            &json!({ "jsonrpc": "2.0", "method": method, "params": params }),
+            self.max_message_bytes,
+        )?;
+        let deadline = Instant::now() + self.request_timeout;
+        let permit = timeout_at(
+            deadline,
+            self.queue_bytes
+                .clone()
+                .acquire_many_owned(payload.len().max(1) as u32),
+        )
+        .await
+        .map_err(|_| StdioTransportError::Timeout)?
+        .map_err(|_| StdioTransportError::Closed)?;
+        let (reply, response) = oneshot::channel();
+        timeout_at(
+            deadline,
+            self.commands.send(ClientCommand::Notification {
+                payload,
+                permit,
+                deadline,
+                generation,
+                reply,
+            }),
+        )
+        .await
+        .map_err(|_| StdioTransportError::Timeout)?
+        .map_err(|_| StdioTransportError::Closed)?;
+        match timeout_at(deadline, response).await {
+            Ok(response) => response.map_err(|_| StdioTransportError::Closed)?,
+            Err(_) => Err(StdioTransportError::Timeout),
+        }
+    }
+
+    async fn reset_transport(&self, generation: u64) {
+        let (completed, completion) = oneshot::channel();
+        let deadline = Instant::now() + self.request_timeout;
+        let sent = timeout_at(
+            deadline,
+            self.commands.send(ClientCommand::Reset {
+                generation,
+                completed,
+            }),
+        )
+        .await;
+        if matches!(sent, Ok(Ok(()))) {
+            let _ = timeout_at(deadline, completion).await;
+        } else {
+            reset_lifecycle_generation(&self.lifecycle, generation);
+        }
+    }
+}
+
+impl Drop for StdioClient {
+    fn drop(&mut self) {
+        if self.actor.is_none() {
+            return;
+        }
+        let _ = self
+            .commands
+            .try_send(ClientCommand::Shutdown { completed: None });
+    }
+}
+
+struct InitializationGuard {
+    lifecycle: std::sync::Arc<AtomicU64>,
+    commands: mpsc::Sender<ClientCommand>,
+    generation: u64,
+    armed: bool,
+}
+
+impl InitializationGuard {
+    fn new(
+        lifecycle: std::sync::Arc<AtomicU64>,
+        commands: mpsc::Sender<ClientCommand>,
+        generation: u64,
+    ) -> Self {
+        Self {
+            lifecycle,
+            commands,
+            generation,
+            armed: true,
+        }
+    }
+
+    fn disarm(&mut self) {
+        self.armed = false;
+    }
+}
+
+impl Drop for InitializationGuard {
+    fn drop(&mut self) {
+        if !self.armed
+            || self.lifecycle.load(Ordering::Acquire)
+                != lifecycle_word(self.generation, LIFECYCLE_INITIALIZING)
+        {
+            return;
+        }
+        let lifecycle = self.lifecycle.clone();
+        let commands = self.commands.clone();
+        let generation = self.generation;
+        let cleanup = async move {
+            let (completed, completion) = oneshot::channel();
+            if commands
+                .send(ClientCommand::Reset {
+                    generation,
+                    completed,
+                })
+                .await
+                .is_err()
+            {
+                reset_lifecycle_generation(&lifecycle, generation);
+                return;
+            }
+            if completion.await.is_err() {
+                reset_lifecycle_generation(&lifecycle, generation);
+            }
+        };
+        if let Ok(runtime) = tokio::runtime::Handle::try_current() {
+            runtime.spawn(cleanup);
+        } else {
+            reset_lifecycle_generation(&self.lifecycle, self.generation);
+        }
+    }
+}
+
+#[derive(Clone, Copy)]
+enum RequestSemantics {
+    Replayable,
+    AmbiguousAfterWrite,
+}
+
+enum ClientCommand {
+    Request {
+        id: u64,
+        payload: Vec<u8>,
+        permit: OwnedSemaphorePermit,
+        initialization: bool,
+        generation: Option<u64>,
+        semantics: RequestSemantics,
+        deadline: Instant,
+        reply: oneshot::Sender<Result<Value, StdioTransportError>>,
+    },
+    Notification {
+        payload: Vec<u8>,
+        permit: OwnedSemaphorePermit,
+        deadline: Instant,
+        generation: Option<u64>,
+        reply: oneshot::Sender<Result<(), StdioTransportError>>,
+    },
+    Reset {
+        generation: u64,
+        completed: oneshot::Sender<()>,
+    },
+    Healthy {
+        generation: u64,
+    },
+    Shutdown {
+        completed: Option<oneshot::Sender<()>>,
+    },
+}
+
+struct PendingRequest {
+    semantics: RequestSemantics,
+    generation: Option<u64>,
+    deadline: Instant,
+    reply: oneshot::Sender<Result<Value, StdioTransportError>>,
+}
+
+async fn run_actor(
+    template: TrustedStdioTemplate,
+    limits: StdioTransportLimits,
+    initial_process: RunningProcess,
+    mut commands: mpsc::Receiver<ClientCommand>,
+    tool_list_changed: broadcast::Sender<()>,
+    lifecycle: std::sync::Arc<AtomicU64>,
+) {
+    let mut process = Some(initial_process);
+    let mut pending = HashMap::<u64, PendingRequest>::new();
+    let mut restart = RestartState::default();
+
+    'actor: loop {
+        if process.is_none() {
+            let Some(command) = commands.recv().await else {
+                break;
+            };
+            if let ClientCommand::Shutdown { completed } = command {
+                if let Some(completed) = completed {
+                    let _ = completed.send(());
+                }
+                break;
+            }
+            if let ClientCommand::Reset {
+                generation,
+                completed,
+            } = command
+            {
+                reset_lifecycle_generation(&lifecycle, generation);
+                let _ = completed.send(());
+                continue;
+            }
+            if matches!(&command, ClientCommand::Healthy { .. }) {
+                continue;
+            }
+            if !matches!(
+                &command,
+                ClientCommand::Request {
+                    initialization: true,
+                    ..
+                }
+            ) {
+                reject_command(command, StdioTransportError::RestartRequiresInitialization);
+                continue;
+            }
+            let valid_generation = matches!(
+                &command,
+                ClientCommand::Request {
+                    generation: Some(generation),
+                    ..
+                } if lifecycle.load(Ordering::Acquire)
+                    == lifecycle_word(*generation, LIFECYCLE_INITIALIZING)
+            );
+            if !valid_generation {
+                reject_command(command, StdioTransportError::Closed);
+                continue;
+            }
+            if let Some(retry_at) = restart.retry_at {
+                while Instant::now() < retry_at {
+                    tokio::select! {
+                        _ = tokio::time::sleep_until(retry_at) => break,
+                        next = commands.recv() => match next {
+                            Some(ClientCommand::Shutdown { completed }) => {
+                                reject_command(command, StdioTransportError::Closed);
+                                if let Some(completed) = completed {
+                                    let _ = completed.send(());
+                                }
+                                break 'actor;
+                            }
+                            Some(ClientCommand::Reset { generation, completed }) => {
+                                reset_lifecycle_generation(&lifecycle, generation);
+                                let _ = completed.send(());
+                            }
+                            Some(ClientCommand::Healthy { .. }) => {}
+                            Some(other) => reject_command(
+                                other,
+                                StdioTransportError::RestartRequiresInitialization,
+                            ),
+                            None => {
+                                reject_command(command, StdioTransportError::Closed);
+                                break 'actor;
+                            }
+                        }
+                    }
+                }
+            }
+            if command_reply_closed(&command) {
+                continue;
+            }
+            match RunningProcess::spawn(&template, limits).await {
+                Ok(spawned) => process = Some(spawned),
+                Err(error) => {
+                    reject_command(command, error);
+                    restart.record_failure(limits);
+                    continue;
+                }
+            }
+            if let Some(running) = process.as_mut()
+                && dispatch_command(running, command, &mut pending, &lifecycle, limits)
+                    .await
+                    .is_err()
+            {
+                let error = running.stop(limits).await;
+                fail_pending(&mut pending, error);
+                reset_lifecycle_current(&lifecycle);
+                process = None;
+                restart.record_failure(limits);
+            }
+            continue;
+        }
+
+        let running = process.as_mut().expect("process presence was checked");
+        tokio::select! {
+            command = commands.recv() => {
+                let Some(command) = command else {
+                    let _ = running.stop(limits).await;
+                    break;
+                };
+                if let ClientCommand::Shutdown { completed } = command {
+                    let error = running.stop(limits).await;
+                    fail_pending(&mut pending, error);
+                    if let Some(completed) = completed {
+                        let _ = completed.send(());
+                    }
+                    break;
+                }
+                if let ClientCommand::Reset {
+                    generation,
+                    completed,
+                } = command
+                {
+                    if lifecycle_generation(lifecycle.load(Ordering::Acquire)) != generation {
+                        let _ = completed.send(());
+                        continue;
+                    }
+                    let error = running.stop(limits).await;
+                    fail_pending(&mut pending, error);
+                    reset_lifecycle_current(&lifecycle);
+                    process = None;
+                    restart.record_failure(limits);
+                    let _ = completed.send(());
+                    continue;
+                }
+                if let ClientCommand::Healthy { generation } = command {
+                    if lifecycle.load(Ordering::Acquire)
+                        == lifecycle_word(generation, LIFECYCLE_INITIALIZED)
+                    {
+                        restart.record_success();
+                    }
+                    continue;
+                }
+                if dispatch_command(
+                    running,
+                    command,
+                    &mut pending,
+                    &lifecycle,
+                    limits,
+                )
+                .await
+                .is_err()
+                {
+                    let error = running.stop(limits).await;
+                    fail_pending(&mut pending, error);
+                    reset_lifecycle_current(&lifecycle);
+                    process = None;
+                    restart.record_failure(limits);
+                }
+            }
+            message = running.stdout.read_message(limits.max_message_bytes) => {
+                match message {
+                    Ok(Some(message)) => {
+                        if handle_server_message(
+                            message,
+                            running,
+                            &mut pending,
+                            &tool_list_changed,
+                            &lifecycle,
+                            limits,
+                        )
+                        .await
+                        .is_err()
+                        {
+                            let error = running.stop(limits).await;
+                            fail_pending(&mut pending, error);
+                            reset_lifecycle_current(&lifecycle);
+                            process = None;
+                            restart.record_failure(limits);
+                        }
+                    }
+                    Ok(None) | Err(_) => {
+                        let error = running.stop(limits).await;
+                        fail_pending(&mut pending, error);
+                        reset_lifecycle_current(&lifecycle);
+                        process = None;
+                        restart.record_failure(limits);
+                    }
+                }
+            }
+            status = running.child.wait() => {
+                while let Ok(Ok(Some(message))) = timeout(
+                    Duration::from_millis(10),
+                    running.stdout.read_message(limits.max_message_bytes),
+                )
+                .await
+                {
+                    if handle_server_message(
+                        message,
+                        running,
+                        &mut pending,
+                        &tool_list_changed,
+                        &lifecycle,
+                        limits,
+                    )
+                    .await
+                    .is_err()
+                    {
+                        break;
+                    }
+                }
+                let error = running.after_exit(status.ok(), limits).await;
+                fail_pending(&mut pending, error);
+                reset_lifecycle_current(&lifecycle);
+                process = None;
+                restart.record_failure(limits);
+            }
+            _ = wait_for_pending_deadline(&pending) => {
+                if expire_pending(&mut pending) {
+                    let error = running.stop(limits).await;
+                    fail_pending(&mut pending, error);
+                    reset_lifecycle_current(&lifecycle);
+                    process = None;
+                    restart.record_failure(limits);
+                }
+            }
+            _ = running.writer_failed.recv() => {
+                let error = running.stop(limits).await;
+                fail_pending(&mut pending, error);
+                reset_lifecycle_current(&lifecycle);
+                process = None;
+                restart.record_failure(limits);
+            }
+        }
+    }
+}
+
+async fn wait_for_pending_deadline(pending_requests: &HashMap<u64, PendingRequest>) {
+    if let Some(deadline) = pending_requests
+        .values()
+        .map(|request| request.deadline)
+        .min()
+    {
+        tokio::time::sleep_until(deadline).await;
+    } else {
+        pending::<()>().await;
+    }
+}
+
+fn expire_pending(pending_requests: &mut HashMap<u64, PendingRequest>) -> bool {
+    let now = Instant::now();
+    let expired = pending_requests
+        .iter()
+        .filter_map(|(id, request)| (request.deadline <= now).then_some(*id))
+        .collect::<Vec<_>>();
+    let had_expired = !expired.is_empty();
+    for id in expired {
+        let Some(request) = pending_requests.remove(&id) else {
+            continue;
+        };
+        let error = match request.semantics {
+            RequestSemantics::Replayable => StdioTransportError::Timeout,
+            RequestSemantics::AmbiguousAfterWrite => StdioTransportError::AmbiguousToolCall,
+        };
+        let _ = request.reply.send(Err(error));
+    }
+    had_expired
+}
+
+async fn dispatch_command(
+    process: &mut RunningProcess,
+    command: ClientCommand,
+    pending: &mut HashMap<u64, PendingRequest>,
+    lifecycle: &AtomicU64,
+    limits: StdioTransportLimits,
+) -> Result<(), StdioTransportError> {
+    match command {
+        ClientCommand::Request {
+            id,
+            payload,
+            permit,
+            initialization,
+            generation,
+            semantics,
+            deadline,
+            reply,
+        } => {
+            if initialization
+                && !generation.is_some_and(|generation| {
+                    lifecycle.load(Ordering::Acquire)
+                        == lifecycle_word(generation, LIFECYCLE_INITIALIZING)
+                })
+            {
+                let _ = reply.send(Err(StdioTransportError::Closed));
+                return Ok(());
+            }
+            if Instant::now() >= deadline {
+                let error = match semantics {
+                    RequestSemantics::Replayable => StdioTransportError::Timeout,
+                    RequestSemantics::AmbiguousAfterWrite => StdioTransportError::AmbiguousToolCall,
+                };
+                let _ = reply.send(Err(error));
+                return Ok(());
+            }
+            if pending.len() >= limits.command_queue_capacity {
+                let _ = reply.send(Err(StdioTransportError::TooManyInFlight));
+                return Ok(());
+            }
+            if pending.contains_key(&id) {
+                let _ = reply.send(Err(StdioTransportError::DuplicateRequestId));
+                return Ok(());
+            }
+            pending.insert(
+                id,
+                PendingRequest {
+                    semantics,
+                    generation,
+                    deadline,
+                    reply,
+                },
+            );
+            if process.write(payload, Some(permit), None).is_err() {
+                return Err(StdioTransportError::Closed);
+            }
+        }
+        ClientCommand::Notification {
+            payload,
+            permit,
+            deadline,
+            generation,
+            reply,
+        } => {
+            if generation.is_some_and(|generation| {
+                lifecycle.load(Ordering::Acquire)
+                    != lifecycle_word(generation, LIFECYCLE_INITIALIZING)
+            }) {
+                let _ = reply.send(Err(StdioTransportError::Closed));
+                return Ok(());
+            }
+            if Instant::now() >= deadline {
+                let _ = reply.send(Err(StdioTransportError::Timeout));
+            } else {
+                process.write(payload, Some(permit), Some(reply))?;
+            }
+        }
+        ClientCommand::Reset { .. }
+        | ClientCommand::Healthy { .. }
+        | ClientCommand::Shutdown { .. } => {
+            unreachable!("lifecycle commands are handled by the actor")
+        }
+    }
+    Ok(())
+}
+
+async fn handle_server_message(
+    message: Value,
+    process: &mut RunningProcess,
+    pending: &mut HashMap<u64, PendingRequest>,
+    tool_list_changed: &broadcast::Sender<()>,
+    lifecycle: &AtomicU64,
+    limits: StdioTransportLimits,
+) -> Result<(), StdioTransportError> {
+    let object = message
+        .as_object()
+        .ok_or(StdioTransportError::InvalidResponse)?;
+    if object.get("jsonrpc").and_then(Value::as_str) != Some("2.0") {
+        return Err(StdioTransportError::InvalidResponse);
+    }
+    if object.contains_key("method") {
+        if let Some(id) = object.get("id") {
+            let response = if object.get("method").and_then(Value::as_str) == Some("ping") {
+                json!({ "jsonrpc": "2.0", "id": id, "result": {} })
+            } else {
+                json!({
+                    "jsonrpc": "2.0",
+                    "id": id,
+                    "error": { "code": -32601, "message": "Method not found" }
+                })
+            };
+            let payload = encode_message(&response, limits.max_message_bytes)?;
+            process.write(payload, None, None)?;
+        } else if object.get("method").and_then(Value::as_str)
+            == Some("notifications/tools/list_changed")
+        {
+            let _ = tool_list_changed.send(());
+        }
+        return Ok(());
+    }
+
+    let id = object
+        .get("id")
+        .and_then(Value::as_u64)
+        .ok_or(StdioTransportError::InvalidResponse)?;
+    let request = pending
+        .remove(&id)
+        .ok_or(StdioTransportError::UnexpectedResponseId)?;
+    if request.generation.is_some_and(|generation| {
+        lifecycle.load(Ordering::Acquire) != lifecycle_word(generation, LIFECYCLE_INITIALIZING)
+    }) {
+        let _ = request.reply.send(Err(StdioTransportError::Closed));
+        return Ok(());
+    }
+    let response = match (object.get("result"), object.get("error")) {
+        (Some(result), None) => Ok(result.clone()),
+        (None, Some(Value::Object(error))) => match (
+            error.get("code").and_then(Value::as_i64),
+            error.get("message").and_then(Value::as_str),
+        ) {
+            (Some(code), Some(_)) => Err(StdioTransportError::JsonRpc { code }),
+            _ => Err(StdioTransportError::InvalidResponse),
+        },
+        _ => Err(StdioTransportError::InvalidResponse),
+    };
+    let _ = request.reply.send(response);
+    Ok(())
+}
+
+fn reject_command(command: ClientCommand, error: StdioTransportError) {
+    match command {
+        ClientCommand::Request { reply, .. } => {
+            let _ = reply.send(Err(error));
+        }
+        ClientCommand::Notification { reply, .. } => {
+            let _ = reply.send(Err(error));
+        }
+        ClientCommand::Reset { completed, .. } => {
+            let _ = completed.send(());
+        }
+        ClientCommand::Healthy { .. } => {}
+        ClientCommand::Shutdown { completed } => {
+            if let Some(completed) = completed {
+                let _ = completed.send(());
+            }
+        }
+    }
+}
+
+fn command_reply_closed(command: &ClientCommand) -> bool {
+    match command {
+        ClientCommand::Request { reply, .. } => reply.is_closed(),
+        ClientCommand::Notification { reply, .. } => reply.is_closed(),
+        ClientCommand::Reset { completed, .. } => completed.is_closed(),
+        ClientCommand::Healthy { .. } => false,
+        ClientCommand::Shutdown { completed } => {
+            completed.as_ref().is_some_and(oneshot::Sender::is_closed)
+        }
+    }
+}
+
+fn fail_pending(pending: &mut HashMap<u64, PendingRequest>, failure: ProcessFailure) {
+    for (_, request) in pending.drain() {
+        let error = match request.semantics {
+            RequestSemantics::Replayable => StdioTransportError::ProcessExited {
+                code: failure.code,
+                stderr_truncated: failure.stderr_truncated,
+            },
+            RequestSemantics::AmbiguousAfterWrite => StdioTransportError::AmbiguousToolCall,
+        };
+        let _ = request.reply.send(Err(error));
+    }
+}
+
+#[derive(Default)]
+struct RestartState {
+    consecutive_failures: u32,
+    retry_at: Option<Instant>,
+}
+
+impl RestartState {
+    fn record_failure(&mut self, limits: StdioTransportLimits) {
+        self.consecutive_failures = self.consecutive_failures.saturating_add(1);
+        let shift = self.consecutive_failures.saturating_sub(1).min(31);
+        let multiplier = 1_u32 << shift;
+        let delay = limits
+            .initial_restart_backoff
+            .saturating_mul(multiplier)
+            .min(limits.max_restart_backoff);
+        self.retry_at = Instant::now().checked_add(delay);
+    }
+
+    fn record_success(&mut self) {
+        self.consecutive_failures = 0;
+        self.retry_at = None;
+    }
+}
+
+struct RunningProcess {
+    child: Child,
+    writer: Option<mpsc::Sender<WriteFrame>>,
+    writer_task: JoinHandle<()>,
+    writer_failed: mpsc::Receiver<()>,
+    stdout: BoundedMessageReader<ChildStdout>,
+    stderr: JoinHandle<StderrSummary>,
+    process_group: i32,
+}
+
+impl RunningProcess {
+    async fn spawn(
+        template: &TrustedStdioTemplate,
+        limits: StdioTransportLimits,
+    ) -> Result<Self, StdioTransportError> {
+        for name in &template.secret_environment {
+            let value = template
+                .environment
+                .get(name)
+                .ok_or(StdioTemplateError::InvalidSecretOverlay)?;
+            if value.is_empty()
+                || value.len() > MAX_ENVIRONMENT_VALUE_BYTES
+                || value.as_bytes().contains(&0)
+            {
+                return Err(StdioTemplateError::InvalidSecretOverlay.into());
+            }
+        }
+        verify_executable(template)?;
+        verify_cwd(template)?;
+        let mut command = Command::new(&template.executable);
+        command
+            .args(&template.arguments)
+            .env_clear()
+            .envs(&template.environment)
+            .stdin(Stdio::piped())
+            .stdout(Stdio::piped())
+            .stderr(Stdio::piped())
+            .kill_on_drop(true);
+        if let Some(cwd) = &template.cwd {
+            command.current_dir(cwd);
+        }
+        configure_process_group(&mut command);
+        let mut child = command.spawn().map_err(|_| StdioTransportError::Spawn)?;
+        let process_group = child.id().ok_or(StdioTransportError::Spawn)? as i32;
+        let stdin = child.stdin.take().ok_or(StdioTransportError::Spawn)?;
+        let stdout = child.stdout.take().ok_or(StdioTransportError::Spawn)?;
+        let stderr = child.stderr.take().ok_or(StdioTransportError::Spawn)?;
+        let stderr = tokio::spawn(drain_stderr(stderr, limits.max_stderr_bytes));
+        let (writer, writes) = mpsc::channel(limits.command_queue_capacity);
+        let (writer_failure, writer_failed) = mpsc::channel(1);
+        let writer_task = tokio::spawn(write_frames(stdin, writes, writer_failure));
+        Ok(Self {
+            child,
+            writer: Some(writer),
+            writer_task,
+            writer_failed,
+            stdout: BoundedMessageReader::new(stdout),
+            stderr,
+            process_group,
+        })
+    }
+
+    fn write(
+        &mut self,
+        payload: Vec<u8>,
+        permit: Option<OwnedSemaphorePermit>,
+        completion: Option<oneshot::Sender<Result<(), StdioTransportError>>>,
+    ) -> Result<(), StdioTransportError> {
+        let frame = WriteFrame {
+            payload,
+            _permit: permit,
+            completion,
+        };
+        match self
+            .writer
+            .as_ref()
+            .ok_or(StdioTransportError::Closed)?
+            .try_send(frame)
+        {
+            Ok(()) => Ok(()),
+            Err(error) => {
+                let mut frame = error.into_inner();
+                if let Some(completion) = frame.completion.take() {
+                    let _ = completion.send(Err(StdioTransportError::Closed));
+                }
+                Err(StdioTransportError::TooManyInFlight)
+            }
+        }
+    }
+
+    async fn stop(&mut self, limits: StdioTransportLimits) -> ProcessFailure {
+        signal_process_group(self.process_group, libc::SIGTERM);
+        let status = match timeout(limits.shutdown_grace, self.child.wait()).await {
+            Ok(Ok(status)) => Some(status),
+            _ => {
+                signal_process_group(self.process_group, libc::SIGKILL);
+                let _ = self.child.start_kill();
+                self.child.wait().await.ok()
+            }
+        };
+        let summary = self.finish_background(limits).await;
+        ProcessFailure {
+            code: status.as_ref().and_then(ExitStatus::code),
+            stderr_truncated: summary.truncated,
+        }
+    }
+
+    async fn after_exit(
+        &mut self,
+        status: Option<ExitStatus>,
+        limits: StdioTransportLimits,
+    ) -> ProcessFailure {
+        signal_process_group(self.process_group, libc::SIGTERM);
+        let summary = self.finish_background(limits).await;
+        ProcessFailure {
+            code: status.as_ref().and_then(ExitStatus::code),
+            stderr_truncated: summary.truncated,
+        }
+    }
+
+    async fn finish_background(&mut self, limits: StdioTransportLimits) -> StderrSummary {
+        self.writer.take();
+        let summary = match timeout(limits.shutdown_grace, &mut self.stderr).await {
+            Ok(summary) => summary.unwrap_or_default(),
+            Err(_) => {
+                signal_process_group(self.process_group, libc::SIGKILL);
+                match timeout(limits.shutdown_grace, &mut self.stderr).await {
+                    Ok(summary) => summary.unwrap_or_default(),
+                    Err(_) => {
+                        self.stderr.abort();
+                        StderrSummary { truncated: true }
+                    }
+                }
+            }
+        };
+        if timeout(limits.shutdown_grace, &mut self.writer_task)
+            .await
+            .is_err()
+        {
+            self.writer_task.abort();
+        }
+        if process_group_exists(self.process_group) {
+            signal_process_group(self.process_group, libc::SIGKILL);
+        }
+        summary
+    }
+}
+
+struct WriteFrame {
+    payload: Vec<u8>,
+    _permit: Option<OwnedSemaphorePermit>,
+    completion: Option<oneshot::Sender<Result<(), StdioTransportError>>>,
+}
+
+async fn write_frames<W>(
+    mut stdin: W,
+    mut frames: mpsc::Receiver<WriteFrame>,
+    failure: mpsc::Sender<()>,
+) where
+    W: AsyncWrite + Unpin,
+{
+    while let Some(frame) = frames.recv().await {
+        let mut frame = frame;
+        let result = async {
+            stdin.write_all(&frame.payload).await?;
+            stdin.write_all(b"\n").await?;
+            stdin.flush().await
+        }
+        .await;
+        if let Some(completion) = frame.completion.take() {
+            let _ = completion.send(if result.is_ok() {
+                Ok(())
+            } else {
+                Err(StdioTransportError::Closed)
+            });
+        }
+        if result.is_err() {
+            let _ = failure.try_send(());
+            break;
+        }
+    }
+    let _ = stdin.shutdown().await;
+}
+
+#[derive(Clone, Copy)]
+struct ProcessFailure {
+    code: Option<i32>,
+    stderr_truncated: bool,
+}
+
+struct BoundedMessageReader<R> {
+    reader: BufReader<R>,
+}
+
+impl<R> BoundedMessageReader<R>
+where
+    R: AsyncRead + Unpin,
+{
+    fn new(reader: R) -> Self {
+        Self {
+            reader: BufReader::with_capacity(8 * 1024, reader),
+        }
+    }
+
+    async fn read_message(
+        &mut self,
+        max_bytes: usize,
+    ) -> Result<Option<Value>, StdioTransportError> {
+        let mut bytes = Vec::new();
+        loop {
+            let available = self
+                .reader
+                .fill_buf()
+                .await
+                .map_err(|_| StdioTransportError::Closed)?;
+            if available.is_empty() {
+                if bytes.is_empty() {
+                    return Ok(None);
+                }
+                return Err(StdioTransportError::InvalidResponse);
+            }
+            let newline = available.iter().position(|byte| *byte == b'\n');
+            let consumed = newline.map_or(available.len(), |index| index + 1);
+            let content = newline.map_or(available, |index| &available[..index]);
+            if bytes.len().saturating_add(content.len()) > max_bytes {
+                return Err(StdioTransportError::ResponseTooLarge);
+            }
+            bytes.extend_from_slice(content);
+            self.reader.consume(consumed);
+            if newline.is_some() {
+                if bytes.last() == Some(&b'\r') {
+                    bytes.pop();
+                }
+                if bytes.is_empty() {
+                    return Err(StdioTransportError::InvalidResponse);
+                }
+                return serde_json::from_slice(&bytes)
+                    .map(Some)
+                    .map_err(|_| StdioTransportError::InvalidResponse);
+            }
+        }
+    }
+}
+
+#[derive(Default)]
+struct StderrSummary {
+    truncated: bool,
+}
+
+async fn drain_stderr<R>(mut stderr: R, max_bytes: usize) -> StderrSummary
+where
+    R: AsyncRead + Unpin,
+{
+    let mut retained = 0_usize;
+    let mut truncated = false;
+    let mut buffer = [0_u8; 8 * 1024];
+    loop {
+        match stderr.read(&mut buffer).await {
+            Ok(0) | Err(_) => break,
+            Ok(read) => {
+                if retained.saturating_add(read) > max_bytes {
+                    truncated = true;
+                }
+                retained = retained.saturating_add(read).min(max_bytes);
+            }
+        }
+    }
+    StderrSummary { truncated }
+}
+
+fn encode_message(value: &Value, max_bytes: usize) -> Result<Vec<u8>, StdioTransportError> {
+    let payload = serde_json::to_vec(value).map_err(|_| StdioTransportError::Encode)?;
+    if payload.len() > max_bytes {
+        return Err(StdioTransportError::RequestTooLarge);
+    }
+    Ok(payload)
+}
+
+fn validate_template_name(name: &str) -> Result<(), StdioTemplateError> {
+    if name.is_empty()
+        || name.len() > MAX_TEMPLATE_NAME_BYTES
+        || !name
+            .bytes()
+            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_'))
+    {
+        return Err(StdioTemplateError::InvalidName);
+    }
+    Ok(())
+}
+
+fn validate_arguments(arguments: &[String]) -> Result<(), StdioTemplateError> {
+    if arguments.len() > MAX_ARGUMENTS {
+        return Err(StdioTemplateError::TooManyArguments);
+    }
+    let mut total = 0_usize;
+    for argument in arguments {
+        if argument.len() > MAX_ARGUMENT_BYTES || argument.as_bytes().contains(&0) {
+            return Err(StdioTemplateError::ArgumentTooLarge);
+        }
+        total = total
+            .checked_add(argument.len())
+            .ok_or(StdioTemplateError::TemplateTooLarge)?;
+    }
+    if total > MAX_TEMPLATE_BYTES {
+        return Err(StdioTemplateError::TemplateTooLarge);
+    }
+    Ok(())
+}
+
+fn validate_environment(environment: &BTreeMap<String, String>) -> Result<(), StdioTemplateError> {
+    if environment.len() > MAX_ENVIRONMENT_ENTRIES {
+        return Err(StdioTemplateError::TooManyEnvironmentEntries);
+    }
+    let mut total = 0_usize;
+    for (name, value) in environment {
+        if !valid_environment_name(name)
+            || value.as_bytes().contains(&0)
+            || value.len() > MAX_ENVIRONMENT_VALUE_BYTES
+        {
+            return Err(StdioTemplateError::InvalidEnvironmentEntry);
+        }
+        total = total
+            .checked_add(name.len())
+            .and_then(|total| total.checked_add(value.len()))
+            .ok_or(StdioTemplateError::TemplateTooLarge)?;
+    }
+    if total > MAX_TEMPLATE_BYTES {
+        return Err(StdioTemplateError::TemplateTooLarge);
+    }
+    Ok(())
+}
+
+fn validate_secret_environment(
+    secret_environment: &[String],
+    environment: &BTreeMap<String, String>,
+) -> Result<(), StdioTemplateError> {
+    if secret_environment.len() > MAX_ENVIRONMENT_ENTRIES {
+        return Err(StdioTemplateError::TooManyEnvironmentEntries);
+    }
+    let mut previous: Option<&str> = None;
+    let mut names = secret_environment
+        .iter()
+        .map(String::as_str)
+        .collect::<Vec<_>>();
+    names.sort_unstable();
+    for name in names {
+        if !valid_environment_name(name) || environment.contains_key(name) || previous == Some(name)
+        {
+            return Err(StdioTemplateError::InvalidSecretFields);
+        }
+        previous = Some(name);
+    }
+    Ok(())
+}
+
+fn validate_secret_overlay(
+    approved: &[String],
+    secrets: &BTreeMap<String, String>,
+) -> Result<(), StdioTemplateError> {
+    if approved.len() != secrets.len() {
+        return Err(StdioTemplateError::InvalidSecretOverlay);
+    }
+    for name in approved {
+        let Some(value) = secrets.get(name) else {
+            return Err(StdioTemplateError::InvalidSecretOverlay);
+        };
+        if value.is_empty()
+            || value.len() > MAX_ENVIRONMENT_VALUE_BYTES
+            || value.as_bytes().contains(&0)
+        {
+            return Err(StdioTemplateError::InvalidSecretOverlay);
+        }
+    }
+    if secrets.keys().any(|name| !approved.contains(name)) {
+        return Err(StdioTemplateError::InvalidSecretOverlay);
+    }
+    Ok(())
+}
+
+fn valid_environment_name(name: &str) -> bool {
+    let mut bytes = name.bytes();
+    bytes
+        .next()
+        .is_some_and(|byte| byte.is_ascii_alphabetic() || byte == b'_')
+        && bytes.all(|byte| byte.is_ascii_alphanumeric() || byte == b'_')
+}
+
+fn verify_executable(template: &TrustedStdioTemplate) -> Result<(), StdioTransportError> {
+    let canonical =
+        std::fs::canonicalize(&template.executable).map_err(|_| StdioTransportError::Spawn)?;
+    if canonical != template.executable {
+        return Err(StdioTransportError::Spawn);
+    }
+    let metadata = std::fs::metadata(&canonical).map_err(|_| StdioTransportError::Spawn)?;
+    if !metadata.is_file() {
+        return Err(StdioTransportError::Spawn);
+    }
+    validate_executable_permissions(&metadata).map_err(StdioTransportError::Template)
+}
+
+fn verify_cwd(template: &TrustedStdioTemplate) -> Result<(), StdioTransportError> {
+    let Some(cwd) = &template.cwd else {
+        return Ok(());
+    };
+    let canonical = std::fs::canonicalize(cwd).map_err(|_| StdioTransportError::Spawn)?;
+    if &canonical != cwd
+        || !std::fs::metadata(&canonical)
+            .map_err(|_| StdioTransportError::Spawn)?
+            .is_dir()
+    {
+        return Err(StdioTransportError::Spawn);
+    }
+    Ok(())
+}
+
+#[cfg(unix)]
+fn validate_executable_permissions(metadata: &std::fs::Metadata) -> Result<(), StdioTemplateError> {
+    use std::os::unix::fs::PermissionsExt;
+
+    if metadata.permissions().mode() & 0o111 == 0 {
+        return Err(StdioTemplateError::ExecutableNotExecutable);
+    }
+    Ok(())
+}
+
+#[cfg(not(unix))]
+fn validate_executable_permissions(_: &std::fs::Metadata) -> Result<(), StdioTemplateError> {
+    Ok(())
+}
+
+#[cfg(unix)]
+fn configure_process_group(command: &mut Command) {
+    unsafe {
+        command.pre_exec(|| {
+            if libc::setpgid(0, 0) == -1 {
+                return Err(io::Error::last_os_error());
+            }
+            Ok(())
+        });
+    }
+}
+
+#[cfg(not(unix))]
+fn configure_process_group(_: &mut Command) {}
+
+#[cfg(unix)]
+fn signal_process_group(process_group: i32, signal: i32) {
+    if process_group > 0 {
+        unsafe {
+            libc::kill(-process_group, signal);
+        }
+    }
+}
+
+#[cfg(unix)]
+fn process_group_exists(process_group: i32) -> bool {
+    process_group > 0 && unsafe { libc::kill(-process_group, 0) == 0 }
+}
+
+#[cfg(not(unix))]
+fn signal_process_group(_: i32, _: i32) {}
+
+#[cfg(not(unix))]
+fn process_group_exists(_: i32) -> bool {
+    false
+}
+
+#[cfg(test)]
+mod tests {
+    use std::os::unix::fs::PermissionsExt;
+
+    use tempfile::TempDir;
+    use tokio::time::{Duration, Instant};
+
+    use super::*;
+
+    fn script(directory: &TempDir, name: &str, contents: &str) -> PathBuf {
+        let path = directory.path().join(name);
+        std::fs::write(&path, contents).expect("script writes");
+        let mut permissions = std::fs::metadata(&path)
+            .expect("script metadata exists")
+            .permissions();
+        permissions.set_mode(0o700);
+        std::fs::set_permissions(&path, permissions).expect("script becomes executable");
+        path
+    }
+
+    fn template(path: PathBuf) -> TrustedStdioTemplate {
+        TrustedStdioTemplate::validate(StdioTemplate {
+            name: "fixture".to_owned(),
+            executable: path,
+            cwd: None,
+            arguments: Vec::new(),
+            environment: BTreeMap::new(),
+            secret_environment: Vec::new(),
+        })
+        .expect("fixture template validates")
+    }
+
+    async fn initialize_client(client: &StdioClient) {
+        client
+            .initialize(
+                DEFAULT_PROTOCOL_VERSION,
+                json!({ "name": "executor", "version": "1" }),
+                json!({}),
+            )
+            .await
+            .expect("initialization succeeds");
+    }
+
+    #[test]
+    fn templates_require_named_absolute_executables_and_reject_duplicates() {
+        let error = TrustedStdioTemplate::validate(StdioTemplate {
+            name: "bad name".to_owned(),
+            executable: PathBuf::from("relative-command"),
+            cwd: None,
+            arguments: Vec::new(),
+            environment: BTreeMap::new(),
+            secret_environment: Vec::new(),
+        })
+        .expect_err("invalid name is rejected first");
+        assert!(matches!(error, StdioTemplateError::InvalidName));
+
+        let directory = TempDir::new().expect("temporary directory creates");
+        let executable = script(&directory, "server", "#!/bin/sh\nexit 0\n");
+        let config = StdioTemplate {
+            name: "fixture".to_owned(),
+            executable,
+            cwd: None,
+            arguments: Vec::new(),
+            environment: BTreeMap::new(),
+            secret_environment: Vec::new(),
+        };
+        let error = StdioTemplateRegistry::new(vec![config.clone(), config])
+            .expect_err("duplicate names are rejected");
+        assert!(matches!(error, StdioTemplateError::DuplicateName));
+    }
+
+    #[test]
+    fn loads_a_bounded_strict_configuration_file() {
+        let directory = TempDir::new().expect("temporary directory creates");
+        let executable = script(&directory, "server", "#!/bin/sh\nexit 0\n");
+        let config_path = directory.path().join("stdio.json");
+        std::fs::write(
+            &config_path,
+            serde_json::to_vec(&json!({
+                "templates": [{
+                    "name": "fixture",
+                    "executable": executable,
+                    "secretEnvironment": ["API_TOKEN"]
+                }]
+            }))
+            .expect("configuration encodes"),
+        )
+        .expect("configuration writes");
+        let registry = StdioTemplateRegistry::load(&config_path).expect("configuration loads");
+        assert_eq!(registry.descriptors()[0].name, "fixture");
+
+        std::fs::write(&config_path, br#"{"templates":[],"unexpected":true}"#)
+            .expect("invalid configuration writes");
+        assert!(matches!(
+            StdioTemplateRegistry::load(&config_path),
+            Err(StdioTemplateError::ConfigInvalid)
+        ));
+
+        std::fs::write(&config_path, vec![b' '; MAX_CONFIG_FILE_BYTES as usize + 1])
+            .expect("oversized configuration writes");
+        assert!(matches!(
+            StdioTemplateRegistry::load(&config_path),
+            Err(StdioTemplateError::ConfigTooLarge)
+        ));
+    }
+
+    #[tokio::test]
+    async fn initializes_lists_and_calls_with_clean_environment() {
+        let directory = TempDir::new().expect("temporary directory creates");
+        let executable = script(
+            &directory,
+            "server",
+            r#"#!/bin/sh
+if [ -n "${HOME+x}" ]; then exit 9; fi
+while IFS= read -r line; do
+  case "$line" in
+    *'"method":"initialize"'*) printf '%s\n' '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2025-11-25","capabilities":{},"serverInfo":{"name":"fixture","version":"1"}}}' '{"jsonrpc":"2.0","method":"notifications/tools/list_changed"}' ;;
+    *'"method":"tools/list"'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"echo","inputSchema":{"type":"object"}}]}}' ;;
+    *'"method":"tools/call"'*) printf '%s\n' '{"jsonrpc":"2.0","id":77,"result":{"content":[{"type":"text","text":"ok"}],"isError":false}}' ;;
+  esac
+done
+"#,
+        );
+        let client = StdioClient::connect(template(executable), StdioTransportLimits::default())
+            .await
+            .expect("client connects");
+        let mut list_changed = client.subscribe_tool_list_changed();
+        let initialized = client
+            .initialize(
+                DEFAULT_PROTOCOL_VERSION,
+                json!({ "name": "executor", "version": "1" }),
+                json!({}),
+            )
+            .await
+            .expect("initialization succeeds");
+        assert_eq!(initialized.protocol_version, DEFAULT_PROTOCOL_VERSION);
+        timeout(Duration::from_secs(1), list_changed.recv())
+            .await
+            .expect("list changed notification arrives")
+            .expect("list changed channel remains open");
+        let tools = client
+            .list_tools(None)
+            .await
+            .expect("tool listing succeeds");
+        assert_eq!(tools.tools[0].name, "echo");
+        let result = client
+            .call_tool("echo", json!({ "value": "hi" }), 77)
+            .await
+            .expect("tool call succeeds");
+        assert!(!result.is_error);
+        client.shutdown().await;
+    }
+
+    #[tokio::test]
+    async fn answers_server_ping_requests_with_an_empty_result() {
+        let directory = TempDir::new().expect("temporary directory creates");
+        let executable = script(
+            &directory,
+            "ping-server",
+            r#"#!/bin/sh
+read line
+printf '%s\n' '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2025-11-25","capabilities":{}}}'
+read line
+printf '%s\n' '{"jsonrpc":"2.0","id":"server-ping","method":"ping"}'
+read first
+read second
+wire="$first$second"
+case "$wire" in
+  *'"id":"server-ping"'*'"result":{}'*'"method":"tools/list"'* | *'"method":"tools/list"'*'"id":"server-ping"'*'"result":{}'*) ;;
+  *) exit 9 ;;
+esac
+printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[]}}'
+while IFS= read -r line; do :; done
+"#,
+        );
+        let client = StdioClient::connect(template(executable), StdioTransportLimits::default())
+            .await
+            .expect("client connects");
+        initialize_client(&client).await;
+
+        let tools = client
+            .list_tools(None)
+            .await
+            .expect("list succeeds after the server ping");
+        assert!(tools.tools.is_empty());
+        client.shutdown().await;
+    }
+
+    #[tokio::test]
+    async fn call_tool_requires_object_structured_content() {
+        let directory = TempDir::new().expect("temporary directory creates");
+        let executable = script(
+            &directory,
+            "structured-content-server",
+            r#"#!/bin/sh
+read line
+printf '%s\n' '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2025-11-25","capabilities":{}}}'
+read line
+read line
+printf '%s\n' '{"jsonrpc":"2.0","id":10,"result":{"content":[],"structuredContent":{"status":"ok"},"isError":false}}'
+read line
+printf '%s\n' '{"jsonrpc":"2.0","id":11,"result":{"content":[],"structuredContent":"not-an-object"}}'
+read line
+printf '%s\n' '{"jsonrpc":"2.0","id":12,"result":{"content":[],"structuredContent":[]}}'
+read line
+printf '%s\n' '{"jsonrpc":"2.0","id":13,"result":{"content":[],"structuredContent":null}}'
+while IFS= read -r line; do :; done
+"#,
+        );
+        let client = StdioClient::connect(template(executable), StdioTransportLimits::default())
+            .await
+            .expect("client connects");
+        initialize_client(&client).await;
+
+        let valid = client
+            .call_tool("valid", json!({}), 10)
+            .await
+            .expect("object structured content is valid");
+        assert_eq!(valid.structured_content, Some(json!({ "status": "ok" })));
+        assert!(!valid.is_error);
+        for request_id in 11..=13 {
+            assert!(matches!(
+                client.call_tool("invalid", json!({}), request_id).await,
+                Err(StdioTransportError::Decode)
+            ));
+        }
+        client.shutdown().await;
+    }
+
+    #[tokio::test]
+    async fn registry_exposes_only_secret_descriptors_and_requires_exact_overlay() {
+        let directory = TempDir::new().expect("temporary directory creates");
+        let executable = script(
+            &directory,
+            "secret-server",
+            r#"#!/bin/sh
+if [ "$API_TOKEN" != "preserve surrounding spaces" ]; then exit 8; fi
+read line
+printf '%s\n' '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2025-11-25","capabilities":{}}}'
+read line
+read line
+printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[]}}'
+"#,
+        );
+        let registry = StdioTemplateRegistry::new(vec![StdioTemplate {
+            name: "secret-fixture".to_owned(),
+            executable,
+            cwd: None,
+            arguments: vec!["--trusted-argument".to_owned()],
+            environment: BTreeMap::new(),
+            secret_environment: vec!["API_TOKEN".to_owned()],
+        }])
+        .expect("registry validates");
+        assert_eq!(
+            registry.descriptors(),
+            vec![StdioTemplateDescriptor {
+                name: "secret-fixture".to_owned(),
+                secret_fields: vec!["API_TOKEN".to_owned()],
+            }]
+        );
+        let error = match registry
+            .connect_with_secrets(
+                "secret-fixture",
+                &BTreeMap::new(),
+                StdioTransportLimits::default(),
+            )
+            .await
+        {
+            Ok(client) => {
+                client.shutdown().await;
+                panic!("required secrets cannot be omitted");
+            }
+            Err(error) => error,
+        };
+        assert!(matches!(
+            error,
+            StdioTransportError::Template(StdioTemplateError::InvalidSecretOverlay)
+        ));
+
+        let secrets = BTreeMap::from([(
+            "API_TOKEN".to_owned(),
+            "preserve surrounding spaces".to_owned(),
+        )]);
+        let client = registry
+            .connect_with_secrets("secret-fixture", &secrets, StdioTransportLimits::default())
+            .await
+            .expect("approved secret overlay connects");
+        initialize_client(&client).await;
+        assert!(client.list_tools(None).await.is_ok());
+        client.shutdown().await;
+    }
+
+    #[tokio::test]
+    async fn child_runs_in_the_exact_canonical_working_directory() {
+        let directory = TempDir::new().expect("temporary directory creates");
+        let working_directory = directory.path().join("working");
+        std::fs::create_dir(&working_directory).expect("working directory creates");
+        let output = directory.path().join("cwd.txt");
+        let executable = script(
+            &directory,
+            "cwd-server",
+            r#"#!/bin/sh
+pwd > "$OUTPUT"
+while IFS= read -r line; do
+  case "$line" in
+    *'"method":"initialize"'*) printf '%s\n' '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2025-11-25","capabilities":{}}}' ;;
+  esac
+done
+"#,
+        );
+        let registry = StdioTemplateRegistry::new(vec![StdioTemplate {
+            name: "cwd-fixture".to_owned(),
+            executable,
+            cwd: Some(working_directory.clone()),
+            arguments: Vec::new(),
+            environment: BTreeMap::from([(
+                "OUTPUT".to_owned(),
+                output.to_string_lossy().into_owned(),
+            )]),
+            secret_environment: Vec::new(),
+        }])
+        .expect("working directory template validates");
+        let client = registry
+            .connect_with_secrets(
+                "cwd-fixture",
+                &BTreeMap::new(),
+                StdioTransportLimits::default(),
+            )
+            .await
+            .expect("client connects");
+        initialize_client(&client).await;
+        assert_eq!(
+            std::fs::read_to_string(output)
+                .expect("working directory capture exists")
+                .trim(),
+            std::fs::canonicalize(working_directory)
+                .expect("working directory canonicalizes")
+                .to_string_lossy()
+        );
+        client.shutdown().await;
+    }
+
+    #[tokio::test]
+    async fn oversized_stdout_is_rejected_without_unbounded_buffering() {
+        let directory = TempDir::new().expect("temporary directory creates");
+        let executable = script(
+            &directory,
+            "server",
+            "#!/bin/sh\nread line\ni=0; while [ $i -lt 2048 ]; do printf x; i=$((i+1)); done; printf '\\n'\n",
+        );
+        let limits = StdioTransportLimits {
+            max_message_bytes: 512,
+            ..StdioTransportLimits::default()
+        };
+        let client = StdioClient::connect(template(executable), limits)
+            .await
+            .expect("client connects");
+        let error = client
+            .initialize(
+                DEFAULT_PROTOCOL_VERSION,
+                json!({ "name": "executor", "version": "1" }),
+                json!({}),
+            )
+            .await
+            .expect_err("oversized response is rejected");
+        assert!(matches!(error, StdioTransportError::ProcessExited { .. }));
+        client.shutdown().await;
+    }
+
+    #[tokio::test]
+    async fn disconnected_tool_calls_are_never_retried() {
+        let directory = TempDir::new().expect("temporary directory creates");
+        let counter = directory.path().join("counter");
+        let executable = script(
+            &directory,
+            "server",
+            &format!(
+                "#!/bin/sh\nread line\nprintf '%s\\n' '{{\"jsonrpc\":\"2.0\",\"id\":1,\"result\":{{\"protocolVersion\":\"2025-11-25\",\"capabilities\":{{}}}}}}'\nread line\nread line\nprintf x >> '{}'\nexit 1\n",
+                counter.display()
+            ),
+        );
+        let client = StdioClient::connect(template(executable), StdioTransportLimits::default())
+            .await
+            .expect("client connects");
+        initialize_client(&client).await;
+        let error = client
+            .call_tool("mutate", json!({}), 41)
+            .await
+            .expect_err("disconnected call has an ambiguous result");
+        assert!(matches!(error, StdioTransportError::AmbiguousToolCall));
+        tokio::time::sleep(Duration::from_millis(200)).await;
+        assert_eq!(std::fs::read(&counter).expect("counter exists"), b"x");
+        client.shutdown().await;
+    }
+
+    #[tokio::test]
+    async fn initialized_state_clears_when_an_idle_child_exits() {
+        let directory = TempDir::new().expect("temporary directory creates");
+        let executable = script(
+            &directory,
+            "server",
+            "#!/bin/sh\nread line\nprintf '%s\\n' '{\"jsonrpc\":\"2.0\",\"id\":1,\"result\":{\"protocolVersion\":\"2025-11-25\",\"capabilities\":{}}}'\nread line\nexit 0\n",
+        );
+        let client = StdioClient::connect(template(executable), StdioTransportLimits::default())
+            .await
+            .expect("client connects");
+        initialize_client(&client).await;
+        assert!(client.is_initialized());
+        timeout(Duration::from_secs(1), async {
+            while client.is_initialized() {
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .expect("idle child exit clears initialized state");
+        client.shutdown().await;
+    }
+
+    #[tokio::test]
+    async fn restart_attempts_observe_exponential_backoff() {
+        let directory = TempDir::new().expect("temporary directory creates");
+        let executable = script(&directory, "server", "#!/bin/sh\nexit 1\n");
+        let limits = StdioTransportLimits {
+            initial_restart_backoff: Duration::from_millis(120),
+            max_restart_backoff: Duration::from_millis(120),
+            ..StdioTransportLimits::default()
+        };
+        let client = StdioClient::connect(template(executable), limits)
+            .await
+            .expect("initial spawn succeeds");
+        let _ = client
+            .initialize(
+                DEFAULT_PROTOCOL_VERSION,
+                json!({ "name": "executor", "version": "1" }),
+                json!({}),
+            )
+            .await;
+        let started = Instant::now();
+        let _ = client
+            .initialize(
+                DEFAULT_PROTOCOL_VERSION,
+                json!({ "name": "executor", "version": "1" }),
+                json!({}),
+            )
+            .await;
+        assert!(started.elapsed() >= Duration::from_millis(100));
+        client.shutdown().await;
+    }
+
+    #[tokio::test]
+    async fn timed_out_requests_are_removed_and_force_reinitialization() {
+        let directory = TempDir::new().expect("temporary directory creates");
+        let executable = script(
+            &directory,
+            "timeout-server",
+            r#"#!/bin/sh
+while IFS= read -r line; do
+  case "$line" in
+    *'"method":"initialize"'*) printf '%s\n' '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2025-11-25","capabilities":{}}}' ;;
+  esac
+done
+"#,
+        );
+        let limits = StdioTransportLimits {
+            request_timeout: Duration::from_millis(150),
+            shutdown_grace: Duration::from_millis(30),
+            initial_restart_backoff: Duration::from_millis(10),
+            max_restart_backoff: Duration::from_millis(20),
+            ..StdioTransportLimits::default()
+        };
+        let client = StdioClient::connect(template(executable), limits)
+            .await
+            .expect("client connects");
+        initialize_client(&client).await;
+        let started = Instant::now();
+        let error = client
+            .list_tools(None)
+            .await
+            .expect_err("unanswered request times out");
+        assert!(matches!(error, StdioTransportError::Timeout));
+        assert!(started.elapsed() < Duration::from_secs(1));
+        timeout(Duration::from_secs(1), async {
+            while lifecycle_state(client.lifecycle.load(Ordering::Acquire))
+                != LIFECYCLE_UNINITIALIZED
+            {
+                tokio::time::sleep(Duration::from_millis(5)).await;
+            }
+        })
+        .await
+        .expect("timed out request teardown completes");
+        assert!(matches!(
+            client.list_tools(None).await,
+            Err(StdioTransportError::NotInitialized)
+        ));
+        client.shutdown().await;
+    }
+
+    #[tokio::test]
+    async fn stdout_is_drained_while_large_concurrent_requests_are_written() {
+        let directory = TempDir::new().expect("temporary directory creates");
+        let executable = script(
+            &directory,
+            "duplex-server",
+            r#"#!/bin/sh
+read line
+printf '%s\n' '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2025-11-25","capabilities":{}}}'
+read line
+i=0
+while [ $i -lt 1400 ]; do
+  printf '%s\n' '{"jsonrpc":"2.0","method":"notifications/tools/list_changed"}'
+  i=$((i+1))
+done
+i=2
+while IFS= read -r line; do
+  printf '{"jsonrpc":"2.0","id":%s,"result":{"tools":[]}}\n' "$i"
+  i=$((i+1))
+done
+"#,
+        );
+        let client = std::sync::Arc::new(
+            StdioClient::connect(template(executable), StdioTransportLimits::default())
+                .await
+                .expect("client connects"),
+        );
+        initialize_client(&client).await;
+        let mut calls = tokio::task::JoinSet::new();
+        for _ in 0..64 {
+            let client = client.clone();
+            calls.spawn(async move {
+                client
+                    .list_tools(Some(&"x".repeat(4 * 1024)))
+                    .await
+                    .expect("concurrent list succeeds")
+            });
+        }
+        timeout(Duration::from_secs(5), async {
+            while let Some(result) = calls.join_next().await {
+                result.expect("list task completes");
+            }
+        })
+        .await
+        .expect("full-duplex traffic does not deadlock");
+        std::sync::Arc::try_unwrap(client)
+            .ok()
+            .expect("all task client references are dropped")
+            .shutdown()
+            .await;
+    }
+
+    #[tokio::test]
+    async fn shutdown_kills_the_process_group_even_when_descendants_ignore_term() {
+        let directory = TempDir::new().expect("temporary directory creates");
+        let descendant_pid = directory.path().join("descendant.pid");
+        let executable = script(
+            &directory,
+            "process-group-server",
+            r#"#!/bin/sh
+trap '' TERM
+(trap '' TERM; while :; do /bin/sleep 1; done) &
+printf '%s' "$!" > "$PID_FILE"
+while IFS= read -r line; do
+  case "$line" in
+    *'"method":"initialize"'*) printf '%s\n' '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2025-11-25","capabilities":{}}}' ;;
+  esac
+done
+"#,
+        );
+        let mut trusted = template(executable);
+        trusted.environment.insert(
+            "PID_FILE".to_owned(),
+            descendant_pid.to_string_lossy().into_owned(),
+        );
+        let limits = StdioTransportLimits {
+            shutdown_grace: Duration::from_millis(40),
+            initial_restart_backoff: Duration::from_millis(10),
+            max_restart_backoff: Duration::from_millis(20),
+            ..StdioTransportLimits::default()
+        };
+        let client = StdioClient::connect(trusted, limits)
+            .await
+            .expect("client connects");
+        initialize_client(&client).await;
+        let pid = std::fs::read_to_string(&descendant_pid)
+            .expect("descendant PID is captured")
+            .parse::<i32>()
+            .expect("descendant PID is numeric");
+        let started = Instant::now();
+        client.shutdown().await;
+        assert!(started.elapsed() < Duration::from_secs(1));
+        for _ in 0..200 {
+            if unsafe { libc::kill(pid, 0) } == -1 {
+                return;
+            }
+            tokio::time::sleep(Duration::from_millis(10)).await;
+        }
+        panic!("descendant process remained alive after process-group shutdown");
+    }
+
+    #[tokio::test]
+    async fn failed_initialize_response_restarts_before_retry() {
+        let directory = TempDir::new().expect("temporary directory creates");
+        let marker = directory.path().join("started");
+        let executable = script(
+            &directory,
+            "initialize-retry-server",
+            r#"#!/bin/sh
+read line
+if [ -f "$MARKER" ]; then
+  printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"protocolVersion":"2025-11-25","capabilities":{}}}'
+else
+  printf x > "$MARKER"
+  printf '%s\n' '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2025-06-18","capabilities":{}}}'
+fi
+while IFS= read -r line; do :; done
+"#,
+        );
+        let mut trusted = template(executable);
+        trusted
+            .environment
+            .insert("MARKER".to_owned(), marker.to_string_lossy().into_owned());
+        let client = StdioClient::connect(trusted, StdioTransportLimits::default())
+            .await
+            .expect("client connects");
+        let error = client
+            .initialize(
+                DEFAULT_PROTOCOL_VERSION,
+                json!({ "name": "executor", "version": "1" }),
+                json!({}),
+            )
+            .await
+            .expect_err("mismatched protocol version is rejected");
+        assert!(matches!(
+            error,
+            StdioTransportError::ProtocolVersionMismatch
+        ));
+        initialize_client(&client).await;
+        client.shutdown().await;
+    }
+
+    #[tokio::test]
+    async fn initialize_waits_for_initialized_notification_flush() {
+        let (writer, mut reader) = tokio::io::duplex(1);
+        let (frames, queued) = mpsc::channel(1);
+        let (failure, _) = mpsc::channel(1);
+        let writer_task = tokio::spawn(write_frames(writer, queued, failure));
+        let (completed, mut completion) = oneshot::channel();
+        frames
+            .send(WriteFrame {
+                payload: b"initialized".to_vec(),
+                _permit: None,
+                completion: Some(completed),
+            })
+            .await
+            .expect("notification frame queues");
+
+        assert!(
+            timeout(Duration::from_millis(30), &mut completion)
+                .await
+                .is_err(),
+            "notification must not report success while its write is blocked"
+        );
+        let mut wire = vec![0_u8; b"initialized\n".len()];
+        reader
+            .read_exact(&mut wire)
+            .await
+            .expect("notification is drained from the wire");
+        completion
+            .await
+            .expect("writer reports notification completion")
+            .expect("write and flush succeed");
+        assert_eq!(wire, b"initialized\n");
+        drop(frames);
+        writer_task.await.expect("writer task exits cleanly");
+    }
+
+    #[tokio::test]
+    async fn shutdown_interrupts_restart_backoff() {
+        let directory = TempDir::new().expect("temporary directory creates");
+        let executable = script(&directory, "crash-server", "#!/bin/sh\nexit 1\n");
+        let limits = StdioTransportLimits {
+            request_timeout: Duration::from_secs(5),
+            initial_restart_backoff: Duration::from_secs(2),
+            max_restart_backoff: Duration::from_secs(2),
+            ..StdioTransportLimits::default()
+        };
+        let client = std::sync::Arc::new(
+            StdioClient::connect(template(executable), limits)
+                .await
+                .expect("initial spawn succeeds"),
+        );
+        let _ = client
+            .initialize(
+                DEFAULT_PROTOCOL_VERSION,
+                json!({ "name": "executor", "version": "1" }),
+                json!({}),
+            )
+            .await;
+        let retry_client = client.clone();
+        let retry = tokio::spawn(async move {
+            retry_client
+                .initialize(
+                    DEFAULT_PROTOCOL_VERSION,
+                    json!({ "name": "executor", "version": "1" }),
+                    json!({}),
+                )
+                .await
+        });
+        tokio::time::sleep(Duration::from_millis(50)).await;
+        let (completed, completion) = oneshot::channel();
+        let started = Instant::now();
+        client
+            .commands
+            .send(ClientCommand::Shutdown {
+                completed: Some(completed),
+            })
+            .await
+            .expect("shutdown queues");
+        timeout(Duration::from_millis(500), completion)
+            .await
+            .expect("shutdown interrupts backoff")
+            .expect("actor acknowledges shutdown");
+        assert!(started.elapsed() < Duration::from_millis(500));
+        assert!(retry.await.expect("retry task completes").is_err());
+    }
+
+    #[tokio::test]
+    async fn canceling_initialize_resets_before_retry() {
+        let directory = TempDir::new().expect("temporary directory creates");
+        let marker = directory.path().join("first-start");
+        let executable = script(
+            &directory,
+            "cancel-initialize-server",
+            r#"#!/bin/sh
+read line
+if [ -f "$MARKER" ]; then
+  printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"protocolVersion":"2025-11-25","capabilities":{}}}'
+else
+  printf x > "$MARKER"
+fi
+while IFS= read -r line; do :; done
+"#,
+        );
+        let mut trusted = template(executable);
+        trusted
+            .environment
+            .insert("MARKER".to_owned(), marker.to_string_lossy().into_owned());
+        let limits = StdioTransportLimits {
+            request_timeout: Duration::from_secs(2),
+            shutdown_grace: Duration::from_millis(40),
+            initial_restart_backoff: Duration::from_millis(10),
+            max_restart_backoff: Duration::from_millis(20),
+            ..StdioTransportLimits::default()
+        };
+        let client = std::sync::Arc::new(
+            StdioClient::connect(trusted, limits)
+                .await
+                .expect("client connects"),
+        );
+        let initializing_client = client.clone();
+        let initializing = tokio::spawn(async move {
+            initializing_client
+                .initialize(
+                    DEFAULT_PROTOCOL_VERSION,
+                    json!({ "name": "executor", "version": "1" }),
+                    json!({}),
+                )
+                .await
+        });
+        timeout(Duration::from_secs(1), async {
+            while !marker.exists() {
+                tokio::time::sleep(Duration::from_millis(5)).await;
+            }
+        })
+        .await
+        .expect("first initialization reaches child");
+        initializing.abort();
+        let _ = initializing.await;
+        timeout(Duration::from_secs(1), async {
+            while lifecycle_state(client.lifecycle.load(Ordering::Acquire))
+                != LIFECYCLE_UNINITIALIZED
+            {
+                tokio::time::sleep(Duration::from_millis(5)).await;
+            }
+        })
+        .await
+        .expect("canceled initialization cleanup completes");
+        initialize_client(&client).await;
+        std::sync::Arc::try_unwrap(client)
+            .ok()
+            .expect("initialization task released its client")
+            .shutdown()
+            .await;
+    }
+
+    #[tokio::test]
+    async fn stale_lifecycle_commands_cannot_mutate_a_new_generation() {
+        let directory = TempDir::new().expect("temporary directory creates");
+        let marker = directory.path().join("first-generation");
+        let executable = script(
+            &directory,
+            "generation-server",
+            r#"#!/bin/sh
+read line
+if [ -f "$MARKER" ]; then
+  printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"protocolVersion":"2025-11-25","capabilities":{}}}'
+  read line
+  read line
+  printf '%s\n' '{"jsonrpc":"2.0","id":3,"result":{"tools":[]}}'
+else
+  printf x > "$MARKER"
+  printf '%s\n' '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2025-11-25","capabilities":{}}}'
+fi
+while IFS= read -r line; do :; done
+"#,
+        );
+        let mut trusted = template(executable);
+        trusted
+            .environment
+            .insert("MARKER".to_owned(), marker.to_string_lossy().into_owned());
+        let client = StdioClient::connect(trusted, StdioTransportLimits::default())
+            .await
+            .expect("client connects");
+        initialize_client(&client).await;
+        let first_generation = lifecycle_generation(client.lifecycle.load(Ordering::Acquire));
+        client.reset_transport(first_generation).await;
+        initialize_client(&client).await;
+
+        let (completed, completion) = oneshot::channel();
+        client
+            .commands
+            .send(ClientCommand::Reset {
+                generation: first_generation,
+                completed,
+            })
+            .await
+            .expect("stale reset queues");
+        completion.await.expect("stale reset is acknowledged");
+        assert_eq!(
+            lifecycle_state(client.lifecycle.load(Ordering::Acquire)),
+            LIFECYCLE_INITIALIZED
+        );
+        assert!(matches!(
+            client
+                .notify(
+                    "notifications/initialized",
+                    json!({}),
+                    Some(first_generation),
+                )
+                .await,
+            Err(StdioTransportError::Closed)
+        ));
+        assert_eq!(
+            lifecycle_state(client.lifecycle.load(Ordering::Acquire)),
+            LIFECYCLE_INITIALIZED
+        );
+        assert!(client.list_tools(None).await.is_ok());
+        client.shutdown().await;
+    }
+
+    #[tokio::test]
+    async fn mismatched_initialization_does_not_reset_exponential_backoff() {
+        let directory = TempDir::new().expect("temporary directory creates");
+        let first = directory.path().join("first");
+        let second = directory.path().join("second");
+        let executable = script(
+            &directory,
+            "mismatch-server",
+            r#"#!/bin/sh
+read line
+if [ ! -f "$FIRST" ]; then
+  printf x > "$FIRST"; id=1
+elif [ ! -f "$SECOND" ]; then
+  printf x > "$SECOND"; id=2
+else
+  id=3
+fi
+printf '{"jsonrpc":"2.0","id":%s,"result":{"protocolVersion":"2025-06-18","capabilities":{}}}\n' "$id"
+while IFS= read -r line; do :; done
+"#,
+        );
+        let mut trusted = template(executable);
+        trusted.environment.extend([
+            ("FIRST".to_owned(), first.to_string_lossy().into_owned()),
+            ("SECOND".to_owned(), second.to_string_lossy().into_owned()),
+        ]);
+        let limits = StdioTransportLimits {
+            request_timeout: Duration::from_secs(1),
+            shutdown_grace: Duration::from_millis(20),
+            initial_restart_backoff: Duration::from_millis(60),
+            max_restart_backoff: Duration::from_millis(120),
+            ..StdioTransportLimits::default()
+        };
+        let client = StdioClient::connect(trusted, limits)
+            .await
+            .expect("client connects");
+        for (attempt, minimum_delay) in [
+            (0, Duration::ZERO),
+            (1, Duration::from_millis(45)),
+            (2, Duration::from_millis(100)),
+        ] {
+            let started = Instant::now();
+            let error = client
+                .initialize(
+                    DEFAULT_PROTOCOL_VERSION,
+                    json!({ "name": "executor", "version": "1" }),
+                    json!({}),
+                )
+                .await
+                .expect_err("mismatched version remains rejected");
+            assert!(matches!(
+                error,
+                StdioTransportError::ProtocolVersionMismatch
+            ));
+            assert!(
+                started.elapsed() >= minimum_delay,
+                "attempt {attempt} did not observe its accumulated backoff"
+            );
+        }
+        client.shutdown().await;
+    }
+
+    #[test]
+    fn limits_and_merged_secret_environment_are_strictly_bounded() {
+        let limits = StdioTransportLimits {
+            initial_restart_backoff: Duration::from_secs(31),
+            max_restart_backoff: Duration::from_secs(31),
+            ..StdioTransportLimits::default()
+        };
+        assert!(matches!(
+            limits.validate(),
+            Err(StdioTransportError::InvalidLimits)
+        ));
+
+        let approved = (0..128).map(|index| format!("SECRET_{index}"));
+        let secrets = approved
+            .clone()
+            .map(|name| (name, "value".to_owned()))
+            .collect::<BTreeMap<_, _>>();
+        let base = BTreeMap::from([("STATIC".to_owned(), "value".to_owned())]);
+        assert!(validate_environment(&base).is_ok());
+        let mut merged = base;
+        merged.extend(secrets);
+        assert!(matches!(
+            validate_environment(&merged),
+            Err(StdioTemplateError::TooManyEnvironmentEntries)
+        ));
+    }
+
+    #[test]
+    fn packed_lifecycle_transitions_reject_stale_generation_races() {
+        let lifecycle = AtomicU64::new(lifecycle_word(1, LIFECYCLE_INITIALIZING));
+        assert!(matches!(
+            acquire_lifecycle_generation(&lifecycle),
+            Err(StdioTransportError::AlreadyInitialized)
+        ));
+        reset_lifecycle_generation(&lifecycle, 0);
+        assert_eq!(
+            lifecycle.load(Ordering::Acquire),
+            lifecycle_word(1, LIFECYCLE_INITIALIZING)
+        );
+        reset_lifecycle_generation(&lifecycle, 1);
+        let second = acquire_lifecycle_generation(&lifecycle).expect("next generation acquires");
+        assert_eq!(second, 2);
+
+        assert!(
+            lifecycle
+                .compare_exchange(
+                    lifecycle_word(1, LIFECYCLE_INITIALIZING),
+                    lifecycle_word(1, LIFECYCLE_INITIALIZED),
+                    Ordering::AcqRel,
+                    Ordering::Acquire,
+                )
+                .is_err(),
+            "stale finalization cannot initialize the next generation"
+        );
+        reset_lifecycle_generation(&lifecycle, 1);
+        assert_eq!(
+            lifecycle.load(Ordering::Acquire),
+            lifecycle_word(2, LIFECYCLE_INITIALIZING),
+            "stale reset fallback cannot clear the next generation"
+        );
+    }
+}
diff --git a/src/oauth/crypto.rs b/src/oauth/crypto.rs
new file mode 100644
index 000000000..fd752d1af
--- /dev/null
+++ b/src/oauth/crypto.rs
@@ -0,0 +1,164 @@
+use thiserror::Error;
+
+use crate::crypto::{CryptoError, Keyring, generate_secret};
+
+use super::model::OAuthSecretSet;
+
+const CONNECTION_SECRET_PURPOSE: &str = "oauth-connection-secret-v1";
+const AUTHORIZATION_STATE_PURPOSE: &str = "oauth-authorization-state-v1";
+const AUTHORIZATION_CLAIM_PURPOSE: &str = "oauth-authorization-claim-v1";
+const PKCE_VERIFIER_PURPOSE: &str = "oauth-pkce-verifier-v1";
+const REFRESH_LEASE_PURPOSE: &str = "oauth-refresh-lease-v1";
+
+#[derive(Debug, Error)]
+pub(crate) enum OAuthCryptoError {
+    #[error(transparent)]
+    Crypto(#[from] CryptoError),
+    #[error("could not encode protected OAuth data")]
+    Encode(#[source] serde_json::Error),
+    #[error("could not decode protected OAuth data")]
+    Decode(#[source] serde_json::Error),
+    #[error("the protected OAuth text was not valid UTF-8")]
+    InvalidUtf8,
+}
+
+#[derive(Clone)]
+pub(crate) struct OAuthCrypto {
+    keyring: Keyring,
+}
+
+impl OAuthCrypto {
+    pub(crate) fn new(keyring: Keyring) -> Self {
+        Self { keyring }
+    }
+
+    pub(crate) fn new_state(&self) -> String {
+        generate_secret("oas_")
+    }
+
+    pub(crate) fn new_claim_token(&self) -> String {
+        generate_secret("oac_")
+    }
+
+    pub(crate) fn new_refresh_lease_token(&self) -> String {
+        generate_secret("oar_")
+    }
+
+    pub(crate) fn new_pkce_verifier(&self) -> String {
+        generate_secret("")
+    }
+
+    pub(crate) fn state_digest(&self, state: &str) -> [u8; 32] {
+        self.keyring
+            .digest(AUTHORIZATION_STATE_PURPOSE, state.as_bytes())
+    }
+
+    pub(crate) fn authorization_claim_digest(&self, claim: &str) -> [u8; 32] {
+        self.keyring
+            .digest(AUTHORIZATION_CLAIM_PURPOSE, claim.as_bytes())
+    }
+
+    pub(crate) fn refresh_lease_digest(&self, lease: &str) -> [u8; 32] {
+        self.keyring.digest(REFRESH_LEASE_PURPOSE, lease.as_bytes())
+    }
+
+    pub(crate) fn seal_pkce_verifier(
+        &self,
+        transaction_id: &str,
+        verifier: &str,
+    ) -> Result<Vec<u8>, OAuthCryptoError> {
+        self.keyring
+            .encrypt(PKCE_VERIFIER_PURPOSE, transaction_id, verifier.as_bytes())
+            .map_err(Into::into)
+    }
+
+    pub(crate) fn open_pkce_verifier(
+        &self,
+        transaction_id: &str,
+        ciphertext: &[u8],
+    ) -> Result<String, OAuthCryptoError> {
+        let plaintext = self
+            .keyring
+            .decrypt(PKCE_VERIFIER_PURPOSE, transaction_id, ciphertext)?;
+        String::from_utf8(plaintext).map_err(|_| OAuthCryptoError::InvalidUtf8)
+    }
+
+    pub(crate) fn seal_secrets(
+        &self,
+        connection_id: &str,
+        revision: i64,
+        secrets: &OAuthSecretSet,
+    ) -> Result<Vec<u8>, OAuthCryptoError> {
+        let plaintext = serde_json::to_vec(secrets).map_err(OAuthCryptoError::Encode)?;
+        self.keyring
+            .encrypt(
+                CONNECTION_SECRET_PURPOSE,
+                &secret_record_id(connection_id, revision),
+                &plaintext,
+            )
+            .map_err(Into::into)
+    }
+
+    pub(crate) fn open_secrets(
+        &self,
+        connection_id: &str,
+        revision: i64,
+        ciphertext: &[u8],
+    ) -> Result<OAuthSecretSet, OAuthCryptoError> {
+        let plaintext = self.keyring.decrypt(
+            CONNECTION_SECRET_PURPOSE,
+            &secret_record_id(connection_id, revision),
+            ciphertext,
+        )?;
+        serde_json::from_slice(&plaintext).map_err(OAuthCryptoError::Decode)
+    }
+}
+
+fn secret_record_id(connection_id: &str, revision: i64) -> String {
+    format!("{connection_id}:{revision}")
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::crypto::Keyring;
+
+    use super::{OAuthCrypto, OAuthSecretSet};
+
+    #[test]
+    fn secret_envelopes_are_bound_to_connection_and_revision() {
+        let crypto = OAuthCrypto::new(Keyring::from_master_key([3; 32]).unwrap());
+        let secrets = OAuthSecretSet {
+            client_secret: Some("client-secret".into()),
+            access_token: Some("access-token".into()),
+            refresh_token: Some("refresh-token".into()),
+            token_type: Some("Bearer".into()),
+            granted_scopes: vec!["read".into()],
+            access_token_expires_at: Some(42),
+        };
+        let ciphertext = crypto.seal_secrets("connection-a", 1, &secrets).unwrap();
+
+        let opened = crypto.open_secrets("connection-a", 1, &ciphertext).unwrap();
+        assert_eq!(opened.access_token.as_deref(), Some("access-token"));
+        assert!(crypto.open_secrets("connection-b", 1, &ciphertext).is_err());
+        assert!(crypto.open_secrets("connection-a", 2, &ciphertext).is_err());
+    }
+
+    #[test]
+    fn pkce_envelopes_are_bound_to_the_authorization_transaction() {
+        let crypto = OAuthCrypto::new(Keyring::from_master_key([4; 32]).unwrap());
+        let ciphertext = crypto
+            .seal_pkce_verifier("transaction-a", "verifier")
+            .unwrap();
+        assert_eq!(
+            crypto
+                .open_pkce_verifier("transaction-a", &ciphertext)
+                .unwrap(),
+            "verifier"
+        );
+        assert!(
+            crypto
+                .open_pkce_verifier("transaction-b", &ciphertext)
+                .is_err()
+        );
+    }
+}
diff --git a/src/oauth/discovery.rs b/src/oauth/discovery.rs
new file mode 100644
index 000000000..3e727ac00
--- /dev/null
+++ b/src/oauth/discovery.rs
@@ -0,0 +1,401 @@
+use serde::Deserialize;
+use thiserror::Error;
+use url::Url;
+
+use crate::outbound::{OutboundError, OutboundPolicy, parse_url};
+
+#[derive(Clone)]
+pub struct AuthorizationServerMetadata {
+    pub issuer: String,
+    pub authorization_endpoint: Url,
+    pub token_endpoint: Url,
+    pub scopes_supported: Vec<String>,
+    pub token_endpoint_auth_methods_supported: Vec<String>,
+}
+
+#[derive(Clone)]
+pub struct ProtectedResourceMetadata {
+    pub authorization_servers: Vec<Url>,
+    pub scopes_supported: Vec<String>,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum TokenEndpointAuthMethod {
+    None,
+    ClientSecretBasic,
+    ClientSecretPost,
+}
+
+#[derive(Debug, Error)]
+pub enum OAuthDiscoveryError {
+    #[error("the OAuth URL is invalid")]
+    InvalidUrl,
+    #[error("OAuth endpoints must use HTTPS, except loopback HTTP in local-test mode")]
+    InsecureEndpoint,
+    #[error("OAuth issuer URLs must not contain a query or fragment")]
+    InvalidIssuer,
+    #[error("OAuth metadata discovery failed")]
+    Transport(#[source] OutboundError),
+    #[error("OAuth metadata is malformed")]
+    MalformedMetadata,
+    #[error("authorization server metadata issuer does not exactly match the requested issuer")]
+    IssuerMismatch,
+    #[error("the authorization server does not advertise authorization code support")]
+    AuthorizationCodeUnsupported,
+    #[error("the authorization server does not advertise PKCE S256 support")]
+    PkceS256Unsupported,
+    #[error("the authorization server does not support the selected token authentication method")]
+    TokenAuthMethodUnsupported,
+    #[error("protected resource metadata does not match the requested resource")]
+    ResourceMismatch,
+    #[error("the requested OAuth scopes include the unsupported openid scope")]
+    OpenIdUnsupported,
+}
+
+impl OAuthDiscoveryError {
+    pub fn code(&self) -> &'static str {
+        match self {
+            Self::InvalidUrl => "invalid_oauth_url",
+            Self::InsecureEndpoint => "insecure_oauth_endpoint",
+            Self::InvalidIssuer => "invalid_oauth_issuer",
+            Self::Transport(error) => error.code(),
+            Self::MalformedMetadata => "malformed_oauth_metadata",
+            Self::IssuerMismatch => "oauth_issuer_mismatch",
+            Self::AuthorizationCodeUnsupported => "oauth_authorization_code_unsupported",
+            Self::PkceS256Unsupported => "oauth_pkce_s256_unsupported",
+            Self::TokenAuthMethodUnsupported => "oauth_token_auth_method_unsupported",
+            Self::ResourceMismatch => "oauth_resource_mismatch",
+            Self::OpenIdUnsupported => "oauth_openid_unsupported",
+        }
+    }
+}
+
+#[derive(Deserialize)]
+pub(crate) struct RawAuthorizationServerMetadata {
+    pub issuer: String,
+    pub authorization_endpoint: String,
+    pub token_endpoint: String,
+    #[serde(default)]
+    pub scopes_supported: Vec<String>,
+    #[serde(default)]
+    pub response_types_supported: Vec<String>,
+    #[serde(default)]
+    pub grant_types_supported: Vec<String>,
+    #[serde(default)]
+    pub code_challenge_methods_supported: Vec<String>,
+    #[serde(default)]
+    pub token_endpoint_auth_methods_supported: Vec<String>,
+}
+
+#[derive(Deserialize)]
+pub(crate) struct RawProtectedResourceMetadata {
+    pub resource: Option<String>,
+    #[serde(default)]
+    pub authorization_servers: Vec<String>,
+    #[serde(default)]
+    pub scopes_supported: Vec<String>,
+}
+
+pub(crate) fn authorization_server_metadata_url(
+    issuer: &str,
+    policy: &OutboundPolicy,
+) -> Result<Url, OAuthDiscoveryError> {
+    let issuer_url = validate_issuer(issuer, policy)?;
+    let path = issuer_url.path().trim_end_matches('/');
+    let metadata = if path.is_empty() {
+        format!(
+            "{}/.well-known/oauth-authorization-server",
+            issuer_url.origin().ascii_serialization()
+        )
+    } else {
+        format!(
+            "{}/.well-known/oauth-authorization-server{path}",
+            issuer_url.origin().ascii_serialization()
+        )
+    };
+    validate_oauth_url(&metadata, policy)
+}
+
+pub(crate) fn protected_resource_metadata_urls(
+    resource: &str,
+    policy: &OutboundPolicy,
+) -> Result<Vec<Url>, OAuthDiscoveryError> {
+    let resource = validate_oauth_url(resource, policy)?;
+    let origin = resource.origin().ascii_serialization();
+    let path = resource.path().trim_end_matches('/');
+    let mut urls = Vec::with_capacity(2);
+    if !path.is_empty() {
+        urls.push(validate_oauth_url(
+            &format!("{origin}/.well-known/oauth-protected-resource{path}"),
+            policy,
+        )?);
+    }
+    urls.push(validate_oauth_url(
+        &format!("{origin}/.well-known/oauth-protected-resource"),
+        policy,
+    )?);
+    Ok(urls)
+}
+
+pub(crate) fn validate_authorization_server_metadata(
+    requested_issuer: &str,
+    raw: RawAuthorizationServerMetadata,
+    policy: &OutboundPolicy,
+) -> Result<AuthorizationServerMetadata, OAuthDiscoveryError> {
+    if raw.issuer != requested_issuer {
+        return Err(OAuthDiscoveryError::IssuerMismatch);
+    }
+    validate_issuer(&raw.issuer, policy)?;
+    let authorization_endpoint = validate_oauth_url(&raw.authorization_endpoint, policy)?;
+    let token_endpoint = validate_oauth_url(&raw.token_endpoint, policy)?;
+
+    if !raw.response_types_supported.is_empty()
+        && !raw
+            .response_types_supported
+            .iter()
+            .any(|value| value == "code")
+    {
+        return Err(OAuthDiscoveryError::AuthorizationCodeUnsupported);
+    }
+    if !raw.grant_types_supported.is_empty()
+        && !raw
+            .grant_types_supported
+            .iter()
+            .any(|value| value == "authorization_code")
+    {
+        return Err(OAuthDiscoveryError::AuthorizationCodeUnsupported);
+    }
+    if !raw
+        .code_challenge_methods_supported
+        .iter()
+        .any(|value| value == "S256")
+    {
+        return Err(OAuthDiscoveryError::PkceS256Unsupported);
+    }
+
+    Ok(AuthorizationServerMetadata {
+        issuer: raw.issuer,
+        authorization_endpoint,
+        token_endpoint,
+        scopes_supported: raw.scopes_supported,
+        token_endpoint_auth_methods_supported: raw.token_endpoint_auth_methods_supported,
+    })
+}
+
+pub(crate) fn validate_protected_resource_metadata(
+    requested_resource: &str,
+    raw: RawProtectedResourceMetadata,
+    policy: &OutboundPolicy,
+) -> Result<ProtectedResourceMetadata, OAuthDiscoveryError> {
+    let expected = canonical_resource(requested_resource, policy)?;
+    let resource = raw.resource.ok_or(OAuthDiscoveryError::MalformedMetadata)?;
+    let resource = canonical_resource(&resource, policy)?;
+    if resource != expected {
+        return Err(OAuthDiscoveryError::ResourceMismatch);
+    }
+    let authorization_servers = raw
+        .authorization_servers
+        .iter()
+        .map(|issuer| validate_issuer(issuer, policy))
+        .collect::<Result<Vec<_>, _>>()?;
+    Ok(ProtectedResourceMetadata {
+        authorization_servers,
+        scopes_supported: raw.scopes_supported,
+    })
+}
+
+pub fn ensure_scopes_supported(scopes: &[String]) -> Result<(), OAuthDiscoveryError> {
+    if scopes.iter().any(|scope| scope == "openid") {
+        return Err(OAuthDiscoveryError::OpenIdUnsupported);
+    }
+    Ok(())
+}
+
+pub fn ensure_token_auth_method(
+    metadata: &AuthorizationServerMetadata,
+    method: TokenEndpointAuthMethod,
+) -> Result<(), OAuthDiscoveryError> {
+    let advertised = &metadata.token_endpoint_auth_methods_supported;
+    let supported = match method {
+        TokenEndpointAuthMethod::None => advertised.iter().any(|value| value == "none"),
+        TokenEndpointAuthMethod::ClientSecretBasic => {
+            advertised.is_empty()
+                || advertised
+                    .iter()
+                    .any(|value| value == "client_secret_basic")
+        }
+        TokenEndpointAuthMethod::ClientSecretPost => {
+            advertised.iter().any(|value| value == "client_secret_post")
+        }
+    };
+    if supported {
+        Ok(())
+    } else {
+        Err(OAuthDiscoveryError::TokenAuthMethodUnsupported)
+    }
+}
+
+pub(crate) fn validate_oauth_url(
+    value: &str,
+    policy: &OutboundPolicy,
+) -> Result<Url, OAuthDiscoveryError> {
+    let url = parse_url(value, policy).map_err(map_url_error)?;
+    if url.scheme() == "https"
+        || (url.scheme() == "http" && policy.allow_private_networks && is_loopback(&url))
+    {
+        Ok(url)
+    } else {
+        Err(OAuthDiscoveryError::InsecureEndpoint)
+    }
+}
+
+fn validate_issuer(value: &str, policy: &OutboundPolicy) -> Result<Url, OAuthDiscoveryError> {
+    let url = validate_oauth_url(value, policy)?;
+    if url.query().is_some() || url.fragment().is_some() {
+        return Err(OAuthDiscoveryError::InvalidIssuer);
+    }
+    Ok(url)
+}
+
+fn canonical_resource(value: &str, policy: &OutboundPolicy) -> Result<String, OAuthDiscoveryError> {
+    let mut url = validate_oauth_url(value, policy)?;
+    url.set_query(None);
+    url.set_fragment(None);
+    let path = url.path().trim_end_matches('/').to_owned();
+    url.set_path(&path);
+    Ok(url.to_string().trim_end_matches('/').to_owned())
+}
+
+fn is_loopback(url: &Url) -> bool {
+    match url.host() {
+        Some(url::Host::Ipv4(address)) => address.is_loopback(),
+        Some(url::Host::Ipv6(address)) => address.is_loopback(),
+        Some(url::Host::Domain(hostname)) => hostname.eq_ignore_ascii_case("localhost"),
+        None => false,
+    }
+}
+
+fn map_url_error(error: OutboundError) -> OAuthDiscoveryError {
+    match error {
+        OutboundError::InvalidUrl
+        | OutboundError::UnsupportedScheme
+        | OutboundError::CredentialsNotAllowed
+        | OutboundError::FragmentNotAllowed
+        | OutboundError::MissingHost
+        | OutboundError::MissingPort => OAuthDiscoveryError::InvalidUrl,
+        error => OAuthDiscoveryError::Transport(error),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn local_policy() -> OutboundPolicy {
+        OutboundPolicy {
+            allow_private_networks: true,
+            ..OutboundPolicy::default()
+        }
+    }
+
+    fn raw_metadata(issuer: &str) -> RawAuthorizationServerMetadata {
+        RawAuthorizationServerMetadata {
+            issuer: issuer.to_owned(),
+            authorization_endpoint: format!("{issuer}/authorize"),
+            token_endpoint: format!("{issuer}/token"),
+            scopes_supported: vec![],
+            response_types_supported: vec!["code".to_owned()],
+            grant_types_supported: vec!["authorization_code".to_owned()],
+            code_challenge_methods_supported: vec!["S256".to_owned()],
+            token_endpoint_auth_methods_supported: vec![
+                "none".to_owned(),
+                "client_secret_post".to_owned(),
+            ],
+        }
+    }
+
+    #[test]
+    fn issuer_path_is_appended_after_the_well_known_segment() {
+        let url = authorization_server_metadata_url("https://auth.example/tenant", &local_policy())
+            .expect("metadata URL is valid");
+        assert_eq!(
+            url.as_str(),
+            "https://auth.example/.well-known/oauth-authorization-server/tenant"
+        );
+    }
+
+    #[test]
+    fn metadata_issuer_requires_an_exact_string_match() {
+        let error = validate_authorization_server_metadata(
+            "https://auth.example",
+            raw_metadata("https://auth.example/"),
+            &local_policy(),
+        )
+        .err()
+        .expect("different issuer spelling is rejected");
+        assert!(matches!(error, OAuthDiscoveryError::IssuerMismatch));
+    }
+
+    #[test]
+    fn only_loopback_http_is_allowed() {
+        assert!(validate_oauth_url("http://localhost:9999/token", &local_policy()).is_ok());
+        assert!(matches!(
+            validate_oauth_url("http://10.0.0.2/token", &local_policy()),
+            Err(OAuthDiscoveryError::InsecureEndpoint)
+        ));
+    }
+
+    #[test]
+    fn client_secret_post_must_be_explicitly_advertised() {
+        let raw = raw_metadata("https://auth.example");
+        let mut metadata =
+            validate_authorization_server_metadata("https://auth.example", raw, &local_policy())
+                .expect("metadata is valid");
+        assert!(
+            ensure_token_auth_method(&metadata, TokenEndpointAuthMethod::ClientSecretPost).is_ok()
+        );
+        metadata.token_endpoint_auth_methods_supported = vec![];
+        assert!(matches!(
+            ensure_token_auth_method(&metadata, TokenEndpointAuthMethod::ClientSecretPost),
+            Err(OAuthDiscoveryError::TokenAuthMethodUnsupported)
+        ));
+        assert!(
+            ensure_token_auth_method(&metadata, TokenEndpointAuthMethod::ClientSecretBasic).is_ok()
+        );
+    }
+
+    #[test]
+    fn openid_scope_is_rejected() {
+        assert!(matches!(
+            ensure_scopes_supported(&["read".to_owned(), "openid".to_owned()]),
+            Err(OAuthDiscoveryError::OpenIdUnsupported)
+        ));
+    }
+
+    #[test]
+    fn protected_resource_metadata_requires_an_exact_resource() {
+        let missing = RawProtectedResourceMetadata {
+            resource: None,
+            authorization_servers: vec![],
+            scopes_supported: vec![],
+        };
+        assert!(matches!(
+            validate_protected_resource_metadata(
+                "https://api.example/v1",
+                missing,
+                &local_policy()
+            ),
+            Err(OAuthDiscoveryError::MalformedMetadata)
+        ));
+
+        let parent = RawProtectedResourceMetadata {
+            resource: Some("https://api.example".to_owned()),
+            authorization_servers: vec![],
+            scopes_supported: vec![],
+        };
+        assert!(matches!(
+            validate_protected_resource_metadata("https://api.example/v1", parent, &local_policy()),
+            Err(OAuthDiscoveryError::ResourceMismatch)
+        ));
+    }
+}
diff --git a/src/oauth/mod.rs b/src/oauth/mod.rs
new file mode 100644
index 000000000..605385274
--- /dev/null
+++ b/src/oauth/mod.rs
@@ -0,0 +1,13 @@
+pub(crate) mod crypto;
+pub(crate) mod discovery;
+pub(crate) mod model;
+mod service;
+pub(crate) mod store;
+pub(crate) mod transport;
+
+pub(crate) use service::{
+    CallbackRequest, ConnectionView, OAuthAccessToken, OAuthBinding, OAuthClientInput,
+    OAuthDiscoveryInput, OAuthError, OAuthService, SaveConnectionRequest,
+};
+#[cfg(test)]
+pub(crate) use service::{ClientAuthentication, ConnectionStatus};
diff --git a/src/oauth/model.rs b/src/oauth/model.rs
new file mode 100644
index 000000000..76fd4220d
--- /dev/null
+++ b/src/oauth/model.rs
@@ -0,0 +1,228 @@
+use serde::{Deserialize, Serialize};
+
+#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub(crate) enum OAuthClientAuthentication {
+    None,
+    ClientSecretBasic,
+    ClientSecretPost,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub(crate) struct OAuthConnectionConfig {
+    pub(crate) issuer: String,
+    pub(crate) authorization_endpoint: String,
+    pub(crate) token_endpoint: String,
+    pub(crate) client_id: String,
+    pub(crate) client_authentication: OAuthClientAuthentication,
+    pub(crate) token_endpoint_auth_methods_supported: Vec<String>,
+    pub(crate) scopes: Vec<String>,
+    pub(crate) allow_private_network: bool,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub(crate) resource: Option<String>,
+}
+
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub(crate) struct OAuthSecretSet {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub(crate) client_secret: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub(crate) access_token: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub(crate) refresh_token: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub(crate) token_type: Option<String>,
+    #[serde(default)]
+    pub(crate) granted_scopes: Vec<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub(crate) access_token_expires_at: Option<i64>,
+}
+
+#[derive(Clone)]
+pub(crate) enum OAuthClientSecretUpdate {
+    Preserve,
+    Replace(Option<String>),
+}
+
+impl std::fmt::Debug for OAuthClientSecretUpdate {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::Preserve => formatter.write_str("Preserve"),
+            Self::Replace(value) => formatter
+                .debug_tuple("Replace")
+                .field(&value.as_ref().map(|_| "[REDACTED]"))
+                .finish(),
+        }
+    }
+}
+
+impl std::fmt::Debug for OAuthSecretSet {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("OAuthSecretSet")
+            .field(
+                "client_secret",
+                &self.client_secret.as_ref().map(|_| "[REDACTED]"),
+            )
+            .field(
+                "access_token",
+                &self.access_token.as_ref().map(|_| "[REDACTED]"),
+            )
+            .field(
+                "refresh_token",
+                &self.refresh_token.as_ref().map(|_| "[REDACTED]"),
+            )
+            .field("token_type", &self.token_type)
+            .field("granted_scopes", &self.granted_scopes)
+            .field("access_token_expires_at", &self.access_token_expires_at)
+            .finish()
+    }
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub(crate) enum OAuthConnectionStatus {
+    PendingAuthorization,
+    Connecting,
+    Active,
+    ReauthorizationRequired,
+}
+
+impl OAuthConnectionStatus {
+    pub(super) fn as_db_str(self) -> &'static str {
+        match self {
+            Self::PendingAuthorization => "pending_authorization",
+            Self::Connecting => "connecting",
+            Self::Active => "active",
+            Self::ReauthorizationRequired => "reauth_required",
+        }
+    }
+
+    pub(super) fn from_db(value: &str) -> Option<Self> {
+        match value {
+            "pending_authorization" => Some(Self::PendingAuthorization),
+            "connecting" => Some(Self::Connecting),
+            "active" => Some(Self::Active),
+            "reauth_required" => Some(Self::ReauthorizationRequired),
+            _ => None,
+        }
+    }
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub(crate) struct OAuthConnection {
+    pub(crate) id: String,
+    pub(crate) source_id: String,
+    pub(crate) credential_key: String,
+    pub(crate) revision: i64,
+    pub(crate) config_revision: i64,
+    pub(crate) secret_revision: Option<i64>,
+    pub(crate) config: OAuthConnectionConfig,
+    pub(crate) status: OAuthConnectionStatus,
+    pub(crate) granted_scopes: Vec<String>,
+    pub(crate) has_client_secret: bool,
+    pub(crate) has_refresh_token: bool,
+    pub(crate) access_expires_at: Option<i64>,
+    pub(crate) authorized_at: Option<i64>,
+    pub(crate) last_refreshed_at: Option<i64>,
+    pub(crate) error_code: Option<String>,
+    pub(crate) created_at: i64,
+    pub(crate) updated_at: i64,
+}
+
+#[derive(Clone)]
+pub(crate) struct OAuthCredential {
+    pub(crate) connection: OAuthConnection,
+    pub(crate) secrets: Option<OAuthSecretSet>,
+}
+
+impl std::fmt::Debug for OAuthCredential {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("OAuthCredential")
+            .field("connection", &self.connection)
+            .field("secrets", &self.secrets)
+            .finish()
+    }
+}
+
+#[derive(Clone)]
+pub(crate) struct PendingAuthorization {
+    pub(crate) transaction_id: String,
+    pub(crate) state: String,
+    pub(crate) pkce_verifier: String,
+    pub(crate) config_revision: i64,
+    pub(crate) expires_at: i64,
+}
+
+impl std::fmt::Debug for PendingAuthorization {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("PendingAuthorization")
+            .field("transaction_id", &self.transaction_id)
+            .field("state", &"[REDACTED]")
+            .field("pkce_verifier", &"[REDACTED]")
+            .field("config_revision", &self.config_revision)
+            .field("expires_at", &self.expires_at)
+            .finish()
+    }
+}
+
+#[derive(Clone)]
+pub(crate) struct AuthorizationExchangeClaim {
+    pub(crate) transaction_id: String,
+    pub(crate) connection_id: String,
+    pub(crate) connection_revision: i64,
+    pub(crate) config_revision: i64,
+    pub(crate) config: OAuthConnectionConfig,
+    pub(crate) base_secret_revision: Option<i64>,
+    pub(crate) secrets: Option<OAuthSecretSet>,
+    pub(crate) claim_token: String,
+    pub(crate) pkce_verifier: String,
+}
+
+impl std::fmt::Debug for AuthorizationExchangeClaim {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("AuthorizationExchangeClaim")
+            .field("transaction_id", &self.transaction_id)
+            .field("connection_id", &self.connection_id)
+            .field("connection_revision", &self.connection_revision)
+            .field("config_revision", &self.config_revision)
+            .field("config", &self.config)
+            .field("base_secret_revision", &self.base_secret_revision)
+            .field("secrets", &self.secrets)
+            .field("claim_token", &"[REDACTED]")
+            .field("pkce_verifier", &"[REDACTED]")
+            .finish()
+    }
+}
+
+#[derive(Clone)]
+pub(crate) struct RefreshClaim {
+    pub(crate) connection_id: String,
+    pub(crate) connection_revision: i64,
+    pub(crate) config_revision: i64,
+    pub(crate) config: OAuthConnectionConfig,
+    pub(crate) base_secret_revision: i64,
+    pub(crate) secrets: OAuthSecretSet,
+    pub(crate) lease_token: String,
+    pub(crate) expires_at: i64,
+}
+
+impl std::fmt::Debug for RefreshClaim {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("RefreshClaim")
+            .field("connection_id", &self.connection_id)
+            .field("connection_revision", &self.connection_revision)
+            .field("config_revision", &self.config_revision)
+            .field("config", &self.config)
+            .field("base_secret_revision", &self.base_secret_revision)
+            .field("secrets", &self.secrets)
+            .field("lease_token", &"[REDACTED]")
+            .field("expires_at", &self.expires_at)
+            .finish()
+    }
+}
diff --git a/src/oauth/service.rs b/src/oauth/service.rs
new file mode 100644
index 000000000..beff7f4d9
--- /dev/null
+++ b/src/oauth/service.rs
@@ -0,0 +1,1960 @@
+use std::{
+    collections::HashMap,
+    sync::{Arc, Mutex, Weak},
+};
+
+use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+use sqlx::{Row, SqlitePool};
+use thiserror::Error;
+use tokio::sync::Mutex as AsyncMutex;
+use url::Url;
+
+use crate::{crypto::Keyring, outbound::OutboundPolicy, unix_timestamp};
+
+use super::{
+    discovery::{
+        AuthorizationServerMetadata, TokenEndpointAuthMethod, ensure_scopes_supported,
+        ensure_token_auth_method,
+    },
+    model::{
+        OAuthClientAuthentication as StoredClientAuthentication, OAuthClientSecretUpdate,
+        OAuthConnection, OAuthConnectionConfig, OAuthConnectionStatus, OAuthSecretSet,
+        RefreshClaim,
+    },
+    store::{OAuthStore, OAuthStoreError},
+    transport::{
+        AuthorizationCodeExchange, AuthorizationRequest, OAuthClientAuthentication,
+        OAuthHttpTransport, OAuthTransportError, RefreshTokenExchange, TokenResponse,
+    },
+};
+
+const AUTHORIZATION_TTL_SECONDS: i64 = 10 * 60;
+const ACCESS_TOKEN_MIN_VALIDITY_SECONDS: i64 = 30;
+const REFRESH_LEASE_TTL_SECONDS: i64 = 60;
+const MAX_DISPLAY_URL_BYTES: usize = 16 * 1024;
+const MAX_CLIENT_ID_BYTES: usize = 4 * 1024;
+const MAX_CLIENT_SECRET_BYTES: usize = 64 * 1024;
+const MAX_CREDENTIAL_KEY_BYTES: usize = 128;
+const MAX_SCOPES: usize = 64;
+const MAX_SCOPE_BYTES: usize = 256;
+const MAX_STATE_BYTES: usize = 256;
+const MAX_AUTHORIZATION_CODE_BYTES: usize = 64 * 1024;
+
+#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub(crate) enum ClientAuthentication {
+    None,
+    ClientSecretBasic,
+    ClientSecretPost,
+}
+
+#[derive(Clone, Debug, Deserialize)]
+#[serde(
+    tag = "type",
+    rename_all = "snake_case",
+    rename_all_fields = "camelCase",
+    deny_unknown_fields
+)]
+pub(crate) enum OAuthDiscoveryInput {
+    Issuer {
+        issuer: String,
+    },
+    Mcp {
+        authorization_server: Option<String>,
+    },
+}
+
+#[derive(Clone, Deserialize)]
+#[serde(tag = "action", rename_all = "snake_case", deny_unknown_fields)]
+pub(crate) enum ClientSecretMutation {
+    Preserve,
+    Replace { value: String },
+}
+
+impl std::fmt::Debug for ClientSecretMutation {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::Preserve => formatter.write_str("Preserve"),
+            Self::Replace { .. } => formatter.write_str("Replace([REDACTED])"),
+        }
+    }
+}
+
+#[derive(Clone, Debug, Deserialize)]
+#[serde(
+    tag = "authentication",
+    rename_all = "snake_case",
+    rename_all_fields = "camelCase",
+    deny_unknown_fields
+)]
+pub(crate) enum OAuthClientInput {
+    None {
+        client_id: String,
+    },
+    ClientSecretBasic {
+        client_id: String,
+        client_secret: ClientSecretMutation,
+    },
+    ClientSecretPost {
+        client_id: String,
+        client_secret: ClientSecretMutation,
+    },
+}
+
+pub(crate) struct SaveConnectionRequest {
+    pub(crate) expected_revision: i64,
+    pub(crate) discovery: OAuthDiscoveryInput,
+    pub(crate) client: OAuthClientInput,
+    pub(crate) scopes: Vec<String>,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub(crate) enum ConnectionStatus {
+    #[allow(dead_code)]
+    NotConfigured,
+    ReadyToConnect,
+    Connecting,
+    Connected,
+    ReauthorizationRequired,
+    Error,
+}
+
+#[derive(Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub(crate) struct ConnectionView {
+    pub(crate) id: String,
+    pub(crate) credential_key: String,
+    pub(crate) revision: i64,
+    pub(crate) status: ConnectionStatus,
+    pub(crate) issuer: String,
+    pub(crate) client_id: String,
+    pub(crate) client_auth_method: ClientAuthentication,
+    pub(crate) callback_url: String,
+    pub(crate) requested_scopes: Vec<String>,
+    pub(crate) granted_scopes: Vec<String>,
+    pub(crate) has_client_secret: bool,
+    pub(crate) has_refresh_token: bool,
+    pub(crate) access_expires_at: Option<i64>,
+    pub(crate) authorized_at: Option<i64>,
+    pub(crate) last_refreshed_at: Option<i64>,
+    pub(crate) error_code: Option<String>,
+}
+
+pub(crate) struct AuthorizationStart {
+    pub(crate) authorization_url: String,
+}
+
+pub(crate) struct CallbackRequest {
+    pub(crate) connection_id: String,
+    pub(crate) state: String,
+    pub(crate) code: Option<String>,
+    pub(crate) error: Option<String>,
+}
+
+pub(crate) struct CallbackResult {
+    pub(crate) connection_id: String,
+    pub(crate) source_id: String,
+}
+
+#[derive(Debug, Error)]
+pub(crate) enum OAuthError {
+    #[error("invalid OAuth input")]
+    Validation {
+        code: &'static str,
+        message: &'static str,
+    },
+    #[error("the OAuth connection was not found")]
+    NotFound,
+    #[error("the OAuth connection changed concurrently")]
+    Conflict {
+        code: &'static str,
+        message: &'static str,
+    },
+    #[error("the OAuth transaction is not valid for this session")]
+    UnauthorizedTransaction,
+    #[error("OAuth authorization was denied")]
+    AuthorizationDenied { connection_id: String },
+    #[error("the OAuth provider request failed")]
+    Upstream { code: &'static str },
+    #[error("OAuth persistence failed")]
+    Internal,
+}
+
+impl OAuthError {
+    pub(crate) const fn code(&self) -> &'static str {
+        match self {
+            Self::Validation { code, .. }
+            | Self::Conflict { code, .. }
+            | Self::Upstream { code } => code,
+            Self::NotFound => "oauth_connection_required",
+            Self::UnauthorizedTransaction => "oauth_transaction_unauthorized",
+            Self::AuthorizationDenied { .. } => "oauth_authorization_denied",
+            Self::Internal => "oauth_internal_error",
+        }
+    }
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub(crate) struct OAuthBinding {
+    pub(crate) connection_id: String,
+    pub(crate) credential_key: String,
+    pub(crate) config_revision: i64,
+    #[serde(default)]
+    pub(crate) granted_scopes: Vec<String>,
+}
+
+pub(crate) struct OAuthAccessToken {
+    token: String,
+    connection_id: String,
+    config_revision: i64,
+    secret_revision: i64,
+}
+
+impl OAuthAccessToken {
+    pub(crate) fn expose(&self) -> &str {
+        &self.token
+    }
+
+    pub(crate) fn connection_id(&self) -> &str {
+        &self.connection_id
+    }
+
+    pub(crate) const fn config_revision(&self) -> i64 {
+        self.config_revision
+    }
+
+    pub(crate) const fn secret_revision(&self) -> i64 {
+        self.secret_revision
+    }
+}
+
+impl std::fmt::Debug for OAuthAccessToken {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter.write_str("OAuthAccessToken([REDACTED])")
+    }
+}
+
+#[derive(Clone)]
+pub(crate) struct OAuthService {
+    store: OAuthStore,
+    pool: SqlitePool,
+    outbound_policy: OutboundPolicy,
+    origin: Arc<str>,
+    refresh_locks: Arc<Mutex<HashMap<String, Weak<AsyncMutex<()>>>>>,
+}
+
+impl OAuthService {
+    pub(crate) fn new(
+        pool: SqlitePool,
+        keyring: Keyring,
+        origin: String,
+        outbound_policy: OutboundPolicy,
+    ) -> Self {
+        Self {
+            store: OAuthStore::new(pool.clone(), keyring),
+            pool,
+            outbound_policy,
+            origin: Arc::from(origin),
+            refresh_locks: Arc::new(Mutex::new(HashMap::new())),
+        }
+    }
+
+    pub(crate) async fn recover_startup(&self) -> Result<(), OAuthError> {
+        self.store
+            .recover_startup(unix_timestamp())
+            .await
+            .map(|_| ())
+            .map_err(map_store_error)
+    }
+
+    pub(crate) async fn list_connections(
+        &self,
+        source_id: &str,
+    ) -> Result<Vec<ConnectionView>, OAuthError> {
+        self.require_source(source_id).await?;
+        self.store
+            .expire_authorizations(unix_timestamp())
+            .await
+            .map_err(map_store_error)?;
+        self.store
+            .list_connections(source_id)
+            .await
+            .map_err(map_store_error)?
+            .into_iter()
+            .map(|connection| self.connection_view(connection))
+            .collect()
+    }
+
+    pub(crate) async fn binding(
+        &self,
+        source_id: &str,
+        credential_key: &str,
+    ) -> Result<Option<OAuthBinding>, OAuthError> {
+        let credential = match self
+            .store
+            .connection_by_source_key(source_id, credential_key)
+            .await
+        {
+            Ok(credential) => credential,
+            Err(OAuthStoreError::ConnectionNotFound) => return Ok(None),
+            Err(error) => return Err(map_store_error(error)),
+        };
+        Ok(Some(snapshot_binding(&credential.connection)?))
+    }
+
+    pub(crate) async fn ready_binding_for_scopes(
+        &self,
+        source_id: &str,
+        credential_key: &str,
+        required_scopes: &[String],
+    ) -> Result<Option<OAuthBinding>, OAuthError> {
+        let credential = match self
+            .store
+            .connection_by_source_key(source_id, credential_key)
+            .await
+        {
+            Ok(credential) => credential,
+            Err(OAuthStoreError::ConnectionNotFound) => return Ok(None),
+            Err(error) => return Err(map_store_error(error)),
+        };
+        if credential.connection.status != OAuthConnectionStatus::Active {
+            return Ok(None);
+        }
+        if !required_scopes
+            .iter()
+            .all(|scope| credential.connection.config.scopes.contains(scope))
+        {
+            return Err(validation(
+                "oauth_scope_not_requested",
+                "The managed OAuth connection does not request every scope required by this tool.",
+            ));
+        }
+        if !required_scopes
+            .iter()
+            .all(|scope| credential.connection.granted_scopes.contains(scope))
+        {
+            return Err(OAuthError::Conflict {
+                code: "oauth_scope_not_granted",
+                message: "The OAuth provider did not grant every scope required by this tool.",
+            });
+        }
+        let refreshable = credential
+            .secrets
+            .as_ref()
+            .is_some_and(|secrets| secrets.refresh_token.is_some());
+        if !token_is_usable(&credential.secrets, unix_timestamp()) && !refreshable {
+            return Ok(None);
+        }
+        Ok(Some(snapshot_binding(&credential.connection)?))
+    }
+
+    pub(crate) async fn bindings_for_source(
+        &self,
+        source_id: &str,
+    ) -> Result<Vec<OAuthBinding>, OAuthError> {
+        let now = unix_timestamp();
+        let mut bindings = self
+            .store
+            .list_connections(source_id)
+            .await
+            .map_err(map_store_error)?
+            .into_iter()
+            .filter(|connection| connection_is_dispatch_ready(connection, now))
+            .map(|connection| snapshot_binding(&connection))
+            .collect::<Result<Vec<_>, _>>()?;
+        bindings.sort();
+        Ok(bindings)
+    }
+
+    pub(crate) async fn bindings_match(
+        &self,
+        source_id: &str,
+        expected: &[OAuthBinding],
+    ) -> Result<bool, OAuthError> {
+        let current = self.bindings_for_source(source_id).await?;
+        Ok(expected
+            .iter()
+            .all(|binding| current.binary_search(binding).is_ok()))
+    }
+
+    pub(crate) async fn access_token_for_binding(
+        &self,
+        binding: &OAuthBinding,
+    ) -> Result<OAuthAccessToken, OAuthError> {
+        self.access_token(&binding.connection_id, binding.config_revision)
+            .await
+    }
+
+    pub(crate) async fn save_connection(
+        &self,
+        source_id: &str,
+        credential_key: &str,
+        request: SaveConnectionRequest,
+    ) -> Result<ConnectionView, OAuthError> {
+        self.require_source(source_id).await?;
+        validate_credential_key(credential_key)?;
+        if request.expected_revision < 0 {
+            return Err(validation(
+                "invalid_revision",
+                "expectedRevision must not be negative.",
+            ));
+        }
+        let scopes = validate_scopes(request.scopes)?;
+        ensure_scopes_supported(&scopes).map_err(map_discovery_error)?;
+        let (client_id, authentication, secret_update) = validate_client(request.client)?;
+        let allow_private_network = self.source_allows_private_network(source_id).await?;
+        let transport = self.transport(allow_private_network);
+        let (issuer, resource) = self
+            .resolve_discovery(source_id, request.discovery, &scopes, &transport)
+            .await?;
+        transport
+            .validate_issuer(&issuer)
+            .map_err(map_configured_issuer_error)?;
+        let metadata = transport
+            .discover_authorization_server(&issuer)
+            .await
+            .map_err(map_transport_error)?;
+        ensure_token_auth_method(&metadata, token_auth_method(authentication))
+            .map_err(map_discovery_error)?;
+        ensure_requested_scopes(&metadata.scopes_supported, &scopes)?;
+        let config = OAuthConnectionConfig {
+            issuer: metadata.issuer,
+            authorization_endpoint: metadata.authorization_endpoint.to_string(),
+            token_endpoint: metadata.token_endpoint.to_string(),
+            client_id,
+            client_authentication: stored_authentication(authentication),
+            token_endpoint_auth_methods_supported: metadata.token_endpoint_auth_methods_supported,
+            scopes,
+            allow_private_network,
+            resource,
+        };
+        if matches!(&secret_update, OAuthClientSecretUpdate::Preserve)
+            && request.expected_revision > 0
+        {
+            let current = self
+                .store
+                .connection_by_source_key(source_id, credential_key)
+                .await
+                .map_err(map_store_error)?;
+            if current.connection.revision != request.expected_revision {
+                return Err(conflict());
+            }
+            if confidential_identity_changed(&current.connection.config, &config) {
+                return Err(validation(
+                    "oauth_client_secret_replacement_required",
+                    "Replace the client secret when changing the OAuth issuer or client identity.",
+                ));
+            }
+        }
+        let connection = self
+            .store
+            .upsert_connection(
+                source_id,
+                credential_key,
+                request.expected_revision,
+                &config,
+                secret_update,
+                unix_timestamp(),
+            )
+            .await
+            .map_err(map_store_error)?;
+        self.connection_view(connection.connection)
+    }
+
+    pub(crate) async fn begin_authorization(
+        &self,
+        source_id: &str,
+        credential_key: &str,
+        expected_revision: i64,
+        _admin_id: i64,
+        admin_session_digest: &[u8],
+    ) -> Result<AuthorizationStart, OAuthError> {
+        let session_digest = fixed_digest(admin_session_digest)?;
+        self.store
+            .expire_authorizations(unix_timestamp())
+            .await
+            .map_err(map_store_error)?;
+        let credential = self
+            .store
+            .connection_by_source_key(source_id, credential_key)
+            .await
+            .map_err(map_store_error)?;
+        if credential.connection.revision != expected_revision {
+            return Err(conflict());
+        }
+        let client =
+            client_authentication(&credential.connection.config, credential.secrets.as_ref())?;
+        ensure_token_auth_method(
+            &metadata_from_config(&credential.connection.config)?,
+            client.method(),
+        )
+        .map_err(map_discovery_error)?;
+        let now = unix_timestamp();
+        let expires_at = now
+            .checked_add(AUTHORIZATION_TTL_SECONDS)
+            .ok_or(OAuthError::Internal)?;
+        let pending = self
+            .store
+            .begin_authorization(
+                source_id,
+                credential_key,
+                expected_revision,
+                &session_digest,
+                now,
+                expires_at,
+            )
+            .await
+            .map_err(map_store_error)?;
+        let challenge = URL_SAFE_NO_PAD.encode(Sha256::digest(pending.pkce_verifier.as_bytes()));
+        let callback_url = self.callback_url(&credential.connection.id)?;
+        let authorization_url = self
+            .transport(self.source_allows_private_network(source_id).await?)
+            .authorization_url(
+                &metadata_from_config(&credential.connection.config)?,
+                &AuthorizationRequest {
+                    client_id: credential.connection.config.client_id,
+                    redirect_uri: callback_url,
+                    scopes: credential.connection.config.scopes,
+                    state: pending.state,
+                    code_challenge: challenge,
+                    resource: credential.connection.config.resource,
+                },
+            )
+            .map_err(map_transport_error)?;
+        Ok(AuthorizationStart {
+            authorization_url: authorization_url.to_string(),
+        })
+    }
+
+    pub(crate) async fn disconnect(
+        &self,
+        source_id: &str,
+        credential_key: &str,
+        expected_revision: i64,
+    ) -> Result<ConnectionView, OAuthError> {
+        let connection = self
+            .store
+            .disconnect_connection(
+                source_id,
+                credential_key,
+                expected_revision,
+                unix_timestamp(),
+            )
+            .await
+            .map_err(map_store_error)?;
+        self.connection_view(connection.connection)
+    }
+
+    pub(crate) async fn delete_connection(
+        &self,
+        source_id: &str,
+        credential_key: &str,
+        expected_revision: i64,
+    ) -> Result<(), OAuthError> {
+        self.store
+            .delete_connection(source_id, credential_key, expected_revision)
+            .await
+            .map_err(map_store_error)
+    }
+
+    pub(crate) async fn complete_callback(
+        &self,
+        request: CallbackRequest,
+        _admin_id: i64,
+        admin_session_digest: &[u8],
+    ) -> Result<CallbackResult, OAuthError> {
+        validate_callback(&request)?;
+        let session_digest = fixed_digest(admin_session_digest)?;
+        let claim = self
+            .store
+            .claim_authorization_exchange(
+                &request.connection_id,
+                &request.state,
+                &session_digest,
+                unix_timestamp(),
+            )
+            .await
+            .map_err(map_store_error)?;
+        if let Some(provider_error) = request.error.as_deref() {
+            self.store
+                .fail_authorization_exchange(&claim, "authorization_denied", unix_timestamp())
+                .await
+                .map_err(map_store_error)?;
+            if provider_error == "access_denied" {
+                return Err(OAuthError::AuthorizationDenied {
+                    connection_id: claim.connection_id,
+                });
+            }
+            return Err(OAuthError::Upstream {
+                code: "oauth_authorization_error",
+            });
+        }
+        let code = request.code.ok_or_else(|| {
+            validation(
+                "invalid_oauth_callback",
+                "The OAuth callback must include an authorization code.",
+            )
+        })?;
+        let exchange_result = async {
+            let client = client_authentication(&claim.config, claim.secrets.as_ref())?;
+            let callback_url = self.callback_url(&claim.connection_id)?;
+            let current = self
+                .store
+                .connection(&claim.connection_id)
+                .await
+                .map_err(map_store_error)?;
+            if current.connection.revision != claim.connection_revision {
+                return Err(conflict());
+            }
+            let allow_private_network = self
+                .source_allows_private_network(&current.connection.source_id)
+                .await?;
+            let token = self
+                .transport(allow_private_network)
+                .exchange_authorization_code(
+                    &metadata_from_config(&claim.config)?,
+                    &AuthorizationCodeExchange {
+                        code,
+                        redirect_uri: callback_url,
+                        code_verifier: claim.pkce_verifier.clone(),
+                        resource: claim.config.resource.clone(),
+                        client,
+                    },
+                )
+                .await
+                .map_err(map_transport_error)?;
+            let secrets = token_secrets(
+                token,
+                claim
+                    .secrets
+                    .as_ref()
+                    .and_then(|secrets| secrets.client_secret.clone()),
+                None,
+                &claim.config.scopes,
+                unix_timestamp(),
+            )?;
+            Ok((secrets, current.connection.source_id))
+        }
+        .await;
+        let (secrets, source_id) = match exchange_result {
+            Ok(result) => result,
+            Err(error) => {
+                self.store
+                    .fail_authorization_exchange(&claim, error.code(), unix_timestamp())
+                    .await
+                    .map_err(map_store_error)?;
+                return Err(error);
+            }
+        };
+        self.store
+            .complete_authorization_exchange(&claim, &secrets, unix_timestamp())
+            .await
+            .map_err(map_store_error)?;
+        Ok(CallbackResult {
+            connection_id: claim.connection_id,
+            source_id,
+        })
+    }
+
+    pub(crate) async fn access_token(
+        &self,
+        connection_id: &str,
+        expected_config_revision: i64,
+    ) -> Result<OAuthAccessToken, OAuthError> {
+        let current = self
+            .store
+            .connection(connection_id)
+            .await
+            .map_err(map_store_error)?;
+        require_config_revision(&current.connection, expected_config_revision)?;
+        require_active_connection(&current.connection)?;
+        if token_is_usable(&current.secrets, unix_timestamp()) {
+            return access_token_from(current);
+        }
+        let refresh_lock = self.refresh_lock(connection_id);
+        let _guard = refresh_lock.lock().await;
+        let current = self
+            .store
+            .connection(connection_id)
+            .await
+            .map_err(map_store_error)?;
+        require_config_revision(&current.connection, expected_config_revision)?;
+        require_active_connection(&current.connection)?;
+        if token_is_usable(&current.secrets, unix_timestamp()) {
+            return access_token_from(current);
+        }
+        let now = unix_timestamp();
+        let lease_expires_at = now
+            .checked_add(REFRESH_LEASE_TTL_SECONDS)
+            .ok_or(OAuthError::Internal)?;
+        let claim = self
+            .store
+            .claim_refresh(connection_id, now, lease_expires_at)
+            .await
+            .map_err(map_store_error)?;
+        let Some(refresh_token) = claim.secrets.refresh_token.clone() else {
+            self.store
+                .mark_refresh_reauthorization_required(&claim, "refresh_token_missing")
+                .await
+                .map_err(map_store_error)?;
+            return Err(OAuthError::Conflict {
+                code: "oauth_reauthorization_required",
+                message: "The OAuth connection must be authorized again.",
+            });
+        };
+        let prepared = async {
+            let current = self
+                .store
+                .connection(&claim.connection_id)
+                .await
+                .map_err(map_store_error)?;
+            if current.connection.revision != claim.connection_revision {
+                return Err(conflict());
+            }
+            let allow_private_network = self
+                .source_allows_private_network(&current.connection.source_id)
+                .await?;
+            let client = client_authentication(&claim.config, Some(&claim.secrets))?;
+            let metadata = metadata_from_config(&claim.config)?;
+            Ok((allow_private_network, client, metadata))
+        }
+        .await;
+        let (allow_private_network, client, metadata) = match prepared {
+            Ok(prepared) => prepared,
+            Err(error) => return Err(self.terminalize_refresh_error(&claim, error).await),
+        };
+        let refreshed = self
+            .transport(allow_private_network)
+            .refresh_access_token(
+                &metadata,
+                &RefreshTokenExchange {
+                    refresh_token,
+                    resource: claim.config.resource.clone(),
+                    client,
+                },
+            )
+            .await;
+        let token = match refreshed {
+            Ok(token) => token,
+            Err(OAuthTransportError::InvalidGrant) => {
+                self.store
+                    .mark_refresh_invalid_grant(&claim, unix_timestamp())
+                    .await
+                    .map_err(map_store_error)?;
+                return Err(OAuthError::Conflict {
+                    code: "oauth_reauthorization_required",
+                    message: "The OAuth connection must be authorized again.",
+                });
+            }
+            Err(error) => {
+                let error = map_transport_error(error);
+                return Err(self.terminalize_refresh_error(&claim, error).await);
+            }
+        };
+        let rotated = self.refresh_token_secrets(&claim, token).await?;
+        self.store
+            .complete_refresh(&claim, &rotated, unix_timestamp())
+            .await
+            .map_err(map_store_error)?;
+        let current = self
+            .store
+            .connection(connection_id)
+            .await
+            .map_err(map_store_error)?;
+        require_config_revision(&current.connection, expected_config_revision)?;
+        require_active_connection(&current.connection)?;
+        access_token_from(current)
+    }
+
+    async fn refresh_token_secrets(
+        &self,
+        claim: &RefreshClaim,
+        token: TokenResponse,
+    ) -> Result<OAuthSecretSet, OAuthError> {
+        match token_secrets(
+            token,
+            claim.secrets.client_secret.clone(),
+            claim.secrets.refresh_token.clone(),
+            &claim.secrets.granted_scopes,
+            unix_timestamp(),
+        ) {
+            Ok(rotated) => Ok(rotated),
+            Err(error) => Err(self.terminalize_refresh_error(claim, error).await),
+        }
+    }
+
+    async fn terminalize_refresh_error(
+        &self,
+        claim: &RefreshClaim,
+        error: OAuthError,
+    ) -> OAuthError {
+        match self
+            .store
+            .mark_refresh_reauthorization_required(claim, error.code())
+            .await
+        {
+            Ok(()) => error,
+            Err(store_error) => map_store_error(store_error),
+        }
+    }
+
+    async fn resolve_discovery(
+        &self,
+        source_id: &str,
+        discovery: OAuthDiscoveryInput,
+        scopes: &[String],
+        transport: &OAuthHttpTransport,
+    ) -> Result<(String, Option<String>), OAuthError> {
+        match discovery {
+            OAuthDiscoveryInput::Issuer { issuer } => {
+                validate_url_length(&issuer)?;
+                Ok((issuer, None))
+            }
+            OAuthDiscoveryInput::Mcp {
+                authorization_server,
+            } => {
+                let resource = self.mcp_resource(source_id).await?;
+                let metadata = transport
+                    .discover_protected_resource(&resource)
+                    .await
+                    .map_err(map_transport_error)?;
+                let issuer = match (authorization_server, metadata.as_ref()) {
+                    (Some(issuer), Some(metadata)) => {
+                        validate_url_length(&issuer)?;
+                        if !metadata.authorization_servers.is_empty()
+                            && !authorization_server_is_advertised(
+                                &issuer,
+                                &metadata.authorization_servers,
+                            )?
+                        {
+                            return Err(validation(
+                                "oauth_authorization_server_mismatch",
+                                "The selected authorization server is not advertised by this MCP resource.",
+                            ));
+                        }
+                        issuer
+                    }
+                    (Some(issuer), None) => issuer,
+                    (None, Some(metadata)) if metadata.authorization_servers.len() == 1 => {
+                        metadata.authorization_servers[0].to_string()
+                    }
+                    _ => {
+                        return Err(validation(
+                            "oauth_authorization_server_required",
+                            "Select one authorization server advertised by the MCP resource.",
+                        ));
+                    }
+                };
+                if let Some(metadata) = metadata
+                    && !metadata.scopes_supported.is_empty()
+                {
+                    ensure_requested_scopes(&metadata.scopes_supported, scopes)?;
+                }
+                Ok((issuer, Some(resource)))
+            }
+        }
+    }
+
+    async fn require_source(&self, source_id: &str) -> Result<(), OAuthError> {
+        let exists =
+            sqlx::query_scalar::<_, i64>("SELECT EXISTS(SELECT 1 FROM sources WHERE id = ?)")
+                .bind(source_id)
+                .fetch_one(&self.pool)
+                .await
+                .map_err(|_| OAuthError::Internal)?;
+        if exists == 0 {
+            Err(OAuthError::NotFound)
+        } else {
+            Ok(())
+        }
+    }
+
+    async fn mcp_resource(&self, source_id: &str) -> Result<String, OAuthError> {
+        let row = sqlx::query("SELECT kind, configuration_json FROM sources WHERE id = ?")
+            .bind(source_id)
+            .fetch_optional(&self.pool)
+            .await
+            .map_err(|_| OAuthError::Internal)?
+            .ok_or(OAuthError::NotFound)?;
+        let kind: String = row.get("kind");
+        if kind != "mcp_http" {
+            return Err(validation(
+                "oauth_mcp_discovery_unavailable",
+                "MCP protected-resource discovery requires an MCP HTTP source.",
+            ));
+        }
+        let configuration: serde_json::Value = serde_json::from_str(row.get("configuration_json"))
+            .map_err(|_| OAuthError::Internal)?;
+        let endpoint = configuration
+            .get("endpoint")
+            .and_then(serde_json::Value::as_str)
+            .ok_or(OAuthError::Internal)?;
+        validate_url_length(endpoint)?;
+        Ok(endpoint.to_owned())
+    }
+
+    async fn source_allows_private_network(&self, source_id: &str) -> Result<bool, OAuthError> {
+        let configuration =
+            sqlx::query_scalar::<_, String>("SELECT configuration_json FROM sources WHERE id = ?")
+                .bind(source_id)
+                .fetch_optional(&self.pool)
+                .await
+                .map_err(|_| OAuthError::Internal)?
+                .ok_or(OAuthError::NotFound)?;
+        let configuration: serde_json::Value =
+            serde_json::from_str(&configuration).map_err(|_| OAuthError::Internal)?;
+        Ok(configuration
+            .get("allowPrivateNetwork")
+            .and_then(serde_json::Value::as_bool)
+            .unwrap_or(false))
+    }
+
+    fn transport(&self, allow_private_network: bool) -> OAuthHttpTransport {
+        let mut policy = self.outbound_policy.clone();
+        policy.allow_private_networks = allow_private_network;
+        OAuthHttpTransport::new(policy)
+    }
+
+    fn connection_view(&self, connection: OAuthConnection) -> Result<ConnectionView, OAuthError> {
+        let status = if connection.error_code.is_some()
+            && connection.status != OAuthConnectionStatus::ReauthorizationRequired
+        {
+            ConnectionStatus::Error
+        } else {
+            match connection.status {
+                OAuthConnectionStatus::PendingAuthorization => ConnectionStatus::ReadyToConnect,
+                OAuthConnectionStatus::Connecting => ConnectionStatus::Connecting,
+                OAuthConnectionStatus::Active => ConnectionStatus::Connected,
+                OAuthConnectionStatus::ReauthorizationRequired => {
+                    ConnectionStatus::ReauthorizationRequired
+                }
+            }
+        };
+        Ok(ConnectionView {
+            callback_url: self.callback_url(&connection.id)?,
+            id: connection.id,
+            credential_key: connection.credential_key,
+            revision: connection.revision,
+            status,
+            issuer: connection.config.issuer,
+            client_id: connection.config.client_id,
+            client_auth_method: public_authentication(connection.config.client_authentication),
+            requested_scopes: connection.config.scopes,
+            granted_scopes: connection.granted_scopes,
+            has_client_secret: connection.has_client_secret,
+            has_refresh_token: connection.has_refresh_token,
+            access_expires_at: connection.access_expires_at,
+            authorized_at: connection.authorized_at,
+            last_refreshed_at: connection.last_refreshed_at,
+            error_code: connection.error_code,
+        })
+    }
+
+    fn callback_url(&self, connection_id: &str) -> Result<String, OAuthError> {
+        let mut url = Url::parse(&self.origin).map_err(|_| OAuthError::Internal)?;
+        url.set_path(&format!("/api/v1/oauth/callback/{connection_id}"));
+        url.set_query(None);
+        url.set_fragment(None);
+        Ok(url.to_string())
+    }
+
+    fn refresh_lock(&self, connection_id: &str) -> Arc<AsyncMutex<()>> {
+        let mut locks = self
+            .refresh_locks
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        locks.retain(|_, lock| lock.strong_count() > 0);
+        if let Some(lock) = locks.get(connection_id).and_then(Weak::upgrade) {
+            return lock;
+        }
+        let lock = Arc::new(AsyncMutex::new(()));
+        locks.insert(connection_id.to_owned(), Arc::downgrade(&lock));
+        lock
+    }
+}
+
+fn validate_client(
+    client: OAuthClientInput,
+) -> Result<(String, ClientAuthentication, OAuthClientSecretUpdate), OAuthError> {
+    let (client_id, authentication, secret) = match client {
+        OAuthClientInput::None { client_id } => (
+            client_id,
+            ClientAuthentication::None,
+            OAuthClientSecretUpdate::Replace(None),
+        ),
+        OAuthClientInput::ClientSecretBasic {
+            client_id,
+            client_secret,
+        } => (
+            client_id,
+            ClientAuthentication::ClientSecretBasic,
+            secret_update(client_secret)?,
+        ),
+        OAuthClientInput::ClientSecretPost {
+            client_id,
+            client_secret,
+        } => (
+            client_id,
+            ClientAuthentication::ClientSecretPost,
+            secret_update(client_secret)?,
+        ),
+    };
+    let client_id = client_id.trim().to_owned();
+    if client_id.is_empty() || client_id.len() > MAX_CLIENT_ID_BYTES {
+        return Err(validation(
+            "invalid_oauth_client_id",
+            "The OAuth client ID is invalid.",
+        ));
+    }
+    Ok((client_id, authentication, secret))
+}
+
+fn secret_update(mutation: ClientSecretMutation) -> Result<OAuthClientSecretUpdate, OAuthError> {
+    match mutation {
+        ClientSecretMutation::Preserve => Ok(OAuthClientSecretUpdate::Preserve),
+        ClientSecretMutation::Replace { value }
+            if !value.is_empty() && value.len() <= MAX_CLIENT_SECRET_BYTES =>
+        {
+            Ok(OAuthClientSecretUpdate::Replace(Some(value)))
+        }
+        ClientSecretMutation::Replace { .. } => Err(validation(
+            "invalid_oauth_client_secret",
+            "The OAuth client secret is invalid.",
+        )),
+    }
+}
+
+fn validate_scopes(scopes: Vec<String>) -> Result<Vec<String>, OAuthError> {
+    if scopes.len() > MAX_SCOPES {
+        return Err(validation(
+            "invalid_oauth_scopes",
+            "Too many OAuth scopes were requested.",
+        ));
+    }
+    let mut normalized = Vec::with_capacity(scopes.len());
+    for scope in scopes {
+        if scope == "openid" {
+            return Err(validation(
+                "oauth_openid_unsupported",
+                "OpenID Connect scopes are not supported.",
+            ));
+        }
+        if scope.is_empty()
+            || scope.len() > MAX_SCOPE_BYTES
+            || !scope
+                .bytes()
+                .all(|byte| matches!(byte, 0x21 | 0x23..=0x5b | 0x5d..=0x7e))
+        {
+            return Err(validation(
+                "invalid_oauth_scopes",
+                "An OAuth scope is invalid.",
+            ));
+        }
+        if !normalized.contains(&scope) {
+            normalized.push(scope);
+        }
+    }
+    Ok(normalized)
+}
+
+fn validate_credential_key(credential_key: &str) -> Result<(), OAuthError> {
+    if credential_key.is_empty()
+        || credential_key.len() > MAX_CREDENTIAL_KEY_BYTES
+        || credential_key.chars().any(char::is_control)
+    {
+        Err(validation(
+            "invalid_oauth_credential_key",
+            "The OAuth credential key is invalid.",
+        ))
+    } else {
+        Ok(())
+    }
+}
+
+fn validate_url_length(value: &str) -> Result<(), OAuthError> {
+    if value.is_empty() || value.len() > MAX_DISPLAY_URL_BYTES {
+        Err(validation("invalid_oauth_url", "The OAuth URL is invalid."))
+    } else {
+        Ok(())
+    }
+}
+
+fn validate_callback(request: &CallbackRequest) -> Result<(), OAuthError> {
+    if request.connection_id.is_empty()
+        || request.connection_id.len() > 128
+        || request.state.is_empty()
+        || request.state.len() > MAX_STATE_BYTES
+        || request
+            .code
+            .as_ref()
+            .is_some_and(|code| code.is_empty() || code.len() > MAX_AUTHORIZATION_CODE_BYTES)
+        || request
+            .error
+            .as_ref()
+            .is_some_and(|error| error.is_empty() || error.len() > 256)
+        || (request.code.is_some() == request.error.is_some())
+    {
+        Err(validation(
+            "invalid_oauth_callback",
+            "The OAuth callback parameters are invalid.",
+        ))
+    } else {
+        Ok(())
+    }
+}
+
+fn fixed_digest(value: &[u8]) -> Result<[u8; 32], OAuthError> {
+    value
+        .try_into()
+        .map_err(|_| OAuthError::UnauthorizedTransaction)
+}
+
+fn ensure_requested_scopes(supported: &[String], requested: &[String]) -> Result<(), OAuthError> {
+    if supported.is_empty() || requested.iter().all(|scope| supported.contains(scope)) {
+        Ok(())
+    } else {
+        Err(validation(
+            "oauth_scope_unsupported",
+            "The OAuth provider does not advertise every requested scope.",
+        ))
+    }
+}
+
+fn metadata_from_config(
+    config: &OAuthConnectionConfig,
+) -> Result<AuthorizationServerMetadata, OAuthError> {
+    Ok(AuthorizationServerMetadata {
+        issuer: config.issuer.clone(),
+        authorization_endpoint: Url::parse(&config.authorization_endpoint)
+            .map_err(|_| OAuthError::Internal)?,
+        token_endpoint: Url::parse(&config.token_endpoint).map_err(|_| OAuthError::Internal)?,
+        scopes_supported: Vec::new(),
+        token_endpoint_auth_methods_supported: config.token_endpoint_auth_methods_supported.clone(),
+    })
+}
+
+fn client_authentication(
+    config: &OAuthConnectionConfig,
+    secrets: Option<&OAuthSecretSet>,
+) -> Result<OAuthClientAuthentication, OAuthError> {
+    match config.client_authentication {
+        StoredClientAuthentication::None => Ok(OAuthClientAuthentication::Public {
+            client_id: config.client_id.clone(),
+        }),
+        StoredClientAuthentication::ClientSecretBasic => {
+            Ok(OAuthClientAuthentication::ClientSecretBasic {
+                client_id: config.client_id.clone(),
+                client_secret: required_client_secret(secrets)?,
+            })
+        }
+        StoredClientAuthentication::ClientSecretPost => {
+            Ok(OAuthClientAuthentication::ClientSecretPost {
+                client_id: config.client_id.clone(),
+                client_secret: required_client_secret(secrets)?,
+            })
+        }
+    }
+}
+
+fn required_client_secret(secrets: Option<&OAuthSecretSet>) -> Result<String, OAuthError> {
+    secrets
+        .and_then(|secrets| secrets.client_secret.clone())
+        .ok_or_else(|| {
+            validation(
+                "oauth_client_secret_required",
+                "This OAuth client requires a saved client secret.",
+            )
+        })
+}
+
+fn token_secrets(
+    token: TokenResponse,
+    client_secret: Option<String>,
+    previous_refresh_token: Option<String>,
+    fallback_scopes: &[String],
+    now: i64,
+) -> Result<OAuthSecretSet, OAuthError> {
+    let expires_at = match token.expires_in {
+        Some(seconds) => Some(
+            now.checked_add(i64::try_from(seconds).map_err(|_| malformed_token_response())?)
+                .ok_or_else(malformed_token_response)?,
+        ),
+        None => None,
+    };
+    if expires_at.is_some_and(|expires_at| {
+        expires_at <= now.saturating_add(ACCESS_TOKEN_MIN_VALIDITY_SECONDS)
+    }) {
+        return Err(OAuthError::Upstream {
+            code: "oauth_access_token_lifetime_too_short",
+        });
+    }
+    let granted_scopes = match token.scope {
+        Some(scopes) => {
+            let scopes =
+                validate_scopes(scopes.split_ascii_whitespace().map(str::to_owned).collect())
+                    .map_err(|_| malformed_token_response())?;
+            if !scopes.iter().all(|scope| fallback_scopes.contains(scope)) {
+                return Err(OAuthError::Upstream {
+                    code: "oauth_scope_escalation",
+                });
+            }
+            scopes
+        }
+        None => fallback_scopes.to_vec(),
+    };
+    Ok(OAuthSecretSet {
+        client_secret,
+        access_token: Some(token.access_token),
+        refresh_token: token.refresh_token.or(previous_refresh_token),
+        token_type: Some(token.token_type),
+        granted_scopes,
+        access_token_expires_at: expires_at,
+    })
+}
+
+fn token_is_usable(secrets: &Option<OAuthSecretSet>, now: i64) -> bool {
+    secrets.as_ref().is_some_and(|secrets| {
+        secrets.access_token.is_some()
+            && secrets.access_token_expires_at.is_none_or(|expires_at| {
+                expires_at > now.saturating_add(ACCESS_TOKEN_MIN_VALIDITY_SECONDS)
+            })
+    })
+}
+
+fn snapshot_binding(connection: &OAuthConnection) -> Result<OAuthBinding, OAuthError> {
+    validate_credential_key(&connection.credential_key).map_err(|_| OAuthError::Internal)?;
+    let mut granted_scopes =
+        validate_scopes(connection.granted_scopes.clone()).map_err(|_| OAuthError::Internal)?;
+    granted_scopes.sort();
+    Ok(OAuthBinding {
+        connection_id: connection.id.clone(),
+        credential_key: connection.credential_key.clone(),
+        config_revision: connection.config_revision,
+        granted_scopes,
+    })
+}
+
+fn connection_is_dispatch_ready(connection: &OAuthConnection, now: i64) -> bool {
+    connection.status == OAuthConnectionStatus::Active
+        && (connection.has_refresh_token
+            || (connection.secret_revision.is_some()
+                && connection.access_expires_at.is_none_or(|expires_at| {
+                    expires_at > now.saturating_add(ACCESS_TOKEN_MIN_VALIDITY_SECONDS)
+                })))
+}
+
+fn access_token_from(
+    credential: super::model::OAuthCredential,
+) -> Result<OAuthAccessToken, OAuthError> {
+    let secret_revision = credential
+        .connection
+        .secret_revision
+        .ok_or_else(reauthorization_required)?;
+    let token = credential
+        .secrets
+        .and_then(|secrets| secrets.access_token)
+        .ok_or_else(reauthorization_required)?;
+    Ok(OAuthAccessToken {
+        token,
+        connection_id: credential.connection.id,
+        config_revision: credential.connection.config_revision,
+        secret_revision,
+    })
+}
+
+fn reauthorization_required() -> OAuthError {
+    OAuthError::Conflict {
+        code: "oauth_reauthorization_required",
+        message: "The OAuth connection must be authorized again.",
+    }
+}
+
+fn require_config_revision(
+    connection: &OAuthConnection,
+    expected_config_revision: i64,
+) -> Result<(), OAuthError> {
+    if connection.config_revision == expected_config_revision {
+        Ok(())
+    } else {
+        Err(conflict())
+    }
+}
+
+fn require_active_connection(connection: &OAuthConnection) -> Result<(), OAuthError> {
+    if connection.status == OAuthConnectionStatus::Active {
+        Ok(())
+    } else {
+        Err(reauthorization_required())
+    }
+}
+
+fn stored_authentication(authentication: ClientAuthentication) -> StoredClientAuthentication {
+    match authentication {
+        ClientAuthentication::None => StoredClientAuthentication::None,
+        ClientAuthentication::ClientSecretBasic => StoredClientAuthentication::ClientSecretBasic,
+        ClientAuthentication::ClientSecretPost => StoredClientAuthentication::ClientSecretPost,
+    }
+}
+
+fn public_authentication(authentication: StoredClientAuthentication) -> ClientAuthentication {
+    match authentication {
+        StoredClientAuthentication::None => ClientAuthentication::None,
+        StoredClientAuthentication::ClientSecretBasic => ClientAuthentication::ClientSecretBasic,
+        StoredClientAuthentication::ClientSecretPost => ClientAuthentication::ClientSecretPost,
+    }
+}
+
+fn confidential_identity_changed(
+    current: &OAuthConnectionConfig,
+    replacement: &OAuthConnectionConfig,
+) -> bool {
+    current.issuer != replacement.issuer
+        || current.authorization_endpoint != replacement.authorization_endpoint
+        || current.token_endpoint != replacement.token_endpoint
+        || current.client_id != replacement.client_id
+        || current.client_authentication != replacement.client_authentication
+}
+
+fn authorization_server_is_advertised(
+    selected: &str,
+    advertised: &[Url],
+) -> Result<bool, OAuthError> {
+    let selected = Url::parse(selected)
+        .map_err(|_| validation("invalid_oauth_url", "The OAuth issuer URL is invalid."))?;
+    Ok(advertised.iter().any(|candidate| candidate == &selected))
+}
+
+fn token_auth_method(authentication: ClientAuthentication) -> TokenEndpointAuthMethod {
+    match authentication {
+        ClientAuthentication::None => TokenEndpointAuthMethod::None,
+        ClientAuthentication::ClientSecretBasic => TokenEndpointAuthMethod::ClientSecretBasic,
+        ClientAuthentication::ClientSecretPost => TokenEndpointAuthMethod::ClientSecretPost,
+    }
+}
+
+trait AuthenticationMethod {
+    fn method(&self) -> TokenEndpointAuthMethod;
+}
+
+impl AuthenticationMethod for OAuthClientAuthentication {
+    fn method(&self) -> TokenEndpointAuthMethod {
+        match self {
+            Self::Public { .. } => TokenEndpointAuthMethod::None,
+            Self::ClientSecretBasic { .. } => TokenEndpointAuthMethod::ClientSecretBasic,
+            Self::ClientSecretPost { .. } => TokenEndpointAuthMethod::ClientSecretPost,
+        }
+    }
+}
+
+fn map_store_error(error: OAuthStoreError) -> OAuthError {
+    match error {
+        OAuthStoreError::ConnectionNotFound => OAuthError::NotFound,
+        OAuthStoreError::Conflict | OAuthStoreError::RefreshInProgress => conflict(),
+        OAuthStoreError::AuthorizationRejected => OAuthError::UnauthorizedTransaction,
+        OAuthStoreError::ReauthorizationRequired => OAuthError::Conflict {
+            code: "oauth_reauthorization_required",
+            message: "The OAuth connection must be authorized again.",
+        },
+        OAuthStoreError::AuthorizationCapacity => OAuthError::Conflict {
+            code: "oauth_authorization_busy",
+            message: "Too many OAuth authorization attempts are active.",
+        },
+        OAuthStoreError::InvalidStoredRecord
+        | OAuthStoreError::EncodeConfiguration(_)
+        | OAuthStoreError::DecodeConfiguration(_)
+        | OAuthStoreError::Crypto(_)
+        | OAuthStoreError::Database(_) => OAuthError::Internal,
+    }
+}
+
+fn map_transport_error(error: OAuthTransportError) -> OAuthError {
+    OAuthError::Upstream { code: error.code() }
+}
+
+fn map_configured_issuer_error(error: super::discovery::OAuthDiscoveryError) -> OAuthError {
+    use super::discovery::OAuthDiscoveryError;
+
+    match error {
+        OAuthDiscoveryError::InvalidUrl => {
+            validation("invalid_oauth_url", "The OAuth issuer URL is invalid.")
+        }
+        OAuthDiscoveryError::InsecureEndpoint => validation(
+            "insecure_oauth_endpoint",
+            "The OAuth issuer must use HTTPS, except for loopback local-test endpoints.",
+        ),
+        OAuthDiscoveryError::InvalidIssuer => validation(
+            "invalid_oauth_issuer",
+            "The OAuth issuer URL must not contain a query or fragment.",
+        ),
+        error => OAuthError::Upstream { code: error.code() },
+    }
+}
+
+fn map_discovery_error(error: super::discovery::OAuthDiscoveryError) -> OAuthError {
+    use super::discovery::OAuthDiscoveryError;
+
+    match error {
+        OAuthDiscoveryError::OpenIdUnsupported => validation(
+            "oauth_openid_unsupported",
+            "OpenID Connect scopes are not supported.",
+        ),
+        OAuthDiscoveryError::TokenAuthMethodUnsupported => validation(
+            "oauth_client_authentication_unsupported",
+            "The OAuth provider does not support the selected client authentication method.",
+        ),
+        error => OAuthError::Upstream { code: error.code() },
+    }
+}
+
+fn validation(code: &'static str, message: &'static str) -> OAuthError {
+    OAuthError::Validation { code, message }
+}
+
+fn malformed_token_response() -> OAuthError {
+    OAuthError::Upstream {
+        code: "malformed_oauth_response",
+    }
+}
+
+fn conflict() -> OAuthError {
+    OAuthError::Conflict {
+        code: "oauth_revision_conflict",
+        message: "The OAuth connection changed. Reload it and try again.",
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use sqlx::sqlite::SqlitePoolOptions;
+
+    use super::*;
+
+    async fn binding_test_service() -> OAuthService {
+        let pool = SqlitePoolOptions::new()
+            .max_connections(1)
+            .connect("sqlite::memory:")
+            .await
+            .unwrap();
+        sqlx::migrate!("./migrations").run(&pool).await.unwrap();
+        sqlx::query(
+            "INSERT INTO sources (
+                id, kind, slug, display_name, configuration_json, health_status,
+                revision, catalog_revision, created_at, updated_at
+             ) VALUES ('source-1', 'openapi', 'test', 'Test', '{}', 'unknown', 0, 0, 1, 1)",
+        )
+        .execute(&pool)
+        .await
+        .unwrap();
+        OAuthService::new(
+            pool,
+            Keyring::from_master_key([17; 32]).unwrap(),
+            "http://localhost:3000".into(),
+            OutboundPolicy::default(),
+        )
+    }
+
+    fn binding_test_config() -> OAuthConnectionConfig {
+        OAuthConnectionConfig {
+            issuer: "https://issuer.example".into(),
+            authorization_endpoint: "https://issuer.example/authorize".into(),
+            token_endpoint: "https://issuer.example/token".into(),
+            client_id: "executor".into(),
+            client_authentication: StoredClientAuthentication::ClientSecretBasic,
+            token_endpoint_auth_methods_supported: vec!["client_secret_basic".into()],
+            scopes: vec!["read".into()],
+            allow_private_network: false,
+            resource: Some("https://api.example".into()),
+        }
+    }
+
+    fn binding_test_secrets(access_token: &str, refresh_token: &str) -> OAuthSecretSet {
+        OAuthSecretSet {
+            client_secret: Some("client-secret".into()),
+            access_token: Some(access_token.into()),
+            refresh_token: Some(refresh_token.into()),
+            token_type: Some("Bearer".into()),
+            granted_scopes: vec!["read".into()],
+            access_token_expires_at: Some(10_000),
+        }
+    }
+
+    #[test]
+    fn public_client_is_an_explicit_secret_clear() {
+        let (_, authentication, update) = validate_client(OAuthClientInput::None {
+            client_id: "public-client".to_owned(),
+        })
+        .expect("public client is valid");
+        assert_eq!(authentication, ClientAuthentication::None);
+        assert!(matches!(update, OAuthClientSecretUpdate::Replace(None)));
+    }
+
+    #[test]
+    fn authorization_server_membership_normalizes_the_root_path() {
+        let advertised = [Url::parse("https://identity.example.test").unwrap()];
+
+        assert!(
+            authorization_server_is_advertised("https://identity.example.test", &advertised)
+                .unwrap()
+        );
+        assert!(
+            authorization_server_is_advertised("https://identity.example.test/", &advertised)
+                .unwrap()
+        );
+        assert!(
+            !authorization_server_is_advertised("https://other.example.test", &advertised).unwrap()
+        );
+    }
+
+    #[test]
+    fn access_tokens_are_redacted_from_debug_output() {
+        assert_eq!(
+            format!(
+                "{:?}",
+                OAuthAccessToken {
+                    token: "secret-token".to_owned(),
+                    connection_id: "connection".to_owned(),
+                    config_revision: 1,
+                    secret_revision: 1,
+                }
+            ),
+            "OAuthAccessToken([REDACTED])"
+        );
+    }
+
+    #[test]
+    fn callback_requires_exactly_one_provider_result() {
+        let base = CallbackRequest {
+            connection_id: "connection".to_owned(),
+            state: "state".to_owned(),
+            code: None,
+            error: None,
+        };
+        assert!(validate_callback(&base).is_err());
+        assert!(
+            validate_callback(&CallbackRequest {
+                code: Some("code".to_owned()),
+                error: Some("access_denied".to_owned()),
+                ..base
+            })
+            .is_err()
+        );
+    }
+
+    #[test]
+    fn connection_statuses_have_stable_wire_names() {
+        assert_eq!(
+            serde_json::to_string(&ConnectionStatus::Connecting).unwrap(),
+            "\"connecting\""
+        );
+        assert_eq!(
+            serde_json::to_string(&ConnectionStatus::ReauthorizationRequired).unwrap(),
+            "\"reauthorization_required\""
+        );
+    }
+
+    #[test]
+    fn access_tokens_require_more_than_the_minimum_validity_buffer() {
+        let secrets = |access_token_expires_at| {
+            Some(OAuthSecretSet {
+                access_token: Some("access-token".into()),
+                access_token_expires_at,
+                ..OAuthSecretSet::default()
+            })
+        };
+        let now = 1_000;
+
+        assert!(!token_is_usable(
+            &secrets(Some(now + ACCESS_TOKEN_MIN_VALIDITY_SECONDS)),
+            now,
+        ));
+        assert!(token_is_usable(
+            &secrets(Some(now + ACCESS_TOKEN_MIN_VALIDITY_SECONDS + 1)),
+            now,
+        ));
+        assert!(token_is_usable(&secrets(None), now));
+    }
+
+    #[test]
+    fn successful_token_responses_must_clear_the_minimum_validity_buffer() {
+        let token = |expires_in| TokenResponse {
+            access_token: "access-token".into(),
+            token_type: "Bearer".into(),
+            expires_in: Some(expires_in),
+            refresh_token: Some("refresh-token".into()),
+            scope: Some("read".into()),
+        };
+        let now = 1_000;
+        let error = token_secrets(
+            token(ACCESS_TOKEN_MIN_VALIDITY_SECONDS as u64),
+            None,
+            None,
+            &["read".into()],
+            now,
+        )
+        .expect_err("a token expiring at the safety boundary is rejected");
+        assert!(matches!(
+            error,
+            OAuthError::Upstream {
+                code: "oauth_access_token_lifetime_too_short"
+            }
+        ));
+        assert!(
+            token_secrets(
+                token((ACCESS_TOKEN_MIN_VALIDITY_SECONDS + 1) as u64),
+                None,
+                None,
+                &["read".into()],
+                now,
+            )
+            .is_ok()
+        );
+    }
+
+    #[tokio::test]
+    async fn malformed_refresh_success_terminalizes_the_lease_and_allows_reconnect() {
+        let service = binding_test_service().await;
+        let created = service
+            .store
+            .create_connection(
+                "source-1",
+                "default",
+                &binding_test_config(),
+                Some(&binding_test_secrets("old-access", "old-refresh")),
+                10,
+            )
+            .await
+            .unwrap();
+        let now = unix_timestamp();
+        let refresh = service
+            .store
+            .claim_refresh(&created.connection.id, now, now + 60)
+            .await
+            .unwrap();
+        let error = service
+            .refresh_token_secrets(
+                &refresh,
+                TokenResponse {
+                    access_token: "malformed-access".into(),
+                    token_type: "Bearer".into(),
+                    expires_in: Some(60),
+                    refresh_token: None,
+                    scope: Some("read unrequested".into()),
+                },
+            )
+            .await
+            .expect_err("scope escalation is rejected");
+        assert!(matches!(
+            error,
+            OAuthError::Upstream {
+                code: "oauth_scope_escalation"
+            }
+        ));
+        let terminal = service
+            .store
+            .connection(&created.connection.id)
+            .await
+            .unwrap();
+        assert_eq!(
+            terminal.connection.status,
+            OAuthConnectionStatus::ReauthorizationRequired
+        );
+        assert_eq!(
+            terminal.connection.error_code.as_deref(),
+            Some("oauth_scope_escalation")
+        );
+        assert_eq!(
+            sqlx::query_scalar::<_, i64>(
+                "SELECT COUNT(*) FROM oauth_refresh_leases WHERE connection_id = ?",
+            )
+            .bind(&created.connection.id)
+            .fetch_one(&service.pool)
+            .await
+            .unwrap(),
+            0
+        );
+
+        let session = [9_u8; 32];
+        let pending = service
+            .store
+            .begin_authorization(
+                "source-1",
+                "default",
+                terminal.connection.revision,
+                &session,
+                now + 1,
+                now + 120,
+            )
+            .await
+            .unwrap();
+        let authorization = service
+            .store
+            .claim_authorization_exchange(&created.connection.id, &pending.state, &session, now + 2)
+            .await
+            .unwrap();
+        service
+            .store
+            .complete_authorization_exchange(
+                &authorization,
+                &binding_test_secrets("new-access", "new-refresh"),
+                now + 3,
+            )
+            .await
+            .unwrap();
+        service
+            .store
+            .claim_refresh(&created.connection.id, now + 4, now + 64)
+            .await
+            .expect("refresh can be claimed after reconnecting");
+    }
+
+    #[tokio::test]
+    async fn binding_generation_changes_on_reauthorization_but_not_refresh() {
+        let service = binding_test_service().await;
+        let created = service
+            .store
+            .create_connection(
+                "source-1",
+                "default",
+                &binding_test_config(),
+                Some(&binding_test_secrets("access-before", "refresh-before")),
+                10,
+            )
+            .await
+            .unwrap();
+        let captured = service
+            .binding("source-1", "default")
+            .await
+            .unwrap()
+            .unwrap();
+        let serialized = serde_json::to_value(&captured).unwrap();
+        assert_eq!(
+            serialized,
+            serde_json::json!({
+                "connectionId": created.connection.id,
+                "credentialKey": "default",
+                "configRevision": 1,
+                "grantedScopes": ["read"],
+            })
+        );
+        let serialized = serde_json::to_string(&captured).unwrap();
+        assert!(!serialized.contains("access-before"));
+        assert!(!serialized.contains("refresh-before"));
+        assert!(!serialized.contains("client-secret"));
+
+        let refresh = service
+            .store
+            .claim_refresh(&captured.connection_id, 11, 20)
+            .await
+            .unwrap();
+        service
+            .store
+            .complete_refresh(
+                &refresh,
+                &binding_test_secrets("access-after-refresh", "refresh-after"),
+                12,
+            )
+            .await
+            .unwrap();
+        assert_eq!(
+            service.binding("source-1", "default").await.unwrap(),
+            Some(captured.clone())
+        );
+        assert!(
+            service
+                .bindings_match("source-1", std::slice::from_ref(&captured))
+                .await
+                .unwrap()
+        );
+
+        let refreshed = service
+            .store
+            .connection(&captured.connection_id)
+            .await
+            .unwrap();
+        let session_digest = [7_u8; 32];
+        let pending = service
+            .store
+            .begin_authorization(
+                "source-1",
+                "default",
+                refreshed.connection.revision,
+                &session_digest,
+                13,
+                100,
+            )
+            .await
+            .unwrap();
+        let claim = service
+            .store
+            .claim_authorization_exchange(
+                &captured.connection_id,
+                &pending.state,
+                &session_digest,
+                14,
+            )
+            .await
+            .unwrap();
+        service
+            .store
+            .complete_authorization_exchange(
+                &claim,
+                &binding_test_secrets("access-after-reauth", "refresh-after-reauth"),
+                15,
+            )
+            .await
+            .unwrap();
+
+        let reauthorized = service
+            .binding("source-1", "default")
+            .await
+            .unwrap()
+            .unwrap();
+        assert_eq!(reauthorized.connection_id, captured.connection_id);
+        assert_eq!(reauthorized.credential_key, captured.credential_key);
+        assert_eq!(reauthorized.config_revision, captured.config_revision + 1);
+        assert!(
+            !service
+                .bindings_match("source-1", &[captured])
+                .await
+                .unwrap()
+        );
+    }
+
+    #[tokio::test]
+    async fn approval_binding_snapshots_include_only_dispatch_ready_connections() {
+        let service = binding_test_service().await;
+        service
+            .store
+            .create_connection("source-1", "pending", &binding_test_config(), None, 10)
+            .await
+            .unwrap();
+        let active = service
+            .store
+            .create_connection(
+                "source-1",
+                "active",
+                &binding_test_config(),
+                Some(&binding_test_secrets("access", "refresh")),
+                10,
+            )
+            .await
+            .unwrap();
+
+        let captured = service.bindings_for_source("source-1").await.unwrap();
+        assert_eq!(captured.len(), 1);
+        assert_eq!(captured[0].credential_key, "active");
+        assert_eq!(captured[0].granted_scopes, vec!["read"]);
+
+        service
+            .disconnect("source-1", "active", active.connection.revision)
+            .await
+            .unwrap();
+        assert!(
+            service
+                .bindings_for_source("source-1")
+                .await
+                .unwrap()
+                .is_empty()
+        );
+    }
+
+    #[tokio::test]
+    async fn approval_binding_match_ignores_new_unselected_connections() {
+        let service = binding_test_service().await;
+        let pending = service
+            .store
+            .create_connection(
+                "source-1",
+                "first",
+                &binding_test_config(),
+                Some(&binding_test_secrets("first-access", "first-refresh")),
+                10,
+            )
+            .await
+            .unwrap();
+        sqlx::query("UPDATE oauth_connections SET status = 'connecting' WHERE id = ?")
+            .bind(&pending.connection.id)
+            .execute(&service.pool)
+            .await
+            .unwrap();
+        service
+            .store
+            .create_connection(
+                "source-1",
+                "second",
+                &binding_test_config(),
+                Some(&binding_test_secrets("second-access", "second-refresh")),
+                10,
+            )
+            .await
+            .unwrap();
+        let approved = service.bindings_for_source("source-1").await.unwrap();
+        assert_eq!(approved.len(), 1);
+        assert_eq!(approved[0].credential_key, "second");
+
+        sqlx::query("UPDATE oauth_connections SET status = 'active' WHERE id = ?")
+            .bind(&pending.connection.id)
+            .execute(&service.pool)
+            .await
+            .unwrap();
+        assert_eq!(
+            service.bindings_for_source("source-1").await.unwrap().len(),
+            2
+        );
+        assert!(service.bindings_match("source-1", &approved).await.unwrap());
+    }
+
+    #[tokio::test]
+    async fn access_token_refuses_non_active_connections_even_with_a_fresh_old_token() {
+        let service = binding_test_service().await;
+        let secrets = OAuthSecretSet {
+            client_secret: Some("client-secret".into()),
+            access_token: Some("fresh-old-token".into()),
+            refresh_token: Some("refresh-token".into()),
+            token_type: Some("Bearer".into()),
+            granted_scopes: vec!["read".into()],
+            access_token_expires_at: Some(i64::MAX),
+        };
+        let created = service
+            .store
+            .create_connection(
+                "source-1",
+                "default",
+                &binding_test_config(),
+                Some(&secrets),
+                10,
+            )
+            .await
+            .unwrap();
+        assert_eq!(
+            service
+                .access_token(&created.connection.id, created.connection.config_revision)
+                .await
+                .unwrap()
+                .expose(),
+            "fresh-old-token"
+        );
+
+        for (status, error_code) in [
+            ("connecting", None),
+            ("reauth_required", Some("reauthorization_required")),
+        ] {
+            sqlx::query("UPDATE oauth_connections SET status = ?, error_code = ? WHERE id = ?")
+                .bind(status)
+                .bind(error_code)
+                .bind(&created.connection.id)
+                .execute(&service.pool)
+                .await
+                .unwrap();
+            let error = service
+                .access_token(&created.connection.id, created.connection.config_revision)
+                .await
+                .expect_err("a non-active connection cannot release its retained token");
+            assert_eq!(error.code(), "oauth_reauthorization_required");
+        }
+    }
+}
diff --git a/src/oauth/store.rs b/src/oauth/store.rs
new file mode 100644
index 000000000..88d7d46a5
--- /dev/null
+++ b/src/oauth/store.rs
@@ -0,0 +1,2681 @@
+use sqlx::{Row, SqlitePool};
+use thiserror::Error;
+use uuid::Uuid;
+
+use crate::crypto::Keyring;
+
+use super::{
+    crypto::{OAuthCrypto, OAuthCryptoError},
+    model::{
+        AuthorizationExchangeClaim, OAuthClientSecretUpdate, OAuthConnection,
+        OAuthConnectionConfig, OAuthConnectionStatus, OAuthCredential, OAuthSecretSet,
+        PendingAuthorization, RefreshClaim,
+    },
+};
+
+const AUTHORIZATION_ERROR_INTERRUPTED: &str = "exchange_interrupted";
+const AUTHORIZATION_ERROR_EXPIRED: &str = "authorization_expired";
+const AUTHORIZATION_ERROR_SUPERSEDED: &str = "authorization_superseded";
+const AUTHORIZATION_ERROR_EXCHANGE_TIMEOUT: &str = "exchange_timeout";
+const AUTHORIZATION_EXCHANGE_TTL_SECONDS: i64 = 60;
+const REFRESH_ERROR_INVALID_GRANT: &str = "invalid_grant";
+const REFRESH_ERROR_INTERRUPTED: &str = "refresh_interrupted";
+
+#[derive(Debug, Error)]
+pub(crate) enum OAuthStoreError {
+    #[error("the OAuth connection was not found")]
+    ConnectionNotFound,
+    #[error("the OAuth connection changed concurrently")]
+    Conflict,
+    #[error("the OAuth authorization transaction is invalid, expired, or already consumed")]
+    AuthorizationRejected,
+    #[error("another refresh is already in progress")]
+    RefreshInProgress,
+    #[error("the OAuth connection requires authorization")]
+    ReauthorizationRequired,
+    #[error("the stored OAuth record is invalid")]
+    InvalidStoredRecord,
+    #[error("too many OAuth authorization transactions are active")]
+    AuthorizationCapacity,
+    #[error("could not encode OAuth configuration")]
+    EncodeConfiguration(#[source] serde_json::Error),
+    #[error("could not decode OAuth configuration")]
+    DecodeConfiguration(#[source] serde_json::Error),
+    #[error(transparent)]
+    Crypto(#[from] OAuthCryptoError),
+    #[error("OAuth persistence failed")]
+    Database(#[source] sqlx::Error),
+}
+
+#[derive(Clone)]
+pub(crate) struct OAuthStore {
+    pool: SqlitePool,
+    crypto: OAuthCrypto,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub(crate) struct OAuthRecovery {
+    pub(crate) interrupted_exchanges: u64,
+    pub(crate) abandoned_refresh_leases: u64,
+}
+
+impl OAuthStore {
+    pub(crate) fn new(pool: SqlitePool, keyring: Keyring) -> Self {
+        Self {
+            pool,
+            crypto: OAuthCrypto::new(keyring),
+        }
+    }
+
+    pub(crate) async fn create_connection(
+        &self,
+        source_id: &str,
+        credential_key: &str,
+        config: &OAuthConnectionConfig,
+        initial_secrets: Option<&OAuthSecretSet>,
+        now: i64,
+    ) -> Result<OAuthCredential, OAuthStoreError> {
+        let id = Uuid::new_v4().to_string();
+        let config_json = encode_config(config)?;
+        let secret_revision = initial_secrets.map(|_| 1_i64);
+        let status = if initial_secrets.is_some_and(|secret| secret.access_token.is_some()) {
+            OAuthConnectionStatus::Active
+        } else {
+            OAuthConnectionStatus::PendingAuthorization
+        };
+        let sealed = initial_secrets
+            .map(|secret| self.crypto.seal_secrets(&id, 1, secret))
+            .transpose()?;
+        let granted_scopes_json = serde_json::to_string(
+            &initial_secrets.map_or(&[][..], |secret| secret.granted_scopes.as_slice()),
+        )
+        .map_err(OAuthStoreError::EncodeConfiguration)?;
+        let has_client_secret =
+            initial_secrets.is_some_and(|secret| secret.client_secret.is_some());
+        let has_refresh_token =
+            initial_secrets.is_some_and(|secret| secret.refresh_token.is_some());
+        let access_expires_at = initial_secrets.and_then(|secret| secret.access_token_expires_at);
+        let authorized_at = initial_secrets
+            .is_some_and(|secret| secret.access_token.is_some())
+            .then_some(now);
+
+        let mut transaction = self.pool.begin().await.map_err(database)?;
+        sqlx::query(
+            "INSERT INTO oauth_connections (
+                id, source_id, credential_key, revision,
+                current_config_revision, current_secret_revision, status,
+                granted_scopes_json, has_client_secret, has_refresh_token,
+                access_expires_at, authorized_at, last_refreshed_at, error_code,
+                created_at, updated_at
+             ) VALUES (?, ?, ?, 1, 1, ?, ?, ?, ?, ?, ?, ?, NULL, NULL, ?, ?)",
+        )
+        .bind(&id)
+        .bind(source_id)
+        .bind(credential_key)
+        .bind(secret_revision)
+        .bind(status.as_db_str())
+        .bind(granted_scopes_json)
+        .bind(has_client_secret)
+        .bind(has_refresh_token)
+        .bind(access_expires_at)
+        .bind(authorized_at)
+        .bind(now)
+        .bind(now)
+        .execute(&mut *transaction)
+        .await
+        .map_err(database)?;
+        sqlx::query(
+            "INSERT INTO oauth_connection_config_revisions (
+                connection_id, revision, config_json, created_at
+             ) VALUES (?, 1, ?, ?)",
+        )
+        .bind(&id)
+        .bind(config_json)
+        .bind(now)
+        .execute(&mut *transaction)
+        .await
+        .map_err(database)?;
+        if let (Some(secret), Some(ciphertext)) = (initial_secrets, sealed) {
+            insert_secret_revision(
+                &mut transaction,
+                &id,
+                1,
+                ciphertext,
+                secret.access_token_expires_at,
+                now,
+            )
+            .await?;
+        }
+        transaction.commit().await.map_err(database)?;
+
+        Ok(OAuthCredential {
+            connection: OAuthConnection {
+                id,
+                source_id: source_id.to_owned(),
+                credential_key: credential_key.to_owned(),
+                revision: 1,
+                config_revision: 1,
+                secret_revision,
+                config: config.clone(),
+                status,
+                granted_scopes: initial_secrets
+                    .map_or_else(Vec::new, |secret| secret.granted_scopes.clone()),
+                has_client_secret,
+                has_refresh_token,
+                access_expires_at,
+                authorized_at,
+                last_refreshed_at: None,
+                error_code: None,
+                created_at: now,
+                updated_at: now,
+            },
+            secrets: initial_secrets.cloned(),
+        })
+    }
+
+    pub(crate) async fn upsert_connection(
+        &self,
+        source_id: &str,
+        credential_key: &str,
+        expected_revision: i64,
+        config: &OAuthConnectionConfig,
+        client_secret: OAuthClientSecretUpdate,
+        now: i64,
+    ) -> Result<OAuthCredential, OAuthStoreError> {
+        if expected_revision == 0 {
+            let initial_secrets = match client_secret {
+                OAuthClientSecretUpdate::Preserve => return Err(OAuthStoreError::Conflict),
+                OAuthClientSecretUpdate::Replace(None) => None,
+                OAuthClientSecretUpdate::Replace(Some(client_secret)) => Some(OAuthSecretSet {
+                    client_secret: Some(client_secret),
+                    ..OAuthSecretSet::default()
+                }),
+            };
+            return self
+                .create_connection(
+                    source_id,
+                    credential_key,
+                    config,
+                    initial_secrets.as_ref(),
+                    now,
+                )
+                .await
+                .map_err(|error| match error {
+                    OAuthStoreError::Database(ref database) if is_constraint(database) => {
+                        OAuthStoreError::Conflict
+                    }
+                    other => other,
+                });
+        }
+
+        let current = self
+            .connection_by_source_key(source_id, credential_key)
+            .await?;
+        if current.connection.revision != expected_revision {
+            return Err(OAuthStoreError::Conflict);
+        }
+        let existing_client_secret = current
+            .secrets
+            .as_ref()
+            .and_then(|secrets| secrets.client_secret.clone());
+        let client_secret = match client_secret {
+            OAuthClientSecretUpdate::Preserve => existing_client_secret,
+            OAuthClientSecretUpdate::Replace(replacement) => replacement,
+        };
+        let secrets = OAuthSecretSet {
+            client_secret,
+            ..OAuthSecretSet::default()
+        };
+        let secret_changed =
+            current.connection.secret_revision.is_some() || secrets.client_secret.is_some();
+        let next_config_revision = current
+            .connection
+            .config_revision
+            .checked_add(1)
+            .ok_or(OAuthStoreError::Conflict)?;
+        let next_secret_revision = if secret_changed {
+            Some(
+                current
+                    .connection
+                    .secret_revision
+                    .unwrap_or(0)
+                    .checked_add(1)
+                    .ok_or(OAuthStoreError::Conflict)?,
+            )
+        } else {
+            current.connection.secret_revision
+        };
+        let config_json = encode_config(config)?;
+        let sealed = if secret_changed {
+            Some(self.crypto.seal_secrets(
+                &current.connection.id,
+                next_secret_revision.ok_or(OAuthStoreError::InvalidStoredRecord)?,
+                &secrets,
+            )?)
+        } else {
+            None
+        };
+        let granted_scopes_json = serde_json::to_string(&secrets.granted_scopes)
+            .map_err(OAuthStoreError::EncodeConfiguration)?;
+        let status = OAuthConnectionStatus::PendingAuthorization;
+
+        let mut transaction = self.pool.begin().await.map_err(database)?;
+        sqlx::query(
+            "INSERT INTO oauth_connection_config_revisions (
+                connection_id, revision, config_json, created_at
+             ) VALUES (?, ?, ?, ?)",
+        )
+        .bind(&current.connection.id)
+        .bind(next_config_revision)
+        .bind(config_json)
+        .bind(now)
+        .execute(&mut *transaction)
+        .await
+        .map_err(map_cas_database)?;
+        if let Some(ciphertext) = sealed {
+            insert_secret_revision(
+                &mut transaction,
+                &current.connection.id,
+                next_secret_revision.ok_or(OAuthStoreError::InvalidStoredRecord)?,
+                ciphertext,
+                secrets.access_token_expires_at,
+                now,
+            )
+            .await?;
+        }
+        let updated = sqlx::query(
+            "UPDATE oauth_connections
+             SET revision = revision + 1, current_config_revision = ?,
+                 current_secret_revision = ?, status = ?, error_code = NULL,
+                 granted_scopes_json = ?, has_client_secret = ?, has_refresh_token = ?,
+                 access_expires_at = ?, authorized_at = NULL, last_refreshed_at = NULL,
+                 updated_at = ?
+             WHERE id = ? AND source_id = ? AND credential_key = ? AND revision = ?
+               AND current_config_revision = ?
+               AND ((current_secret_revision IS NULL AND ? IS NULL)
+                    OR current_secret_revision = ?)",
+        )
+        .bind(next_config_revision)
+        .bind(next_secret_revision)
+        .bind(status.as_db_str())
+        .bind(granted_scopes_json)
+        .bind(secrets.client_secret.is_some())
+        .bind(secrets.refresh_token.is_some())
+        .bind(secrets.access_token_expires_at)
+        .bind(now)
+        .bind(&current.connection.id)
+        .bind(source_id)
+        .bind(credential_key)
+        .bind(expected_revision)
+        .bind(current.connection.config_revision)
+        .bind(current.connection.secret_revision)
+        .bind(current.connection.secret_revision)
+        .execute(&mut *transaction)
+        .await
+        .map_err(database)?;
+        if updated.rows_affected() != 1 {
+            return Err(OAuthStoreError::Conflict);
+        }
+        prune_config_revisions(
+            &mut transaction,
+            &current.connection.id,
+            next_config_revision,
+        )
+        .await?;
+        if let Some(current_secret_revision) = next_secret_revision {
+            prune_secret_revisions(
+                &mut transaction,
+                &current.connection.id,
+                current_secret_revision,
+            )
+            .await?;
+        }
+        transaction.commit().await.map_err(database)?;
+        self.connection(&current.connection.id).await
+    }
+
+    pub(crate) async fn connection(
+        &self,
+        connection_id: &str,
+    ) -> Result<OAuthCredential, OAuthStoreError> {
+        let row = sqlx::query(
+            "SELECT c.id, c.source_id, c.credential_key, c.revision,
+                    c.current_config_revision, c.current_secret_revision,
+                    c.status, c.granted_scopes_json, c.has_client_secret,
+                    c.has_refresh_token, c.access_expires_at, c.authorized_at,
+                    c.last_refreshed_at, c.error_code, c.created_at, c.updated_at,
+                    cfg.config_json, sec.payload_ciphertext
+             FROM oauth_connections c
+             JOIN oauth_connection_config_revisions cfg
+               ON cfg.connection_id = c.id
+              AND cfg.revision = c.current_config_revision
+             LEFT JOIN oauth_connection_secret_revisions sec
+               ON sec.connection_id = c.id
+              AND sec.revision = c.current_secret_revision
+             WHERE c.id = ?",
+        )
+        .bind(connection_id)
+        .fetch_optional(&self.pool)
+        .await
+        .map_err(database)?
+        .ok_or(OAuthStoreError::ConnectionNotFound)?;
+        self.credential_from_row(&row)
+    }
+
+    pub(crate) async fn connection_by_source_key(
+        &self,
+        source_id: &str,
+        credential_key: &str,
+    ) -> Result<OAuthCredential, OAuthStoreError> {
+        let id = sqlx::query_scalar::<_, String>(
+            "SELECT id FROM oauth_connections WHERE source_id = ? AND credential_key = ?",
+        )
+        .bind(source_id)
+        .bind(credential_key)
+        .fetch_optional(&self.pool)
+        .await
+        .map_err(database)?
+        .ok_or(OAuthStoreError::ConnectionNotFound)?;
+        self.connection(&id).await
+    }
+
+    pub(crate) async fn list_connections(
+        &self,
+        source_id: &str,
+    ) -> Result<Vec<OAuthConnection>, OAuthStoreError> {
+        let rows = sqlx::query(
+            "SELECT c.id, c.source_id, c.credential_key, c.revision,
+                    c.current_config_revision, c.current_secret_revision,
+                    c.status, c.granted_scopes_json, c.has_client_secret,
+                    c.has_refresh_token, c.access_expires_at, c.authorized_at,
+                    c.last_refreshed_at, c.error_code, c.created_at, c.updated_at,
+                    cfg.config_json
+             FROM oauth_connections c
+             JOIN oauth_connection_config_revisions cfg
+               ON cfg.connection_id = c.id
+              AND cfg.revision = c.current_config_revision
+             WHERE c.source_id = ?
+             ORDER BY c.credential_key",
+        )
+        .bind(source_id)
+        .fetch_all(&self.pool)
+        .await
+        .map_err(database)?;
+        rows.iter().map(connection_metadata_from_row).collect()
+    }
+
+    pub(crate) async fn delete_connection(
+        &self,
+        source_id: &str,
+        credential_key: &str,
+        expected_revision: i64,
+    ) -> Result<(), OAuthStoreError> {
+        let deleted = sqlx::query(
+            "DELETE FROM oauth_connections
+             WHERE source_id = ? AND credential_key = ? AND revision = ?",
+        )
+        .bind(source_id)
+        .bind(credential_key)
+        .bind(expected_revision)
+        .execute(&self.pool)
+        .await
+        .map_err(database)?;
+        if deleted.rows_affected() == 1 {
+            return Ok(());
+        }
+        let exists = sqlx::query_scalar::<_, i64>(
+            "SELECT EXISTS(
+                SELECT 1 FROM oauth_connections
+                WHERE source_id = ? AND credential_key = ?
+             )",
+        )
+        .bind(source_id)
+        .bind(credential_key)
+        .fetch_one(&self.pool)
+        .await
+        .map_err(database)?
+            != 0;
+        if exists {
+            Err(OAuthStoreError::Conflict)
+        } else {
+            Err(OAuthStoreError::ConnectionNotFound)
+        }
+    }
+
+    pub(crate) async fn disconnect_connection(
+        &self,
+        source_id: &str,
+        credential_key: &str,
+        expected_revision: i64,
+        now: i64,
+    ) -> Result<OAuthCredential, OAuthStoreError> {
+        let current = self
+            .connection_by_source_key(source_id, credential_key)
+            .await?;
+        if current.connection.revision != expected_revision {
+            return Err(OAuthStoreError::Conflict);
+        }
+        let disconnected = OAuthSecretSet {
+            client_secret: current
+                .secrets
+                .as_ref()
+                .and_then(|secrets| secrets.client_secret.clone()),
+            ..OAuthSecretSet::default()
+        };
+        let next_secret_revision = current
+            .connection
+            .secret_revision
+            .unwrap_or(0)
+            .checked_add(1)
+            .ok_or(OAuthStoreError::Conflict)?;
+        let ciphertext = self.crypto.seal_secrets(
+            &current.connection.id,
+            next_secret_revision,
+            &disconnected,
+        )?;
+        let mut transaction = self.pool.begin().await.map_err(database)?;
+        insert_secret_revision(
+            &mut transaction,
+            &current.connection.id,
+            next_secret_revision,
+            ciphertext,
+            None,
+            now,
+        )
+        .await?;
+        let updated = sqlx::query(
+            "UPDATE oauth_connections
+             SET revision = revision + 1, current_secret_revision = ?,
+                 status = 'pending_authorization', error_code = NULL,
+                 granted_scopes_json = '[]', has_client_secret = ?,
+                 has_refresh_token = 0, access_expires_at = NULL,
+                 authorized_at = NULL, last_refreshed_at = NULL, updated_at = ?
+             WHERE id = ? AND source_id = ? AND credential_key = ? AND revision = ?
+               AND current_config_revision = ?
+               AND ((current_secret_revision IS NULL AND ? IS NULL)
+                    OR current_secret_revision = ?)",
+        )
+        .bind(next_secret_revision)
+        .bind(disconnected.client_secret.is_some())
+        .bind(now)
+        .bind(&current.connection.id)
+        .bind(source_id)
+        .bind(credential_key)
+        .bind(expected_revision)
+        .bind(current.connection.config_revision)
+        .bind(current.connection.secret_revision)
+        .bind(current.connection.secret_revision)
+        .execute(&mut *transaction)
+        .await
+        .map_err(database)?;
+        if updated.rows_affected() != 1 {
+            return Err(OAuthStoreError::Conflict);
+        }
+        prune_secret_revisions(
+            &mut transaction,
+            &current.connection.id,
+            next_secret_revision,
+        )
+        .await?;
+        transaction.commit().await.map_err(database)?;
+        self.connection(&current.connection.id).await
+    }
+
+    pub(crate) async fn begin_authorization(
+        &self,
+        source_id: &str,
+        credential_key: &str,
+        expected_revision: i64,
+        admin_session_digest: &[u8; 32],
+        now: i64,
+        expires_at: i64,
+    ) -> Result<PendingAuthorization, OAuthStoreError> {
+        if expires_at <= now {
+            return Err(OAuthStoreError::AuthorizationRejected);
+        }
+        let current = sqlx::query(
+            "SELECT id, revision, current_config_revision, current_secret_revision
+             FROM oauth_connections
+             WHERE source_id = ? AND credential_key = ?",
+        )
+        .bind(source_id)
+        .bind(credential_key)
+        .fetch_optional(&self.pool)
+        .await
+        .map_err(database)?
+        .ok_or(OAuthStoreError::ConnectionNotFound)?;
+        if current.get::<i64, _>("revision") != expected_revision {
+            return Err(OAuthStoreError::Conflict);
+        }
+        let connection_id: String = current.get("id");
+        let connection_revision = expected_revision
+            .checked_add(1)
+            .ok_or(OAuthStoreError::Conflict)?;
+        let config_revision: i64 = current.get("current_config_revision");
+        let base_secret_revision: Option<i64> = current.get("current_secret_revision");
+        let transaction_id = Uuid::new_v4().to_string();
+        let state = self.crypto.new_state();
+        let verifier = self.crypto.new_pkce_verifier();
+        let state_digest = self.crypto.state_digest(&state);
+        let verifier_ciphertext = self.crypto.seal_pkce_verifier(&transaction_id, &verifier)?;
+
+        let mut transaction = self.pool.begin().await.map_err(database)?;
+        let exchange_in_progress = sqlx::query_scalar::<_, i64>(
+            "SELECT EXISTS(
+                SELECT 1 FROM oauth_authorization_transactions
+                WHERE connection_id = ? AND status = 'exchanging'
+             )",
+        )
+        .bind(&connection_id)
+        .fetch_one(&mut *transaction)
+        .await
+        .map_err(database)?
+            != 0;
+        if exchange_in_progress {
+            return Err(OAuthStoreError::Conflict);
+        }
+        sqlx::query(
+            "UPDATE oauth_authorization_transactions
+             SET status = 'failed', error_code = ?, completed_at = ?
+             WHERE connection_id = ? AND status = 'pending'",
+        )
+        .bind(AUTHORIZATION_ERROR_SUPERSEDED)
+        .bind(now)
+        .bind(&connection_id)
+        .execute(&mut *transaction)
+        .await
+        .map_err(database)?;
+        let updated = sqlx::query(
+            "UPDATE oauth_connections
+             SET revision = revision + 1, status = 'connecting', error_code = NULL,
+                 updated_at = ?
+             WHERE id = ? AND revision = ? AND current_config_revision = ?
+               AND ((current_secret_revision IS NULL AND ? IS NULL)
+                    OR current_secret_revision = ?)",
+        )
+        .bind(now)
+        .bind(&connection_id)
+        .bind(expected_revision)
+        .bind(config_revision)
+        .bind(base_secret_revision)
+        .bind(base_secret_revision)
+        .execute(&mut *transaction)
+        .await
+        .map_err(database)?;
+        if updated.rows_affected() != 1 {
+            return Err(OAuthStoreError::Conflict);
+        }
+        sqlx::query("DELETE FROM oauth_refresh_leases WHERE connection_id = ?")
+            .bind(&connection_id)
+            .execute(&mut *transaction)
+            .await
+            .map_err(database)?;
+        let inserted = sqlx::query(
+            "INSERT INTO oauth_authorization_transactions (
+                id, connection_id, connection_revision, config_revision, base_secret_revision,
+                state_digest, admin_session_digest, pkce_verifier_ciphertext,
+                exchange_claim_digest, status, result_secret_revision, error_code,
+                created_at, expires_at, claimed_at, completed_at
+             ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL, 'pending', NULL, NULL, ?, ?, NULL, NULL)",
+        )
+        .bind(&transaction_id)
+        .bind(&connection_id)
+        .bind(connection_revision)
+        .bind(config_revision)
+        .bind(base_secret_revision)
+        .bind(state_digest.to_vec())
+        .bind(admin_session_digest.to_vec())
+        .bind(verifier_ciphertext)
+        .bind(now)
+        .bind(expires_at)
+        .execute(&mut *transaction)
+        .await;
+        if let Err(error) = inserted {
+            if is_authorization_capacity(&error) {
+                return Err(OAuthStoreError::AuthorizationCapacity);
+            }
+            return Err(database(error));
+        }
+        transaction.commit().await.map_err(database)?;
+
+        Ok(PendingAuthorization {
+            transaction_id,
+            state,
+            pkce_verifier: verifier,
+            config_revision,
+            expires_at,
+        })
+    }
+
+    pub(crate) async fn claim_authorization_exchange(
+        &self,
+        expected_connection_id: &str,
+        state: &str,
+        admin_session_digest: &[u8; 32],
+        now: i64,
+    ) -> Result<AuthorizationExchangeClaim, OAuthStoreError> {
+        let state_digest = self.crypto.state_digest(state);
+        let claim_token = self.crypto.new_claim_token();
+        let claim_digest = self.crypto.authorization_claim_digest(&claim_token);
+        let exchange_expires_at = now
+            .checked_add(AUTHORIZATION_EXCHANGE_TTL_SECONDS)
+            .ok_or(OAuthStoreError::AuthorizationRejected)?;
+        let mut transaction = self.pool.begin().await.map_err(database)?;
+        sqlx::query(
+            "UPDATE oauth_authorization_transactions
+             SET status = 'expired', error_code = ?, completed_at = ?
+             WHERE state_digest = ? AND connection_id = ?
+               AND status = 'pending' AND expires_at <= ?",
+        )
+        .bind(AUTHORIZATION_ERROR_EXPIRED)
+        .bind(now)
+        .bind(state_digest.to_vec())
+        .bind(expected_connection_id)
+        .bind(now)
+        .execute(&mut *transaction)
+        .await
+        .map_err(database)?;
+        sqlx::query(
+            "UPDATE oauth_connections
+             SET revision = revision + 1,
+                 status = CASE
+                    WHEN authorized_at IS NOT NULL
+                     AND (access_expires_at IS NULL OR access_expires_at > ?)
+                    THEN 'active'
+                    ELSE 'pending_authorization'
+                 END,
+                 error_code = ?, updated_at = ?
+             WHERE id = ? AND status = 'connecting'
+               AND EXISTS (
+                    SELECT 1 FROM oauth_authorization_transactions t
+                    WHERE t.connection_id = oauth_connections.id
+                      AND t.state_digest = ? AND t.status = 'expired'
+                      AND t.connection_revision = oauth_connections.revision
+               )",
+        )
+        .bind(now)
+        .bind(AUTHORIZATION_ERROR_EXPIRED)
+        .bind(now)
+        .bind(expected_connection_id)
+        .bind(state_digest.to_vec())
+        .execute(&mut *transaction)
+        .await
+        .map_err(database)?;
+
+        let row = sqlx::query(
+            "SELECT t.id, t.connection_id, t.connection_revision,
+                    t.config_revision, t.base_secret_revision,
+                    t.pkce_verifier_ciphertext, cfg.config_json,
+                    sec.payload_ciphertext
+             FROM oauth_authorization_transactions t
+             JOIN oauth_connection_config_revisions cfg
+               ON cfg.connection_id = t.connection_id
+              AND cfg.revision = t.config_revision
+             JOIN oauth_connections c
+               ON c.id = t.connection_id
+              AND c.revision = t.connection_revision
+              AND c.current_config_revision = t.config_revision
+              AND ((c.current_secret_revision IS NULL AND t.base_secret_revision IS NULL)
+                   OR c.current_secret_revision = t.base_secret_revision)
+             LEFT JOIN oauth_connection_secret_revisions sec
+               ON sec.connection_id = t.connection_id
+              AND sec.revision = t.base_secret_revision
+             WHERE t.state_digest = ?
+               AND t.connection_id = ?
+               AND t.admin_session_digest = ?
+               AND t.status = 'pending'
+               AND t.expires_at > ?",
+        )
+        .bind(state_digest.to_vec())
+        .bind(expected_connection_id)
+        .bind(admin_session_digest.to_vec())
+        .bind(now)
+        .fetch_optional(&mut *transaction)
+        .await
+        .map_err(database)?;
+        let Some(row) = row else {
+            transaction.commit().await.map_err(database)?;
+            return Err(OAuthStoreError::AuthorizationRejected);
+        };
+        let transaction_id: String = row.get("id");
+        let verifier_ciphertext: Vec<u8> = row.get("pkce_verifier_ciphertext");
+        let base_secret_revision: Option<i64> = row.get("base_secret_revision");
+        let secret_ciphertext: Option<Vec<u8>> = row.get("payload_ciphertext");
+        let secrets = match (base_secret_revision, secret_ciphertext) {
+            (Some(revision), Some(ciphertext)) => Some(self.crypto.open_secrets(
+                expected_connection_id,
+                revision,
+                &ciphertext,
+            )?),
+            (None, None) => None,
+            _ => return Err(OAuthStoreError::InvalidStoredRecord),
+        };
+        let config = decode_config(row.get("config_json"))?;
+        let pkce_verifier = self
+            .crypto
+            .open_pkce_verifier(&transaction_id, &verifier_ciphertext)?;
+        let updated = sqlx::query(
+            "UPDATE oauth_authorization_transactions
+             SET status = 'exchanging', exchange_claim_digest = ?, claimed_at = ?,
+                 exchange_expires_at = ?
+             WHERE id = ? AND status = 'pending' AND expires_at > ?
+               AND EXISTS (
+                    SELECT 1 FROM oauth_connections c
+                    WHERE c.id = oauth_authorization_transactions.connection_id
+                      AND c.revision = oauth_authorization_transactions.connection_revision
+                      AND c.current_config_revision = oauth_authorization_transactions.config_revision
+                      AND ((c.current_secret_revision IS NULL
+                            AND oauth_authorization_transactions.base_secret_revision IS NULL)
+                           OR c.current_secret_revision = oauth_authorization_transactions.base_secret_revision)
+               )",
+        )
+        .bind(claim_digest.to_vec())
+        .bind(now)
+        .bind(exchange_expires_at)
+        .bind(&transaction_id)
+        .bind(now)
+        .execute(&mut *transaction)
+        .await
+        .map_err(database)?;
+        if updated.rows_affected() != 1 {
+            return Err(OAuthStoreError::AuthorizationRejected);
+        }
+        transaction.commit().await.map_err(database)?;
+
+        Ok(AuthorizationExchangeClaim {
+            transaction_id: transaction_id.clone(),
+            connection_id: row.get("connection_id"),
+            connection_revision: row.get("connection_revision"),
+            config_revision: row.get("config_revision"),
+            config,
+            base_secret_revision,
+            secrets,
+            claim_token,
+            pkce_verifier,
+        })
+    }
+
+    pub(crate) async fn complete_authorization_exchange(
+        &self,
+        claim: &AuthorizationExchangeClaim,
+        secrets: &OAuthSecretSet,
+        now: i64,
+    ) -> Result<i64, OAuthStoreError> {
+        if !valid_access_token(secrets) {
+            return Err(OAuthStoreError::InvalidStoredRecord);
+        }
+        let claim_digest = self.crypto.authorization_claim_digest(&claim.claim_token);
+        let mut effective_secrets = secrets.clone();
+        effective_secrets.client_secret = claim
+            .secrets
+            .as_ref()
+            .and_then(|secrets| secrets.client_secret.clone());
+        let next_revision = claim
+            .base_secret_revision
+            .unwrap_or(0)
+            .checked_add(1)
+            .ok_or(OAuthStoreError::Conflict)?;
+        let next_config_revision = claim
+            .config_revision
+            .checked_add(1)
+            .ok_or(OAuthStoreError::Conflict)?;
+        let ciphertext =
+            self.crypto
+                .seal_secrets(&claim.connection_id, next_revision, &effective_secrets)?;
+        let mut transaction = self.pool.begin().await.map_err(database)?;
+        let valid = exchange_claim_is_current(&mut transaction, claim, &claim_digest, now).await?;
+        if !valid {
+            return Err(OAuthStoreError::Conflict);
+        }
+        sqlx::query(
+            "INSERT INTO oauth_connection_config_revisions (
+                connection_id, revision, config_json, created_at
+             ) VALUES (?, ?, ?, ?)",
+        )
+        .bind(&claim.connection_id)
+        .bind(next_config_revision)
+        .bind(encode_config(&claim.config)?)
+        .bind(now)
+        .execute(&mut *transaction)
+        .await
+        .map_err(map_cas_database)?;
+        insert_secret_revision(
+            &mut transaction,
+            &claim.connection_id,
+            next_revision,
+            ciphertext,
+            effective_secrets.access_token_expires_at,
+            now,
+        )
+        .await?;
+        let granted_scopes_json = serde_json::to_string(&effective_secrets.granted_scopes)
+            .map_err(OAuthStoreError::EncodeConfiguration)?;
+        let connection_updated = sqlx::query(
+            "UPDATE oauth_connections
+             SET current_config_revision = ?, current_secret_revision = ?,
+                 status = 'active', error_code = NULL,
+                 revision = revision + 1, granted_scopes_json = ?,
+                 has_client_secret = ?, has_refresh_token = ?, access_expires_at = ?,
+                 authorized_at = ?, last_refreshed_at = NULL, updated_at = ?
+             WHERE id = ? AND revision = ? AND current_config_revision = ?
+               AND ((current_secret_revision IS NULL AND ? IS NULL)
+                    OR current_secret_revision = ?)",
+        )
+        .bind(next_config_revision)
+        .bind(next_revision)
+        .bind(granted_scopes_json)
+        .bind(effective_secrets.client_secret.is_some())
+        .bind(effective_secrets.refresh_token.is_some())
+        .bind(effective_secrets.access_token_expires_at)
+        .bind(now)
+        .bind(now)
+        .bind(&claim.connection_id)
+        .bind(claim.connection_revision)
+        .bind(claim.config_revision)
+        .bind(claim.base_secret_revision)
+        .bind(claim.base_secret_revision)
+        .execute(&mut *transaction)
+        .await
+        .map_err(database)?;
+        if connection_updated.rows_affected() != 1 {
+            return Err(OAuthStoreError::Conflict);
+        }
+        let transaction_updated = sqlx::query(
+            "UPDATE oauth_authorization_transactions
+             SET status = 'succeeded', result_secret_revision = ?, completed_at = ?
+             WHERE id = ? AND status = 'exchanging' AND exchange_claim_digest = ?",
+        )
+        .bind(next_revision)
+        .bind(now)
+        .bind(&claim.transaction_id)
+        .bind(claim_digest.to_vec())
+        .execute(&mut *transaction)
+        .await
+        .map_err(database)?;
+        if transaction_updated.rows_affected() != 1 {
+            return Err(OAuthStoreError::Conflict);
+        }
+        prune_config_revisions(&mut transaction, &claim.connection_id, next_config_revision)
+            .await?;
+        prune_secret_revisions(&mut transaction, &claim.connection_id, next_revision).await?;
+        transaction.commit().await.map_err(database)?;
+        Ok(next_revision)
+    }
+
+    pub(crate) async fn fail_authorization_exchange(
+        &self,
+        claim: &AuthorizationExchangeClaim,
+        error_code: &str,
+        now: i64,
+    ) -> Result<(), OAuthStoreError> {
+        if !valid_reason_code(error_code) {
+            return Err(OAuthStoreError::InvalidStoredRecord);
+        }
+        let claim_digest = self.crypto.authorization_claim_digest(&claim.claim_token);
+        let mut transaction = self.pool.begin().await.map_err(database)?;
+        let updated = sqlx::query(
+            "UPDATE oauth_authorization_transactions
+             SET status = 'failed', error_code = ?, completed_at = ?
+             WHERE id = ? AND status = 'exchanging' AND exchange_claim_digest = ?",
+        )
+        .bind(error_code)
+        .bind(now)
+        .bind(&claim.transaction_id)
+        .bind(claim_digest.to_vec())
+        .execute(&mut *transaction)
+        .await
+        .map_err(database)?;
+        if updated.rows_affected() != 1 {
+            return Err(OAuthStoreError::Conflict);
+        }
+        let connection_status = if claim
+            .secrets
+            .as_ref()
+            .is_some_and(|secrets| secrets.access_token.is_some())
+        {
+            OAuthConnectionStatus::Active
+        } else {
+            OAuthConnectionStatus::PendingAuthorization
+        };
+        let connection_updated = sqlx::query(
+            "UPDATE oauth_connections
+             SET revision = revision + 1, status = ?, error_code = ?, updated_at = ?
+             WHERE id = ? AND revision = ?
+               AND current_config_revision = ?
+               AND ((current_secret_revision IS NULL AND ? IS NULL)
+                    OR current_secret_revision = ?)",
+        )
+        .bind(connection_status.as_db_str())
+        .bind(error_code)
+        .bind(now)
+        .bind(&claim.connection_id)
+        .bind(claim.connection_revision)
+        .bind(claim.config_revision)
+        .bind(claim.base_secret_revision)
+        .bind(claim.base_secret_revision)
+        .execute(&mut *transaction)
+        .await
+        .map_err(database)?;
+        transaction.commit().await.map_err(database)?;
+        if connection_updated.rows_affected() == 1 {
+            Ok(())
+        } else {
+            Err(OAuthStoreError::Conflict)
+        }
+    }
+
+    pub(crate) async fn claim_refresh(
+        &self,
+        connection_id: &str,
+        now: i64,
+        lease_expires_at: i64,
+    ) -> Result<RefreshClaim, OAuthStoreError> {
+        if lease_expires_at <= now {
+            return Err(OAuthStoreError::Conflict);
+        }
+        let lease_token = self.crypto.new_refresh_lease_token();
+        let lease_digest = self.crypto.refresh_lease_digest(&lease_token);
+        let mut transaction = self.pool.begin().await.map_err(database)?;
+        let expired_claim = sqlx::query_as::<_, (i64, i64, i64)>(
+            "SELECT base_secret_revision, connection_revision, config_revision
+             FROM oauth_refresh_leases
+             WHERE connection_id = ? AND expires_at <= ?",
+        )
+        .bind(connection_id)
+        .bind(now)
+        .fetch_optional(&mut *transaction)
+        .await
+        .map_err(database)?;
+        if let Some((expired_base, connection_revision, config_revision)) = expired_claim {
+            let marked = sqlx::query(
+                "UPDATE oauth_connections
+                 SET revision = revision + 1, status = 'reauth_required',
+                     error_code = ?, updated_at = ?
+                 WHERE id = ? AND status = 'active' AND revision = ?
+                   AND current_config_revision = ? AND current_secret_revision = ?",
+            )
+            .bind(REFRESH_ERROR_INTERRUPTED)
+            .bind(now)
+            .bind(connection_id)
+            .bind(connection_revision)
+            .bind(config_revision)
+            .bind(expired_base)
+            .execute(&mut *transaction)
+            .await
+            .map_err(database)?;
+            sqlx::query("DELETE FROM oauth_refresh_leases WHERE connection_id = ?")
+                .bind(connection_id)
+                .execute(&mut *transaction)
+                .await
+                .map_err(database)?;
+            transaction.commit().await.map_err(database)?;
+            if marked.rows_affected() == 1 {
+                return Err(OAuthStoreError::ReauthorizationRequired);
+            }
+            transaction = self.pool.begin().await.map_err(database)?;
+        }
+        sqlx::query("DELETE FROM oauth_refresh_leases WHERE connection_id = ? AND expires_at <= ?")
+            .bind(connection_id)
+            .bind(now)
+            .execute(&mut *transaction)
+            .await
+            .map_err(database)?;
+        let row = sqlx::query(
+            "SELECT c.revision, c.current_config_revision, c.current_secret_revision, c.status,
+                    cfg.config_json, sec.payload_ciphertext
+             FROM oauth_connections c
+             JOIN oauth_connection_config_revisions cfg
+               ON cfg.connection_id = c.id
+              AND cfg.revision = c.current_config_revision
+             LEFT JOIN oauth_connection_secret_revisions sec
+               ON sec.connection_id = c.id
+              AND sec.revision = c.current_secret_revision
+             WHERE c.id = ?",
+        )
+        .bind(connection_id)
+        .fetch_optional(&mut *transaction)
+        .await
+        .map_err(database)?
+        .ok_or(OAuthStoreError::ConnectionNotFound)?;
+        let status = status_from_row(&row)?;
+        if status != OAuthConnectionStatus::Active {
+            return Err(OAuthStoreError::ReauthorizationRequired);
+        }
+        let base_secret_revision: Option<i64> = row.get("current_secret_revision");
+        let base_secret_revision =
+            base_secret_revision.ok_or(OAuthStoreError::InvalidStoredRecord)?;
+        let config = decode_config(row.get("config_json"))?;
+        let ciphertext: Option<Vec<u8>> = row.get("payload_ciphertext");
+        let ciphertext = ciphertext.ok_or(OAuthStoreError::InvalidStoredRecord)?;
+        let secrets = self
+            .crypto
+            .open_secrets(connection_id, base_secret_revision, &ciphertext)?;
+        let inserted = sqlx::query(
+            "INSERT INTO oauth_refresh_leases (
+                connection_id, lease_digest, base_secret_revision,
+                connection_revision, config_revision, claimed_at, expires_at
+             ) VALUES (?, ?, ?, ?, ?, ?, ?)",
+        )
+        .bind(connection_id)
+        .bind(lease_digest.to_vec())
+        .bind(base_secret_revision)
+        .bind(row.get::<i64, _>("revision"))
+        .bind(row.get::<i64, _>("current_config_revision"))
+        .bind(now)
+        .bind(lease_expires_at)
+        .execute(&mut *transaction)
+        .await;
+        if let Err(error) = inserted {
+            if is_constraint(&error) {
+                return Err(OAuthStoreError::RefreshInProgress);
+            }
+            return Err(database(error));
+        }
+        transaction.commit().await.map_err(database)?;
+
+        Ok(RefreshClaim {
+            connection_id: connection_id.to_owned(),
+            connection_revision: row.get("revision"),
+            config_revision: row.get("current_config_revision"),
+            config,
+            base_secret_revision,
+            secrets,
+            lease_token,
+            expires_at: lease_expires_at,
+        })
+    }
+
+    pub(crate) async fn complete_refresh(
+        &self,
+        claim: &RefreshClaim,
+        rotated_secrets: &OAuthSecretSet,
+        now: i64,
+    ) -> Result<i64, OAuthStoreError> {
+        if !valid_access_token(rotated_secrets) {
+            return Err(OAuthStoreError::InvalidStoredRecord);
+        }
+        let mut effective_secrets = rotated_secrets.clone();
+        effective_secrets.client_secret = claim.secrets.client_secret.clone();
+        if effective_secrets.refresh_token.is_none() {
+            effective_secrets.refresh_token = claim.secrets.refresh_token.clone();
+        }
+        let next_revision = claim
+            .base_secret_revision
+            .checked_add(1)
+            .ok_or(OAuthStoreError::Conflict)?;
+        let lease_digest = self.crypto.refresh_lease_digest(&claim.lease_token);
+        let ciphertext =
+            self.crypto
+                .seal_secrets(&claim.connection_id, next_revision, &effective_secrets)?;
+        let mut transaction = self.pool.begin().await.map_err(database)?;
+        if !refresh_claim_is_current(&mut transaction, claim, &lease_digest, now).await? {
+            return Err(OAuthStoreError::Conflict);
+        }
+        insert_secret_revision(
+            &mut transaction,
+            &claim.connection_id,
+            next_revision,
+            ciphertext,
+            effective_secrets.access_token_expires_at,
+            now,
+        )
+        .await?;
+        let granted_scopes_json = serde_json::to_string(&effective_secrets.granted_scopes)
+            .map_err(OAuthStoreError::EncodeConfiguration)?;
+        let updated = sqlx::query(
+            "UPDATE oauth_connections
+             SET current_secret_revision = ?, status = 'active', error_code = NULL,
+                 revision = revision + 1, granted_scopes_json = ?,
+                 has_client_secret = ?, has_refresh_token = ?, access_expires_at = ?,
+                 last_refreshed_at = ?, updated_at = ?
+             WHERE id = ? AND status = 'active' AND revision = ?
+               AND current_config_revision = ? AND current_secret_revision = ?",
+        )
+        .bind(next_revision)
+        .bind(granted_scopes_json)
+        .bind(effective_secrets.client_secret.is_some())
+        .bind(effective_secrets.refresh_token.is_some())
+        .bind(effective_secrets.access_token_expires_at)
+        .bind(now)
+        .bind(now)
+        .bind(&claim.connection_id)
+        .bind(claim.connection_revision)
+        .bind(claim.config_revision)
+        .bind(claim.base_secret_revision)
+        .execute(&mut *transaction)
+        .await
+        .map_err(database)?;
+        if updated.rows_affected() != 1 {
+            return Err(OAuthStoreError::Conflict);
+        }
+        prune_secret_revisions(&mut transaction, &claim.connection_id, next_revision).await?;
+        delete_refresh_lease(&mut transaction, &claim.connection_id, &lease_digest).await?;
+        transaction.commit().await.map_err(database)?;
+        Ok(next_revision)
+    }
+
+    pub(crate) async fn mark_refresh_invalid_grant(
+        &self,
+        claim: &RefreshClaim,
+        now: i64,
+    ) -> Result<(), OAuthStoreError> {
+        let lease_digest = self.crypto.refresh_lease_digest(&claim.lease_token);
+        let mut transaction = self.pool.begin().await.map_err(database)?;
+        if !refresh_claim_is_current(&mut transaction, claim, &lease_digest, now).await? {
+            return Err(OAuthStoreError::Conflict);
+        }
+        let updated = sqlx::query(
+            "UPDATE oauth_connections
+             SET status = 'reauth_required', error_code = ?,
+                 revision = revision + 1, updated_at = ?
+             WHERE id = ? AND status = 'active' AND revision = ?
+               AND current_config_revision = ? AND current_secret_revision = ?",
+        )
+        .bind(REFRESH_ERROR_INVALID_GRANT)
+        .bind(now)
+        .bind(&claim.connection_id)
+        .bind(claim.connection_revision)
+        .bind(claim.config_revision)
+        .bind(claim.base_secret_revision)
+        .execute(&mut *transaction)
+        .await
+        .map_err(database)?;
+        if updated.rows_affected() != 1 {
+            return Err(OAuthStoreError::Conflict);
+        }
+        delete_refresh_lease(&mut transaction, &claim.connection_id, &lease_digest).await?;
+        transaction.commit().await.map_err(database)?;
+        Ok(())
+    }
+
+    pub(crate) async fn mark_refresh_reauthorization_required(
+        &self,
+        claim: &RefreshClaim,
+        reason: &str,
+    ) -> Result<(), OAuthStoreError> {
+        if !valid_reason_code(reason) {
+            return Err(OAuthStoreError::InvalidStoredRecord);
+        }
+        let now = crate::unix_timestamp();
+        let lease_digest = self.crypto.refresh_lease_digest(&claim.lease_token);
+        let mut transaction = self.pool.begin().await.map_err(database)?;
+        if !refresh_claim_is_current(&mut transaction, claim, &lease_digest, now).await? {
+            return Err(OAuthStoreError::Conflict);
+        }
+        let updated = sqlx::query(
+            "UPDATE oauth_connections
+             SET status = 'reauth_required', error_code = ?,
+                 revision = revision + 1, updated_at = ?
+             WHERE id = ? AND status = 'active' AND revision = ?
+               AND current_config_revision = ? AND current_secret_revision = ?",
+        )
+        .bind(reason)
+        .bind(now)
+        .bind(&claim.connection_id)
+        .bind(claim.connection_revision)
+        .bind(claim.config_revision)
+        .bind(claim.base_secret_revision)
+        .execute(&mut *transaction)
+        .await
+        .map_err(database)?;
+        if updated.rows_affected() != 1 {
+            return Err(OAuthStoreError::Conflict);
+        }
+        delete_refresh_lease(&mut transaction, &claim.connection_id, &lease_digest).await?;
+        transaction.commit().await.map_err(database)?;
+        Ok(())
+    }
+
+    pub(crate) async fn expire_authorizations(&self, now: i64) -> Result<u64, OAuthStoreError> {
+        let mut transaction = self.pool.begin().await.map_err(database)?;
+        let expired_pending = sqlx::query(
+            "UPDATE oauth_authorization_transactions
+             SET status = 'expired', error_code = ?, completed_at = ?
+             WHERE status = 'pending' AND expires_at <= ?",
+        )
+        .bind(AUTHORIZATION_ERROR_EXPIRED)
+        .bind(now)
+        .bind(now)
+        .execute(&mut *transaction)
+        .await
+        .map_err(database)?
+        .rows_affected();
+        let expired_exchanging = sqlx::query(
+            "UPDATE oauth_authorization_transactions
+             SET status = 'failed', error_code = ?, completed_at = ?
+             WHERE status = 'exchanging' AND exchange_expires_at <= ?",
+        )
+        .bind(AUTHORIZATION_ERROR_EXCHANGE_TIMEOUT)
+        .bind(now)
+        .bind(now)
+        .execute(&mut *transaction)
+        .await
+        .map_err(database)?
+        .rows_affected();
+        sqlx::query(
+            "UPDATE oauth_connections
+             SET revision = revision + 1,
+                 status = CASE
+                    WHEN authorized_at IS NOT NULL
+                     AND (access_expires_at IS NULL OR access_expires_at > ?)
+                    THEN 'active'
+                    ELSE 'pending_authorization'
+                 END,
+                 error_code = CASE
+                    WHEN EXISTS (
+                        SELECT 1 FROM oauth_authorization_transactions t
+                        WHERE t.connection_id = oauth_connections.id
+                          AND t.status = 'failed' AND t.error_code = ?
+                    ) THEN ?
+                    ELSE ?
+                 END,
+                 updated_at = ?
+             WHERE status = 'connecting'
+               AND NOT EXISTS (
+                    SELECT 1 FROM oauth_authorization_transactions t
+                    WHERE t.connection_id = oauth_connections.id
+                      AND t.status IN ('pending', 'exchanging')
+               )",
+        )
+        .bind(now)
+        .bind(AUTHORIZATION_ERROR_EXCHANGE_TIMEOUT)
+        .bind(AUTHORIZATION_ERROR_EXCHANGE_TIMEOUT)
+        .bind(AUTHORIZATION_ERROR_EXPIRED)
+        .bind(now)
+        .execute(&mut *transaction)
+        .await
+        .map_err(database)?;
+        transaction.commit().await.map_err(database)?;
+        Ok(expired_pending + expired_exchanging)
+    }
+
+    pub(crate) async fn recover_startup(&self, now: i64) -> Result<OAuthRecovery, OAuthStoreError> {
+        let mut transaction = self.pool.begin().await.map_err(database)?;
+        let exchanges = sqlx::query(
+            "UPDATE oauth_authorization_transactions
+             SET status = 'failed', error_code = ?, completed_at = ?
+             WHERE status = 'exchanging'",
+        )
+        .bind(AUTHORIZATION_ERROR_INTERRUPTED)
+        .bind(now)
+        .execute(&mut *transaction)
+        .await
+        .map_err(database)?
+        .rows_affected();
+        sqlx::query(
+            "UPDATE oauth_connections
+             SET revision = revision + 1, status = 'reauth_required',
+                 error_code = ?, updated_at = ?
+             WHERE status = 'active' AND EXISTS (
+                SELECT 1 FROM oauth_refresh_leases l
+                WHERE l.connection_id = oauth_connections.id
+                  AND l.connection_revision = oauth_connections.revision
+                  AND l.config_revision = oauth_connections.current_config_revision
+                  AND l.base_secret_revision = oauth_connections.current_secret_revision
+             )",
+        )
+        .bind(REFRESH_ERROR_INTERRUPTED)
+        .bind(now)
+        .execute(&mut *transaction)
+        .await
+        .map_err(database)?;
+        let leases = sqlx::query("DELETE FROM oauth_refresh_leases")
+            .execute(&mut *transaction)
+            .await
+            .map_err(database)?
+            .rows_affected();
+        sqlx::query(
+            "UPDATE oauth_authorization_transactions
+             SET status = 'expired', error_code = ?, completed_at = ?
+             WHERE status = 'pending' AND expires_at <= ?",
+        )
+        .bind(AUTHORIZATION_ERROR_EXPIRED)
+        .bind(now)
+        .bind(now)
+        .execute(&mut *transaction)
+        .await
+        .map_err(database)?;
+        sqlx::query(
+            "UPDATE oauth_connections
+             SET revision = revision + 1,
+                 status = CASE
+                    WHEN authorized_at IS NOT NULL
+                     AND (access_expires_at IS NULL OR access_expires_at > ?)
+                    THEN 'active'
+                    ELSE 'pending_authorization'
+                 END,
+                 error_code = ?, updated_at = ?
+             WHERE status = 'connecting'
+               AND NOT EXISTS (
+                    SELECT 1 FROM oauth_authorization_transactions t
+                    WHERE t.connection_id = oauth_connections.id
+                      AND t.status = 'pending' AND t.expires_at > ?
+               )",
+        )
+        .bind(now)
+        .bind(AUTHORIZATION_ERROR_INTERRUPTED)
+        .bind(now)
+        .bind(now)
+        .execute(&mut *transaction)
+        .await
+        .map_err(database)?;
+        transaction.commit().await.map_err(database)?;
+        Ok(OAuthRecovery {
+            interrupted_exchanges: exchanges,
+            abandoned_refresh_leases: leases,
+        })
+    }
+
+    fn credential_from_row(
+        &self,
+        row: &sqlx::sqlite::SqliteRow,
+    ) -> Result<OAuthCredential, OAuthStoreError> {
+        let id: String = row.get("id");
+        let secret_revision: Option<i64> = row.get("current_secret_revision");
+        let ciphertext: Option<Vec<u8>> = row.get("payload_ciphertext");
+        let secrets = match (secret_revision, ciphertext) {
+            (Some(revision), Some(ciphertext)) => {
+                Some(self.crypto.open_secrets(&id, revision, &ciphertext)?)
+            }
+            (None, None) => None,
+            _ => return Err(OAuthStoreError::InvalidStoredRecord),
+        };
+        Ok(OAuthCredential {
+            connection: connection_metadata_from_row(row)?,
+            secrets,
+        })
+    }
+}
+
+async fn insert_secret_revision(
+    transaction: &mut sqlx::Transaction<'_, sqlx::Sqlite>,
+    connection_id: &str,
+    revision: i64,
+    ciphertext: Vec<u8>,
+    access_token_expires_at: Option<i64>,
+    now: i64,
+) -> Result<(), OAuthStoreError> {
+    sqlx::query(
+        "INSERT INTO oauth_connection_secret_revisions (
+            connection_id, revision, payload_ciphertext, access_token_expires_at, created_at
+         ) VALUES (?, ?, ?, ?, ?)",
+    )
+    .bind(connection_id)
+    .bind(revision)
+    .bind(ciphertext)
+    .bind(access_token_expires_at)
+    .bind(now)
+    .execute(&mut **transaction)
+    .await
+    .map_err(map_cas_database)?;
+    Ok(())
+}
+
+async fn prune_secret_revisions(
+    transaction: &mut sqlx::Transaction<'_, sqlx::Sqlite>,
+    connection_id: &str,
+    current_revision: i64,
+) -> Result<(), OAuthStoreError> {
+    sqlx::query(
+        "DELETE FROM oauth_connection_secret_revisions
+         WHERE connection_id = ? AND revision <> ?",
+    )
+    .bind(connection_id)
+    .bind(current_revision)
+    .execute(&mut **transaction)
+    .await
+    .map_err(database)?;
+    Ok(())
+}
+
+async fn prune_config_revisions(
+    transaction: &mut sqlx::Transaction<'_, sqlx::Sqlite>,
+    connection_id: &str,
+    current_revision: i64,
+) -> Result<(), OAuthStoreError> {
+    sqlx::query(
+        "DELETE FROM oauth_connection_config_revisions
+         WHERE connection_id = ? AND revision <> ?",
+    )
+    .bind(connection_id)
+    .bind(current_revision)
+    .execute(&mut **transaction)
+    .await
+    .map_err(database)?;
+    Ok(())
+}
+
+async fn exchange_claim_is_current(
+    transaction: &mut sqlx::Transaction<'_, sqlx::Sqlite>,
+    claim: &AuthorizationExchangeClaim,
+    claim_digest: &[u8; 32],
+    now: i64,
+) -> Result<bool, OAuthStoreError> {
+    sqlx::query_scalar::<_, i64>(
+        "SELECT EXISTS(
+            SELECT 1
+            FROM oauth_authorization_transactions t
+            JOIN oauth_connections c ON c.id = t.connection_id
+            WHERE t.id = ? AND t.connection_id = ? AND t.status = 'exchanging'
+              AND t.exchange_claim_digest = ? AND t.exchange_expires_at > ?
+              AND t.config_revision = ?
+              AND t.connection_revision = ? AND c.revision = t.connection_revision
+              AND ((t.base_secret_revision IS NULL AND ? IS NULL)
+                   OR t.base_secret_revision = ?)
+              AND c.current_config_revision = t.config_revision
+              AND ((c.current_secret_revision IS NULL AND t.base_secret_revision IS NULL)
+                   OR c.current_secret_revision = t.base_secret_revision)
+         )",
+    )
+    .bind(&claim.transaction_id)
+    .bind(&claim.connection_id)
+    .bind(claim_digest.to_vec())
+    .bind(now)
+    .bind(claim.config_revision)
+    .bind(claim.connection_revision)
+    .bind(claim.base_secret_revision)
+    .bind(claim.base_secret_revision)
+    .fetch_one(&mut **transaction)
+    .await
+    .map(|exists| exists != 0)
+    .map_err(database)
+}
+
+async fn refresh_claim_is_current(
+    transaction: &mut sqlx::Transaction<'_, sqlx::Sqlite>,
+    claim: &RefreshClaim,
+    lease_digest: &[u8; 32],
+    now: i64,
+) -> Result<bool, OAuthStoreError> {
+    sqlx::query_scalar::<_, i64>(
+        "SELECT EXISTS(
+            SELECT 1
+            FROM oauth_refresh_leases l
+            JOIN oauth_connections c ON c.id = l.connection_id
+            WHERE l.connection_id = ? AND l.lease_digest = ?
+              AND l.base_secret_revision = ? AND l.expires_at > ?
+              AND l.connection_revision = ? AND l.config_revision = ?
+              AND c.status = 'active' AND c.revision = l.connection_revision
+              AND c.current_config_revision = l.config_revision
+              AND c.current_secret_revision = l.base_secret_revision
+         )",
+    )
+    .bind(&claim.connection_id)
+    .bind(lease_digest.to_vec())
+    .bind(claim.base_secret_revision)
+    .bind(now)
+    .bind(claim.connection_revision)
+    .bind(claim.config_revision)
+    .fetch_one(&mut **transaction)
+    .await
+    .map(|exists| exists != 0)
+    .map_err(database)
+}
+
+async fn delete_refresh_lease(
+    transaction: &mut sqlx::Transaction<'_, sqlx::Sqlite>,
+    connection_id: &str,
+    lease_digest: &[u8; 32],
+) -> Result<(), OAuthStoreError> {
+    let deleted = sqlx::query(
+        "DELETE FROM oauth_refresh_leases WHERE connection_id = ? AND lease_digest = ?",
+    )
+    .bind(connection_id)
+    .bind(lease_digest.to_vec())
+    .execute(&mut **transaction)
+    .await
+    .map_err(database)?;
+    if deleted.rows_affected() != 1 {
+        return Err(OAuthStoreError::Conflict);
+    }
+    Ok(())
+}
+
+fn status_from_row(
+    row: &sqlx::sqlite::SqliteRow,
+) -> Result<OAuthConnectionStatus, OAuthStoreError> {
+    let value: String = row.get("status");
+    OAuthConnectionStatus::from_db(&value).ok_or(OAuthStoreError::InvalidStoredRecord)
+}
+
+fn connection_metadata_from_row(
+    row: &sqlx::sqlite::SqliteRow,
+) -> Result<OAuthConnection, OAuthStoreError> {
+    Ok(OAuthConnection {
+        id: row.get("id"),
+        source_id: row.get("source_id"),
+        credential_key: row.get("credential_key"),
+        revision: row.get("revision"),
+        config_revision: row.get("current_config_revision"),
+        secret_revision: row.get("current_secret_revision"),
+        config: decode_config(row.get("config_json"))?,
+        status: status_from_row(row)?,
+        granted_scopes: serde_json::from_str(&row.get::<String, _>("granted_scopes_json"))
+            .map_err(OAuthStoreError::DecodeConfiguration)?,
+        has_client_secret: row.get("has_client_secret"),
+        has_refresh_token: row.get("has_refresh_token"),
+        access_expires_at: row.get("access_expires_at"),
+        authorized_at: row.get("authorized_at"),
+        last_refreshed_at: row.get("last_refreshed_at"),
+        error_code: row.get("error_code"),
+        created_at: row.get("created_at"),
+        updated_at: row.get("updated_at"),
+    })
+}
+
+fn encode_config(config: &OAuthConnectionConfig) -> Result<String, OAuthStoreError> {
+    serde_json::to_string(config).map_err(OAuthStoreError::EncodeConfiguration)
+}
+
+fn decode_config(value: String) -> Result<OAuthConnectionConfig, OAuthStoreError> {
+    serde_json::from_str(&value).map_err(OAuthStoreError::DecodeConfiguration)
+}
+
+fn database(error: sqlx::Error) -> OAuthStoreError {
+    OAuthStoreError::Database(error)
+}
+
+fn map_cas_database(error: sqlx::Error) -> OAuthStoreError {
+    if is_constraint(&error) {
+        OAuthStoreError::Conflict
+    } else {
+        database(error)
+    }
+}
+
+fn is_constraint(error: &sqlx::Error) -> bool {
+    matches!(error, sqlx::Error::Database(error) if error.is_unique_violation())
+}
+
+fn is_authorization_capacity(error: &sqlx::Error) -> bool {
+    matches!(error, sqlx::Error::Database(error) if error.message().contains("OAuth authorization transaction capacity reached"))
+}
+
+fn valid_reason_code(reason: &str) -> bool {
+    !reason.is_empty()
+        && reason.len() <= 128
+        && reason
+            .bytes()
+            .all(|byte| byte.is_ascii_lowercase() || byte.is_ascii_digit() || byte == b'_')
+}
+
+fn valid_access_token(secrets: &OAuthSecretSet) -> bool {
+    secrets
+        .access_token
+        .as_deref()
+        .is_some_and(|token| !token.is_empty())
+}
+
+#[cfg(test)]
+mod tests {
+    use sqlx::sqlite::SqlitePoolOptions;
+
+    use crate::crypto::Keyring;
+
+    use super::{OAuthStore, OAuthStoreError, REFRESH_ERROR_INTERRUPTED};
+    use crate::catalog::{
+        AuditContext, CatalogError, CatalogSnapshot, CatalogStore, CredentialPayload,
+        OAuthBindingExpectation,
+    };
+    use crate::oauth::model::{
+        OAuthClientAuthentication, OAuthClientSecretUpdate, OAuthConnectionConfig,
+        OAuthConnectionStatus, OAuthSecretSet,
+    };
+
+    async fn test_store() -> (OAuthStore, sqlx::SqlitePool) {
+        let pool = SqlitePoolOptions::new()
+            .max_connections(1)
+            .connect("sqlite::memory:")
+            .await
+            .unwrap();
+        sqlx::migrate!("./migrations").run(&pool).await.unwrap();
+        sqlx::query(
+            "INSERT INTO sources (
+                id, kind, slug, display_name, configuration_json, health_status,
+                revision, catalog_revision, created_at, updated_at
+             ) VALUES ('source-1', 'openapi', 'test', 'Test', '{}', 'unknown', 0, 0, 1, 1)",
+        )
+        .execute(&pool)
+        .await
+        .unwrap();
+        let keyring = Keyring::from_master_key([11; 32]).unwrap();
+        (OAuthStore::new(pool.clone(), keyring), pool)
+    }
+
+    fn config(display_name: &str) -> OAuthConnectionConfig {
+        OAuthConnectionConfig {
+            issuer: format!("https://{}.example", display_name.to_lowercase()),
+            authorization_endpoint: "https://issuer.example/authorize".into(),
+            token_endpoint: "https://issuer.example/token".into(),
+            client_id: "executor".into(),
+            client_authentication: OAuthClientAuthentication::ClientSecretBasic,
+            token_endpoint_auth_methods_supported: vec!["client_secret_basic".into()],
+            scopes: vec!["read".into()],
+            allow_private_network: false,
+            resource: Some("https://api.example".into()),
+        }
+    }
+
+    fn secrets(access: &str, refresh: &str) -> OAuthSecretSet {
+        OAuthSecretSet {
+            client_secret: Some("client-secret".into()),
+            access_token: Some(access.into()),
+            refresh_token: Some(refresh.into()),
+            token_type: Some("Bearer".into()),
+            granted_scopes: vec!["read".into()],
+            access_token_expires_at: Some(1_000),
+        }
+    }
+
+    #[tokio::test]
+    async fn config_and_secret_revisions_advance_independently() {
+        let (store, pool) = test_store().await;
+        let created = store
+            .create_connection(
+                "source-1",
+                "default",
+                &config("First"),
+                Some(&secrets("a1", "r1")),
+                10,
+            )
+            .await
+            .unwrap();
+        assert_eq!(created.connection.config_revision, 1);
+        assert_eq!(created.connection.secret_revision, Some(1));
+
+        let updated = store
+            .upsert_connection(
+                "source-1",
+                "default",
+                1,
+                &config("Renamed"),
+                OAuthClientSecretUpdate::Preserve,
+                11,
+            )
+            .await
+            .unwrap();
+        assert_eq!(updated.connection.revision, 2);
+        let loaded = store.connection(&created.connection.id).await.unwrap();
+        assert_eq!(loaded.connection.config.issuer, "https://renamed.example");
+        assert_eq!(loaded.connection.secret_revision, Some(2));
+        assert_eq!(loaded.secrets.unwrap().refresh_token, None);
+        let secret_history = sqlx::query_scalar::<_, i64>(
+            "SELECT count(*) FROM oauth_connection_secret_revisions WHERE connection_id = ?",
+        )
+        .bind(&created.connection.id)
+        .fetch_one(&pool)
+        .await
+        .unwrap();
+        assert_eq!(secret_history, 1);
+        let config_history = sqlx::query_scalar::<_, i64>(
+            "SELECT count(*) FROM oauth_connection_config_revisions WHERE connection_id = ?",
+        )
+        .bind(&created.connection.id)
+        .fetch_one(&pool)
+        .await
+        .unwrap();
+        assert_eq!(config_history, 1);
+
+        assert!(matches!(
+            store
+                .upsert_connection(
+                    "source-1",
+                    "default",
+                    1,
+                    &config("Stale"),
+                    OAuthClientSecretUpdate::Preserve,
+                    12,
+                )
+                .await,
+            Err(OAuthStoreError::Conflict)
+        ));
+    }
+
+    #[tokio::test]
+    async fn authorization_state_is_one_shot_and_bound_to_the_admin_session() {
+        let (store, _) = test_store().await;
+        let connection = store
+            .create_connection("source-1", "default", &config("New"), None, 10)
+            .await
+            .unwrap();
+        let first_session = [1_u8; 32];
+        let other_session = [2_u8; 32];
+        let pending = store
+            .begin_authorization("source-1", "default", 1, &first_session, 11, 100)
+            .await
+            .unwrap();
+
+        assert!(matches!(
+            store
+                .claim_authorization_exchange(
+                    "wrong-connection",
+                    &pending.state,
+                    &first_session,
+                    12,
+                )
+                .await,
+            Err(OAuthStoreError::AuthorizationRejected)
+        ));
+        assert!(matches!(
+            store
+                .claim_authorization_exchange(
+                    &connection.connection.id,
+                    &pending.state,
+                    &other_session,
+                    12,
+                )
+                .await,
+            Err(OAuthStoreError::AuthorizationRejected)
+        ));
+        let claim = store
+            .claim_authorization_exchange(
+                &connection.connection.id,
+                &pending.state,
+                &first_session,
+                12,
+            )
+            .await
+            .unwrap();
+        assert_eq!(claim.pkce_verifier, pending.pkce_verifier);
+        assert!(matches!(
+            store
+                .claim_authorization_exchange(
+                    &connection.connection.id,
+                    &pending.state,
+                    &first_session,
+                    13,
+                )
+                .await,
+            Err(OAuthStoreError::AuthorizationRejected)
+        ));
+
+        let revision = store
+            .complete_authorization_exchange(&claim, &secrets("a1", "r1"), 14)
+            .await
+            .unwrap();
+        assert_eq!(revision, 1);
+        let loaded = store.connection(&connection.connection.id).await.unwrap();
+        assert_eq!(loaded.connection.status, OAuthConnectionStatus::Active);
+        assert_eq!(loaded.connection.secret_revision, Some(1));
+        assert_eq!(loaded.connection.config_revision, 2);
+        let refresh = store
+            .claim_refresh(&connection.connection.id, 15, 25)
+            .await
+            .unwrap();
+        store
+            .complete_refresh(&refresh, &secrets("a2", "r2"), 16)
+            .await
+            .unwrap();
+        let refreshed = store.connection(&connection.connection.id).await.unwrap();
+        assert_eq!(refreshed.connection.config_revision, 2);
+    }
+
+    #[tokio::test]
+    async fn a_new_authorization_supersedes_the_prior_pending_state() {
+        let (store, _) = test_store().await;
+        let connection = store
+            .create_connection("source-1", "default", &config("New"), None, 10)
+            .await
+            .unwrap();
+        let session = [1_u8; 32];
+        let first = store
+            .begin_authorization("source-1", "default", 1, &session, 11, 100)
+            .await
+            .unwrap();
+        let after_first = store.connection(&connection.connection.id).await.unwrap();
+        let second = store
+            .begin_authorization(
+                "source-1",
+                "default",
+                after_first.connection.revision,
+                &session,
+                12,
+                100,
+            )
+            .await
+            .unwrap();
+
+        assert!(matches!(
+            store
+                .claim_authorization_exchange(
+                    &connection.connection.id,
+                    &first.state,
+                    &session,
+                    13,
+                )
+                .await,
+            Err(OAuthStoreError::AuthorizationRejected)
+        ));
+        store
+            .claim_authorization_exchange(&connection.connection.id, &second.state, &session, 13)
+            .await
+            .unwrap();
+    }
+
+    #[tokio::test]
+    async fn runtime_expiry_resets_a_connecting_connection() {
+        let (store, _) = test_store().await;
+        let connection = store
+            .create_connection("source-1", "default", &config("New"), None, 10)
+            .await
+            .unwrap();
+        let session = [1_u8; 32];
+        store
+            .begin_authorization("source-1", "default", 1, &session, 11, 20)
+            .await
+            .unwrap();
+
+        assert_eq!(store.expire_authorizations(20).await.unwrap(), 1);
+        let loaded = store.connection(&connection.connection.id).await.unwrap();
+        assert_eq!(
+            loaded.connection.status,
+            OAuthConnectionStatus::PendingAuthorization
+        );
+        assert_eq!(
+            loaded.connection.error_code.as_deref(),
+            Some("authorization_expired")
+        );
+    }
+
+    #[tokio::test]
+    async fn runtime_expiry_terminalizes_an_abandoned_exchange() {
+        let (store, _) = test_store().await;
+        let connection = store
+            .create_connection("source-1", "default", &config("New"), None, 10)
+            .await
+            .unwrap();
+        let session = [1_u8; 32];
+        let pending = store
+            .begin_authorization("source-1", "default", 1, &session, 11, 20)
+            .await
+            .unwrap();
+        store
+            .claim_authorization_exchange(&connection.connection.id, &pending.state, &session, 12)
+            .await
+            .unwrap();
+
+        assert_eq!(store.expire_authorizations(72).await.unwrap(), 1);
+        let loaded = store.connection(&connection.connection.id).await.unwrap();
+        assert_eq!(
+            loaded.connection.status,
+            OAuthConnectionStatus::PendingAuthorization
+        );
+        assert_eq!(
+            loaded.connection.error_code.as_deref(),
+            Some("exchange_timeout")
+        );
+        store
+            .begin_authorization(
+                "source-1",
+                "default",
+                loaded.connection.revision,
+                &session,
+                73,
+                90,
+            )
+            .await
+            .unwrap();
+    }
+
+    #[tokio::test]
+    async fn exchange_claim_gets_a_fresh_bounded_deadline() {
+        let (store, _) = test_store().await;
+        let connection = store
+            .create_connection("source-1", "default", &config("New"), None, 10)
+            .await
+            .unwrap();
+        let session = [1_u8; 32];
+        let pending = store
+            .begin_authorization("source-1", "default", 1, &session, 11, 20)
+            .await
+            .unwrap();
+        store
+            .claim_authorization_exchange(&connection.connection.id, &pending.state, &session, 19)
+            .await
+            .unwrap();
+
+        assert_eq!(store.expire_authorizations(20).await.unwrap(), 0);
+        let still_connecting = store.connection(&connection.connection.id).await.unwrap();
+        assert_eq!(
+            still_connecting.connection.status,
+            OAuthConnectionStatus::Connecting
+        );
+        assert_eq!(store.expire_authorizations(79).await.unwrap(), 1);
+    }
+
+    #[tokio::test]
+    async fn exchange_completion_rejects_the_exact_deadline() {
+        let (store, pool) = test_store().await;
+        let connection = store
+            .create_connection("source-1", "default", &config("New"), None, 10)
+            .await
+            .unwrap();
+        let session = [1_u8; 32];
+        let pending = store
+            .begin_authorization("source-1", "default", 1, &session, 11, 100)
+            .await
+            .unwrap();
+        let claim = store
+            .claim_authorization_exchange(&connection.connection.id, &pending.state, &session, 12)
+            .await
+            .unwrap();
+
+        assert!(matches!(
+            store
+                .complete_authorization_exchange(&claim, &secrets("a1", "r1"), 72)
+                .await,
+            Err(OAuthStoreError::Conflict)
+        ));
+        let secret_revisions = sqlx::query_scalar::<_, i64>(
+            "SELECT count(*) FROM oauth_connection_secret_revisions WHERE connection_id = ?",
+        )
+        .bind(&connection.connection.id)
+        .fetch_one(&pool)
+        .await
+        .unwrap();
+        assert_eq!(secret_revisions, 0);
+        assert_eq!(store.expire_authorizations(72).await.unwrap(), 1);
+    }
+
+    #[tokio::test]
+    async fn startup_recovery_never_replays_an_interrupted_code_exchange() {
+        let (store, pool) = test_store().await;
+        let connection = store
+            .create_connection("source-1", "default", &config("New"), None, 10)
+            .await
+            .unwrap();
+        let session = [1_u8; 32];
+        let pending = store
+            .begin_authorization("source-1", "default", 1, &session, 11, 100)
+            .await
+            .unwrap();
+        let claim = store
+            .claim_authorization_exchange(&connection.connection.id, &pending.state, &session, 12)
+            .await
+            .unwrap();
+
+        let recovered = store.recover_startup(13).await.unwrap();
+        assert_eq!(recovered.interrupted_exchanges, 1);
+        assert!(matches!(
+            store
+                .complete_authorization_exchange(&claim, &secrets("a1", "r1"), 14)
+                .await,
+            Err(OAuthStoreError::Conflict)
+        ));
+        let state: (String, String) = sqlx::query_as(
+            "SELECT status, error_code FROM oauth_authorization_transactions WHERE id = ?",
+        )
+        .bind(&claim.transaction_id)
+        .fetch_one(&pool)
+        .await
+        .unwrap();
+        assert_eq!(state, ("failed".into(), "exchange_interrupted".into()));
+    }
+
+    #[tokio::test]
+    async fn clean_startup_recovery_is_a_noop() {
+        let (store, _) = test_store().await;
+        let recovered = store.recover_startup(10).await.unwrap();
+        assert_eq!(recovered.interrupted_exchanges, 0);
+        assert_eq!(recovered.abandoned_refresh_leases, 0);
+    }
+
+    #[tokio::test]
+    async fn refresh_is_singleflight_and_rotation_is_compare_and_swap() {
+        let (store, _) = test_store().await;
+        let connection = store
+            .create_connection(
+                "source-1",
+                "default",
+                &config("Active"),
+                Some(&secrets("a1", "r1")),
+                10,
+            )
+            .await
+            .unwrap();
+        let first = store
+            .claim_refresh(&connection.connection.id, 20, 30)
+            .await
+            .unwrap();
+        assert!(matches!(
+            store.claim_refresh(&connection.connection.id, 21, 31).await,
+            Err(OAuthStoreError::RefreshInProgress)
+        ));
+
+        let revision = store
+            .complete_refresh(&first, &secrets("a2", "r2"), 22)
+            .await
+            .unwrap();
+        assert_eq!(revision, 2);
+        assert!(matches!(
+            store
+                .complete_refresh(&first, &secrets("a3", "r3"), 23)
+                .await,
+            Err(OAuthStoreError::Conflict)
+        ));
+        let loaded = store.connection(&connection.connection.id).await.unwrap();
+        assert_eq!(loaded.connection.secret_revision, Some(2));
+        assert_eq!(loaded.secrets.unwrap().refresh_token.as_deref(), Some("r2"));
+    }
+
+    #[tokio::test]
+    async fn stale_refresh_cannot_overwrite_a_new_authorization() {
+        let (store, _) = test_store().await;
+        let connection = store
+            .create_connection(
+                "source-1",
+                "default",
+                &config("Active"),
+                Some(&secrets("old-access", "old-refresh")),
+                10,
+            )
+            .await
+            .unwrap();
+        let refresh = store
+            .claim_refresh(&connection.connection.id, 20, 80)
+            .await
+            .unwrap();
+        let session = [3_u8; 32];
+        let authorization = store
+            .begin_authorization(
+                "source-1",
+                "default",
+                connection.connection.revision,
+                &session,
+                21,
+                100,
+            )
+            .await
+            .unwrap();
+
+        assert!(matches!(
+            store
+                .complete_refresh(&refresh, &secrets("stale-access", "stale-refresh"), 22)
+                .await,
+            Err(OAuthStoreError::Conflict)
+        ));
+        assert!(matches!(
+            store
+                .mark_refresh_reauthorization_required(&refresh, "stale_refresh")
+                .await,
+            Err(OAuthStoreError::Conflict)
+        ));
+        let connecting = store.connection(&connection.connection.id).await.unwrap();
+        assert_eq!(
+            connecting.connection.status,
+            OAuthConnectionStatus::Connecting
+        );
+        assert_eq!(connecting.connection.error_code, None);
+        assert_eq!(
+            sqlx::query_scalar::<_, i64>(
+                "SELECT COUNT(*) FROM oauth_refresh_leases WHERE connection_id = ?",
+            )
+            .bind(&connection.connection.id)
+            .fetch_one(&store.pool)
+            .await
+            .unwrap(),
+            0
+        );
+
+        let claim = store
+            .claim_authorization_exchange(
+                &connection.connection.id,
+                &authorization.state,
+                &session,
+                23,
+            )
+            .await
+            .unwrap();
+        store
+            .complete_authorization_exchange(&claim, &secrets("new-access", "new-refresh"), 24)
+            .await
+            .unwrap();
+        let active = store.connection(&connection.connection.id).await.unwrap();
+        assert_eq!(active.connection.status, OAuthConnectionStatus::Active);
+        assert_eq!(
+            active.secrets.unwrap().access_token.as_deref(),
+            Some("new-access")
+        );
+    }
+
+    #[tokio::test]
+    async fn invalid_grant_requires_reauthorization_without_erasing_secrets() {
+        let (store, _) = test_store().await;
+        let connection = store
+            .create_connection(
+                "source-1",
+                "default",
+                &config("Active"),
+                Some(&secrets("a1", "r1")),
+                10,
+            )
+            .await
+            .unwrap();
+        let claim = store
+            .claim_refresh(&connection.connection.id, 20, 30)
+            .await
+            .unwrap();
+        store.mark_refresh_invalid_grant(&claim, 21).await.unwrap();
+
+        let loaded = store.connection(&connection.connection.id).await.unwrap();
+        assert_eq!(
+            loaded.connection.status,
+            OAuthConnectionStatus::ReauthorizationRequired
+        );
+        assert_eq!(
+            loaded.connection.error_code.as_deref(),
+            Some("invalid_grant")
+        );
+        assert_eq!(loaded.connection.secret_revision, Some(1));
+        assert!(matches!(
+            store.claim_refresh(&connection.connection.id, 22, 32).await,
+            Err(OAuthStoreError::ReauthorizationRequired)
+        ));
+    }
+
+    #[tokio::test]
+    async fn disconnect_preserves_only_the_client_secret() {
+        let (store, _) = test_store().await;
+        let connection = store
+            .create_connection(
+                "source-1",
+                "default",
+                &config("Active"),
+                Some(&secrets("a1", "r1")),
+                10,
+            )
+            .await
+            .unwrap();
+        let disconnected = store
+            .disconnect_connection("source-1", "default", 1, 11)
+            .await
+            .unwrap();
+
+        assert_eq!(disconnected.connection.revision, 2);
+        assert_eq!(
+            disconnected.connection.status,
+            OAuthConnectionStatus::PendingAuthorization
+        );
+        assert_eq!(disconnected.connection.authorized_at, None);
+        let secrets = disconnected.secrets.unwrap();
+        assert_eq!(secrets.client_secret.as_deref(), Some("client-secret"));
+        assert_eq!(secrets.access_token, None);
+        assert_eq!(secrets.refresh_token, None);
+        assert!(matches!(
+            store
+                .disconnect_connection("source-1", "default", 1, 12)
+                .await,
+            Err(OAuthStoreError::Conflict)
+        ));
+        assert_eq!(connection.connection.id, disconnected.connection.id);
+    }
+
+    #[tokio::test]
+    async fn switching_to_a_public_client_clears_every_secret_and_token() {
+        let (store, _) = test_store().await;
+        store
+            .create_connection(
+                "source-1",
+                "default",
+                &config("Active"),
+                Some(&secrets("a1", "r1")),
+                10,
+            )
+            .await
+            .unwrap();
+        let updated = store
+            .upsert_connection(
+                "source-1",
+                "default",
+                1,
+                &config("Public"),
+                OAuthClientSecretUpdate::Replace(None),
+                11,
+            )
+            .await
+            .unwrap();
+        let secrets = updated.secrets.unwrap();
+        assert_eq!(secrets.client_secret, None);
+        assert_eq!(secrets.access_token, None);
+        assert_eq!(secrets.refresh_token, None);
+        assert!(!updated.connection.has_client_secret);
+        assert!(!updated.connection.has_refresh_token);
+    }
+
+    #[tokio::test]
+    async fn metadata_listing_never_decrypts_secret_ciphertext() {
+        let (store, pool) = test_store().await;
+        let connection = store
+            .create_connection(
+                "source-1",
+                "default",
+                &config("Active"),
+                Some(&secrets("a1", "r1")),
+                10,
+            )
+            .await
+            .unwrap();
+        sqlx::query("DROP TRIGGER oauth_secret_revisions_immutable")
+            .execute(&pool)
+            .await
+            .unwrap();
+        sqlx::query(
+            "UPDATE oauth_connection_secret_revisions
+             SET payload_ciphertext = zeroblob(length(payload_ciphertext))
+             WHERE connection_id = ?",
+        )
+        .bind(&connection.connection.id)
+        .execute(&pool)
+        .await
+        .unwrap();
+
+        let listed = store.list_connections("source-1").await.unwrap();
+        assert_eq!(listed.len(), 1);
+        assert!(listed[0].has_refresh_token);
+    }
+
+    #[tokio::test]
+    async fn managed_tokens_are_encrypted_and_only_the_current_revision_is_retained() {
+        let (store, pool) = test_store().await;
+        let connection = store
+            .create_connection(
+                "source-1",
+                "default",
+                &config("Active"),
+                Some(&secrets(
+                    "access-plaintext-marker",
+                    "refresh-plaintext-marker",
+                )),
+                10,
+            )
+            .await
+            .unwrap();
+        let first_ciphertext = sqlx::query_scalar::<_, Vec<u8>>(
+            "SELECT payload_ciphertext FROM oauth_connection_secret_revisions
+             WHERE connection_id = ?",
+        )
+        .bind(&connection.connection.id)
+        .fetch_one(&pool)
+        .await
+        .unwrap();
+        assert!(!contains_bytes(
+            &first_ciphertext,
+            b"access-plaintext-marker"
+        ));
+        assert!(!contains_bytes(
+            &first_ciphertext,
+            b"refresh-plaintext-marker"
+        ));
+        let config_json = sqlx::query_scalar::<_, String>(
+            "SELECT config_json FROM oauth_connection_config_revisions
+             WHERE connection_id = ?",
+        )
+        .bind(&connection.connection.id)
+        .fetch_one(&pool)
+        .await
+        .unwrap();
+        assert!(!config_json.contains("access-plaintext-marker"));
+        assert!(!config_json.contains("refresh-plaintext-marker"));
+
+        let claim = store
+            .claim_refresh(&connection.connection.id, 20, 30)
+            .await
+            .unwrap();
+        store
+            .complete_refresh(
+                &claim,
+                &secrets("rotated-access-marker", "rotated-refresh-marker"),
+                21,
+            )
+            .await
+            .unwrap();
+        let retained = sqlx::query_as::<_, (i64, Vec<u8>)>(
+            "SELECT revision, payload_ciphertext
+             FROM oauth_connection_secret_revisions WHERE connection_id = ?",
+        )
+        .bind(&connection.connection.id)
+        .fetch_all(&pool)
+        .await
+        .unwrap();
+        assert_eq!(retained.len(), 1);
+        assert_eq!(retained[0].0, 2);
+        assert!(!contains_bytes(&retained[0].1, b"rotated-access-marker"));
+        assert!(!contains_bytes(&retained[0].1, b"rotated-refresh-marker"));
+    }
+
+    #[tokio::test]
+    async fn restart_makes_an_in_flight_refresh_require_reauthorization() {
+        let (store, _) = test_store().await;
+        let connection = store
+            .create_connection(
+                "source-1",
+                "default",
+                &config("Active"),
+                Some(&secrets("a1", "r1")),
+                10,
+            )
+            .await
+            .unwrap();
+        let _claim = store
+            .claim_refresh(&connection.connection.id, 20, 200)
+            .await
+            .unwrap();
+        let recovered = store.recover_startup(21).await.unwrap();
+        assert_eq!(recovered.abandoned_refresh_leases, 1);
+        assert!(matches!(
+            store.claim_refresh(&connection.connection.id, 22, 32).await,
+            Err(OAuthStoreError::ReauthorizationRequired)
+        ));
+        let loaded = store.connection(&connection.connection.id).await.unwrap();
+        assert_eq!(
+            loaded.connection.status,
+            OAuthConnectionStatus::ReauthorizationRequired
+        );
+        assert_eq!(
+            loaded.connection.error_code.as_deref(),
+            Some("refresh_interrupted")
+        );
+    }
+
+    #[tokio::test]
+    async fn an_expired_live_refresh_lease_is_never_replayed() {
+        let (store, _) = test_store().await;
+        let connection = store
+            .create_connection(
+                "source-1",
+                "default",
+                &config("Active"),
+                Some(&secrets("a1", "r1")),
+                10,
+            )
+            .await
+            .unwrap();
+        store
+            .claim_refresh(&connection.connection.id, 20, 30)
+            .await
+            .unwrap();
+        assert!(matches!(
+            store.claim_refresh(&connection.connection.id, 30, 40).await,
+            Err(OAuthStoreError::ReauthorizationRequired)
+        ));
+    }
+
+    #[tokio::test]
+    async fn an_ambiguous_refresh_failure_requires_reauthorization() {
+        let (store, _) = test_store().await;
+        let connection = store
+            .create_connection(
+                "source-1",
+                "default",
+                &config("Active"),
+                Some(&secrets("a1", "r1")),
+                10,
+            )
+            .await
+            .unwrap();
+        let now = crate::unix_timestamp();
+        let claim = store
+            .claim_refresh(&connection.connection.id, now, now + 60)
+            .await
+            .unwrap();
+        store
+            .mark_refresh_reauthorization_required(&claim, REFRESH_ERROR_INTERRUPTED)
+            .await
+            .unwrap();
+
+        let loaded = store.connection(&connection.connection.id).await.unwrap();
+        assert_eq!(
+            loaded.connection.status,
+            OAuthConnectionStatus::ReauthorizationRequired
+        );
+        assert_eq!(
+            loaded.connection.error_code.as_deref(),
+            Some("refresh_interrupted")
+        );
+    }
+
+    #[tokio::test]
+    async fn missing_refresh_token_uses_one_terminal_compare_and_swap() {
+        let (store, _) = test_store().await;
+        let connection = store
+            .create_connection(
+                "source-1",
+                "default",
+                &config("Active"),
+                Some(&secrets("a1", "r1")),
+                10,
+            )
+            .await
+            .unwrap();
+        let now = crate::unix_timestamp();
+        let claim = store
+            .claim_refresh(&connection.connection.id, now, now + 60)
+            .await
+            .unwrap();
+        store
+            .mark_refresh_reauthorization_required(&claim, "refresh_token_missing")
+            .await
+            .unwrap();
+        let loaded = store.connection(&connection.connection.id).await.unwrap();
+        assert_eq!(
+            loaded.connection.error_code.as_deref(),
+            Some("refresh_token_missing")
+        );
+    }
+
+    #[tokio::test]
+    async fn token_completion_rejects_a_missing_access_token() {
+        let (store, _) = test_store().await;
+        let connection = store
+            .create_connection("source-1", "default", &config("New"), None, 10)
+            .await
+            .unwrap();
+        let session = [1_u8; 32];
+        let pending = store
+            .begin_authorization("source-1", "default", 1, &session, 11, 100)
+            .await
+            .unwrap();
+        let claim = store
+            .claim_authorization_exchange(&connection.connection.id, &pending.state, &session, 12)
+            .await
+            .unwrap();
+        assert!(matches!(
+            store
+                .complete_authorization_exchange(&claim, &OAuthSecretSet::default(), 13)
+                .await,
+            Err(OAuthStoreError::InvalidStoredRecord)
+        ));
+    }
+
+    fn contains_bytes(haystack: &[u8], needle: &[u8]) -> bool {
+        haystack
+            .windows(needle.len())
+            .any(|window| window == needle)
+    }
+
+    #[tokio::test]
+    async fn catalog_sync_fences_the_oauth_binding_inside_its_write_transaction() {
+        let (store, pool) = test_store().await;
+        let created = store
+            .create_connection(
+                "source-1",
+                "default",
+                &config("New"),
+                Some(&secrets("a1", "r1")),
+                10,
+            )
+            .await
+            .unwrap();
+        let catalog = CatalogStore::new(pool, Keyring::from_master_key([11; 32]).unwrap());
+        let snapshot = |expected_source_revision| CatalogSnapshot {
+            expected_source_revision,
+            expected_credential_revision: None,
+            artifacts: Vec::new(),
+            tools: Vec::new(),
+        };
+        let exact = OAuthBindingExpectation::Exact {
+            credential_key: "default".into(),
+            connection_id: created.connection.id.clone(),
+            config_revision: created.connection.config_revision,
+        };
+        let refresh = store
+            .claim_refresh(&created.connection.id, 11, 20)
+            .await
+            .unwrap();
+        store
+            .complete_refresh(&refresh, &secrets("a2", "r2"), 12)
+            .await
+            .unwrap();
+        let after_refresh = store.connection(&created.connection.id).await.unwrap();
+        assert_eq!(after_refresh.connection.config_revision, 1);
+        let first = catalog
+            .sync_catalog_with_bindings_and_oauth_binding(
+                "source-1",
+                snapshot(0),
+                Vec::new(),
+                exact.clone(),
+                AuditContext::system(None),
+            )
+            .await
+            .unwrap();
+        assert_eq!(first.source_revision, 1);
+
+        let updated = store
+            .upsert_connection(
+                "source-1",
+                "default",
+                after_refresh.connection.revision,
+                &config("Changed"),
+                OAuthClientSecretUpdate::Preserve,
+                13,
+            )
+            .await
+            .unwrap();
+        let error = catalog
+            .sync_catalog_with_bindings_and_oauth_binding(
+                "source-1",
+                snapshot(1),
+                Vec::new(),
+                exact,
+                AuditContext::system(None),
+            )
+            .await
+            .unwrap_err();
+        assert!(matches!(
+            error,
+            CatalogError::Validation {
+                code: "oauth_binding_changed",
+                ..
+            }
+        ));
+        assert_eq!(catalog.source("source-1").await.unwrap().revision, 1);
+
+        store
+            .delete_connection("source-1", "default", updated.connection.revision)
+            .await
+            .unwrap();
+        let absent = catalog
+            .sync_catalog_with_bindings_and_oauth_binding(
+                "source-1",
+                snapshot(1),
+                Vec::new(),
+                OAuthBindingExpectation::Absent {
+                    credential_key: "default".into(),
+                },
+                AuditContext::system(None),
+            )
+            .await
+            .unwrap();
+        assert_eq!(absent.source_revision, 2);
+    }
+
+    #[tokio::test]
+    async fn credential_replace_rolls_back_when_the_oauth_binding_changed() {
+        let (store, pool) = test_store().await;
+        let catalog = CatalogStore::new(pool, Keyring::from_master_key([11; 32]).unwrap());
+        let initial_credential = CredentialPayload {
+            schema_version: 1,
+            payload: serde_json::json!({ "token": "original" }),
+        };
+        catalog
+            .put_credential(
+                "source-1",
+                &initial_credential,
+                None,
+                AuditContext::system(None),
+            )
+            .await
+            .unwrap();
+        let replacement = CredentialPayload {
+            schema_version: 1,
+            payload: serde_json::json!({}),
+        };
+        let snapshot = || CatalogSnapshot {
+            expected_source_revision: 1,
+            expected_credential_revision: Some(0),
+            artifacts: Vec::new(),
+            tools: Vec::new(),
+        };
+        let exact_error = catalog
+            .replace_credential_and_sync_catalog_with_oauth_binding(
+                "source-1",
+                &replacement,
+                snapshot(),
+                Vec::new(),
+                OAuthBindingExpectation::Exact {
+                    credential_key: "default".into(),
+                    connection_id: "missing".into(),
+                    config_revision: 1,
+                },
+                AuditContext::system(None),
+            )
+            .await
+            .unwrap_err();
+        assert!(matches!(
+            exact_error,
+            CatalogError::Validation {
+                code: "oauth_binding_changed",
+                ..
+            }
+        ));
+        let stored = catalog.credential("source-1").await.unwrap().unwrap();
+        assert_eq!(stored.revision, 0);
+        assert_eq!(stored.credential.payload, initial_credential.payload);
+        assert_eq!(catalog.source("source-1").await.unwrap().revision, 1);
+
+        store
+            .create_connection(
+                "source-1",
+                "default",
+                &config("Active"),
+                Some(&secrets("a1", "r1")),
+                10,
+            )
+            .await
+            .unwrap();
+        let absent_error = catalog
+            .replace_credential_and_sync_catalog_with_oauth_binding(
+                "source-1",
+                &replacement,
+                snapshot(),
+                Vec::new(),
+                OAuthBindingExpectation::Absent {
+                    credential_key: "default".into(),
+                },
+                AuditContext::system(None),
+            )
+            .await
+            .unwrap_err();
+        assert!(matches!(
+            absent_error,
+            CatalogError::Validation {
+                code: "oauth_binding_changed",
+                ..
+            }
+        ));
+        let stored = catalog.credential("source-1").await.unwrap().unwrap();
+        assert_eq!(stored.revision, 0);
+        assert_eq!(stored.credential.payload, initial_credential.payload);
+        assert_eq!(catalog.source("source-1").await.unwrap().revision, 1);
+    }
+}
diff --git a/src/oauth/transport.rs b/src/oauth/transport.rs
new file mode 100644
index 000000000..2f53adbe8
--- /dev/null
+++ b/src/oauth/transport.rs
@@ -0,0 +1,800 @@
+use std::time::Duration;
+
+use base64::{Engine as _, engine::general_purpose::STANDARD};
+#[cfg(test)]
+use rand::RngCore;
+use reqwest::{Method, StatusCode, header};
+use serde::Deserialize;
+#[cfg(test)]
+use sha2::{Digest, Sha256};
+use thiserror::Error;
+use url::{Url, form_urlencoded};
+
+use super::discovery::{
+    AuthorizationServerMetadata, OAuthDiscoveryError, ProtectedResourceMetadata,
+    RawAuthorizationServerMetadata, RawProtectedResourceMetadata, TokenEndpointAuthMethod,
+    authorization_server_metadata_url, ensure_scopes_supported, ensure_token_auth_method,
+    protected_resource_metadata_urls, validate_authorization_server_metadata, validate_oauth_url,
+    validate_protected_resource_metadata,
+};
+use crate::outbound::{HardenedHttpClient, OutboundError, OutboundPolicy, OutboundRequest};
+
+const MAX_OAUTH_RESPONSE_BYTES: usize = 256 * 1024;
+const MAX_TOKEN_REQUEST_BYTES: usize = 64 * 1024;
+const MAX_OAUTH_HEADER_BYTES: usize = 32 * 1024;
+const OAUTH_REQUEST_TIMEOUT: Duration = Duration::from_secs(20);
+
+#[derive(Clone)]
+pub struct OAuthHttpTransport {
+    client: HardenedHttpClient,
+    policy: OutboundPolicy,
+}
+
+#[derive(Clone)]
+pub struct AuthorizationRequest {
+    pub client_id: String,
+    pub redirect_uri: String,
+    pub scopes: Vec<String>,
+    pub state: String,
+    pub code_challenge: String,
+    pub resource: Option<String>,
+}
+
+#[derive(Clone)]
+pub struct AuthorizationCodeExchange {
+    pub code: String,
+    pub redirect_uri: String,
+    pub code_verifier: String,
+    pub resource: Option<String>,
+    pub client: OAuthClientAuthentication,
+}
+
+#[derive(Clone)]
+pub struct RefreshTokenExchange {
+    pub refresh_token: String,
+    pub resource: Option<String>,
+    pub client: OAuthClientAuthentication,
+}
+
+#[derive(Clone)]
+pub enum OAuthClientAuthentication {
+    Public {
+        client_id: String,
+    },
+    ClientSecretBasic {
+        client_id: String,
+        client_secret: String,
+    },
+    ClientSecretPost {
+        client_id: String,
+        client_secret: String,
+    },
+}
+
+#[cfg(test)]
+#[derive(Clone)]
+pub struct PkcePair {
+    pub verifier: String,
+    pub challenge: String,
+}
+
+#[derive(Clone, Deserialize)]
+pub struct TokenResponse {
+    pub access_token: String,
+    pub token_type: String,
+    pub expires_in: Option<u64>,
+    pub refresh_token: Option<String>,
+    pub scope: Option<String>,
+}
+
+#[derive(Debug, Error)]
+pub enum OAuthTransportError {
+    #[error(transparent)]
+    Discovery(#[from] OAuthDiscoveryError),
+    #[error("OAuth HTTP request failed")]
+    Transport(#[source] OutboundError),
+    #[error("OAuth endpoint returned HTTP {0}")]
+    HttpStatus(u16),
+    #[error("OAuth endpoint returned an error: {0}")]
+    OAuthError(String),
+    #[error("the OAuth authorization grant is no longer valid")]
+    InvalidGrant,
+    #[error("OAuth response is malformed")]
+    MalformedResponse,
+    #[error("the PKCE value is invalid")]
+    InvalidPkce,
+    #[error("the OAuth redirect URI is invalid")]
+    InvalidRedirectUri,
+}
+
+impl OAuthTransportError {
+    pub fn code(&self) -> &'static str {
+        match self {
+            Self::Discovery(error) => error.code(),
+            Self::Transport(error) => error.code(),
+            Self::HttpStatus(_) => "oauth_http_error",
+            Self::OAuthError(_) => "oauth_token_error",
+            Self::InvalidGrant => "oauth_invalid_grant",
+            Self::MalformedResponse => "malformed_oauth_response",
+            Self::InvalidPkce => "invalid_oauth_pkce",
+            Self::InvalidRedirectUri => "invalid_oauth_redirect_uri",
+        }
+    }
+}
+
+#[derive(Deserialize)]
+struct OAuthErrorResponse {
+    error: String,
+}
+
+impl OAuthHttpTransport {
+    pub fn new(mut policy: OutboundPolicy) -> Self {
+        policy.require_https_or_loopback = true;
+        policy.max_request_bytes = policy.max_request_bytes.min(MAX_TOKEN_REQUEST_BYTES);
+        policy.max_response_bytes = policy.max_response_bytes.min(MAX_OAUTH_RESPONSE_BYTES);
+        policy.max_header_bytes = policy.max_header_bytes.min(MAX_OAUTH_HEADER_BYTES);
+        policy.max_redirects = 0;
+        policy.request_timeout = policy.request_timeout.min(OAUTH_REQUEST_TIMEOUT);
+        Self {
+            client: HardenedHttpClient::new(policy.clone()),
+            policy,
+        }
+    }
+
+    pub fn validate_issuer(&self, issuer: &str) -> Result<(), OAuthDiscoveryError> {
+        authorization_server_metadata_url(issuer, &self.policy).map(|_| ())
+    }
+
+    pub async fn discover_authorization_server(
+        &self,
+        issuer: &str,
+    ) -> Result<AuthorizationServerMetadata, OAuthTransportError> {
+        let metadata_url = authorization_server_metadata_url(issuer, &self.policy)?;
+        let body = self.get_json(metadata_url).await?;
+        let raw = serde_json::from_slice::<RawAuthorizationServerMetadata>(&body)
+            .map_err(|_| OAuthTransportError::MalformedResponse)?;
+        validate_authorization_server_metadata(issuer, raw, &self.policy).map_err(Into::into)
+    }
+
+    pub async fn discover_protected_resource(
+        &self,
+        resource: &str,
+    ) -> Result<Option<ProtectedResourceMetadata>, OAuthTransportError> {
+        for metadata_url in protected_resource_metadata_urls(resource, &self.policy)? {
+            let response = self
+                .execute_json_request(Method::GET, metadata_url, vec![], None)
+                .await?;
+            if matches!(
+                response.status,
+                StatusCode::NOT_FOUND | StatusCode::METHOD_NOT_ALLOWED
+            ) {
+                continue;
+            }
+            if !response.status.is_success() {
+                return Err(OAuthTransportError::HttpStatus(response.status.as_u16()));
+            }
+            let raw = serde_json::from_slice::<RawProtectedResourceMetadata>(&response.body)
+                .map_err(|_| OAuthTransportError::MalformedResponse)?;
+            let metadata = validate_protected_resource_metadata(resource, raw, &self.policy)?;
+            return Ok(Some(metadata));
+        }
+        Ok(None)
+    }
+
+    pub fn authorization_url(
+        &self,
+        metadata: &AuthorizationServerMetadata,
+        request: &AuthorizationRequest,
+    ) -> Result<Url, OAuthTransportError> {
+        ensure_scopes_supported(&request.scopes)?;
+        validate_code_challenge(&request.code_challenge)?;
+        validate_redirect_uri(&request.redirect_uri)?;
+        let mut url = metadata.authorization_endpoint.clone();
+        {
+            let mut query = url.query_pairs_mut();
+            query.append_pair("response_type", "code");
+            query.append_pair("client_id", &request.client_id);
+            query.append_pair("redirect_uri", &request.redirect_uri);
+            query.append_pair("state", &request.state);
+            query.append_pair("code_challenge", &request.code_challenge);
+            query.append_pair("code_challenge_method", "S256");
+            if !request.scopes.is_empty() {
+                query.append_pair("scope", &request.scopes.join(" "));
+            }
+            if let Some(resource) = request.resource.as_deref() {
+                let resource = validate_oauth_url(resource, &self.policy)?;
+                query.append_pair("resource", resource.as_str());
+            }
+        }
+        Ok(url)
+    }
+
+    pub async fn exchange_authorization_code(
+        &self,
+        metadata: &AuthorizationServerMetadata,
+        request: &AuthorizationCodeExchange,
+    ) -> Result<TokenResponse, OAuthTransportError> {
+        validate_code_verifier(&request.code_verifier)?;
+        validate_redirect_uri(&request.redirect_uri)?;
+        let method = request.client.method();
+        ensure_token_auth_method(metadata, method)?;
+
+        let (headers, body) = {
+            let mut form = form_urlencoded::Serializer::new(String::new());
+            form.append_pair("grant_type", "authorization_code");
+            form.append_pair("code", &request.code);
+            form.append_pair("redirect_uri", &request.redirect_uri);
+            form.append_pair("code_verifier", &request.code_verifier);
+            if let Some(resource) = request.resource.as_deref() {
+                let resource = validate_oauth_url(resource, &self.policy)?;
+                form.append_pair("resource", resource.as_str());
+            }
+            let mut headers = token_request_headers();
+            apply_client_authentication(&mut form, &mut headers, &request.client)?;
+            (headers, form.finish().into_bytes())
+        };
+        self.execute_token_request(metadata, headers, body).await
+    }
+
+    pub async fn refresh_access_token(
+        &self,
+        metadata: &AuthorizationServerMetadata,
+        request: &RefreshTokenExchange,
+    ) -> Result<TokenResponse, OAuthTransportError> {
+        let method = request.client.method();
+        ensure_token_auth_method(metadata, method)?;
+
+        let (headers, body) = {
+            let mut form = form_urlencoded::Serializer::new(String::new());
+            form.append_pair("grant_type", "refresh_token");
+            form.append_pair("refresh_token", &request.refresh_token);
+            if let Some(resource) = request.resource.as_deref() {
+                let resource = validate_oauth_url(resource, &self.policy)?;
+                form.append_pair("resource", resource.as_str());
+            }
+            let mut headers = token_request_headers();
+            apply_client_authentication(&mut form, &mut headers, &request.client)?;
+            (headers, form.finish().into_bytes())
+        };
+        self.execute_token_request(metadata, headers, body).await
+    }
+
+    async fn execute_token_request(
+        &self,
+        metadata: &AuthorizationServerMetadata,
+        headers: Vec<(header::HeaderName, header::HeaderValue)>,
+        body: Vec<u8>,
+    ) -> Result<TokenResponse, OAuthTransportError> {
+        let response = self
+            .execute_json_request(
+                Method::POST,
+                metadata.token_endpoint.clone(),
+                headers,
+                Some(body),
+            )
+            .await?;
+        if !response.status.is_success() {
+            if let Ok(error) = serde_json::from_slice::<OAuthErrorResponse>(&response.body) {
+                let error = sanitize_error_code(&error.error);
+                if error == "invalid_grant" {
+                    return Err(OAuthTransportError::InvalidGrant);
+                }
+                return Err(OAuthTransportError::OAuthError(error));
+            }
+            return Err(OAuthTransportError::HttpStatus(response.status.as_u16()));
+        }
+        let token = serde_json::from_slice::<TokenResponse>(&response.body)
+            .map_err(|_| OAuthTransportError::MalformedResponse)?;
+        if token.access_token.is_empty() || !token.token_type.eq_ignore_ascii_case("bearer") {
+            return Err(OAuthTransportError::MalformedResponse);
+        }
+        if token.scope.as_deref().is_some_and(|scope| {
+            scope
+                .split_ascii_whitespace()
+                .any(|candidate| candidate == "openid")
+        }) {
+            return Err(OAuthDiscoveryError::OpenIdUnsupported.into());
+        }
+        Ok(token)
+    }
+
+    async fn get_json(&self, url: Url) -> Result<Vec<u8>, OAuthTransportError> {
+        let response = self
+            .execute_json_request(Method::GET, url, vec![], None)
+            .await?;
+        if !response.status.is_success() {
+            return Err(OAuthTransportError::HttpStatus(response.status.as_u16()));
+        }
+        Ok(response.body)
+    }
+
+    async fn execute_json_request(
+        &self,
+        method: Method,
+        url: Url,
+        headers: Vec<(header::HeaderName, header::HeaderValue)>,
+        body: Option<Vec<u8>>,
+    ) -> Result<crate::outbound::OutboundResponse, OAuthTransportError> {
+        let mut request = OutboundRequest::new(method, url);
+        request.headers.insert(
+            header::ACCEPT,
+            header::HeaderValue::from_static("application/json"),
+        );
+        for (name, value) in headers {
+            request.headers.insert(name, value);
+        }
+        request.body = body.unwrap_or_default();
+        self.client
+            .execute(request)
+            .await
+            .map_err(OAuthTransportError::Transport)
+    }
+}
+
+fn token_request_headers() -> Vec<(header::HeaderName, header::HeaderValue)> {
+    vec![(
+        header::CONTENT_TYPE,
+        header::HeaderValue::from_static("application/x-www-form-urlencoded"),
+    )]
+}
+
+fn apply_client_authentication(
+    form: &mut form_urlencoded::Serializer<'_, String>,
+    headers: &mut Vec<(header::HeaderName, header::HeaderValue)>,
+    client: &OAuthClientAuthentication,
+) -> Result<(), OAuthTransportError> {
+    match client {
+        OAuthClientAuthentication::Public { client_id } => {
+            form.append_pair("client_id", client_id);
+        }
+        OAuthClientAuthentication::ClientSecretBasic {
+            client_id,
+            client_secret,
+        } => {
+            let username = percent_encode_form_component(client_id);
+            let password = percent_encode_form_component(client_secret);
+            let credential = STANDARD.encode(format!("{username}:{password}"));
+            let mut value = header::HeaderValue::from_str(&format!("Basic {credential}"))
+                .map_err(|_| OAuthTransportError::MalformedResponse)?;
+            value.set_sensitive(true);
+            headers.push((header::AUTHORIZATION, value));
+        }
+        OAuthClientAuthentication::ClientSecretPost {
+            client_id,
+            client_secret,
+        } => {
+            form.append_pair("client_id", client_id);
+            form.append_pair("client_secret", client_secret);
+        }
+    }
+    Ok(())
+}
+
+impl OAuthClientAuthentication {
+    fn method(&self) -> TokenEndpointAuthMethod {
+        match self {
+            Self::Public { .. } => TokenEndpointAuthMethod::None,
+            Self::ClientSecretBasic { .. } => TokenEndpointAuthMethod::ClientSecretBasic,
+            Self::ClientSecretPost { .. } => TokenEndpointAuthMethod::ClientSecretPost,
+        }
+    }
+}
+
+#[cfg(test)]
+pub fn generate_pkce() -> PkcePair {
+    let mut random = [0_u8; 32];
+    rand::rngs::OsRng.fill_bytes(&mut random);
+    let verifier = base64::engine::general_purpose::URL_SAFE_NO_PAD.encode(random);
+    let challenge = base64::engine::general_purpose::URL_SAFE_NO_PAD
+        .encode(Sha256::digest(verifier.as_bytes()));
+    PkcePair {
+        verifier,
+        challenge,
+    }
+}
+
+fn validate_code_verifier(value: &str) -> Result<(), OAuthTransportError> {
+    if (43..=128).contains(&value.len()) && value.bytes().all(is_pkce_unreserved) {
+        Ok(())
+    } else {
+        Err(OAuthTransportError::InvalidPkce)
+    }
+}
+
+fn validate_redirect_uri(value: &str) -> Result<(), OAuthTransportError> {
+    let url = Url::parse(value).map_err(|_| OAuthTransportError::InvalidRedirectUri)?;
+    if matches!(url.scheme(), "http" | "https")
+        && url.host().is_some()
+        && url.username().is_empty()
+        && url.password().is_none()
+        && url.query().is_none()
+        && url.fragment().is_none()
+    {
+        Ok(())
+    } else {
+        Err(OAuthTransportError::InvalidRedirectUri)
+    }
+}
+
+fn validate_code_challenge(value: &str) -> Result<(), OAuthTransportError> {
+    if value.len() == 43
+        && value
+            .bytes()
+            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_'))
+    {
+        Ok(())
+    } else {
+        Err(OAuthTransportError::InvalidPkce)
+    }
+}
+
+fn is_pkce_unreserved(byte: u8) -> bool {
+    byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'.' | b'_' | b'~')
+}
+
+fn percent_encode_form_component(value: &str) -> String {
+    form_urlencoded::byte_serialize(value.as_bytes()).collect()
+}
+
+fn sanitize_error_code(value: &str) -> String {
+    value
+        .chars()
+        .filter(|character| character.is_ascii_alphanumeric() || matches!(character, '_' | '-'))
+        .take(128)
+        .collect()
+}
+
+#[cfg(test)]
+mod tests {
+    use std::{collections::VecDeque, sync::Arc};
+
+    use tokio::{
+        io::{AsyncReadExt, AsyncWriteExt},
+        net::TcpListener,
+        sync::Mutex,
+    };
+
+    use super::*;
+
+    struct TestServer {
+        issuer: String,
+        requests: Arc<Mutex<Vec<String>>>,
+        task: tokio::task::JoinHandle<()>,
+    }
+
+    impl TestServer {
+        async fn start(responses: Vec<String>) -> Self {
+            let listener = TcpListener::bind("127.0.0.1:0")
+                .await
+                .expect("test listener binds");
+            let issuer = format!(
+                "http://{}",
+                listener.local_addr().expect("listener address")
+            );
+            let requests = Arc::new(Mutex::new(Vec::new()));
+            let captured = requests.clone();
+            let responses = Arc::new(Mutex::new(VecDeque::from(responses)));
+            let task = tokio::spawn(async move {
+                while let Some(response) = responses.lock().await.pop_front() {
+                    let (mut stream, _) = listener.accept().await.expect("request accepted");
+                    let mut bytes = Vec::new();
+                    let mut chunk = [0_u8; 4096];
+                    loop {
+                        let read = stream.read(&mut chunk).await.expect("request read");
+                        if read == 0 {
+                            break;
+                        }
+                        bytes.extend_from_slice(&chunk[..read]);
+                        assert!(bytes.len() <= 64 * 1024, "test request remains bounded");
+                        if request_is_complete(&bytes) {
+                            break;
+                        }
+                    }
+                    captured
+                        .lock()
+                        .await
+                        .push(String::from_utf8_lossy(&bytes).into_owned());
+                    stream
+                        .write_all(response.as_bytes())
+                        .await
+                        .expect("response written");
+                }
+            });
+            Self {
+                issuer,
+                requests,
+                task,
+            }
+        }
+
+        async fn finish(self) -> Vec<String> {
+            self.task.await.expect("server completes");
+            Arc::try_unwrap(self.requests)
+                .expect("single request owner")
+                .into_inner()
+        }
+    }
+
+    fn response(status: &str, body: &str) -> String {
+        format!(
+            "HTTP/1.1 {status}\r\nContent-Type: application/json\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{body}",
+            body.len()
+        )
+    }
+
+    fn request_is_complete(bytes: &[u8]) -> bool {
+        let Some(headers_end) = bytes.windows(4).position(|window| window == b"\r\n\r\n") else {
+            return false;
+        };
+        let body_start = headers_end + 4;
+        let headers = String::from_utf8_lossy(&bytes[..headers_end]);
+        let content_length = headers.lines().find_map(|line| {
+            let (name, value) = line.split_once(':')?;
+            name.eq_ignore_ascii_case("content-length")
+                .then(|| value.trim().parse::<usize>().ok())
+                .flatten()
+        });
+        bytes.len() >= body_start + content_length.unwrap_or(0)
+    }
+
+    fn transport() -> OAuthHttpTransport {
+        OAuthHttpTransport::new(OutboundPolicy {
+            allow_private_networks: true,
+            ..OutboundPolicy::default()
+        })
+    }
+
+    fn metadata(issuer: &str, methods: &[&str]) -> String {
+        serde_json::json!({
+            "issuer": issuer,
+            "authorization_endpoint": format!("{issuer}/authorize"),
+            "token_endpoint": format!("{issuer}/token"),
+            "response_types_supported": ["code"],
+            "grant_types_supported": ["authorization_code"],
+            "code_challenge_methods_supported": ["S256"],
+            "token_endpoint_auth_methods_supported": methods,
+        })
+        .to_string()
+    }
+
+    #[test]
+    fn generated_pkce_pair_is_valid_s256() {
+        let pair = generate_pkce();
+        validate_code_verifier(&pair.verifier).expect("verifier is valid");
+        validate_code_challenge(&pair.challenge).expect("challenge is valid");
+        let expected = base64::engine::general_purpose::URL_SAFE_NO_PAD
+            .encode(Sha256::digest(pair.verifier.as_bytes()));
+        assert_eq!(pair.challenge, expected);
+    }
+
+    #[tokio::test]
+    async fn discovery_uses_only_rfc_8414_and_requires_exact_issuer() {
+        let server = TestServer::start(vec![response(
+            "200 OK",
+            &metadata("http://127.0.0.1:1", &["none"]),
+        )])
+        .await;
+        let error = transport()
+            .discover_authorization_server(&server.issuer)
+            .await
+            .err()
+            .expect("issuer mismatch rejected");
+        assert!(matches!(
+            error,
+            OAuthTransportError::Discovery(OAuthDiscoveryError::IssuerMismatch)
+        ));
+        let requests = server.finish().await;
+        assert!(requests[0].starts_with("GET /.well-known/oauth-authorization-server "));
+        assert!(!requests[0].contains("openid-configuration"));
+    }
+
+    #[tokio::test]
+    async fn public_code_exchange_posts_pkce_without_a_secret() {
+        let server = TestServer::start(vec![response(
+            "200 OK",
+            r#"{"access_token":"access","token_type":"Bearer","expires_in":60}"#,
+        )])
+        .await;
+        let raw = serde_json::from_str::<RawAuthorizationServerMetadata>(&metadata(
+            &server.issuer,
+            &["none"],
+        ))
+        .expect("metadata JSON");
+        let metadata =
+            validate_authorization_server_metadata(&server.issuer, raw, &transport().policy)
+                .expect("metadata valid");
+        let pair = generate_pkce();
+        let token = transport()
+            .exchange_authorization_code(
+                &metadata,
+                &AuthorizationCodeExchange {
+                    code: "code-value".to_owned(),
+                    redirect_uri: "http://localhost/callback".to_owned(),
+                    code_verifier: pair.verifier,
+                    resource: None,
+                    client: OAuthClientAuthentication::Public {
+                        client_id: "public-client".to_owned(),
+                    },
+                },
+            )
+            .await
+            .expect("exchange succeeds");
+        assert_eq!(token.access_token, "access");
+        let requests = server.finish().await;
+        let token_request = &requests[0];
+        assert!(token_request.starts_with("POST /token "));
+        assert!(token_request.contains("client_id=public-client"));
+        assert!(token_request.contains("code_verifier="));
+        assert!(!token_request.contains("client_secret"));
+        assert!(
+            !token_request
+                .to_ascii_lowercase()
+                .contains("authorization:")
+        );
+    }
+
+    #[tokio::test]
+    async fn confidential_basic_uses_authorization_header_not_form_secret() {
+        let server = TestServer::start(vec![response(
+            "200 OK",
+            r#"{"access_token":"access","token_type":"Bearer"}"#,
+        )])
+        .await;
+        let raw = serde_json::from_str::<RawAuthorizationServerMetadata>(&metadata(
+            &server.issuer,
+            &["client_secret_basic"],
+        ))
+        .expect("metadata JSON");
+        let metadata =
+            validate_authorization_server_metadata(&server.issuer, raw, &transport().policy)
+                .expect("metadata valid");
+        let pair = generate_pkce();
+        transport()
+            .exchange_authorization_code(
+                &metadata,
+                &AuthorizationCodeExchange {
+                    code: "code".to_owned(),
+                    redirect_uri: "http://localhost/callback".to_owned(),
+                    code_verifier: pair.verifier,
+                    resource: None,
+                    client: OAuthClientAuthentication::ClientSecretBasic {
+                        client_id: "client:id".to_owned(),
+                        client_secret: "secret value".to_owned(),
+                    },
+                },
+            )
+            .await
+            .expect("exchange succeeds");
+        let requests = server.finish().await;
+        assert!(
+            requests[0]
+                .to_ascii_lowercase()
+                .contains("authorization: basic ")
+        );
+        let body = requests[0].split("\r\n\r\n").nth(1).unwrap_or_default();
+        assert!(!body.contains("client_secret"));
+        assert!(!body.contains("secret"));
+    }
+
+    #[test]
+    fn authorization_url_rejects_openid() {
+        let raw = serde_json::from_str::<RawAuthorizationServerMetadata>(&metadata(
+            "https://auth.example",
+            &["none"],
+        ))
+        .expect("metadata JSON");
+        let metadata = validate_authorization_server_metadata(
+            "https://auth.example",
+            raw,
+            &OutboundPolicy::default(),
+        )
+        .expect("metadata valid");
+        let pair = generate_pkce();
+        let Err(error) = transport().authorization_url(
+            &metadata,
+            &AuthorizationRequest {
+                client_id: "client".to_owned(),
+                redirect_uri: "http://localhost/callback".to_owned(),
+                scopes: vec!["openid".to_owned()],
+                state: "state".to_owned(),
+                code_challenge: pair.challenge,
+                resource: None,
+            },
+        ) else {
+            panic!("openid is rejected");
+        };
+        assert!(matches!(
+            error,
+            OAuthTransportError::Discovery(OAuthDiscoveryError::OpenIdUnsupported)
+        ));
+    }
+
+    #[test]
+    fn authorization_url_rejects_redirect_uri_ambiguity() {
+        let raw = serde_json::from_str::<RawAuthorizationServerMetadata>(&metadata(
+            "https://auth.example",
+            &["none"],
+        ))
+        .expect("metadata JSON");
+        let metadata = validate_authorization_server_metadata(
+            "https://auth.example",
+            raw,
+            &OutboundPolicy::default(),
+        )
+        .expect("metadata valid");
+        let pair = generate_pkce();
+        let Err(error) = transport().authorization_url(
+            &metadata,
+            &AuthorizationRequest {
+                client_id: "client".to_owned(),
+                redirect_uri: "https://user@example.test/callback?next=evil".to_owned(),
+                scopes: vec![],
+                state: "state".to_owned(),
+                code_challenge: pair.challenge,
+                resource: None,
+            },
+        ) else {
+            panic!("ambiguous redirect URI is rejected");
+        };
+        assert!(matches!(error, OAuthTransportError::InvalidRedirectUri));
+    }
+
+    #[tokio::test]
+    async fn refresh_exchange_surfaces_invalid_grant_without_error_description() {
+        let server = TestServer::start(vec![response(
+            "400 Bad Request",
+            r#"{"error":"invalid_grant","error_description":"refresh secret leaked"}"#,
+        )])
+        .await;
+        let raw = serde_json::from_str::<RawAuthorizationServerMetadata>(&metadata(
+            &server.issuer,
+            &["none"],
+        ))
+        .expect("metadata JSON");
+        let metadata =
+            validate_authorization_server_metadata(&server.issuer, raw, &transport().policy)
+                .expect("metadata valid");
+        let error = transport()
+            .refresh_access_token(
+                &metadata,
+                &RefreshTokenExchange {
+                    refresh_token: "old-refresh".to_owned(),
+                    resource: None,
+                    client: OAuthClientAuthentication::Public {
+                        client_id: "public-client".to_owned(),
+                    },
+                },
+            )
+            .await
+            .err()
+            .expect("invalid grant is surfaced");
+        assert!(matches!(error, OAuthTransportError::InvalidGrant));
+        assert!(!error.to_string().contains("refresh secret leaked"));
+        let requests = server.finish().await;
+        let body = requests[0].split("\r\n\r\n").nth(1).unwrap_or_default();
+        assert!(body.contains("grant_type=refresh_token"));
+        assert!(body.contains("refresh_token=old-refresh"));
+    }
+
+    #[test]
+    fn oauth_response_bound_is_stricter_than_the_general_client() {
+        let policy = OutboundPolicy {
+            max_response_bytes: MAX_OAUTH_RESPONSE_BYTES * 100,
+            ..OutboundPolicy::default()
+        };
+        let transport = OAuthHttpTransport::new(policy);
+        assert_eq!(
+            transport.policy.max_response_bytes,
+            MAX_OAUTH_RESPONSE_BYTES
+        );
+        assert_eq!(transport.policy.max_redirects, 0);
+        assert!(transport.policy.require_https_or_loopback);
+    }
+
+    #[test]
+    fn insecure_resolved_transport_has_a_stable_sanitized_error() {
+        let error = OAuthTransportError::Transport(OutboundError::InsecureTransport);
+        assert_eq!(error.code(), "insecure_outbound_transport");
+        assert_eq!(error.to_string(), "OAuth HTTP request failed");
+    }
+}
diff --git a/src/openapi.rs b/src/openapi.rs
new file mode 100644
index 000000000..16571e837
--- /dev/null
+++ b/src/openapi.rs
@@ -0,0 +1,2671 @@
+use std::{collections::BTreeMap, fmt};
+
+use serde::de::{self, MapAccess, SeqAccess, Visitor};
+use serde::{Deserialize, Serialize};
+use serde_json::{Map, Value, json};
+use sha2::{Digest, Sha256};
+use thiserror::Error;
+use url::Url;
+
+use crate::catalog::ToolMode;
+
+const MAX_REFERENCE_DEPTH: usize = 64;
+const MAX_RESOLVED_NODES: usize = 250_000;
+const MAX_RESOLVED_BYTES: usize = 16 * 1024 * 1024;
+const MAX_COMPILED_OPERATIONS: usize = 100_000;
+const MAX_PARAMETERS_PER_OPERATION: usize = 1_024;
+const MAX_SECURITY_ALTERNATIVES: usize = 256;
+const MAX_SECURITY_REQUIREMENTS_PER_ALTERNATIVE: usize = 64;
+const HTTP_METHODS: [&str; 8] = [
+    "get", "put", "post", "delete", "options", "head", "patch", "trace",
+];
+
+#[derive(Clone, Copy)]
+enum OpenApiSchemaDialect {
+    OpenApi30,
+    JsonSchema202012,
+}
+
+const OAS31_BASE_DIALECT: &str = "https://spec.openapis.org/oas/3.1/dialect/base";
+const JSON_SCHEMA_2020_12_DIALECT: &str = "https://json-schema.org/draft/2020-12/schema";
+
+#[derive(Clone, Debug)]
+pub struct CompiledOpenApi {
+    pub document: Value,
+    pub title: String,
+    pub description: Option<String>,
+    pub tools: Vec<CompiledOpenApiTool>,
+}
+
+#[derive(Clone, Debug)]
+pub struct CompiledOpenApiTool {
+    pub stable_key: String,
+    pub preferred_name: String,
+    pub display_name: String,
+    pub description: Option<String>,
+    pub input_schema: Value,
+    pub output_schema: Option<Value>,
+    pub intrinsic_mode: ToolMode,
+    pub binding: OpenApiBinding,
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct OpenApiBinding {
+    pub version: u32,
+    pub method: String,
+    pub path_template: String,
+    pub server_url: String,
+    pub parameters: Vec<OpenApiParameterBinding>,
+    pub request_body: Option<OpenApiRequestBodyBinding>,
+    pub security: Vec<OpenApiSecurityAlternative>,
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct OpenApiParameterBinding {
+    pub name: String,
+    pub location: OpenApiParameterLocation,
+    pub required: bool,
+    pub style: String,
+    pub explode: bool,
+    pub allow_reserved: bool,
+}
+
+#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum OpenApiParameterLocation {
+    Path,
+    Query,
+    Header,
+    Cookie,
+}
+
+impl OpenApiParameterLocation {
+    fn input_key(self) -> &'static str {
+        match self {
+            Self::Path => "path",
+            Self::Query => "query",
+            Self::Header => "headers",
+            Self::Cookie => "cookies",
+        }
+    }
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct OpenApiRequestBodyBinding {
+    pub required: bool,
+    pub default_media_type: String,
+    pub media_types: Vec<String>,
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct OpenApiSecurityAlternative {
+    pub requirements: Vec<OpenApiSecurityRequirement>,
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct OpenApiSecurityRequirement {
+    pub scheme_name: String,
+    pub scopes: Vec<String>,
+    pub scheme: OpenApiSecurityScheme,
+    pub oauth_flows: Option<OpenApiOAuthFlows>,
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(
+    tag = "type",
+    rename_all = "snake_case",
+    rename_all_fields = "camelCase",
+    deny_unknown_fields
+)]
+pub enum OpenApiSecurityScheme {
+    ApiKey {
+        name: String,
+        location: OpenApiParameterLocation,
+    },
+    Http {
+        scheme: String,
+        bearer_format: Option<String>,
+    },
+    OAuth2,
+    OpenIdConnect {
+        url: String,
+    },
+    MutualTls,
+}
+
+#[derive(Clone, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct OpenApiOAuthFlows {
+    pub implicit: Option<OpenApiOAuthFlow>,
+    pub password: Option<OpenApiOAuthFlow>,
+    pub client_credentials: Option<OpenApiOAuthFlow>,
+    pub authorization_code: Option<OpenApiOAuthFlow>,
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct OpenApiOAuthFlow {
+    pub authorization_url: Option<String>,
+    pub token_url: Option<String>,
+    pub refresh_url: Option<String>,
+    pub scopes: BTreeMap<String, String>,
+}
+
+#[derive(Debug, Error)]
+pub enum OpenApiError {
+    #[error("the OpenAPI document is not valid JSON or YAML")]
+    Parse,
+    #[error("only OpenAPI 3.0 and 3.1 documents are supported")]
+    UnsupportedVersion,
+    #[error("the OpenAPI document is invalid: {0}")]
+    InvalidDocument(&'static str),
+    #[error("external references are not supported: {0}")]
+    ExternalReference(String),
+    #[error("a local reference does not exist: {0}")]
+    ReferenceNotFound(String),
+    #[error("a local reference cycle was found: {0}")]
+    ReferenceCycle(String),
+    #[error("local reference resolution exceeded the depth limit")]
+    ReferenceDepth,
+    #[error("the OpenAPI document exceeds compiler limit {code}")]
+    LimitExceeded { code: &'static str },
+    #[error("operation {method} {path} is invalid: {message}")]
+    InvalidOperation {
+        method: String,
+        path: String,
+        message: &'static str,
+    },
+}
+
+#[derive(Clone, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct OpenApiCredentialSet {
+    pub schemes: BTreeMap<String, OpenApiCredential>,
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(
+    tag = "type",
+    rename_all = "snake_case",
+    rename_all_fields = "camelCase",
+    deny_unknown_fields
+)]
+pub enum OpenApiCredential {
+    ApiKey {
+        value: String,
+    },
+    Bearer {
+        token: String,
+    },
+    Basic {
+        username: String,
+        password: String,
+    },
+    #[serde(rename = "oauth_access_token")]
+    OAuthAccessToken {
+        #[serde(rename = "access_token")]
+        access_token: String,
+    },
+}
+
+pub type StaticCredentialSet = OpenApiCredentialSet;
+pub type StaticCredentialScheme = OpenApiCredential;
+
+impl OpenApiCredentialSet {
+    pub fn validate(&self) -> Result<(), OpenApiCredentialError> {
+        if self.schemes.len() > 64 {
+            return Err(OpenApiCredentialError::TooManySchemes);
+        }
+        for (name, credential) in &self.schemes {
+            if name.is_empty() || name.len() > 256 || name.chars().any(char::is_control) {
+                return Err(OpenApiCredentialError::InvalidSchemeName);
+            }
+            credential.validate()?;
+        }
+        Ok(())
+    }
+}
+
+impl OpenApiCredential {
+    pub const fn credential_type(&self) -> &'static str {
+        match self {
+            Self::ApiKey { .. } => "api_key",
+            Self::Bearer { .. } => "bearer",
+            Self::Basic { .. } => "basic",
+            Self::OAuthAccessToken { .. } => "manual_oauth_access_token",
+        }
+    }
+
+    fn validate(&self) -> Result<(), OpenApiCredentialError> {
+        if let Self::Basic { username, .. } = self
+            && username.contains(':')
+        {
+            return Err(OpenApiCredentialError::InvalidBasicUsername);
+        }
+        if let Self::Basic { username, password } = self
+            && (username.chars().any(char::is_control) || password.chars().any(char::is_control))
+        {
+            return Err(OpenApiCredentialError::InvalidBasicValue);
+        }
+        let valid = match self {
+            Self::ApiKey { value } => !value.is_empty() && value.len() <= 16_384,
+            Self::Bearer { token } => !token.is_empty() && token.len() <= 16_384,
+            Self::Basic { username, password } => {
+                username.len() <= 4_096 && password.len() <= 16_384
+            }
+            Self::OAuthAccessToken { access_token } => {
+                !access_token.is_empty() && access_token.len() <= 16_384
+            }
+        };
+        if valid {
+            Ok(())
+        } else {
+            Err(OpenApiCredentialError::InvalidValue)
+        }
+    }
+}
+
+#[derive(Debug, Error, Eq, PartialEq)]
+pub enum OpenApiCredentialError {
+    #[error("at most 64 OpenAPI security schemes may be configured")]
+    TooManySchemes,
+    #[error("an OpenAPI security scheme name is invalid")]
+    InvalidSchemeName,
+    #[error("an OpenAPI credential value is invalid")]
+    InvalidValue,
+    #[error("an HTTP Basic username must not contain a colon")]
+    InvalidBasicUsername,
+    #[error("an HTTP Basic username or password must not contain control characters")]
+    InvalidBasicValue,
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub struct OpenApiProtocolRequest {
+    pub method: String,
+    pub url: Url,
+    pub headers: BTreeMap<String, String>,
+    pub body: Vec<u8>,
+    pub selected_security_schemes: Vec<String>,
+}
+
+type CookieParameters = BTreeMap<String, Vec<(String, String)>>;
+
+#[derive(Debug, Error)]
+pub enum OpenApiInvocationError {
+    #[error("tool arguments must be an object")]
+    InvalidArguments,
+    #[error("a required tool argument is missing: {0}")]
+    MissingArgument(String),
+    #[error("the tool arguments contain an invalid value: {0}")]
+    InvalidArgument(String),
+    #[error("no configured credential satisfies the operation security requirements")]
+    UnsatisfiedSecurity,
+    #[error("the configured credential does not match security scheme {0}")]
+    InvalidCredential(String),
+    #[error("the configured OpenAPI credentials are invalid")]
+    InvalidCredentialConfiguration,
+    #[error("an unsafe HTTP header was rejected: {0}")]
+    InvalidHeader(String),
+    #[error("the compiled operation URL is invalid")]
+    InvalidUrl,
+}
+
+pub fn build_protocol_request(
+    binding: &OpenApiBinding,
+    arguments: &Value,
+    credentials: &OpenApiCredentialSet,
+) -> Result<OpenApiProtocolRequest, OpenApiInvocationError> {
+    build_protocol_request_with_base(binding, arguments, credentials, None)
+}
+
+pub fn build_protocol_request_with_base(
+    binding: &OpenApiBinding,
+    arguments: &Value,
+    credentials: &OpenApiCredentialSet,
+    document_base_url: Option<&Url>,
+) -> Result<OpenApiProtocolRequest, OpenApiInvocationError> {
+    credentials
+        .validate()
+        .map_err(|_| OpenApiInvocationError::InvalidCredentialConfiguration)?;
+    let method = validate_method(&binding.method)?;
+    let arguments = arguments
+        .as_object()
+        .ok_or(OpenApiInvocationError::InvalidArguments)?;
+    validate_argument_members(binding, arguments)?;
+    let mut path = binding.path_template.clone();
+    let mut query = Vec::new();
+    let mut headers = BTreeMap::new();
+    let mut cookies = BTreeMap::new();
+
+    for parameter in &binding.parameters {
+        validate_parameter_serialization(parameter)?;
+        let carrier = arguments
+            .get(parameter.location.input_key())
+            .and_then(Value::as_object);
+        let value = carrier.and_then(|carrier| carrier.get(&parameter.name));
+        let Some(value) = value else {
+            if parameter.required {
+                return Err(OpenApiInvocationError::MissingArgument(format!(
+                    "{}.{}",
+                    parameter.location.input_key(),
+                    parameter.name
+                )));
+            }
+            continue;
+        };
+        match parameter.location {
+            OpenApiParameterLocation::Path => {
+                let serialized = serialize_parameter(value, parameter, false)?;
+                let encoded = encode_path_value(&serialized);
+                let marker = format!("{{{}}}", parameter.name);
+                if !path.contains(&marker) {
+                    return Err(OpenApiInvocationError::InvalidArgument(format!(
+                        "path.{}",
+                        parameter.name
+                    )));
+                }
+                path = path.replace(&marker, &encoded);
+            }
+            OpenApiParameterLocation::Query => {
+                append_query_parameter(&mut query, value, parameter)?;
+            }
+            OpenApiParameterLocation::Header => {
+                validate_user_header_name(&parameter.name)?;
+                let serialized = serialize_parameter(value, parameter, false)?;
+                validate_header_value(&parameter.name, &serialized)?;
+                headers.insert(parameter.name.to_ascii_lowercase(), serialized);
+            }
+            OpenApiParameterLocation::Cookie => {
+                validate_cookie_name(&parameter.name)?;
+                append_cookie_parameter(&mut cookies, value, parameter)?;
+            }
+        }
+    }
+    if path.contains('{') || path.contains('}') {
+        return Err(OpenApiInvocationError::InvalidArgument("path".to_owned()));
+    }
+
+    let mut first_security_error = None;
+    let mut selected = None;
+    for alternative in &binding.security {
+        if security_alternative_has_carrier_conflict(alternative)
+            || !alternative.requirements.iter().all(|requirement| {
+                credentials
+                    .schemes
+                    .get(&requirement.scheme_name)
+                    .is_some_and(|credential| credential_matches(&requirement.scheme, credential))
+            })
+        {
+            continue;
+        }
+        let mut candidate_query = query.clone();
+        let mut candidate_headers = headers.clone();
+        let mut candidate_cookies = cookies.clone();
+        let applied = alternative.requirements.iter().try_for_each(|requirement| {
+            let credential = credentials
+                .schemes
+                .get(&requirement.scheme_name)
+                .ok_or(OpenApiInvocationError::UnsatisfiedSecurity)?;
+            apply_credential(
+                requirement,
+                credential,
+                &mut candidate_query,
+                &mut candidate_headers,
+                &mut candidate_cookies,
+            )
+        });
+        match applied {
+            Ok(()) => {
+                selected = Some((
+                    candidate_query,
+                    candidate_headers,
+                    candidate_cookies,
+                    alternative
+                        .requirements
+                        .iter()
+                        .map(|requirement| requirement.scheme_name.clone())
+                        .collect::<Vec<_>>(),
+                ));
+                break;
+            }
+            Err(error) => {
+                first_security_error.get_or_insert(error);
+            }
+        };
+    }
+    let (selected_query, selected_headers, selected_cookies, selected_security_schemes) = selected
+        .ok_or_else(|| {
+            first_security_error.unwrap_or(OpenApiInvocationError::UnsatisfiedSecurity)
+        })?;
+    query = selected_query;
+    headers = selected_headers;
+    cookies = selected_cookies;
+
+    if !cookies.is_empty() {
+        let cookie = cookies
+            .into_values()
+            .filter_map(|pairs| {
+                (!pairs.is_empty()).then(|| {
+                    pairs
+                        .into_iter()
+                        .map(|(name, value)| format!("{name}={}", encode_cookie_value(&value)))
+                        .collect::<Vec<_>>()
+                        .join("&")
+                })
+            })
+            .collect::<Vec<_>>()
+            .join("; ");
+        headers.insert("cookie".to_owned(), cookie);
+    }
+    let mut url = operation_url(&binding.server_url, &path, document_base_url)?;
+    if !query.is_empty() {
+        let mut pairs = url.query_pairs_mut();
+        for (name, value) in query {
+            pairs.append_pair(&name, &value);
+        }
+    }
+
+    let body = if let Some(body_binding) = &binding.request_body {
+        let body = arguments.get("body").cloned();
+        if body_binding.required && body.is_none() {
+            return Err(OpenApiInvocationError::MissingArgument("body".to_owned()));
+        }
+        let requested = match arguments.get("contentType") {
+            Some(Value::String(requested)) => requested.as_str(),
+            Some(_) => {
+                return Err(OpenApiInvocationError::InvalidArgument(
+                    "contentType".to_owned(),
+                ));
+            }
+            None => &body_binding.default_media_type,
+        };
+        if !body_binding
+            .media_types
+            .iter()
+            .any(|media| media == requested)
+        {
+            return Err(OpenApiInvocationError::InvalidArgument(
+                "contentType".to_owned(),
+            ));
+        }
+        if let Some(body) = &body {
+            validate_request_body_value(requested, body)?;
+        }
+        if body.is_some() {
+            headers.insert("content-type".to_owned(), requested.to_owned());
+        } else if arguments.contains_key("contentType") {
+            return Err(OpenApiInvocationError::InvalidArgument(
+                "contentType".to_owned(),
+            ));
+        }
+        body.map_or_else(
+            || Ok(Vec::new()),
+            |body| encode_request_body(requested, &body),
+        )?
+    } else {
+        if arguments.contains_key("body") || arguments.contains_key("contentType") {
+            return Err(OpenApiInvocationError::InvalidArgument("body".to_owned()));
+        }
+        Vec::new()
+    };
+    Ok(OpenApiProtocolRequest {
+        method,
+        url,
+        headers,
+        body,
+        selected_security_schemes,
+    })
+}
+
+fn validate_parameter_serialization(
+    parameter: &OpenApiParameterBinding,
+) -> Result<(), OpenApiInvocationError> {
+    let supported = !parameter.allow_reserved
+        && match parameter.location {
+            OpenApiParameterLocation::Query => matches!(
+                parameter.style.as_str(),
+                "form" | "spaceDelimited" | "pipeDelimited" | "deepObject"
+            ),
+            OpenApiParameterLocation::Path | OpenApiParameterLocation::Header => {
+                parameter.style == "simple"
+            }
+            OpenApiParameterLocation::Cookie => parameter.style == "form",
+        };
+    if supported {
+        Ok(())
+    } else {
+        Err(OpenApiInvocationError::InvalidArgument(format!(
+            "{}.{}",
+            parameter.location.input_key(),
+            parameter.name
+        )))
+    }
+}
+
+fn validate_method(method: &str) -> Result<String, OpenApiInvocationError> {
+    let method = method.to_ascii_uppercase();
+    if matches!(
+        method.as_str(),
+        "GET" | "PUT" | "POST" | "DELETE" | "OPTIONS" | "HEAD" | "PATCH"
+    ) {
+        Ok(method)
+    } else {
+        Err(OpenApiInvocationError::InvalidArgument("method".to_owned()))
+    }
+}
+
+fn encode_request_body(media_type: &str, body: &Value) -> Result<Vec<u8>, OpenApiInvocationError> {
+    let base = media_type
+        .split_once(';')
+        .map_or(media_type, |(base, _)| base)
+        .trim();
+    match base {
+        "application/json" => serde_json::to_vec(body)
+            .map_err(|_| OpenApiInvocationError::InvalidArgument("body".to_owned())),
+        value if value.ends_with("+json") => serde_json::to_vec(body)
+            .map_err(|_| OpenApiInvocationError::InvalidArgument("body".to_owned())),
+        "text/plain" => Ok(body
+            .as_str()
+            .ok_or_else(|| OpenApiInvocationError::InvalidArgument("body".to_owned()))?
+            .as_bytes()
+            .to_vec()),
+        "application/x-www-form-urlencoded" => {
+            let object = body
+                .as_object()
+                .ok_or_else(|| OpenApiInvocationError::InvalidArgument("body".to_owned()))?;
+            let mut serializer = url::form_urlencoded::Serializer::new(String::new());
+            for (name, value) in object {
+                serializer.append_pair(name, &scalar(value, "body")?);
+            }
+            Ok(serializer.finish().into_bytes())
+        }
+        _ => Err(OpenApiInvocationError::InvalidArgument("body".to_owned())),
+    }
+}
+
+fn validate_request_body_value(
+    media_type: &str,
+    body: &Value,
+) -> Result<(), OpenApiInvocationError> {
+    let base = media_type
+        .split_once(';')
+        .map_or(media_type, |(base, _)| base)
+        .trim();
+    if base == "text/plain" && !body.is_string() {
+        return Err(OpenApiInvocationError::InvalidArgument("body".to_owned()));
+    }
+    if base == "application/x-www-form-urlencoded" {
+        let object = body
+            .as_object()
+            .ok_or_else(|| OpenApiInvocationError::InvalidArgument("body".to_owned()))?;
+        if object
+            .values()
+            .any(|value| !matches!(value, Value::String(_) | Value::Number(_) | Value::Bool(_)))
+        {
+            return Err(OpenApiInvocationError::InvalidArgument("body".to_owned()));
+        }
+    }
+    Ok(())
+}
+
+fn operation_url(
+    server_url: &str,
+    path: &str,
+    document_base_url: Option<&Url>,
+) -> Result<Url, OpenApiInvocationError> {
+    let server = Url::parse(server_url)
+        .or_else(|_| {
+            document_base_url
+                .ok_or(url::ParseError::RelativeUrlWithoutBase)?
+                .join(server_url)
+        })
+        .map_err(|_| OpenApiInvocationError::InvalidUrl)?;
+    if !matches!(server.scheme(), "http" | "https")
+        || server.host().is_none()
+        || !server.username().is_empty()
+        || server.password().is_some()
+        || server.query().is_some()
+        || server.fragment().is_some()
+    {
+        return Err(OpenApiInvocationError::InvalidUrl);
+    }
+    let base_path = server.path().trim_end_matches('/');
+    let combined = format!("{base_path}/{}", path.trim_start_matches('/'));
+    let mut url = server;
+    url.set_path(&combined);
+    Ok(url)
+}
+
+fn validate_argument_members(
+    binding: &OpenApiBinding,
+    arguments: &Map<String, Value>,
+) -> Result<(), OpenApiInvocationError> {
+    let mut allowed_root = std::collections::BTreeSet::new();
+    let mut carrier_members = BTreeMap::<&str, std::collections::BTreeSet<&str>>::new();
+    for parameter in &binding.parameters {
+        let carrier = parameter.location.input_key();
+        allowed_root.insert(carrier);
+        carrier_members
+            .entry(carrier)
+            .or_default()
+            .insert(&parameter.name);
+    }
+    if binding.request_body.is_some() {
+        allowed_root.insert("body");
+        allowed_root.insert("contentType");
+    }
+    for (key, value) in arguments {
+        if !allowed_root.contains(key.as_str()) {
+            return Err(OpenApiInvocationError::InvalidArgument(key.clone()));
+        }
+        let Some(allowed_members) = carrier_members.get(key.as_str()) else {
+            continue;
+        };
+        let members = value
+            .as_object()
+            .ok_or_else(|| OpenApiInvocationError::InvalidArgument(key.clone()))?;
+        if let Some(unknown) = members
+            .keys()
+            .find(|member| !allowed_members.contains(member.as_str()))
+        {
+            return Err(OpenApiInvocationError::InvalidArgument(format!(
+                "{key}.{unknown}"
+            )));
+        }
+    }
+    Ok(())
+}
+
+fn credential_matches(scheme: &OpenApiSecurityScheme, credential: &OpenApiCredential) -> bool {
+    match (scheme, credential) {
+        (OpenApiSecurityScheme::ApiKey { .. }, OpenApiCredential::ApiKey { .. }) => true,
+        (OpenApiSecurityScheme::Http { scheme, .. }, OpenApiCredential::Basic { .. }) => {
+            scheme == "basic"
+        }
+        (
+            OpenApiSecurityScheme::Http { scheme, .. },
+            OpenApiCredential::Bearer { .. } | OpenApiCredential::OAuthAccessToken { .. },
+        ) => scheme == "bearer",
+        (
+            OpenApiSecurityScheme::OAuth2 | OpenApiSecurityScheme::OpenIdConnect { .. },
+            OpenApiCredential::OAuthAccessToken { .. },
+        ) => true,
+        _ => false,
+    }
+}
+
+fn apply_credential(
+    requirement: &OpenApiSecurityRequirement,
+    credential: &OpenApiCredential,
+    query: &mut Vec<(String, String)>,
+    headers: &mut BTreeMap<String, String>,
+    cookies: &mut CookieParameters,
+) -> Result<(), OpenApiInvocationError> {
+    match (&requirement.scheme, credential) {
+        (OpenApiSecurityScheme::ApiKey { name, location }, OpenApiCredential::ApiKey { value }) => {
+            reject_control_characters(name, value)?;
+            match location {
+                OpenApiParameterLocation::Query => {
+                    query.retain(|(existing, _)| existing != name);
+                    query.push((name.clone(), value.clone()));
+                }
+                OpenApiParameterLocation::Header => {
+                    validate_auth_header_name(name)?;
+                    validate_header_value(name, value)?;
+                    headers.insert(name.to_ascii_lowercase(), value.clone());
+                }
+                OpenApiParameterLocation::Cookie => {
+                    validate_cookie_name(name)?;
+                    for pairs in cookies.values_mut() {
+                        pairs.retain(|(existing, _)| existing != name);
+                    }
+                    cookies.retain(|_, pairs| !pairs.is_empty());
+                    cookies.insert(name.clone(), vec![(name.clone(), value.clone())]);
+                }
+                OpenApiParameterLocation::Path => {
+                    return Err(OpenApiInvocationError::InvalidCredential(
+                        requirement.scheme_name.clone(),
+                    ));
+                }
+            }
+        }
+        (
+            OpenApiSecurityScheme::Http { scheme, .. },
+            OpenApiCredential::Basic { username, password },
+        ) if scheme == "basic" => {
+            reject_control_characters("username", username)?;
+            reject_control_characters("password", password)?;
+            use base64::Engine as _;
+            let encoded =
+                base64::engine::general_purpose::STANDARD.encode(format!("{username}:{password}"));
+            let value = format!("Basic {encoded}");
+            validate_header_value("authorization", &value)?;
+            headers.insert("authorization".to_owned(), value);
+        }
+        (OpenApiSecurityScheme::Http { scheme, .. }, OpenApiCredential::Bearer { token })
+            if scheme == "bearer" =>
+        {
+            reject_control_characters("token", token)?;
+            let value = format!("Bearer {token}");
+            validate_header_value("authorization", &value)?;
+            headers.insert("authorization".to_owned(), value);
+        }
+        (
+            OpenApiSecurityScheme::Http { scheme, .. },
+            OpenApiCredential::OAuthAccessToken { access_token },
+        ) if scheme == "bearer" => {
+            reject_control_characters("access token", access_token)?;
+            let value = format!("Bearer {access_token}");
+            validate_header_value("authorization", &value)?;
+            headers.insert("authorization".to_owned(), value);
+        }
+        (
+            OpenApiSecurityScheme::OAuth2 | OpenApiSecurityScheme::OpenIdConnect { .. },
+            OpenApiCredential::OAuthAccessToken { access_token },
+        ) => {
+            reject_control_characters("access token", access_token)?;
+            let value = format!("Bearer {access_token}");
+            validate_header_value("authorization", &value)?;
+            headers.insert("authorization".to_owned(), value);
+        }
+        _ => {
+            return Err(OpenApiInvocationError::InvalidCredential(
+                requirement.scheme_name.clone(),
+            ));
+        }
+    }
+    Ok(())
+}
+
+fn append_query_parameter(
+    output: &mut Vec<(String, String)>,
+    value: &Value,
+    parameter: &OpenApiParameterBinding,
+) -> Result<(), OpenApiInvocationError> {
+    if parameter.style == "deepObject" {
+        let object = value.as_object().ok_or_else(|| {
+            OpenApiInvocationError::InvalidArgument(format!("query.{}", parameter.name))
+        })?;
+        for (key, value) in object {
+            output.push((
+                format!("{}[{key}]", parameter.name),
+                scalar(value, &format!("query.{}", parameter.name))?,
+            ));
+        }
+        return Ok(());
+    }
+    if parameter.explode
+        && let Some(values) = value.as_array()
+    {
+        for value in values {
+            output.push((
+                parameter.name.clone(),
+                scalar(value, &format!("query.{}", parameter.name))?,
+            ));
+        }
+        return Ok(());
+    }
+    if parameter.explode
+        && let Some(object) = value.as_object()
+    {
+        for (key, value) in object {
+            output.push((
+                key.clone(),
+                scalar(value, &format!("query.{}", parameter.name))?,
+            ));
+        }
+        return Ok(());
+    }
+    output.push((
+        parameter.name.clone(),
+        serialize_parameter(value, parameter, true)?,
+    ));
+    Ok(())
+}
+
+fn append_cookie_parameter(
+    output: &mut CookieParameters,
+    value: &Value,
+    parameter: &OpenApiParameterBinding,
+) -> Result<(), OpenApiInvocationError> {
+    let label = format!("cookies.{}", parameter.name);
+    let pairs = if let Some(values) = value.as_array() {
+        if parameter.explode {
+            values
+                .iter()
+                .map(|value| Ok((parameter.name.clone(), scalar(value, &label)?)))
+                .collect::<Result<Vec<_>, OpenApiInvocationError>>()?
+        } else {
+            vec![(
+                parameter.name.clone(),
+                values
+                    .iter()
+                    .map(|value| scalar(value, &label))
+                    .collect::<Result<Vec<_>, _>>()?
+                    .join(","),
+            )]
+        }
+    } else if let Some(object) = value.as_object() {
+        if parameter.explode {
+            object
+                .iter()
+                .map(|(name, value)| {
+                    validate_cookie_name(name)?;
+                    Ok((name.clone(), scalar(value, &label)?))
+                })
+                .collect::<Result<Vec<_>, OpenApiInvocationError>>()?
+        } else {
+            let mut flattened = Vec::with_capacity(object.len() * 2);
+            for (name, value) in object {
+                flattened.push(name.clone());
+                flattened.push(scalar(value, &label)?);
+            }
+            vec![(parameter.name.clone(), flattened.join(","))]
+        }
+    } else {
+        vec![(parameter.name.clone(), scalar(value, &label)?)]
+    };
+    for (name, value) in &pairs {
+        validate_cookie_name(name)?;
+        reject_control_characters(name, value)?;
+    }
+    output.insert(parameter.name.clone(), pairs);
+    Ok(())
+}
+
+fn serialize_parameter(
+    value: &Value,
+    parameter: &OpenApiParameterBinding,
+    query: bool,
+) -> Result<String, OpenApiInvocationError> {
+    let label = format!("{}.{}", parameter.location.input_key(), parameter.name);
+    if let Some(values) = value.as_array() {
+        let delimiter = match parameter.style.as_str() {
+            "spaceDelimited" if query => " ",
+            "pipeDelimited" if query => "|",
+            _ => ",",
+        };
+        return values
+            .iter()
+            .map(|value| scalar(value, &label))
+            .collect::<Result<Vec<_>, _>>()
+            .map(|values| values.join(delimiter));
+    }
+    if let Some(object) = value.as_object() {
+        let mut values = Vec::with_capacity(object.len() * 2);
+        for (key, value) in object {
+            let value = scalar(value, &label)?;
+            if parameter.explode {
+                values.push(format!("{key}={value}"));
+            } else {
+                values.push(key.clone());
+                values.push(value);
+            }
+        }
+        return Ok(values.join(","));
+    }
+    scalar(value, &label)
+}
+
+fn scalar(value: &Value, label: &str) -> Result<String, OpenApiInvocationError> {
+    match value {
+        Value::String(value) => Ok(value.clone()),
+        Value::Number(value) => Ok(value.to_string()),
+        Value::Bool(value) => Ok(value.to_string()),
+        Value::Null => Ok(String::new()),
+        _ => Err(OpenApiInvocationError::InvalidArgument(label.to_owned())),
+    }
+}
+
+fn validate_user_header_name(name: &str) -> Result<(), OpenApiInvocationError> {
+    let normalized = name.to_ascii_lowercase();
+    if protected_header(&normalized, false) {
+        return Err(OpenApiInvocationError::InvalidHeader(name.to_owned()));
+    }
+    validate_header_token(name)
+}
+
+fn validate_auth_header_name(name: &str) -> Result<(), OpenApiInvocationError> {
+    let normalized = name.to_ascii_lowercase();
+    if protected_header(&normalized, true) {
+        return Err(OpenApiInvocationError::InvalidHeader(name.to_owned()));
+    }
+    validate_header_token(name)
+}
+
+fn validate_header_token(name: &str) -> Result<(), OpenApiInvocationError> {
+    if is_http_token(name) {
+        Ok(())
+    } else {
+        Err(OpenApiInvocationError::InvalidHeader(name.to_owned()))
+    }
+}
+
+fn validate_cookie_name(name: &str) -> Result<(), OpenApiInvocationError> {
+    validate_header_token(name)
+}
+
+fn protected_header(normalized: &str, allow_authorization: bool) -> bool {
+    (!allow_authorization && normalized == "authorization")
+        || normalized.starts_with("proxy-")
+        || normalized.starts_with("x-forwarded-")
+        || matches!(
+            normalized,
+            "host"
+                | "content-length"
+                | "transfer-encoding"
+                | "connection"
+                | "cookie"
+                | "proxy-connection"
+                | "upgrade"
+                | "te"
+                | "trailer"
+                | "forwarded"
+                | "via"
+                | "referer"
+                | "x-forwarded"
+                | "x-real-ip"
+                | "x-original-url"
+                | "x-rewrite-url"
+                | "x-original-host"
+                | "x-http-method-override"
+                | "x-http-method"
+                | "x-method-override"
+                | "x-original-method"
+        )
+}
+
+fn is_http_token(name: &str) -> bool {
+    !name.is_empty()
+        && name.bytes().all(|byte| {
+            byte.is_ascii_alphanumeric()
+                || matches!(
+                    byte,
+                    b'!' | b'#'
+                        | b'$'
+                        | b'%'
+                        | b'&'
+                        | b'\''
+                        | b'*'
+                        | b'+'
+                        | b'-'
+                        | b'.'
+                        | b'^'
+                        | b'_'
+                        | b'`'
+                        | b'|'
+                        | b'~'
+                )
+        })
+}
+
+fn validate_header_value(name: &str, value: &str) -> Result<(), OpenApiInvocationError> {
+    if value
+        .bytes()
+        .any(|byte| byte != b'\t' && !(b' '..=b'~').contains(&byte))
+    {
+        Err(OpenApiInvocationError::InvalidHeader(name.to_owned()))
+    } else {
+        Ok(())
+    }
+}
+
+fn reject_control_characters(name: &str, value: &str) -> Result<(), OpenApiInvocationError> {
+    if value.chars().any(char::is_control) {
+        Err(OpenApiInvocationError::InvalidArgument(name.to_owned()))
+    } else {
+        Ok(())
+    }
+}
+
+fn encode_path_value(value: &str) -> String {
+    percent_encode(value, false)
+}
+
+fn encode_cookie_value(value: &str) -> String {
+    percent_encode(value, true)
+}
+
+fn percent_encode(value: &str, cookie: bool) -> String {
+    let mut encoded = String::new();
+    for byte in value.bytes() {
+        let safe = byte.is_ascii_alphanumeric()
+            || matches!(byte, b'-' | b'.' | b'_' | b'~')
+            || (cookie && matches!(byte, b':' | b'@'));
+        if safe {
+            encoded.push(char::from(byte));
+        } else {
+            encoded.push_str(&format!("%{byte:02X}"));
+        }
+    }
+    encoded
+}
+
+pub fn compile_document(bytes: &[u8]) -> Result<CompiledOpenApi, OpenApiError> {
+    let document = parse_document(bytes)?;
+    compile_value(document)
+}
+
+pub fn compile_value(document: Value) -> Result<CompiledOpenApi, OpenApiError> {
+    let document_bytes = serde_json::to_vec(&document)
+        .map_err(|_| OpenApiError::InvalidDocument("the document cannot be serialized"))?
+        .len();
+    if document_bytes > MAX_RESOLVED_BYTES {
+        return Err(limit("document_bytes"));
+    }
+    let root = document
+        .as_object()
+        .ok_or(OpenApiError::InvalidDocument("the root must be an object"))?;
+    let schema_dialect = validate_version(root)?;
+    reject_external_references(&document)?;
+    if matches!(schema_dialect, OpenApiSchemaDialect::OpenApi30) {
+        reject_openapi30_reference_siblings(&document)?;
+    }
+
+    let info = object_field(root, "info")?;
+    let title = string_field(info, "title")?.to_owned();
+    let description = optional_string(info, "description")?.map(str::to_owned);
+    let paths = object_field(root, "paths")?;
+    let root_servers = root.get("servers");
+    let root_security = root.get("security");
+    let security_schemes = root
+        .get("components")
+        .and_then(Value::as_object)
+        .and_then(|components| components.get("securitySchemes"))
+        .and_then(Value::as_object);
+    let mut tools = Vec::new();
+    let mut budget = CompileBudget {
+        resolved_nodes: 0,
+        resolved_bytes: document_bytes,
+    };
+    if root_servers.is_some() {
+        select_server(root_servers, &document, "ROOT", "/", &mut budget)?;
+    }
+
+    for (path, raw_path_item) in paths {
+        if !path.starts_with('/') {
+            continue;
+        }
+        let mut stack = Vec::new();
+        let path_item = resolve_value(raw_path_item, &document, &mut stack, 0, &mut budget)?;
+        let path_item = path_item
+            .as_object()
+            .ok_or_else(|| invalid_operation("PATH", path, "the path item must be an object"))?;
+        if path_item.get("servers").is_some() {
+            select_server(
+                path_item.get("servers"),
+                &document,
+                "PATH",
+                path,
+                &mut budget,
+            )?;
+        }
+        let path_parameters =
+            parse_parameters(path_item.get("parameters"), &document, path, &mut budget)?;
+
+        for method in HTTP_METHODS {
+            let Some(raw_operation) = path_item.get(method) else {
+                continue;
+            };
+            if method == "trace" {
+                return Err(invalid_operation(
+                    method,
+                    path,
+                    "TRACE operations are not supported",
+                ));
+            }
+            if tools.len() >= MAX_COMPILED_OPERATIONS {
+                return Err(limit("too_many_operations"));
+            }
+            let mut stack = Vec::new();
+            let operation = resolve_value(raw_operation, &document, &mut stack, 0, &mut budget)?;
+            let operation = operation.as_object().ok_or_else(|| {
+                invalid_operation(method, path, "the operation must be an object")
+            })?;
+            if operation.get("servers").is_some() {
+                select_server(
+                    operation.get("servers"),
+                    &document,
+                    method,
+                    path,
+                    &mut budget,
+                )?;
+            }
+            let operation_parameters =
+                parse_parameters(operation.get("parameters"), &document, path, &mut budget)?;
+            let parameters = merge_parameters(path_parameters.clone(), operation_parameters);
+            if parameters.len() > MAX_PARAMETERS_PER_OPERATION {
+                return Err(limit("too_many_parameters"));
+            }
+            validate_path_parameters(method, path, &parameters)?;
+            let server_url = select_server(
+                operation
+                    .get("servers")
+                    .or_else(|| path_item.get("servers"))
+                    .or(root_servers),
+                &document,
+                method,
+                path,
+                &mut budget,
+            )?;
+            let request_body = parse_request_body(
+                operation.get("requestBody"),
+                &document,
+                method,
+                path,
+                &mut budget,
+            )?;
+            let security = parse_security(
+                operation.get("security").or(root_security),
+                security_schemes,
+                &document,
+                method,
+                path,
+                &mut budget,
+            )?;
+            let preferred_name = operation
+                .get("x-executor-toolPath")
+                .and_then(Value::as_str)
+                .or_else(|| operation.get("operationId").and_then(Value::as_str))
+                .map(str::to_owned)
+                .unwrap_or_else(|| fallback_name(method, path));
+            let display_name = operation
+                .get("summary")
+                .and_then(Value::as_str)
+                .or_else(|| operation.get("operationId").and_then(Value::as_str))
+                .map(str::to_owned)
+                .unwrap_or_else(|| format!("{} {path}", method.to_ascii_uppercase()));
+            let description = operation
+                .get("description")
+                .and_then(Value::as_str)
+                .map(str::to_owned);
+            let input_schema =
+                build_input_schema(&parameters, request_body.as_ref(), schema_dialect)?;
+            let output_schema = parse_output_schema(
+                operation.get("responses"),
+                &document,
+                method,
+                path,
+                &mut budget,
+            )?;
+            let binding = OpenApiBinding {
+                version: 1,
+                method: method.to_ascii_uppercase(),
+                path_template: path.clone(),
+                server_url,
+                parameters: parameters
+                    .iter()
+                    .map(|parameter| parameter.binding.clone())
+                    .collect(),
+                request_body: request_body.as_ref().map(|body| body.binding.clone()),
+                security,
+            };
+            budget.charge_serialized(&input_schema)?;
+            if let Some(output_schema) = &output_schema {
+                budget.charge_serialized(output_schema)?;
+            }
+            budget.charge_serialized(&binding)?;
+            tools.push(CompiledOpenApiTool {
+                stable_key: stable_key(method, path),
+                preferred_name,
+                display_name,
+                description,
+                input_schema,
+                output_schema,
+                intrinsic_mode: intrinsic_mode(method),
+                binding,
+            });
+        }
+    }
+    tools.sort_by(|left, right| left.stable_key.cmp(&right.stable_key));
+    Ok(CompiledOpenApi {
+        document,
+        title,
+        description,
+        tools,
+    })
+}
+
+fn parse_document(bytes: &[u8]) -> Result<Value, OpenApiError> {
+    let mut json = serde_json::Deserializer::from_slice(bytes);
+    if let Ok(value) = UniqueValue::deserialize(&mut json)
+        && json.end().is_ok()
+    {
+        return Ok(value.0);
+    }
+    serde_yaml::from_slice::<UniqueValue>(bytes)
+        .map(|value| value.0)
+        .map_err(|_| OpenApiError::Parse)
+}
+
+struct UniqueValue(Value);
+
+impl<'de> Deserialize<'de> for UniqueValue {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: serde::Deserializer<'de>,
+    {
+        deserializer.deserialize_any(UniqueValueVisitor)
+    }
+}
+
+struct UniqueValueVisitor;
+
+impl<'de> Visitor<'de> for UniqueValueVisitor {
+    type Value = UniqueValue;
+
+    fn expecting(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str("a JSON-compatible value without duplicate object keys")
+    }
+
+    fn visit_bool<E>(self, value: bool) -> Result<Self::Value, E> {
+        Ok(UniqueValue(Value::Bool(value)))
+    }
+
+    fn visit_i64<E>(self, value: i64) -> Result<Self::Value, E> {
+        Ok(UniqueValue(Value::Number(value.into())))
+    }
+
+    fn visit_u64<E>(self, value: u64) -> Result<Self::Value, E> {
+        Ok(UniqueValue(Value::Number(value.into())))
+    }
+
+    fn visit_f64<E>(self, value: f64) -> Result<Self::Value, E>
+    where
+        E: de::Error,
+    {
+        serde_json::Number::from_f64(value)
+            .map(Value::Number)
+            .map(UniqueValue)
+            .ok_or_else(|| E::custom("non-finite numbers are not supported"))
+    }
+
+    fn visit_str<E>(self, value: &str) -> Result<Self::Value, E> {
+        Ok(UniqueValue(Value::String(value.to_owned())))
+    }
+
+    fn visit_string<E>(self, value: String) -> Result<Self::Value, E> {
+        Ok(UniqueValue(Value::String(value)))
+    }
+
+    fn visit_none<E>(self) -> Result<Self::Value, E> {
+        Ok(UniqueValue(Value::Null))
+    }
+
+    fn visit_unit<E>(self) -> Result<Self::Value, E> {
+        Ok(UniqueValue(Value::Null))
+    }
+
+    fn visit_seq<A>(self, mut sequence: A) -> Result<Self::Value, A::Error>
+    where
+        A: SeqAccess<'de>,
+    {
+        let mut values = Vec::new();
+        while let Some(value) = sequence.next_element::<UniqueValue>()? {
+            values.push(value.0);
+        }
+        Ok(UniqueValue(Value::Array(values)))
+    }
+
+    fn visit_map<A>(self, mut entries: A) -> Result<Self::Value, A::Error>
+    where
+        A: MapAccess<'de>,
+    {
+        let mut object = Map::new();
+        while let Some((key, value)) = entries.next_entry::<String, UniqueValue>()? {
+            if object.insert(key.clone(), value.0).is_some() {
+                return Err(de::Error::custom(format!("duplicate object key: {key}")));
+            }
+        }
+        Ok(UniqueValue(Value::Object(object)))
+    }
+}
+
+fn validate_version(root: &Map<String, Value>) -> Result<OpenApiSchemaDialect, OpenApiError> {
+    if root.contains_key("swagger") {
+        return Err(OpenApiError::UnsupportedVersion);
+    }
+    let version = root
+        .get("openapi")
+        .and_then(Value::as_str)
+        .ok_or(OpenApiError::UnsupportedVersion)?;
+    if version.starts_with("3.0.") {
+        Ok(OpenApiSchemaDialect::OpenApi30)
+    } else if version.starts_with("3.1.") {
+        validate_openapi31_schema_dialect(root)?;
+        Ok(OpenApiSchemaDialect::JsonSchema202012)
+    } else {
+        Err(OpenApiError::UnsupportedVersion)
+    }
+}
+
+fn validate_openapi31_schema_dialect(root: &Map<String, Value>) -> Result<(), OpenApiError> {
+    let Some(dialect) = root.get("jsonSchemaDialect") else {
+        return Ok(());
+    };
+    let dialect = dialect.as_str().ok_or(OpenApiError::InvalidDocument(
+        "jsonSchemaDialect must be a URI string",
+    ))?;
+    let dialect = dialect.strip_suffix('#').unwrap_or(dialect);
+    if matches!(dialect, OAS31_BASE_DIALECT | JSON_SCHEMA_2020_12_DIALECT) {
+        Ok(())
+    } else {
+        Err(OpenApiError::InvalidDocument(
+            "the OpenAPI 3.1 JSON Schema dialect is not supported",
+        ))
+    }
+}
+
+fn reject_external_references(value: &Value) -> Result<(), OpenApiError> {
+    match value {
+        Value::Array(values) => {
+            for value in values {
+                reject_external_references(value)?;
+            }
+        }
+        Value::Object(object) => {
+            if let Some(reference) = object.get("$ref").and_then(Value::as_str)
+                && !reference.starts_with('#')
+            {
+                return Err(OpenApiError::ExternalReference(reference.to_owned()));
+            }
+            for value in object.values() {
+                reject_external_references(value)?;
+            }
+        }
+        _ => {}
+    }
+    Ok(())
+}
+
+fn reject_openapi30_reference_siblings(value: &Value) -> Result<(), OpenApiError> {
+    match value {
+        Value::Array(values) => {
+            for value in values {
+                reject_openapi30_reference_siblings(value)?;
+            }
+        }
+        Value::Object(object) => {
+            if object.contains_key("$ref") && object.len() > 1 {
+                return Err(OpenApiError::InvalidDocument(
+                    "OpenAPI 3.0 reference objects cannot have sibling fields",
+                ));
+            }
+            for value in object.values() {
+                reject_openapi30_reference_siblings(value)?;
+            }
+        }
+        Value::Null | Value::Bool(_) | Value::Number(_) | Value::String(_) => {}
+    }
+    Ok(())
+}
+
+#[derive(Default)]
+struct CompileBudget {
+    resolved_nodes: usize,
+    resolved_bytes: usize,
+}
+
+impl CompileBudget {
+    fn charge(&mut self, value: &Value) -> Result<(), OpenApiError> {
+        self.resolved_nodes = self
+            .resolved_nodes
+            .checked_add(1)
+            .ok_or_else(|| limit("resolved_nodes"))?;
+        if self.resolved_nodes > MAX_RESOLVED_NODES {
+            return Err(limit("resolved_nodes"));
+        }
+        let shallow_bytes = match value {
+            Value::Null | Value::Bool(_) => 8,
+            Value::Number(number) => number.to_string().len() + 8,
+            Value::String(value) => value.len() + 8,
+            Value::Array(values) => values.len().saturating_mul(2) + 8,
+            Value::Object(object) => object.keys().fold(8usize, |bytes, key| {
+                bytes.saturating_add(key.len()).saturating_add(4)
+            }),
+        };
+        self.charge_bytes(shallow_bytes)?;
+        Ok(())
+    }
+
+    fn charge_serialized<T: Serialize>(&mut self, value: &T) -> Result<(), OpenApiError> {
+        let bytes = serde_json::to_vec(value)
+            .map_err(|_| OpenApiError::InvalidDocument("compiled data cannot be serialized"))?
+            .len();
+        self.charge_bytes(bytes)
+    }
+
+    fn charge_bytes(&mut self, bytes: usize) -> Result<(), OpenApiError> {
+        self.resolved_bytes = self
+            .resolved_bytes
+            .checked_add(bytes)
+            .ok_or_else(|| limit("resolved_bytes"))?;
+        if self.resolved_bytes > MAX_RESOLVED_BYTES {
+            return Err(limit("resolved_bytes"));
+        }
+        Ok(())
+    }
+}
+
+fn resolve_value(
+    value: &Value,
+    root: &Value,
+    stack: &mut Vec<String>,
+    depth: usize,
+    budget: &mut CompileBudget,
+) -> Result<Value, OpenApiError> {
+    if depth > MAX_REFERENCE_DEPTH {
+        return Err(OpenApiError::ReferenceDepth);
+    }
+    budget.charge(value)?;
+    match value {
+        Value::Array(values) => values
+            .iter()
+            .map(|value| resolve_value(value, root, stack, depth + 1, budget))
+            .collect::<Result<Vec<_>, _>>()
+            .map(Value::Array),
+        Value::Object(object) => {
+            if let Some(reference) = object.get("$ref") {
+                let reference = reference
+                    .as_str()
+                    .ok_or(OpenApiError::InvalidDocument("$ref must be a string"))?;
+                if !reference.starts_with('#') {
+                    return Err(OpenApiError::ExternalReference(reference.to_owned()));
+                }
+                let pointer = local_pointer(reference)?;
+                if stack.iter().any(|entry| entry == reference) {
+                    return Err(OpenApiError::ReferenceCycle(reference.to_owned()));
+                }
+                let target = root
+                    .pointer(&pointer)
+                    .ok_or_else(|| OpenApiError::ReferenceNotFound(reference.to_owned()))?;
+                stack.push(reference.to_owned());
+                let resolved = resolve_value(target, root, stack, depth + 1, budget)?;
+                stack.pop();
+                if object.len() == 1 {
+                    return Ok(resolved);
+                }
+                let mut resolved =
+                    resolved
+                        .as_object()
+                        .cloned()
+                        .ok_or(OpenApiError::InvalidDocument(
+                            "a referenced value with siblings must be an object",
+                        ))?;
+                for (key, sibling) in object {
+                    if key != "$ref" {
+                        resolved.insert(
+                            key.clone(),
+                            resolve_value(sibling, root, stack, depth + 1, budget)?,
+                        );
+                    }
+                }
+                Ok(Value::Object(resolved))
+            } else {
+                object
+                    .iter()
+                    .map(|(key, value)| {
+                        Ok((
+                            key.clone(),
+                            resolve_value(value, root, stack, depth + 1, budget)?,
+                        ))
+                    })
+                    .collect::<Result<Map<_, _>, _>>()
+                    .map(Value::Object)
+            }
+        }
+        _ => Ok(value.clone()),
+    }
+}
+
+fn local_pointer(reference: &str) -> Result<String, OpenApiError> {
+    let fragment = reference
+        .strip_prefix('#')
+        .expect("local references start with a fragment marker");
+    percent_decode(fragment).ok_or_else(|| OpenApiError::ReferenceNotFound(reference.to_owned()))
+}
+
+fn percent_decode(value: &str) -> Option<String> {
+    let bytes = value.as_bytes();
+    let mut decoded = Vec::with_capacity(bytes.len());
+    let mut index = 0;
+    while index < bytes.len() {
+        if bytes[index] == b'%' {
+            let high = *bytes.get(index + 1)?;
+            let low = *bytes.get(index + 2)?;
+            decoded.push(hex(high)? * 16 + hex(low)?);
+            index += 3;
+        } else {
+            decoded.push(bytes[index]);
+            index += 1;
+        }
+    }
+    String::from_utf8(decoded).ok()
+}
+
+fn hex(value: u8) -> Option<u8> {
+    match value {
+        b'0'..=b'9' => Some(value - b'0'),
+        b'a'..=b'f' => Some(value - b'a' + 10),
+        b'A'..=b'F' => Some(value - b'A' + 10),
+        _ => None,
+    }
+}
+
+#[derive(Clone)]
+struct ParsedParameter {
+    binding: OpenApiParameterBinding,
+    schema: Value,
+}
+
+fn parse_parameters(
+    value: Option<&Value>,
+    root: &Value,
+    path: &str,
+    budget: &mut CompileBudget,
+) -> Result<Vec<ParsedParameter>, OpenApiError> {
+    let Some(value) = value else {
+        return Ok(Vec::new());
+    };
+    let values = value
+        .as_array()
+        .ok_or_else(|| invalid_operation("PATH", path, "parameters must be an array"))?;
+    if values.len() > MAX_PARAMETERS_PER_OPERATION {
+        return Err(limit("too_many_parameters"));
+    }
+    let mut parsed = Vec::with_capacity(values.len());
+    for value in values {
+        let mut stack = Vec::new();
+        let value = resolve_value(value, root, &mut stack, 0, budget)?;
+        let parameter = value
+            .as_object()
+            .ok_or_else(|| invalid_operation("PATH", path, "a parameter must be an object"))?;
+        let name = string_field(parameter, "name")?.to_owned();
+        let location = match string_field(parameter, "in")? {
+            "path" => OpenApiParameterLocation::Path,
+            "query" => OpenApiParameterLocation::Query,
+            "header" => OpenApiParameterLocation::Header,
+            "cookie" => OpenApiParameterLocation::Cookie,
+            _ => {
+                return Err(invalid_operation(
+                    "PATH",
+                    path,
+                    "a parameter location is invalid",
+                ));
+            }
+        };
+        let required = location == OpenApiParameterLocation::Path
+            || parameter
+                .get("required")
+                .and_then(Value::as_bool)
+                .unwrap_or(false);
+        let style = parameter
+            .get("style")
+            .and_then(Value::as_str)
+            .unwrap_or_else(|| default_style(location))
+            .to_owned();
+        let explode = parameter
+            .get("explode")
+            .and_then(Value::as_bool)
+            .unwrap_or_else(|| style == "form");
+        let allow_reserved = parameter
+            .get("allowReserved")
+            .and_then(Value::as_bool)
+            .unwrap_or(false);
+        if allow_reserved {
+            return Err(invalid_operation(
+                "PATH",
+                path,
+                "allowReserved parameters are not supported",
+            ));
+        }
+        let supported_style = match location {
+            OpenApiParameterLocation::Path | OpenApiParameterLocation::Header => style == "simple",
+            OpenApiParameterLocation::Query => matches!(
+                style.as_str(),
+                "form" | "spaceDelimited" | "pipeDelimited" | "deepObject"
+            ),
+            OpenApiParameterLocation::Cookie => style == "form",
+        };
+        if !supported_style {
+            return Err(invalid_operation(
+                "PATH",
+                path,
+                "the parameter serialization style is not supported",
+            ));
+        }
+        if parameter.contains_key("content") {
+            return Err(invalid_operation(
+                "PATH",
+                path,
+                "content-based parameters are not supported",
+            ));
+        }
+        let schema = if let Some(schema) = parameter.get("schema") {
+            schema.clone()
+        } else {
+            json!({})
+        };
+        parsed.push(ParsedParameter {
+            binding: OpenApiParameterBinding {
+                name,
+                location,
+                required,
+                style,
+                explode,
+                allow_reserved,
+            },
+            schema,
+        });
+    }
+    Ok(parsed)
+}
+
+fn merge_parameters(
+    path_parameters: Vec<ParsedParameter>,
+    operation_parameters: Vec<ParsedParameter>,
+) -> Vec<ParsedParameter> {
+    let mut parameters = BTreeMap::new();
+    for parameter in path_parameters.into_iter().chain(operation_parameters) {
+        parameters.insert(
+            (parameter.binding.location, parameter.binding.name.clone()),
+            parameter,
+        );
+    }
+    parameters.into_values().collect()
+}
+
+fn default_style(location: OpenApiParameterLocation) -> &'static str {
+    match location {
+        OpenApiParameterLocation::Path | OpenApiParameterLocation::Header => "simple",
+        OpenApiParameterLocation::Query | OpenApiParameterLocation::Cookie => "form",
+    }
+}
+
+fn validate_path_parameters(
+    method: &str,
+    path: &str,
+    parameters: &[ParsedParameter],
+) -> Result<(), OpenApiError> {
+    let mut template_names = Vec::new();
+    let mut remainder = path;
+    while let Some(open) = remainder.find('{') {
+        let after_open = &remainder[open + 1..];
+        let Some(close) = after_open.find('}') else {
+            return Err(invalid_operation(
+                method,
+                path,
+                "the path template has an unclosed variable",
+            ));
+        };
+        let name = &after_open[..close];
+        if name.is_empty() || name.contains('{') {
+            return Err(invalid_operation(
+                method,
+                path,
+                "the path template has an invalid variable",
+            ));
+        }
+        template_names.push(name);
+        remainder = &after_open[close + 1..];
+    }
+    if remainder.contains('}') {
+        return Err(invalid_operation(
+            method,
+            path,
+            "the path template has an unmatched closing brace",
+        ));
+    }
+    let path_parameters = parameters
+        .iter()
+        .filter(|parameter| parameter.binding.location == OpenApiParameterLocation::Path)
+        .map(|parameter| parameter.binding.name.as_str())
+        .collect::<Vec<_>>();
+    let same_members = template_names.len() == path_parameters.len()
+        && template_names
+            .iter()
+            .all(|name| path_parameters.iter().any(|parameter| parameter == name));
+    if same_members {
+        Ok(())
+    } else {
+        Err(invalid_operation(
+            method,
+            path,
+            "path template variables and path parameters must match",
+        ))
+    }
+}
+
+fn select_server(
+    value: Option<&Value>,
+    root: &Value,
+    method: &str,
+    path: &str,
+    budget: &mut CompileBudget,
+) -> Result<String, OpenApiError> {
+    let Some(value) = value else {
+        return Ok("/".to_owned());
+    };
+    let servers = value
+        .as_array()
+        .ok_or_else(|| invalid_operation(method, path, "servers must be an array"))?;
+    if servers.is_empty() {
+        return Ok("/".to_owned());
+    }
+    let mut selected = None;
+    for server in servers {
+        let mut stack = Vec::new();
+        let server = resolve_value(server, root, &mut stack, 0, budget)?;
+        let url = parse_server_url(&server, method, path)?;
+        if selected.is_none() {
+            selected = Some(url);
+        }
+    }
+    Ok(selected.expect("a non-empty server list selects its first server"))
+}
+
+fn parse_server_url(server: &Value, method: &str, path: &str) -> Result<String, OpenApiError> {
+    let server = server
+        .as_object()
+        .ok_or_else(|| invalid_operation(method, path, "a server must be an object"))?;
+    let mut url = string_field(server, "url")?.to_owned();
+    if let Some(variables) = server.get("variables").and_then(Value::as_object) {
+        for (name, variable) in variables {
+            let default = variable
+                .get("default")
+                .and_then(Value::as_str)
+                .ok_or_else(|| {
+                    invalid_operation(method, path, "a server variable needs a default")
+                })?;
+            url = url.replace(&format!("{{{name}}}"), default);
+        }
+    }
+    validate_server_url(&url, method, path)?;
+    Ok(url)
+}
+
+fn validate_server_url(url: &str, method: &str, path: &str) -> Result<(), OpenApiError> {
+    let base = Url::parse("https://executor.invalid/")
+        .expect("the fixed OpenAPI server validation base is valid");
+    let parsed = Url::options()
+        .base_url(Some(&base))
+        .parse(url)
+        .map_err(|_| invalid_operation(method, path, "the server URL is invalid"))?;
+    if !matches!(parsed.scheme(), "http" | "https") {
+        return Err(invalid_operation(
+            method,
+            path,
+            "the server URL scheme is not supported",
+        ));
+    }
+    if !parsed.username().is_empty()
+        || parsed.password().is_some()
+        || parsed.query().is_some()
+        || parsed.fragment().is_some()
+    {
+        return Err(invalid_operation(
+            method,
+            path,
+            "server URLs cannot contain userinfo, query parameters, or fragments",
+        ));
+    }
+    Ok(())
+}
+
+struct ParsedRequestBody {
+    binding: OpenApiRequestBodyBinding,
+    schemas: Vec<Value>,
+}
+
+fn parse_request_body(
+    value: Option<&Value>,
+    root: &Value,
+    method: &str,
+    path: &str,
+    budget: &mut CompileBudget,
+) -> Result<Option<ParsedRequestBody>, OpenApiError> {
+    let Some(value) = value else {
+        return Ok(None);
+    };
+    let mut stack = Vec::new();
+    let body = resolve_value(value, root, &mut stack, 0, budget)?;
+    let body = body
+        .as_object()
+        .ok_or_else(|| invalid_operation(method, path, "requestBody must be an object"))?;
+    let content = object_field(body, "content")?;
+    let mut media_types = content.keys().cloned().collect::<Vec<_>>();
+    if media_types.iter().any(|media_type| {
+        let base = media_type
+            .split_once(';')
+            .map_or(media_type.as_str(), |(base, _)| base)
+            .trim();
+        !(base == "application/json"
+            || base.ends_with("+json")
+            || base == "text/plain"
+            || base == "application/x-www-form-urlencoded")
+    }) {
+        return Err(invalid_operation(
+            method,
+            path,
+            "the request body media type is not supported",
+        ));
+    }
+    media_types.sort_by(|left, right| {
+        media_rank(left)
+            .cmp(&media_rank(right))
+            .then_with(|| left.cmp(right))
+    });
+    let Some(default_media_type) = media_types.first().cloned() else {
+        return Err(invalid_operation(
+            method,
+            path,
+            "requestBody content cannot be empty",
+        ));
+    };
+    let schemas = media_types
+        .iter()
+        .map(|media_type| {
+            content
+                .get(media_type)
+                .and_then(Value::as_object)
+                .and_then(|media| media.get("schema"))
+                .cloned()
+                .unwrap_or_else(|| json!({}))
+        })
+        .collect::<Vec<_>>();
+    for (media_type, schema) in media_types.iter().zip(&schemas) {
+        validate_request_body_schema(media_type, schema, method, path)?;
+    }
+    Ok(Some(ParsedRequestBody {
+        binding: OpenApiRequestBodyBinding {
+            required: body
+                .get("required")
+                .and_then(Value::as_bool)
+                .unwrap_or(false),
+            default_media_type,
+            media_types,
+        },
+        schemas,
+    }))
+}
+
+fn validate_request_body_schema(
+    media_type: &str,
+    schema: &Value,
+    method: &str,
+    path: &str,
+) -> Result<(), OpenApiError> {
+    let base = media_type
+        .split_once(';')
+        .map_or(media_type, |(base, _)| base)
+        .trim();
+    if base == "text/plain" {
+        if schema.get("type").and_then(Value::as_str) != Some("string") {
+            return Err(invalid_operation(
+                method,
+                path,
+                "text/plain request bodies require a string schema",
+            ));
+        }
+    } else if base == "application/x-www-form-urlencoded" {
+        let schema = schema.as_object().ok_or_else(|| {
+            invalid_operation(method, path, "form request bodies require an object schema")
+        })?;
+        if schema.get("type").and_then(Value::as_str) != Some("object") {
+            return Err(invalid_operation(
+                method,
+                path,
+                "form request bodies require an object schema",
+            ));
+        }
+        if schema.get("additionalProperties") != Some(&Value::Bool(false)) {
+            return Err(invalid_operation(
+                method,
+                path,
+                "form request body properties must be declared scalar values",
+            ));
+        }
+        if let Some(properties) = schema.get("properties") {
+            let properties = properties.as_object().ok_or_else(|| {
+                invalid_operation(method, path, "form schema properties must be an object")
+            })?;
+            for property in properties.values() {
+                let scalar = property
+                    .get("type")
+                    .and_then(Value::as_str)
+                    .is_some_and(|kind| {
+                        matches!(kind, "string" | "number" | "integer" | "boolean")
+                    });
+                if !scalar {
+                    return Err(invalid_operation(
+                        method,
+                        path,
+                        "form request body properties must be scalar values",
+                    ));
+                }
+            }
+        }
+    }
+    Ok(())
+}
+
+fn select_media(content: &Map<String, Value>) -> Option<(&String, &Map<String, Value>)> {
+    content
+        .iter()
+        .filter_map(|(kind, value)| value.as_object().map(|value| (kind, value)))
+        .min_by(|(left, _), (right, _)| {
+            media_rank(left)
+                .cmp(&media_rank(right))
+                .then_with(|| left.cmp(right))
+        })
+}
+
+fn media_rank(media_type: &str) -> u8 {
+    let media_type = media_type
+        .split_once(';')
+        .map_or(media_type, |(essence, _)| essence)
+        .trim();
+    match media_type {
+        "application/json" => 0,
+        value if value.ends_with("+json") => 1,
+        "application/x-www-form-urlencoded" => 2,
+        "multipart/form-data" => 3,
+        value if value.starts_with("text/") => 4,
+        _ => 5,
+    }
+}
+
+fn parse_security(
+    value: Option<&Value>,
+    schemes: Option<&Map<String, Value>>,
+    root: &Value,
+    method: &str,
+    path: &str,
+    budget: &mut CompileBudget,
+) -> Result<Vec<OpenApiSecurityAlternative>, OpenApiError> {
+    let Some(value) = value else {
+        return Ok(vec![OpenApiSecurityAlternative {
+            requirements: Vec::new(),
+        }]);
+    };
+    let alternatives = value
+        .as_array()
+        .ok_or_else(|| invalid_operation(method, path, "security must be an array"))?;
+    if alternatives.len() > MAX_SECURITY_ALTERNATIVES {
+        return Err(limit("too_many_security_alternatives"));
+    }
+    if alternatives.is_empty() {
+        return Ok(vec![OpenApiSecurityAlternative {
+            requirements: Vec::new(),
+        }]);
+    }
+    let mut parsed = Vec::with_capacity(alternatives.len());
+    for alternative in alternatives {
+        let alternative = alternative.as_object().ok_or_else(|| {
+            invalid_operation(method, path, "a security alternative must be an object")
+        })?;
+        if alternative.len() > MAX_SECURITY_REQUIREMENTS_PER_ALTERNATIVE {
+            return Err(limit("too_many_security_requirements"));
+        }
+        let mut requirements = Vec::with_capacity(alternative.len());
+        for (scheme_name, scopes) in alternative {
+            let scheme_value = schemes
+                .and_then(|schemes| schemes.get(scheme_name))
+                .ok_or_else(|| invalid_operation(method, path, "a security scheme is missing"))?;
+            let mut stack = Vec::new();
+            let scheme_value = resolve_value(scheme_value, root, &mut stack, 0, budget)?;
+            let (scheme, oauth_flows) = parse_security_scheme(
+                scheme_value.as_object().ok_or_else(|| {
+                    invalid_operation(method, path, "a security scheme must be an object")
+                })?,
+                method,
+                path,
+            )?;
+            let scopes = scopes
+                .as_array()
+                .ok_or_else(|| invalid_operation(method, path, "security scopes must be an array"))?
+                .iter()
+                .map(|scope| {
+                    scope.as_str().map(str::to_owned).ok_or_else(|| {
+                        invalid_operation(method, path, "a security scope must be a string")
+                    })
+                })
+                .collect::<Result<Vec<_>, _>>()?;
+            requirements.push(OpenApiSecurityRequirement {
+                scheme_name: scheme_name.clone(),
+                scopes,
+                scheme,
+                oauth_flows,
+            });
+        }
+        requirements.sort_by(|left, right| left.scheme_name.cmp(&right.scheme_name));
+        let alternative = OpenApiSecurityAlternative { requirements };
+        if security_alternative_has_carrier_conflict(&alternative) {
+            return Err(invalid_operation(
+                method,
+                path,
+                "security requirements in an AND alternative target the same carrier",
+            ));
+        }
+        parsed.push(alternative);
+    }
+    Ok(parsed)
+}
+
+fn security_alternative_has_carrier_conflict(alternative: &OpenApiSecurityAlternative) -> bool {
+    let mut carriers = std::collections::BTreeSet::new();
+    alternative
+        .requirements
+        .iter()
+        .filter_map(security_carrier)
+        .any(|carrier| !carriers.insert(carrier))
+}
+
+fn security_carrier(requirement: &OpenApiSecurityRequirement) -> Option<String> {
+    match &requirement.scheme {
+        OpenApiSecurityScheme::ApiKey { name, location } => Some(match location {
+            OpenApiParameterLocation::Header => format!("header:{}", name.to_ascii_lowercase()),
+            OpenApiParameterLocation::Query => format!("query:{name}"),
+            OpenApiParameterLocation::Cookie => format!("cookie:{name}"),
+            OpenApiParameterLocation::Path => return None,
+        }),
+        OpenApiSecurityScheme::Http { .. }
+        | OpenApiSecurityScheme::OAuth2
+        | OpenApiSecurityScheme::OpenIdConnect { .. } => Some("header:authorization".to_owned()),
+        OpenApiSecurityScheme::MutualTls => Some("tls:client_certificate".to_owned()),
+    }
+}
+
+fn parse_security_scheme(
+    scheme: &Map<String, Value>,
+    method: &str,
+    path: &str,
+) -> Result<(OpenApiSecurityScheme, Option<OpenApiOAuthFlows>), OpenApiError> {
+    match string_field(scheme, "type")? {
+        "apiKey" => {
+            let location = match string_field(scheme, "in")? {
+                "header" => OpenApiParameterLocation::Header,
+                "query" => OpenApiParameterLocation::Query,
+                "cookie" => OpenApiParameterLocation::Cookie,
+                _ => {
+                    return Err(invalid_operation(
+                        method,
+                        path,
+                        "an API key location is invalid",
+                    ));
+                }
+            };
+            Ok((
+                OpenApiSecurityScheme::ApiKey {
+                    name: string_field(scheme, "name")?.to_owned(),
+                    location,
+                },
+                None,
+            ))
+        }
+        "http" => {
+            let http_scheme = string_field(scheme, "scheme")?.to_ascii_lowercase();
+            if !matches!(http_scheme.as_str(), "basic" | "bearer") {
+                return Err(invalid_operation(
+                    method,
+                    path,
+                    "the HTTP authentication scheme is not supported",
+                ));
+            }
+            Ok((
+                OpenApiSecurityScheme::Http {
+                    scheme: http_scheme,
+                    bearer_format: optional_string(scheme, "bearerFormat")?.map(str::to_owned),
+                },
+                None,
+            ))
+        }
+        "oauth2" => Ok((
+            OpenApiSecurityScheme::OAuth2,
+            Some(parse_oauth_flows(object_field(scheme, "flows")?)?),
+        )),
+        "openIdConnect" => Ok((
+            OpenApiSecurityScheme::OpenIdConnect {
+                url: string_field(scheme, "openIdConnectUrl")?.to_owned(),
+            },
+            None,
+        )),
+        "mutualTLS" => Err(invalid_operation(
+            method,
+            path,
+            "mutual TLS authentication is not supported",
+        )),
+        _ => Err(invalid_operation(
+            method,
+            path,
+            "a security scheme type is unsupported",
+        )),
+    }
+}
+
+fn parse_oauth_flows(flows: &Map<String, Value>) -> Result<OpenApiOAuthFlows, OpenApiError> {
+    Ok(OpenApiOAuthFlows {
+        implicit: flows
+            .get("implicit")
+            .map(|flow| parse_oauth_flow(flow, true, false))
+            .transpose()?,
+        password: flows
+            .get("password")
+            .map(|flow| parse_oauth_flow(flow, false, true))
+            .transpose()?,
+        client_credentials: flows
+            .get("clientCredentials")
+            .map(|flow| parse_oauth_flow(flow, false, true))
+            .transpose()?,
+        authorization_code: flows
+            .get("authorizationCode")
+            .map(|flow| parse_oauth_flow(flow, true, true))
+            .transpose()?,
+    })
+}
+
+fn parse_oauth_flow(
+    flow: &Value,
+    needs_authorization_url: bool,
+    needs_token_url: bool,
+) -> Result<OpenApiOAuthFlow, OpenApiError> {
+    let flow = flow.as_object().ok_or(OpenApiError::InvalidDocument(
+        "an OAuth flow must be an object",
+    ))?;
+    let authorization_url = optional_string(flow, "authorizationUrl")?.map(str::to_owned);
+    let token_url = optional_string(flow, "tokenUrl")?.map(str::to_owned);
+    if needs_authorization_url && authorization_url.is_none() {
+        return Err(OpenApiError::InvalidDocument(
+            "an OAuth flow is missing authorizationUrl",
+        ));
+    }
+    if needs_token_url && token_url.is_none() {
+        return Err(OpenApiError::InvalidDocument(
+            "an OAuth flow is missing tokenUrl",
+        ));
+    }
+    let scopes = object_field(flow, "scopes")?
+        .iter()
+        .map(|(scope, description)| {
+            description
+                .as_str()
+                .map(|description| (scope.clone(), description.to_owned()))
+                .ok_or(OpenApiError::InvalidDocument(
+                    "an OAuth scope description must be a string",
+                ))
+        })
+        .collect::<Result<_, _>>()?;
+    Ok(OpenApiOAuthFlow {
+        authorization_url,
+        token_url,
+        refresh_url: optional_string(flow, "refreshUrl")?.map(str::to_owned),
+        scopes,
+    })
+}
+
+fn build_input_schema(
+    parameters: &[ParsedParameter],
+    body: Option<&ParsedRequestBody>,
+    dialect: OpenApiSchemaDialect,
+) -> Result<Value, OpenApiError> {
+    let mut root_properties = Map::new();
+    let mut root_required = Vec::new();
+    let mut media_branches = None;
+    for location in [
+        OpenApiParameterLocation::Path,
+        OpenApiParameterLocation::Query,
+        OpenApiParameterLocation::Header,
+        OpenApiParameterLocation::Cookie,
+    ] {
+        let matching = parameters
+            .iter()
+            .filter(|parameter| parameter.binding.location == location)
+            .collect::<Vec<_>>();
+        if matching.is_empty() {
+            continue;
+        }
+        let mut properties = Map::new();
+        let mut required = Vec::new();
+        for parameter in matching {
+            properties.insert(
+                parameter.binding.name.clone(),
+                normalized_input_schema(&parameter.schema, dialect)?,
+            );
+            if parameter.binding.required {
+                required.push(Value::String(parameter.binding.name.clone()));
+            }
+        }
+        let mut schema = Map::from_iter([
+            ("type".to_owned(), Value::String("object".to_owned())),
+            ("properties".to_owned(), Value::Object(properties)),
+            ("additionalProperties".to_owned(), Value::Bool(false)),
+        ]);
+        if !required.is_empty() {
+            schema.insert("required".to_owned(), Value::Array(required));
+            root_required.push(Value::String(location.input_key().to_owned()));
+        }
+        root_properties.insert(location.input_key().to_owned(), Value::Object(schema));
+    }
+    if let Some(body) = body {
+        let normalized_schemas = body
+            .schemas
+            .iter()
+            .map(|schema| normalized_input_schema(schema, dialect))
+            .collect::<Result<Vec<_>, _>>()?;
+        let schema = if normalized_schemas.len() == 1 {
+            normalized_schemas[0].clone()
+        } else {
+            media_branches = Some(
+                body.binding
+                    .media_types
+                    .iter()
+                    .zip(&normalized_schemas)
+                    .map(|(media_type, schema)| {
+                        let mut required = Vec::new();
+                        if body.binding.required {
+                            required.push(Value::String("body".to_owned()));
+                        }
+                        if media_type != &body.binding.default_media_type {
+                            required.push(Value::String("contentType".to_owned()));
+                        }
+                        let mut branch = Map::from_iter([
+                            ("type".to_owned(), Value::String("object".to_owned())),
+                            (
+                                "properties".to_owned(),
+                                json!({
+                                    "body": schema,
+                                    "contentType": { "const": media_type }
+                                }),
+                            ),
+                        ]);
+                        if !required.is_empty() {
+                            branch.insert("required".to_owned(), Value::Array(required));
+                        }
+                        Value::Object(branch)
+                    })
+                    .collect::<Vec<_>>(),
+            );
+            Value::Bool(true)
+        };
+        root_properties.insert("body".to_owned(), schema);
+        root_properties.insert(
+            "contentType".to_owned(),
+            json!({
+                "type": "string",
+                "enum": body.binding.media_types,
+                "default": body.binding.default_media_type
+            }),
+        );
+        if body.binding.required {
+            root_required.push(Value::String("body".to_owned()));
+        }
+    }
+    let mut schema = Map::from_iter([
+        (
+            "$schema".to_owned(),
+            Value::String("https://json-schema.org/draft/2020-12/schema".to_owned()),
+        ),
+        ("type".to_owned(), Value::String("object".to_owned())),
+        ("properties".to_owned(), Value::Object(root_properties)),
+        ("additionalProperties".to_owned(), Value::Bool(false)),
+    ]);
+    if !root_required.is_empty() {
+        schema.insert("required".to_owned(), Value::Array(root_required));
+    }
+    if let Some(media_branches) = media_branches {
+        schema.insert("oneOf".to_owned(), Value::Array(media_branches));
+    }
+    Ok(Value::Object(schema))
+}
+
+fn normalized_input_schema(
+    schema: &Value,
+    dialect: OpenApiSchemaDialect,
+) -> Result<Value, OpenApiError> {
+    let mut schema = schema.clone();
+    validate_schema_dialect_declarations(&schema, dialect)?;
+    normalize_request_schema(&mut schema);
+    if matches!(dialect, OpenApiSchemaDialect::OpenApi30) {
+        normalize_openapi30_schema(&mut schema);
+    }
+    Ok(schema)
+}
+
+fn validate_schema_dialect_declarations(
+    value: &Value,
+    dialect: OpenApiSchemaDialect,
+) -> Result<(), OpenApiError> {
+    let Value::Object(schema) = value else {
+        return Ok(());
+    };
+    if let Some(declared) = schema.get("$schema") {
+        let declared = declared.as_str().ok_or(OpenApiError::InvalidDocument(
+            "a Schema Object $schema declaration must be a URI string",
+        ))?;
+        let declared = declared.strip_suffix('#').unwrap_or(declared);
+        if matches!(dialect, OpenApiSchemaDialect::OpenApi30)
+            || !matches!(declared, OAS31_BASE_DIALECT | JSON_SCHEMA_2020_12_DIALECT)
+        {
+            return Err(OpenApiError::InvalidDocument(
+                "a Schema Object uses an unsupported JSON Schema dialect",
+            ));
+        }
+    }
+    for keyword in [
+        "additionalItems",
+        "additionalProperties",
+        "contains",
+        "contentSchema",
+        "else",
+        "if",
+        "items",
+        "not",
+        "propertyNames",
+        "then",
+        "unevaluatedItems",
+        "unevaluatedProperties",
+    ] {
+        if let Some(child) = schema.get(keyword) {
+            validate_schema_dialect_declarations(child, dialect)?;
+        }
+    }
+    for keyword in [
+        "$defs",
+        "definitions",
+        "dependentSchemas",
+        "patternProperties",
+        "properties",
+    ] {
+        if let Some(children) = schema.get(keyword).and_then(Value::as_object) {
+            for child in children.values() {
+                validate_schema_dialect_declarations(child, dialect)?;
+            }
+        }
+    }
+    for keyword in ["allOf", "anyOf", "oneOf", "prefixItems"] {
+        if let Some(children) = schema.get(keyword).and_then(Value::as_array) {
+            for child in children {
+                validate_schema_dialect_declarations(child, dialect)?;
+            }
+        }
+    }
+    Ok(())
+}
+
+fn normalize_request_schema(value: &mut Value) {
+    let Value::Object(schema) = value else {
+        return;
+    };
+    for keyword in [
+        "additionalItems",
+        "additionalProperties",
+        "contains",
+        "contentSchema",
+        "else",
+        "if",
+        "items",
+        "not",
+        "propertyNames",
+        "then",
+        "unevaluatedItems",
+        "unevaluatedProperties",
+    ] {
+        if let Some(child) = schema.get_mut(keyword) {
+            normalize_request_schema(child);
+        }
+    }
+    for keyword in [
+        "$defs",
+        "definitions",
+        "dependentSchemas",
+        "patternProperties",
+        "properties",
+    ] {
+        if let Some(children) = schema.get_mut(keyword).and_then(Value::as_object_mut) {
+            children.values_mut().for_each(normalize_request_schema);
+        }
+    }
+    for keyword in ["allOf", "anyOf", "oneOf", "prefixItems"] {
+        if let Some(children) = schema.get_mut(keyword).and_then(Value::as_array_mut) {
+            children.iter_mut().for_each(normalize_request_schema);
+        }
+    }
+    let read_only = schema
+        .get("properties")
+        .and_then(Value::as_object)
+        .map(|properties| {
+            properties
+                .iter()
+                .filter(|(_, property)| property.get("readOnly") == Some(&Value::Bool(true)))
+                .map(|(name, _)| name.clone())
+                .collect::<std::collections::HashSet<_>>()
+        })
+        .unwrap_or_default();
+    if let Some(required) = schema.get_mut("required").and_then(Value::as_array_mut) {
+        required.retain(|name| name.as_str().is_none_or(|name| !read_only.contains(name)));
+    }
+}
+
+fn normalize_openapi30_schema(value: &mut Value) {
+    let Value::Object(schema) = value else {
+        return;
+    };
+    for keyword in [
+        "additionalItems",
+        "additionalProperties",
+        "contains",
+        "contentSchema",
+        "else",
+        "if",
+        "items",
+        "not",
+        "propertyNames",
+        "then",
+        "unevaluatedItems",
+        "unevaluatedProperties",
+    ] {
+        if let Some(child) = schema.get_mut(keyword) {
+            normalize_openapi30_schema(child);
+        }
+    }
+    for keyword in [
+        "$defs",
+        "definitions",
+        "dependentSchemas",
+        "patternProperties",
+        "properties",
+    ] {
+        if let Some(children) = schema.get_mut(keyword).and_then(Value::as_object_mut) {
+            children.values_mut().for_each(normalize_openapi30_schema);
+        }
+    }
+    for keyword in ["allOf", "anyOf", "oneOf", "prefixItems"] {
+        if let Some(children) = schema.get_mut(keyword).and_then(Value::as_array_mut) {
+            children.iter_mut().for_each(normalize_openapi30_schema);
+        }
+    }
+    normalize_openapi30_exclusive_bound(schema, "minimum", "exclusiveMinimum");
+    normalize_openapi30_exclusive_bound(schema, "maximum", "exclusiveMaximum");
+    if schema.remove("nullable") == Some(Value::Bool(true)) {
+        match schema.remove("type") {
+            Some(Value::String(schema_type)) => {
+                schema.insert(
+                    "type".to_owned(),
+                    Value::Array(vec![
+                        Value::String(schema_type),
+                        Value::String("null".to_owned()),
+                    ]),
+                );
+            }
+            Some(Value::Array(mut schema_types)) => {
+                if !schema_types.iter().any(|schema_type| schema_type == "null") {
+                    schema_types.push(Value::String("null".to_owned()));
+                }
+                schema.insert("type".to_owned(), Value::Array(schema_types));
+            }
+            Some(schema_type) => {
+                schema.insert("type".to_owned(), schema_type);
+            }
+            None => {}
+        }
+    }
+}
+
+fn normalize_openapi30_exclusive_bound(
+    schema: &mut Map<String, Value>,
+    inclusive_name: &str,
+    exclusive_name: &str,
+) {
+    match schema.remove(exclusive_name) {
+        Some(Value::Bool(true)) => {
+            if let Some(bound) = schema.remove(inclusive_name) {
+                schema.insert(exclusive_name.to_owned(), bound);
+            }
+        }
+        Some(Value::Bool(false)) | None => {}
+        Some(value) => {
+            schema.insert(exclusive_name.to_owned(), value);
+        }
+    }
+}
+
+fn parse_output_schema(
+    value: Option<&Value>,
+    root: &Value,
+    method: &str,
+    path: &str,
+    budget: &mut CompileBudget,
+) -> Result<Option<Value>, OpenApiError> {
+    let Some(responses) = value else {
+        return Ok(None);
+    };
+    let responses = responses
+        .as_object()
+        .ok_or_else(|| invalid_operation(method, path, "responses must be an object"))?;
+    let response = responses
+        .iter()
+        .filter(|(status, _)| {
+            status.len() == 3
+                && status.starts_with('2')
+                && status[1..]
+                    .chars()
+                    .all(|character| character.is_ascii_digit())
+        })
+        .min_by_key(|(status, _)| *status)
+        .map(|(_, response)| response)
+        .or_else(|| responses.get("2XX"))
+        .or_else(|| responses.get("default"));
+    let Some(response) = response else {
+        return Ok(None);
+    };
+    let mut stack = Vec::new();
+    let response = resolve_value(response, root, &mut stack, 0, budget)?;
+    let content = response
+        .as_object()
+        .and_then(|response| response.get("content"))
+        .and_then(Value::as_object);
+    Ok(content
+        .and_then(select_media)
+        .and_then(|(_, media)| media.get("schema"))
+        .cloned())
+}
+
+fn stable_key(method: &str, path: &str) -> String {
+    let digest = Sha256::digest(format!("{}\n{path}", method.to_ascii_uppercase()));
+    let digest = digest
+        .iter()
+        .map(|byte| format!("{byte:02x}"))
+        .collect::<String>();
+    format!("openapi:v1:{digest}")
+}
+
+fn fallback_name(method: &str, path: &str) -> String {
+    let mut name = method.to_owned();
+    for segment in path.split('/') {
+        let segment = segment.trim_matches(['{', '}']);
+        if !segment.is_empty() {
+            name.push('_');
+            name.push_str(segment);
+        }
+    }
+    name
+}
+
+fn intrinsic_mode(method: &str) -> ToolMode {
+    match method {
+        "get" | "head" | "options" => ToolMode::Enabled,
+        "post" | "put" | "patch" | "delete" => ToolMode::Ask,
+        _ => ToolMode::Disabled,
+    }
+}
+
+fn object_field<'a>(
+    object: &'a Map<String, Value>,
+    field: &'static str,
+) -> Result<&'a Map<String, Value>, OpenApiError> {
+    object
+        .get(field)
+        .and_then(Value::as_object)
+        .ok_or(OpenApiError::InvalidDocument(
+            "a required object field is missing",
+        ))
+}
+
+fn string_field<'a>(
+    object: &'a Map<String, Value>,
+    field: &'static str,
+) -> Result<&'a str, OpenApiError> {
+    object
+        .get(field)
+        .and_then(Value::as_str)
+        .ok_or(OpenApiError::InvalidDocument(
+            "a required string field is missing",
+        ))
+}
+
+fn optional_string<'a>(
+    object: &'a Map<String, Value>,
+    field: &'static str,
+) -> Result<Option<&'a str>, OpenApiError> {
+    match object.get(field) {
+        None | Some(Value::Null) => Ok(None),
+        Some(Value::String(value)) => Ok(Some(value)),
+        Some(_) => Err(OpenApiError::InvalidDocument(
+            "an optional string field is invalid",
+        )),
+    }
+}
+
+fn invalid_operation(method: &str, path: &str, message: &'static str) -> OpenApiError {
+    OpenApiError::InvalidOperation {
+        method: method.to_ascii_uppercase(),
+        path: path.to_owned(),
+        message,
+    }
+}
+
+fn limit(code: &'static str) -> OpenApiError {
+    OpenApiError::LimitExceeded { code }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{percent_decode, stable_key};
+
+    #[test]
+    fn percent_decoding_handles_local_pointer_fragments() {
+        assert_eq!(percent_decode("/a%20b"), Some("/a b".to_owned()));
+        assert_eq!(percent_decode("/%GG"), None);
+    }
+
+    #[test]
+    fn stable_keys_are_case_normalized_and_path_sensitive() {
+        assert_eq!(stable_key("get", "/pets"), stable_key("GET", "/pets"));
+        assert_ne!(stable_key("get", "/pets"), stable_key("get", "/pets/"));
+    }
+}
diff --git a/src/outbound.rs b/src/outbound.rs
new file mode 100644
index 000000000..d0965547e
--- /dev/null
+++ b/src/outbound.rs
@@ -0,0 +1,919 @@
+use std::{
+    collections::HashSet,
+    net::{IpAddr, Ipv4Addr, Ipv6Addr, SocketAddr},
+    time::Duration,
+};
+
+#[cfg(test)]
+use std::collections::HashMap;
+
+use reqwest::{
+    Method, StatusCode,
+    header::{
+        ACCEPT_ENCODING, CONNECTION, CONTENT_ENCODING, CONTENT_LENGTH, HeaderMap, HeaderName,
+        LOCATION, REFERER, TE, TRAILER, TRANSFER_ENCODING, UPGRADE,
+    },
+    redirect::Policy,
+};
+use thiserror::Error;
+use url::{Host, Url};
+
+const DEFAULT_MAX_REQUEST_BYTES: usize = 8 * 1024 * 1024;
+const DEFAULT_MAX_RESPONSE_BYTES: usize = 16 * 1024 * 1024;
+const DEFAULT_MAX_HEADER_BYTES: usize = 64 * 1024;
+const DEFAULT_MAX_REDIRECTS: usize = 3;
+const DEFAULT_CONNECT_TIMEOUT: Duration = Duration::from_secs(5);
+const DEFAULT_REQUEST_TIMEOUT: Duration = Duration::from_secs(30);
+const MAX_URL_BYTES: usize = 16 * 1024;
+const MAX_DNS_ADDRESSES: usize = 32;
+const AWS_METADATA_IPV6: Ipv6Addr = Ipv6Addr::new(0xfd00, 0x0ec2, 0, 0, 0, 0, 0, 0x0254);
+const GOOGLE_METADATA_IPV6: Ipv6Addr = Ipv6Addr::new(0xfd20, 0x00ce, 0, 0, 0, 0, 0, 0x0254);
+const ORACLE_METADATA_IPV6: Ipv6Addr = Ipv6Addr::new(0xfd00, 0x00c1, 0, 0, 0, 0, 0xa9fe, 0xa9fe);
+
+#[derive(Clone, Debug)]
+pub struct OutboundPolicy {
+    pub allow_private_networks: bool,
+    pub require_https_or_loopback: bool,
+    pub max_request_bytes: usize,
+    pub max_response_bytes: usize,
+    pub max_header_bytes: usize,
+    pub max_redirects: usize,
+    pub connect_timeout: Duration,
+    pub request_timeout: Duration,
+}
+
+impl Default for OutboundPolicy {
+    fn default() -> Self {
+        Self {
+            allow_private_networks: false,
+            require_https_or_loopback: false,
+            max_request_bytes: DEFAULT_MAX_REQUEST_BYTES,
+            max_response_bytes: DEFAULT_MAX_RESPONSE_BYTES,
+            max_header_bytes: DEFAULT_MAX_HEADER_BYTES,
+            max_redirects: DEFAULT_MAX_REDIRECTS,
+            connect_timeout: DEFAULT_CONNECT_TIMEOUT,
+            request_timeout: DEFAULT_REQUEST_TIMEOUT,
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum AddressClass {
+    Public,
+    Private,
+    Forbidden,
+}
+
+#[derive(Debug, Error)]
+pub enum OutboundError {
+    #[error("the outbound URL is invalid")]
+    InvalidUrl,
+    #[error("the outbound URL must use HTTP or HTTPS")]
+    UnsupportedScheme,
+    #[error("the outbound URL must not contain credentials")]
+    CredentialsNotAllowed,
+    #[error("the outbound URL must not contain a fragment")]
+    FragmentNotAllowed,
+    #[error("the outbound URL must contain a host")]
+    MissingHost,
+    #[error("plaintext outbound transport is allowed only for loopback addresses")]
+    InsecureTransport,
+    #[error("the outbound URL has no usable port")]
+    MissingPort,
+    #[error("the outbound host resolves to a private address")]
+    PrivateAddress,
+    #[error("the outbound host resolves to a forbidden address")]
+    ForbiddenAddress,
+    #[error("the outbound host could not be resolved")]
+    DnsResolution,
+    #[error("the outbound request contains a forbidden header")]
+    ForbiddenHeader,
+    #[error("the outbound request method is not allowed")]
+    ForbiddenMethod,
+    #[error("the outbound request headers are too large")]
+    RequestHeadersTooLarge,
+    #[error("the outbound request body is too large")]
+    RequestBodyTooLarge,
+    #[error("the outbound HTTP client could not be initialized")]
+    ClientInitialization,
+    #[error("the outbound request timed out")]
+    Timeout,
+    #[error("the outbound connection failed")]
+    Connection,
+    #[error("the outbound request failed")]
+    Request,
+    #[error("the upstream response headers are too large")]
+    ResponseHeadersTooLarge,
+    #[error("the upstream response body is too large")]
+    ResponseBodyTooLarge,
+    #[error("the upstream response uses an unsupported content encoding")]
+    UnsupportedContentEncoding,
+    #[error("the upstream redirect has no valid Location header")]
+    InvalidRedirect,
+    #[error("the upstream redirect would downgrade HTTPS to HTTP")]
+    RedirectDowngrade,
+    #[error("the upstream redirect looped")]
+    RedirectLoop,
+    #[error("the upstream response exceeded the redirect limit")]
+    TooManyRedirects,
+    #[error("the upstream server returned HTTP {status}")]
+    UpstreamStatus { status: StatusCode },
+}
+
+impl OutboundError {
+    pub fn code(&self) -> &'static str {
+        match self {
+            Self::InvalidUrl => "invalid_outbound_url",
+            Self::UnsupportedScheme => "unsupported_outbound_scheme",
+            Self::CredentialsNotAllowed => "outbound_credentials_not_allowed",
+            Self::FragmentNotAllowed => "outbound_fragment_not_allowed",
+            Self::MissingHost | Self::MissingPort => "invalid_outbound_host",
+            Self::InsecureTransport => "insecure_outbound_transport",
+            Self::PrivateAddress => "private_network_denied",
+            Self::ForbiddenAddress => "forbidden_network_target",
+            Self::DnsResolution => "dns_resolution_failed",
+            Self::ForbiddenHeader => "forbidden_outbound_header",
+            Self::ForbiddenMethod => "forbidden_outbound_method",
+            Self::RequestHeadersTooLarge => "outbound_headers_too_large",
+            Self::RequestBodyTooLarge => "outbound_request_too_large",
+            Self::ClientInitialization => "outbound_client_failed",
+            Self::Timeout => "upstream_timeout",
+            Self::Connection => "upstream_connection_failed",
+            Self::Request => "upstream_request_failed",
+            Self::ResponseHeadersTooLarge => "upstream_headers_too_large",
+            Self::ResponseBodyTooLarge => "upstream_response_too_large",
+            Self::UnsupportedContentEncoding => "unsupported_content_encoding",
+            Self::InvalidRedirect => "invalid_upstream_redirect",
+            Self::RedirectDowngrade => "redirect_downgrade_denied",
+            Self::RedirectLoop => "upstream_redirect_loop",
+            Self::TooManyRedirects => "too_many_upstream_redirects",
+            Self::UpstreamStatus { .. } => "upstream_http_error",
+        }
+    }
+}
+
+#[derive(Clone)]
+pub struct OutboundRequest {
+    pub method: Method,
+    pub url: Url,
+    pub headers: HeaderMap,
+    pub body: Vec<u8>,
+}
+
+impl OutboundRequest {
+    pub fn new(method: Method, url: Url) -> Self {
+        Self {
+            method,
+            url,
+            headers: HeaderMap::new(),
+            body: Vec::new(),
+        }
+    }
+}
+
+pub struct OutboundResponse {
+    pub status: StatusCode,
+    pub headers: HeaderMap,
+    pub body: Vec<u8>,
+    pub final_url: Url,
+}
+
+pub struct OutboundStreamResponse {
+    pub status: StatusCode,
+    pub headers: HeaderMap,
+    pub final_url: Url,
+    response: reqwest::Response,
+    bytes_read: usize,
+    max_response_bytes: usize,
+    timeout: StreamTimeout,
+    declared_response_too_large: bool,
+}
+
+enum StreamTimeout {
+    Absolute(tokio::time::Instant),
+    Idle(Duration),
+}
+
+impl OutboundStreamResponse {
+    pub fn declared_response_too_large(&self) -> bool {
+        self.declared_response_too_large
+    }
+
+    pub async fn next_chunk(&mut self) -> Result<Option<Vec<u8>>, OutboundError> {
+        let remaining = match self.timeout {
+            StreamTimeout::Absolute(deadline) => deadline
+                .checked_duration_since(tokio::time::Instant::now())
+                .ok_or(OutboundError::Timeout)?,
+            StreamTimeout::Idle(timeout) => timeout,
+        };
+        let Some(chunk) = tokio::time::timeout(remaining, self.response.chunk())
+            .await
+            .map_err(|_| OutboundError::Timeout)?
+            .map_err(map_reqwest_error)?
+        else {
+            return Ok(None);
+        };
+        match self.timeout {
+            StreamTimeout::Absolute(_) => {
+                self.bytes_read = self
+                    .bytes_read
+                    .checked_add(chunk.len())
+                    .ok_or(OutboundError::ResponseBodyTooLarge)?;
+                if self.bytes_read > self.max_response_bytes {
+                    return Err(OutboundError::ResponseBodyTooLarge);
+                }
+            }
+            StreamTimeout::Idle(_) if chunk.len() > self.max_response_bytes => {
+                return Err(OutboundError::ResponseBodyTooLarge);
+            }
+            StreamTimeout::Idle(_) => {}
+        }
+        Ok(Some(chunk.to_vec()))
+    }
+}
+
+#[derive(Clone, Debug)]
+pub struct HardenedHttpClient {
+    policy: OutboundPolicy,
+    #[cfg(test)]
+    test_dns_resolutions: HashMap<String, Vec<IpAddr>>,
+}
+
+pub fn parse_url(input: &str, policy: &OutboundPolicy) -> Result<Url, OutboundError> {
+    let url = Url::parse(input).map_err(|_| OutboundError::InvalidUrl)?;
+    validate_url(&url, policy)?;
+    Ok(url)
+}
+
+impl HardenedHttpClient {
+    pub fn new(policy: OutboundPolicy) -> Self {
+        Self {
+            policy,
+            #[cfg(test)]
+            test_dns_resolutions: HashMap::new(),
+        }
+    }
+
+    #[cfg(test)]
+    pub(crate) fn with_test_dns_resolution(
+        mut self,
+        hostname: impl Into<String>,
+        addresses: Vec<IpAddr>,
+    ) -> Self {
+        self.test_dns_resolutions
+            .insert(hostname.into().to_ascii_lowercase(), addresses);
+        self
+    }
+
+    pub async fn execute(
+        &self,
+        request: OutboundRequest,
+    ) -> Result<OutboundResponse, OutboundError> {
+        validate_request(&request, &self.policy)?;
+        tokio::time::timeout(self.policy.request_timeout, self.execute_once(request))
+            .await
+            .map_err(|_| OutboundError::Timeout)?
+    }
+
+    pub async fn execute_streaming(
+        &self,
+        request: OutboundRequest,
+    ) -> Result<OutboundStreamResponse, OutboundError> {
+        validate_request(&request, &self.policy)?;
+        tokio::time::timeout(
+            self.policy.request_timeout,
+            self.execute_streaming_once(request, false, false),
+        )
+        .await
+        .map_err(|_| OutboundError::Timeout)?
+    }
+
+    pub async fn execute_streaming_headers_first(
+        &self,
+        request: OutboundRequest,
+    ) -> Result<OutboundStreamResponse, OutboundError> {
+        validate_request(&request, &self.policy)?;
+        tokio::time::timeout(
+            self.policy.request_timeout,
+            self.execute_streaming_once(request, false, true),
+        )
+        .await
+        .map_err(|_| OutboundError::Timeout)?
+    }
+
+    pub async fn execute_long_lived_streaming(
+        &self,
+        request: OutboundRequest,
+        idle_timeout: Duration,
+    ) -> Result<OutboundStreamResponse, OutboundError> {
+        validate_request(&request, &self.policy)?;
+        tokio::time::timeout(
+            self.policy.request_timeout,
+            self.execute_streaming_once(request, true, true),
+        )
+        .await
+        .map_err(|_| OutboundError::Timeout)?
+        .map(|mut response| {
+            response.timeout = StreamTimeout::Idle(idle_timeout);
+            response
+        })
+    }
+
+    pub async fn fetch_spec(
+        &self,
+        url: Url,
+        headers: HeaderMap,
+    ) -> Result<OutboundResponse, OutboundError> {
+        self.fetch_spec_with_url_policy(url, headers, |_| Ok(()))
+            .await
+    }
+
+    pub async fn fetch_spec_with_url_policy<F>(
+        &self,
+        url: Url,
+        headers: HeaderMap,
+        validate_url_policy: F,
+    ) -> Result<OutboundResponse, OutboundError>
+    where
+        F: Fn(&Url) -> Result<(), OutboundError>,
+    {
+        tokio::time::timeout(
+            self.policy.request_timeout,
+            self.fetch_spec_with_redirects(url, headers, &validate_url_policy),
+        )
+        .await
+        .map_err(|_| OutboundError::Timeout)?
+    }
+
+    async fn fetch_spec_with_redirects(
+        &self,
+        url: Url,
+        headers: HeaderMap,
+        validate_url_policy: &impl Fn(&Url) -> Result<(), OutboundError>,
+    ) -> Result<OutboundResponse, OutboundError> {
+        validate_headers(&headers, self.policy.max_header_bytes)?;
+        let mut current = url;
+        let mut headers = headers;
+        let mut visited = HashSet::new();
+
+        for redirect_count in 0..=self.policy.max_redirects {
+            validate_url_policy(&current)?;
+            validate_url(&current, &self.policy)?;
+            if !visited.insert(current.as_str().to_owned()) {
+                return Err(OutboundError::RedirectLoop);
+            }
+
+            let response = self
+                .execute_once(OutboundRequest {
+                    method: Method::GET,
+                    url: current.clone(),
+                    headers: headers.clone(),
+                    body: Vec::new(),
+                })
+                .await?;
+            if !is_redirect(response.status) {
+                if response.status.is_success() {
+                    return Ok(response);
+                }
+                return Err(OutboundError::UpstreamStatus {
+                    status: response.status,
+                });
+            }
+            if redirect_count == self.policy.max_redirects {
+                return Err(OutboundError::TooManyRedirects);
+            }
+
+            let unchecked_next = joined_redirect_target(&current, response.headers.get(LOCATION))?;
+            validate_url_policy(&unchecked_next)?;
+            let next = redirect_target(&current, response.headers.get(LOCATION), &self.policy)?;
+            if !same_origin(&current, &next) {
+                strip_cross_origin_headers(&mut headers);
+            }
+            current = next;
+        }
+
+        Err(OutboundError::TooManyRedirects)
+    }
+
+    async fn execute_once(
+        &self,
+        request: OutboundRequest,
+    ) -> Result<OutboundResponse, OutboundError> {
+        let mut response = self.execute_streaming_once(request, false, false).await?;
+        let mut body = Vec::new();
+        while let Some(chunk) = response.next_chunk().await? {
+            body.extend_from_slice(&chunk);
+        }
+        Ok(OutboundResponse {
+            status: response.status,
+            headers: response.headers,
+            body,
+            final_url: response.final_url,
+        })
+    }
+
+    async fn execute_streaming_once(
+        &self,
+        mut request: OutboundRequest,
+        long_lived: bool,
+        allow_declared_oversize: bool,
+    ) -> Result<OutboundStreamResponse, OutboundError> {
+        validate_request(&request, &self.policy)?;
+        let resolved = resolve_target(
+            &request.url,
+            &self.policy,
+            #[cfg(test)]
+            &self.test_dns_resolutions,
+        )
+        .await?;
+        if !request.headers.contains_key(ACCEPT_ENCODING) {
+            request.headers.insert(
+                ACCEPT_ENCODING,
+                "identity".parse().expect("static header is valid"),
+            );
+        }
+        validate_headers(&request.headers, self.policy.max_header_bytes)?;
+
+        let mut builder = reqwest::Client::builder()
+            .no_proxy()
+            .redirect(Policy::none())
+            .referer(false)
+            .connect_timeout(self.policy.connect_timeout)
+            .pool_max_idle_per_host(0);
+        if !long_lived {
+            builder = builder.timeout(self.policy.request_timeout);
+        }
+        if let Some(hostname) = resolved.hostname.as_deref() {
+            builder = builder.resolve_to_addrs(hostname, &resolved.addresses);
+        }
+        let client = builder
+            .build()
+            .map_err(|_| OutboundError::ClientInitialization)?;
+        let response = client
+            .request(request.method, request.url.clone())
+            .headers(request.headers)
+            .body(request.body)
+            .send()
+            .await
+            .map_err(map_reqwest_error)?;
+        let declared_response_too_large =
+            match validate_response_headers(response.headers(), &self.policy) {
+                Err(OutboundError::ResponseBodyTooLarge) if allow_declared_oversize => true,
+                Err(error) => return Err(error),
+                Ok(()) => false,
+            };
+        Ok(OutboundStreamResponse {
+            status: response.status(),
+            headers: response.headers().clone(),
+            final_url: request.url,
+            response,
+            bytes_read: 0,
+            max_response_bytes: self.policy.max_response_bytes,
+            timeout: StreamTimeout::Absolute(
+                tokio::time::Instant::now() + self.policy.request_timeout,
+            ),
+            declared_response_too_large,
+        })
+    }
+}
+
+struct ResolvedTarget {
+    hostname: Option<String>,
+    addresses: Vec<SocketAddr>,
+}
+
+async fn resolve_target(
+    url: &Url,
+    policy: &OutboundPolicy,
+    #[cfg(test)] test_dns_resolutions: &HashMap<String, Vec<IpAddr>>,
+) -> Result<ResolvedTarget, OutboundError> {
+    validate_url(url, policy)?;
+    let port = url
+        .port_or_known_default()
+        .ok_or(OutboundError::MissingPort)?;
+    match url.host().ok_or(OutboundError::MissingHost)? {
+        Host::Ipv4(address) => {
+            validate_address(IpAddr::V4(address), policy)?;
+            let resolved = ResolvedTarget {
+                hostname: None,
+                addresses: vec![SocketAddr::new(IpAddr::V4(address), port)],
+            };
+            validate_resolved_transport(url, &resolved.addresses, policy)?;
+            Ok(resolved)
+        }
+        Host::Ipv6(address) => {
+            let address = canonical_ip(IpAddr::V6(address));
+            validate_address(address, policy)?;
+            let resolved = ResolvedTarget {
+                hostname: None,
+                addresses: vec![SocketAddr::new(address, port)],
+            };
+            validate_resolved_transport(url, &resolved.addresses, policy)?;
+            Ok(resolved)
+        }
+        Host::Domain(hostname) => {
+            #[cfg(test)]
+            if let Some(addresses) = test_dns_resolutions.get(hostname) {
+                return resolved_domain_target(
+                    url,
+                    hostname,
+                    port,
+                    addresses
+                        .iter()
+                        .map(|address| SocketAddr::new(*address, port))
+                        .collect(),
+                    policy,
+                );
+            }
+            let addresses = tokio::time::timeout(
+                policy.connect_timeout,
+                tokio::net::lookup_host((hostname, port)),
+            )
+            .await
+            .map_err(|_| OutboundError::Timeout)?
+            .map_err(|_| OutboundError::DnsResolution)?
+            .map(|address| SocketAddr::new(canonical_ip(address.ip()), address.port()))
+            .take(MAX_DNS_ADDRESSES + 1)
+            .collect::<Vec<_>>();
+            resolved_domain_target(url, hostname, port, addresses, policy)
+        }
+    }
+}
+
+fn resolved_domain_target(
+    url: &Url,
+    hostname: &str,
+    port: u16,
+    addresses: Vec<SocketAddr>,
+    policy: &OutboundPolicy,
+) -> Result<ResolvedTarget, OutboundError> {
+    let mut addresses = addresses
+        .into_iter()
+        .map(|address| SocketAddr::new(canonical_ip(address.ip()), port))
+        .take(MAX_DNS_ADDRESSES + 1)
+        .collect::<Vec<_>>();
+    if addresses.len() > MAX_DNS_ADDRESSES {
+        return Err(OutboundError::DnsResolution);
+    }
+    addresses.sort_unstable();
+    addresses.dedup();
+    if addresses.is_empty() {
+        return Err(OutboundError::DnsResolution);
+    }
+    for address in &addresses {
+        validate_address(address.ip(), policy)?;
+    }
+    validate_resolved_transport(url, &addresses, policy)?;
+    Ok(ResolvedTarget {
+        hostname: Some(hostname.to_owned()),
+        addresses,
+    })
+}
+
+fn validate_resolved_transport(
+    url: &Url,
+    addresses: &[SocketAddr],
+    policy: &OutboundPolicy,
+) -> Result<(), OutboundError> {
+    if !policy.require_https_or_loopback || url.scheme() == "https" {
+        return Ok(());
+    }
+    if url.scheme() == "http"
+        && addresses
+            .iter()
+            .all(|address| canonical_ip(address.ip()).is_loopback())
+    {
+        Ok(())
+    } else {
+        Err(OutboundError::InsecureTransport)
+    }
+}
+
+pub fn validate_url(url: &Url, policy: &OutboundPolicy) -> Result<(), OutboundError> {
+    if url.as_str().len() > MAX_URL_BYTES {
+        return Err(OutboundError::InvalidUrl);
+    }
+    if !matches!(url.scheme(), "http" | "https") {
+        return Err(OutboundError::UnsupportedScheme);
+    }
+    if !url.username().is_empty() || url.password().is_some() {
+        return Err(OutboundError::CredentialsNotAllowed);
+    }
+    if url.fragment().is_some() {
+        return Err(OutboundError::FragmentNotAllowed);
+    }
+    let host = url.host().ok_or(OutboundError::MissingHost)?;
+    if url.port_or_known_default().is_none_or(|port| port == 0) {
+        return Err(OutboundError::MissingPort);
+    }
+    match host {
+        Host::Ipv4(address) => validate_address(IpAddr::V4(address), policy),
+        Host::Ipv6(address) => validate_address(canonical_ip(IpAddr::V6(address)), policy),
+        Host::Domain(_) => Ok(()),
+    }
+}
+
+pub fn classify_ip(address: IpAddr) -> AddressClass {
+    match canonical_ip(address) {
+        IpAddr::V4(address) => classify_ipv4(address),
+        IpAddr::V6(address) => classify_ipv6(address),
+    }
+}
+
+fn classify_ipv4(address: Ipv4Addr) -> AddressClass {
+    let octets = address.octets();
+    if octets == [100, 100, 100, 200] {
+        return AddressClass::Forbidden;
+    }
+    if octets[0] == 10
+        || octets[0] == 127
+        || (octets[0] == 172 && (16..=31).contains(&octets[1]))
+        || (octets[0] == 192 && octets[1] == 168)
+        || (octets[0] == 100 && (64..=127).contains(&octets[1]))
+    {
+        return AddressClass::Private;
+    }
+    if octets[0] == 0
+        || (octets[0] == 169 && octets[1] == 254)
+        || (octets[0] == 192 && octets[1] == 0 && octets[2] == 0)
+        || (octets[0] == 192 && octets[1] == 0 && octets[2] == 2)
+        || (octets[0] == 192 && octets[1] == 88 && octets[2] == 99)
+        || (octets[0] == 198 && (octets[1] == 18 || octets[1] == 19))
+        || (octets[0] == 198 && octets[1] == 51 && octets[2] == 100)
+        || (octets[0] == 203 && octets[1] == 0 && octets[2] == 113)
+        || octets[0] >= 224
+    {
+        AddressClass::Forbidden
+    } else {
+        AddressClass::Public
+    }
+}
+
+fn classify_ipv6(address: Ipv6Addr) -> AddressClass {
+    if matches!(
+        address,
+        AWS_METADATA_IPV6 | GOOGLE_METADATA_IPV6 | ORACLE_METADATA_IPV6
+    ) {
+        return AddressClass::Forbidden;
+    }
+    if address.is_loopback() || (address.segments()[0] & 0xfe00) == 0xfc00 {
+        return AddressClass::Private;
+    }
+    let segments = address.segments();
+    let globally_routable_prefix = (segments[0] & 0xe000) == 0x2000;
+    let documentation = segments[0] == 0x2001 && segments[1] == 0x0db8;
+    let ietf_protocol_assignments = segments[0] == 0x2001 && segments[1] <= 0x01ff;
+    let benchmarking = segments[0] == 0x2001 && segments[1] == 0x0002;
+    let teredo = segments[0] == 0x2001 && segments[1] == 0;
+    let orchid = segments[0] == 0x2001 && matches!(segments[1] & 0xfff0, 0x0010 | 0x0020);
+    let documentation_v2 = segments[0] == 0x3fff && (segments[1] & 0xf000) == 0;
+    let discard_only = segments[0] == 0x0100 && segments[1..4] == [0, 0, 0];
+    let translation_private = segments[0] == 0x0064 && segments[1] == 0xff9b && segments[2] == 1;
+    let link_local = (segments[0] & 0xffc0) == 0xfe80;
+    let site_local = (segments[0] & 0xffc0) == 0xfec0;
+    if !globally_routable_prefix
+        || documentation
+        || ietf_protocol_assignments
+        || benchmarking
+        || teredo
+        || orchid
+        || documentation_v2
+        || discard_only
+        || translation_private
+        || link_local
+        || site_local
+        || address.is_multicast()
+        || address.is_unspecified()
+    {
+        AddressClass::Forbidden
+    } else if segments[0] == 0x2002 {
+        let embedded = Ipv4Addr::new(
+            (segments[1] >> 8) as u8,
+            segments[1] as u8,
+            (segments[2] >> 8) as u8,
+            segments[2] as u8,
+        );
+        classify_ipv4(embedded)
+    } else {
+        AddressClass::Public
+    }
+}
+
+fn validate_address(address: IpAddr, policy: &OutboundPolicy) -> Result<(), OutboundError> {
+    match classify_ip(address) {
+        AddressClass::Public => Ok(()),
+        AddressClass::Private if policy.allow_private_networks => Ok(()),
+        AddressClass::Private => Err(OutboundError::PrivateAddress),
+        AddressClass::Forbidden => Err(OutboundError::ForbiddenAddress),
+    }
+}
+
+fn canonical_ip(address: IpAddr) -> IpAddr {
+    match address {
+        IpAddr::V6(address) => address
+            .to_ipv4_mapped()
+            .map(IpAddr::V4)
+            .unwrap_or(IpAddr::V6(address)),
+        address => address,
+    }
+}
+
+pub fn redirect_target(
+    current: &Url,
+    location: Option<&reqwest::header::HeaderValue>,
+    policy: &OutboundPolicy,
+) -> Result<Url, OutboundError> {
+    let next = joined_redirect_target(current, location)?;
+    validate_url(&next, policy)?;
+    if current.scheme() == "https" && next.scheme() != "https" {
+        return Err(OutboundError::RedirectDowngrade);
+    }
+    Ok(next)
+}
+
+fn joined_redirect_target(
+    current: &Url,
+    location: Option<&reqwest::header::HeaderValue>,
+) -> Result<Url, OutboundError> {
+    let location = location
+        .and_then(|value| value.to_str().ok())
+        .ok_or(OutboundError::InvalidRedirect)?;
+    current
+        .join(location)
+        .map_err(|_| OutboundError::InvalidRedirect)
+}
+
+fn validate_request(
+    request: &OutboundRequest,
+    policy: &OutboundPolicy,
+) -> Result<(), OutboundError> {
+    validate_url(&request.url, policy)?;
+    if matches!(request.method, Method::TRACE | Method::CONNECT) {
+        return Err(OutboundError::ForbiddenMethod);
+    }
+    validate_headers(&request.headers, policy.max_header_bytes)?;
+    if request.body.len() > policy.max_request_bytes {
+        return Err(OutboundError::RequestBodyTooLarge);
+    }
+    Ok(())
+}
+
+fn validate_headers(headers: &HeaderMap, max_bytes: usize) -> Result<(), OutboundError> {
+    let mut total = 0_usize;
+    for (name, value) in headers {
+        if forbidden_request_header(name) {
+            return Err(OutboundError::ForbiddenHeader);
+        }
+        total = total
+            .checked_add(name.as_str().len())
+            .and_then(|length| length.checked_add(value.as_bytes().len()))
+            .ok_or(OutboundError::RequestHeadersTooLarge)?;
+        if total > max_bytes {
+            return Err(OutboundError::RequestHeadersTooLarge);
+        }
+    }
+    Ok(())
+}
+
+fn forbidden_request_header(name: &HeaderName) -> bool {
+    name == CONNECTION
+        || name == CONTENT_LENGTH
+        || name == TE
+        || name == TRAILER
+        || name == TRANSFER_ENCODING
+        || name == UPGRADE
+        || name == REFERER
+        || name == "host"
+        || name == "keep-alive"
+        || name.as_str().starts_with("proxy-")
+}
+
+fn validate_response_headers(
+    headers: &HeaderMap,
+    policy: &OutboundPolicy,
+) -> Result<(), OutboundError> {
+    let mut total = 0_usize;
+    for (name, value) in headers {
+        total = total
+            .checked_add(name.as_str().len())
+            .and_then(|length| length.checked_add(value.as_bytes().len()))
+            .ok_or(OutboundError::ResponseHeadersTooLarge)?;
+        if total > policy.max_header_bytes {
+            return Err(OutboundError::ResponseHeadersTooLarge);
+        }
+    }
+    for value in headers.get_all(CONTENT_ENCODING) {
+        if !value.as_bytes().eq_ignore_ascii_case(b"identity") {
+            return Err(OutboundError::UnsupportedContentEncoding);
+        }
+    }
+    let mut declared_length = None;
+    for value in headers.get_all(CONTENT_LENGTH) {
+        let length = value
+            .to_str()
+            .ok()
+            .and_then(|value| value.parse::<u64>().ok())
+            .ok_or(OutboundError::ResponseHeadersTooLarge)?;
+        if declared_length.is_some_and(|previous| previous != length) {
+            return Err(OutboundError::ResponseHeadersTooLarge);
+        }
+        if length > policy.max_response_bytes as u64 {
+            return Err(OutboundError::ResponseBodyTooLarge);
+        }
+        declared_length = Some(length);
+    }
+    Ok(())
+}
+
+fn same_origin(left: &Url, right: &Url) -> bool {
+    left.scheme() == right.scheme()
+        && left.host() == right.host()
+        && left.port_or_known_default() == right.port_or_known_default()
+}
+
+fn strip_cross_origin_headers(headers: &mut HeaderMap) {
+    headers.clear();
+}
+
+fn is_redirect(status: StatusCode) -> bool {
+    matches!(
+        status,
+        StatusCode::MOVED_PERMANENTLY
+            | StatusCode::FOUND
+            | StatusCode::SEE_OTHER
+            | StatusCode::TEMPORARY_REDIRECT
+            | StatusCode::PERMANENT_REDIRECT
+    )
+}
+
+fn map_reqwest_error(error: reqwest::Error) -> OutboundError {
+    if error.is_timeout() {
+        OutboundError::Timeout
+    } else if error.is_connect() {
+        OutboundError::Connection
+    } else {
+        OutboundError::Request
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[tokio::test]
+    async fn test_dns_override_still_runs_resolved_transport_policy() {
+        let client = HardenedHttpClient::new(OutboundPolicy {
+            allow_private_networks: true,
+            require_https_or_loopback: true,
+            ..OutboundPolicy::default()
+        })
+        .with_test_dns_resolution(
+            "poison.localhost",
+            vec![IpAddr::V4(Ipv4Addr::new(8, 8, 8, 8))],
+        );
+        let request = OutboundRequest::new(
+            Method::GET,
+            Url::parse("http://poison.localhost:8080/spec").expect("test URL parses"),
+        );
+
+        assert!(matches!(
+            client.execute(request).await,
+            Err(OutboundError::InsecureTransport)
+        ));
+    }
+
+    #[test]
+    fn resolved_plaintext_transport_requires_every_pinned_address_to_be_loopback() {
+        let policy = OutboundPolicy {
+            allow_private_networks: true,
+            require_https_or_loopback: true,
+            ..OutboundPolicy::default()
+        };
+        let http = Url::parse("http://localhost:8080/spec").expect("HTTP URL parses");
+        let loopback = [
+            SocketAddr::new(IpAddr::V4(Ipv4Addr::LOCALHOST), 8080),
+            SocketAddr::new(IpAddr::V6(Ipv6Addr::LOCALHOST), 8080),
+        ];
+        assert!(validate_resolved_transport(&http, &loopback, &policy).is_ok());
+
+        for poisoned in [
+            SocketAddr::new(IpAddr::V4(Ipv4Addr::new(8, 8, 8, 8)), 8080),
+            SocketAddr::new(IpAddr::V4(Ipv4Addr::new(10, 0, 0, 1)), 8080),
+        ] {
+            assert!(matches!(
+                validate_resolved_transport(&http, &[poisoned], &policy),
+                Err(OutboundError::InsecureTransport)
+            ));
+        }
+
+        let https = Url::parse("https://api.example.test/spec").expect("HTTPS URL parses");
+        assert!(
+            validate_resolved_transport(
+                &https,
+                &[SocketAddr::new(IpAddr::V4(Ipv4Addr::new(8, 8, 8, 8)), 443,)],
+                &policy,
+            )
+            .is_ok()
+        );
+    }
+}
diff --git a/src/protocols/graphql.rs b/src/protocols/graphql.rs
new file mode 100644
index 000000000..2e83696b5
--- /dev/null
+++ b/src/protocols/graphql.rs
@@ -0,0 +1,2639 @@
+use std::{
+    collections::{BTreeMap, BTreeSet},
+    sync::{Arc, OnceLock},
+};
+
+use base64::{Engine as _, engine::general_purpose::STANDARD};
+use reqwest::{
+    Method,
+    header::{self, HeaderMap, HeaderName, HeaderValue},
+};
+use serde::{Deserialize, Serialize};
+use serde_json::{Map, Value, json};
+use thiserror::Error;
+use tokio::sync::Semaphore;
+use url::{Host, Url};
+
+use super::{
+    ConfiguredCredential, CredentialMetadata, ProtocolError, ProtocolErrorCategory,
+    ProtocolExecutionResponse, ProtocolHttpMetadata, ProtocolResponseError, protocol_catalog_error,
+    protocol_outbound_error,
+};
+use crate::{
+    catalog::{
+        ArtifactKind, AuditContext, CatalogSnapshot, CatalogStore, CatalogSyncResult, CreateSource,
+        CredentialPayload, InitialCatalogSnapshot, OAuthBindingExpectation, SourceKind,
+        SourceRecord, StagedArtifact, StagedTool, StagedToolBinding, StoredCredential, ToolBinding,
+    },
+    graphql::{
+        CompiledGraphql, GraphqlBindingV1, GraphqlError, GraphqlOperation, INTROSPECTION_QUERY,
+        compile_introspection,
+    },
+    oauth::{OAuthBinding, OAuthError, OAuthService},
+    outbound::{HardenedHttpClient, OutboundError, OutboundPolicy, OutboundRequest, parse_url},
+};
+
+const GRAPHQL_CREDENTIAL_SCHEMA_VERSION: u32 = 1;
+const MAX_ENDPOINT_BYTES: usize = 16 * 1024;
+const MAX_CREDENTIAL_BYTES: usize = 16 * 1024;
+const MAX_HEADER_NAME_BYTES: usize = 256;
+const MAX_INTROSPECTION_BYTES: usize = 16 * 1024 * 1024;
+const GRAPHQL_COMPILE_CONCURRENCY: usize = 2;
+const GRAPHQL_USER_AGENT: &str = "executor";
+static GRAPHQL_COMPILE_PERMITS: OnceLock<Arc<Semaphore>> = OnceLock::new();
+
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct CreateGraphqlSource {
+    pub display_name: String,
+    pub preferred_slug: Option<String>,
+    pub description: Option<String>,
+    pub endpoint: String,
+    #[serde(default)]
+    pub allow_private_network: bool,
+    pub credential: Option<GraphqlCredential>,
+}
+
+#[derive(Clone, Deserialize, Serialize)]
+#[serde(
+    tag = "type",
+    rename_all = "snake_case",
+    rename_all_fields = "camelCase",
+    deny_unknown_fields
+)]
+pub enum GraphqlCredential {
+    Bearer {
+        token: String,
+    },
+    Basic {
+        username: String,
+        password: String,
+    },
+    ApiKeyHeader {
+        name: String,
+        value: String,
+    },
+    #[serde(rename = "oauth_access_token")]
+    OAuthAccessToken {
+        access_token: String,
+    },
+}
+
+impl GraphqlCredential {
+    fn credential_type(&self) -> &'static str {
+        match self {
+            Self::Bearer { .. } => "bearer",
+            Self::Basic { .. } => "basic",
+            Self::ApiKeyHeader { .. } => "api_key_header",
+            Self::OAuthAccessToken { .. } => "oauth_access_token",
+        }
+    }
+
+    fn validate(&self) -> Result<(), ProtocolError> {
+        match self {
+            Self::Bearer { token } => validate_secret(token),
+            Self::Basic { username, password } => {
+                validate_secret(username)?;
+                if username.contains(':') {
+                    return Err(invalid_credentials());
+                }
+                validate_secret(password)
+            }
+            Self::ApiKeyHeader { name, value } => {
+                if name.is_empty() || name.len() > MAX_HEADER_NAME_BYTES {
+                    return Err(invalid_credentials());
+                }
+                let name =
+                    HeaderName::from_bytes(name.as_bytes()).map_err(|_| invalid_credentials())?;
+                if protected_header(&name) {
+                    return Err(invalid_credentials());
+                }
+                validate_secret(value)
+            }
+            Self::OAuthAccessToken { access_token } => validate_secret(access_token),
+        }
+    }
+
+    fn apply(&self, headers: &mut HeaderMap) -> Result<(), ProtocolError> {
+        self.validate()?;
+        let (name, mut value) = match self {
+            Self::Bearer { token }
+            | Self::OAuthAccessToken {
+                access_token: token,
+            } => (
+                header::AUTHORIZATION,
+                HeaderValue::from_str(&format!("Bearer {token}"))
+                    .map_err(|_| invalid_credentials())?,
+            ),
+            Self::Basic { username, password } => {
+                let encoded = STANDARD.encode(format!("{username}:{password}"));
+                (
+                    header::AUTHORIZATION,
+                    HeaderValue::from_str(&format!("Basic {encoded}"))
+                        .map_err(|_| invalid_credentials())?,
+                )
+            }
+            Self::ApiKeyHeader { name, value } => (
+                HeaderName::from_bytes(name.as_bytes()).map_err(|_| invalid_credentials())?,
+                HeaderValue::from_str(value).map_err(|_| invalid_credentials())?,
+            ),
+        };
+        value.set_sensitive(true);
+        headers.insert(name, value);
+        Ok(())
+    }
+}
+
+#[derive(Clone, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct GraphqlSourceConfigurationV1 {
+    endpoint: String,
+    allow_private_network: bool,
+}
+
+impl GraphqlSourceConfigurationV1 {
+    fn decode(configuration: &Map<String, Value>) -> Result<Self, ProtocolError> {
+        let decoded: Self =
+            serde_json::from_value(Value::Object(configuration.clone())).map_err(|_| {
+                ProtocolError::corrupt(
+                    "invalid_source_configuration",
+                    "The stored GraphQL source configuration is invalid.",
+                )
+            })?;
+        validate_endpoint(&decoded.endpoint).map_err(|_| {
+            ProtocolError::corrupt(
+                "invalid_source_configuration",
+                "The stored GraphQL source configuration is invalid.",
+            )
+        })?;
+        if public_endpoint(&decoded.endpoint).ok().as_deref() != Some(decoded.endpoint.as_str()) {
+            return Err(ProtocolError::corrupt(
+                "invalid_source_configuration",
+                "The stored GraphQL source configuration is invalid.",
+            ));
+        }
+        Ok(decoded)
+    }
+
+    fn encode(&self) -> Result<Map<String, Value>, ProtocolError> {
+        serde_json::to_value(self)
+            .map_err(internal_encoding_error)?
+            .as_object()
+            .cloned()
+            .ok_or_else(internal_error)
+    }
+}
+
+#[derive(Clone, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct StoredGraphqlCredentialV1 {
+    endpoint: String,
+    credential: Option<GraphqlCredential>,
+}
+
+impl StoredGraphqlCredentialV1 {
+    fn decode(stored: &StoredCredential) -> Result<Self, ProtocolError> {
+        if stored.credential.schema_version != GRAPHQL_CREDENTIAL_SCHEMA_VERSION {
+            return Err(ProtocolError::corrupt(
+                "unsupported_credential_schema",
+                "The stored GraphQL credential schema is not supported.",
+            ));
+        }
+        let decoded: Self =
+            serde_json::from_value(stored.credential.payload.clone()).map_err(|_| {
+                ProtocolError::corrupt(
+                    "invalid_source_credentials",
+                    "The stored GraphQL credential state is invalid.",
+                )
+            })?;
+        validate_endpoint(&decoded.endpoint).map_err(|_| {
+            ProtocolError::corrupt(
+                "invalid_source_credentials",
+                "The stored GraphQL credential state is invalid.",
+            )
+        })?;
+        if decoded
+            .credential
+            .as_ref()
+            .is_some_and(|value| value.validate().is_err())
+        {
+            return Err(ProtocolError::corrupt(
+                "invalid_source_credentials",
+                "The stored GraphQL credential state is invalid.",
+            ));
+        }
+        Ok(decoded)
+    }
+
+    fn payload(&self) -> Result<CredentialPayload, ProtocolError> {
+        Ok(CredentialPayload {
+            schema_version: GRAPHQL_CREDENTIAL_SCHEMA_VERSION,
+            payload: serde_json::to_value(self).map_err(internal_encoding_error)?,
+        })
+    }
+}
+
+pub struct PreparedGraphqlInvocation {
+    request: OutboundRequest,
+    policy: OutboundPolicy,
+    mutation: bool,
+    oauth_binding: Option<OAuthBinding>,
+}
+
+#[derive(Debug, Error)]
+pub enum GraphqlInvocationError {
+    #[error("GraphQL transport failed")]
+    Outbound {
+        #[source]
+        source: OutboundError,
+        outcome_unknown: bool,
+    },
+    #[error("GraphQL mutation outcome is unknown")]
+    Indeterminate,
+    #[error("GraphQL OAuth authorization is unavailable")]
+    OAuth(#[source] OAuthError),
+}
+
+impl GraphqlInvocationError {
+    pub const fn outcome_unknown(&self) -> bool {
+        match self {
+            Self::Outbound {
+                outcome_unknown, ..
+            } => *outcome_unknown,
+            Self::Indeterminate => true,
+            Self::OAuth(_) => false,
+        }
+    }
+}
+
+#[derive(Clone, Default)]
+pub struct GraphqlAdapter {
+    oauth: Option<OAuthService>,
+    #[cfg(test)]
+    test_dns_resolution: Option<(String, Vec<std::net::IpAddr>)>,
+}
+
+impl GraphqlAdapter {
+    pub(crate) fn with_oauth(oauth: OAuthService) -> Self {
+        Self {
+            oauth: Some(oauth),
+            #[cfg(test)]
+            test_dns_resolution: None,
+        }
+    }
+
+    #[cfg(test)]
+    fn with_test_dns_resolution(
+        mut self,
+        hostname: impl Into<String>,
+        addresses: Vec<std::net::IpAddr>,
+    ) -> Self {
+        self.test_dns_resolution = Some((hostname.into(), addresses));
+        self
+    }
+
+    fn http_client(&self, policy: OutboundPolicy) -> HardenedHttpClient {
+        let client = HardenedHttpClient::new(policy);
+        #[cfg(test)]
+        let client = match &self.test_dns_resolution {
+            Some((hostname, addresses)) => {
+                client.with_test_dns_resolution(hostname.clone(), addresses.clone())
+            }
+            None => client,
+        };
+        client
+    }
+
+    pub(crate) async fn oauth_binding_observation(
+        &self,
+        source_id: &str,
+        stored: Option<&StoredCredential>,
+        expected_bindings: Option<&[OAuthBinding]>,
+    ) -> Result<Option<OAuthBinding>, ProtocolError> {
+        let stored = stored.ok_or_else(|| {
+            ProtocolError::corrupt(
+                "source_credentials_missing",
+                "The source credential state is missing.",
+            )
+        })?;
+        if StoredGraphqlCredentialV1::decode(stored)?
+            .credential
+            .is_some()
+        {
+            return Ok(None);
+        }
+        if let Some(expected_bindings) = expected_bindings {
+            return Ok(expected_bindings
+                .iter()
+                .find(|binding| binding.credential_key == "default")
+                .cloned());
+        }
+        let Some(oauth) = &self.oauth else {
+            return Ok(None);
+        };
+        oauth
+            .binding(source_id, "default")
+            .await
+            .map_err(protocol_oauth_error)
+    }
+
+    pub fn prepare_invocation(
+        &self,
+        binding: &GraphqlBindingV1,
+        source_configuration: &Map<String, Value>,
+        stored: Option<&StoredCredential>,
+        arguments: &Value,
+        oauth_binding: Option<OAuthBinding>,
+    ) -> Result<PreparedGraphqlInvocation, ProtocolError> {
+        if oauth_binding
+            .as_ref()
+            .is_some_and(|binding| binding.credential_key != "default")
+        {
+            return Err(ProtocolError::corrupt(
+                "invalid_oauth_binding",
+                "The GraphQL source OAuth binding is invalid.",
+            ));
+        }
+        binding.validate().map_err(|_| invalid_binding())?;
+        let configuration = GraphqlSourceConfigurationV1::decode(source_configuration)?;
+        let stored = stored.ok_or_else(|| {
+            ProtocolError::corrupt(
+                "source_credentials_missing",
+                "The source credential state is missing.",
+            )
+        })?;
+        let credential = StoredGraphqlCredentialV1::decode(stored)?;
+        if public_endpoint(&credential.endpoint).map_err(|_| invalid_binding())?
+            != configuration.endpoint
+        {
+            return Err(ProtocolError::corrupt(
+                "source_endpoint_mismatch",
+                "The stored GraphQL endpoint does not match its source configuration.",
+            ));
+        }
+        let arguments = arguments.as_object().ok_or_else(invalid_arguments)?;
+        let allowed = binding
+            .variables
+            .iter()
+            .map(|variable| &variable.name)
+            .collect::<BTreeSet<_>>();
+        if arguments.keys().any(|key| !allowed.contains(key)) {
+            return Err(invalid_arguments());
+        }
+        let body = serde_json::to_vec(&json!({
+            "query": binding.document,
+            "operationName": binding.operation_name,
+            "variables": arguments,
+        }))
+        .map_err(internal_encoding_error)?;
+        let policy = graphql_outbound_policy(configuration.allow_private_network);
+        let url = parse_url(&credential.endpoint, &policy).map_err(protocol_outbound_error)?;
+        let mut request = OutboundRequest::new(Method::POST, url);
+        apply_standard_request_headers(&mut request.headers);
+        if let Some(credential) = &credential.credential {
+            if oauth_binding.is_some() {
+                return Err(ProtocolError::corrupt(
+                    "ambiguous_source_credentials",
+                    "The GraphQL source has conflicting credential bindings.",
+                ));
+            }
+            credential.apply(&mut request.headers)?;
+        }
+        request.body = body;
+        Ok(PreparedGraphqlInvocation {
+            request,
+            policy,
+            mutation: binding.operation == GraphqlOperation::Mutation,
+            oauth_binding,
+        })
+    }
+
+    pub async fn execute_invocation(
+        &self,
+        prepared: PreparedGraphqlInvocation,
+    ) -> Result<ProtocolExecutionResponse, GraphqlInvocationError> {
+        let PreparedGraphqlInvocation {
+            mut request,
+            policy,
+            mutation,
+            oauth_binding,
+        } = prepared;
+        if let Some(binding) = oauth_binding {
+            let oauth = self
+                .oauth
+                .as_ref()
+                .ok_or(GraphqlInvocationError::OAuth(OAuthError::Internal))?;
+            let access_token = oauth
+                .access_token_for_binding(&binding)
+                .await
+                .map_err(GraphqlInvocationError::OAuth)?;
+            let mut authorization =
+                HeaderValue::from_str(&format!("Bearer {}", access_token.expose()))
+                    .map_err(|_| GraphqlInvocationError::OAuth(OAuthError::Internal))?;
+            authorization.set_sensitive(true);
+            request.headers.insert(header::AUTHORIZATION, authorization);
+        }
+        let response = self
+            .http_client(policy)
+            .execute(request)
+            .await
+            .map_err(|source| {
+                let outcome_unknown = mutation && may_have_dispatched(&source);
+                GraphqlInvocationError::Outbound {
+                    source,
+                    outcome_unknown,
+                }
+            })?;
+        let http = Some(ProtocolHttpMetadata {
+            status: response.status.as_u16(),
+            headers: safe_response_headers(&response.headers),
+            truncated: false,
+        });
+        if !response.status.is_success() {
+            if mutation {
+                return Err(GraphqlInvocationError::Indeterminate);
+            }
+            return Ok(protocol_failure(
+                "upstream_http_error",
+                "The upstream GraphQL API returned an HTTP error response.",
+                http,
+            ));
+        }
+        let value: Value = match serde_json::from_slice(&response.body) {
+            Ok(value) => value,
+            Err(_) => {
+                return invalid_execution_response(mutation, http);
+            }
+        };
+        let Some(object) = value.as_object() else {
+            return invalid_execution_response(mutation, http);
+        };
+        if let Some(errors) = object.get("errors") {
+            match errors {
+                Value::Null => {}
+                Value::Array(errors) if errors.is_empty() => {}
+                Value::Array(errors) => {
+                    if graphql_errors_are_well_formed(errors) {
+                        if mutation {
+                            return Err(GraphqlInvocationError::Indeterminate);
+                        }
+                        return Ok(protocol_failure(
+                            "graphql_error",
+                            "The upstream GraphQL operation returned an error.",
+                            http,
+                        ));
+                    }
+                    return invalid_execution_response(mutation, http);
+                }
+                _ => return invalid_execution_response(mutation, http),
+            }
+        }
+        let Some(data) = object.get("data").and_then(Value::as_object) else {
+            return invalid_execution_response(mutation, http);
+        };
+        let Some(result) = data.get("result") else {
+            return invalid_execution_response(mutation, http);
+        };
+        Ok(ProtocolExecutionResponse {
+            ok: true,
+            data: Some(result.clone()),
+            error: None,
+            http,
+        })
+    }
+
+    pub async fn create_source(
+        &self,
+        catalog: &CatalogStore,
+        input: CreateGraphqlSource,
+        audit: AuditContext<'_>,
+    ) -> Result<SourceRecord, ProtocolError> {
+        validate_endpoint(&input.endpoint).map_err(protocol_outbound_error)?;
+        if let Some(credential) = &input.credential {
+            credential.validate()?;
+        }
+        let configuration = GraphqlSourceConfigurationV1 {
+            endpoint: public_endpoint(&input.endpoint).map_err(protocol_outbound_error)?,
+            allow_private_network: input.allow_private_network,
+        };
+        let stored = StoredGraphqlCredentialV1 {
+            endpoint: input.endpoint,
+            credential: input.credential,
+        };
+        let policy = graphql_introspection_policy(input.allow_private_network);
+        let discovery = fetch_and_compile(
+            &configuration,
+            &stored,
+            None,
+            &policy,
+            self.http_client(policy.clone()),
+        )
+        .await;
+        let authorization_required = stored.credential.is_none()
+            && discovery
+                .as_ref()
+                .is_err_and(|error| error.code == "authorization_required");
+        let preferred_slug = input
+            .preferred_slug
+            .unwrap_or_else(|| input.display_name.clone());
+        let create = CreateSource {
+            kind: SourceKind::Graphql,
+            preferred_slug,
+            display_name: input.display_name,
+            description: input.description,
+            configuration: configuration.encode()?,
+        };
+        let payload = stored.payload()?;
+        let (source, _) = match discovery {
+            Ok(compiled) => catalog
+                .create_source_with_catalog(
+                    create,
+                    &payload,
+                    initial_catalog_snapshot(&compiled),
+                    staged_bindings(&compiled),
+                    audit,
+                )
+                .await
+                .map_err(protocol_catalog_error)?,
+            Err(_error) if authorization_required => catalog
+                .create_authorization_required_source_with_catalog(
+                    create,
+                    &payload,
+                    InitialCatalogSnapshot {
+                        artifacts: Vec::new(),
+                        tools: Vec::new(),
+                    },
+                    Vec::new(),
+                    audit,
+                )
+                .await
+                .map_err(protocol_catalog_error)?,
+            Err(error) => return Err(error),
+        };
+        Ok(source)
+    }
+
+    pub async fn refresh_source(
+        &self,
+        catalog: &CatalogStore,
+        source: SourceRecord,
+        audit: AuditContext<'_>,
+    ) -> Result<CatalogSyncResult, ProtocolError> {
+        if source.kind != SourceKind::Graphql {
+            return Err(ProtocolError::corrupt(
+                "source_protocol_mismatch",
+                "The stored source does not match the GraphQL protocol.",
+            ));
+        }
+        let configuration = GraphqlSourceConfigurationV1::decode(&source.configuration)?;
+        let stored_record = required_stored_credential(catalog, &source.id).await?;
+        let stored = StoredGraphqlCredentialV1::decode(&stored_record)?;
+        let oauth_binding = if stored.credential.is_none() {
+            match &self.oauth {
+                Some(oauth) => oauth
+                    .binding(&source.id, "default")
+                    .await
+                    .map_err(protocol_oauth_error)?,
+                None => None,
+            }
+        } else {
+            None
+        };
+        let access_token = oauth_access(self, oauth_binding.clone()).await?;
+        let oauth_expectation = if stored.credential.is_none() {
+            Some(match (&oauth_binding, access_token.as_ref()) {
+                (Some(binding), Some(_access_token)) => OAuthBindingExpectation::Exact {
+                    credential_key: "default".to_owned(),
+                    connection_id: binding.connection_id.clone(),
+                    config_revision: binding.config_revision,
+                },
+                (None, None) => OAuthBindingExpectation::Absent {
+                    credential_key: "default".to_owned(),
+                },
+                _ => {
+                    return Err(ProtocolError::new(
+                        ProtocolErrorCategory::Internal,
+                        "oauth_binding_invalid",
+                        "The managed OAuth connection could not be resolved safely.",
+                    ));
+                }
+            })
+        } else {
+            None
+        };
+        let policy = graphql_introspection_policy(configuration.allow_private_network);
+        let compiled = fetch_and_compile(
+            &configuration,
+            &stored,
+            access_token,
+            &policy,
+            self.http_client(policy.clone()),
+        )
+        .await?;
+        let snapshot = CatalogSnapshot {
+            expected_source_revision: source.revision,
+            expected_credential_revision: Some(stored_record.revision),
+            artifacts: staged_artifacts(&compiled),
+            tools: staged_tools(&compiled),
+        };
+        let bindings = staged_bindings(&compiled);
+        if let Some(expectation) = oauth_expectation {
+            catalog
+                .sync_catalog_with_bindings_and_oauth_binding(
+                    &source.id,
+                    snapshot,
+                    bindings,
+                    expectation,
+                    audit,
+                )
+                .await
+                .map_err(protocol_catalog_error)
+        } else {
+            catalog
+                .sync_catalog_with_bindings(&source.id, snapshot, bindings, audit)
+                .await
+                .map_err(protocol_catalog_error)
+        }
+    }
+
+    pub async fn credential_metadata(
+        &self,
+        catalog: &CatalogStore,
+        source_id: &str,
+    ) -> Result<CredentialMetadata, ProtocolError> {
+        let stored = required_stored_credential(catalog, source_id).await?;
+        let credential = StoredGraphqlCredentialV1::decode(&stored)?;
+        Ok(credential_metadata(stored.revision, credential))
+    }
+
+    pub async fn replace_credentials(
+        &self,
+        catalog: &CatalogStore,
+        source_id: &str,
+        expected_revision: i64,
+        credential: Option<GraphqlCredential>,
+        audit: AuditContext<'_>,
+    ) -> Result<CredentialMetadata, ProtocolError> {
+        if let Some(credential) = &credential {
+            credential.validate()?;
+        }
+        self.replace_optional_credentials(catalog, source_id, expected_revision, credential, audit)
+            .await
+    }
+
+    pub async fn clear_credentials(
+        &self,
+        catalog: &CatalogStore,
+        source_id: &str,
+        expected_revision: i64,
+        audit: AuditContext<'_>,
+    ) -> Result<CredentialMetadata, ProtocolError> {
+        self.replace_optional_credentials(catalog, source_id, expected_revision, None, audit)
+            .await
+    }
+
+    async fn replace_optional_credentials(
+        &self,
+        catalog: &CatalogStore,
+        source_id: &str,
+        expected_revision: i64,
+        credential: Option<GraphqlCredential>,
+        audit: AuditContext<'_>,
+    ) -> Result<CredentialMetadata, ProtocolError> {
+        let stored = required_stored_credential(catalog, source_id).await?;
+        if stored.revision != expected_revision {
+            return Err(revision_conflict());
+        }
+        let current = StoredGraphqlCredentialV1::decode(&stored)?;
+        let replacement = StoredGraphqlCredentialV1 {
+            endpoint: current.endpoint,
+            credential,
+        };
+        let payload = replacement.payload()?;
+        catalog
+            .put_credential(source_id, &payload, Some(expected_revision), audit)
+            .await
+            .map_err(protocol_catalog_error)?;
+        let revision = expected_revision
+            .checked_add(1)
+            .ok_or_else(internal_error)?;
+        Ok(credential_metadata(revision, replacement))
+    }
+}
+
+async fn oauth_access(
+    adapter: &GraphqlAdapter,
+    binding: Option<OAuthBinding>,
+) -> Result<Option<crate::oauth::OAuthAccessToken>, ProtocolError> {
+    let Some(binding) = binding else {
+        return Ok(None);
+    };
+    let oauth = adapter.oauth.as_ref().ok_or_else(|| {
+        ProtocolError::new(
+            ProtocolErrorCategory::Internal,
+            "oauth_service_unavailable",
+            "Managed OAuth is unavailable for this source.",
+        )
+    })?;
+    oauth
+        .access_token_for_binding(&binding)
+        .await
+        .map(Some)
+        .map_err(protocol_oauth_error)
+}
+
+async fn fetch_and_compile(
+    configuration: &GraphqlSourceConfigurationV1,
+    stored: &StoredGraphqlCredentialV1,
+    oauth_access_token: Option<crate::oauth::OAuthAccessToken>,
+    policy: &OutboundPolicy,
+    client: HardenedHttpClient,
+) -> Result<CompiledGraphql, ProtocolError> {
+    if public_endpoint(&stored.endpoint).map_err(protocol_outbound_error)?
+        != configuration.endpoint.as_str()
+    {
+        return Err(ProtocolError::corrupt(
+            "source_endpoint_mismatch",
+            "The stored GraphQL endpoint does not match its source configuration.",
+        ));
+    }
+    let url = parse_url(&stored.endpoint, policy).map_err(protocol_outbound_error)?;
+    let mut request = OutboundRequest::new(Method::POST, url);
+    apply_standard_request_headers(&mut request.headers);
+    if let Some(credential) = &stored.credential {
+        credential.apply(&mut request.headers)?;
+    } else if let Some(access_token) = oauth_access_token {
+        let mut authorization = HeaderValue::from_str(&format!("Bearer {}", access_token.expose()))
+            .map_err(|_| protocol_oauth_error(OAuthError::Internal))?;
+        authorization.set_sensitive(true);
+        request.headers.insert(header::AUTHORIZATION, authorization);
+    }
+    request.body = serde_json::to_vec(&json!({
+        "query": INTROSPECTION_QUERY,
+        "operationName": "ExecutorIntrospection",
+        "variables": {},
+    }))
+    .map_err(internal_encoding_error)?;
+    let response = client
+        .execute(request)
+        .await
+        .map_err(protocol_outbound_error)?;
+    if stored.credential.is_none()
+        && matches!(
+            response.status,
+            reqwest::StatusCode::UNAUTHORIZED | reqwest::StatusCode::FORBIDDEN
+        )
+    {
+        return Err(authorization_required_error());
+    }
+    if !response.status.is_success() {
+        return Err(ProtocolError::new(
+            ProtocolErrorCategory::Upstream,
+            "upstream_http_error",
+            "The GraphQL introspection request failed.",
+        ));
+    }
+    let permit = try_compile_permit(
+        GRAPHQL_COMPILE_PERMITS
+            .get_or_init(|| Arc::new(Semaphore::new(GRAPHQL_COMPILE_CONCURRENCY)))
+            .clone(),
+    )?;
+    compile_introspection_bounded(response.body, permit).await
+}
+
+fn graphql_outbound_policy(allow_private_networks: bool) -> OutboundPolicy {
+    OutboundPolicy {
+        allow_private_networks,
+        require_https_or_loopback: true,
+        ..OutboundPolicy::default()
+    }
+}
+
+fn graphql_introspection_policy(allow_private_networks: bool) -> OutboundPolicy {
+    OutboundPolicy {
+        max_response_bytes: MAX_INTROSPECTION_BYTES,
+        ..graphql_outbound_policy(allow_private_networks)
+    }
+}
+
+enum GraphqlCompileTaskError {
+    InvalidJson,
+    AuthorizationRequired,
+    Rejected,
+    Compile(GraphqlError),
+}
+
+fn try_compile_permit(
+    permits: Arc<Semaphore>,
+) -> Result<tokio::sync::OwnedSemaphorePermit, ProtocolError> {
+    permits.try_acquire_owned().map_err(|_| {
+        ProtocolError::new(
+            ProtocolErrorCategory::Conflict,
+            "graphql_compiler_busy",
+            "GraphQL schema import is busy. Retry shortly.",
+        )
+    })
+}
+
+async fn compile_introspection_bounded(
+    response: Vec<u8>,
+    permit: tokio::sync::OwnedSemaphorePermit,
+) -> Result<CompiledGraphql, ProtocolError> {
+    tokio::task::spawn_blocking(move || {
+        let _permit = permit;
+        let response: Value =
+            serde_json::from_slice(&response).map_err(|_| GraphqlCompileTaskError::InvalidJson)?;
+        let errors = response.as_object().and_then(|object| object.get("errors"));
+        if errors.is_some_and(graphql_errors_require_authorization) {
+            return Err(GraphqlCompileTaskError::AuthorizationRequired);
+        }
+        if errors.is_some_and(non_empty_graphql_errors) {
+            return Err(GraphqlCompileTaskError::Rejected);
+        }
+        compile_introspection(response).map_err(GraphqlCompileTaskError::Compile)
+    })
+    .await
+    .map_err(|_| internal_error())?
+    .map_err(|error| match error {
+        GraphqlCompileTaskError::InvalidJson => ProtocolError::new(
+            ProtocolErrorCategory::Upstream,
+            "invalid_graphql_response",
+            "The GraphQL introspection response is invalid.",
+        ),
+        GraphqlCompileTaskError::AuthorizationRequired => authorization_required_error(),
+        GraphqlCompileTaskError::Rejected => ProtocolError::new(
+            ProtocolErrorCategory::Upstream,
+            "graphql_introspection_failed",
+            "The GraphQL server rejected introspection.",
+        ),
+        GraphqlCompileTaskError::Compile(error) => graphql_error(error),
+    })
+}
+
+fn initial_catalog_snapshot(compiled: &CompiledGraphql) -> InitialCatalogSnapshot {
+    InitialCatalogSnapshot {
+        artifacts: staged_artifacts(compiled),
+        tools: staged_tools(compiled),
+    }
+}
+
+fn staged_artifacts(compiled: &CompiledGraphql) -> Vec<StagedArtifact> {
+    vec![StagedArtifact {
+        kind: ArtifactKind::GraphqlSchema,
+        stable_key: "schema".to_owned(),
+        content: compiled.document.clone(),
+    }]
+}
+
+fn staged_tools(compiled: &CompiledGraphql) -> Vec<StagedTool> {
+    compiled
+        .tools
+        .iter()
+        .map(|tool| StagedTool {
+            stable_key: tool.stable_key.clone(),
+            preferred_name: tool.preferred_name.clone(),
+            display_name: tool.display_name.clone(),
+            description: tool.description.clone(),
+            input_schema: tool.input_schema.clone(),
+            output_schema: tool.output_schema.clone(),
+            input_typescript: None,
+            output_typescript: None,
+            typescript_definitions: BTreeMap::new(),
+            intrinsic_mode: tool.intrinsic_mode,
+        })
+        .collect()
+}
+
+fn staged_bindings(compiled: &CompiledGraphql) -> Vec<StagedToolBinding> {
+    compiled
+        .tools
+        .iter()
+        .map(|tool| StagedToolBinding {
+            stable_key: tool.stable_key.clone(),
+            binding: ToolBinding::GraphqlV1(tool.binding.clone()),
+        })
+        .collect()
+}
+
+fn validate_endpoint(value: &str) -> Result<(), OutboundError> {
+    if value.len() > MAX_ENDPOINT_BYTES {
+        return Err(OutboundError::InvalidUrl);
+    }
+    let url = Url::parse(value).map_err(|_| OutboundError::InvalidUrl)?;
+    if !matches!(url.scheme(), "http" | "https") {
+        return Err(OutboundError::UnsupportedScheme);
+    }
+    if url.scheme() == "http" && !loopback_endpoint(&url) {
+        return Err(OutboundError::UnsupportedScheme);
+    }
+    if url.host().is_none() {
+        return Err(OutboundError::MissingHost);
+    }
+    if !url.username().is_empty() || url.password().is_some() {
+        return Err(OutboundError::CredentialsNotAllowed);
+    }
+    if url.fragment().is_some() {
+        return Err(OutboundError::FragmentNotAllowed);
+    }
+    Ok(())
+}
+
+fn loopback_endpoint(url: &Url) -> bool {
+    match url.host() {
+        Some(Host::Ipv4(address)) => address.is_loopback(),
+        Some(Host::Ipv6(address)) => address.is_loopback(),
+        Some(Host::Domain(hostname)) => {
+            hostname.eq_ignore_ascii_case("localhost")
+                || hostname.to_ascii_lowercase().ends_with(".localhost")
+        }
+        None => false,
+    }
+}
+
+fn public_endpoint(value: &str) -> Result<String, OutboundError> {
+    validate_endpoint(value)?;
+    let mut url = Url::parse(value).map_err(|_| OutboundError::InvalidUrl)?;
+    url.set_path("/");
+    url.set_query(None);
+    Ok(url.to_string())
+}
+
+fn may_have_dispatched(error: &OutboundError) -> bool {
+    matches!(
+        error,
+        OutboundError::Timeout
+            | OutboundError::Request
+            | OutboundError::ResponseHeadersTooLarge
+            | OutboundError::ResponseBodyTooLarge
+            | OutboundError::UnsupportedContentEncoding
+    )
+}
+
+fn validate_secret(value: &str) -> Result<(), ProtocolError> {
+    if value.is_empty() || value.len() > MAX_CREDENTIAL_BYTES || value.chars().any(char::is_control)
+    {
+        Err(invalid_credentials())
+    } else {
+        Ok(())
+    }
+}
+
+fn apply_standard_request_headers(headers: &mut HeaderMap) {
+    headers.insert(
+        header::CONTENT_TYPE,
+        HeaderValue::from_static("application/json"),
+    );
+    headers.insert(
+        header::ACCEPT,
+        HeaderValue::from_static("application/graphql-response+json, application/json"),
+    );
+    headers.insert(
+        header::USER_AGENT,
+        HeaderValue::from_static(GRAPHQL_USER_AGENT),
+    );
+}
+
+fn protected_header(name: &HeaderName) -> bool {
+    name == header::AUTHORIZATION
+        || name == header::ACCEPT
+        || name == header::ACCEPT_ENCODING
+        || name == header::CONTENT_TYPE
+        || name == header::CONTENT_LENGTH
+        || name == header::HOST
+        || name == header::CONNECTION
+        || name == header::TRANSFER_ENCODING
+        || name == header::TE
+        || name == header::TRAILER
+        || name == header::UPGRADE
+        || name == header::REFERER
+        || name == header::COOKIE
+        || name == header::ORIGIN
+        || name == header::USER_AGENT
+        || name == "keep-alive"
+        || name == "forwarded"
+        || name == "via"
+        || name == "x-http-method-override"
+        || name == "x-method-override"
+        || name == "x-original-url"
+        || name == "x-rewrite-url"
+        || name == "x-real-ip"
+        || name.as_str().starts_with("x-forwarded-")
+        || name.as_str().starts_with("proxy-")
+}
+
+fn safe_response_headers(headers: &HeaderMap) -> BTreeMap<String, String> {
+    [
+        header::CONTENT_TYPE,
+        header::CONTENT_LENGTH,
+        header::RETRY_AFTER,
+    ]
+    .into_iter()
+    .filter_map(|name| {
+        headers
+            .get(&name)
+            .and_then(|value| value.to_str().ok())
+            .map(|value| (name.as_str().to_owned(), value.to_owned()))
+    })
+    .collect()
+}
+
+fn non_empty_graphql_errors(value: &Value) -> bool {
+    !matches!(value, Value::Array(errors) if errors.is_empty()) && !value.is_null()
+}
+
+fn graphql_errors_require_authorization(value: &Value) -> bool {
+    let Some(errors) = value.as_array().filter(|errors| !errors.is_empty()) else {
+        return false;
+    };
+    errors.iter().any(|error| {
+        let Some(error) = error.as_object() else {
+            return false;
+        };
+        let extensions = error.get("extensions").and_then(Value::as_object);
+        let code = extensions
+            .and_then(|extensions| extensions.get("code"))
+            .and_then(Value::as_str)
+            .or_else(|| error.get("code").and_then(Value::as_str));
+        if code.is_some_and(|code| {
+            matches!(
+                code.to_ascii_uppercase().as_str(),
+                "UNAUTHENTICATED"
+                    | "UNAUTHORIZED"
+                    | "FORBIDDEN"
+                    | "AUTHENTICATION_REQUIRED"
+                    | "AUTHORIZATION_REQUIRED"
+                    | "ACCESS_DENIED"
+                    | "INVALID_TOKEN"
+                    | "TOKEN_EXPIRED"
+            )
+        }) {
+            return true;
+        }
+        let status = extensions
+            .and_then(|extensions| extensions.get("http"))
+            .and_then(Value::as_object)
+            .and_then(|http| http.get("status"))
+            .or_else(|| extensions.and_then(|extensions| extensions.get("status")));
+        if status.is_some_and(|status| {
+            status
+                .as_u64()
+                .is_some_and(|status| status == 401 || status == 403)
+                || status
+                    .as_str()
+                    .is_some_and(|status| matches!(status, "401" | "403"))
+        }) {
+            return true;
+        }
+        let message = error
+            .get("message")
+            .and_then(Value::as_str)
+            .map(str::trim)
+            .map(str::to_ascii_lowercase);
+        message.is_some_and(|message| {
+            [
+                "authentication required",
+                "authorization required",
+                "not authenticated",
+                "access denied",
+                "invalid access token",
+                "access token expired",
+                "missing bearer token",
+            ]
+            .into_iter()
+            .any(|prefix| {
+                message == prefix
+                    || message
+                        .strip_prefix(prefix)
+                        .and_then(|suffix| suffix.chars().next())
+                        .is_some_and(|character| matches!(character, '.' | ':' | ';'))
+            })
+        })
+    })
+}
+
+fn graphql_errors_are_well_formed(errors: &[Value]) -> bool {
+    !errors.is_empty()
+        && errors.iter().all(|error| {
+            error
+                .as_object()
+                .and_then(|error| error.get("message"))
+                .and_then(Value::as_str)
+                .is_some()
+        })
+}
+
+fn protocol_failure(
+    code: &str,
+    message: &str,
+    http: Option<ProtocolHttpMetadata>,
+) -> ProtocolExecutionResponse {
+    ProtocolExecutionResponse {
+        ok: false,
+        data: None,
+        error: Some(ProtocolResponseError {
+            code: code.to_owned(),
+            message: message.to_owned(),
+        }),
+        http,
+    }
+}
+
+fn invalid_execution_response(
+    mutation: bool,
+    http: Option<ProtocolHttpMetadata>,
+) -> Result<ProtocolExecutionResponse, GraphqlInvocationError> {
+    if mutation {
+        Err(GraphqlInvocationError::Indeterminate)
+    } else {
+        Ok(protocol_failure(
+            "invalid_graphql_response",
+            "The upstream GraphQL API returned an invalid response.",
+            http,
+        ))
+    }
+}
+
+async fn required_stored_credential(
+    catalog: &CatalogStore,
+    source_id: &str,
+) -> Result<StoredCredential, ProtocolError> {
+    catalog
+        .credential(source_id)
+        .await
+        .map_err(protocol_catalog_error)?
+        .ok_or_else(|| {
+            ProtocolError::corrupt(
+                "source_credentials_missing",
+                "The source credential state is missing.",
+            )
+        })
+}
+
+fn credential_metadata(revision: i64, stored: StoredGraphqlCredentialV1) -> CredentialMetadata {
+    CredentialMetadata {
+        revision,
+        configured_schemes: stored
+            .credential
+            .into_iter()
+            .map(|credential| ConfiguredCredential {
+                name: "default".to_owned(),
+                credential_type: credential.credential_type(),
+            })
+            .collect(),
+    }
+}
+
+fn graphql_error(error: GraphqlError) -> ProtocolError {
+    let code = match error {
+        GraphqlError::InvalidDocument(_) => "invalid_graphql_schema",
+        GraphqlError::UnsupportedType(_) => "unsupported_graphql_type",
+        GraphqlError::LimitExceeded { .. } => "graphql_schema_limit_exceeded",
+        GraphqlError::InvalidBinding => "invalid_graphql_schema",
+    };
+    ProtocolError::new(
+        ProtocolErrorCategory::InvalidInput,
+        code,
+        "The GraphQL schema could not be imported safely.",
+    )
+}
+
+fn protocol_oauth_error(error: OAuthError) -> ProtocolError {
+    match error {
+        OAuthError::Validation { code, message } => {
+            ProtocolError::new(ProtocolErrorCategory::InvalidInput, code, message)
+        }
+        OAuthError::NotFound => ProtocolError::new(
+            ProtocolErrorCategory::Conflict,
+            "oauth_connection_required",
+            "The OAuth connection must be configured before this operation can run.",
+        ),
+        OAuthError::Conflict { code, message } => {
+            ProtocolError::new(ProtocolErrorCategory::Conflict, code, message)
+        }
+        OAuthError::Upstream { code } => ProtocolError::new(
+            ProtocolErrorCategory::Upstream,
+            code,
+            "The OAuth provider request failed.",
+        ),
+        OAuthError::UnauthorizedTransaction
+        | OAuthError::AuthorizationDenied { .. }
+        | OAuthError::Internal => ProtocolError::new(
+            ProtocolErrorCategory::Internal,
+            "oauth_internal_error",
+            "Managed OAuth could not be resolved safely.",
+        ),
+    }
+}
+
+fn authorization_required_error() -> ProtocolError {
+    ProtocolError::new(
+        ProtocolErrorCategory::Conflict,
+        "authorization_required",
+        "Authorize this GraphQL source, then refresh it to import tools.",
+    )
+}
+
+fn invalid_binding() -> ProtocolError {
+    ProtocolError::corrupt(
+        "invalid_tool_binding",
+        "The stored GraphQL tool binding is invalid.",
+    )
+}
+
+fn invalid_arguments() -> ProtocolError {
+    ProtocolError::new(
+        ProtocolErrorCategory::InvalidInput,
+        "invalid_tool_arguments",
+        "The tool arguments are invalid.",
+    )
+}
+
+fn invalid_credentials() -> ProtocolError {
+    ProtocolError::new(
+        ProtocolErrorCategory::InvalidInput,
+        "invalid_credentials",
+        "The static credential configuration is invalid.",
+    )
+}
+
+fn revision_conflict() -> ProtocolError {
+    ProtocolError::new(
+        ProtocolErrorCategory::Conflict,
+        "revision_conflict",
+        "The source changed. Refresh and retry the update.",
+    )
+}
+
+fn internal_error() -> ProtocolError {
+    ProtocolError::new(
+        ProtocolErrorCategory::Internal,
+        "internal_error",
+        "The protocol operation could not be completed.",
+    )
+}
+
+fn internal_encoding_error(_error: serde_json::Error) -> ProtocolError {
+    internal_error()
+}
+
+#[cfg(test)]
+mod tests {
+    use std::{
+        collections::BTreeMap,
+        net::{IpAddr, Ipv4Addr},
+        time::Duration,
+    };
+
+    use reqwest::header::HeaderName;
+    use serde_json::{Map, Value, json};
+    use tokio::{
+        io::{AsyncReadExt, AsyncWriteExt},
+        net::{TcpListener, TcpStream},
+        time::timeout,
+    };
+
+    use super::{
+        CreateGraphqlSource, GraphqlAdapter, GraphqlCredential, GraphqlSourceConfigurationV1,
+        StoredGraphqlCredentialV1, graphql_errors_require_authorization, may_have_dispatched,
+        protected_header, public_endpoint, try_compile_permit,
+    };
+    use crate::{
+        AppConfig, ExecutorApp,
+        catalog::{
+            AuditContext, CreateSource, CredentialPayload, InitialCatalogSnapshot, ListToolsFilter,
+            SourceHealth, SourceKind, StagedTool, StagedToolBinding, StoredCredential, ToolBinding,
+            ToolMode,
+        },
+        crypto::Keyring,
+        graphql::{
+            GraphqlBindingV1, GraphqlOperation, GraphqlTypeRef, GraphqlVariableBinding,
+            MAX_INPUT_OBJECT_DEPTH,
+        },
+        oauth::{
+            OAuthBinding, OAuthService,
+            model::{OAuthClientAuthentication, OAuthConnectionConfig, OAuthSecretSet},
+            store::OAuthStore,
+        },
+        outbound::{OutboundError, OutboundPolicy},
+        protocols::ProtocolErrorCategory,
+    };
+
+    #[test]
+    fn manual_oauth_credential_uses_the_public_wire_shape() {
+        let credential: GraphqlCredential = serde_json::from_value(json!({
+            "type": "oauth_access_token",
+            "accessToken": "secret-token"
+        }))
+        .expect("public manual OAuth credential decodes");
+
+        assert!(matches!(
+            credential,
+            GraphqlCredential::OAuthAccessToken { ref access_token }
+                if access_token == "secret-token"
+        ));
+        assert_eq!(
+            serde_json::to_value(credential).expect("manual OAuth credential encodes"),
+            json!({ "type": "oauth_access_token", "accessToken": "secret-token" })
+        );
+        assert!(
+            serde_json::from_value::<GraphqlCredential>(json!({
+                "type": "o_auth_access_token",
+                "accessToken": "secret-token"
+            }))
+            .is_err()
+        );
+    }
+
+    fn query_binding() -> GraphqlBindingV1 {
+        let mut binding = GraphqlBindingV1 {
+            version: 1,
+            operation: GraphqlOperation::Query,
+            field_name: "hello".to_owned(),
+            operation_name: "ExecutorQueryHello".to_owned(),
+            variables: vec![GraphqlVariableBinding {
+                name: "id".to_owned(),
+                type_ref: GraphqlTypeRef::NonNull {
+                    of_type: Box::new(GraphqlTypeRef::Named {
+                        name: "ID".to_owned(),
+                    }),
+                },
+            }],
+            selection: Vec::new(),
+            document: String::new(),
+        };
+        binding.document = binding.canonical_document().unwrap();
+        binding
+    }
+
+    fn mutation_binding() -> GraphqlBindingV1 {
+        let mut binding = GraphqlBindingV1 {
+            operation: GraphqlOperation::Mutation,
+            operation_name: "ExecutorMutationHello".to_owned(),
+            ..query_binding()
+        };
+        binding.document = binding.canonical_document().unwrap();
+        binding
+    }
+
+    fn source_configuration(endpoint: String, allow_private_network: bool) -> Map<String, Value> {
+        GraphqlSourceConfigurationV1 {
+            endpoint: public_endpoint(&endpoint).expect("test endpoint has a safe public origin"),
+            allow_private_network,
+        }
+        .encode()
+        .unwrap()
+    }
+
+    fn stored_credential(
+        endpoint: impl Into<String>,
+        credential: Option<GraphqlCredential>,
+    ) -> StoredCredential {
+        StoredCredential {
+            revision: 0,
+            credential: StoredGraphqlCredentialV1 {
+                endpoint: endpoint.into(),
+                credential,
+            }
+            .payload()
+            .unwrap(),
+        }
+    }
+
+    fn with_poisoned_localhost(adapter: GraphqlAdapter) -> GraphqlAdapter {
+        adapter.with_test_dns_resolution(
+            "poison.localhost",
+            vec![IpAddr::V4(Ipv4Addr::new(8, 8, 8, 8))],
+        )
+    }
+
+    async fn read_request(stream: &mut TcpStream) -> Vec<u8> {
+        let mut request = Vec::new();
+        loop {
+            let mut buffer = [0_u8; 4096];
+            let read = timeout(Duration::from_secs(2), stream.read(&mut buffer))
+                .await
+                .expect("request arrives before timeout")
+                .expect("request is readable");
+            assert_ne!(read, 0, "request does not end before its body");
+            request.extend_from_slice(&buffer[..read]);
+            let Some(header_end) = request.windows(4).position(|window| window == b"\r\n\r\n")
+            else {
+                continue;
+            };
+            let header_end = header_end + 4;
+            let headers = String::from_utf8_lossy(&request[..header_end]);
+            let content_length = headers
+                .lines()
+                .find_map(|line| {
+                    let (name, value) = line.split_once(':')?;
+                    name.eq_ignore_ascii_case("content-length")
+                        .then(|| value.trim().parse::<usize>().ok())
+                        .flatten()
+                })
+                .unwrap_or(0);
+            if request.len() >= header_end + content_length {
+                return request;
+            }
+        }
+    }
+
+    fn response(status: &str, body: &str, extra_headers: &str) -> Vec<u8> {
+        format!(
+            "HTTP/1.1 {status}\r\nContent-Type: application/json\r\nContent-Length: {}\r\n{extra_headers}Connection: close\r\n\r\n{body}",
+            body.len()
+        )
+        .into_bytes()
+    }
+
+    fn minimal_introspection() -> Value {
+        json!({
+            "data": { "__schema": {
+                "queryType": { "name": "Query" },
+                "mutationType": null,
+                "subscriptionType": null,
+                "types": [
+                    { "kind": "SCALAR", "name": "String", "description": null, "fields": null, "inputFields": null, "enumValues": null },
+                    { "kind": "OBJECT", "name": "Query", "description": null, "inputFields": null, "enumValues": null, "fields": [
+                        { "name": "hello", "description": null, "isDeprecated": false, "args": [], "type": { "kind": "SCALAR", "name": "String", "ofType": null } }
+                    ] }
+                ]
+            } }
+        })
+    }
+
+    fn overdeep_input_introspection() -> Value {
+        let mut document = minimal_introspection();
+        let definitions = (0..=MAX_INPUT_OBJECT_DEPTH).map(|index| {
+            let field_type = if index == MAX_INPUT_OBJECT_DEPTH {
+                json!({ "kind": "SCALAR", "name": "String", "ofType": null })
+            } else {
+                json!({
+                    "kind": "INPUT_OBJECT",
+                    "name": format!("Input{}", index + 1),
+                    "ofType": null
+                })
+            };
+            json!({
+                "kind": "INPUT_OBJECT",
+                "name": format!("Input{index}"),
+                "description": null,
+                "fields": null,
+                "inputFields": [{
+                    "name": "next",
+                    "description": null,
+                    "defaultValue": null,
+                    "type": field_type
+                }],
+                "enumValues": null
+            })
+        });
+        let types = document["data"]["__schema"]["types"]
+            .as_array_mut()
+            .expect("schema types are an array");
+        types.extend(definitions);
+        let query = types
+            .iter_mut()
+            .find(|definition| definition["name"] == "Query")
+            .expect("query type exists");
+        query["fields"][0]["args"] = json!([{
+            "name": "input",
+            "description": null,
+            "defaultValue": null,
+            "type": { "kind": "INPUT_OBJECT", "name": "Input0", "ofType": null }
+        }]);
+        document
+    }
+
+    async fn execute_with_response(
+        binding: &GraphqlBindingV1,
+        status: &str,
+        body: &str,
+    ) -> Result<super::ProtocolExecutionResponse, super::GraphqlInvocationError> {
+        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let endpoint = format!("http://{}/graphql", listener.local_addr().unwrap());
+        let prepared = GraphqlAdapter::default()
+            .prepare_invocation(
+                binding,
+                &source_configuration(endpoint.clone(), true),
+                Some(&stored_credential(endpoint, None)),
+                &json!({ "id": "user-1" }),
+                None,
+            )
+            .unwrap();
+        let execution =
+            tokio::spawn(
+                async move { GraphqlAdapter::default().execute_invocation(prepared).await },
+            );
+        let (mut stream, _) = listener.accept().await.unwrap();
+        read_request(&mut stream).await;
+        stream.write_all(&response(status, body, "")).await.unwrap();
+        execution.await.unwrap()
+    }
+
+    #[test]
+    fn mutation_outcome_is_unknown_only_for_errors_after_dispatch_may_have_started() {
+        assert!(may_have_dispatched(&OutboundError::Timeout));
+        assert!(may_have_dispatched(&OutboundError::Request));
+        assert!(may_have_dispatched(&OutboundError::ResponseBodyTooLarge));
+        assert!(!may_have_dispatched(&OutboundError::Connection));
+        assert!(!may_have_dispatched(&OutboundError::DnsResolution));
+        assert!(!may_have_dispatched(&OutboundError::PrivateAddress));
+        assert!(!may_have_dispatched(&OutboundError::ForbiddenHeader));
+    }
+
+    #[test]
+    fn api_key_headers_cannot_take_over_transport_or_forwarding_metadata() {
+        for name in [
+            "authorization",
+            "accept",
+            "accept-encoding",
+            "content-type",
+            "content-length",
+            "host",
+            "connection",
+            "transfer-encoding",
+            "te",
+            "trailer",
+            "upgrade",
+            "keep-alive",
+            "referer",
+            "cookie",
+            "origin",
+            "user-agent",
+            "forwarded",
+            "via",
+            "x-http-method-override",
+            "x-method-override",
+            "x-original-url",
+            "x-rewrite-url",
+            "x-real-ip",
+            "x-forwarded-host",
+            "proxy-authorization",
+        ] {
+            assert!(protected_header(
+                &HeaderName::from_bytes(name.as_bytes()).unwrap()
+            ));
+        }
+    }
+
+    #[test]
+    fn credentials_reject_empty_oversized_and_control_character_values() {
+        for credential in [
+            GraphqlCredential::Bearer {
+                token: String::new(),
+            },
+            GraphqlCredential::Bearer {
+                token: "token\r\nx-injected: value".to_owned(),
+            },
+            GraphqlCredential::ApiKeyHeader {
+                name: "x-api-key".to_owned(),
+                value: "value\nmore".to_owned(),
+            },
+            GraphqlCredential::Basic {
+                username: "admin".to_owned(),
+                password: "x".repeat(super::MAX_CREDENTIAL_BYTES + 1),
+            },
+            GraphqlCredential::Basic {
+                username: "admin:injected".to_owned(),
+                password: "password".to_owned(),
+            },
+        ] {
+            assert!(credential.validate().is_err());
+        }
+    }
+
+    #[test]
+    fn only_narrow_graphql_auth_errors_defer_discovery() {
+        for errors in [
+            json!([{ "message": "authentication required" }]),
+            json!([{ "message": "safe", "extensions": { "code": "UNAUTHENTICATED" } }]),
+            json!([{ "message": "safe", "extensions": { "http": { "status": 403 } } }]),
+        ] {
+            assert!(graphql_errors_require_authorization(&errors));
+        }
+        for errors in [
+            json!([{ "message": "GraphQL introspection is disabled" }]),
+            json!([{ "message": "Cannot query field unauthorized" }]),
+            json!([{ "message": "safe", "extensions": { "code": "GRAPHQL_VALIDATION_FAILED" } }]),
+        ] {
+            assert!(!graphql_errors_require_authorization(&errors));
+        }
+    }
+
+    #[test]
+    fn compiler_capacity_fails_fast_with_a_sanitized_retryable_error() {
+        let error = try_compile_permit(std::sync::Arc::new(tokio::sync::Semaphore::new(0)))
+            .expect_err("exhausted capacity is rejected before network or parsing");
+        assert_eq!(error.code, "graphql_compiler_busy");
+        assert_eq!(error.category, ProtocolErrorCategory::Conflict);
+        assert!(!error.message.contains("hostile"));
+    }
+
+    #[tokio::test]
+    async fn poisoned_plaintext_introspection_rejects_static_credentials_before_dispatch() {
+        let directory = tempfile::tempdir().unwrap();
+        let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+            .await
+            .unwrap();
+        let adapter = with_poisoned_localhost(GraphqlAdapter::default());
+        let credentials = [
+            GraphqlCredential::Bearer {
+                token: "bearer-secret".to_owned(),
+            },
+            GraphqlCredential::Basic {
+                username: "admin".to_owned(),
+                password: "basic-secret".to_owned(),
+            },
+            GraphqlCredential::ApiKeyHeader {
+                name: "x-api-key".to_owned(),
+                value: "api-key-secret".to_owned(),
+            },
+            GraphqlCredential::OAuthAccessToken {
+                access_token: "static-oauth-secret".to_owned(),
+            },
+        ];
+        for (index, credential) in credentials.into_iter().enumerate() {
+            let error = adapter
+                .create_source(
+                    app.catalog(),
+                    CreateGraphqlSource {
+                        display_name: format!("Poisoned GraphQL {index}"),
+                        preferred_slug: None,
+                        description: None,
+                        endpoint: "http://poison.localhost:8080/graphql".to_owned(),
+                        allow_private_network: true,
+                        credential: Some(credential),
+                    },
+                    AuditContext::system(Some("graphql-poisoned-introspection")),
+                )
+                .await
+                .expect_err("poisoned plaintext resolution is rejected");
+            assert_eq!(error.code, "insecure_outbound_transport");
+            assert_eq!(error.category, ProtocolErrorCategory::InvalidInput);
+        }
+        app.shutdown().await;
+    }
+
+    #[tokio::test]
+    async fn introspection_redirects_are_not_followed_or_reauthorized() {
+        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let redirected = TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let endpoint = format!("http://{}/graphql", listener.local_addr().unwrap());
+        let redirect_target = format!("http://{}/stolen", redirected.local_addr().unwrap());
+        let directory = tempfile::tempdir().unwrap();
+        let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+            .await
+            .unwrap();
+        let catalog = app.catalog().clone();
+        let create = tokio::spawn(async move {
+            GraphqlAdapter::default()
+                .create_source(
+                    &catalog,
+                    CreateGraphqlSource {
+                        display_name: "Redirecting GraphQL".to_owned(),
+                        preferred_slug: None,
+                        description: None,
+                        endpoint,
+                        allow_private_network: true,
+                        credential: Some(GraphqlCredential::Bearer {
+                            token: "introspection-redirect-secret".to_owned(),
+                        }),
+                    },
+                    AuditContext::system(Some("graphql-redirect-introspection")),
+                )
+                .await
+        });
+        let (mut stream, _) = listener.accept().await.unwrap();
+        let request = String::from_utf8_lossy(&read_request(&mut stream).await).into_owned();
+        assert!(request.contains("authorization: Bearer introspection-redirect-secret\r\n"));
+        assert!(request.contains("user-agent: executor\r\n"));
+        stream
+            .write_all(&response(
+                "302 Found",
+                "{}",
+                &format!("Location: {redirect_target}\r\n"),
+            ))
+            .await
+            .unwrap();
+        let error = create
+            .await
+            .unwrap()
+            .expect_err("introspection redirect is returned without being followed");
+        assert_eq!(error.code, "upstream_http_error");
+        assert!(
+            timeout(Duration::from_millis(100), redirected.accept())
+                .await
+                .is_err(),
+            "the credential is never redelivered to the redirect target"
+        );
+        app.shutdown().await;
+    }
+
+    #[tokio::test]
+    async fn poisoned_plaintext_invocation_rejects_static_credentials_before_dispatch() {
+        let endpoint = "http://poison.localhost:8080/graphql".to_owned();
+        let adapter = with_poisoned_localhost(GraphqlAdapter::default());
+        let credentials = [
+            GraphqlCredential::Bearer {
+                token: "bearer-secret".to_owned(),
+            },
+            GraphqlCredential::Basic {
+                username: "admin".to_owned(),
+                password: "basic-secret".to_owned(),
+            },
+            GraphqlCredential::ApiKeyHeader {
+                name: "x-api-key".to_owned(),
+                value: "api-key-secret".to_owned(),
+            },
+            GraphqlCredential::OAuthAccessToken {
+                access_token: "static-oauth-secret".to_owned(),
+            },
+        ];
+        for credential in credentials {
+            let prepared = adapter
+                .prepare_invocation(
+                    &query_binding(),
+                    &source_configuration(endpoint.clone(), true),
+                    Some(&stored_credential(endpoint.clone(), Some(credential))),
+                    &json!({ "id": "user-1" }),
+                    None,
+                )
+                .unwrap();
+            let error = adapter
+                .execute_invocation(prepared)
+                .await
+                .expect_err("poisoned plaintext resolution is rejected");
+            assert!(matches!(
+                error,
+                super::GraphqlInvocationError::Outbound {
+                    source: OutboundError::InsecureTransport,
+                    outcome_unknown: false,
+                }
+            ));
+        }
+    }
+
+    #[test]
+    fn stored_credentials_and_configuration_fail_closed() {
+        let malformed_credential = StoredCredential {
+            revision: 1,
+            credential: CredentialPayload {
+                schema_version: 1,
+                payload: json!({
+                    "endpoint": "https://example.test/graphql",
+                    "credential": {
+                        "type": "api_key_header",
+                        "name": "x-forwarded-host",
+                        "value": "internal.example"
+                    }
+                }),
+            },
+        };
+        let error = match StoredGraphqlCredentialV1::decode(&malformed_credential) {
+            Ok(_) => panic!("protected stored credential must fail closed"),
+            Err(error) => error,
+        };
+        assert_eq!(error.code, "invalid_source_credentials");
+        assert_eq!(error.category, ProtocolErrorCategory::CorruptData);
+
+        let configuration = Map::from_iter([
+            (
+                "endpoint".to_owned(),
+                json!("https://example.test/graphql?token=secret"),
+            ),
+            ("allowPrivateNetwork".to_owned(), json!(false)),
+        ]);
+        assert!(GraphqlSourceConfigurationV1::decode(&configuration).is_err());
+    }
+
+    #[tokio::test]
+    async fn invocation_posts_fixed_document_exact_variables_and_auth() {
+        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let endpoint = format!("http://{}/graphql", listener.local_addr().unwrap());
+        let prepared = GraphqlAdapter::default()
+            .prepare_invocation(
+                &query_binding(),
+                &source_configuration(endpoint.clone(), true),
+                Some(&stored_credential(
+                    endpoint,
+                    Some(GraphqlCredential::Bearer {
+                        token: "secret-token".to_owned(),
+                    }),
+                )),
+                &json!({ "id": "user-1" }),
+                None,
+            )
+            .unwrap();
+        let execution =
+            tokio::spawn(
+                async move { GraphqlAdapter::default().execute_invocation(prepared).await },
+            );
+        let (mut stream, _) = listener.accept().await.unwrap();
+        let request = read_request(&mut stream).await;
+        let request_text = String::from_utf8_lossy(&request);
+        assert!(request_text.starts_with("POST /graphql HTTP/1.1"));
+        assert!(request_text.contains("authorization: Bearer secret-token\r\n"));
+        assert!(request_text.contains("user-agent: executor\r\n"));
+        let body = request_text.split("\r\n\r\n").nth(1).unwrap();
+        assert_eq!(
+            serde_json::from_str::<Value>(body).unwrap(),
+            json!({
+                "query": "query ExecutorQueryHello($id: ID!) { result: hello(id: $id) }",
+                "operationName": "ExecutorQueryHello",
+                "variables": { "id": "user-1" }
+            })
+        );
+        stream
+            .write_all(&response("200 OK", r#"{"data":{"result":"world"}}"#, ""))
+            .await
+            .unwrap();
+        let result = execution.await.unwrap().unwrap();
+        assert!(result.ok);
+        assert_eq!(result.data, Some(json!("world")));
+    }
+
+    #[tokio::test]
+    async fn import_and_credential_cas_return_the_exact_committed_revision() {
+        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let endpoint = format!("http://{}/graphql", listener.local_addr().unwrap());
+        let directory = tempfile::tempdir().unwrap();
+        let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+            .await
+            .unwrap();
+        let catalog = app.catalog().clone();
+        let create = tokio::spawn(async move {
+            GraphqlAdapter::default()
+                .create_source(
+                    &catalog,
+                    CreateGraphqlSource {
+                        display_name: "GraphQL".to_owned(),
+                        preferred_slug: None,
+                        description: None,
+                        endpoint,
+                        allow_private_network: true,
+                        credential: None,
+                    },
+                    AuditContext::system(Some("graphql-create")),
+                )
+                .await
+        });
+        let (mut stream, _) = listener.accept().await.unwrap();
+        read_request(&mut stream).await;
+        let body = serde_json::to_string(&minimal_introspection()).unwrap();
+        stream
+            .write_all(&response("200 OK", &body, ""))
+            .await
+            .unwrap();
+        let source = create.await.unwrap().unwrap();
+        assert_eq!(source.tool_count, 1);
+
+        let first_catalog = app.catalog().clone();
+        let first_source = source.id.clone();
+        let first = tokio::spawn(async move {
+            GraphqlAdapter::default()
+                .replace_credentials(
+                    &first_catalog,
+                    &first_source,
+                    0,
+                    Some(GraphqlCredential::Bearer {
+                        token: "first-secret".to_owned(),
+                    }),
+                    AuditContext::system(Some("graphql-first-credential")),
+                )
+                .await
+        });
+        let second_catalog = app.catalog().clone();
+        let second_source = source.id.clone();
+        let second = tokio::spawn(async move {
+            GraphqlAdapter::default()
+                .replace_credentials(
+                    &second_catalog,
+                    &second_source,
+                    0,
+                    Some(GraphqlCredential::Basic {
+                        username: "second".to_owned(),
+                        password: "second-secret".to_owned(),
+                    }),
+                    AuditContext::system(Some("graphql-second-credential")),
+                )
+                .await
+        });
+        let outcomes = [first.await.unwrap(), second.await.unwrap()];
+        let committed = outcomes
+            .iter()
+            .find_map(|outcome| outcome.as_ref().ok())
+            .expect("one credential update commits");
+        assert_eq!(committed.revision, 1);
+        assert_eq!(outcomes.iter().filter(|outcome| outcome.is_ok()).count(), 1);
+        assert_eq!(
+            outcomes.iter().filter(|outcome| outcome.is_err()).count(),
+            1
+        );
+        let current = GraphqlAdapter::default()
+            .credential_metadata(app.catalog(), &source.id)
+            .await
+            .unwrap();
+        assert_eq!(current.revision, committed.revision);
+        assert_eq!(
+            current.configured_schemes[0].credential_type,
+            committed.configured_schemes[0].credential_type
+        );
+    }
+
+    #[tokio::test]
+    async fn overdeep_refresh_retains_the_last_good_graphql_catalog() {
+        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let endpoint = format!("http://{}/graphql", listener.local_addr().unwrap());
+        let directory = tempfile::tempdir().unwrap();
+        let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+            .await
+            .unwrap();
+        let catalog = app.catalog().clone();
+        let create_catalog = catalog.clone();
+        let create_endpoint = endpoint.clone();
+        let create = tokio::spawn(async move {
+            GraphqlAdapter::default()
+                .create_source(
+                    &create_catalog,
+                    CreateGraphqlSource {
+                        display_name: "GraphQL depth".to_owned(),
+                        preferred_slug: None,
+                        description: None,
+                        endpoint: create_endpoint,
+                        allow_private_network: true,
+                        credential: None,
+                    },
+                    AuditContext::system(Some("graphql-depth-create")),
+                )
+                .await
+        });
+        let (mut stream, _) = listener.accept().await.unwrap();
+        read_request(&mut stream).await;
+        let body = serde_json::to_string(&minimal_introspection()).unwrap();
+        stream
+            .write_all(&response("200 OK", &body, ""))
+            .await
+            .unwrap();
+        let source = create.await.unwrap().unwrap();
+        let original_tools = catalog
+            .list_tools(ListToolsFilter {
+                source_id: Some(source.id.clone()),
+                limit: 10,
+                ..ListToolsFilter::default()
+            })
+            .await
+            .unwrap();
+        assert_eq!(original_tools.items.len(), 1);
+        let original_tool = original_tools.items[0].clone();
+
+        let refresh_catalog = catalog.clone();
+        let refresh_source = source.clone();
+        let refresh = tokio::spawn(async move {
+            GraphqlAdapter::default()
+                .refresh_source(
+                    &refresh_catalog,
+                    refresh_source,
+                    AuditContext::system(Some("graphql-depth-refresh")),
+                )
+                .await
+        });
+        let (mut stream, _) = listener.accept().await.unwrap();
+        read_request(&mut stream).await;
+        let body = serde_json::to_string(&overdeep_input_introspection()).unwrap();
+        stream
+            .write_all(&response("200 OK", &body, ""))
+            .await
+            .unwrap();
+        let error = refresh
+            .await
+            .unwrap()
+            .expect_err("overdeep refresh is rejected");
+        assert_eq!(error.code, "graphql_schema_limit_exceeded");
+
+        let current = catalog.source(&source.id).await.unwrap();
+        assert_eq!(current.catalog_revision, source.catalog_revision);
+        let retained = catalog.tool(&original_tool.id).await.unwrap();
+        assert!(retained.present);
+        assert_eq!(retained.stable_key, original_tool.stable_key);
+        app.shutdown().await;
+    }
+
+    #[tokio::test]
+    async fn unauthenticated_denials_can_stage_an_authorization_required_source() {
+        for (status, body) in [
+            ("401 Unauthorized", "{}"),
+            (
+                "200 OK",
+                r#"{"errors":[{"message":"authentication required"}]}"#,
+            ),
+        ] {
+            let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+            let endpoint = format!("http://{}/graphql", listener.local_addr().unwrap());
+            let directory = tempfile::tempdir().unwrap();
+            let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+                .await
+                .unwrap();
+            let catalog = app.catalog().clone();
+            let create = tokio::spawn(async move {
+                GraphqlAdapter::default()
+                    .create_source(
+                        &catalog,
+                        CreateGraphqlSource {
+                            display_name: "GraphQL OAuth".to_owned(),
+                            preferred_slug: None,
+                            description: None,
+                            endpoint,
+                            allow_private_network: true,
+                            credential: None,
+                        },
+                        AuditContext::system(Some("graphql-oauth-create")),
+                    )
+                    .await
+            });
+            let (mut stream, _) = listener.accept().await.unwrap();
+            read_request(&mut stream).await;
+            stream.write_all(&response(status, body, "")).await.unwrap();
+            let source = create.await.unwrap().unwrap();
+            assert_eq!(source.tool_count, 0);
+            assert_eq!(source.health_status, SourceHealth::Error);
+            assert_eq!(
+                source.health_error_code.as_deref(),
+                Some("authorization_required")
+            );
+            app.shutdown().await;
+        }
+    }
+
+    #[tokio::test]
+    async fn static_credentials_suppress_managed_oauth_and_conflicts_fail_closed() {
+        let endpoint = "https://example.test/graphql".to_owned();
+        let stored = stored_credential(
+            endpoint.clone(),
+            Some(GraphqlCredential::Bearer {
+                token: "static-secret".to_owned(),
+            }),
+        );
+        let adapter = GraphqlAdapter::default();
+        assert!(
+            adapter
+                .oauth_binding_observation(
+                    "source-id",
+                    Some(&stored),
+                    Some(&[OAuthBinding {
+                        connection_id: "ignored-connection".to_owned(),
+                        credential_key: "default".to_owned(),
+                        config_revision: 1,
+                        granted_scopes: Vec::new(),
+                    }]),
+                )
+                .await
+                .unwrap()
+                .is_none()
+        );
+        let error = match adapter.prepare_invocation(
+            &query_binding(),
+            &source_configuration(endpoint, false),
+            Some(&stored),
+            &json!({ "id": "user-1" }),
+            Some(OAuthBinding {
+                connection_id: "connection-id".to_owned(),
+                credential_key: "default".to_owned(),
+                config_revision: 1,
+                granted_scopes: Vec::new(),
+            }),
+        ) {
+            Ok(_) => panic!("static and managed credentials must not both apply"),
+            Err(error) => error,
+        };
+        assert_eq!(error.code, "ambiguous_source_credentials");
+        assert_eq!(error.category, ProtocolErrorCategory::CorruptData);
+    }
+
+    #[tokio::test]
+    async fn managed_oauth_reaches_queries_and_mutations_static_wins_and_401_is_not_retried() {
+        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let endpoint = format!("http://{}/graphql", listener.local_addr().unwrap());
+        let directory = tempfile::tempdir().unwrap();
+        let master_key = [73_u8; 32];
+        let master_key_file = directory.path().join("fixture-master.key");
+        std::fs::write(&master_key_file, master_key).unwrap();
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+
+            std::fs::set_permissions(&master_key_file, std::fs::Permissions::from_mode(0o600))
+                .unwrap();
+        }
+        let app = ExecutorApp::open(
+            AppConfig::new(directory.path().join("data"))
+                .with_master_key_file(Some(master_key_file)),
+        )
+        .await
+        .unwrap();
+        let stored = StoredGraphqlCredentialV1 {
+            endpoint: endpoint.clone(),
+            credential: None,
+        };
+        let (source, _) = app
+            .catalog()
+            .create_source_with_catalog_health(
+                CreateSource {
+                    kind: SourceKind::Graphql,
+                    preferred_slug: "oauth_graphql".to_owned(),
+                    display_name: "OAuth GraphQL".to_owned(),
+                    description: None,
+                    configuration: source_configuration(endpoint.clone(), true),
+                },
+                &stored.payload().unwrap(),
+                InitialCatalogSnapshot {
+                    artifacts: Vec::new(),
+                    tools: Vec::new(),
+                },
+                Vec::new(),
+                SourceHealth::Unknown,
+                AuditContext::system(Some("graphql-oauth-fixture")),
+            )
+            .await
+            .unwrap();
+        let keyring = Keyring::from_master_key(master_key).unwrap();
+        OAuthStore::new(app.pool().clone(), keyring.clone())
+            .create_connection(
+                &source.id,
+                "default",
+                &OAuthConnectionConfig {
+                    issuer: "https://auth.example.test".to_owned(),
+                    authorization_endpoint: "https://auth.example.test/authorize".to_owned(),
+                    token_endpoint: "https://auth.example.test/token".to_owned(),
+                    client_id: "fixture-client".to_owned(),
+                    client_authentication: OAuthClientAuthentication::None,
+                    token_endpoint_auth_methods_supported: vec!["none".to_owned()],
+                    scopes: vec!["graphql".to_owned()],
+                    allow_private_network: false,
+                    resource: None,
+                },
+                Some(&OAuthSecretSet {
+                    access_token: Some("managed-secret-token".to_owned()),
+                    granted_scopes: vec!["graphql".to_owned()],
+                    ..OAuthSecretSet::default()
+                }),
+                1,
+            )
+            .await
+            .unwrap();
+        let adapter = GraphqlAdapter::with_oauth(OAuthService::new(
+            app.pool().clone(),
+            keyring,
+            "http://127.0.0.1:4788".to_owned(),
+            OutboundPolicy::default(),
+        ));
+        let stored_record = app.catalog().credential(&source.id).await.unwrap().unwrap();
+        let binding = adapter
+            .oauth_binding_observation(&source.id, Some(&stored_record), None)
+            .await
+            .unwrap()
+            .unwrap();
+
+        let prepared = adapter
+            .prepare_invocation(
+                &query_binding(),
+                &source.configuration,
+                Some(&stored_record),
+                &json!({ "id": "user-1" }),
+                Some(binding.clone()),
+            )
+            .unwrap();
+        let query_adapter = adapter.clone();
+        let query = tokio::spawn(async move { query_adapter.execute_invocation(prepared).await });
+        let (mut stream, _) = listener.accept().await.unwrap();
+        let request = String::from_utf8_lossy(&read_request(&mut stream).await).into_owned();
+        assert!(request.contains("authorization: Bearer managed-secret-token\r\n"));
+        stream
+            .write_all(&response("200 OK", r#"{"data":{"result":"managed"}}"#, ""))
+            .await
+            .unwrap();
+        assert_eq!(query.await.unwrap().unwrap().data, Some(json!("managed")));
+
+        let prepared = adapter
+            .prepare_invocation(
+                &mutation_binding(),
+                &source.configuration,
+                Some(&stored_record),
+                &json!({ "id": "user-1" }),
+                Some(binding.clone()),
+            )
+            .unwrap();
+        let mutation_adapter = adapter.clone();
+        let mutation =
+            tokio::spawn(async move { mutation_adapter.execute_invocation(prepared).await });
+        let (mut stream, _) = listener.accept().await.unwrap();
+        let request = String::from_utf8_lossy(&read_request(&mut stream).await).into_owned();
+        assert!(request.contains("authorization: Bearer managed-secret-token\r\n"));
+        stream
+            .write_all(&response("401 Unauthorized", "{}", ""))
+            .await
+            .unwrap();
+        assert!(matches!(
+            mutation.await.unwrap(),
+            Err(super::GraphqlInvocationError::Indeterminate)
+        ));
+        assert!(
+            timeout(Duration::from_millis(100), listener.accept())
+                .await
+                .is_err(),
+            "a dispatched mutation is never retried after an authentication response"
+        );
+
+        let static_stored = stored_credential(
+            endpoint,
+            Some(GraphqlCredential::Bearer {
+                token: "static-secret-token".to_owned(),
+            }),
+        );
+        let observed = adapter
+            .oauth_binding_observation(&source.id, Some(&static_stored), Some(&[binding]))
+            .await
+            .unwrap();
+        assert!(observed.is_none());
+        let prepared = adapter
+            .prepare_invocation(
+                &query_binding(),
+                &source.configuration,
+                Some(&static_stored),
+                &json!({ "id": "user-1" }),
+                observed,
+            )
+            .unwrap();
+        let static_adapter = adapter.clone();
+        let static_query =
+            tokio::spawn(async move { static_adapter.execute_invocation(prepared).await });
+        let (mut stream, _) = listener.accept().await.unwrap();
+        let request = String::from_utf8_lossy(&read_request(&mut stream).await).into_owned();
+        assert!(request.contains("authorization: Bearer static-secret-token\r\n"));
+        assert!(!request.contains("managed-secret-token"));
+        stream
+            .write_all(&response("200 OK", r#"{"data":{"result":"static"}}"#, ""))
+            .await
+            .unwrap();
+        assert_eq!(
+            static_query.await.unwrap().unwrap().data,
+            Some(json!("static"))
+        );
+        app.shutdown().await;
+    }
+
+    #[tokio::test]
+    async fn poisoned_plaintext_managed_oauth_never_dispatches_and_refresh_keeps_last_good() {
+        let directory = tempfile::tempdir().unwrap();
+        let master_key = [74_u8; 32];
+        let master_key_file = directory.path().join("fixture-master.key");
+        std::fs::write(&master_key_file, master_key).unwrap();
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+
+            std::fs::set_permissions(&master_key_file, std::fs::Permissions::from_mode(0o600))
+                .unwrap();
+        }
+        let app = ExecutorApp::open(
+            AppConfig::new(directory.path().join("data"))
+                .with_master_key_file(Some(master_key_file)),
+        )
+        .await
+        .unwrap();
+        let endpoint = "http://poison.localhost:8080/graphql".to_owned();
+        let stored = StoredGraphqlCredentialV1 {
+            endpoint: endpoint.clone(),
+            credential: None,
+        };
+        let binding = query_binding();
+        let stable_key = binding.stable_key().unwrap();
+        let (source, _) = app
+            .catalog()
+            .create_source_with_catalog_health(
+                CreateSource {
+                    kind: SourceKind::Graphql,
+                    preferred_slug: "poisoned_oauth_graphql".to_owned(),
+                    display_name: "Poisoned OAuth GraphQL".to_owned(),
+                    description: None,
+                    configuration: source_configuration(endpoint, true),
+                },
+                &stored.payload().unwrap(),
+                InitialCatalogSnapshot {
+                    artifacts: Vec::new(),
+                    tools: vec![StagedTool {
+                        stable_key: stable_key.clone(),
+                        preferred_name: "hello".to_owned(),
+                        display_name: "hello".to_owned(),
+                        description: None,
+                        input_schema: json!({ "type": "object" }),
+                        output_schema: None,
+                        input_typescript: None,
+                        output_typescript: None,
+                        typescript_definitions: BTreeMap::new(),
+                        intrinsic_mode: ToolMode::Enabled,
+                    }],
+                },
+                vec![StagedToolBinding {
+                    stable_key,
+                    binding: ToolBinding::GraphqlV1(binding.clone()),
+                }],
+                SourceHealth::Healthy,
+                AuditContext::system(Some("graphql-poisoned-oauth-fixture")),
+            )
+            .await
+            .unwrap();
+        let original_tool = app
+            .catalog()
+            .list_tools(ListToolsFilter {
+                source_id: Some(source.id.clone()),
+                limit: 10,
+                ..ListToolsFilter::default()
+            })
+            .await
+            .unwrap()
+            .items
+            .into_iter()
+            .next()
+            .unwrap();
+        let keyring = Keyring::from_master_key(master_key).unwrap();
+        OAuthStore::new(app.pool().clone(), keyring.clone())
+            .create_connection(
+                &source.id,
+                "default",
+                &OAuthConnectionConfig {
+                    issuer: "https://auth.example.test".to_owned(),
+                    authorization_endpoint: "https://auth.example.test/authorize".to_owned(),
+                    token_endpoint: "https://auth.example.test/token".to_owned(),
+                    client_id: "fixture-client".to_owned(),
+                    client_authentication: OAuthClientAuthentication::None,
+                    token_endpoint_auth_methods_supported: vec!["none".to_owned()],
+                    scopes: vec!["graphql".to_owned()],
+                    allow_private_network: false,
+                    resource: None,
+                },
+                Some(&OAuthSecretSet {
+                    access_token: Some("managed-secret-token".to_owned()),
+                    granted_scopes: vec!["graphql".to_owned()],
+                    ..OAuthSecretSet::default()
+                }),
+                1,
+            )
+            .await
+            .unwrap();
+        let adapter = with_poisoned_localhost(GraphqlAdapter::with_oauth(OAuthService::new(
+            app.pool().clone(),
+            keyring,
+            "http://127.0.0.1:4788".to_owned(),
+            OutboundPolicy::default(),
+        )));
+        let stored_record = app.catalog().credential(&source.id).await.unwrap().unwrap();
+        let oauth_binding = adapter
+            .oauth_binding_observation(&source.id, Some(&stored_record), None)
+            .await
+            .unwrap()
+            .unwrap();
+        let prepared = adapter
+            .prepare_invocation(
+                &binding,
+                &source.configuration,
+                Some(&stored_record),
+                &json!({ "id": "user-1" }),
+                Some(oauth_binding),
+            )
+            .unwrap();
+        let error = adapter
+            .execute_invocation(prepared)
+            .await
+            .expect_err("managed token is not sent over poisoned plaintext");
+        assert!(matches!(
+            error,
+            super::GraphqlInvocationError::Outbound {
+                source: OutboundError::InsecureTransport,
+                outcome_unknown: false,
+            }
+        ));
+
+        let refresh_error = adapter
+            .refresh_source(
+                app.catalog(),
+                source.clone(),
+                AuditContext::system(Some("graphql-poisoned-oauth-refresh")),
+            )
+            .await
+            .expect_err("managed introspection token is not sent over poisoned plaintext");
+        assert_eq!(refresh_error.code, "insecure_outbound_transport");
+        assert_eq!(refresh_error.category, ProtocolErrorCategory::InvalidInput);
+        let current = app.catalog().source(&source.id).await.unwrap();
+        assert_eq!(current.catalog_revision, source.catalog_revision);
+        let retained = app.catalog().tool(&original_tool.id).await.unwrap();
+        assert!(retained.present);
+        assert_eq!(retained.stable_key, original_tool.stable_key);
+        app.shutdown().await;
+    }
+
+    #[tokio::test]
+    async fn upstream_errors_are_sanitized_and_redirects_are_not_followed() {
+        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let endpoint = format!("http://{}/graphql", listener.local_addr().unwrap());
+        let prepared = GraphqlAdapter::default()
+            .prepare_invocation(
+                &query_binding(),
+                &source_configuration(endpoint.clone(), true),
+                Some(&stored_credential(
+                    endpoint,
+                    Some(GraphqlCredential::Bearer {
+                        token: "redirect-secret".to_owned(),
+                    }),
+                )),
+                &json!({ "id": "user-1" }),
+                None,
+            )
+            .unwrap();
+        let execution =
+            tokio::spawn(
+                async move { GraphqlAdapter::default().execute_invocation(prepared).await },
+            );
+        let (mut stream, _) = listener.accept().await.unwrap();
+        let request = String::from_utf8_lossy(&read_request(&mut stream).await).into_owned();
+        assert!(request.contains("authorization: Bearer redirect-secret\r\n"));
+        stream
+            .write_all(&response(
+                "200 OK",
+                r#"{"errors":[{"message":"database password is hunter2"}],"data":{"result":null}}"#,
+                "",
+            ))
+            .await
+            .unwrap();
+        let result = execution.await.unwrap().unwrap();
+        let error = result.error.unwrap();
+        assert_eq!(error.code, "graphql_error");
+        assert!(!error.message.contains("hunter2"));
+
+        let endpoint = format!("http://{}/graphql", listener.local_addr().unwrap());
+        let prepared = GraphqlAdapter::default()
+            .prepare_invocation(
+                &query_binding(),
+                &source_configuration(endpoint.clone(), true),
+                Some(&stored_credential(
+                    endpoint,
+                    Some(GraphqlCredential::Bearer {
+                        token: "redirect-secret".to_owned(),
+                    }),
+                )),
+                &json!({ "id": "user-1" }),
+                None,
+            )
+            .unwrap();
+        let execution =
+            tokio::spawn(
+                async move { GraphqlAdapter::default().execute_invocation(prepared).await },
+            );
+        let (mut stream, _) = listener.accept().await.unwrap();
+        let request = String::from_utf8_lossy(&read_request(&mut stream).await).into_owned();
+        assert!(request.contains("authorization: Bearer redirect-secret\r\n"));
+        stream
+            .write_all(&response("302 Found", "{}", "Location: /redirected\r\n"))
+            .await
+            .unwrap();
+        let result = execution.await.unwrap().unwrap();
+        assert!(!result.ok);
+        assert_eq!(result.http.unwrap().status, 302);
+        assert!(
+            timeout(Duration::from_millis(100), listener.accept())
+                .await
+                .is_err()
+        );
+    }
+
+    #[tokio::test]
+    async fn mutation_ambiguous_responses_and_graphql_errors_are_indeterminate() {
+        for (status, body) in [
+            ("302 Found", "{}"),
+            ("400 Bad Request", "{}"),
+            ("409 Conflict", "{}"),
+            ("429 Too Many Requests", "{}"),
+            ("500 Internal Server Error", "{}"),
+            ("408 Request Timeout", "{}"),
+            ("200 OK", "not-json"),
+            ("200 OK", r#"{"data":{}}"#),
+            ("200 OK", r#"{"errors":{},"data":{"result":null}}"#),
+            ("200 OK", r#"{"errors":[null],"data":{"result":null}}"#),
+        ] {
+            let error = execute_with_response(&mutation_binding(), status, body)
+                .await
+                .expect_err("ambiguous mutation response must be indeterminate");
+            assert!(matches!(
+                error,
+                super::GraphqlInvocationError::Indeterminate
+            ));
+            assert!(error.outcome_unknown());
+        }
+
+        let error = execute_with_response(
+            &mutation_binding(),
+            "200 OK",
+            r#"{"errors":[{"message":"secret upstream detail"}],"data":{"result":null}}"#,
+        )
+        .await
+        .expect_err("mutation errors can follow committed side effects");
+        assert!(error.outcome_unknown());
+
+        let result = execute_with_response(&query_binding(), "200 OK", "not-json")
+            .await
+            .expect("malformed query responses are ordinary failures");
+        assert!(!result.ok);
+        assert_eq!(result.error.unwrap().code, "invalid_graphql_response");
+    }
+
+    #[tokio::test]
+    async fn post_write_disconnect_is_unknown_but_private_policy_failure_is_pre_dispatch() {
+        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let endpoint = format!("http://{}/graphql", listener.local_addr().unwrap());
+        let prepared = GraphqlAdapter::default()
+            .prepare_invocation(
+                &mutation_binding(),
+                &source_configuration(endpoint.clone(), true),
+                Some(&stored_credential(endpoint, None)),
+                &json!({ "id": "user-1" }),
+                None,
+            )
+            .unwrap();
+        let execution =
+            tokio::spawn(
+                async move { GraphqlAdapter::default().execute_invocation(prepared).await },
+            );
+        let (mut stream, _) = listener.accept().await.unwrap();
+        read_request(&mut stream).await;
+        drop(stream);
+        let error = execution.await.unwrap().unwrap_err();
+        assert!(error.outcome_unknown());
+
+        let endpoint = "http://127.0.0.1:1/graphql".to_owned();
+        let error = match GraphqlAdapter::default().prepare_invocation(
+            &mutation_binding(),
+            &source_configuration(endpoint.clone(), false),
+            Some(&stored_credential(endpoint, None)),
+            &json!({ "id": "user-1" }),
+            None,
+        ) {
+            Ok(_) => panic!("private policy failure must happen before dispatch"),
+            Err(error) => error,
+        };
+        assert_eq!(error.code, "private_network_denied");
+    }
+
+    #[test]
+    fn canonical_binding_tampering_and_extra_arguments_fail_before_network() {
+        let mut binding = query_binding();
+        binding.document = "query Evil { result: adminSecrets }".to_owned();
+        let endpoint = "https://example.test/graphql".to_owned();
+        let error = match GraphqlAdapter::default().prepare_invocation(
+            &binding,
+            &source_configuration(endpoint.clone(), false),
+            Some(&stored_credential(endpoint.clone(), None)),
+            &json!({ "id": "user-1" }),
+            None,
+        ) {
+            Ok(_) => panic!("tampered binding must fail closed"),
+            Err(error) => error,
+        };
+        assert_eq!(error.code, "invalid_tool_binding");
+        assert_eq!(error.category, ProtocolErrorCategory::CorruptData);
+
+        let error = match GraphqlAdapter::default().prepare_invocation(
+            &query_binding(),
+            &source_configuration(endpoint.clone(), false),
+            Some(&stored_credential(endpoint, None)),
+            &json!({ "id": "user-1", "document": "mutation Evil" }),
+            None,
+        ) {
+            Ok(_) => panic!("extra arguments must not alter the document"),
+            Err(error) => error,
+        };
+        assert_eq!(error.code, "invalid_tool_arguments");
+    }
+
+    #[test]
+    fn public_endpoint_strips_path_and_query_secrets_and_public_configuration_rejects_them() {
+        let endpoint = public_endpoint(
+            "https://graphql.example.test/secret-path/api?token=secret&tenant=customer",
+        )
+        .expect("query-bearing endpoints are valid in encrypted storage");
+        assert_eq!(endpoint, "https://graphql.example.test/");
+        assert!(!endpoint.contains("secret"));
+
+        let exposed = Map::from_iter([
+            (
+                "endpoint".to_owned(),
+                json!("https://graphql.example.test/api?token=secret"),
+            ),
+            ("allowPrivateNetwork".to_owned(), json!(false)),
+        ]);
+        assert!(GraphqlSourceConfigurationV1::decode(&exposed).is_err());
+        assert!(public_endpoint("https://user:secret@example.test/graphql").is_err());
+        assert!(public_endpoint("https://example.test/graphql#secret").is_err());
+        assert!(public_endpoint("http://api.example.test/graphql").is_err());
+        assert!(public_endpoint("http://localhost:8080/graphql").is_ok());
+        assert!(public_endpoint("http://127.0.0.1:8080/graphql").is_ok());
+    }
+}
diff --git a/src/protocols/mcp.rs b/src/protocols/mcp.rs
new file mode 100644
index 000000000..f1157e2ed
--- /dev/null
+++ b/src/protocols/mcp.rs
@@ -0,0 +1,6246 @@
+use std::{collections::BTreeMap, future::Future, sync::Arc, time::Duration};
+
+use async_trait::async_trait;
+use base64::{Engine as _, engine::general_purpose::STANDARD};
+use reqwest::header::{AUTHORIZATION, HeaderMap, HeaderName, HeaderValue};
+use serde::{Deserialize, Serialize};
+use serde_json::{Map, Value, json};
+use thiserror::Error;
+use tokio::sync::broadcast::error::{RecvError, TryRecvError};
+use url::{Host, Url};
+
+use super::{
+    ConfiguredCredential, CredentialMetadata, ProtocolError, ProtocolErrorCategory,
+    ProtocolExecutionResponse, ProtocolResponseError, protocol_catalog_error,
+};
+use crate::{
+    catalog::{
+        AuditContext, CatalogStore, CatalogSyncResult, CreateSource, CredentialPayload,
+        InitialCatalogSnapshot, McpToolBindingV1, OAuthBindingExpectation, SourceHealth,
+        SourceKind, SourceRecord, StoredCredential,
+    },
+    mcp::{
+        discovery::{
+            DiscoveredMcpTool, DiscoveryBasis, DiscoveryError, DiscoveryPlan, ListChangedCoalescer,
+            ToolPage, ToolPageFetcher, bindings_for_source_kind, discover,
+        },
+        manager::{McpConnectionManager, SourceRevisionLease, WatcherRevisionLease},
+        upstream::{
+            http::{
+                DEFAULT_PROTOCOL_VERSION as HTTP_PROTOCOL_VERSION, StreamableHttpConfig,
+                StreamableHttpError, StreamableHttpTransport, is_supported_protocol_version,
+            },
+            stdio::{
+                DEFAULT_PROTOCOL_VERSION as STDIO_PROTOCOL_VERSION, InitializeResult,
+                StdioLifecycleMonitor, StdioTemplateError, StdioTemplateRegistry,
+                StdioTransportError, StdioTransportLimits,
+            },
+        },
+    },
+    oauth::{OAuthBinding, OAuthError, OAuthService},
+};
+
+const MCP_CREDENTIAL_SCHEMA_VERSION: u32 = 1;
+const MAX_ENDPOINT_BYTES: usize = 8 * 1024;
+const MAX_CREDENTIAL_BYTES: usize = 64 * 1024;
+const MAX_SECRET_VALUES: usize = 128;
+const MAX_SECRET_NAME_BYTES: usize = 256;
+const MAX_SECRET_VALUE_BYTES: usize = 16 * 1024;
+const MAX_DISCOVERY_GENERATIONS: usize = 8;
+const DISCOVERY_DEADLINE: Duration = Duration::from_secs(120);
+const DISCOVERY_QUIET_PERIOD: Duration = Duration::from_millis(25);
+const STDIO_WATCHER_HEARTBEAT: Duration = Duration::from_secs(1);
+const WATCHER_RECONCILIATION_ATTEMPTS: usize = 3;
+const WATCHER_RECONCILIATION_RETRY_DELAY: Duration = Duration::from_millis(25);
+
+#[derive(Clone, Deserialize, Serialize)]
+#[serde(
+    tag = "type",
+    rename_all = "snake_case",
+    rename_all_fields = "camelCase",
+    deny_unknown_fields
+)]
+pub enum McpHttpCredential {
+    Bearer {
+        token: String,
+    },
+    Basic {
+        username: String,
+        password: String,
+    },
+    ApiKeyHeader {
+        name: String,
+        value: String,
+    },
+    #[serde(rename = "oauth_access_token")]
+    OAuthAccessToken {
+        access_token: String,
+    },
+}
+
+impl McpHttpCredential {
+    fn credential_type(&self) -> &'static str {
+        match self {
+            Self::Bearer { .. } => "bearer",
+            Self::Basic { .. } => "basic",
+            Self::ApiKeyHeader { .. } => "api_key_header",
+            Self::OAuthAccessToken { .. } => "oauth_access_token",
+        }
+    }
+
+    fn headers(&self) -> Result<HeaderMap, ProtocolError> {
+        let mut headers = HeaderMap::new();
+        match self {
+            Self::Bearer { token }
+            | Self::OAuthAccessToken {
+                access_token: token,
+            } => {
+                let mut value = HeaderValue::from_str(&format!("Bearer {token}"))
+                    .map_err(|_| invalid_credentials("The MCP bearer credential is invalid."))?;
+                value.set_sensitive(true);
+                headers.insert(AUTHORIZATION, value);
+            }
+            Self::Basic { username, password } => {
+                let encoded = STANDARD.encode(format!("{username}:{password}"));
+                let mut value = HeaderValue::from_str(&format!("Basic {encoded}"))
+                    .map_err(|_| invalid_credentials("The MCP basic credential is invalid."))?;
+                value.set_sensitive(true);
+                headers.insert(AUTHORIZATION, value);
+            }
+            Self::ApiKeyHeader { name, value } => {
+                let name = HeaderName::from_bytes(name.as_bytes())
+                    .map_err(|_| invalid_credentials("The MCP API key header name is invalid."))?;
+                if protected_mcp_header(&name) {
+                    return Err(invalid_credentials(
+                        "The MCP API key cannot use a protected HTTP header.",
+                    ));
+                }
+                let mut value = HeaderValue::from_str(value)
+                    .map_err(|_| invalid_credentials("The MCP API key header value is invalid."))?;
+                value.set_sensitive(true);
+                headers.insert(name, value);
+            }
+        }
+        Ok(headers)
+    }
+
+    fn validate(&self) -> Result<(), ProtocolError> {
+        match self {
+            Self::Bearer { token }
+            | Self::OAuthAccessToken {
+                access_token: token,
+            } => {
+                validate_secret(token)?;
+            }
+            Self::Basic { username, password } => {
+                if username.is_empty() || username.contains(':') || username.len() > 4 * 1024 {
+                    return Err(invalid_credentials(
+                        "The MCP basic credential username is invalid.",
+                    ));
+                }
+                validate_secret(password)?;
+            }
+            Self::ApiKeyHeader { name, value } => {
+                if name.is_empty() || name.len() > 256 {
+                    return Err(invalid_credentials(
+                        "The MCP API key header name is invalid.",
+                    ));
+                }
+                validate_secret(value)?;
+            }
+        }
+        let headers = self.headers()?;
+        let mut config = StreamableHttpConfig::new("https://example.invalid/mcp");
+        config.headers = headers;
+        StreamableHttpTransport::new(config).map_err(http_configuration_error)?;
+        Ok(())
+    }
+}
+
+fn protected_mcp_header(name: &HeaderName) -> bool {
+    matches!(
+        name.as_str(),
+        "host"
+            | "content-type"
+            | "accept"
+            | "content-length"
+            | "connection"
+            | "transfer-encoding"
+            | "mcp-session-id"
+            | "mcp-protocol-version"
+            | "origin"
+            | "referer"
+            | "authorization"
+            | "proxy-authorization"
+            | "proxy-connection"
+    ) || name.as_str().starts_with("proxy-")
+}
+
+#[derive(Clone, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct CreateMcpHttpSource {
+    pub display_name: String,
+    pub preferred_slug: Option<String>,
+    pub description: Option<String>,
+    pub endpoint: String,
+    #[serde(default)]
+    pub allow_private_network: bool,
+    pub credential: Option<McpHttpCredential>,
+}
+
+#[derive(Clone, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct CreateMcpStdioSource {
+    pub display_name: String,
+    pub preferred_slug: Option<String>,
+    pub description: Option<String>,
+    pub template_name: String,
+    #[serde(default)]
+    pub secret_values: BTreeMap<String, String>,
+}
+
+#[derive(Clone, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct ReplaceMcpHttpCredential {
+    pub credential: Option<McpHttpCredential>,
+}
+
+#[derive(Clone, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct ReplaceMcpStdioCredential {
+    #[serde(default)]
+    pub secret_values: BTreeMap<String, String>,
+}
+
+#[derive(Clone, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct McpHttpSourceConfigurationV1 {
+    endpoint: String,
+    allow_private_network: bool,
+    negotiated_protocol_version: String,
+}
+
+#[derive(Clone, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct McpStdioSourceConfigurationV1 {
+    template_name: String,
+    negotiated_protocol_version: Option<String>,
+}
+
+#[derive(Clone, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub(super) struct StoredMcpHttpCredentialV1 {
+    endpoint: String,
+    credential: Option<McpHttpCredential>,
+}
+
+#[derive(Clone, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct StoredMcpStdioCredentialV1 {
+    template_name: String,
+    secret_values: BTreeMap<String, String>,
+}
+
+#[derive(Clone)]
+pub struct McpAdapter {
+    connections: Arc<McpConnectionManager>,
+    oauth: Option<OAuthService>,
+    #[cfg(test)]
+    post_commit_pause: Option<Arc<PostCommitPause>>,
+    #[cfg(test)]
+    watcher_unavailable_pause: Option<Arc<WatcherUnavailablePause>>,
+    #[cfg(test)]
+    watcher_install_attempts: Option<Arc<std::sync::atomic::AtomicUsize>>,
+    #[cfg(test)]
+    watcher_capability_load_failures: Option<Arc<std::sync::atomic::AtomicUsize>>,
+    #[cfg(test)]
+    watcher_credential_load_failures: Option<Arc<std::sync::atomic::AtomicUsize>>,
+}
+
+#[cfg(test)]
+#[derive(Default)]
+struct PostCommitPause {
+    reached: tokio::sync::Notify,
+    release: tokio::sync::Notify,
+}
+
+struct WatcherReconciliationFailure {
+    error: ProtocolError,
+    failed_revision: Option<i64>,
+}
+
+#[cfg(test)]
+#[derive(Default)]
+pub(super) struct WatcherUnavailablePause {
+    reached: tokio::sync::Notify,
+    release: tokio::sync::Notify,
+}
+
+#[cfg(test)]
+impl WatcherUnavailablePause {
+    pub(super) async fn reached(&self) {
+        self.reached.notified().await;
+    }
+
+    pub(super) fn release(&self) {
+        self.release.notify_one();
+    }
+}
+
+impl Default for McpAdapter {
+    fn default() -> Self {
+        Self::new(StdioTemplateRegistry::default())
+    }
+}
+
+impl McpAdapter {
+    pub fn new(stdio_templates: StdioTemplateRegistry) -> Self {
+        Self {
+            connections: Arc::new(McpConnectionManager::new(stdio_templates)),
+            oauth: None,
+            #[cfg(test)]
+            post_commit_pause: None,
+            #[cfg(test)]
+            watcher_unavailable_pause: None,
+            #[cfg(test)]
+            watcher_install_attempts: None,
+            #[cfg(test)]
+            watcher_capability_load_failures: None,
+            #[cfg(test)]
+            watcher_credential_load_failures: None,
+        }
+    }
+
+    pub fn stdio_templates(&self) -> &StdioTemplateRegistry {
+        self.connections.stdio_templates()
+    }
+
+    pub(crate) fn with_connection_manager(connections: Arc<McpConnectionManager>) -> Self {
+        Self {
+            connections,
+            oauth: None,
+            #[cfg(test)]
+            post_commit_pause: None,
+            #[cfg(test)]
+            watcher_unavailable_pause: None,
+            #[cfg(test)]
+            watcher_install_attempts: None,
+            #[cfg(test)]
+            watcher_capability_load_failures: None,
+            #[cfg(test)]
+            watcher_credential_load_failures: None,
+        }
+    }
+
+    pub(crate) fn with_services(
+        connections: Arc<McpConnectionManager>,
+        oauth: OAuthService,
+    ) -> Self {
+        Self {
+            connections,
+            oauth: Some(oauth),
+            #[cfg(test)]
+            post_commit_pause: None,
+            #[cfg(test)]
+            watcher_unavailable_pause: None,
+            #[cfg(test)]
+            watcher_install_attempts: None,
+            #[cfg(test)]
+            watcher_capability_load_failures: None,
+            #[cfg(test)]
+            watcher_credential_load_failures: None,
+        }
+    }
+
+    pub async fn create_http_source(
+        &self,
+        catalog: &CatalogStore,
+        input: CreateMcpHttpSource,
+        audit: AuditContext<'_>,
+    ) -> Result<SourceRecord, ProtocolError> {
+        validate_http_credential(input.credential.as_ref())?;
+        let endpoint = validate_endpoint(&input.endpoint)?;
+        let stored = StoredMcpHttpCredentialV1 {
+            endpoint: endpoint.to_string(),
+            credential: input.credential,
+        };
+        let _operation = self.connections.begin_operation().map_err(shutting_down)?;
+        let discovery =
+            discover_http_for_create(&stored, input.allow_private_network, 0, Some(0)).await?;
+        let configuration = McpHttpSourceConfigurationV1 {
+            endpoint: display_endpoint(&endpoint),
+            allow_private_network: input.allow_private_network,
+            negotiated_protocol_version: discovery.protocol_version().to_owned(),
+        };
+        let preferred_slug = input
+            .preferred_slug
+            .unwrap_or_else(|| input.display_name.clone());
+        let create = CreateSource {
+            kind: SourceKind::McpHttp,
+            preferred_slug,
+            display_name: input.display_name,
+            description: input.description,
+            configuration: encode_configuration(&configuration)?,
+        };
+        let credential = stored.payload()?;
+        let (source, authorization_required) = match discovery {
+            HttpCreateDiscovery::Ready(plan) => {
+                let plan = *plan;
+                (
+                    catalog
+                        .create_source_with_catalog(
+                            create,
+                            &credential,
+                            plan.initial_catalog_snapshot(),
+                            plan.bindings,
+                            audit,
+                        )
+                        .await
+                        .map_err(protocol_catalog_error)?
+                        .0,
+                    false,
+                )
+            }
+            HttpCreateDiscovery::AuthorizationRequired => (
+                catalog
+                    .create_authorization_required_source_with_catalog(
+                        create,
+                        &credential,
+                        InitialCatalogSnapshot {
+                            artifacts: Vec::new(),
+                            tools: Vec::new(),
+                        },
+                        Vec::new(),
+                        audit,
+                    )
+                    .await
+                    .map_err(protocol_catalog_error)?
+                    .0,
+                true,
+            ),
+        };
+        if !authorization_required
+            && let Err(error) = self.install_source_watcher(catalog, &source).await
+        {
+            tracing::warn!(
+                source_id = source.id,
+                code = error.code,
+                "MCP HTTP source watcher installation failed"
+            );
+        }
+        Ok(source)
+    }
+
+    pub async fn create_stdio_source(
+        &self,
+        catalog: &CatalogStore,
+        input: CreateMcpStdioSource,
+        audit: AuditContext<'_>,
+    ) -> Result<SourceRecord, ProtocolError> {
+        self.connections
+            .stdio_templates()
+            .template(&input.template_name)
+            .map_err(input_template_error)?;
+        validate_secret_values(&input.secret_values)?;
+        let discover_now = stdio_secrets_complete(
+            self.connections.stdio_templates(),
+            &input.template_name,
+            &input.secret_values,
+        )?;
+        let stored = StoredMcpStdioCredentialV1 {
+            template_name: input.template_name.clone(),
+            secret_values: input.secret_values,
+        };
+        let (snapshot, bindings, negotiated_protocol_version) = if discover_now {
+            let _operation = self.connections.begin_operation().map_err(shutting_down)?;
+            let plan =
+                discover_stdio(self.connections.stdio_templates(), &stored, 0, Some(0)).await?;
+            let negotiated_protocol_version = plan.basis.protocol_version.clone();
+            (
+                plan.initial_catalog_snapshot(),
+                plan.bindings,
+                negotiated_protocol_version,
+            )
+        } else {
+            (
+                InitialCatalogSnapshot {
+                    artifacts: Vec::new(),
+                    tools: Vec::new(),
+                },
+                Vec::new(),
+                HTTP_PROTOCOL_VERSION.to_owned(),
+            )
+        };
+        let configuration = McpStdioSourceConfigurationV1 {
+            template_name: input.template_name,
+            negotiated_protocol_version: discover_now.then_some(negotiated_protocol_version),
+        };
+        let preferred_slug = input
+            .preferred_slug
+            .unwrap_or_else(|| input.display_name.clone());
+        let create = CreateSource {
+            kind: SourceKind::McpStdio,
+            preferred_slug,
+            display_name: input.display_name,
+            description: input.description,
+            configuration: encode_configuration(&configuration)?,
+        };
+        let credential = stored.payload()?;
+        let (source, _) = if discover_now {
+            catalog
+                .create_source_with_catalog(create, &credential, snapshot, bindings, audit)
+                .await
+        } else {
+            catalog
+                .create_source_with_catalog_health(
+                    create,
+                    &credential,
+                    snapshot,
+                    bindings,
+                    SourceHealth::Unknown,
+                    audit,
+                )
+                .await
+        }
+        .map_err(protocol_catalog_error)?;
+        if discover_now && let Err(error) = self.install_source_watcher(catalog, &source).await {
+            tracing::warn!(
+                source_id = source.id,
+                code = error.code,
+                "MCP stdio source watcher installation failed"
+            );
+        }
+        Ok(source)
+    }
+
+    pub async fn refresh_source(
+        &self,
+        catalog: &CatalogStore,
+        source: SourceRecord,
+        audit: AuditContext<'_>,
+    ) -> Result<CatalogSyncResult, ProtocolError> {
+        let _operation = self.connections.begin_operation().map_err(shutting_down)?;
+        let source_id = source.id.clone();
+        let result = self.refresh_source_core(catalog, source, audit).await?;
+        self.finish_source_watcher_reconciliation(catalog, &source_id, result.source_revision)
+            .await?;
+        Ok(result)
+    }
+
+    async fn refresh_source_core(
+        &self,
+        catalog: &CatalogStore,
+        source: SourceRecord,
+        audit: AuditContext<'_>,
+    ) -> Result<CatalogSyncResult, ProtocolError> {
+        let stored = required_stored_credential(catalog, &source.id).await?;
+        let _operation = self.connections.begin_operation().map_err(shutting_down)?;
+        let (plan, oauth_expectation) = match source.kind {
+            SourceKind::McpHttp => {
+                let configuration = McpHttpSourceConfigurationV1::decode(&source.configuration)?;
+                let credential = StoredMcpHttpCredentialV1::decode(&stored)?;
+                self.discover_http_source(
+                    &source.id,
+                    &credential,
+                    configuration.allow_private_network,
+                    source.revision,
+                    Some(stored.revision),
+                )
+                .await?
+            }
+            SourceKind::McpStdio => {
+                let configuration = McpStdioSourceConfigurationV1::decode(&source.configuration)?;
+                let credential = StoredMcpStdioCredentialV1::decode(&stored)?;
+                if configuration.template_name != credential.template_name {
+                    return Err(corrupt_configuration());
+                }
+                self.connections
+                    .stdio_templates()
+                    .template(&credential.template_name)
+                    .map_err(stored_template_error)?;
+                (
+                    discover_stdio(
+                        self.connections.stdio_templates(),
+                        &credential,
+                        source.revision,
+                        Some(stored.revision),
+                    )
+                    .await?,
+                    None,
+                )
+            }
+            SourceKind::Openapi | SourceKind::Graphql => {
+                return Err(ProtocolError::corrupt(
+                    "source_protocol_mismatch",
+                    "The stored source does not match the MCP protocol.",
+                ));
+            }
+        };
+        let result = match oauth_expectation {
+            Some(expectation) => {
+                catalog
+                    .sync_catalog_with_bindings_and_oauth_binding(
+                        &source.id,
+                        plan.catalog_snapshot(),
+                        plan.bindings,
+                        expectation,
+                        audit,
+                    )
+                    .await
+            }
+            None => {
+                catalog
+                    .sync_catalog_with_bindings(
+                        &source.id,
+                        plan.catalog_snapshot(),
+                        plan.bindings,
+                        audit,
+                    )
+                    .await
+            }
+        }
+        .map_err(protocol_catalog_error)?;
+        Ok(result)
+    }
+
+    pub async fn credential_metadata(
+        &self,
+        catalog: &CatalogStore,
+        source: &SourceRecord,
+    ) -> Result<CredentialMetadata, ProtocolError> {
+        let stored = required_stored_credential(catalog, &source.id).await?;
+        match source.kind {
+            SourceKind::McpHttp => {
+                let credential = StoredMcpHttpCredentialV1::decode(&stored)?;
+                Ok(http_credential_metadata(stored.revision, &credential))
+            }
+            SourceKind::McpStdio => {
+                let credential = StoredMcpStdioCredentialV1::decode(&stored)?;
+                Ok(stdio_credential_metadata(stored.revision, &credential))
+            }
+            SourceKind::Openapi | SourceKind::Graphql => Err(ProtocolError::corrupt(
+                "source_protocol_mismatch",
+                "The stored source does not match the MCP protocol.",
+            )),
+        }
+    }
+
+    pub async fn replace_http_credentials(
+        &self,
+        catalog: &CatalogStore,
+        source_id: &str,
+        expected_revision: i64,
+        update: ReplaceMcpHttpCredential,
+        audit: AuditContext<'_>,
+    ) -> Result<CredentialMetadata, ProtocolError> {
+        let _operation = self.connections.begin_operation().map_err(shutting_down)?;
+        validate_http_credential(update.credential.as_ref())?;
+        let stored = required_stored_credential(catalog, source_id).await?;
+        require_revision(expected_revision, stored.revision)?;
+        let mut credential = StoredMcpHttpCredentialV1::decode(&stored)?;
+        let Some(candidate) = update.credential else {
+            return self
+                .clear_http_credentials(catalog, source_id, stored, credential, audit)
+                .await;
+        };
+        credential.credential = Some(candidate);
+        let source = catalog
+            .source(source_id)
+            .await
+            .map_err(protocol_catalog_error)?;
+        let configuration = McpHttpSourceConfigurationV1::decode(&source.configuration)?;
+        let plan = discover_http(
+            &credential,
+            configuration.allow_private_network,
+            source.revision,
+            Some(stored.revision),
+        )
+        .await?;
+        let (stored, _synced, committed_source) = catalog
+            .replace_credential_and_sync_catalog(
+                source_id,
+                &credential.payload()?,
+                plan.catalog_snapshot(),
+                plan.bindings,
+                audit,
+            )
+            .await
+            .map_err(protocol_catalog_error)?;
+        self.finish_source_watcher_reconciliation(catalog, source_id, committed_source.revision)
+            .await?;
+        let credential = StoredMcpHttpCredentialV1::decode(&stored)?;
+        let metadata = http_credential_metadata(stored.revision, &credential);
+        Ok(metadata)
+    }
+
+    async fn clear_http_credentials(
+        &self,
+        catalog: &CatalogStore,
+        source_id: &str,
+        stored: StoredCredential,
+        mut credential: StoredMcpHttpCredentialV1,
+        audit: AuditContext<'_>,
+    ) -> Result<CredentialMetadata, ProtocolError> {
+        let source = catalog
+            .source(source_id)
+            .await
+            .map_err(protocol_catalog_error)?;
+        let configuration = McpHttpSourceConfigurationV1::decode(&source.configuration)?;
+        credential.credential = None;
+        let anonymous_discovery = self
+            .discover_http_source(
+                source_id,
+                &credential,
+                configuration.allow_private_network,
+                source.revision,
+                Some(stored.revision),
+            )
+            .await
+            .and_then(|(plan, expectation)| {
+                expectation
+                    .map(|expectation| (plan, expectation))
+                    .ok_or_else(corrupt_configuration)
+            });
+        self.connections
+            .stop_watcher_and_wait_at_revision(source_id, source.revision)
+            .await;
+        let committed = match anonymous_discovery {
+            Ok((plan, expectation)) => catalog
+                .replace_credential_and_sync_catalog_with_oauth_binding(
+                    source_id,
+                    &credential.payload()?,
+                    plan.catalog_snapshot(),
+                    plan.bindings,
+                    expectation,
+                    audit,
+                )
+                .await
+                .map(|(stored, _, source)| (stored, source)),
+            Err(error) => {
+                tracing::info!(
+                    source_id,
+                    code = error.code,
+                    "MCP HTTP source does not support anonymous discovery after credential clear"
+                );
+                catalog
+                    .replace_credential_and_mark_unknown(
+                        source_id,
+                        &credential.payload()?,
+                        source.revision,
+                        stored.revision,
+                        audit,
+                    )
+                    .await
+            }
+        };
+        let (stored, committed_source) = match committed {
+            Ok(committed) => committed,
+            Err(error) => {
+                if let Err(recovery_error) = self
+                    .reconcile_source_watcher(catalog, source_id, source.revision)
+                    .await
+                {
+                    tracing::warn!(
+                        source_id,
+                        code = recovery_error.code,
+                        "MCP HTTP watcher rollback recovery failed"
+                    );
+                }
+                return Err(protocol_catalog_error(error));
+            }
+        };
+        self.finish_source_watcher_reconciliation(catalog, source_id, committed_source.revision)
+            .await?;
+        let credential = StoredMcpHttpCredentialV1::decode(&stored)?;
+        let metadata = http_credential_metadata(stored.revision, &credential);
+        Ok(metadata)
+    }
+
+    pub async fn replace_stdio_credentials(
+        &self,
+        catalog: &CatalogStore,
+        source_id: &str,
+        expected_revision: i64,
+        update: ReplaceMcpStdioCredential,
+        audit: AuditContext<'_>,
+    ) -> Result<CredentialMetadata, ProtocolError> {
+        let _operation = self.connections.begin_operation().map_err(shutting_down)?;
+        validate_secret_values(&update.secret_values)?;
+        let stored = required_stored_credential(catalog, source_id).await?;
+        require_revision(expected_revision, stored.revision)?;
+        let mut credential = StoredMcpStdioCredentialV1::decode(&stored)?;
+        if !stdio_secrets_complete(
+            self.connections.stdio_templates(),
+            &credential.template_name,
+            &update.secret_values,
+        )? {
+            return Err(invalid_credentials(
+                "The MCP stdio source requires all template secret values.",
+            ));
+        }
+        credential.secret_values = update.secret_values;
+        let source = catalog
+            .source(source_id)
+            .await
+            .map_err(protocol_catalog_error)?;
+        let plan = discover_stdio(
+            self.connections.stdio_templates(),
+            &credential,
+            source.revision,
+            Some(stored.revision),
+        )
+        .await?;
+        let (stored, _synced, committed_source) = catalog
+            .replace_credential_and_sync_catalog(
+                source_id,
+                &credential.payload()?,
+                plan.catalog_snapshot(),
+                plan.bindings,
+                audit,
+            )
+            .await
+            .map_err(protocol_catalog_error)?;
+        self.finish_source_watcher_reconciliation(catalog, source_id, committed_source.revision)
+            .await?;
+        let credential = StoredMcpStdioCredentialV1::decode(&stored)?;
+        let metadata = stdio_credential_metadata(stored.revision, &credential);
+        Ok(metadata)
+    }
+
+    pub async fn clear_credentials(
+        &self,
+        catalog: &CatalogStore,
+        source: &SourceRecord,
+        expected_revision: i64,
+        audit: AuditContext<'_>,
+    ) -> Result<CredentialMetadata, ProtocolError> {
+        match source.kind {
+            SourceKind::McpHttp => {
+                self.replace_http_credentials(
+                    catalog,
+                    &source.id,
+                    expected_revision,
+                    ReplaceMcpHttpCredential { credential: None },
+                    audit,
+                )
+                .await
+            }
+            SourceKind::McpStdio => {
+                let _operation = self.connections.begin_operation().map_err(shutting_down)?;
+                let stored = required_stored_credential(catalog, &source.id).await?;
+                require_revision(expected_revision, stored.revision)?;
+                let mut credential = StoredMcpStdioCredentialV1::decode(&stored)?;
+                credential.secret_values.clear();
+                if stdio_secrets_complete(
+                    self.connections.stdio_templates(),
+                    &credential.template_name,
+                    &credential.secret_values,
+                )? {
+                    return self
+                        .replace_stdio_credentials(
+                            catalog,
+                            &source.id,
+                            expected_revision,
+                            ReplaceMcpStdioCredential {
+                                secret_values: BTreeMap::new(),
+                            },
+                            audit,
+                        )
+                        .await;
+                }
+                self.connections
+                    .stop_watcher_and_wait_at_revision(&source.id, source.revision)
+                    .await;
+                let cleared = catalog
+                    .replace_credential_and_mark_unknown(
+                        &source.id,
+                        &credential.payload()?,
+                        source.revision,
+                        stored.revision,
+                        audit,
+                    )
+                    .await;
+                let (stored, committed_source) = match cleared {
+                    Ok(cleared) => cleared,
+                    Err(error) => {
+                        if let Err(recovery_error) = self
+                            .reconcile_source_watcher(catalog, &source.id, source.revision)
+                            .await
+                        {
+                            tracing::warn!(
+                                source_id = source.id,
+                                code = recovery_error.code,
+                                "MCP stdio watcher rollback recovery failed"
+                            );
+                        }
+                        return Err(protocol_catalog_error(error));
+                    }
+                };
+                self.finish_source_watcher_reconciliation(
+                    catalog,
+                    &committed_source.id,
+                    committed_source.revision,
+                )
+                .await?;
+                let credential = StoredMcpStdioCredentialV1::decode(&stored)?;
+                Ok(stdio_credential_metadata(stored.revision, &credential))
+            }
+            SourceKind::Openapi | SourceKind::Graphql => Err(ProtocolError::corrupt(
+                "source_protocol_mismatch",
+                "The stored source does not match the MCP protocol.",
+            )),
+        }
+    }
+
+    async fn install_source_watcher(
+        &self,
+        catalog: &CatalogStore,
+        source: &SourceRecord,
+    ) -> Result<bool, ProtocolError> {
+        #[cfg(test)]
+        if let Some(attempts) = &self.watcher_install_attempts {
+            attempts.fetch_add(1, std::sync::atomic::Ordering::SeqCst);
+        }
+        if source.health_status == SourceHealth::Unknown {
+            return Ok(self
+                .connections
+                .stop_watcher_and_wait_at_revision(&source.id, source.revision)
+                .await);
+        }
+        #[cfg(test)]
+        if consume_test_failure(&self.watcher_capability_load_failures) {
+            return Err(internal_error());
+        }
+        match source_supports_list_changed(catalog, &source.id).await {
+            Ok(true) => {}
+            Ok(false) => {
+                return Ok(self
+                    .connections
+                    .stop_watcher_and_wait_at_revision(&source.id, source.revision)
+                    .await);
+            }
+            Err(error) => return Err(error),
+        }
+        #[cfg(test)]
+        if consume_test_failure(&self.watcher_credential_load_failures) {
+            return Err(internal_error());
+        }
+        let stored = required_stored_credential(catalog, &source.id).await?;
+        let source_id = source.id.clone();
+        let credential_revision = stored.revision;
+        let connections = self.connections.clone();
+        let oauth = self.oauth.clone();
+        let catalog = catalog.clone();
+        let installed = match source.kind {
+            SourceKind::McpHttp => {
+                let configuration = McpHttpSourceConfigurationV1::decode(&source.configuration)?;
+                let credential = StoredMcpHttpCredentialV1::decode(&stored)?;
+                self.connections
+                    .replace_watcher(
+                        source_id.clone(),
+                        source.revision,
+                        move |canceled, revision_lease| {
+                            run_http_watcher(
+                                HttpWatcherContext {
+                                    connections,
+                                    oauth,
+                                    catalog,
+                                    source_id,
+                                    credential,
+                                    allow_private_network: configuration.allow_private_network,
+                                    credential_revision,
+                                    revision_lease,
+                                },
+                                canceled,
+                            )
+                        },
+                    )
+                    .await
+            }
+            SourceKind::McpStdio => {
+                let configuration = McpStdioSourceConfigurationV1::decode(&source.configuration)?;
+                let credential = match StoredMcpStdioCredentialV1::decode(&stored) {
+                    Ok(credential) if credential.template_name == configuration.template_name => {
+                        credential
+                    }
+                    Ok(_) => return Err(corrupt_configuration()),
+                    Err(error) => return Err(error),
+                };
+                self.connections
+                    .replace_watcher(
+                        source_id.clone(),
+                        source.revision,
+                        move |canceled, revision_lease| {
+                            run_stdio_watcher(
+                                StdioWatcherContext {
+                                    connections,
+                                    catalog,
+                                    source_id,
+                                    credential,
+                                    credential_revision,
+                                    revision_lease,
+                                },
+                                canceled,
+                            )
+                        },
+                    )
+                    .await
+            }
+            SourceKind::Openapi | SourceKind::Graphql => {
+                return Err(ProtocolError::corrupt(
+                    "source_protocol_mismatch",
+                    "The stored source does not match the MCP protocol.",
+                ));
+            }
+        };
+        match installed {
+            Ok(installed) => Ok(installed),
+            Err(error) => Err(shutting_down(error)),
+        }
+    }
+
+    async fn reconcile_source_watcher(
+        &self,
+        catalog: &CatalogStore,
+        source_id: &str,
+        minimum_revision: i64,
+    ) -> Result<(), ProtocolError> {
+        let _reconciliation = self.connections.lock_watcher_reconciliation().await;
+        self.reconcile_source_watcher_locked(catalog, source_id, minimum_revision)
+            .await
+            .map_err(|failure| failure.error)
+    }
+
+    async fn reconcile_source_watcher_locked(
+        &self,
+        catalog: &CatalogStore,
+        source_id: &str,
+        minimum_revision: i64,
+    ) -> Result<(), WatcherReconciliationFailure> {
+        if self
+            .connections
+            .watcher_revision(source_id)
+            .is_some_and(|revision| revision >= minimum_revision)
+        {
+            match catalog.source(source_id).await {
+                Ok(source)
+                    if self.connections.watcher_revision(source_id) == Some(source.revision) =>
+                {
+                    return Ok(());
+                }
+                Ok(_) => {}
+                Err(crate::catalog::CatalogError::NotFound { .. }) => {
+                    self.connections
+                        .stop_watcher_and_wait_at_least_revision(source_id, minimum_revision)
+                        .await;
+                    return Ok(());
+                }
+                Err(error) => {
+                    return Err(WatcherReconciliationFailure {
+                        error: protocol_catalog_error(error),
+                        failed_revision: None,
+                    });
+                }
+            }
+        }
+        self.connections
+            .stop_watcher_and_wait_at_least_revision(source_id, minimum_revision)
+            .await;
+        let mut last_failure = None;
+        for attempt in 0..WATCHER_RECONCILIATION_ATTEMPTS {
+            let source = match catalog.source(source_id).await {
+                Ok(source) => source,
+                Err(crate::catalog::CatalogError::NotFound { .. }) => return Ok(()),
+                Err(error) => {
+                    last_failure = Some(WatcherReconciliationFailure {
+                        error: protocol_catalog_error(error),
+                        failed_revision: None,
+                    });
+                    if attempt + 1 < WATCHER_RECONCILIATION_ATTEMPTS {
+                        tokio::time::sleep(WATCHER_RECONCILIATION_RETRY_DELAY).await;
+                    }
+                    continue;
+                }
+            };
+            if source.revision < minimum_revision {
+                last_failure = Some(WatcherReconciliationFailure {
+                    error: stale_watcher_reconciliation(),
+                    failed_revision: None,
+                });
+                if attempt + 1 < WATCHER_RECONCILIATION_ATTEMPTS {
+                    tokio::time::sleep(WATCHER_RECONCILIATION_RETRY_DELAY).await;
+                }
+                continue;
+            }
+            let observed_revision = source.revision;
+            self.connections
+                .stop_watcher_and_wait_at_least_revision(source_id, observed_revision)
+                .await;
+            match self.install_source_watcher(catalog, &source).await {
+                Ok(true) => return Ok(()),
+                Ok(false) => {
+                    last_failure = Some(WatcherReconciliationFailure {
+                        error: stale_watcher_reconciliation(),
+                        failed_revision: None,
+                    });
+                }
+                Err(error) => {
+                    last_failure = Some(WatcherReconciliationFailure {
+                        error,
+                        failed_revision: Some(observed_revision),
+                    });
+                }
+            }
+            if attempt + 1 < WATCHER_RECONCILIATION_ATTEMPTS {
+                tokio::time::sleep(WATCHER_RECONCILIATION_RETRY_DELAY).await;
+            }
+        }
+        Err(
+            last_failure.unwrap_or_else(|| WatcherReconciliationFailure {
+                error: stale_watcher_reconciliation(),
+                failed_revision: None,
+            }),
+        )
+    }
+
+    pub(super) async fn finish_source_watcher_reconciliation(
+        &self,
+        catalog: &CatalogStore,
+        source_id: &str,
+        committed_revision: i64,
+    ) -> Result<(), ProtocolError> {
+        #[cfg(test)]
+        if let Some(pause) = &self.post_commit_pause {
+            pause.reached.notify_one();
+            pause.release.notified().await;
+        }
+        self.reconcile_source_watcher(catalog, source_id, committed_revision)
+            .await
+    }
+
+    pub(super) async fn ensure_source_creation_watcher(
+        &self,
+        catalog: &CatalogStore,
+        source_id: &str,
+    ) {
+        let source = match catalog.source(source_id).await {
+            Ok(source) => source,
+            Err(crate::catalog::CatalogError::NotFound { .. }) => return,
+            Err(error) => {
+                tracing::warn!(
+                    source_id,
+                    error = %error,
+                    "MCP source-create watcher reload failed"
+                );
+                return;
+            }
+        };
+        if let Err(error) = self.ensure_source_watcher(catalog, &source).await {
+            tracing::warn!(
+                source_id,
+                code = error.code,
+                "MCP source-create watcher recovery failed"
+            );
+        }
+    }
+
+    async fn ensure_source_watcher(
+        &self,
+        catalog: &CatalogStore,
+        source: &SourceRecord,
+    ) -> Result<(), ProtocolError> {
+        if source.health_status == SourceHealth::Unknown {
+            self.connections
+                .stop_watcher_and_wait_at_least_revision(&source.id, source.revision)
+                .await;
+            return Ok(());
+        }
+        if self.connections.has_watcher(&source.id) {
+            match source_supports_list_changed(catalog, &source.id).await {
+                Ok(true) => return Ok(()),
+                Ok(false) => {
+                    self.connections
+                        .stop_watcher_and_wait_at_revision(&source.id, source.revision)
+                        .await;
+                    return Ok(());
+                }
+                Err(error) => {
+                    self.connections
+                        .stop_watcher_and_wait_at_least_revision(&source.id, source.revision)
+                        .await;
+                    return Err(error);
+                }
+            }
+        }
+        self.reconcile_source_watcher(catalog, &source.id, source.revision)
+            .await
+    }
+
+    pub async fn restore_watchers(&self, catalog: &CatalogStore) -> Result<(), ProtocolError> {
+        let sources = catalog
+            .list_sources()
+            .await
+            .map_err(protocol_catalog_error)?;
+        for source in sources {
+            if matches!(source.kind, SourceKind::McpHttp | SourceKind::McpStdio) {
+                self.ensure_source_watcher(catalog, &source).await?;
+            }
+        }
+        Ok(())
+    }
+
+    pub async fn recover_source_watcher_after_failed_delete(
+        &self,
+        catalog: &CatalogStore,
+        source_id: &str,
+        minimum_revision: i64,
+        audit: AuditContext<'_>,
+    ) -> Result<(), ProtocolError> {
+        let _reconciliation = self.connections.lock_watcher_reconciliation().await;
+        match self
+            .reconcile_source_watcher_locked(catalog, source_id, minimum_revision)
+            .await
+        {
+            Ok(()) => Ok(()),
+            Err(failure) => {
+                if let Some(failed_revision) = failure.failed_revision {
+                    self.persist_watcher_unavailable_at_revision(
+                        catalog,
+                        source_id,
+                        failed_revision,
+                        audit,
+                    )
+                    .await;
+                }
+                Err(failure.error)
+            }
+        }
+    }
+
+    async fn persist_watcher_unavailable_at_revision(
+        &self,
+        catalog: &CatalogStore,
+        source_id: &str,
+        failed_revision: i64,
+        audit: AuditContext<'_>,
+    ) {
+        #[cfg(test)]
+        if let Some(pause) = &self.watcher_unavailable_pause {
+            pause.reached.notify_one();
+            pause.release.notified().await;
+        }
+        let source = match catalog.source(source_id).await {
+            Ok(source) if source.revision == failed_revision => source,
+            Ok(_) | Err(crate::catalog::CatalogError::NotFound { .. }) => return,
+            Err(error) => {
+                tracing::warn!(
+                    source_id,
+                    error = %error,
+                    "MCP watcher unavailability could not be revalidated"
+                );
+                return;
+            }
+        };
+        if self.connections.has_watcher(source_id) {
+            return;
+        }
+        let Some(revisions) = self
+            .connections
+            .lock_source_revisions([(source.id.clone(), failed_revision)])
+            .await
+        else {
+            return;
+        };
+        match catalog
+            .mark_source_error(source_id, "mcp_watcher_unavailable", failed_revision, audit)
+            .await
+        {
+            Ok(updated) => {
+                if !revisions.advance(&std::collections::HashMap::from([(
+                    updated.id.clone(),
+                    updated.revision,
+                )])) {
+                    tracing::error!(
+                        source_id,
+                        "MCP watcher revision did not match unavailable health persistence"
+                    );
+                }
+                self.connections
+                    .stop_watcher_and_wait_at_least_revision(&updated.id, updated.revision)
+                    .await;
+            }
+            Err(
+                crate::catalog::CatalogError::RevisionConflict { .. }
+                | crate::catalog::CatalogError::NotFound { .. },
+            ) => {}
+            Err(error) => {
+                tracing::warn!(
+                    source_id,
+                    error = %error,
+                    "MCP watcher unavailability could not be persisted"
+                );
+            }
+        }
+    }
+
+    #[cfg(test)]
+    pub(super) fn fail_watcher_capability_loads(
+        &mut self,
+        failures: Arc<std::sync::atomic::AtomicUsize>,
+    ) {
+        self.watcher_capability_load_failures = Some(failures);
+    }
+
+    #[cfg(test)]
+    pub(super) fn pause_watcher_unavailable_persistence(&mut self) -> Arc<WatcherUnavailablePause> {
+        let pause = Arc::new(WatcherUnavailablePause::default());
+        self.watcher_unavailable_pause = Some(pause.clone());
+        pause
+    }
+
+    pub(super) async fn lock_source_deletion(
+        &self,
+        source_id: &str,
+    ) -> tokio::sync::OwnedMutexGuard<()> {
+        self.connections.lock_source_deletion(source_id).await
+    }
+
+    pub async fn retire_source_watcher(&self, source_id: &str) {
+        self.connections.retire_source(source_id).await;
+    }
+
+    pub async fn unretire_source_watcher(&self, source_id: &str) {
+        self.connections.unretire_source(source_id).await;
+    }
+
+    pub(super) async fn lock_source_revisions(
+        &self,
+        observed_revisions: impl IntoIterator<Item = (String, i64)>,
+    ) -> Option<SourceRevisionLease> {
+        self.connections
+            .lock_source_revisions(observed_revisions)
+            .await
+    }
+
+    pub(super) async fn oauth_binding_observation(
+        &self,
+        source_id: &str,
+        source_kind: SourceKind,
+        stored: Option<&StoredCredential>,
+        expected_bindings: Option<&[OAuthBinding]>,
+    ) -> Result<McpOAuthBindingObservation, ProtocolError> {
+        if source_kind == SourceKind::McpStdio {
+            return Ok(McpOAuthBindingObservation::NotApplicable);
+        }
+        if source_kind != SourceKind::McpHttp {
+            return Err(ProtocolError::corrupt(
+                "source_protocol_mismatch",
+                "The stored source does not match the MCP protocol.",
+            ));
+        }
+        let stored = stored.ok_or_else(|| {
+            ProtocolError::corrupt(
+                "source_credentials_missing",
+                "The source credential state is missing.",
+            )
+        })?;
+        let credential = StoredMcpHttpCredentialV1::decode_for_invocation(stored)?;
+        if credential.credential.is_some() {
+            return Ok(McpOAuthBindingObservation::Static);
+        }
+        if let Some(expected_bindings) = expected_bindings {
+            let mut defaults = expected_bindings
+                .iter()
+                .filter(|binding| binding.credential_key == "default");
+            let binding = defaults.next().cloned();
+            if defaults.next().is_some() {
+                return Err(ProtocolError::corrupt(
+                    "source_authorization_mismatch",
+                    "The prepared MCP authorization state is inconsistent.",
+                ));
+            }
+            return Ok(binding.map_or(
+                McpOAuthBindingObservation::Anonymous,
+                McpOAuthBindingObservation::Managed,
+            ));
+        }
+        let Some(oauth) = &self.oauth else {
+            return Ok(McpOAuthBindingObservation::Anonymous);
+        };
+        Ok(oauth
+            .binding(source_id, "default")
+            .await
+            .map_err(mcp_oauth_error)?
+            .map_or(
+                McpOAuthBindingObservation::Anonymous,
+                McpOAuthBindingObservation::Managed,
+            ))
+    }
+
+    #[allow(clippy::too_many_arguments)]
+    pub(super) fn prepare_invocation(
+        &self,
+        source_id: &str,
+        source_kind: SourceKind,
+        binding: &McpToolBindingV1,
+        source_configuration: &Map<String, Value>,
+        stored: Option<&StoredCredential>,
+        arguments: &Value,
+        oauth_binding: McpOAuthBindingObservation,
+    ) -> Result<PreparedMcpInvocation, ProtocolError> {
+        if binding.version != 1 || binding.tool_name.is_empty() {
+            return Err(ProtocolError::corrupt(
+                "unsupported_binding_schema",
+                "The stored MCP tool binding schema is not supported.",
+            ));
+        }
+        if !arguments.is_object() {
+            return Err(ProtocolError::new(
+                ProtocolErrorCategory::InvalidInput,
+                "invalid_tool_arguments",
+                "The tool arguments are invalid.",
+            ));
+        }
+        let stored = stored.ok_or_else(|| {
+            ProtocolError::corrupt(
+                "source_credentials_missing",
+                "The source credential state is missing.",
+            )
+        })?;
+        match source_kind {
+            SourceKind::McpHttp => {
+                let configuration = McpHttpSourceConfigurationV1::decode(source_configuration)?;
+                let credential = StoredMcpHttpCredentialV1::decode_for_invocation(stored)?;
+                let config =
+                    http_transport_config(&credential, configuration.allow_private_network)?;
+                StreamableHttpTransport::new(config).map_err(http_configuration_error)?;
+                let authorization_matches = matches!(
+                    (&credential.credential, &oauth_binding),
+                    (Some(_), McpOAuthBindingObservation::Static)
+                        | (None, McpOAuthBindingObservation::Anonymous)
+                        | (None, McpOAuthBindingObservation::Managed(_))
+                );
+                if !authorization_matches {
+                    return Err(ProtocolError::corrupt(
+                        "source_authorization_mismatch",
+                        "The prepared MCP authorization state is inconsistent.",
+                    ));
+                }
+                Ok(PreparedMcpInvocation::Http {
+                    source_id: source_id.to_owned(),
+                    credential,
+                    allow_private_network: configuration.allow_private_network,
+                    oauth_binding,
+                    tool_name: binding.tool_name.clone(),
+                    arguments: arguments.clone(),
+                })
+            }
+            SourceKind::McpStdio => {
+                if !matches!(oauth_binding, McpOAuthBindingObservation::NotApplicable) {
+                    return Err(ProtocolError::corrupt(
+                        "source_authorization_mismatch",
+                        "The prepared MCP authorization state is inconsistent.",
+                    ));
+                }
+                let configuration = McpStdioSourceConfigurationV1::decode(source_configuration)?;
+                let credential = StoredMcpStdioCredentialV1::decode_for_invocation(stored)?;
+                if configuration.template_name != credential.template_name {
+                    return Err(corrupt_configuration());
+                }
+                if !stdio_secrets_complete(
+                    self.connections.stdio_templates(),
+                    &credential.template_name,
+                    &credential.secret_values,
+                )? {
+                    return Err(ProtocolError::new(
+                        ProtocolErrorCategory::InvalidInput,
+                        "missing_source_credentials",
+                        "The MCP stdio source requires credentials before its tools can run.",
+                    ));
+                }
+                self.connections
+                    .stdio_templates()
+                    .template(&credential.template_name)
+                    .map_err(stored_template_error)?;
+                Ok(PreparedMcpInvocation::Stdio {
+                    template_name: credential.template_name,
+                    secret_values: credential.secret_values,
+                    tool_name: binding.tool_name.clone(),
+                    arguments: arguments.clone(),
+                })
+            }
+            SourceKind::Openapi | SourceKind::Graphql => Err(ProtocolError::corrupt(
+                "source_binding_mismatch",
+                "The stored tool binding does not match its source protocol.",
+            )),
+        }
+    }
+
+    async fn discover_http_source(
+        &self,
+        source_id: &str,
+        stored: &StoredMcpHttpCredentialV1,
+        allow_private_network: bool,
+        source_revision: i64,
+        credential_revision: Option<i64>,
+    ) -> Result<(DiscoveryPlan, Option<OAuthBindingExpectation>), ProtocolError> {
+        let (config, oauth_revision) = self
+            .http_transport_config_for_source(source_id, stored, allow_private_network)
+            .await?;
+        let plan = discover_http_config(
+            config,
+            source_revision,
+            credential_revision,
+            stored.credential.is_none(),
+        )
+        .await?;
+        Ok((
+            plan,
+            catalog_oauth_expectation(stored, oauth_revision.as_ref()),
+        ))
+    }
+
+    pub(super) async fn execute_invocation(
+        &self,
+        prepared: PreparedMcpInvocation,
+    ) -> Result<ProtocolExecutionResponse, McpInvocationError> {
+        let _operation = self
+            .connections
+            .begin_operation()
+            .map_err(|_| McpInvocationError::ShuttingDown)?;
+        match prepared {
+            PreparedMcpInvocation::Http {
+                source_id,
+                credential,
+                allow_private_network,
+                oauth_binding,
+                tool_name,
+                arguments,
+            } => {
+                let config = http_transport_config_for_observation(
+                    self.oauth.as_ref(),
+                    &source_id,
+                    &credential,
+                    allow_private_network,
+                    &oauth_binding,
+                )
+                .await
+                .map_err(McpInvocationError::AuthorizationSetup)?;
+                execute_http(config, &tool_name, arguments).await
+            }
+            PreparedMcpInvocation::Stdio {
+                template_name,
+                secret_values,
+                tool_name,
+                arguments,
+            } => {
+                execute_stdio(
+                    self.connections.stdio_templates(),
+                    &template_name,
+                    &secret_values,
+                    &tool_name,
+                    arguments,
+                )
+                .await
+            }
+        }
+    }
+
+    async fn http_transport_config_for_source(
+        &self,
+        source_id: &str,
+        stored: &StoredMcpHttpCredentialV1,
+        allow_private_network: bool,
+    ) -> Result<(StreamableHttpConfig, Option<OAuthTransportRevision>), ProtocolError> {
+        http_transport_config_for_source(
+            self.oauth.as_ref(),
+            source_id,
+            stored,
+            allow_private_network,
+        )
+        .await
+    }
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+struct OAuthTransportRevision {
+    binding: OAuthBinding,
+    secret_revision: i64,
+}
+
+fn catalog_oauth_expectation(
+    stored: &StoredMcpHttpCredentialV1,
+    revision: Option<&OAuthTransportRevision>,
+) -> Option<OAuthBindingExpectation> {
+    if stored.credential.is_some() {
+        return None;
+    }
+    Some(match revision {
+        Some(revision) => OAuthBindingExpectation::Exact {
+            credential_key: "default".to_owned(),
+            connection_id: revision.binding.connection_id.clone(),
+            config_revision: revision.binding.config_revision,
+        },
+        None => OAuthBindingExpectation::Absent {
+            credential_key: "default".to_owned(),
+        },
+    })
+}
+
+fn oauth_transport_changed(
+    active: Option<&OAuthTransportRevision>,
+    current: Option<&OAuthTransportRevision>,
+) -> bool {
+    active != current
+}
+
+struct HttpWatcherContext {
+    connections: Arc<McpConnectionManager>,
+    oauth: Option<OAuthService>,
+    catalog: CatalogStore,
+    source_id: String,
+    credential: StoredMcpHttpCredentialV1,
+    allow_private_network: bool,
+    credential_revision: i64,
+    revision_lease: WatcherRevisionLease,
+}
+
+async fn run_http_watcher(
+    context: HttpWatcherContext,
+    mut canceled: tokio::sync::oneshot::Receiver<()>,
+) {
+    let HttpWatcherContext {
+        connections,
+        oauth,
+        catalog,
+        source_id,
+        credential,
+        allow_private_network,
+        credential_revision,
+        revision_lease,
+    } = context;
+    let mut retry_delay = Duration::from_secs(1);
+    loop {
+        let Some(source_revision) = revision_lease.current_revision() else {
+            return;
+        };
+        let operation = match connections.begin_operation() {
+            Ok(operation) => operation,
+            Err(_) => return,
+        };
+        let (config, oauth_revision) = match http_transport_config_for_source(
+            oauth.as_ref(),
+            &source_id,
+            &credential,
+            allow_private_network,
+        )
+        .await
+        {
+            Ok(config) => config,
+            Err(error) => {
+                tracing::warn!(
+                    source_id,
+                    code = error.code,
+                    "MCP HTTP watcher configuration failed"
+                );
+                let authorization_required = error.code == "authorization_required";
+                if authorization_required {
+                    mark_watcher_authorization_required(&catalog, &source_id, &revision_lease)
+                        .await;
+                    drop(operation);
+                    if wait_for_http_authorization_change(
+                        oauth.as_ref(),
+                        &source_id,
+                        &credential,
+                        allow_private_network,
+                        None,
+                        &mut canceled,
+                    )
+                    .await
+                    {
+                        return;
+                    }
+                    retry_delay = Duration::from_secs(1);
+                    continue;
+                }
+                drop(operation);
+                if watcher_retry_or_cancel(&mut canceled, retry_delay).await {
+                    return;
+                }
+                retry_delay = next_watcher_backoff(retry_delay);
+                continue;
+            }
+        };
+        let oauth_expectation = catalog_oauth_expectation(&credential, oauth_revision.as_ref());
+        let transport = match StreamableHttpTransport::new(config) {
+            Ok(transport) => transport,
+            Err(_) => {
+                tracing::warn!(source_id, "MCP HTTP watcher transport failed");
+                return;
+            }
+        };
+        let mut changed = transport.subscribe_tool_list_changed();
+        let initialized = match transport.initialize().await {
+            Ok(initialized) => initialized,
+            Err(error) => {
+                tracing::warn!(source_id, "MCP HTTP watcher initialization failed");
+                if credential.credential.is_none() && http_authorization_denied(&error) {
+                    mark_watcher_authorization_required(&catalog, &source_id, &revision_lease)
+                        .await;
+                    drop(operation);
+                    if wait_for_http_authorization_change(
+                        oauth.as_ref(),
+                        &source_id,
+                        &credential,
+                        allow_private_network,
+                        oauth_revision.as_ref(),
+                        &mut canceled,
+                    )
+                    .await
+                    {
+                        return;
+                    }
+                    retry_delay = Duration::from_secs(1);
+                    continue;
+                }
+                drop(operation);
+                if watcher_retry_or_cancel(&mut canceled, retry_delay).await {
+                    return;
+                }
+                retry_delay = next_watcher_backoff(retry_delay);
+                continue;
+            }
+        };
+        let basis =
+            match http_discovery_basis(initialized, source_revision, Some(credential_revision)) {
+                Ok(basis) => basis,
+                Err(error) => {
+                    tracing::warn!(
+                        source_id,
+                        code = error.code,
+                        "MCP HTTP watcher initialization metadata is invalid"
+                    );
+                    let _ = transport.terminate().await;
+                    return;
+                }
+            };
+        let listener_transport = transport.clone();
+        let mut listener =
+            tokio::spawn(async move { listener_transport.listen_notifications().await });
+        let reconciled = {
+            let reconciliation = reconcile_watcher_session(async {
+                let plan = discover_http_session(
+                    &transport,
+                    &mut changed,
+                    basis.clone(),
+                    credential.credential.is_none(),
+                )
+                .await?;
+                commit_watcher_discovery(
+                    &catalog,
+                    &source_id,
+                    plan,
+                    oauth_expectation.clone(),
+                    &revision_lease,
+                )
+                .await
+            });
+            tokio::pin!(reconciliation);
+            tokio::select! {
+                _ = &mut canceled => {
+                    abort_and_join(&mut listener).await;
+                    let _ = transport.terminate().await;
+                    return;
+                }
+                result = &mut reconciliation => result,
+            }
+        };
+        let mut listener_finished = false;
+        let mut reconnect = false;
+        match reconciled {
+            Ok(reconciled) => {
+                if let Some(listener_result) =
+                    finished_http_listener_after_reconciliation(&reconciled, &mut listener).await
+                {
+                    listener_finished = true;
+                    if let Ok(Err(error)) = listener_result {
+                        if permanent_http_notification_error(&error) {
+                            let _ = transport.terminate().await;
+                            return;
+                        }
+                        tracing::debug!(
+                            source_id,
+                            "MCP HTTP notification listener disconnected after reconciliation"
+                        );
+                    }
+                    reconnect = true;
+                }
+                let (synced, supports_list_changed) = reconciled.into_inner();
+                retry_delay = Duration::from_secs(1);
+                if !supports_list_changed {
+                    connections
+                        .stop_watcher_at_revision(&source_id, synced.source_revision)
+                        .await;
+                    if !listener_finished {
+                        abort_and_join(&mut listener).await;
+                    }
+                    let _ = transport.terminate().await;
+                    return;
+                }
+            }
+            Err(error) => {
+                tracing::warn!(
+                    source_id,
+                    code = error.code,
+                    "MCP HTTP watcher startup reconciliation failed"
+                );
+                let authorization_required = error.code == "authorization_required";
+                if authorization_required {
+                    mark_watcher_authorization_required(&catalog, &source_id, &revision_lease)
+                        .await;
+                }
+                abort_and_join(&mut listener).await;
+                let _ = transport.terminate().await;
+                drop(operation);
+                if authorization_required {
+                    if wait_for_http_authorization_change(
+                        oauth.as_ref(),
+                        &source_id,
+                        &credential,
+                        allow_private_network,
+                        oauth_revision.as_ref(),
+                        &mut canceled,
+                    )
+                    .await
+                    {
+                        return;
+                    }
+                    retry_delay = Duration::from_secs(1);
+                    continue;
+                }
+                if watcher_retry_or_cancel(&mut canceled, retry_delay).await {
+                    return;
+                }
+                retry_delay = next_watcher_backoff(retry_delay);
+                continue;
+            }
+        }
+        let coalescer = ListChangedCoalescer::default();
+        let mut oauth_revision_check = tokio::time::interval(Duration::from_secs(30));
+        oauth_revision_check.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Delay);
+        oauth_revision_check.tick().await;
+        let mut authorization_blocked = false;
+        while !reconnect {
+            tokio::select! {
+                _ = &mut canceled => {
+                    abort_and_join(&mut listener).await;
+                    let _ = transport.terminate().await;
+                    return;
+                }
+                result = &mut listener => {
+                    listener_finished = true;
+                    if let Ok(Err(error)) = result {
+                        if permanent_http_notification_error(&error) {
+                            let _ = transport.terminate().await;
+                            return;
+                        }
+                        tracing::debug!(source_id, "MCP HTTP notification listener disconnected");
+                    }
+                    reconnect = true;
+                }
+                _ = oauth_revision_check.tick(), if credential.credential.is_none() && oauth.is_some() => {
+                    match http_transport_config_for_source(
+                        oauth.as_ref(),
+                        &source_id,
+                        &credential,
+                        allow_private_network,
+                    )
+                    .await
+                    {
+                        Ok((_, current_revision))
+                            if !oauth_transport_changed(
+                                oauth_revision.as_ref(),
+                                current_revision.as_ref(),
+                            ) => {}
+                        Ok(_) => {
+                            tracing::debug!(source_id, "MCP HTTP OAuth token changed; reconnecting");
+                            reconnect = true;
+                        }
+                        Err(error) => {
+                            tracing::warn!(source_id, code = error.code, "MCP HTTP OAuth token check failed");
+                            if error.code == "authorization_required" {
+                                mark_watcher_authorization_required(
+                                    &catalog,
+                                    &source_id,
+                                    &revision_lease,
+                                )
+                                .await;
+                                authorization_blocked = true;
+                            }
+                            reconnect = true;
+                        }
+                    }
+                }
+                signal = changed.recv() => {
+                    match signal {
+                        Ok(()) | Err(RecvError::Lagged(_)) => {
+                            retry_delay = Duration::from_secs(1);
+                            coalescer.notify_changed();
+                            drain_change_signals(&mut changed, &coalescer);
+                            let refresh = coalescer.refresh_pending(|| {
+                                refresh_http_watcher_session(
+                                    catalog.clone(),
+                                    source_id.clone(),
+                                    transport.clone(),
+                                    basis.clone(),
+                                    oauth_expectation.clone(),
+                                    connections.clone(),
+                                    revision_lease.clone(),
+                                )
+                            });
+                            tokio::pin!(refresh);
+                            match wait_for_watcher_refresh(
+                                &mut canceled,
+                                &mut listener,
+                                &mut refresh,
+                            )
+                            .await
+                            {
+                                WatcherRefreshWait::Canceled => {
+                                    abort_and_join(&mut listener).await;
+                                    let _ = transport.terminate().await;
+                                    return;
+                                }
+                                WatcherRefreshWait::Disconnected(result) => {
+                                    listener_finished = true;
+                                    if let Ok(Err(error)) = result {
+                                        if permanent_http_notification_error(&error) {
+                                            let _ = transport.terminate().await;
+                                            return;
+                                        }
+                                        tracing::debug!(source_id, "MCP HTTP notification listener disconnected");
+                                    }
+                                    reconnect = true;
+                                }
+                                WatcherRefreshWait::Completed(result) => {
+                                    if let Err(error) = result {
+                                        tracing::warn!(source_id, code = error.code, "MCP HTTP notification refresh failed");
+                                        if error.code == "authorization_required" {
+                                            mark_watcher_authorization_required(
+                                                &catalog,
+                                                &source_id,
+                                                &revision_lease,
+                                            )
+                                            .await;
+                                            authorization_blocked = true;
+                                        }
+                                        if matches!(
+                                            error.code,
+                                            "authorization_required" | "oauth_binding_changed"
+                                        ) {
+                                            reconnect = true;
+                                            continue;
+                                        }
+                                        let mut refresh_delay = Duration::from_secs(1);
+                                        'http_refresh_retries: while coalescer.has_pending() {
+                                            match wait_for_watcher_refresh(
+                                                &mut canceled,
+                                                &mut listener,
+                                                tokio::time::sleep(refresh_delay),
+                                            )
+                                            .await
+                                            {
+                                                WatcherRefreshWait::Canceled => {
+                                                    abort_and_join(&mut listener).await;
+                                                    let _ = transport.terminate().await;
+                                                    return;
+                                                }
+                                                WatcherRefreshWait::Disconnected(result) => {
+                                                    listener_finished = true;
+                                                    if let Ok(Err(error)) = result
+                                                        && permanent_http_notification_error(&error)
+                                                    {
+                                                        let _ = transport.terminate().await;
+                                                        return;
+                                                    }
+                                                    tracing::debug!(source_id, "MCP HTTP notification listener disconnected during refresh retry");
+                                                    reconnect = true;
+                                                    break 'http_refresh_retries;
+                                                }
+                                                WatcherRefreshWait::Completed(()) => {}
+                                            }
+                                            if reconnect {
+                                                break;
+                                            }
+                                            let retried = coalescer.refresh_pending(|| {
+                                                refresh_http_watcher_session(
+                                                    catalog.clone(),
+                                                    source_id.clone(),
+                                                    transport.clone(),
+                                                    basis.clone(),
+                                                    oauth_expectation.clone(),
+                                                    connections.clone(),
+                                                    revision_lease.clone(),
+                                                )
+                                            });
+                                            tokio::pin!(retried);
+                                            match wait_for_watcher_refresh(
+                                                &mut canceled,
+                                                &mut listener,
+                                                &mut retried,
+                                            )
+                                            .await
+                                            {
+                                                WatcherRefreshWait::Canceled => {
+                                                    abort_and_join(&mut listener).await;
+                                                    let _ = transport.terminate().await;
+                                                    return;
+                                                }
+                                                WatcherRefreshWait::Disconnected(result) => {
+                                                    listener_finished = true;
+                                                    if let Ok(Err(error)) = result
+                                                        && permanent_http_notification_error(&error)
+                                                    {
+                                                        let _ = transport.terminate().await;
+                                                        return;
+                                                    }
+                                                    tracing::debug!(source_id, "MCP HTTP notification listener disconnected during refresh retry");
+                                                    reconnect = true;
+                                                    break 'http_refresh_retries;
+                                                }
+                                                WatcherRefreshWait::Completed(result) => {
+                                                    match result {
+                                                        Ok(_) => break 'http_refresh_retries,
+                                                        Err(error)
+                                                            if matches!(
+                                                                error.code,
+                                                                "authorization_required"
+                                                                    | "oauth_binding_changed"
+                                                            ) =>
+                                                        {
+                                                            if error.code == "authorization_required" {
+                                                                mark_watcher_authorization_required(
+                                                                    &catalog,
+                                                                    &source_id,
+                                                                    &revision_lease,
+                                                                )
+                                                                .await;
+                                                                authorization_blocked = true;
+                                                            }
+                                                            reconnect = true;
+                                                            break 'http_refresh_retries;
+                                                        }
+                                                        Err(_) => {}
+                                                    }
+                                                }
+                                            }
+                                            refresh_delay = next_watcher_backoff(refresh_delay);
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                        Err(RecvError::Closed) => reconnect = true,
+                    }
+                }
+            }
+        }
+        if !listener_finished {
+            abort_and_join(&mut listener).await;
+        }
+        let _ = transport.terminate().await;
+        drop(operation);
+        if authorization_blocked {
+            if wait_for_http_authorization_change(
+                oauth.as_ref(),
+                &source_id,
+                &credential,
+                allow_private_network,
+                oauth_revision.as_ref(),
+                &mut canceled,
+            )
+            .await
+            {
+                return;
+            }
+            retry_delay = Duration::from_secs(1);
+            continue;
+        }
+        if watcher_retry_or_cancel(&mut canceled, retry_delay).await {
+            return;
+        }
+        retry_delay = next_watcher_backoff(retry_delay);
+    }
+}
+
+async fn abort_and_join<T>(task: &mut tokio::task::JoinHandle<T>) {
+    task.abort();
+    let _ = task.await;
+}
+
+async fn mark_watcher_authorization_required(
+    catalog: &CatalogStore,
+    source_id: &str,
+    revision_lease: &WatcherRevisionLease,
+) {
+    let Some(expected_revision) = revision_lease.current_revision() else {
+        return;
+    };
+    let Some(revision_guard) = revision_lease.lock_revision(expected_revision).await else {
+        return;
+    };
+    let source = match catalog
+        .mark_source_error(
+            source_id,
+            "authorization_required",
+            expected_revision,
+            AuditContext::system(None),
+        )
+        .await
+    {
+        Ok(source) => source,
+        Err(error) => {
+            tracing::debug!(
+                source_id,
+                error = %error,
+                "MCP authorization health transition was superseded"
+            );
+            return;
+        }
+    };
+    let _ = revision_guard.advance(source.revision);
+}
+
+async fn wait_for_http_authorization_change(
+    oauth: Option<&OAuthService>,
+    source_id: &str,
+    credential: &StoredMcpHttpCredentialV1,
+    allow_private_network: bool,
+    active_revision: Option<&OAuthTransportRevision>,
+    canceled: &mut tokio::sync::oneshot::Receiver<()>,
+) -> bool {
+    if credential.credential.is_some() || oauth.is_none() {
+        return true;
+    }
+    let mut poll = tokio::time::interval(Duration::from_secs(30));
+    poll.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Delay);
+    poll.tick().await;
+    loop {
+        tokio::select! {
+            _ = &mut *canceled => return true,
+            _ = poll.tick() => {
+                if let Ok((_, current_revision)) = http_transport_config_for_source(
+                    oauth,
+                    source_id,
+                    credential,
+                    allow_private_network,
+                )
+                .await
+                    && oauth_transport_changed(active_revision, current_revision.as_ref())
+                {
+                    return false;
+                }
+            }
+        }
+    }
+}
+
+struct StdioWatcherContext {
+    connections: Arc<McpConnectionManager>,
+    catalog: CatalogStore,
+    source_id: String,
+    credential: StoredMcpStdioCredentialV1,
+    credential_revision: i64,
+    revision_lease: WatcherRevisionLease,
+}
+
+async fn run_stdio_watcher(
+    context: StdioWatcherContext,
+    mut canceled: tokio::sync::oneshot::Receiver<()>,
+) {
+    let StdioWatcherContext {
+        connections,
+        catalog,
+        source_id,
+        credential,
+        credential_revision,
+        revision_lease,
+    } = context;
+    let mut retry_delay = Duration::from_secs(1);
+    loop {
+        let Some(source_revision) = revision_lease.current_revision() else {
+            return;
+        };
+        let operation = match connections.begin_operation() {
+            Ok(operation) => operation,
+            Err(_) => return,
+        };
+        let client = match connections
+            .stdio_templates()
+            .connect_with_secrets(
+                &credential.template_name,
+                &credential.secret_values,
+                StdioTransportLimits::default(),
+            )
+            .await
+        {
+            Ok(client) => client,
+            Err(_) => {
+                tracing::warn!(source_id, "MCP stdio watcher transport failed");
+                drop(operation);
+                if watcher_retry_or_cancel(&mut canceled, retry_delay).await {
+                    return;
+                }
+                retry_delay = next_watcher_backoff(retry_delay);
+                continue;
+            }
+        };
+        let mut changed = client.subscribe_tool_list_changed();
+        let initialized = match client
+            .initialize(
+                STDIO_PROTOCOL_VERSION,
+                client_info(),
+                Value::Object(Map::new()),
+            )
+            .await
+        {
+            Ok(initialized) => initialized,
+            Err(_) => {
+                tracing::warn!(source_id, "MCP stdio watcher initialization failed");
+                client.shutdown().await;
+                drop(operation);
+                if watcher_retry_or_cancel(&mut canceled, retry_delay).await {
+                    return;
+                }
+                retry_delay = next_watcher_backoff(retry_delay);
+                continue;
+            }
+        };
+        let basis =
+            match stdio_discovery_basis(initialized, source_revision, Some(credential_revision)) {
+                Ok(basis) => basis,
+                Err(error) => {
+                    tracing::warn!(
+                        source_id,
+                        code = error.code,
+                        "MCP stdio watcher initialization metadata is invalid"
+                    );
+                    client.shutdown().await;
+                    return;
+                }
+            };
+        match watcher_reconcile_or_cancel(&mut canceled, || {
+            reconcile_watcher_session(async {
+                let plan = discover_stdio_session(&client, &mut changed, basis.clone()).await?;
+                commit_watcher_discovery(&catalog, &source_id, plan, None, &revision_lease).await
+            })
+        })
+        .await
+        {
+            None => {
+                client.shutdown().await;
+                return;
+            }
+            Some(Ok(reconciled)) => {
+                let (synced, supports_list_changed) = reconciled.into_inner();
+                retry_delay = Duration::from_secs(1);
+                if !supports_list_changed {
+                    connections
+                        .stop_watcher_at_revision(&source_id, synced.source_revision)
+                        .await;
+                    client.shutdown().await;
+                    return;
+                }
+            }
+            Some(Err(error)) => {
+                tracing::warn!(
+                    source_id,
+                    code = error.code,
+                    "MCP stdio watcher startup reconciliation failed"
+                );
+                client.shutdown().await;
+                drop(operation);
+                if watcher_retry_or_cancel(&mut canceled, retry_delay).await {
+                    return;
+                }
+                retry_delay = next_watcher_backoff(retry_delay);
+                continue;
+            }
+        }
+        let lifecycle = client.lifecycle_monitor();
+        let client = Arc::new(tokio::sync::Mutex::new(Some(client)));
+        let coalescer = ListChangedCoalescer::default();
+        let mut heartbeat = tokio::time::interval(STDIO_WATCHER_HEARTBEAT);
+        heartbeat.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Delay);
+        heartbeat.tick().await;
+        'stdio_notifications: loop {
+            tokio::select! {
+                _ = &mut canceled => {
+                    shutdown_shared_stdio(client).await;
+                    return;
+                }
+                _ = heartbeat.tick() => {
+                    if !lifecycle.is_initialized() {
+                        tracing::debug!(source_id, "MCP stdio watcher disconnected");
+                        break;
+                    }
+                }
+                signal = changed.recv() => {
+                    match signal {
+                        Ok(()) | Err(RecvError::Lagged(_)) => {
+                            retry_delay = Duration::from_secs(1);
+                            coalescer.notify_changed();
+                            drain_change_signals(&mut changed, &coalescer);
+                            let refresh_result = {
+                                let refresh = coalescer.refresh_pending(|| {
+                                    refresh_stdio_watcher_session(
+                                        catalog.clone(),
+                                        source_id.clone(),
+                                        client.clone(),
+                                        basis.clone(),
+                                        connections.clone(),
+                                        revision_lease.clone(),
+                                    )
+                                });
+                                tokio::pin!(refresh);
+                                wait_for_watcher_refresh(
+                                    &mut canceled,
+                                    wait_for_stdio_disconnect(&lifecycle),
+                                    &mut refresh,
+                                )
+                                .await
+                            };
+                            let refresh_result = match refresh_result {
+                                WatcherRefreshWait::Canceled => {
+                                    shutdown_shared_stdio(client.clone()).await;
+                                    return;
+                                }
+                                WatcherRefreshWait::Disconnected(()) => {
+                                    tracing::debug!(source_id, "MCP stdio watcher disconnected during refresh");
+                                    break 'stdio_notifications;
+                                }
+                                WatcherRefreshWait::Completed(result) => result,
+                            };
+                            if let Err(error) = refresh_result {
+                                tracing::warn!(source_id, code = error.code, "MCP stdio notification refresh failed");
+                                let mut refresh_delay = Duration::from_secs(1);
+                                'stdio_refresh_retries: while coalescer.has_pending() {
+                                    match wait_for_watcher_refresh(
+                                        &mut canceled,
+                                        wait_for_stdio_disconnect(&lifecycle),
+                                        tokio::time::sleep(refresh_delay),
+                                    )
+                                    .await
+                                    {
+                                        WatcherRefreshWait::Canceled => {
+                                            shutdown_shared_stdio(client.clone()).await;
+                                            return;
+                                        }
+                                        WatcherRefreshWait::Disconnected(()) => {
+                                            tracing::debug!(source_id, "MCP stdio watcher disconnected during refresh retry");
+                                            break 'stdio_notifications;
+                                        }
+                                        WatcherRefreshWait::Completed(()) => {}
+                                    }
+                                    let retried = coalescer.refresh_pending(|| {
+                                        refresh_stdio_watcher_session(
+                                            catalog.clone(),
+                                            source_id.clone(),
+                                            client.clone(),
+                                            basis.clone(),
+                                            connections.clone(),
+                                            revision_lease.clone(),
+                                        )
+                                    });
+                                    tokio::pin!(retried);
+                                    match wait_for_watcher_refresh(
+                                        &mut canceled,
+                                        wait_for_stdio_disconnect(&lifecycle),
+                                        &mut retried,
+                                    )
+                                    .await
+                                    {
+                                        WatcherRefreshWait::Canceled => {
+                                            shutdown_shared_stdio(client.clone()).await;
+                                            return;
+                                        }
+                                        WatcherRefreshWait::Disconnected(()) => {
+                                            tracing::debug!(source_id, "MCP stdio watcher disconnected during refresh retry");
+                                            break 'stdio_notifications;
+                                        }
+                                        WatcherRefreshWait::Completed(Ok(_)) => {
+                                            break 'stdio_refresh_retries;
+                                        }
+                                        WatcherRefreshWait::Completed(Err(_)) => {}
+                                    }
+                                    refresh_delay = next_watcher_backoff(refresh_delay);
+                                }
+                            }
+                        }
+                        Err(RecvError::Closed) => break,
+                    }
+                }
+            }
+        }
+        shutdown_shared_stdio(client).await;
+        drop(operation);
+        if watcher_retry_or_cancel(&mut canceled, retry_delay).await {
+            return;
+        }
+        retry_delay = next_watcher_backoff(retry_delay);
+    }
+}
+
+fn drain_change_signals(
+    receiver: &mut tokio::sync::broadcast::Receiver<()>,
+    coalescer: &ListChangedCoalescer,
+) {
+    loop {
+        match receiver.try_recv() {
+            Ok(()) | Err(TryRecvError::Lagged(_)) => {
+                coalescer.notify_changed();
+            }
+            Err(TryRecvError::Empty | TryRecvError::Closed) => return,
+        }
+    }
+}
+
+#[allow(clippy::too_many_arguments)]
+async fn refresh_http_watcher_session(
+    catalog: CatalogStore,
+    source_id: String,
+    transport: StreamableHttpTransport,
+    mut basis: DiscoveryBasis,
+    oauth_expectation: Option<OAuthBindingExpectation>,
+    connections: Arc<McpConnectionManager>,
+    revision_lease: WatcherRevisionLease,
+) -> Result<(), ProtocolError> {
+    basis.expected_source_revision = revision_lease
+        .current_revision()
+        .ok_or_else(stale_watcher_reconciliation)?;
+    let mut changed = transport.subscribe_tool_list_changed();
+    let authorization_required_on_denial = oauth_expectation.is_some();
+    let plan = discover_http_session(
+        &transport,
+        &mut changed,
+        basis,
+        authorization_required_on_denial,
+    )
+    .await?;
+    let (_, supports_list_changed) = commit_watcher_discovery(
+        &catalog,
+        &source_id,
+        plan,
+        oauth_expectation,
+        &revision_lease,
+    )
+    .await?;
+    if !supports_list_changed {
+        let source_revision = revision_lease
+            .current_revision()
+            .ok_or_else(stale_watcher_reconciliation)?;
+        connections
+            .stop_watcher_at_revision(&source_id, source_revision)
+            .await;
+    }
+    Ok(())
+}
+
+async fn refresh_stdio_watcher_session(
+    catalog: CatalogStore,
+    source_id: String,
+    client: Arc<tokio::sync::Mutex<Option<crate::mcp::upstream::stdio::StdioClient>>>,
+    mut basis: DiscoveryBasis,
+    connections: Arc<McpConnectionManager>,
+    revision_lease: WatcherRevisionLease,
+) -> Result<(), ProtocolError> {
+    basis.expected_source_revision = revision_lease
+        .current_revision()
+        .ok_or_else(stale_watcher_reconciliation)?;
+    let client = client.lock().await;
+    let client = client.as_ref().ok_or_else(stale_watcher_reconciliation)?;
+    let mut changed = client.subscribe_tool_list_changed();
+    let plan = discover_stdio_session(client, &mut changed, basis).await?;
+    let (_, supports_list_changed) =
+        commit_watcher_discovery(&catalog, &source_id, plan, None, &revision_lease).await?;
+    if !supports_list_changed {
+        let source_revision = revision_lease
+            .current_revision()
+            .ok_or_else(stale_watcher_reconciliation)?;
+        connections
+            .stop_watcher_at_revision(&source_id, source_revision)
+            .await;
+    }
+    Ok(())
+}
+
+async fn shutdown_shared_stdio(
+    client: Arc<tokio::sync::Mutex<Option<crate::mcp::upstream::stdio::StdioClient>>>,
+) {
+    if let Some(client) = client.lock().await.take() {
+        client.shutdown().await;
+    }
+}
+
+async fn wait_for_stdio_disconnect(lifecycle: &StdioLifecycleMonitor) {
+    loop {
+        if !lifecycle.is_initialized() {
+            return;
+        }
+        tokio::time::sleep(STDIO_WATCHER_HEARTBEAT).await;
+    }
+}
+
+enum WatcherRefreshWait<Output, Disconnect = ()> {
+    Canceled,
+    Disconnected(Disconnect),
+    Completed(Output),
+}
+
+async fn wait_for_watcher_refresh<Disconnect, Refresh>(
+    canceled: &mut tokio::sync::oneshot::Receiver<()>,
+    disconnect: Disconnect,
+    refresh: Refresh,
+) -> WatcherRefreshWait<Refresh::Output, Disconnect::Output>
+where
+    Disconnect: Future,
+    Refresh: Future,
+{
+    tokio::select! {
+        _ = canceled => WatcherRefreshWait::Canceled,
+        disconnected = disconnect => WatcherRefreshWait::Disconnected(disconnected),
+        result = refresh => WatcherRefreshWait::Completed(result),
+    }
+}
+
+async fn commit_watcher_discovery(
+    catalog: &CatalogStore,
+    source_id: &str,
+    plan: DiscoveryPlan,
+    oauth_expectation: Option<OAuthBindingExpectation>,
+    revision_lease: &WatcherRevisionLease,
+) -> Result<(CatalogSyncResult, bool), ProtocolError> {
+    let expected_revision = plan.basis.expected_source_revision;
+    let supports_list_changed = plan.basis.tools_list_changed;
+    let revision_guard = revision_lease
+        .lock_revision(expected_revision)
+        .await
+        .ok_or_else(stale_watcher_reconciliation)?;
+    let result = match oauth_expectation {
+        Some(expectation) => {
+            catalog
+                .sync_catalog_with_bindings_and_oauth_binding(
+                    source_id,
+                    plan.catalog_snapshot(),
+                    plan.bindings,
+                    expectation,
+                    AuditContext::system(None),
+                )
+                .await
+        }
+        None => {
+            catalog
+                .sync_catalog_with_bindings(
+                    source_id,
+                    plan.catalog_snapshot(),
+                    plan.bindings,
+                    AuditContext::system(None),
+                )
+                .await
+        }
+    }
+    .map_err(protocol_catalog_error)?;
+    if !revision_guard.advance(result.source_revision) {
+        return Err(stale_watcher_reconciliation());
+    }
+    Ok((result, supports_list_changed))
+}
+
+struct ReconciledWatcherSession<Output>(Output);
+
+impl<Output> ReconciledWatcherSession<Output> {
+    fn into_inner(self) -> Output {
+        self.0
+    }
+}
+
+async fn finished_http_listener_after_reconciliation<Output>(
+    _reconciled: &ReconciledWatcherSession<Output>,
+    listener: &mut tokio::task::JoinHandle<Result<(), StreamableHttpError>>,
+) -> Option<Result<Result<(), StreamableHttpError>, tokio::task::JoinError>> {
+    if listener.is_finished() {
+        Some(listener.await)
+    } else {
+        None
+    }
+}
+
+async fn reconcile_watcher_session<Reconciliation, Output, Error>(
+    reconciliation: Reconciliation,
+) -> Result<ReconciledWatcherSession<Output>, Error>
+where
+    Reconciliation: Future<Output = Result<Output, Error>>,
+{
+    reconciliation.await.map(ReconciledWatcherSession)
+}
+
+async fn watcher_reconcile_or_cancel<Refresh, RefreshFuture, Output>(
+    canceled: &mut tokio::sync::oneshot::Receiver<()>,
+    refresh: Refresh,
+) -> Option<Output>
+where
+    Refresh: FnOnce() -> RefreshFuture,
+    RefreshFuture: Future<Output = Output>,
+{
+    tokio::select! {
+        _ = canceled => None,
+        result = refresh() => Some(result),
+    }
+}
+
+async fn watcher_retry_or_cancel(
+    canceled: &mut tokio::sync::oneshot::Receiver<()>,
+    delay: Duration,
+) -> bool {
+    tokio::select! {
+        _ = canceled => true,
+        _ = tokio::time::sleep(delay) => false,
+    }
+}
+
+fn next_watcher_backoff(current: Duration) -> Duration {
+    current.saturating_mul(2).min(Duration::from_secs(60))
+}
+
+fn permanent_http_notification_error(error: &StreamableHttpError) -> bool {
+    matches!(
+        error,
+        StreamableHttpError::HttpStatus(reqwest::StatusCode::METHOD_NOT_ALLOWED)
+            | StreamableHttpError::InvalidSessionId
+            | StreamableHttpError::NotInitialized
+    )
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub(super) enum McpOAuthBindingObservation {
+    NotApplicable,
+    Static,
+    Anonymous,
+    Managed(OAuthBinding),
+}
+
+#[must_use = "a prepared MCP invocation must be executed or explicitly discarded"]
+pub(super) enum PreparedMcpInvocation {
+    Http {
+        source_id: String,
+        credential: StoredMcpHttpCredentialV1,
+        allow_private_network: bool,
+        oauth_binding: McpOAuthBindingObservation,
+        tool_name: String,
+        arguments: Value,
+    },
+    Stdio {
+        template_name: String,
+        secret_values: BTreeMap<String, String>,
+        tool_name: String,
+        arguments: Value,
+    },
+}
+
+#[derive(Debug, Error)]
+pub enum McpInvocationError {
+    #[error("MCP authorization setup failed")]
+    AuthorizationSetup(#[source] ProtocolError),
+    #[error("MCP Streamable HTTP session setup failed")]
+    HttpSetup(#[source] StreamableHttpError),
+    #[error("MCP Streamable HTTP tool call failed and its outcome is unknown")]
+    HttpCall(#[source] StreamableHttpError),
+    #[error("MCP stdio session setup failed")]
+    StdioSetup(#[source] StdioTransportError),
+    #[error("MCP stdio tool call failed and its outcome is unknown")]
+    StdioCall(#[source] StdioTransportError),
+    #[error("MCP connections are shutting down")]
+    ShuttingDown,
+}
+
+impl McpInvocationError {
+    pub fn outcome_unknown(&self) -> bool {
+        matches!(self, Self::StdioCall(_) | Self::HttpCall(_))
+    }
+}
+
+impl McpHttpSourceConfigurationV1 {
+    fn decode(configuration: &Map<String, Value>) -> Result<Self, ProtocolError> {
+        let decoded: Self = decode_configuration(configuration)?;
+        if !is_supported_protocol_version(&decoded.negotiated_protocol_version) {
+            return Err(corrupt_configuration());
+        }
+        validate_endpoint(&decoded.endpoint).map_err(|_| corrupt_configuration())?;
+        Ok(decoded)
+    }
+}
+
+impl McpStdioSourceConfigurationV1 {
+    fn decode(configuration: &Map<String, Value>) -> Result<Self, ProtocolError> {
+        let decoded: Self = decode_configuration(configuration)?;
+        if decoded.template_name.is_empty()
+            || decoded
+                .negotiated_protocol_version
+                .as_deref()
+                .is_some_and(|version| version != HTTP_PROTOCOL_VERSION)
+        {
+            return Err(corrupt_configuration());
+        }
+        Ok(decoded)
+    }
+}
+
+impl StoredMcpHttpCredentialV1 {
+    fn decode(stored: &StoredCredential) -> Result<Self, ProtocolError> {
+        require_schema(stored, false)?;
+        let decoded: Self = serde_json::from_value(stored.credential.payload.clone())
+            .map_err(|_| corrupt_credentials())?;
+        validate_endpoint(&decoded.endpoint).map_err(|_| corrupt_credentials())?;
+        validate_http_credential(decoded.credential.as_ref()).map_err(|_| corrupt_credentials())?;
+        Ok(decoded)
+    }
+
+    fn decode_for_invocation(stored: &StoredCredential) -> Result<Self, ProtocolError> {
+        require_schema(stored, true)?;
+        Self::decode(stored)
+    }
+
+    fn payload(&self) -> Result<CredentialPayload, ProtocolError> {
+        credential_payload(self)
+    }
+}
+
+impl StoredMcpStdioCredentialV1 {
+    fn decode(stored: &StoredCredential) -> Result<Self, ProtocolError> {
+        require_schema(stored, false)?;
+        let decoded: Self = serde_json::from_value(stored.credential.payload.clone())
+            .map_err(|_| corrupt_credentials())?;
+        if decoded.template_name.is_empty() {
+            return Err(corrupt_credentials());
+        }
+        validate_secret_values(&decoded.secret_values).map_err(|_| corrupt_credentials())?;
+        Ok(decoded)
+    }
+
+    fn decode_for_invocation(stored: &StoredCredential) -> Result<Self, ProtocolError> {
+        require_schema(stored, true)?;
+        Self::decode(stored)
+    }
+
+    fn payload(&self) -> Result<CredentialPayload, ProtocolError> {
+        credential_payload(self)
+    }
+}
+
+async fn execute_http(
+    config: StreamableHttpConfig,
+    tool_name: &str,
+    arguments: Value,
+) -> Result<ProtocolExecutionResponse, McpInvocationError> {
+    let transport = StreamableHttpTransport::new(config).map_err(McpInvocationError::HttpSetup)?;
+    transport
+        .initialize()
+        .await
+        .map_err(McpInvocationError::HttpSetup)?;
+    let called = transport
+        .call_tool(tool_name, arguments, json!(1))
+        .await
+        .map_err(McpInvocationError::HttpCall);
+    let _ = transport.terminate().await;
+    called.map(mcp_response)
+}
+
+async fn execute_stdio(
+    templates: &StdioTemplateRegistry,
+    template_name: &str,
+    secret_values: &BTreeMap<String, String>,
+    tool_name: &str,
+    arguments: Value,
+) -> Result<ProtocolExecutionResponse, McpInvocationError> {
+    let client = templates
+        .connect_with_secrets(
+            template_name,
+            secret_values,
+            StdioTransportLimits::default(),
+        )
+        .await
+        .map_err(McpInvocationError::StdioSetup)?;
+    if let Err(error) = client
+        .initialize(
+            STDIO_PROTOCOL_VERSION,
+            client_info(),
+            Value::Object(Map::new()),
+        )
+        .await
+    {
+        client.shutdown().await;
+        return Err(McpInvocationError::StdioSetup(error));
+    }
+    let called = client
+        .call_tool(tool_name, arguments, 2)
+        .await
+        .map_err(McpInvocationError::StdioCall);
+    client.shutdown().await;
+    called.map(|result| {
+        mcp_response(json!({
+            "content": result.content,
+            "structuredContent": result.structured_content,
+            "isError": result.is_error,
+        }))
+    })
+}
+
+fn mcp_response(result: Value) -> ProtocolExecutionResponse {
+    let is_error = result
+        .as_object()
+        .and_then(|result| result.get("isError"))
+        .and_then(Value::as_bool)
+        .unwrap_or(false);
+    ProtocolExecutionResponse {
+        ok: !is_error,
+        data: (!is_error).then_some(result),
+        error: is_error.then_some(ProtocolResponseError {
+            code: "upstream_tool_error".to_owned(),
+            message: "The upstream MCP tool returned an error result.".to_owned(),
+        }),
+        http: None,
+    }
+}
+
+async fn discover_http(
+    stored: &StoredMcpHttpCredentialV1,
+    allow_private_network: bool,
+    source_revision: i64,
+    credential_revision: Option<i64>,
+) -> Result<DiscoveryPlan, ProtocolError> {
+    let config = http_transport_config(stored, allow_private_network)?;
+    discover_http_config(
+        config,
+        source_revision,
+        credential_revision,
+        stored.credential.is_none(),
+    )
+    .await
+}
+
+async fn discover_http_config(
+    config: StreamableHttpConfig,
+    source_revision: i64,
+    credential_revision: Option<i64>,
+    authorization_required_on_denial: bool,
+) -> Result<DiscoveryPlan, ProtocolError> {
+    let transport = StreamableHttpTransport::new(config).map_err(http_protocol_error)?;
+    let mut changed = transport.subscribe_tool_list_changed();
+    let initialized = transport.initialize().await.map_err(|error| {
+        http_protocol_error_for_authorization(error, authorization_required_on_denial)
+    })?;
+    let plan = match http_discovery_basis(initialized, source_revision, credential_revision) {
+        Ok(basis) => {
+            discover_http_session(
+                &transport,
+                &mut changed,
+                basis,
+                authorization_required_on_denial,
+            )
+            .await
+        }
+        Err(error) => Err(error),
+    };
+    let _ = transport.terminate().await;
+    plan
+}
+
+enum HttpCreateDiscovery {
+    Ready(Box<DiscoveryPlan>),
+    AuthorizationRequired,
+}
+
+impl HttpCreateDiscovery {
+    fn protocol_version(&self) -> &str {
+        match self {
+            Self::Ready(plan) => &plan.basis.protocol_version,
+            Self::AuthorizationRequired => HTTP_PROTOCOL_VERSION,
+        }
+    }
+}
+
+async fn discover_http_for_create(
+    stored: &StoredMcpHttpCredentialV1,
+    allow_private_network: bool,
+    source_revision: i64,
+    credential_revision: Option<i64>,
+) -> Result<HttpCreateDiscovery, ProtocolError> {
+    let config = http_transport_config(stored, allow_private_network)?;
+    let transport = StreamableHttpTransport::new(config).map_err(http_protocol_error)?;
+    let mut changed = transport.subscribe_tool_list_changed();
+    let initialized = match transport.initialize().await {
+        Ok(initialized) => initialized,
+        Err(error) if stored.credential.is_none() && http_authorization_denied(&error) => {
+            return Ok(HttpCreateDiscovery::AuthorizationRequired);
+        }
+        Err(error) => return Err(http_protocol_error(error)),
+    };
+    let plan = match http_discovery_basis(initialized, source_revision, credential_revision) {
+        Ok(basis) => {
+            discover_http_session(&transport, &mut changed, basis, stored.credential.is_none())
+                .await
+        }
+        Err(error) => Err(error),
+    };
+    let _ = transport.terminate().await;
+    match plan {
+        Ok(plan) => Ok(HttpCreateDiscovery::Ready(Box::new(plan))),
+        Err(error) if stored.credential.is_none() && error.code == "authorization_required" => {
+            Ok(HttpCreateDiscovery::AuthorizationRequired)
+        }
+        Err(error) => Err(error),
+    }
+}
+
+async fn discover_stdio(
+    templates: &StdioTemplateRegistry,
+    stored: &StoredMcpStdioCredentialV1,
+    source_revision: i64,
+    credential_revision: Option<i64>,
+) -> Result<DiscoveryPlan, ProtocolError> {
+    let client = templates
+        .connect_with_secrets(
+            &stored.template_name,
+            &stored.secret_values,
+            StdioTransportLimits::default(),
+        )
+        .await
+        .map_err(stdio_protocol_error)?;
+    let mut changed = client.subscribe_tool_list_changed();
+    let initialized = match client
+        .initialize(
+            STDIO_PROTOCOL_VERSION,
+            client_info(),
+            Value::Object(Map::new()),
+        )
+        .await
+    {
+        Ok(initialized) => initialized,
+        Err(error) => {
+            client.shutdown().await;
+            return Err(stdio_protocol_error(error));
+        }
+    };
+    let plan = match stdio_discovery_basis(initialized, source_revision, credential_revision) {
+        Ok(basis) => discover_stdio_session(&client, &mut changed, basis).await,
+        Err(error) => Err(error),
+    };
+    client.shutdown().await;
+    plan
+}
+
+async fn discover_http_session(
+    transport: &StreamableHttpTransport,
+    changed: &mut tokio::sync::broadcast::Receiver<()>,
+    basis: DiscoveryBasis,
+    authorization_required_on_denial: bool,
+) -> Result<DiscoveryPlan, ProtocolError> {
+    tokio::time::timeout(DISCOVERY_DEADLINE, async {
+        let mut generation = 0_usize;
+        let mut next_request_id = 1_u64;
+        loop {
+            generation += 1;
+            if generation > MAX_DISCOVERY_GENERATIONS {
+                return Err(unstable_catalog());
+            }
+            let starting_request_id = next_request_id;
+            let mut fetcher = HttpPageFetcher {
+                transport,
+                next_request_id,
+                authorization_required_on_denial,
+            };
+            let plan = discover(&mut fetcher, basis.clone())
+                .await
+                .map_err(discovery_protocol_error)?;
+            next_request_id = fetcher.next_request_id;
+            if next_request_id == starting_request_id {
+                return Err(ProtocolError::new(
+                    ProtocolErrorCategory::Internal,
+                    "internal_error",
+                    "MCP discovery did not issue a tools/list request.",
+                ));
+            }
+            if !catalog_changed_before_quiet(changed).await {
+                return Ok(plan);
+            }
+        }
+    })
+    .await
+    .unwrap_or_else(|_| Err(discovery_timeout()))
+}
+
+async fn discover_stdio_session(
+    client: &crate::mcp::upstream::stdio::StdioClient,
+    changed: &mut tokio::sync::broadcast::Receiver<()>,
+    basis: DiscoveryBasis,
+) -> Result<DiscoveryPlan, ProtocolError> {
+    tokio::time::timeout(DISCOVERY_DEADLINE, async {
+        for _ in 0..MAX_DISCOVERY_GENERATIONS {
+            let mut fetcher = StdioPageFetcher { client };
+            let plan = discover(&mut fetcher, basis.clone())
+                .await
+                .map(bindings_for_stdio)
+                .map_err(discovery_protocol_error)?;
+            if !catalog_changed_before_quiet(changed).await {
+                return Ok(plan);
+            }
+        }
+        Err(unstable_catalog())
+    })
+    .await
+    .unwrap_or_else(|_| Err(discovery_timeout()))
+}
+
+async fn catalog_changed_before_quiet(receiver: &mut tokio::sync::broadcast::Receiver<()>) -> bool {
+    let mut changed = false;
+    loop {
+        match receiver.try_recv() {
+            Ok(()) | Err(TryRecvError::Lagged(_)) => changed = true,
+            Err(TryRecvError::Empty) => break,
+            Err(TryRecvError::Closed) => return changed,
+        }
+    }
+    if changed {
+        return true;
+    }
+    match tokio::time::timeout(DISCOVERY_QUIET_PERIOD, receiver.recv()).await {
+        Ok(Ok(())) | Ok(Err(RecvError::Lagged(_))) => true,
+        Ok(Err(RecvError::Closed)) | Err(_) => false,
+    }
+}
+
+fn bindings_for_stdio(plan: DiscoveryPlan) -> DiscoveryPlan {
+    bindings_for_source_kind(plan, true)
+}
+
+struct HttpPageFetcher<'a> {
+    transport: &'a StreamableHttpTransport,
+    next_request_id: u64,
+    authorization_required_on_denial: bool,
+}
+
+#[async_trait]
+impl ToolPageFetcher for HttpPageFetcher<'_> {
+    type Error = McpPageFetchError;
+
+    async fn fetch_tools_page(&mut self, cursor: Option<&str>) -> Result<ToolPage, Self::Error> {
+        let id = self.next_request_id;
+        self.next_request_id = self.next_request_id.saturating_add(1);
+        let page = self
+            .transport
+            .list_tools(cursor, json!(id))
+            .await
+            .map_err(|error| {
+                if self.authorization_required_on_denial && http_authorization_denied(&error) {
+                    McpPageFetchError::AuthorizationRequired
+                } else {
+                    McpPageFetchError::Http(error)
+                }
+            })?;
+        let tools = page
+            .tools
+            .into_iter()
+            .map(serde_json::from_value)
+            .collect::<Result<Vec<DiscoveredMcpTool>, _>>()
+            .map_err(|_| McpPageFetchError::Decode)?;
+        Ok(ToolPage {
+            tools,
+            next_cursor: page.next_cursor,
+        })
+    }
+}
+
+struct StdioPageFetcher<'a> {
+    client: &'a crate::mcp::upstream::stdio::StdioClient,
+}
+
+#[async_trait]
+impl ToolPageFetcher for StdioPageFetcher<'_> {
+    type Error = McpPageFetchError;
+
+    async fn fetch_tools_page(&mut self, cursor: Option<&str>) -> Result<ToolPage, Self::Error> {
+        let page = self
+            .client
+            .list_tools(cursor)
+            .await
+            .map_err(McpPageFetchError::Stdio)?;
+        let tools = page
+            .tools
+            .into_iter()
+            .map(|tool| {
+                let annotations = tool
+                    .annotations
+                    .map(serde_json::from_value)
+                    .transpose()
+                    .map_err(|_| McpPageFetchError::Decode)?;
+                Ok(DiscoveredMcpTool {
+                    name: tool.name,
+                    title: tool.title,
+                    description: tool.description,
+                    input_schema: tool.input_schema,
+                    output_schema: tool.output_schema,
+                    annotations,
+                    meta: Map::new(),
+                })
+            })
+            .collect::<Result<Vec<_>, McpPageFetchError>>()?;
+        Ok(ToolPage {
+            tools,
+            next_cursor: page.next_cursor,
+        })
+    }
+}
+
+#[derive(Debug, Error)]
+enum McpPageFetchError {
+    #[error("MCP authorization is required")]
+    AuthorizationRequired,
+    #[error("MCP HTTP tools/list failed")]
+    Http(#[source] StreamableHttpError),
+    #[error("MCP stdio tools/list failed")]
+    Stdio(#[source] StdioTransportError),
+    #[error("MCP tools/list response could not be decoded")]
+    Decode,
+}
+
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct HttpInitializeResult {
+    protocol_version: String,
+    #[serde(default)]
+    capabilities: Value,
+    server_info: HttpServerInfo,
+    #[serde(default)]
+    instructions: Option<String>,
+}
+
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct HttpServerInfo {
+    name: String,
+    version: String,
+    #[serde(default)]
+    title: Option<String>,
+}
+
+fn http_discovery_basis(
+    initialized: Value,
+    expected_source_revision: i64,
+    expected_credential_revision: Option<i64>,
+) -> Result<DiscoveryBasis, ProtocolError> {
+    let initialized: HttpInitializeResult = serde_json::from_value(initialized).map_err(|_| {
+        ProtocolError::new(
+            ProtocolErrorCategory::Upstream,
+            "invalid_mcp_initialize",
+            "The MCP server returned invalid initialization metadata.",
+        )
+    })?;
+    if !is_supported_protocol_version(&initialized.protocol_version) {
+        return Err(ProtocolError::new(
+            ProtocolErrorCategory::Upstream,
+            "mcp_protocol_version_mismatch",
+            "The MCP server selected an unsupported protocol version.",
+        ));
+    }
+    Ok(DiscoveryBasis {
+        expected_source_revision,
+        expected_credential_revision,
+        protocol_version: initialized.protocol_version,
+        server_name: initialized.server_info.name,
+        server_version: initialized.server_info.version,
+        server_title: initialized.server_info.title,
+        instructions: initialized.instructions,
+        capabilities: initialized.capabilities.clone(),
+        tools_list_changed: tools_list_changed(&initialized.capabilities),
+    })
+}
+
+fn stdio_discovery_basis(
+    initialized: InitializeResult,
+    expected_source_revision: i64,
+    expected_credential_revision: Option<i64>,
+) -> Result<DiscoveryBasis, ProtocolError> {
+    let server_info = initialized.server_info.ok_or_else(|| {
+        ProtocolError::new(
+            ProtocolErrorCategory::Upstream,
+            "invalid_mcp_initialize",
+            "The MCP server returned invalid initialization metadata.",
+        )
+    })?;
+    Ok(DiscoveryBasis {
+        expected_source_revision,
+        expected_credential_revision,
+        protocol_version: initialized.protocol_version.to_string(),
+        server_name: server_info.name,
+        server_version: server_info.version,
+        server_title: server_info.title,
+        instructions: initialized.instructions,
+        capabilities: initialized.capabilities.clone(),
+        tools_list_changed: tools_list_changed(&initialized.capabilities),
+    })
+}
+
+fn tools_list_changed(capabilities: &Value) -> bool {
+    capabilities
+        .as_object()
+        .and_then(|capabilities| capabilities.get("tools"))
+        .and_then(Value::as_object)
+        .and_then(|tools| tools.get("listChanged"))
+        .and_then(Value::as_bool)
+        .unwrap_or(false)
+}
+
+fn client_info() -> Value {
+    json!({ "name": "executor", "version": env!("CARGO_PKG_VERSION") })
+}
+
+fn http_transport_config(
+    stored: &StoredMcpHttpCredentialV1,
+    allow_private_network: bool,
+) -> Result<StreamableHttpConfig, ProtocolError> {
+    validate_http_credential(stored.credential.as_ref())?;
+    let endpoint = validate_endpoint(&stored.endpoint)?;
+    let mut config = StreamableHttpConfig::new(endpoint.to_string());
+    config.allow_private_networks = allow_private_network;
+    if let Some(credential) = &stored.credential {
+        config.headers = credential.headers()?;
+    }
+    Ok(config)
+}
+
+async fn http_transport_config_for_source(
+    oauth: Option<&OAuthService>,
+    source_id: &str,
+    stored: &StoredMcpHttpCredentialV1,
+    allow_private_network: bool,
+) -> Result<(StreamableHttpConfig, Option<OAuthTransportRevision>), ProtocolError> {
+    let config = http_transport_config(stored, allow_private_network)?;
+    if stored.credential.is_some() {
+        return Ok((config, None));
+    }
+    let Some(oauth) = oauth else {
+        return Ok((config, None));
+    };
+    let Some(binding) = oauth
+        .binding(source_id, "default")
+        .await
+        .map_err(mcp_oauth_error)?
+    else {
+        return Ok((config, None));
+    };
+    http_transport_config_for_binding(
+        Some(oauth),
+        source_id,
+        stored,
+        allow_private_network,
+        Some(&binding),
+    )
+    .await
+}
+
+async fn http_transport_config_for_binding(
+    oauth: Option<&OAuthService>,
+    source_id: &str,
+    stored: &StoredMcpHttpCredentialV1,
+    allow_private_network: bool,
+    binding: Option<&OAuthBinding>,
+) -> Result<(StreamableHttpConfig, Option<OAuthTransportRevision>), ProtocolError> {
+    let mut config = http_transport_config(stored, allow_private_network)?;
+    if stored.credential.is_some() || binding.is_none() {
+        return Ok((config, None));
+    }
+    let oauth = oauth.ok_or_else(|| {
+        ProtocolError::new(
+            ProtocolErrorCategory::Conflict,
+            "authorization_required",
+            "The MCP source requires OAuth authorization.",
+        )
+    })?;
+    let binding = binding.expect("binding presence checked");
+    if binding.credential_key != "default" {
+        return Err(ProtocolError::corrupt(
+            "source_authorization_mismatch",
+            "The prepared MCP authorization state is inconsistent.",
+        ));
+    }
+    let current = oauth
+        .binding(source_id, "default")
+        .await
+        .map_err(mcp_oauth_error)?;
+    if current.as_ref() != Some(binding) {
+        return Err(ProtocolError::new(
+            ProtocolErrorCategory::Conflict,
+            "oauth_binding_changed",
+            "The managed OAuth connection changed. Retry the operation.",
+        ));
+    }
+    let token = oauth
+        .access_token_for_binding(binding)
+        .await
+        .map_err(mcp_oauth_error)?;
+    if token.connection_id() != binding.connection_id
+        || token.config_revision() != binding.config_revision
+    {
+        return Err(ProtocolError::new(
+            ProtocolErrorCategory::Conflict,
+            "oauth_binding_changed",
+            "The managed OAuth connection changed. Retry the operation.",
+        ));
+    }
+    let mut authorization =
+        HeaderValue::from_str(&format!("Bearer {}", token.expose())).map_err(|_| {
+            ProtocolError::new(
+                ProtocolErrorCategory::Upstream,
+                "invalid_oauth_access_token",
+                "The OAuth provider returned an access token that cannot be used safely.",
+            )
+        })?;
+    authorization.set_sensitive(true);
+    config.headers.insert(AUTHORIZATION, authorization);
+    Ok((
+        config,
+        Some(OAuthTransportRevision {
+            binding: binding.clone(),
+            secret_revision: token.secret_revision(),
+        }),
+    ))
+}
+
+async fn http_transport_config_for_observation(
+    oauth: Option<&OAuthService>,
+    source_id: &str,
+    stored: &StoredMcpHttpCredentialV1,
+    allow_private_network: bool,
+    observation: &McpOAuthBindingObservation,
+) -> Result<StreamableHttpConfig, ProtocolError> {
+    match observation {
+        McpOAuthBindingObservation::Static if stored.credential.is_some() => {
+            http_transport_config(stored, allow_private_network)
+        }
+        McpOAuthBindingObservation::Anonymous if stored.credential.is_none() => {
+            let current = match oauth {
+                Some(oauth) => oauth
+                    .binding(source_id, "default")
+                    .await
+                    .map_err(mcp_oauth_error)?,
+                None => None,
+            };
+            if current.is_some() {
+                return Err(ProtocolError::new(
+                    ProtocolErrorCategory::Conflict,
+                    "oauth_binding_changed",
+                    "The managed OAuth connection changed. Retry the operation.",
+                ));
+            }
+            http_transport_config(stored, allow_private_network)
+        }
+        McpOAuthBindingObservation::Managed(binding) if stored.credential.is_none() => {
+            http_transport_config_for_binding(
+                oauth,
+                source_id,
+                stored,
+                allow_private_network,
+                Some(binding),
+            )
+            .await
+            .map(|(config, _)| config)
+        }
+        _ => Err(ProtocolError::corrupt(
+            "source_authorization_mismatch",
+            "The prepared MCP authorization state is inconsistent.",
+        )),
+    }
+}
+
+fn validate_endpoint(endpoint: &str) -> Result<Url, ProtocolError> {
+    if endpoint.is_empty() || endpoint.len() > MAX_ENDPOINT_BYTES {
+        return Err(ProtocolError::new(
+            ProtocolErrorCategory::InvalidInput,
+            "invalid_mcp_endpoint",
+            "The MCP endpoint is invalid.",
+        ));
+    }
+    let url = Url::parse(endpoint).map_err(|_| invalid_endpoint())?;
+    if !matches!(url.scheme(), "http" | "https")
+        || url.host().is_none()
+        || !url.username().is_empty()
+        || url.password().is_some()
+        || url.fragment().is_some()
+    {
+        return Err(invalid_endpoint());
+    }
+    if url.scheme() == "http" && !loopback_endpoint(&url) {
+        return Err(invalid_endpoint());
+    }
+    Ok(url)
+}
+
+fn loopback_endpoint(url: &Url) -> bool {
+    match url.host() {
+        Some(Host::Ipv4(address)) => address.is_loopback(),
+        Some(Host::Ipv6(address)) => address.is_loopback(),
+        Some(Host::Domain(hostname)) => {
+            hostname.eq_ignore_ascii_case("localhost")
+                || hostname.to_ascii_lowercase().ends_with(".localhost")
+        }
+        None => false,
+    }
+}
+
+fn display_endpoint(endpoint: &Url) -> String {
+    let mut display = endpoint.clone();
+    display.set_query(None);
+    display.to_string()
+}
+
+fn validate_http_credential(credential: Option<&McpHttpCredential>) -> Result<(), ProtocolError> {
+    if let Some(credential) = credential {
+        credential.validate()?;
+        if serde_json::to_vec(credential)
+            .map(|encoded| encoded.len() > MAX_CREDENTIAL_BYTES)
+            .unwrap_or(true)
+        {
+            return Err(invalid_credentials(
+                "The MCP credential exceeds the allowed size.",
+            ));
+        }
+    }
+    Ok(())
+}
+
+fn validate_secret(secret: &str) -> Result<(), ProtocolError> {
+    if secret.is_empty() || secret.len() > MAX_SECRET_VALUE_BYTES || secret.as_bytes().contains(&0)
+    {
+        Err(invalid_credentials("The MCP credential value is invalid."))
+    } else {
+        Ok(())
+    }
+}
+
+fn validate_secret_values(values: &BTreeMap<String, String>) -> Result<(), ProtocolError> {
+    if values.len() > MAX_SECRET_VALUES {
+        return Err(invalid_credentials(
+            "The MCP stdio source has too many secret values.",
+        ));
+    }
+    for (name, value) in values {
+        if name.is_empty()
+            || name.len() > MAX_SECRET_NAME_BYTES
+            || !name
+                .bytes()
+                .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_'))
+        {
+            return Err(invalid_credentials("An MCP stdio secret name is invalid."));
+        }
+        validate_secret(value)?;
+    }
+    Ok(())
+}
+
+fn stdio_secrets_complete(
+    templates: &StdioTemplateRegistry,
+    template_name: &str,
+    values: &BTreeMap<String, String>,
+) -> Result<bool, ProtocolError> {
+    let descriptor = templates
+        .descriptors()
+        .into_iter()
+        .find(|descriptor| descriptor.name == template_name)
+        .ok_or_else(|| input_template_error(StdioTemplateError::UnknownTemplate))?;
+    if values.is_empty() && !descriptor.secret_fields.is_empty() {
+        return Ok(false);
+    }
+    let exact = values.len() == descriptor.secret_fields.len()
+        && descriptor
+            .secret_fields
+            .iter()
+            .all(|field| values.contains_key(field));
+    if exact {
+        Ok(true)
+    } else {
+        Err(invalid_credentials(
+            "The MCP stdio secret values must exactly match the selected template.",
+        ))
+    }
+}
+
+fn http_credential_metadata(
+    revision: i64,
+    credential: &StoredMcpHttpCredentialV1,
+) -> CredentialMetadata {
+    CredentialMetadata {
+        revision,
+        configured_schemes: credential
+            .credential
+            .as_ref()
+            .map(|credential| {
+                vec![ConfiguredCredential {
+                    name: "connection".to_owned(),
+                    credential_type: credential.credential_type(),
+                }]
+            })
+            .unwrap_or_default(),
+    }
+}
+
+fn stdio_credential_metadata(
+    revision: i64,
+    credential: &StoredMcpStdioCredentialV1,
+) -> CredentialMetadata {
+    CredentialMetadata {
+        revision,
+        configured_schemes: credential
+            .secret_values
+            .keys()
+            .map(|name| ConfiguredCredential {
+                name: name.clone(),
+                credential_type: "secret_env",
+            })
+            .collect(),
+    }
+}
+
+async fn required_stored_credential(
+    catalog: &CatalogStore,
+    source_id: &str,
+) -> Result<StoredCredential, ProtocolError> {
+    catalog
+        .credential(source_id)
+        .await
+        .map_err(protocol_catalog_error)?
+        .ok_or_else(|| {
+            ProtocolError::corrupt(
+                "source_credentials_missing",
+                "The source credential state is missing.",
+            )
+        })
+}
+
+async fn source_supports_list_changed(
+    catalog: &CatalogStore,
+    source_id: &str,
+) -> Result<bool, ProtocolError> {
+    let content = sqlx::query_scalar::<_, String>(
+        "SELECT content_json FROM source_artifacts \
+         WHERE source_id = ? AND artifact_kind = 'mcp_capabilities' AND stable_key = 'mcp-server'",
+    )
+    .bind(source_id)
+    .fetch_optional(catalog.pool())
+    .await
+    .map_err(|_| internal_error())?
+    .ok_or_else(|| {
+        ProtocolError::corrupt(
+            "source_artifact_missing",
+            "The MCP source capability artifact is missing.",
+        )
+    })?;
+    let content: Value = serde_json::from_str(&content).map_err(|_| corrupt_configuration())?;
+    Ok(content
+        .as_object()
+        .and_then(|content| content.get("toolsListChanged"))
+        .and_then(Value::as_bool)
+        .unwrap_or(false))
+}
+
+fn credential_payload<T: Serialize>(value: &T) -> Result<CredentialPayload, ProtocolError> {
+    Ok(CredentialPayload {
+        schema_version: MCP_CREDENTIAL_SCHEMA_VERSION,
+        payload: serde_json::to_value(value).map_err(|_| internal_error())?,
+    })
+}
+
+fn encode_configuration<T: Serialize>(value: &T) -> Result<Map<String, Value>, ProtocolError> {
+    serde_json::to_value(value)
+        .map_err(|_| internal_error())?
+        .as_object()
+        .cloned()
+        .ok_or_else(internal_error)
+}
+
+fn decode_configuration<T: for<'de> Deserialize<'de>>(
+    configuration: &Map<String, Value>,
+) -> Result<T, ProtocolError> {
+    serde_json::from_value(Value::Object(configuration.clone()))
+        .map_err(|_| corrupt_configuration())
+}
+
+fn require_schema(stored: &StoredCredential, invocation: bool) -> Result<(), ProtocolError> {
+    if stored.credential.schema_version == MCP_CREDENTIAL_SCHEMA_VERSION {
+        Ok(())
+    } else if invocation {
+        Err(ProtocolError::new(
+            ProtocolErrorCategory::InvalidInput,
+            "unsupported_credential_schema",
+            "The stored MCP credential schema is not supported.",
+        ))
+    } else {
+        Err(ProtocolError::corrupt(
+            "unsupported_credential_schema",
+            "The stored MCP credential schema is not supported.",
+        ))
+    }
+}
+
+fn require_revision(expected: i64, actual: i64) -> Result<(), ProtocolError> {
+    if expected == actual {
+        Ok(())
+    } else {
+        Err(ProtocolError::new(
+            ProtocolErrorCategory::Conflict,
+            "revision_conflict",
+            "The source changed. Refresh and retry the update.",
+        ))
+    }
+}
+
+fn discovery_protocol_error(error: DiscoveryError) -> ProtocolError {
+    if let DiscoveryError::Fetch(source) = &error
+        && source
+            .downcast_ref::<McpPageFetchError>()
+            .is_some_and(|error| matches!(error, McpPageFetchError::AuthorizationRequired))
+    {
+        return ProtocolError::new(
+            ProtocolErrorCategory::Conflict,
+            "authorization_required",
+            "The MCP source requires authorization.",
+        );
+    }
+    let (code, message) = match error {
+        DiscoveryError::Fetch(_) => (
+            "mcp_discovery_failed",
+            "The MCP server failed while listing tools.",
+        ),
+        DiscoveryError::TooManyPages { .. } => (
+            "mcp_too_many_pages",
+            "The MCP server returned too many tool pages.",
+        ),
+        DiscoveryError::TooManyTools { .. } => (
+            "mcp_too_many_tools",
+            "The MCP server returned too many tools.",
+        ),
+        DiscoveryError::InvalidCursor | DiscoveryError::CursorCycle => (
+            "invalid_mcp_cursor",
+            "The MCP server returned invalid tool pagination.",
+        ),
+        DiscoveryError::DuplicateTool { .. } => (
+            "duplicate_mcp_tool",
+            "The MCP server returned duplicate tool names.",
+        ),
+        DiscoveryError::InvalidTool { .. } => (
+            "invalid_mcp_tool",
+            "The MCP server returned an invalid tool definition.",
+        ),
+        DiscoveryError::CapabilitiesTooLarge => (
+            "mcp_capabilities_too_large",
+            "The MCP server returned too much capability metadata.",
+        ),
+        DiscoveryError::InvalidCapabilities => (
+            "invalid_mcp_capabilities",
+            "The MCP server returned invalid capabilities.",
+        ),
+        DiscoveryError::ToolMetadataTooLarge => (
+            "mcp_tool_metadata_too_large",
+            "The MCP server returned too much tool metadata.",
+        ),
+    };
+    ProtocolError::new(ProtocolErrorCategory::Upstream, code, message)
+}
+
+fn http_configuration_error(error: StreamableHttpError) -> ProtocolError {
+    match error {
+        StreamableHttpError::InsecureEndpoint => invalid_endpoint(),
+        StreamableHttpError::Outbound(error) => super::protocol_outbound_error(error),
+        _ => invalid_credentials("The MCP HTTP credential configuration is invalid."),
+    }
+}
+
+fn http_protocol_error(error: StreamableHttpError) -> ProtocolError {
+    match error {
+        StreamableHttpError::InsecureEndpoint => invalid_endpoint(),
+        StreamableHttpError::Outbound(error) => super::protocol_outbound_error(error),
+        StreamableHttpError::ProtocolVersionMismatch => ProtocolError::new(
+            ProtocolErrorCategory::Upstream,
+            "mcp_protocol_version_mismatch",
+            "The MCP server selected an unsupported protocol version.",
+        ),
+        _ => ProtocolError::new(
+            ProtocolErrorCategory::Upstream,
+            "mcp_transport_error",
+            "The MCP HTTP server could not be reached or returned an invalid response.",
+        ),
+    }
+}
+
+fn http_authorization_denied(error: &StreamableHttpError) -> bool {
+    matches!(
+        error,
+        StreamableHttpError::HttpStatus(status)
+            if matches!(
+                *status,
+                reqwest::StatusCode::UNAUTHORIZED | reqwest::StatusCode::FORBIDDEN
+            )
+    )
+}
+
+fn http_protocol_error_for_authorization(
+    error: StreamableHttpError,
+    authorization_required_on_denial: bool,
+) -> ProtocolError {
+    if authorization_required_on_denial && http_authorization_denied(&error) {
+        ProtocolError::new(
+            ProtocolErrorCategory::Conflict,
+            "authorization_required",
+            "The MCP source requires authorization.",
+        )
+    } else {
+        http_protocol_error(error)
+    }
+}
+
+fn stdio_protocol_error(_error: StdioTransportError) -> ProtocolError {
+    ProtocolError::new(
+        ProtocolErrorCategory::Upstream,
+        "mcp_transport_error",
+        "The MCP stdio server could not be started or returned an invalid response.",
+    )
+}
+
+fn shutting_down(_error: crate::mcp::manager::McpShuttingDown) -> ProtocolError {
+    ProtocolError::new(
+        ProtocolErrorCategory::Conflict,
+        "mcp_shutting_down",
+        "MCP connections are shutting down.",
+    )
+}
+
+fn unstable_catalog() -> ProtocolError {
+    ProtocolError::new(
+        ProtocolErrorCategory::Upstream,
+        "mcp_catalog_unstable",
+        "The MCP tool catalog kept changing during discovery.",
+    )
+}
+
+fn discovery_timeout() -> ProtocolError {
+    ProtocolError::new(
+        ProtocolErrorCategory::Upstream,
+        "mcp_discovery_timeout",
+        "MCP tool discovery exceeded its deadline.",
+    )
+}
+
+fn stale_watcher_reconciliation() -> ProtocolError {
+    ProtocolError::new(
+        ProtocolErrorCategory::Conflict,
+        "stale_watcher_reconciliation",
+        "The MCP source changed while its watcher was reconciling.",
+    )
+}
+
+fn input_template_error(_error: StdioTemplateError) -> ProtocolError {
+    ProtocolError::new(
+        ProtocolErrorCategory::InvalidInput,
+        "invalid_stdio_template",
+        "The selected MCP stdio template is unavailable.",
+    )
+}
+
+fn stored_template_error(_error: StdioTemplateError) -> ProtocolError {
+    ProtocolError::new(
+        ProtocolErrorCategory::Conflict,
+        "stdio_template_unavailable",
+        "The configured MCP stdio template is unavailable.",
+    )
+}
+
+fn invalid_endpoint() -> ProtocolError {
+    ProtocolError::new(
+        ProtocolErrorCategory::InvalidInput,
+        "invalid_mcp_endpoint",
+        "The MCP endpoint must use HTTPS, or loopback HTTP, without user info or a fragment.",
+    )
+}
+
+fn invalid_credentials(message: &'static str) -> ProtocolError {
+    ProtocolError::new(
+        ProtocolErrorCategory::InvalidInput,
+        "invalid_credentials",
+        message,
+    )
+}
+
+fn mcp_oauth_error(error: OAuthError) -> ProtocolError {
+    match error {
+        OAuthError::Validation { code, message } => {
+            ProtocolError::new(ProtocolErrorCategory::InvalidInput, code, message)
+        }
+        OAuthError::NotFound | OAuthError::AuthorizationDenied { .. } => ProtocolError::new(
+            ProtocolErrorCategory::Conflict,
+            "authorization_required",
+            "The MCP source requires OAuth authorization.",
+        ),
+        OAuthError::Conflict {
+            code: "oauth_reauthorization_required",
+            ..
+        } => ProtocolError::new(
+            ProtocolErrorCategory::Conflict,
+            "authorization_required",
+            "The MCP source requires OAuth authorization.",
+        ),
+        OAuthError::Conflict { .. } => ProtocolError::new(
+            ProtocolErrorCategory::Conflict,
+            "oauth_binding_changed",
+            "The managed OAuth connection changed. Retry the operation.",
+        ),
+        OAuthError::UnauthorizedTransaction => ProtocolError::new(
+            ProtocolErrorCategory::Internal,
+            "oauth_internal_error",
+            "The managed OAuth credential could not be resolved.",
+        ),
+        OAuthError::Upstream { code } => ProtocolError::new(
+            ProtocolErrorCategory::Upstream,
+            code,
+            "The OAuth provider request failed.",
+        ),
+        OAuthError::Internal => ProtocolError::new(
+            ProtocolErrorCategory::Internal,
+            "oauth_internal_error",
+            "The managed OAuth credential could not be resolved.",
+        ),
+    }
+}
+
+fn corrupt_configuration() -> ProtocolError {
+    ProtocolError::corrupt(
+        "invalid_source_configuration",
+        "The stored MCP source configuration is invalid.",
+    )
+}
+
+fn corrupt_credentials() -> ProtocolError {
+    ProtocolError::corrupt(
+        "invalid_source_credentials",
+        "The stored MCP credential state is invalid.",
+    )
+}
+
+fn internal_error() -> ProtocolError {
+    ProtocolError::new(
+        ProtocolErrorCategory::Internal,
+        "internal_error",
+        "The MCP protocol operation could not be completed.",
+    )
+}
+
+#[cfg(test)]
+fn consume_test_failure(counter: &Option<Arc<std::sync::atomic::AtomicUsize>>) -> bool {
+    counter.as_ref().is_some_and(|counter| {
+        counter
+            .fetch_update(
+                std::sync::atomic::Ordering::SeqCst,
+                std::sync::atomic::Ordering::SeqCst,
+                |remaining| remaining.checked_sub(1),
+            )
+            .is_ok()
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use std::{
+        collections::{HashMap, VecDeque},
+        convert::Infallible,
+    };
+
+    use tokio::{
+        io::{AsyncReadExt, AsyncWriteExt},
+        net::TcpListener,
+    };
+
+    use super::*;
+    use crate::{
+        AppConfig, ExecutorApp,
+        catalog::{
+            AuditContext, CreateSource, CredentialPayload, InitialCatalogSnapshot, ListToolsFilter,
+            SourceRecord, StoredCredential, ToolMode,
+        },
+        crypto::Keyring,
+        oauth::{
+            model::{OAuthClientAuthentication, OAuthConnectionConfig, OAuthSecretSet},
+            store::OAuthStore,
+        },
+        outbound::OutboundPolicy,
+    };
+
+    #[test]
+    fn manual_oauth_credential_uses_the_public_wire_shape() {
+        let credential: McpHttpCredential = serde_json::from_value(json!({
+            "type": "oauth_access_token",
+            "accessToken": "secret-token"
+        }))
+        .expect("public manual OAuth credential decodes");
+
+        assert!(matches!(
+            credential,
+            McpHttpCredential::OAuthAccessToken { ref access_token }
+                if access_token == "secret-token"
+        ));
+        assert_eq!(
+            serde_json::to_value(credential).expect("manual OAuth credential encodes"),
+            json!({ "type": "oauth_access_token", "accessToken": "secret-token" })
+        );
+        assert!(
+            serde_json::from_value::<McpHttpCredential>(json!({
+                "type": "o_auth_access_token",
+                "accessToken": "secret-token"
+            }))
+            .is_err()
+        );
+    }
+
+    struct ReconciliationFetcher {
+        pages: VecDeque<ToolPage>,
+        events: Arc<std::sync::Mutex<Vec<String>>>,
+        session: &'static str,
+        generation: usize,
+    }
+
+    #[async_trait]
+    impl ToolPageFetcher for ReconciliationFetcher {
+        type Error = Infallible;
+
+        async fn fetch_tools_page(
+            &mut self,
+            cursor: Option<&str>,
+        ) -> Result<ToolPage, Self::Error> {
+            let page = if cursor.is_some() { 2 } else { 1 };
+            self.events
+                .lock()
+                .expect("event mutex is available")
+                .push(format!(
+                    "{}:discover-{}-page-{page}",
+                    self.session, self.generation
+                ));
+            Ok(self.pages.pop_front().expect("discovery page exists"))
+        }
+    }
+
+    fn reconciliation_basis(expected_source_revision: i64) -> DiscoveryBasis {
+        DiscoveryBasis {
+            expected_source_revision,
+            expected_credential_revision: Some(0),
+            protocol_version: HTTP_PROTOCOL_VERSION.to_owned(),
+            server_name: "fixture".to_owned(),
+            server_version: "1".to_owned(),
+            server_title: None,
+            instructions: None,
+            capabilities: json!({ "tools": { "listChanged": true } }),
+            tools_list_changed: true,
+        }
+    }
+
+    fn reconciliation_tool(name: &str) -> DiscoveredMcpTool {
+        DiscoveredMcpTool {
+            name: name.to_owned(),
+            title: None,
+            description: None,
+            input_schema: json!({ "type": "object" }),
+            output_schema: None,
+            annotations: None,
+            meta: Map::new(),
+        }
+    }
+
+    async fn reconciliation_plan_with_list_changed(
+        expected_source_revision: i64,
+        name: &str,
+        tools_list_changed: bool,
+    ) -> DiscoveryPlan {
+        let mut fetcher = ReconciliationFetcher {
+            pages: VecDeque::from([ToolPage {
+                tools: vec![reconciliation_tool(name)],
+                next_cursor: None,
+            }]),
+            events: Arc::new(std::sync::Mutex::new(Vec::new())),
+            session: "plan",
+            generation: 1,
+        };
+        let mut basis = reconciliation_basis(expected_source_revision);
+        basis.capabilities = json!({ "tools": { "listChanged": tools_list_changed } });
+        basis.tools_list_changed = tools_list_changed;
+        discover(&mut fetcher, basis)
+            .await
+            .expect("test discovery succeeds")
+    }
+
+    async fn reconciliation_plan(expected_source_revision: i64, name: &str) -> DiscoveryPlan {
+        reconciliation_plan_with_list_changed(expected_source_revision, name, true).await
+    }
+
+    fn race_manager(kind: SourceKind) -> Arc<McpConnectionManager> {
+        let templates = if kind == SourceKind::McpStdio {
+            StdioTemplateRegistry::new(vec![crate::mcp::upstream::stdio::StdioTemplate {
+                name: "race-fixture".to_owned(),
+                executable: std::path::PathBuf::from("/bin/sh"),
+                cwd: None,
+                arguments: vec!["-c".to_owned(), "exit 1".to_owned()],
+                environment: BTreeMap::new(),
+                secret_environment: vec!["API_TOKEN".to_owned()],
+            }])
+            .expect("race stdio template validates")
+        } else {
+            StdioTemplateRegistry::default()
+        };
+        Arc::new(McpConnectionManager::new(templates))
+    }
+
+    async fn create_watcher_race_source(catalog: &CatalogStore, kind: SourceKind) -> SourceRecord {
+        let mut plan = reconciliation_plan(0, "initial").await;
+        let (configuration, credential) = match kind {
+            SourceKind::McpHttp => (
+                encode_configuration(&McpHttpSourceConfigurationV1 {
+                    endpoint: "http://127.0.0.1:1/mcp".to_owned(),
+                    allow_private_network: true,
+                    negotiated_protocol_version: HTTP_PROTOCOL_VERSION.to_owned(),
+                })
+                .expect("HTTP configuration encodes"),
+                StoredMcpHttpCredentialV1 {
+                    endpoint: "http://127.0.0.1:1/mcp".to_owned(),
+                    credential: Some(McpHttpCredential::Bearer {
+                        token: "old-http-token".to_owned(),
+                    }),
+                }
+                .payload()
+                .expect("HTTP credential encodes"),
+            ),
+            SourceKind::McpStdio => {
+                plan = bindings_for_stdio(plan);
+                (
+                    encode_configuration(&McpStdioSourceConfigurationV1 {
+                        template_name: "race-fixture".to_owned(),
+                        negotiated_protocol_version: Some(HTTP_PROTOCOL_VERSION.to_owned()),
+                    })
+                    .expect("stdio configuration encodes"),
+                    StoredMcpStdioCredentialV1 {
+                        template_name: "race-fixture".to_owned(),
+                        secret_values: BTreeMap::from([(
+                            "API_TOKEN".to_owned(),
+                            "old-stdio-token".to_owned(),
+                        )]),
+                    }
+                    .payload()
+                    .expect("stdio credential encodes"),
+                )
+            }
+            SourceKind::Openapi | SourceKind::Graphql => {
+                unreachable!("watcher race fixtures require MCP")
+            }
+        };
+        catalog
+            .create_source_with_catalog(
+                CreateSource {
+                    kind,
+                    preferred_slug: format!("{}-watcher-race", kind.as_str()),
+                    display_name: "Watcher race".to_owned(),
+                    description: None,
+                    configuration,
+                },
+                &credential,
+                plan.initial_catalog_snapshot(),
+                plan.bindings,
+                AuditContext::system(Some("watcher-race-create")),
+            )
+            .await
+            .expect("watcher race source creates")
+            .0
+    }
+
+    async fn install_old_race_watcher(
+        manager: &McpConnectionManager,
+        source: &SourceRecord,
+    ) -> WatcherRevisionLease {
+        let (lease_sender, lease_receiver) = tokio::sync::oneshot::channel();
+        assert!(
+            manager
+                .replace_watcher(
+                    source.id.clone(),
+                    source.revision,
+                    move |mut canceled, lease| async move {
+                        lease_sender.send(lease).ok();
+                        let _ = (&mut canceled).await;
+                    },
+                )
+                .await
+                .expect("old race watcher installs")
+        );
+        lease_receiver
+            .await
+            .expect("old race watcher exposes lease")
+    }
+
+    struct OldSecretWatcherSentinel {
+        canceled: tokio::sync::Notify,
+        release: tokio::sync::Notify,
+        in_use: std::sync::atomic::AtomicBool,
+    }
+
+    async fn install_old_secret_watcher(
+        manager: &McpConnectionManager,
+        source: &SourceRecord,
+    ) -> (WatcherRevisionLease, Arc<OldSecretWatcherSentinel>) {
+        let sentinel = Arc::new(OldSecretWatcherSentinel {
+            canceled: tokio::sync::Notify::new(),
+            release: tokio::sync::Notify::new(),
+            in_use: std::sync::atomic::AtomicBool::new(true),
+        });
+        let (lease_sender, lease_receiver) = tokio::sync::oneshot::channel();
+        assert!(
+            manager
+                .replace_watcher(source.id.clone(), source.revision, {
+                    let sentinel = sentinel.clone();
+                    move |mut canceled, lease| async move {
+                        lease_sender.send(lease).ok();
+                        let _ = (&mut canceled).await;
+                        sentinel.canceled.notify_one();
+                        sentinel.release.notified().await;
+                        sentinel
+                            .in_use
+                            .store(false, std::sync::atomic::Ordering::SeqCst);
+                    }
+                })
+                .await
+                .expect("old-secret watcher installs")
+        );
+        let lease = lease_receiver
+            .await
+            .expect("old-secret watcher exposes lease");
+        (lease, sentinel)
+    }
+
+    async fn commit_replacement_fixture(
+        catalog: &CatalogStore,
+        source: &SourceRecord,
+    ) -> SourceRecord {
+        let mut plan = reconciliation_plan(source.revision, "replacement").await;
+        let credential = match source.kind {
+            SourceKind::McpHttp => StoredMcpHttpCredentialV1 {
+                endpoint: "http://127.0.0.1:1/mcp".to_owned(),
+                credential: Some(McpHttpCredential::Bearer {
+                    token: "new-http-token".to_owned(),
+                }),
+            }
+            .payload()
+            .expect("replacement HTTP credential encodes"),
+            SourceKind::McpStdio => {
+                plan = bindings_for_stdio(plan);
+                StoredMcpStdioCredentialV1 {
+                    template_name: "race-fixture".to_owned(),
+                    secret_values: BTreeMap::from([(
+                        "API_TOKEN".to_owned(),
+                        "new-stdio-token".to_owned(),
+                    )]),
+                }
+                .payload()
+                .expect("replacement stdio credential encodes")
+            }
+            SourceKind::Openapi | SourceKind::Graphql => {
+                unreachable!("watcher race fixtures require MCP")
+            }
+        };
+        catalog
+            .replace_credential_and_sync_catalog(
+                &source.id,
+                &credential,
+                plan.catalog_snapshot(),
+                plan.bindings,
+                AuditContext::system(Some("watcher-race-replace")),
+            )
+            .await
+            .expect("replacement commits")
+            .2
+    }
+
+    async fn commit_mode_during_post_commit_pause(
+        manager: &McpConnectionManager,
+        catalog: &CatalogStore,
+        source: &SourceRecord,
+    ) -> SourceRecord {
+        let lease = manager
+            .lock_source_revisions([(source.id.clone(), source.revision)])
+            .await
+            .expect("post-commit catalog revision leases");
+        let updated = catalog
+            .set_source_mode(
+                &source.id,
+                Some(ToolMode::Ask),
+                source.revision,
+                AuditContext::system(Some("watcher-race-mode")),
+            )
+            .await
+            .expect("post-commit mode mutation commits");
+        assert!(lease.advance(&HashMap::from([(updated.id.clone(), updated.revision,)])));
+        updated
+    }
+
+    #[test]
+    fn strict_create_inputs_reject_unknown_fields_and_default_private_access_off() {
+        let input: CreateMcpHttpSource = serde_json::from_value(json!({
+            "displayName": "Example",
+            "endpoint": "https://example.com/mcp"
+        }))
+        .expect("minimal HTTP input decodes");
+        assert!(!input.allow_private_network);
+        assert!(input.credential.is_none());
+
+        assert!(
+            serde_json::from_value::<CreateMcpHttpSource>(json!({
+                "displayName": "Example",
+                "endpoint": "https://example.com/mcp",
+                "unexpected": true
+            }))
+            .is_err()
+        );
+        assert!(
+            serde_json::from_value::<CreateMcpStdioSource>(json!({
+                "displayName": "Example",
+                "templateName": "fixture",
+                "secretValues": {},
+                "executable": "/bin/sh"
+            }))
+            .is_err()
+        );
+    }
+
+    #[test]
+    fn supported_http_protocol_versions_decode_for_discovery_and_persistence() {
+        for protocol_version in [HTTP_PROTOCOL_VERSION, "2025-06-18"] {
+            let basis = http_discovery_basis(
+                json!({
+                    "protocolVersion": protocol_version,
+                    "capabilities": {},
+                    "serverInfo": { "name": "fixture", "version": "1" }
+                }),
+                4,
+                Some(7),
+            )
+            .expect("supported HTTP discovery metadata decodes");
+            assert_eq!(basis.protocol_version, protocol_version);
+
+            let configuration = json!({
+                "endpoint": "https://example.com/mcp",
+                "allowPrivateNetwork": false,
+                "negotiatedProtocolVersion": protocol_version,
+            })
+            .as_object()
+            .expect("configuration is an object")
+            .clone();
+            let decoded = McpHttpSourceConfigurationV1::decode(&configuration)
+                .expect("supported persisted HTTP protocol version decodes");
+            assert_eq!(decoded.negotiated_protocol_version, protocol_version);
+        }
+    }
+
+    #[test]
+    fn old_and_unknown_http_protocol_versions_fail_discovery_and_persistence() {
+        for protocol_version in ["2025-03-26", "2099-01-01"] {
+            let discovery_error = http_discovery_basis(
+                json!({
+                    "protocolVersion": protocol_version,
+                    "capabilities": {},
+                    "serverInfo": { "name": "fixture", "version": "1" }
+                }),
+                0,
+                None,
+            )
+            .expect_err("unsupported HTTP discovery version is rejected");
+            assert_eq!(discovery_error.code, "mcp_protocol_version_mismatch");
+            assert_eq!(discovery_error.category, ProtocolErrorCategory::Upstream);
+
+            let configuration = json!({
+                "endpoint": "https://example.com/mcp",
+                "allowPrivateNetwork": false,
+                "negotiatedProtocolVersion": protocol_version,
+            })
+            .as_object()
+            .expect("configuration is an object")
+            .clone();
+            let Err(configuration_error) = McpHttpSourceConfigurationV1::decode(&configuration)
+            else {
+                panic!("unsupported persisted HTTP protocol version is rejected");
+            };
+            assert_eq!(configuration_error.code, "invalid_source_configuration");
+            assert_eq!(
+                configuration_error.category,
+                ProtocolErrorCategory::CorruptData
+            );
+        }
+    }
+
+    #[tokio::test]
+    async fn plaintext_nonloopback_create_rejects_static_and_anonymous_without_a_request() {
+        let listener = TcpListener::bind("0.0.0.0:0")
+            .await
+            .expect("zero-request listener binds");
+        let endpoint = format!(
+            "http://0.0.0.0:{}/mcp",
+            listener
+                .local_addr()
+                .expect("zero-request listener has an address")
+                .port()
+        );
+        let directory = tempfile::tempdir().expect("temporary data directory exists");
+        let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+            .await
+            .expect("test app opens");
+        let adapter = McpAdapter::default();
+
+        for allow_private_network in [false, true] {
+            for credential in [
+                None,
+                Some(McpHttpCredential::Bearer {
+                    token: "must-not-dispatch".to_owned(),
+                }),
+            ] {
+                let error = adapter
+                    .create_http_source(
+                        app.catalog(),
+                        CreateMcpHttpSource {
+                            display_name: "Plaintext rejection".to_owned(),
+                            preferred_slug: None,
+                            description: None,
+                            endpoint: endpoint.clone(),
+                            allow_private_network,
+                            credential,
+                        },
+                        AuditContext::system(Some("plaintext-create-rejection")),
+                    )
+                    .await
+                    .expect_err("non-loopback plaintext create is rejected");
+                assert_eq!(error.code, "invalid_mcp_endpoint");
+            }
+        }
+        assert!(
+            tokio::time::timeout(Duration::from_millis(25), listener.accept())
+                .await
+                .is_err(),
+            "rejected source creation must not reach the endpoint"
+        );
+        app.shutdown().await;
+    }
+
+    #[tokio::test]
+    async fn plaintext_nonloopback_refresh_rejects_legacy_state_without_a_request() {
+        let listener = TcpListener::bind("0.0.0.0:0")
+            .await
+            .expect("refresh zero-request listener binds");
+        let endpoint = format!(
+            "http://0.0.0.0:{}/mcp",
+            listener
+                .local_addr()
+                .expect("refresh listener has an address")
+                .port()
+        );
+        let directory = tempfile::tempdir().expect("temporary data directory exists");
+        let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+            .await
+            .expect("test app opens");
+        let (source, _) = app
+            .catalog()
+            .create_source_with_catalog(
+                CreateSource {
+                    kind: SourceKind::McpHttp,
+                    preferred_slug: "legacy-plaintext-mcp".to_owned(),
+                    display_name: "Legacy plaintext MCP".to_owned(),
+                    description: None,
+                    configuration: json!({
+                        "endpoint": endpoint.clone(),
+                        "allowPrivateNetwork": true,
+                        "negotiatedProtocolVersion": HTTP_PROTOCOL_VERSION,
+                    })
+                    .as_object()
+                    .expect("legacy configuration is an object")
+                    .clone(),
+                },
+                &CredentialPayload {
+                    schema_version: MCP_CREDENTIAL_SCHEMA_VERSION,
+                    payload: json!({
+                        "endpoint": endpoint,
+                        "credential": {
+                            "type": "bearer",
+                            "token": "must-not-dispatch"
+                        }
+                    }),
+                },
+                InitialCatalogSnapshot {
+                    artifacts: Vec::new(),
+                    tools: Vec::new(),
+                },
+                Vec::new(),
+                AuditContext::system(Some("legacy-plaintext-create")),
+            )
+            .await
+            .expect("legacy source fixture is stored");
+        let error = McpAdapter::default()
+            .refresh_source(
+                app.catalog(),
+                source,
+                AuditContext::system(Some("legacy-plaintext-refresh")),
+            )
+            .await
+            .expect_err("legacy plaintext refresh is rejected");
+        assert_eq!(error.code, "invalid_source_configuration");
+        assert!(
+            tokio::time::timeout(Duration::from_millis(25), listener.accept())
+                .await
+                .is_err(),
+            "rejected refresh must not reach the endpoint"
+        );
+        app.shutdown().await;
+    }
+
+    #[test]
+    fn public_http_configuration_removes_query_secrets() {
+        let endpoint = validate_endpoint("https://example.com/mcp?api_key=secret")
+            .expect("endpoint validates");
+        assert_eq!(display_endpoint(&endpoint), "https://example.com/mcp");
+        let stored = StoredMcpHttpCredentialV1 {
+            endpoint: endpoint.to_string(),
+            credential: None,
+        };
+        assert!(stored.endpoint.contains("api_key=secret"));
+    }
+
+    #[test]
+    fn plaintext_http_is_rejected_before_transport_except_for_loopback() {
+        assert_eq!(
+            http_configuration_error(StreamableHttpError::InsecureEndpoint).code,
+            "invalid_mcp_endpoint"
+        );
+        assert_eq!(
+            http_protocol_error(StreamableHttpError::InsecureEndpoint).code,
+            "invalid_mcp_endpoint"
+        );
+        for endpoint in [
+            "http://example.com/mcp",
+            "http://10.0.0.5/mcp",
+            "http://192.168.1.5/mcp",
+            "http://169.254.1.2/mcp",
+            "http://[fc00::1]/mcp",
+        ] {
+            assert_eq!(
+                validate_endpoint(endpoint)
+                    .expect_err("non-loopback plaintext endpoint is rejected")
+                    .code,
+                "invalid_mcp_endpoint"
+            );
+            for allow_private_network in [false, true] {
+                for credential in [
+                    None,
+                    Some(McpHttpCredential::Bearer {
+                        token: "must-not-dispatch".to_owned(),
+                    }),
+                ] {
+                    let stored = StoredMcpHttpCredentialV1 {
+                        endpoint: endpoint.to_owned(),
+                        credential,
+                    };
+                    let error = match http_transport_config(&stored, allow_private_network) {
+                        Ok(_) => panic!("plaintext transport must be rejected before construction"),
+                        Err(error) => error,
+                    };
+                    assert_eq!(error.code, "invalid_mcp_endpoint");
+                }
+            }
+        }
+
+        for endpoint in [
+            "http://localhost:3000/mcp",
+            "http://worker.localhost:3000/mcp",
+            "http://127.0.0.1:3000/mcp",
+            "http://[::1]:3000/mcp",
+            "https://example.com/mcp",
+            "https://10.0.0.5/mcp",
+        ] {
+            let stored = StoredMcpHttpCredentialV1 {
+                endpoint: endpoint.to_owned(),
+                credential: Some(McpHttpCredential::Bearer {
+                    token: "allowed-transport".to_owned(),
+                }),
+            };
+            http_transport_config(&stored, true)
+                .expect("HTTPS and loopback HTTP transport configurations remain valid");
+        }
+    }
+
+    #[test]
+    fn credentials_validate_and_metadata_never_contains_values() {
+        let credential = McpHttpCredential::Bearer {
+            token: "highly-secret".to_owned(),
+        };
+        credential.validate().expect("bearer validates");
+        assert!(
+            credential
+                .headers()
+                .expect("bearer headers encode")
+                .get(AUTHORIZATION)
+                .expect("authorization header exists")
+                .is_sensitive()
+        );
+        let stored = StoredMcpHttpCredentialV1 {
+            endpoint: "https://example.com/mcp".to_owned(),
+            credential: Some(credential),
+        };
+        let metadata = http_credential_metadata(3, &stored);
+        assert_eq!(metadata.revision, 3);
+        assert_eq!(metadata.configured_schemes[0].credential_type, "bearer");
+        assert!(!format!("{metadata:?}").contains("highly-secret"));
+
+        let stdio = StoredMcpStdioCredentialV1 {
+            template_name: "fixture".to_owned(),
+            secret_values: BTreeMap::from([("API_TOKEN".to_owned(), "hidden".to_owned())]),
+        };
+        let metadata = stdio_credential_metadata(5, &stdio);
+        assert_eq!(metadata.configured_schemes[0].name, "API_TOKEN");
+        assert_eq!(metadata.configured_schemes[0].credential_type, "secret_env");
+        assert!(!format!("{metadata:?}").contains("hidden"));
+    }
+
+    #[test]
+    fn api_key_credentials_reject_protected_transport_headers() {
+        for name in [
+            "Authorization",
+            "Host",
+            "Content-Type",
+            "Accept",
+            "Content-Length",
+            "Connection",
+            "Transfer-Encoding",
+            "Mcp-Session-Id",
+            "Mcp-Protocol-Version",
+            "Origin",
+            "Referer",
+            "Proxy-Authorization",
+            "Proxy-Custom",
+        ] {
+            let credential = McpHttpCredential::ApiKeyHeader {
+                name: name.to_owned(),
+                value: "secret".to_owned(),
+            };
+            assert!(credential.validate().is_err(), "{name} must be protected");
+        }
+        McpHttpCredential::ApiKeyHeader {
+            name: "X-Api-Key".to_owned(),
+            value: "secret".to_owned(),
+        }
+        .validate()
+        .expect("an ordinary API key header validates");
+    }
+
+    #[test]
+    fn stdio_secret_completeness_allows_deferred_create_but_requires_exact_rotation() {
+        let registry =
+            StdioTemplateRegistry::new(vec![crate::mcp::upstream::stdio::StdioTemplate {
+                name: "fixture".to_owned(),
+                executable: std::path::PathBuf::from("/bin/sh"),
+                cwd: None,
+                arguments: Vec::new(),
+                environment: BTreeMap::new(),
+                secret_environment: vec!["API_TOKEN".to_owned()],
+            }])
+            .expect("fixture registry validates");
+        assert!(
+            !stdio_secrets_complete(&registry, "fixture", &BTreeMap::new())
+                .expect("omitted secrets select deferred creation")
+        );
+        assert!(
+            stdio_secrets_complete(
+                &registry,
+                "fixture",
+                &BTreeMap::from([("API_TOKEN".to_owned(), " secret ".to_owned())]),
+            )
+            .expect("an exact secret overlay is complete")
+        );
+        assert!(
+            stdio_secrets_complete(
+                &registry,
+                "fixture",
+                &BTreeMap::from([("OTHER".to_owned(), "secret".to_owned())]),
+            )
+            .is_err()
+        );
+
+        let public_registry =
+            StdioTemplateRegistry::new(vec![crate::mcp::upstream::stdio::StdioTemplate {
+                name: "public-fixture".to_owned(),
+                executable: std::path::PathBuf::from("/bin/sh"),
+                cwd: None,
+                arguments: Vec::new(),
+                environment: BTreeMap::new(),
+                secret_environment: Vec::new(),
+            }])
+            .expect("public fixture registry validates");
+        assert!(
+            stdio_secrets_complete(&public_registry, "public-fixture", &BTreeMap::new())
+                .expect("an empty overlay is complete for a template without secrets")
+        );
+    }
+
+    #[test]
+    fn malformed_persisted_credentials_fail_closed() {
+        let stored = StoredCredential {
+            revision: 1,
+            credential: CredentialPayload {
+                schema_version: MCP_CREDENTIAL_SCHEMA_VERSION,
+                payload: json!({
+                    "endpoint": "file:///tmp/mcp",
+                    "credential": null
+                }),
+            },
+        };
+        let Err(error) = StoredMcpHttpCredentialV1::decode(&stored) else {
+            panic!("invalid stored endpoint must fail closed");
+        };
+        assert_eq!(error.code, "invalid_source_credentials");
+        assert_eq!(error.category, ProtocolErrorCategory::CorruptData);
+    }
+
+    #[tokio::test]
+    async fn anonymous_create_can_defer_discovery_for_an_oauth_protected_resource() {
+        let directory = tempfile::tempdir().expect("temporary data directory exists");
+        let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+            .await
+            .expect("test app opens");
+        for (status, reason) in [(401, "Unauthorized"), (403, "Forbidden")] {
+            let listener = TcpListener::bind("127.0.0.1:0")
+                .await
+                .expect("fixture listener binds");
+            let address = listener.local_addr().expect("fixture address exists");
+            let server = tokio::spawn(async move {
+                let (mut stream, _) = listener.accept().await.expect("fixture accepts request");
+                let mut request = vec![0_u8; 4096];
+                let read = stream
+                    .read(&mut request)
+                    .await
+                    .expect("fixture reads request");
+                let request = String::from_utf8_lossy(&request[..read]);
+                assert!(request.starts_with("POST /mcp HTTP/1.1"));
+                assert!(!request.to_ascii_lowercase().contains("authorization:"));
+                let response = format!(
+                    "HTTP/1.1 {status} {reason}\r\nWWW-Authenticate: Bearer resource_metadata=\"https://auth.example/.well-known/oauth-protected-resource\"\r\nContent-Length: 0\r\nConnection: close\r\n\r\n"
+                );
+                stream
+                    .write_all(response.as_bytes())
+                    .await
+                    .expect("fixture writes response");
+            });
+            let source = McpAdapter::default()
+                .create_http_source(
+                    app.catalog(),
+                    CreateMcpHttpSource {
+                        display_name: format!("OAuth fixture {status}"),
+                        preferred_slug: Some(format!("oauth_fixture_{status}")),
+                        description: None,
+                        endpoint: format!("http://{address}/mcp"),
+                        allow_private_network: true,
+                        credential: None,
+                    },
+                    AuditContext::system(Some("oauth-protected-create")),
+                )
+                .await
+                .expect("OAuth-protected source creation is deferred");
+
+            assert_eq!(source.health_status, SourceHealth::Error);
+            assert_eq!(
+                source.health_error_code.as_deref(),
+                Some("authorization_required")
+            );
+            let tools = app
+                .catalog()
+                .list_tools(ListToolsFilter {
+                    source_id: Some(source.id),
+                    include_tombstoned: true,
+                    limit: 100,
+                    ..ListToolsFilter::default()
+                })
+                .await
+                .expect("deferred source catalog remains readable");
+            assert!(tools.items.is_empty());
+            server.await.expect("fixture server joins");
+        }
+        app.shutdown().await;
+    }
+
+    #[tokio::test]
+    async fn credentialless_create_defers_when_tools_list_is_forbidden() {
+        let directory = tempfile::tempdir().expect("temporary data directory exists");
+        let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+            .await
+            .expect("test app opens");
+        let listener = TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("fixture listener binds");
+        let address = listener.local_addr().expect("fixture address exists");
+        let server = tokio::spawn(async move {
+            let initialize_body = json!({
+                "jsonrpc": "2.0",
+                "id": 0,
+                "result": {
+                    "protocolVersion": HTTP_PROTOCOL_VERSION,
+                    "capabilities": { "tools": {} },
+                    "serverInfo": { "name": "fixture", "version": "1" }
+                }
+            })
+            .to_string();
+            for step in 0..3 {
+                let (mut stream, _) = listener.accept().await.expect("fixture accepts request");
+                let mut request = vec![0_u8; 8192];
+                let read = stream
+                    .read(&mut request)
+                    .await
+                    .expect("fixture reads request");
+                let request = String::from_utf8_lossy(&request[..read]);
+                let response = match step {
+                    0 => {
+                        assert!(request.contains("\"method\":\"initialize\""));
+                        format!(
+                            "HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{initialize_body}",
+                            initialize_body.len()
+                        )
+                    }
+                    1 => {
+                        assert!(request.contains("notifications/initialized"));
+                        "HTTP/1.1 202 Accepted\r\nContent-Length: 0\r\nConnection: close\r\n\r\n"
+                            .to_owned()
+                    }
+                    _ => {
+                        assert!(request.contains("\"method\":\"tools/list\""));
+                        "HTTP/1.1 403 Forbidden\r\nWWW-Authenticate: Bearer\r\nContent-Length: 0\r\nConnection: close\r\n\r\n"
+                            .to_owned()
+                    }
+                };
+                stream
+                    .write_all(response.as_bytes())
+                    .await
+                    .expect("fixture writes response");
+            }
+        });
+
+        let source = McpAdapter::default()
+            .create_http_source(
+                app.catalog(),
+                CreateMcpHttpSource {
+                    display_name: "Split auth fixture".to_owned(),
+                    preferred_slug: Some("split_auth_fixture".to_owned()),
+                    description: None,
+                    endpoint: format!("http://{address}/mcp"),
+                    allow_private_network: true,
+                    credential: None,
+                },
+                AuditContext::system(Some("split-auth-create")),
+            )
+            .await
+            .expect("tools/list denial defers source creation");
+
+        assert_eq!(source.health_status, SourceHealth::Error);
+        assert_eq!(
+            source.health_error_code.as_deref(),
+            Some("authorization_required")
+        );
+        server.await.expect("fixture server joins");
+        app.shutdown().await;
+    }
+
+    #[tokio::test]
+    async fn managed_oauth_is_resolved_just_in_time_and_static_credentials_take_precedence() {
+        let directory = tempfile::tempdir().expect("temporary data directory exists");
+        let master_key = [42_u8; 32];
+        let master_key_file = directory.path().join("fixture-master.key");
+        std::fs::write(&master_key_file, master_key).expect("fixture master key is written");
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+
+            std::fs::set_permissions(&master_key_file, std::fs::Permissions::from_mode(0o600))
+                .expect("fixture master key permissions are restricted");
+        }
+        let app = ExecutorApp::open(
+            AppConfig::new(directory.path().join("data"))
+                .with_master_key_file(Some(master_key_file)),
+        )
+        .await
+        .expect("test app opens");
+        let stored = StoredMcpHttpCredentialV1 {
+            endpoint: "https://mcp.example.test/rpc".to_owned(),
+            credential: None,
+        };
+        let (source, _) = app
+            .catalog()
+            .create_source_with_catalog_health(
+                CreateSource {
+                    kind: SourceKind::McpHttp,
+                    preferred_slug: "managed_oauth".to_owned(),
+                    display_name: "Managed OAuth".to_owned(),
+                    description: None,
+                    configuration: json!({
+                        "endpoint": "https://mcp.example.test/rpc",
+                        "allowPrivateNetwork": false,
+                        "negotiatedProtocolVersion": HTTP_PROTOCOL_VERSION,
+                    })
+                    .as_object()
+                    .expect("configuration is an object")
+                    .clone(),
+                },
+                &stored.payload().expect("credential encodes"),
+                InitialCatalogSnapshot {
+                    artifacts: Vec::new(),
+                    tools: Vec::new(),
+                },
+                Vec::new(),
+                SourceHealth::Unknown,
+                AuditContext::system(Some("managed-oauth-source")),
+            )
+            .await
+            .expect("fixture source is created");
+        let keyring = Keyring::from_master_key(master_key).expect("fixture keyring derives");
+        OAuthStore::new(app.pool().clone(), keyring.clone())
+            .create_connection(
+                &source.id,
+                "default",
+                &OAuthConnectionConfig {
+                    issuer: "https://auth.example.test".to_owned(),
+                    authorization_endpoint: "https://auth.example.test/authorize".to_owned(),
+                    token_endpoint: "https://auth.example.test/token".to_owned(),
+                    client_id: "fixture-client".to_owned(),
+                    client_authentication: OAuthClientAuthentication::None,
+                    token_endpoint_auth_methods_supported: vec!["none".to_owned()],
+                    scopes: vec!["tools:read".to_owned()],
+                    allow_private_network: false,
+                    resource: Some("https://mcp.example.test/rpc".to_owned()),
+                },
+                Some(&OAuthSecretSet {
+                    access_token: Some("managed-secret-token".to_owned()),
+                    granted_scopes: vec!["tools:read".to_owned()],
+                    ..OAuthSecretSet::default()
+                }),
+                1,
+            )
+            .await
+            .expect("managed OAuth connection is created");
+        let oauth = OAuthService::new(
+            app.pool().clone(),
+            keyring,
+            "http://127.0.0.1:4788".to_owned(),
+            OutboundPolicy::default(),
+        );
+
+        let (managed, revision) =
+            http_transport_config_for_source(Some(&oauth), &source.id, &stored, false)
+                .await
+                .expect("managed OAuth token resolves");
+        assert_eq!(
+            managed
+                .headers
+                .get(AUTHORIZATION)
+                .expect("authorization header exists"),
+            "Bearer managed-secret-token"
+        );
+        assert!(
+            managed
+                .headers
+                .get(AUTHORIZATION)
+                .expect("authorization header exists")
+                .is_sensitive()
+        );
+        assert!(!format!("{:?}", managed.headers).contains("managed-secret-token"));
+        assert_eq!(
+            revision.expect("managed revision exists").secret_revision,
+            1
+        );
+        let source_credential = app
+            .catalog()
+            .credential(&source.id)
+            .await
+            .expect("source credential remains readable")
+            .expect("source credential exists");
+        let source_payload = serde_json::to_string(&source_credential.credential.payload)
+            .expect("source credential serializes");
+        assert!(!source_payload.contains("managed-secret-token"));
+        assert!(!source_payload.contains("access_token"));
+        let mut stale_binding = oauth
+            .binding(&source.id, "default")
+            .await
+            .expect("binding lookup succeeds")
+            .expect("managed binding exists");
+        stale_binding.config_revision += 1;
+        let stale = match http_transport_config_for_binding(
+            Some(&oauth),
+            &source.id,
+            &stored,
+            false,
+            Some(&stale_binding),
+        )
+        .await
+        {
+            Ok(_) => panic!("a stale approval binding must be rejected before transport setup"),
+            Err(error) => error,
+        };
+        assert_eq!(stale.code, "oauth_binding_changed");
+        let anonymous = match http_transport_config_for_observation(
+            Some(&oauth),
+            &source.id,
+            &stored,
+            false,
+            &McpOAuthBindingObservation::Anonymous,
+        )
+        .await
+        {
+            Ok(_) => panic!("observed OAuth absence must be fenced at execution"),
+            Err(error) => error,
+        };
+        assert_eq!(anonymous.code, "oauth_binding_changed");
+
+        let zero_request_listener = TcpListener::bind("0.0.0.0:0")
+            .await
+            .expect("managed OAuth zero-request listener binds");
+        let insecure_managed = StoredMcpHttpCredentialV1 {
+            endpoint: format!(
+                "http://0.0.0.0:{}/mcp",
+                zero_request_listener
+                    .local_addr()
+                    .expect("managed OAuth listener has an address")
+                    .port()
+            ),
+            credential: None,
+        };
+        for allow_private_network in [false, true] {
+            let error = match http_transport_config_for_source(
+                Some(&oauth),
+                &source.id,
+                &insecure_managed,
+                allow_private_network,
+            )
+            .await
+            {
+                Ok(_) => panic!("managed OAuth must not configure plaintext public transport"),
+                Err(error) => error,
+            };
+            assert_eq!(error.code, "invalid_mcp_endpoint");
+        }
+        let error = match http_transport_config_for_binding(
+            Some(&oauth),
+            &source.id,
+            &insecure_managed,
+            true,
+            Some(&stale_binding),
+        )
+        .await
+        {
+            Ok(_) => panic!("plaintext rejection must precede managed OAuth resolution"),
+            Err(error) => error,
+        };
+        assert_eq!(error.code, "invalid_mcp_endpoint");
+        assert!(
+            tokio::time::timeout(Duration::from_millis(25), zero_request_listener.accept())
+                .await
+                .is_err(),
+            "managed OAuth rejection must not reach the plaintext endpoint"
+        );
+
+        let static_stored = StoredMcpHttpCredentialV1 {
+            endpoint: stored.endpoint,
+            credential: Some(McpHttpCredential::Bearer {
+                token: "static-secret-token".to_owned(),
+            }),
+        };
+        let (static_config, revision) =
+            http_transport_config_for_source(Some(&oauth), &source.id, &static_stored, false)
+                .await
+                .expect("static credential resolves without managed OAuth");
+        assert_eq!(
+            static_config
+                .headers
+                .get(AUTHORIZATION)
+                .expect("authorization header exists"),
+            "Bearer static-secret-token"
+        );
+        assert!(revision.is_none());
+        app.shutdown().await;
+    }
+
+    #[test]
+    fn oauth_config_or_secret_rotation_requires_a_new_http_session() {
+        let active = OAuthTransportRevision {
+            binding: OAuthBinding {
+                connection_id: "connection".to_owned(),
+                credential_key: "default".to_owned(),
+                config_revision: 4,
+                granted_scopes: vec![],
+            },
+            secret_revision: 7,
+        };
+        let anonymous_stored = StoredMcpHttpCredentialV1 {
+            endpoint: "https://mcp.example.test".to_owned(),
+            credential: None,
+        };
+        assert!(matches!(
+            catalog_oauth_expectation(&anonymous_stored, None),
+            Some(OAuthBindingExpectation::Absent { credential_key })
+                if credential_key == "default"
+        ));
+        assert!(matches!(
+            catalog_oauth_expectation(&anonymous_stored, Some(&active)),
+            Some(OAuthBindingExpectation::Exact {
+                credential_key,
+                connection_id,
+                config_revision: 4,
+            }) if credential_key == "default" && connection_id == "connection"
+        ));
+        assert!(
+            catalog_oauth_expectation(
+                &StoredMcpHttpCredentialV1 {
+                    endpoint: anonymous_stored.endpoint.clone(),
+                    credential: Some(McpHttpCredential::Bearer {
+                        token: "static".to_owned(),
+                    }),
+                },
+                Some(&active),
+            )
+            .is_none()
+        );
+        assert!(!oauth_transport_changed(Some(&active), Some(&active)));
+        assert!(oauth_transport_changed(
+            Some(&active),
+            Some(&OAuthTransportRevision {
+                binding: OAuthBinding {
+                    config_revision: 5,
+                    ..active.binding.clone()
+                },
+                secret_revision: active.secret_revision,
+            })
+        ));
+        assert!(oauth_transport_changed(
+            Some(&active),
+            Some(&OAuthTransportRevision {
+                binding: active.binding.clone(),
+                secret_revision: 8,
+            })
+        ));
+        assert!(oauth_transport_changed(None, Some(&active)));
+    }
+
+    #[test]
+    fn preparation_is_network_free_and_preserves_secret_values() {
+        let adapter = McpAdapter::default();
+        let configuration = json!({
+            "endpoint": "https://example.com/mcp",
+            "allowPrivateNetwork": false,
+            "negotiatedProtocolVersion": HTTP_PROTOCOL_VERSION
+        })
+        .as_object()
+        .expect("configuration is an object")
+        .clone();
+        let stored = StoredCredential {
+            revision: 1,
+            credential: StoredMcpHttpCredentialV1 {
+                endpoint: "https://example.com/mcp?secret=query".to_owned(),
+                credential: Some(McpHttpCredential::Bearer {
+                    token: "token".to_owned(),
+                }),
+            }
+            .payload()
+            .expect("credential encodes"),
+        };
+        let prepared = adapter
+            .prepare_invocation(
+                "source-id",
+                SourceKind::McpHttp,
+                &McpToolBindingV1 {
+                    version: 1,
+                    tool_name: "ping".to_owned(),
+                },
+                &configuration,
+                Some(&stored),
+                &json!({}),
+                McpOAuthBindingObservation::Static,
+            )
+            .expect("preparation succeeds without transport I/O");
+        let PreparedMcpInvocation::Http { credential, .. } = prepared else {
+            panic!("HTTP invocation is prepared")
+        };
+        assert!(credential.endpoint.contains("secret=query"));
+        assert!(credential.credential.is_some());
+
+        let insecure_changed_endpoint = StoredCredential {
+            revision: 2,
+            credential: StoredMcpHttpCredentialV1 {
+                endpoint: "http://example.com/mcp".to_owned(),
+                credential: Some(McpHttpCredential::Bearer {
+                    token: "must-not-dispatch".to_owned(),
+                }),
+            }
+            .payload()
+            .expect("changed credential encodes"),
+        };
+        let error = match adapter.prepare_invocation(
+            "source-id",
+            SourceKind::McpHttp,
+            &McpToolBindingV1 {
+                version: 1,
+                tool_name: "ping".to_owned(),
+            },
+            &configuration,
+            Some(&insecure_changed_endpoint),
+            &json!({}),
+            McpOAuthBindingObservation::Static,
+        ) {
+            Ok(_) => panic!("changed plaintext public endpoint must fail before invocation"),
+            Err(error) => error,
+        };
+        assert_eq!(error.code, "invalid_source_credentials");
+    }
+
+    #[test]
+    fn mcp_error_results_are_not_exposed_as_success_data() {
+        let response = mcp_response(json!({
+            "content": [{ "type": "text", "text": "failed" }],
+            "isError": true
+        }));
+        assert!(!response.ok);
+        assert!(response.data.is_none());
+        assert_eq!(
+            response.error.expect("error metadata exists").code,
+            "upstream_tool_error"
+        );
+    }
+
+    #[tokio::test]
+    async fn discovery_change_signals_coalesce_and_require_a_quiet_period() {
+        let (sender, mut receiver) = tokio::sync::broadcast::channel(2);
+        sender.send(()).expect("first signal sends");
+        sender.send(()).expect("second signal sends");
+        sender.send(()).expect("lagging signal sends");
+        assert!(catalog_changed_before_quiet(&mut receiver).await);
+        assert!(!catalog_changed_before_quiet(&mut receiver).await);
+    }
+
+    #[tokio::test]
+    async fn watcher_reconciliation_gate_finishes_full_discovery_before_steady_state() {
+        let events = Arc::new(std::sync::Mutex::new(Vec::new()));
+
+        for session in ["startup", "reconnect"] {
+            let reconcile_events = events.clone();
+            let reconciled = reconcile_watcher_session(async move {
+                for generation in 1..=2 {
+                    let mut fetcher = ReconciliationFetcher {
+                        pages: VecDeque::from([
+                            ToolPage {
+                                tools: vec![reconciliation_tool("one")],
+                                next_cursor: Some("next".to_owned()),
+                            },
+                            ToolPage {
+                                tools: vec![reconciliation_tool("two")],
+                                next_cursor: None,
+                            },
+                        ]),
+                        events: reconcile_events.clone(),
+                        session,
+                        generation,
+                    };
+                    discover(&mut fetcher, reconciliation_basis(1))
+                        .await
+                        .expect("full paginated discovery succeeds");
+                }
+                Ok::<(), Infallible>(())
+            })
+            .await
+            .expect("reconciliation reaches the steady-state gate");
+            let () = reconciled.into_inner();
+            events
+                .lock()
+                .expect("event mutex is available")
+                .push(format!("{session}:steady-state"));
+        }
+
+        assert_eq!(
+            *events.lock().expect("event mutex is available"),
+            [
+                "startup:discover-1-page-1",
+                "startup:discover-1-page-2",
+                "startup:discover-2-page-1",
+                "startup:discover-2-page-2",
+                "startup:steady-state",
+                "reconnect:discover-1-page-1",
+                "reconnect:discover-1-page-2",
+                "reconnect:discover-2-page-1",
+                "reconnect:discover-2-page-2",
+                "reconnect:steady-state",
+            ]
+        );
+    }
+
+    #[tokio::test]
+    async fn immediate_http_405_is_observed_only_after_startup_reconciliation_commits() {
+        let events = Arc::new(std::sync::Mutex::new(Vec::new()));
+        let listener_events = events.clone();
+        let mut listener = tokio::spawn(async move {
+            listener_events
+                .lock()
+                .expect("event mutex is available")
+                .push("listener-405".to_owned());
+            Err(StreamableHttpError::HttpStatus(
+                reqwest::StatusCode::METHOD_NOT_ALLOWED,
+            ))
+        });
+        tokio::task::yield_now().await;
+        assert!(listener.is_finished());
+
+        let reconciliation_events = events.clone();
+        let reconciled = reconcile_watcher_session(async move {
+            let mut fetcher = ReconciliationFetcher {
+                pages: VecDeque::from([ToolPage {
+                    tools: vec![reconciliation_tool("startup")],
+                    next_cursor: None,
+                }]),
+                events: reconciliation_events.clone(),
+                session: "startup-405",
+                generation: 1,
+            };
+            let plan = discover(&mut fetcher, reconciliation_basis(1))
+                .await
+                .expect("startup discovery succeeds");
+            reconciliation_events
+                .lock()
+                .expect("event mutex is available")
+                .push("catalog-commit".to_owned());
+            Ok::<_, Infallible>(plan)
+        })
+        .await
+        .expect("startup reconciliation completes");
+
+        let listener_result =
+            finished_http_listener_after_reconciliation(&reconciled, &mut listener)
+                .await
+                .expect("the completed listener is observed after reconciliation")
+                .expect("listener task joins");
+        assert!(matches!(
+            listener_result,
+            Err(StreamableHttpError::HttpStatus(status))
+                if status == reqwest::StatusCode::METHOD_NOT_ALLOWED
+        ));
+        events
+            .lock()
+            .expect("event mutex is available")
+            .push("405-honored".to_owned());
+
+        assert_eq!(
+            *events.lock().expect("event mutex is available"),
+            [
+                "listener-405",
+                "startup-405:discover-1-page-1",
+                "catalog-commit",
+                "405-honored",
+            ]
+        );
+    }
+
+    #[tokio::test]
+    async fn stale_catalog_cas_does_not_publish_a_watcher_plan() {
+        let directory = tempfile::tempdir().expect("temporary data directory exists");
+        let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+            .await
+            .expect("test app opens");
+        let initial = reconciliation_plan(0, "initial").await;
+        let (source, _) = app
+            .catalog()
+            .create_source_with_catalog(
+                CreateSource {
+                    kind: SourceKind::McpHttp,
+                    preferred_slug: "watcher-cas".to_owned(),
+                    display_name: "Watcher CAS".to_owned(),
+                    description: None,
+                    configuration: Map::new(),
+                },
+                &CredentialPayload {
+                    schema_version: MCP_CREDENTIAL_SCHEMA_VERSION,
+                    payload: json!({}),
+                },
+                initial.initial_catalog_snapshot(),
+                initial.bindings,
+                AuditContext::system(Some("watcher-cas-create")),
+            )
+            .await
+            .expect("source is created");
+        let manager = Arc::new(McpConnectionManager::new(StdioTemplateRegistry::default()));
+        let (lease_sender, lease_receiver) = tokio::sync::oneshot::channel();
+        assert!(
+            manager
+                .replace_watcher(
+                    source.id.clone(),
+                    source.revision,
+                    move |mut canceled, lease| async move {
+                        lease_sender.send(lease).ok();
+                        let _ = (&mut canceled).await;
+                    },
+                )
+                .await
+                .expect("manager accepts watcher")
+        );
+        let lease = tokio::time::timeout(Duration::from_secs(2), lease_receiver)
+            .await
+            .expect("watcher delivers its lease promptly")
+            .expect("watcher exposes its lease");
+        let fresh = reconciliation_plan(source.revision, "fresh").await;
+        let fresh_result = app
+            .catalog()
+            .sync_catalog_with_bindings(
+                &source.id,
+                fresh.catalog_snapshot(),
+                fresh.bindings,
+                AuditContext::system(Some("watcher-cas-fresh")),
+            )
+            .await
+            .expect("concurrent catalog update commits");
+        let stale = reconciliation_plan(source.revision, "stale").await;
+        let error = commit_watcher_discovery(app.catalog(), &source.id, stale, None, &lease)
+            .await
+            .expect_err("stale watcher CAS is rejected");
+        assert_eq!(error.code, "revision_conflict");
+        assert_eq!(
+            app.catalog()
+                .source(&source.id)
+                .await
+                .expect("source remains readable")
+                .revision,
+            fresh_result.source_revision
+        );
+        let tools = app
+            .catalog()
+            .list_tools(ListToolsFilter {
+                source_id: Some(source.id.clone()),
+                include_tombstoned: true,
+                limit: 100,
+                ..ListToolsFilter::default()
+            })
+            .await
+            .expect("catalog remains readable");
+        assert!(tools.items.iter().any(|tool| tool.stable_key == "fresh"));
+        assert!(!tools.items.iter().any(|tool| tool.stable_key == "stale"));
+
+        manager.shutdown().await;
+        app.shutdown().await;
+    }
+
+    #[tokio::test]
+    async fn stale_watcher_generation_cannot_publish_at_the_current_catalog_revision() {
+        let directory = tempfile::tempdir().expect("temporary data directory exists");
+        let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+            .await
+            .expect("test app opens");
+        let initial = reconciliation_plan(0, "initial").await;
+        let (source, _) = app
+            .catalog()
+            .create_source_with_catalog(
+                CreateSource {
+                    kind: SourceKind::McpHttp,
+                    preferred_slug: "watcher-generation".to_owned(),
+                    display_name: "Watcher generation".to_owned(),
+                    description: None,
+                    configuration: Map::new(),
+                },
+                &CredentialPayload {
+                    schema_version: MCP_CREDENTIAL_SCHEMA_VERSION,
+                    payload: json!({}),
+                },
+                initial.initial_catalog_snapshot(),
+                initial.bindings,
+                AuditContext::system(Some("watcher-generation-create")),
+            )
+            .await
+            .expect("source is created");
+        let manager = Arc::new(McpConnectionManager::new(StdioTemplateRegistry::default()));
+        let (stale_sender, stale_receiver) = tokio::sync::oneshot::channel();
+        assert!(
+            manager
+                .replace_watcher(
+                    source.id.clone(),
+                    source.revision,
+                    move |mut canceled, lease| async move {
+                        stale_sender.send(lease).ok();
+                        let _ = (&mut canceled).await;
+                    },
+                )
+                .await
+                .expect("first watcher installs")
+        );
+        let stale_lease = tokio::time::timeout(Duration::from_secs(2), stale_receiver)
+            .await
+            .expect("first watcher delivers its lease promptly")
+            .expect("first watcher exposes its lease");
+        assert!(
+            manager
+                .replace_watcher(
+                    source.id.clone(),
+                    source.revision,
+                    move |mut canceled, _lease| async move {
+                        let _ = (&mut canceled).await;
+                    },
+                )
+                .await
+                .expect("replacement watcher installs")
+        );
+        let stale_plan = reconciliation_plan(source.revision, "stale-generation").await;
+        let error =
+            commit_watcher_discovery(app.catalog(), &source.id, stale_plan, None, &stale_lease)
+                .await
+                .expect_err("replaced watcher cannot publish at the current revision");
+        assert_eq!(error.code, "stale_watcher_reconciliation");
+        assert_eq!(
+            app.catalog()
+                .source(&source.id)
+                .await
+                .expect("source remains readable")
+                .revision,
+            source.revision
+        );
+        let tools = app
+            .catalog()
+            .list_tools(ListToolsFilter {
+                source_id: Some(source.id.clone()),
+                include_tombstoned: true,
+                limit: 100,
+                ..ListToolsFilter::default()
+            })
+            .await
+            .expect("catalog remains readable");
+        assert!(tools.items.iter().any(|tool| tool.stable_key == "initial"));
+        assert!(
+            !tools
+                .items
+                .iter()
+                .any(|tool| tool.stable_key == "stale-generation")
+        );
+
+        manager.shutdown().await;
+        app.shutdown().await;
+    }
+
+    async fn credential_replacement_post_commit_race(kind: SourceKind) {
+        let directory = tempfile::tempdir().expect("temporary data directory exists");
+        let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+            .await
+            .expect("test app opens");
+        let manager = race_manager(kind);
+        let source = create_watcher_race_source(app.catalog(), kind).await;
+        let old_watcher = install_old_race_watcher(&manager, &source).await;
+        let committed = commit_replacement_fixture(app.catalog(), &source).await;
+        assert_eq!(committed.revision, source.revision + 1);
+
+        let pause = Arc::new(PostCommitPause::default());
+        let mut adapter = McpAdapter::with_connection_manager(manager.clone());
+        adapter.post_commit_pause = Some(pause.clone());
+        let committed_revision = committed.revision;
+        let finishing = tokio::spawn({
+            let adapter = adapter.clone();
+            let catalog = app.catalog().clone();
+            let source_id = source.id.clone();
+            async move {
+                adapter
+                    .finish_source_watcher_reconciliation(&catalog, &source_id, committed_revision)
+                    .await
+                    .expect("replacement watcher reconciliation succeeds");
+            }
+        });
+        pause.reached.notified().await;
+
+        let current =
+            commit_mode_during_post_commit_pause(&manager, app.catalog(), &committed).await;
+        assert_eq!(current.revision, committed.revision + 1);
+        assert_eq!(old_watcher.current_revision(), None);
+        assert_eq!(manager.watcher_revision(&source.id), Some(source.revision));
+
+        pause.release.notify_one();
+        finishing.await.expect("post-commit reconciliation joins");
+        assert_eq!(manager.watcher_revision(&source.id), Some(current.revision));
+        assert_eq!(old_watcher.current_revision(), None);
+
+        let stored = app
+            .catalog()
+            .credential(&source.id)
+            .await
+            .expect("replacement credential reads")
+            .expect("replacement credential exists");
+        match kind {
+            SourceKind::McpHttp => {
+                let stored = StoredMcpHttpCredentialV1::decode(&stored)
+                    .expect("replacement HTTP credential decodes");
+                assert!(matches!(
+                    stored.credential,
+                    Some(McpHttpCredential::Bearer { token }) if token == "new-http-token"
+                ));
+            }
+            SourceKind::McpStdio => {
+                let stored = StoredMcpStdioCredentialV1::decode(&stored)
+                    .expect("replacement stdio credential decodes");
+                assert_eq!(
+                    stored.secret_values.get("API_TOKEN").map(String::as_str),
+                    Some("new-stdio-token")
+                );
+            }
+            SourceKind::Openapi | SourceKind::Graphql => unreachable!(),
+        }
+        manager.shutdown().await;
+        app.shutdown().await;
+    }
+
+    async fn credential_reconciliation_load_failure_recovers_without_old_secret(
+        kind: SourceKind,
+        fail_capabilities: bool,
+    ) {
+        let directory = tempfile::tempdir().expect("temporary data directory exists");
+        let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+            .await
+            .expect("test app opens");
+        let manager = race_manager(kind);
+        let source = create_watcher_race_source(app.catalog(), kind).await;
+        let (old_watcher, sentinel) = install_old_secret_watcher(&manager, &source).await;
+        let committed = commit_replacement_fixture(app.catalog(), &source).await;
+        let failures = Arc::new(std::sync::atomic::AtomicUsize::new(1));
+        let install_attempts = Arc::new(std::sync::atomic::AtomicUsize::new(0));
+        let mut adapter = McpAdapter::with_connection_manager(manager.clone());
+        adapter.watcher_install_attempts = Some(install_attempts.clone());
+        if fail_capabilities {
+            adapter.watcher_capability_load_failures = Some(failures.clone());
+        } else {
+            adapter.watcher_credential_load_failures = Some(failures.clone());
+        }
+        let committed_revision = committed.revision;
+
+        let finishing = tokio::spawn({
+            let adapter = adapter.clone();
+            let catalog = app.catalog().clone();
+            let source_id = source.id.clone();
+            async move {
+                adapter
+                    .finish_source_watcher_reconciliation(&catalog, &source_id, committed_revision)
+                    .await
+            }
+        });
+        tokio::time::timeout(Duration::from_secs(2), sentinel.canceled.notified())
+            .await
+            .expect("old-secret watcher is canceled promptly");
+        assert!(sentinel.in_use.load(std::sync::atomic::Ordering::SeqCst));
+        assert!(!finishing.is_finished());
+        sentinel.release.notify_one();
+
+        finishing
+            .await
+            .expect("credential reconciliation task joins")
+            .expect("transient watcher load failure recovers");
+        assert!(!sentinel.in_use.load(std::sync::atomic::Ordering::SeqCst));
+        assert_eq!(old_watcher.current_revision(), None);
+        assert_eq!(failures.load(std::sync::atomic::Ordering::SeqCst), 0);
+        assert_eq!(
+            install_attempts.load(std::sync::atomic::Ordering::SeqCst),
+            2
+        );
+        assert_eq!(
+            manager.watcher_revision(&source.id),
+            Some(committed_revision)
+        );
+
+        manager.shutdown().await;
+        app.shutdown().await;
+    }
+
+    #[tokio::test]
+    async fn http_credential_reconciliation_fails_closed_then_recovers_capability_load() {
+        credential_reconciliation_load_failure_recovers_without_old_secret(
+            SourceKind::McpHttp,
+            true,
+        )
+        .await;
+    }
+
+    #[tokio::test]
+    async fn stdio_credential_reconciliation_fails_closed_then_recovers_credential_load() {
+        credential_reconciliation_load_failure_recovers_without_old_secret(
+            SourceKind::McpStdio,
+            false,
+        )
+        .await;
+    }
+
+    #[tokio::test]
+    async fn persistent_post_commit_load_failure_returns_error_without_old_secret_watcher() {
+        let directory = tempfile::tempdir().expect("temporary data directory exists");
+        let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+            .await
+            .expect("test app opens");
+        let manager = race_manager(SourceKind::McpHttp);
+        let source = create_watcher_race_source(app.catalog(), SourceKind::McpHttp).await;
+        let (_old_watcher, sentinel) = install_old_secret_watcher(&manager, &source).await;
+        let committed = commit_replacement_fixture(app.catalog(), &source).await;
+        let mut adapter = McpAdapter::with_connection_manager(manager.clone());
+        adapter.watcher_capability_load_failures = Some(Arc::new(
+            std::sync::atomic::AtomicUsize::new(WATCHER_RECONCILIATION_ATTEMPTS),
+        ));
+
+        let finishing = tokio::spawn({
+            let adapter = adapter.clone();
+            let catalog = app.catalog().clone();
+            let source_id = source.id.clone();
+            async move {
+                adapter
+                    .finish_source_watcher_reconciliation(&catalog, &source_id, committed.revision)
+                    .await
+            }
+        });
+        tokio::time::timeout(Duration::from_secs(2), sentinel.canceled.notified())
+            .await
+            .expect("old-secret watcher is canceled promptly");
+        assert!(!finishing.is_finished());
+        sentinel.release.notify_one();
+
+        let error = finishing
+            .await
+            .expect("credential reconciliation task joins")
+            .expect_err("persistent watcher load failure is reported");
+        assert_eq!(error.code, "internal_error");
+        assert!(!sentinel.in_use.load(std::sync::atomic::Ordering::SeqCst));
+        assert!(!manager.has_watcher(&source.id));
+
+        manager.shutdown().await;
+        app.shutdown().await;
+    }
+
+    async fn source_creation_finish_preserves_or_recovers_watcher(kind: SourceKind) {
+        let directory = tempfile::tempdir().expect("temporary data directory exists");
+        let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+            .await
+            .expect("test app opens");
+        let manager = race_manager(kind);
+        let source = create_watcher_race_source(app.catalog(), kind).await;
+        let watcher_canceled = Arc::new(std::sync::atomic::AtomicBool::new(false));
+        let canceled_flag = watcher_canceled.clone();
+        assert!(
+            manager
+                .replace_watcher(
+                    source.id.clone(),
+                    source.revision,
+                    move |mut canceled, _lease| async move {
+                        let _ = (&mut canceled).await;
+                        canceled_flag.store(true, std::sync::atomic::Ordering::SeqCst);
+                    },
+                )
+                .await
+                .expect("ready source watcher installs")
+        );
+
+        let install_attempts = Arc::new(std::sync::atomic::AtomicUsize::new(0));
+        let mut adapter = McpAdapter::with_connection_manager(manager.clone());
+        adapter.watcher_install_attempts = Some(install_attempts.clone());
+        adapter
+            .ensure_source_creation_watcher(app.catalog(), &source.id)
+            .await;
+        assert_eq!(
+            install_attempts.load(std::sync::atomic::Ordering::SeqCst),
+            0,
+            "finishing a ready create must preserve its current watcher"
+        );
+        assert!(!watcher_canceled.load(std::sync::atomic::Ordering::SeqCst));
+        assert_eq!(manager.watcher_revision(&source.id), Some(source.revision));
+
+        assert!(
+            manager
+                .stop_watcher_and_wait_at_revision(&source.id, source.revision)
+                .await
+        );
+        assert!(watcher_canceled.load(std::sync::atomic::Ordering::SeqCst));
+        adapter
+            .ensure_source_creation_watcher(app.catalog(), &source.id)
+            .await;
+        assert_eq!(
+            install_attempts.load(std::sync::atomic::Ordering::SeqCst),
+            1,
+            "recovery must make exactly one watcher installation attempt"
+        );
+
+        manager.shutdown().await;
+        app.shutdown().await;
+    }
+
+    #[tokio::test]
+    async fn http_source_creation_finish_preserves_ready_watcher_and_recovers_missing() {
+        source_creation_finish_preserves_or_recovers_watcher(SourceKind::McpHttp).await;
+    }
+
+    #[tokio::test]
+    async fn stdio_source_creation_finish_preserves_ready_watcher_and_recovers_missing() {
+        source_creation_finish_preserves_or_recovers_watcher(SourceKind::McpStdio).await;
+    }
+
+    #[tokio::test]
+    async fn http_credential_replacement_reloads_after_a_paused_post_commit_mode_race() {
+        credential_replacement_post_commit_race(SourceKind::McpHttp).await;
+    }
+
+    #[tokio::test]
+    async fn stdio_credential_replacement_reloads_after_a_paused_post_commit_mode_race() {
+        credential_replacement_post_commit_race(SourceKind::McpStdio).await;
+    }
+
+    #[tokio::test]
+    async fn http_clear_fallback_stops_a_stale_old_credential_watcher_after_commit() {
+        let directory = tempfile::tempdir().expect("temporary data directory exists");
+        let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+            .await
+            .expect("test app opens");
+        let manager = race_manager(SourceKind::McpHttp);
+        let source = create_watcher_race_source(app.catalog(), SourceKind::McpHttp).await;
+        let old_watcher = install_old_race_watcher(&manager, &source).await;
+        let expected_credential_revision = app
+            .catalog()
+            .credential(&source.id)
+            .await
+            .expect("HTTP credential reads")
+            .expect("HTTP credential exists")
+            .revision;
+
+        let pause = Arc::new(PostCommitPause::default());
+        let mut adapter = McpAdapter::with_connection_manager(manager.clone());
+        adapter.post_commit_pause = Some(pause.clone());
+        let clearing = tokio::spawn({
+            let adapter = adapter.clone();
+            let catalog = app.catalog().clone();
+            let source_id = source.id.clone();
+            async move {
+                adapter
+                    .replace_http_credentials(
+                        &catalog,
+                        &source_id,
+                        expected_credential_revision,
+                        ReplaceMcpHttpCredential { credential: None },
+                        AuditContext::system(Some("watcher-race-http-clear")),
+                    )
+                    .await
+            }
+        });
+        tokio::time::timeout(Duration::from_secs(5), pause.reached.notified())
+            .await
+            .expect("HTTP clear reaches its post-commit fence");
+
+        assert_eq!(old_watcher.current_revision(), None);
+        assert!(!manager.has_watcher(&source.id));
+        let stale_watcher = install_old_race_watcher(&manager, &source).await;
+        assert_eq!(stale_watcher.current_revision(), Some(source.revision));
+
+        pause.release.notify_one();
+        let metadata = tokio::time::timeout(Duration::from_secs(5), clearing)
+            .await
+            .expect("HTTP clear finishes promptly")
+            .expect("HTTP clear task joins")
+            .expect("HTTP clear commits");
+        assert!(metadata.configured_schemes.is_empty());
+        assert!(!manager.has_watcher(&source.id));
+        assert_eq!(stale_watcher.current_revision(), None);
+        let current = app
+            .catalog()
+            .source(&source.id)
+            .await
+            .expect("cleared HTTP source reads");
+        assert_eq!(current.health_status, SourceHealth::Unknown);
+        assert!(current.revision > source.revision);
+        let stored = app
+            .catalog()
+            .credential(&source.id)
+            .await
+            .expect("cleared HTTP credential reads")
+            .expect("cleared HTTP credential exists");
+        assert!(
+            StoredMcpHttpCredentialV1::decode(&stored)
+                .expect("cleared HTTP credential decodes")
+                .credential
+                .is_none()
+        );
+
+        manager.shutdown().await;
+        app.shutdown().await;
+    }
+
+    #[tokio::test]
+    async fn clearing_required_stdio_secrets_keeps_the_committed_revision_without_a_watcher() {
+        let directory = tempfile::tempdir().expect("temporary data directory exists");
+        let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+            .await
+            .expect("test app opens");
+        let manager = race_manager(SourceKind::McpStdio);
+        let source = create_watcher_race_source(app.catalog(), SourceKind::McpStdio).await;
+        let old_watcher = install_old_race_watcher(&manager, &source).await;
+        let expected_credential_revision = app
+            .catalog()
+            .credential(&source.id)
+            .await
+            .expect("stdio credential reads")
+            .expect("stdio credential exists")
+            .revision;
+        let adapter = McpAdapter::with_connection_manager(manager.clone());
+
+        let metadata = adapter
+            .clear_credentials(
+                app.catalog(),
+                &source,
+                expected_credential_revision,
+                AuditContext::system(Some("watcher-race-stdio-clear")),
+            )
+            .await
+            .expect("stdio credential clear commits");
+        assert!(metadata.configured_schemes.is_empty());
+        assert!(!manager.has_watcher(&source.id));
+        assert_eq!(old_watcher.current_revision(), None);
+
+        let current = app
+            .catalog()
+            .source(&source.id)
+            .await
+            .expect("cleared stdio source reads");
+        assert_eq!(current.health_status, SourceHealth::Unknown);
+        assert!(current.revision > source.revision);
+        let stored = app
+            .catalog()
+            .credential(&source.id)
+            .await
+            .expect("cleared stdio credential reads")
+            .expect("cleared stdio credential exists");
+        assert!(
+            StoredMcpStdioCredentialV1::decode(&stored)
+                .expect("cleared stdio credential decodes")
+                .secret_values
+                .is_empty()
+        );
+
+        adapter
+            .reconcile_source_watcher(app.catalog(), &source.id, current.revision)
+            .await
+            .expect("cleared stdio watcher remains absent");
+        assert!(!manager.has_watcher(&source.id));
+
+        manager.shutdown().await;
+        app.shutdown().await;
+    }
+
+    #[tokio::test]
+    async fn manual_refresh_capability_removal_stops_stale_watcher_after_post_commit_mode_race() {
+        let directory = tempfile::tempdir().expect("temporary data directory exists");
+        let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+            .await
+            .expect("test app opens");
+        let manager = race_manager(SourceKind::McpHttp);
+        let source = create_watcher_race_source(app.catalog(), SourceKind::McpHttp).await;
+        let (old_watcher, sentinel) = install_old_secret_watcher(&manager, &source).await;
+
+        let removed =
+            reconciliation_plan_with_list_changed(source.revision, "refreshed", false).await;
+        let sync = app
+            .catalog()
+            .sync_catalog_with_bindings(
+                &source.id,
+                removed.catalog_snapshot(),
+                removed.bindings,
+                AuditContext::system(Some("watcher-race-refresh")),
+            )
+            .await
+            .expect("capability removal refresh commits");
+        let committed = app
+            .catalog()
+            .source(&source.id)
+            .await
+            .expect("refreshed source reads");
+        assert_eq!(committed.revision, sync.source_revision);
+
+        let pause = Arc::new(PostCommitPause::default());
+        let mut adapter = McpAdapter::with_connection_manager(manager.clone());
+        adapter.post_commit_pause = Some(pause.clone());
+        let committed_revision = committed.revision;
+        let finishing = tokio::spawn({
+            let adapter = adapter.clone();
+            let catalog = app.catalog().clone();
+            let source_id = source.id.clone();
+            async move {
+                adapter
+                    .finish_source_watcher_reconciliation(&catalog, &source_id, committed_revision)
+                    .await
+                    .expect("capability removal watcher reconciliation succeeds");
+            }
+        });
+        pause.reached.notified().await;
+
+        let current =
+            commit_mode_during_post_commit_pause(&manager, app.catalog(), &committed).await;
+        assert_eq!(old_watcher.current_revision(), None);
+        assert_eq!(manager.watcher_revision(&source.id), Some(source.revision));
+
+        pause.release.notify_one();
+        tokio::time::timeout(Duration::from_secs(2), sentinel.canceled.notified())
+            .await
+            .expect("capability removal cancels the old-secret watcher promptly");
+        assert!(sentinel.in_use.load(std::sync::atomic::Ordering::SeqCst));
+        assert!(!finishing.is_finished());
+        sentinel.release.notify_one();
+        finishing.await.expect("post-commit reconciliation joins");
+        assert!(!sentinel.in_use.load(std::sync::atomic::Ordering::SeqCst));
+        assert!(!manager.has_watcher(&source.id));
+        assert_eq!(old_watcher.current_revision(), None);
+        assert_eq!(
+            app.catalog()
+                .source(&source.id)
+                .await
+                .expect("current source reads")
+                .revision,
+            current.revision
+        );
+        manager.shutdown().await;
+        app.shutdown().await;
+    }
+
+    #[tokio::test]
+    async fn watcher_lease_advancement_fences_a_stale_generation() {
+        let manager = Arc::new(McpConnectionManager::new(StdioTemplateRegistry::default()));
+        let (first_sender, first_receiver) = tokio::sync::oneshot::channel();
+        assert!(
+            manager
+                .replace_watcher(
+                    "source".to_owned(),
+                    7,
+                    move |mut canceled, lease| async move {
+                        first_sender.send(lease).ok();
+                        let _ = (&mut canceled).await;
+                    }
+                )
+                .await
+                .expect("first watcher installs")
+        );
+        let stale = tokio::time::timeout(Duration::from_secs(2), first_receiver)
+            .await
+            .expect("first watcher delivers its lease promptly")
+            .expect("first lease is available");
+        let (current_sender, current_receiver) = tokio::sync::oneshot::channel();
+        assert!(
+            manager
+                .replace_watcher(
+                    "source".to_owned(),
+                    7,
+                    move |mut canceled, lease| async move {
+                        current_sender.send(lease).ok();
+                        let _ = (&mut canceled).await;
+                    }
+                )
+                .await
+                .expect("replacement watcher installs")
+        );
+        let current = tokio::time::timeout(Duration::from_secs(2), current_receiver)
+            .await
+            .expect("replacement watcher delivers its lease promptly")
+            .expect("replacement lease is available");
+
+        assert!(stale.lock_revision(7).await.is_none());
+        let current_guard = current
+            .lock_revision(7)
+            .await
+            .expect("current watcher locks its revision");
+        assert!(current_guard.advance(8));
+        assert!(stale.lock_revision(8).await.is_none());
+        assert!(manager.stop_watcher_and_wait_at_revision("source", 8).await);
+        manager.shutdown().await;
+    }
+
+    #[tokio::test]
+    async fn watcher_authorization_failure_updates_health_and_revision_fence() {
+        let directory = tempfile::tempdir().expect("temporary data directory exists");
+        let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+            .await
+            .expect("test app opens");
+        let (source, _) = app
+            .catalog()
+            .create_source_with_catalog_health(
+                CreateSource {
+                    kind: SourceKind::McpHttp,
+                    preferred_slug: "watcher_oauth_health".to_owned(),
+                    display_name: "Watcher OAuth health".to_owned(),
+                    description: None,
+                    configuration: Map::new(),
+                },
+                &CredentialPayload {
+                    schema_version: MCP_CREDENTIAL_SCHEMA_VERSION,
+                    payload: json!({}),
+                },
+                InitialCatalogSnapshot {
+                    artifacts: Vec::new(),
+                    tools: Vec::new(),
+                },
+                Vec::new(),
+                SourceHealth::Unknown,
+                AuditContext::system(Some("watcher-oauth-health-create")),
+            )
+            .await
+            .expect("fixture source is created");
+        let manager = Arc::new(McpConnectionManager::new(StdioTemplateRegistry::default()));
+        let (lease_sender, lease_receiver) = tokio::sync::oneshot::channel();
+        manager
+            .replace_watcher(
+                source.id.clone(),
+                source.revision,
+                move |mut canceled, lease| async move {
+                    lease_sender.send(lease).ok();
+                    let _ = (&mut canceled).await;
+                },
+            )
+            .await
+            .expect("watcher installs");
+        let lease = lease_receiver.await.expect("watcher lease is available");
+        for status in [
+            reqwest::StatusCode::UNAUTHORIZED,
+            reqwest::StatusCode::FORBIDDEN,
+        ] {
+            assert_eq!(
+                http_protocol_error_for_authorization(
+                    StreamableHttpError::HttpStatus(status),
+                    true,
+                )
+                .code,
+                "authorization_required"
+            );
+            assert_eq!(
+                http_protocol_error_for_authorization(
+                    StreamableHttpError::HttpStatus(status),
+                    false,
+                )
+                .code,
+                "mcp_transport_error"
+            );
+        }
+        assert_eq!(
+            discovery_protocol_error(DiscoveryError::Fetch(Box::new(
+                McpPageFetchError::AuthorizationRequired,
+            )))
+            .code,
+            "authorization_required"
+        );
+
+        mark_watcher_authorization_required(app.catalog(), &source.id, &lease).await;
+
+        let current = app
+            .catalog()
+            .source(&source.id)
+            .await
+            .expect("source remains readable");
+        assert_eq!(current.health_status, SourceHealth::Error);
+        assert_eq!(
+            current.health_error_code.as_deref(),
+            Some("authorization_required")
+        );
+        assert_eq!(lease.current_revision(), Some(current.revision));
+        assert!(lease.lock_revision(current.revision).await.is_some());
+        manager.shutdown().await;
+        app.shutdown().await;
+    }
+
+    #[tokio::test]
+    async fn buffered_list_changed_notifications_use_one_refresh_runner() {
+        let (sender, mut receiver) = tokio::sync::broadcast::channel(4);
+        let coalescer = ListChangedCoalescer::default();
+        sender.send(()).expect("notification is buffered");
+        drain_change_signals(&mut receiver, &coalescer);
+        assert!(coalescer.has_pending());
+
+        let started = Arc::new(tokio::sync::Notify::new());
+        let release = Arc::new(tokio::sync::Notify::new());
+        let calls = Arc::new(std::sync::atomic::AtomicUsize::new(0));
+        let in_flight = Arc::new(std::sync::atomic::AtomicUsize::new(0));
+        let maximum_in_flight = Arc::new(std::sync::atomic::AtomicUsize::new(0));
+        let runner = {
+            let coalescer = coalescer.clone();
+            let started = started.clone();
+            let release = release.clone();
+            let calls = calls.clone();
+            let in_flight = in_flight.clone();
+            let maximum_in_flight = maximum_in_flight.clone();
+            tokio::spawn(async move {
+                coalescer
+                    .refresh_pending(|| {
+                        let started = started.clone();
+                        let release = release.clone();
+                        let calls = calls.clone();
+                        let in_flight = in_flight.clone();
+                        let maximum_in_flight = maximum_in_flight.clone();
+                        async move {
+                            let active =
+                                in_flight.fetch_add(1, std::sync::atomic::Ordering::SeqCst) + 1;
+                            maximum_in_flight
+                                .fetch_max(active, std::sync::atomic::Ordering::SeqCst);
+                            let call = calls.fetch_add(1, std::sync::atomic::Ordering::SeqCst) + 1;
+                            if call == 1 {
+                                started.notify_one();
+                                release.notified().await;
+                            }
+                            in_flight.fetch_sub(1, std::sync::atomic::Ordering::SeqCst);
+                            Ok::<(), Infallible>(())
+                        }
+                    })
+                    .await
+            })
+        };
+        tokio::time::timeout(Duration::from_secs(2), started.notified())
+            .await
+            .expect("refresh runner starts promptly");
+        sender.send(()).expect("second notification is buffered");
+        drain_change_signals(&mut receiver, &coalescer);
+        assert_eq!(
+            coalescer
+                .refresh_pending(|| async { Ok::<(), Infallible>(()) })
+                .await
+                .expect("competing runner exits cleanly"),
+            0
+        );
+        release.notify_one();
+
+        assert_eq!(
+            tokio::time::timeout(Duration::from_secs(2), runner)
+                .await
+                .expect("refresh runner completes promptly")
+                .expect("refresh task joins")
+                .expect("refreshes succeed"),
+            2
+        );
+        assert_eq!(calls.load(std::sync::atomic::Ordering::SeqCst), 2);
+        assert_eq!(
+            maximum_in_flight.load(std::sync::atomic::Ordering::SeqCst),
+            1
+        );
+        assert!(!coalescer.has_pending());
+    }
+
+    #[tokio::test]
+    async fn http_listener_disconnect_interrupts_refresh_discovery_and_retry_backoff() {
+        let (_cancel, mut canceled) = tokio::sync::oneshot::channel();
+        let refresh_started = Arc::new(tokio::sync::Notify::new());
+        let mut listener = {
+            let refresh_started = refresh_started.clone();
+            tokio::spawn(async move {
+                refresh_started.notified().await;
+                Err::<(), _>(StreamableHttpError::InvalidResponse)
+            })
+        };
+        let refresh = async {
+            refresh_started.notify_one();
+            std::future::pending::<Result<(), ProtocolError>>().await
+        };
+        tokio::pin!(refresh);
+
+        match tokio::time::timeout(
+            Duration::from_secs(2),
+            wait_for_watcher_refresh(&mut canceled, &mut listener, &mut refresh),
+        )
+        .await
+        .expect("HTTP listener disconnect wins promptly")
+        {
+            WatcherRefreshWait::Disconnected(Ok(Err(StreamableHttpError::InvalidResponse))) => {}
+            _ => panic!("HTTP refresh discovery must yield to listener disconnect"),
+        }
+
+        let mut listener =
+            tokio::spawn(async { Err::<(), _>(StreamableHttpError::InvalidResponse) });
+        match tokio::time::timeout(
+            Duration::from_secs(2),
+            wait_for_watcher_refresh(
+                &mut canceled,
+                &mut listener,
+                tokio::time::sleep(Duration::from_secs(60)),
+            ),
+        )
+        .await
+        .expect("HTTP listener disconnect interrupts backoff promptly")
+        {
+            WatcherRefreshWait::Disconnected(Ok(Err(StreamableHttpError::InvalidResponse))) => {}
+            _ => panic!("HTTP retry backoff must yield to listener disconnect"),
+        }
+    }
+
+    #[tokio::test]
+    async fn stdio_lifecycle_disconnect_interrupts_refresh_discovery_and_retry_backoff() {
+        let (_cancel, mut canceled) = tokio::sync::oneshot::channel();
+        let lifecycle = StdioLifecycleMonitor::initialized_fixture();
+        let client_lock = tokio::sync::Mutex::new(());
+        let client_guard = client_lock.lock().await;
+        let refresh_started = Arc::new(tokio::sync::Notify::new());
+        let disconnect = tokio::spawn({
+            let refresh_started = refresh_started.clone();
+            let lifecycle = lifecycle.clone();
+            async move {
+                refresh_started.notified().await;
+                lifecycle.disconnect_fixture();
+            }
+        });
+        let refresh = async {
+            refresh_started.notify_one();
+            std::future::pending::<Result<(), ProtocolError>>().await
+        };
+
+        match tokio::time::timeout(
+            Duration::from_secs(2),
+            wait_for_watcher_refresh(
+                &mut canceled,
+                wait_for_stdio_disconnect(&lifecycle),
+                refresh,
+            ),
+        )
+        .await
+        .expect("stdio disconnect wins promptly")
+        {
+            WatcherRefreshWait::Disconnected(()) => {}
+            _ => panic!("stdio refresh discovery must yield to lifecycle disconnect"),
+        }
+        disconnect.await.expect("disconnect fixture task joins");
+        assert!(client_lock.try_lock().is_err());
+        drop(client_guard);
+
+        let lifecycle = StdioLifecycleMonitor::initialized_fixture();
+        lifecycle.disconnect_fixture();
+        match tokio::time::timeout(
+            Duration::from_secs(2),
+            wait_for_watcher_refresh(
+                &mut canceled,
+                wait_for_stdio_disconnect(&lifecycle),
+                tokio::time::sleep(Duration::from_secs(60)),
+            ),
+        )
+        .await
+        .expect("stdio disconnect interrupts backoff promptly")
+        {
+            WatcherRefreshWait::Disconnected(()) => {}
+            _ => panic!("stdio retry backoff must yield to lifecycle disconnect"),
+        }
+    }
+
+    #[test]
+    fn every_http_call_transport_failure_is_outcome_unknown() {
+        let error = McpInvocationError::HttpCall(StreamableHttpError::InvalidResponse);
+        assert!(error.outcome_unknown());
+        let setup = McpInvocationError::HttpSetup(StreamableHttpError::InvalidResponse);
+        assert!(!setup.outcome_unknown());
+
+        let stdio_call = McpInvocationError::StdioCall(StdioTransportError::Decode);
+        assert!(stdio_call.outcome_unknown());
+        let stdio_setup = McpInvocationError::StdioSetup(StdioTransportError::Decode);
+        assert!(!stdio_setup.outcome_unknown());
+    }
+}
diff --git a/src/protocols/mod.rs b/src/protocols/mod.rs
new file mode 100644
index 000000000..8928dc666
--- /dev/null
+++ b/src/protocols/mod.rs
@@ -0,0 +1,2264 @@
+pub mod graphql;
+pub mod mcp;
+pub mod openapi;
+
+use std::{
+    collections::{BTreeMap, HashMap, HashSet},
+    fmt,
+    sync::Arc,
+};
+
+use serde::Serialize;
+use serde::de::DeserializeOwned;
+use serde_json::Value;
+
+use crate::{
+    catalog::{
+        AuditContext, BulkToolModeResult, CatalogError, CatalogStore, CatalogSyncResult,
+        InvocationLease, SourceKind, SourceRecord, ToolMode, ToolRecord,
+    },
+    mcp::manager::SourceRevisionLease,
+    oauth::OAuthBinding,
+    outbound::OutboundError,
+};
+
+pub use openapi::{OpenApiPreview, OpenApiSpecInput};
+
+#[derive(Clone, Debug)]
+pub struct ProtocolExecutionResponse {
+    pub ok: bool,
+    pub data: Option<Value>,
+    pub error: Option<ProtocolResponseError>,
+    pub http: Option<ProtocolHttpMetadata>,
+}
+
+#[derive(Clone, Debug)]
+pub struct ProtocolResponseError {
+    pub code: String,
+    pub message: String,
+}
+
+#[derive(Clone, Debug)]
+pub struct ProtocolHttpMetadata {
+    pub status: u16,
+    pub headers: BTreeMap<String, String>,
+    pub truncated: bool,
+}
+
+#[must_use = "a prepared protocol invocation must be executed or explicitly discarded"]
+pub struct PreparedProtocolInvocation {
+    lease: InvocationLease,
+    execution: PreparedProtocolExecution,
+}
+
+enum PreparedProtocolExecution {
+    OpenApi(openapi::PreparedOpenApiInvocation),
+    Graphql(graphql::PreparedGraphqlInvocation),
+    Mcp(mcp::PreparedMcpInvocation),
+}
+
+#[derive(Debug)]
+pub enum ProtocolInvocationError {
+    OpenApi(openapi::OpenApiExecutionError),
+    Graphql(graphql::GraphqlInvocationError),
+    Mcp(mcp::McpInvocationError),
+}
+
+impl fmt::Display for ProtocolInvocationError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::OpenApi(error) => error.fmt(formatter),
+            Self::Graphql(error) => error.fmt(formatter),
+            Self::Mcp(error) => error.fmt(formatter),
+        }
+    }
+}
+
+impl std::error::Error for ProtocolInvocationError {
+    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
+        match self {
+            Self::OpenApi(error) => Some(error),
+            Self::Graphql(error) => Some(error),
+            Self::Mcp(error) => Some(error),
+        }
+    }
+}
+
+#[derive(Clone, Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct CredentialMetadata {
+    pub revision: i64,
+    pub configured_schemes: Vec<ConfiguredCredential>,
+}
+
+#[derive(Clone, Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ConfiguredCredential {
+    pub name: String,
+    pub credential_type: &'static str,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct AvailableOAuthCredential {
+    pub credential_key: String,
+    pub protocol: &'static str,
+    pub requested_scopes: Vec<String>,
+    #[serde(rename = "managedOAuthEligible")]
+    pub managed_oauth_eligible: bool,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum ProtocolErrorCategory {
+    InvalidInput,
+    NotFound,
+    Conflict,
+    CorruptData,
+    Unsupported,
+    Upstream,
+    Internal,
+}
+
+#[derive(Debug)]
+pub struct ProtocolError {
+    pub code: &'static str,
+    pub message: String,
+    pub category: ProtocolErrorCategory,
+}
+
+impl ProtocolError {
+    pub(crate) fn new(
+        category: ProtocolErrorCategory,
+        code: &'static str,
+        message: impl Into<String>,
+    ) -> Self {
+        Self {
+            code,
+            message: message.into(),
+            category,
+        }
+    }
+
+    pub(crate) fn corrupt(code: &'static str, message: &'static str) -> Self {
+        Self::new(ProtocolErrorCategory::CorruptData, code, message)
+    }
+}
+
+impl fmt::Display for ProtocolError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(&self.message)
+    }
+}
+
+impl std::error::Error for ProtocolError {}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum ProtocolRegistration {
+    OpenApi,
+    Graphql,
+    McpHttp,
+    McpStdio,
+}
+
+#[derive(Clone)]
+pub struct ProtocolRegistry {
+    openapi: openapi::OpenApiAdapter,
+    graphql: graphql::GraphqlAdapter,
+    mcp: mcp::McpAdapter,
+}
+
+impl Default for ProtocolRegistry {
+    fn default() -> Self {
+        Self {
+            openapi: openapi::OpenApiAdapter::default(),
+            graphql: graphql::GraphqlAdapter::default(),
+            mcp: mcp::McpAdapter::with_connection_manager(Arc::new(
+                crate::mcp::manager::McpConnectionManager::new(
+                    crate::mcp::upstream::stdio::StdioTemplateRegistry::default(),
+                ),
+            )),
+        }
+    }
+}
+
+impl ProtocolRegistry {
+    pub(crate) fn new(
+        connections: Arc<crate::mcp::manager::McpConnectionManager>,
+        oauth: crate::oauth::OAuthService,
+    ) -> Self {
+        Self {
+            openapi: openapi::OpenApiAdapter::with_oauth(oauth.clone()),
+            graphql: graphql::GraphqlAdapter::with_oauth(oauth.clone()),
+            mcp: mcp::McpAdapter::with_services(connections, oauth),
+        }
+    }
+
+    pub fn registration(&self, kind: SourceKind) -> ProtocolRegistration {
+        match kind {
+            SourceKind::Openapi => ProtocolRegistration::OpenApi,
+            SourceKind::Graphql => ProtocolRegistration::Graphql,
+            SourceKind::McpHttp => ProtocolRegistration::McpHttp,
+            SourceKind::McpStdio => ProtocolRegistration::McpStdio,
+        }
+    }
+
+    fn require_supported(&self, kind: SourceKind) -> Result<(), ProtocolError> {
+        match self.registration(kind) {
+            ProtocolRegistration::OpenApi
+            | ProtocolRegistration::Graphql
+            | ProtocolRegistration::McpHttp
+            | ProtocolRegistration::McpStdio => Ok(()),
+        }
+    }
+
+    pub async fn prepare_invocation(
+        &self,
+        lease: InvocationLease,
+        arguments: &Value,
+        expected_oauth_bindings: Option<&[OAuthBinding]>,
+    ) -> Result<PreparedProtocolInvocation, ProtocolError> {
+        self.require_supported(lease.source_kind())?;
+        let source_id = lease.lookup().source_id.clone();
+        let execution = match lease.source_kind() {
+            SourceKind::Openapi => {
+                let binding = lease.binding().openapi().ok_or_else(|| {
+                    ProtocolError::corrupt(
+                        "source_binding_mismatch",
+                        "The stored tool binding does not match its source protocol.",
+                    )
+                })?;
+                PreparedProtocolExecution::OpenApi(
+                    self.openapi
+                        .prepare_invocation(
+                            &source_id,
+                            binding,
+                            lease.source_configuration(),
+                            lease.credential(),
+                            arguments,
+                            expected_oauth_bindings,
+                        )
+                        .await?,
+                )
+            }
+            SourceKind::McpHttp | SourceKind::McpStdio => {
+                let binding = match (lease.source_kind(), lease.binding()) {
+                    (SourceKind::McpHttp, crate::catalog::ToolBinding::McpHttpV1(binding))
+                    | (SourceKind::McpStdio, crate::catalog::ToolBinding::McpStdioV1(binding)) => {
+                        binding
+                    }
+                    _ => {
+                        return Err(ProtocolError::corrupt(
+                            "source_binding_mismatch",
+                            "The stored tool binding does not match its source protocol.",
+                        ));
+                    }
+                };
+                let oauth_binding = self
+                    .mcp
+                    .oauth_binding_observation(
+                        &source_id,
+                        lease.source_kind(),
+                        lease.credential(),
+                        expected_oauth_bindings,
+                    )
+                    .await?;
+                PreparedProtocolExecution::Mcp(self.mcp.prepare_invocation(
+                    &source_id,
+                    lease.source_kind(),
+                    binding,
+                    lease.source_configuration(),
+                    lease.credential(),
+                    arguments,
+                    oauth_binding,
+                )?)
+            }
+            SourceKind::Graphql => {
+                let binding = lease.binding().graphql().ok_or_else(|| {
+                    ProtocolError::corrupt(
+                        "source_binding_mismatch",
+                        "The stored tool binding does not match its source protocol.",
+                    )
+                })?;
+                let oauth_binding = self
+                    .graphql
+                    .oauth_binding_observation(
+                        &source_id,
+                        lease.credential(),
+                        expected_oauth_bindings,
+                    )
+                    .await?;
+                PreparedProtocolExecution::Graphql(self.graphql.prepare_invocation(
+                    binding,
+                    lease.source_configuration(),
+                    lease.credential(),
+                    arguments,
+                    oauth_binding,
+                )?)
+            }
+        };
+        Ok(PreparedProtocolInvocation { lease, execution })
+    }
+
+    pub async fn execute_invocation(
+        &self,
+        prepared: PreparedProtocolInvocation,
+    ) -> Result<ProtocolExecutionResponse, ProtocolInvocationError> {
+        let PreparedProtocolInvocation { lease, execution } = prepared;
+        let response = match execution {
+            PreparedProtocolExecution::OpenApi(prepared) => self
+                .openapi
+                .execute_invocation(prepared)
+                .await
+                .map_err(ProtocolInvocationError::OpenApi),
+            PreparedProtocolExecution::Graphql(prepared) => self
+                .graphql
+                .execute_invocation(prepared)
+                .await
+                .map_err(ProtocolInvocationError::Graphql),
+            PreparedProtocolExecution::Mcp(prepared) => self
+                .mcp
+                .execute_invocation(prepared)
+                .await
+                .map_err(ProtocolInvocationError::Mcp),
+        };
+        drop(lease);
+        response
+    }
+}
+
+#[derive(Clone)]
+pub struct SourceService {
+    catalog: CatalogStore,
+    registry: ProtocolRegistry,
+    #[cfg(test)]
+    source_creation_finish_pause: Option<Arc<SourceCreationFinishPause>>,
+    #[cfg(test)]
+    source_creation_panic: Option<SourceCreationPanic>,
+    #[cfg(test)]
+    source_delete_failure: Arc<std::sync::atomic::AtomicBool>,
+    #[cfg(test)]
+    source_delete_pause: Option<Arc<SourceDeletePause>>,
+}
+
+#[cfg(test)]
+#[derive(Clone, Copy, Eq, PartialEq)]
+pub(crate) enum SourceCreationPanic {
+    BeforeCreate,
+    AfterCreate,
+}
+
+#[cfg(test)]
+pub(crate) struct SourceCreationFinishPause {
+    armed: std::sync::atomic::AtomicBool,
+    reached: tokio::sync::Notify,
+    release: tokio::sync::Notify,
+}
+
+#[cfg(test)]
+impl Default for SourceCreationFinishPause {
+    fn default() -> Self {
+        Self {
+            armed: std::sync::atomic::AtomicBool::new(true),
+            reached: tokio::sync::Notify::new(),
+            release: tokio::sync::Notify::new(),
+        }
+    }
+}
+
+#[cfg(test)]
+impl SourceCreationFinishPause {
+    pub(crate) async fn reached(&self) {
+        self.reached.notified().await;
+    }
+
+    pub(crate) fn release(&self) {
+        self.release.notify_one();
+    }
+}
+
+#[cfg(test)]
+pub(crate) struct SourceDeletePause {
+    armed: std::sync::atomic::AtomicBool,
+    reached: tokio::sync::Notify,
+    release: tokio::sync::Notify,
+}
+
+#[cfg(test)]
+impl Default for SourceDeletePause {
+    fn default() -> Self {
+        Self {
+            armed: std::sync::atomic::AtomicBool::new(true),
+            reached: tokio::sync::Notify::new(),
+            release: tokio::sync::Notify::new(),
+        }
+    }
+}
+
+#[cfg(test)]
+impl SourceDeletePause {
+    pub(crate) async fn reached(&self) {
+        self.reached.notified().await;
+    }
+
+    pub(crate) fn release(&self) {
+        self.release.notify_one();
+    }
+}
+
+impl SourceService {
+    pub(crate) fn new(
+        catalog: CatalogStore,
+        connections: Arc<crate::mcp::manager::McpConnectionManager>,
+        oauth: crate::oauth::OAuthService,
+    ) -> Self {
+        Self {
+            catalog,
+            registry: ProtocolRegistry::new(connections, oauth),
+            #[cfg(test)]
+            source_creation_finish_pause: None,
+            #[cfg(test)]
+            source_creation_panic: None,
+            #[cfg(test)]
+            source_delete_failure: Arc::new(std::sync::atomic::AtomicBool::new(false)),
+            #[cfg(test)]
+            source_delete_pause: None,
+        }
+    }
+
+    #[cfg(test)]
+    pub(crate) fn pause_source_creation_finish(&mut self) -> Arc<SourceCreationFinishPause> {
+        let pause = Arc::new(SourceCreationFinishPause::default());
+        self.source_creation_finish_pause = Some(pause.clone());
+        pause
+    }
+
+    #[cfg(test)]
+    pub(crate) fn panic_source_creation_at(&mut self, stage: SourceCreationPanic) {
+        self.source_creation_panic = Some(stage);
+    }
+
+    #[cfg(test)]
+    pub(crate) fn fail_next_source_delete(&self) {
+        self.source_delete_failure
+            .store(true, std::sync::atomic::Ordering::SeqCst);
+    }
+
+    #[cfg(test)]
+    pub(crate) fn pause_source_delete_after_retire(&mut self) -> Arc<SourceDeletePause> {
+        let pause = Arc::new(SourceDeletePause::default());
+        self.source_delete_pause = Some(pause.clone());
+        pause
+    }
+
+    #[cfg(test)]
+    pub(crate) fn fail_mcp_watcher_capability_loads(
+        &mut self,
+        failures: Arc<std::sync::atomic::AtomicUsize>,
+    ) {
+        self.registry.mcp.fail_watcher_capability_loads(failures);
+    }
+
+    #[cfg(test)]
+    fn pause_mcp_watcher_unavailable_persistence(&mut self) -> Arc<mcp::WatcherUnavailablePause> {
+        self.registry.mcp.pause_watcher_unavailable_persistence()
+    }
+
+    #[cfg(test)]
+    pub(crate) fn source_creation_panics_at(&self, stage: SourceCreationPanic) -> bool {
+        self.source_creation_panic == Some(stage)
+    }
+
+    pub fn registry(&self) -> &ProtocolRegistry {
+        &self.registry
+    }
+
+    pub fn stdio_template_descriptors(
+        &self,
+    ) -> Vec<crate::mcp::upstream::stdio::StdioTemplateDescriptor> {
+        self.registry.mcp.stdio_templates().descriptors()
+    }
+
+    pub(crate) fn source_creation_idempotency(
+        &self,
+    ) -> crate::catalog::source_idempotency::SourceCreationIdempotencyStore {
+        self.catalog.source_creation_idempotency()
+    }
+
+    pub(crate) async fn finish_source_creation(&self, kind: SourceKind, source_id: &str) {
+        if matches!(kind, SourceKind::McpHttp | SourceKind::McpStdio) {
+            #[cfg(test)]
+            if let Some(pause) = &self.source_creation_finish_pause
+                && pause.armed.swap(false, std::sync::atomic::Ordering::SeqCst)
+            {
+                pause.reached.notify_one();
+                pause.release.notified().await;
+            }
+            self.registry
+                .mcp
+                .ensure_source_creation_watcher(&self.catalog, source_id)
+                .await;
+        }
+    }
+
+    pub async fn restore_mcp_watchers(&self) -> Result<(), ProtocolError> {
+        self.registry.mcp.restore_watchers(&self.catalog).await
+    }
+
+    pub async fn delete(
+        &self,
+        source_id: &str,
+        audit: AuditContext<'_>,
+    ) -> Result<(), ProtocolError> {
+        let _source_deletion = self.registry.mcp.lock_source_deletion(source_id).await;
+        let source = self.source(source_id).await?;
+        let is_mcp = matches!(source.kind, SourceKind::McpHttp | SourceKind::McpStdio);
+        if is_mcp {
+            self.registry.mcp.retire_source_watcher(source_id).await;
+        }
+        #[cfg(test)]
+        if let Some(pause) = &self.source_delete_pause
+            && pause.armed.swap(false, std::sync::atomic::Ordering::SeqCst)
+        {
+            pause.reached.notify_one();
+            pause.release.notified().await;
+        }
+        #[cfg(test)]
+        let deleted = if self
+            .source_delete_failure
+            .swap(false, std::sync::atomic::Ordering::SeqCst)
+        {
+            Err(ProtocolError::new(
+                ProtocolErrorCategory::Internal,
+                "internal_error",
+                "The source could not be deleted.",
+            ))
+        } else {
+            self.catalog
+                .delete_source(source_id, audit)
+                .await
+                .map_err(protocol_catalog_error)
+        };
+        #[cfg(not(test))]
+        let deleted = self
+            .catalog
+            .delete_source(source_id, audit)
+            .await
+            .map_err(protocol_catalog_error);
+        if deleted.is_err() && is_mcp {
+            self.registry.mcp.unretire_source_watcher(source_id).await;
+            if let Err(error) = self
+                .registry
+                .mcp
+                .recover_source_watcher_after_failed_delete(
+                    &self.catalog,
+                    source_id,
+                    source.revision,
+                    audit,
+                )
+                .await
+            {
+                tracing::warn!(
+                    source_id,
+                    code = error.code,
+                    "MCP watcher recovery after failed source delete failed"
+                );
+            }
+        }
+        deleted
+    }
+
+    pub async fn set_source_mode(
+        &self,
+        source_id: &str,
+        mode: Option<ToolMode>,
+        expected_revision: i64,
+        audit: AuditContext<'_>,
+    ) -> Result<SourceRecord, ProtocolError> {
+        let revisions = self
+            .lock_mcp_source_revisions([source_id.to_owned()])
+            .await?;
+        let source = self
+            .catalog
+            .set_source_mode(source_id, mode, expected_revision, audit)
+            .await
+            .map_err(protocol_catalog_error)?;
+        self.advance_mcp_source_revisions(
+            revisions,
+            &[(source.id.clone(), source.revision)].into_iter().collect(),
+        );
+        Ok(source)
+    }
+
+    pub async fn set_tool_mode(
+        &self,
+        tool_id: &str,
+        mode: Option<ToolMode>,
+        expected_revision: i64,
+        audit: AuditContext<'_>,
+    ) -> Result<ToolRecord, ProtocolError> {
+        let tool = self
+            .catalog
+            .tool(tool_id)
+            .await
+            .map_err(protocol_catalog_error)?;
+        let revisions = self
+            .lock_mcp_source_revisions([tool.source_id.clone()])
+            .await?;
+        let (tool, source_id, source_revision) = self
+            .catalog
+            .set_tool_mode_with_source_revision(tool_id, mode, expected_revision, audit)
+            .await
+            .map_err(protocol_catalog_error)?;
+        self.advance_mcp_source_revisions(
+            revisions,
+            &[(source_id, source_revision)].into_iter().collect(),
+        );
+        Ok(tool)
+    }
+
+    pub async fn bulk_set_source_tool_modes(
+        &self,
+        source_id: &str,
+        mode: Option<ToolMode>,
+        expected_source_revision: i64,
+        audit: AuditContext<'_>,
+    ) -> Result<BulkToolModeResult, ProtocolError> {
+        let revisions = self
+            .lock_mcp_source_revisions([source_id.to_owned()])
+            .await?;
+        let result = self
+            .catalog
+            .bulk_set_source_tool_modes(source_id, mode, expected_source_revision, audit)
+            .await
+            .map_err(protocol_catalog_error)?;
+        self.advance_mcp_source_revisions(revisions, &result.source_revisions);
+        Ok(result)
+    }
+
+    pub async fn bulk_set_tool_modes(
+        &self,
+        tool_ids: &[String],
+        mode: Option<ToolMode>,
+        expected_catalog_revision: i64,
+        audit: AuditContext<'_>,
+    ) -> Result<BulkToolModeResult, ProtocolError> {
+        let mut source_ids = HashSet::new();
+        for tool_id in tool_ids {
+            source_ids.insert(
+                self.catalog
+                    .tool(tool_id)
+                    .await
+                    .map_err(protocol_catalog_error)?
+                    .source_id,
+            );
+        }
+        let revisions = self.lock_mcp_source_revisions(source_ids).await?;
+        let result = self
+            .catalog
+            .bulk_set_tool_modes(tool_ids, mode, expected_catalog_revision, audit)
+            .await
+            .map_err(protocol_catalog_error)?;
+        self.advance_mcp_source_revisions(revisions, &result.source_revisions);
+        Ok(result)
+    }
+
+    pub async fn preview_openapi(
+        &self,
+        spec: &OpenApiSpecInput,
+        allow_private_network: bool,
+    ) -> Result<OpenApiPreview, ProtocolError> {
+        self.registry
+            .openapi
+            .preview(spec, allow_private_network)
+            .await
+    }
+
+    pub async fn create(
+        &self,
+        kind: SourceKind,
+        protocol: Value,
+        audit: AuditContext<'_>,
+    ) -> Result<SourceRecord, ProtocolError> {
+        self.registry.require_supported(kind)?;
+        match kind {
+            SourceKind::Openapi => {
+                let input = decode_protocol_input(protocol)?;
+                self.registry
+                    .openapi
+                    .create_source(&self.catalog, input, audit)
+                    .await
+            }
+            SourceKind::McpHttp => {
+                let input = decode_protocol_input(protocol)?;
+                self.registry
+                    .mcp
+                    .create_http_source(&self.catalog, input, audit)
+                    .await
+            }
+            SourceKind::McpStdio => {
+                let input = decode_protocol_input(protocol)?;
+                self.registry
+                    .mcp
+                    .create_stdio_source(&self.catalog, input, audit)
+                    .await
+            }
+            SourceKind::Graphql => {
+                let input = decode_protocol_input(protocol)?;
+                self.registry
+                    .graphql
+                    .create_source(&self.catalog, input, audit)
+                    .await
+            }
+        }
+    }
+
+    pub async fn refresh(
+        &self,
+        source_id: &str,
+        audit: AuditContext<'_>,
+    ) -> Result<CatalogSyncResult, ProtocolError> {
+        let source = self.source(source_id).await?;
+        self.registry.require_supported(source.kind)?;
+        let refreshed = match source.kind {
+            SourceKind::Openapi => {
+                self.registry
+                    .openapi
+                    .refresh_source(&self.catalog, source.clone(), audit)
+                    .await
+            }
+            SourceKind::McpHttp | SourceKind::McpStdio => {
+                self.registry
+                    .mcp
+                    .refresh_source(&self.catalog, source.clone(), audit)
+                    .await
+            }
+            SourceKind::Graphql => {
+                self.registry
+                    .graphql
+                    .refresh_source(&self.catalog, source.clone(), audit)
+                    .await
+            }
+        };
+        if let Err(error) = &refreshed {
+            self.persist_refresh_failure(&source, error, audit).await;
+        }
+        refreshed
+    }
+
+    pub async fn credential_metadata(
+        &self,
+        source_id: &str,
+    ) -> Result<CredentialMetadata, ProtocolError> {
+        let source = self.source(source_id).await?;
+        self.registry.require_supported(source.kind)?;
+        match source.kind {
+            SourceKind::Openapi => {
+                self.registry
+                    .openapi
+                    .credential_metadata(&self.catalog, &source.id)
+                    .await
+            }
+            SourceKind::McpHttp | SourceKind::McpStdio => {
+                self.registry
+                    .mcp
+                    .credential_metadata(&self.catalog, &source)
+                    .await
+            }
+            SourceKind::Graphql => {
+                self.registry
+                    .graphql
+                    .credential_metadata(&self.catalog, &source.id)
+                    .await
+            }
+        }
+    }
+
+    pub async fn available_oauth_credentials(
+        &self,
+        source_id: &str,
+    ) -> Result<Vec<AvailableOAuthCredential>, ProtocolError> {
+        let source = self.source(source_id).await?;
+        self.registry.require_supported(source.kind)?;
+        let credentials = match source.kind {
+            SourceKind::Openapi => self
+                .registry
+                .openapi
+                .managed_oauth_options(&self.catalog, &source.id)
+                .await?
+                .into_iter()
+                .map(|option| AvailableOAuthCredential {
+                    credential_key: option.credential_key,
+                    protocol: "openapi",
+                    requested_scopes: option.scopes,
+                    managed_oauth_eligible: true,
+                })
+                .collect(),
+            SourceKind::Graphql => vec![AvailableOAuthCredential {
+                credential_key: "default".to_owned(),
+                protocol: "graphql",
+                requested_scopes: Vec::new(),
+                managed_oauth_eligible: true,
+            }],
+            SourceKind::McpHttp => vec![AvailableOAuthCredential {
+                credential_key: "default".to_owned(),
+                protocol: "mcp_http",
+                requested_scopes: Vec::new(),
+                managed_oauth_eligible: true,
+            }],
+            SourceKind::McpStdio => Vec::new(),
+        };
+        Ok(credentials)
+    }
+
+    pub async fn ensure_managed_oauth_origin_bound(
+        &self,
+        source_id: &str,
+        credential_key: &str,
+        audit: AuditContext<'_>,
+    ) -> Result<(), ProtocolError> {
+        let source = self.source(source_id).await?;
+        if source.kind != SourceKind::Openapi {
+            return Ok(());
+        }
+        self.registry
+            .openapi
+            .ensure_managed_oauth_origin_bound(&self.catalog, source_id, credential_key, audit)
+            .await
+    }
+
+    pub async fn retire_managed_oauth_origin(
+        &self,
+        source_id: &str,
+        credential_key: &str,
+        audit: AuditContext<'_>,
+    ) -> Result<(), ProtocolError> {
+        let source = self.source(source_id).await?;
+        if source.kind != SourceKind::Openapi {
+            return Ok(());
+        }
+        self.registry
+            .openapi
+            .retire_managed_oauth_origin(&self.catalog, source_id, credential_key, audit)
+            .await
+    }
+
+    pub async fn replace_credentials(
+        &self,
+        source_id: &str,
+        expected_revision: i64,
+        credential: Value,
+        audit: AuditContext<'_>,
+    ) -> Result<CredentialMetadata, ProtocolError> {
+        let source = self.source(source_id).await?;
+        self.registry.require_supported(source.kind)?;
+        match source.kind {
+            SourceKind::Openapi => {
+                let credential = decode_protocol_input(credential)?;
+                self.registry
+                    .openapi
+                    .replace_credentials(
+                        &self.catalog,
+                        &source.id,
+                        expected_revision,
+                        credential,
+                        audit,
+                    )
+                    .await
+            }
+            SourceKind::McpHttp => {
+                let credential = decode_protocol_input(credential)?;
+                self.registry
+                    .mcp
+                    .replace_http_credentials(
+                        &self.catalog,
+                        &source.id,
+                        expected_revision,
+                        credential,
+                        audit,
+                    )
+                    .await
+            }
+            SourceKind::McpStdio => {
+                let credential = decode_protocol_input(credential)?;
+                self.registry
+                    .mcp
+                    .replace_stdio_credentials(
+                        &self.catalog,
+                        &source.id,
+                        expected_revision,
+                        credential,
+                        audit,
+                    )
+                    .await
+            }
+            SourceKind::Graphql => {
+                let credential = decode_protocol_input(credential)?;
+                self.registry
+                    .graphql
+                    .replace_credentials(
+                        &self.catalog,
+                        &source.id,
+                        expected_revision,
+                        credential,
+                        audit,
+                    )
+                    .await
+            }
+        }
+    }
+
+    pub async fn clear_credentials(
+        &self,
+        source_id: &str,
+        expected_revision: i64,
+        audit: AuditContext<'_>,
+    ) -> Result<CredentialMetadata, ProtocolError> {
+        let source = self.source(source_id).await?;
+        self.registry.require_supported(source.kind)?;
+        match source.kind {
+            SourceKind::Openapi => {
+                self.registry
+                    .openapi
+                    .clear_credentials(&self.catalog, &source.id, expected_revision, audit)
+                    .await
+            }
+            SourceKind::McpHttp | SourceKind::McpStdio => {
+                self.registry
+                    .mcp
+                    .clear_credentials(&self.catalog, &source, expected_revision, audit)
+                    .await
+            }
+            SourceKind::Graphql => {
+                self.registry
+                    .graphql
+                    .clear_credentials(&self.catalog, &source.id, expected_revision, audit)
+                    .await
+            }
+        }
+    }
+
+    async fn source(&self, source_id: &str) -> Result<SourceRecord, ProtocolError> {
+        self.catalog
+            .source(source_id)
+            .await
+            .map_err(protocol_catalog_error)
+    }
+
+    async fn lock_mcp_source_revisions(
+        &self,
+        source_ids: impl IntoIterator<Item = String>,
+    ) -> Result<Option<SourceRevisionLease>, ProtocolError> {
+        let source_ids = source_ids.into_iter().collect::<HashSet<_>>();
+        loop {
+            let mut observed = Vec::new();
+            for source_id in &source_ids {
+                let source = self.source(source_id).await?;
+                if matches!(source.kind, SourceKind::McpHttp | SourceKind::McpStdio) {
+                    observed.push((source.id, source.revision));
+                }
+            }
+            if observed.is_empty() {
+                return Ok(None);
+            }
+            if let Some(revisions) = self.registry.mcp.lock_source_revisions(observed).await {
+                return Ok(Some(revisions));
+            }
+            tokio::task::yield_now().await;
+        }
+    }
+
+    fn advance_mcp_source_revisions(
+        &self,
+        revisions: Option<SourceRevisionLease>,
+        committed: &BTreeMap<String, i64>,
+    ) {
+        let Some(revisions) = revisions else {
+            return;
+        };
+        let committed = revisions
+            .source_ids()
+            .filter_map(|source_id| {
+                committed
+                    .get(source_id)
+                    .map(|revision| (source_id.to_owned(), *revision))
+            })
+            .collect::<HashMap<_, _>>();
+        if !revisions.advance(&committed) {
+            tracing::error!("MCP watcher revisions did not match a committed catalog mutation");
+        }
+    }
+
+    async fn persist_refresh_failure(
+        &self,
+        source: &SourceRecord,
+        error: &ProtocolError,
+        audit: AuditContext<'_>,
+    ) {
+        if matches!(
+            error.code,
+            "revision_conflict"
+                | "oauth_binding_changed"
+                | "mcp_shutting_down"
+                | "openapi_credential_origin_changed"
+                | "openapi_credential_origin_unbound"
+                | "insecure_openapi_transport"
+        ) {
+            return;
+        }
+        let health_code = if error.code == "authorization_required" {
+            "authorization_required"
+        } else {
+            match source.kind {
+                SourceKind::Openapi => "openapi_refresh_failed",
+                SourceKind::Graphql => "graphql_refresh_failed",
+                SourceKind::McpHttp | SourceKind::McpStdio => "mcp_refresh_failed",
+            }
+        };
+        let revisions = if matches!(source.kind, SourceKind::McpHttp | SourceKind::McpStdio) {
+            let Some(revisions) = self
+                .registry
+                .mcp
+                .lock_source_revisions([(source.id.clone(), source.revision)])
+                .await
+            else {
+                return;
+            };
+            Some(revisions)
+        } else {
+            None
+        };
+        match self
+            .catalog
+            .mark_source_error(&source.id, health_code, source.revision, audit)
+            .await
+        {
+            Ok(updated) => self.advance_mcp_source_revisions(
+                revisions,
+                &[(updated.id, updated.revision)].into_iter().collect(),
+            ),
+            Err(CatalogError::RevisionConflict { .. } | CatalogError::NotFound { .. }) => {}
+            Err(persistence_error) => {
+                tracing::warn!(
+                    source_id = source.id,
+                    error = %persistence_error,
+                    "source refresh failure health could not be persisted"
+                );
+            }
+        }
+    }
+}
+
+fn decode_protocol_input<T: DeserializeOwned>(value: Value) -> Result<T, ProtocolError> {
+    serde_json::from_value(value).map_err(|_| {
+        ProtocolError::new(
+            ProtocolErrorCategory::InvalidInput,
+            "invalid_json",
+            "The request body must be valid JSON with the expected fields.",
+        )
+    })
+}
+
+pub(crate) fn protocol_catalog_error(error: CatalogError) -> ProtocolError {
+    match error {
+        CatalogError::Validation {
+            code: "oauth_binding_changed",
+            message,
+        } => ProtocolError::new(
+            ProtocolErrorCategory::Conflict,
+            "oauth_binding_changed",
+            message,
+        ),
+        CatalogError::Validation { code, message } => {
+            ProtocolError::new(ProtocolErrorCategory::InvalidInput, code, message)
+        }
+        CatalogError::NotFound { entity: "source" } => ProtocolError::new(
+            ProtocolErrorCategory::NotFound,
+            "source_not_found",
+            "The requested source does not exist.",
+        ),
+        CatalogError::NotFound { .. } | CatalogError::ToolNotFound { .. } => ProtocolError::new(
+            ProtocolErrorCategory::NotFound,
+            "tool_not_found",
+            "The requested tool does not exist.",
+        ),
+        CatalogError::ToolDisabled { .. } => ProtocolError::new(
+            ProtocolErrorCategory::Conflict,
+            "tool_disabled",
+            "The requested tool is disabled.",
+        ),
+        CatalogError::RevisionConflict { .. } => ProtocolError::new(
+            ProtocolErrorCategory::Conflict,
+            "revision_conflict",
+            "The source changed. Refresh and retry the update.",
+        ),
+        CatalogError::CorruptData(_) => ProtocolError::corrupt(
+            "corrupt_protocol_data",
+            "The stored protocol data is invalid.",
+        ),
+        CatalogError::Database(_) | CatalogError::Crypto(_) | CatalogError::Json(_) => {
+            ProtocolError::new(
+                ProtocolErrorCategory::Internal,
+                "internal_error",
+                "The protocol operation could not be completed.",
+            )
+        }
+    }
+}
+
+pub(crate) fn protocol_outbound_error(error: OutboundError) -> ProtocolError {
+    let category = match error {
+        OutboundError::InsecureTransport => ProtocolErrorCategory::InvalidInput,
+        OutboundError::Connection
+        | OutboundError::DnsResolution
+        | OutboundError::Request
+        | OutboundError::Timeout
+        | OutboundError::UpstreamStatus { .. } => ProtocolErrorCategory::Upstream,
+        _ => ProtocolErrorCategory::InvalidInput,
+    };
+    ProtocolError::new(
+        category,
+        error.code(),
+        "The upstream request could not be completed safely.",
+    )
+}
+
+#[cfg(test)]
+mod tests {
+    use std::{sync::Arc, time::Duration};
+
+    use serde_json::{Map, json};
+    use sqlx::{SqlitePool, sqlite::SqlitePoolOptions};
+    use tokio::{
+        io::{AsyncReadExt, AsyncWriteExt},
+        net::TcpListener,
+        sync::RwLock,
+        time::timeout,
+    };
+
+    use super::{
+        ProtocolError, ProtocolErrorCategory, ProtocolRegistration, ProtocolRegistry,
+        SourceService, decode_protocol_input, protocol_catalog_error, protocol_outbound_error,
+    };
+    use crate::catalog::{
+        AuditContext, CatalogError, CatalogSnapshot, CredentialPayload, InitialCatalogSnapshot,
+        InvocationLease, InvocationLookup, InvocationRevisionToken, ListToolsFilter,
+        McpToolBindingV1, ModeProvenance, SourceHealth, SourceKind, StagedArtifact, StagedTool,
+        StagedToolBinding, StoredCredential, ToolBinding, ToolMode,
+    };
+    use crate::crypto::Keyring;
+    use crate::graphql::{GraphqlBindingV1, GraphqlOperation};
+    use crate::mcp::{
+        manager::{McpConnectionManager, WatcherRevisionLease},
+        upstream::stdio::StdioTemplateRegistry,
+    };
+    use crate::oauth::OAuthService;
+    use crate::openapi::{OpenApiBinding, OpenApiCredentialSet, OpenApiSecurityAlternative};
+    use crate::outbound::{OutboundError, OutboundPolicy};
+    use crate::protocols::openapi::CreateOpenApiSource;
+
+    #[test]
+    fn insecure_outbound_transport_is_sanitized_invalid_input() {
+        let error = protocol_outbound_error(OutboundError::InsecureTransport);
+        assert_eq!(error.category, ProtocolErrorCategory::InvalidInput);
+        assert_eq!(error.code, "insecure_outbound_transport");
+        assert_eq!(
+            error.message,
+            "The upstream request could not be completed safely."
+        );
+    }
+
+    async fn source_service_fixture() -> (
+        SourceService,
+        crate::catalog::CatalogStore,
+        Arc<McpConnectionManager>,
+        SqlitePool,
+    ) {
+        let pool = SqlitePoolOptions::new()
+            .max_connections(1)
+            .connect("sqlite::memory:")
+            .await
+            .expect("test database opens");
+        sqlx::migrate!("./migrations")
+            .run(&pool)
+            .await
+            .expect("migrations apply");
+        let keyring = Keyring::from_master_key([91; 32]).expect("test keyring derives");
+        let catalog = crate::catalog::CatalogStore::new(pool.clone(), keyring.clone());
+        let templates =
+            StdioTemplateRegistry::new(vec![crate::mcp::upstream::stdio::StdioTemplate {
+                name: "delete-fixture".to_owned(),
+                executable: std::path::PathBuf::from("/bin/sh"),
+                cwd: None,
+                arguments: vec!["-c".to_owned(), "exit 1".to_owned()],
+                environment: Default::default(),
+                secret_environment: vec!["API_TOKEN".to_owned()],
+            }])
+            .expect("test stdio template validates");
+        let connections = Arc::new(McpConnectionManager::new(templates));
+        let oauth = OAuthService::new(
+            pool.clone(),
+            keyring,
+            "http://127.0.0.1:4788".to_owned(),
+            OutboundPolicy::default(),
+        );
+        let sources = SourceService::new(catalog.clone(), connections.clone(), oauth);
+        (sources, catalog, connections, pool)
+    }
+
+    fn staged_tool(stable_key: &str, preferred_name: &str) -> StagedTool {
+        StagedTool {
+            stable_key: stable_key.to_owned(),
+            preferred_name: preferred_name.to_owned(),
+            display_name: preferred_name.to_owned(),
+            description: None,
+            input_schema: json!({ "type": "object" }),
+            output_schema: None,
+            input_typescript: None,
+            output_typescript: None,
+            typescript_definitions: Default::default(),
+            intrinsic_mode: ToolMode::Enabled,
+        }
+    }
+
+    fn openapi_binding(path: &str) -> ToolBinding {
+        ToolBinding::OpenapiV1(OpenApiBinding {
+            version: 1,
+            method: "GET".to_owned(),
+            path_template: path.to_owned(),
+            server_url: "https://api.example.test".to_owned(),
+            parameters: Vec::new(),
+            request_body: None,
+            security: Vec::new(),
+        })
+    }
+
+    fn protocol_fixture(kind: SourceKind) -> (String, ToolBinding, CredentialPayload) {
+        match kind {
+            SourceKind::Openapi => (
+                "fixture".to_owned(),
+                openapi_binding("/fixture"),
+                CredentialPayload {
+                    schema_version: 1,
+                    payload: json!({
+                        "locator": { "type": "inline" },
+                        "credentials": { "schemes": {} }
+                    }),
+                },
+            ),
+            SourceKind::Graphql => {
+                let mut binding = GraphqlBindingV1 {
+                    version: 1,
+                    operation: GraphqlOperation::Query,
+                    field_name: "fixture".to_owned(),
+                    operation_name: "ExecutorFixture".to_owned(),
+                    variables: Vec::new(),
+                    selection: Vec::new(),
+                    document: String::new(),
+                };
+                binding.document = binding
+                    .canonical_document()
+                    .expect("fixture binding is canonical");
+                let stable_key = binding.stable_key().expect("fixture has a stable key");
+                (
+                    stable_key,
+                    ToolBinding::GraphqlV1(binding),
+                    CredentialPayload {
+                        schema_version: 1,
+                        payload: json!({
+                            "endpoint": "https://graphql.example.test/query",
+                            "credential": null
+                        }),
+                    },
+                )
+            }
+            SourceKind::McpHttp => (
+                "fixture".to_owned(),
+                ToolBinding::McpHttpV1(McpToolBindingV1 {
+                    version: 1,
+                    tool_name: "fixture".to_owned(),
+                }),
+                CredentialPayload {
+                    schema_version: 1,
+                    payload: json!({
+                        "endpoint": "https://mcp.example.test/rpc",
+                        "credential": null
+                    }),
+                },
+            ),
+            SourceKind::McpStdio => unreachable!("lifecycle fixtures use MCP HTTP"),
+        }
+    }
+
+    async fn create_invalid_refresh_fixture(
+        catalog: &crate::catalog::CatalogStore,
+        kind: SourceKind,
+        slug: &str,
+    ) -> (crate::catalog::SourceRecord, crate::catalog::ToolRecord) {
+        let (stable_key, binding, credential) = protocol_fixture(kind);
+        let (source, _) = catalog
+            .create_source_with_catalog(
+                crate::catalog::CreateSource {
+                    kind,
+                    preferred_slug: slug.to_owned(),
+                    display_name: slug.to_owned(),
+                    description: None,
+                    configuration: Map::new(),
+                },
+                &credential,
+                InitialCatalogSnapshot {
+                    artifacts: vec![StagedArtifact {
+                        kind: crate::catalog::ArtifactKind::Metadata,
+                        stable_key: "last-good".to_owned(),
+                        content: json!({ "lastGood": true }),
+                    }],
+                    tools: vec![staged_tool(&stable_key, "fixture")],
+                },
+                vec![StagedToolBinding {
+                    stable_key,
+                    binding,
+                }],
+                AuditContext::system(Some("invalid-refresh-fixture")),
+            )
+            .await
+            .expect("fixture source is created");
+        let tool_id = catalog
+            .list_tools(ListToolsFilter {
+                source_id: Some(source.id.clone()),
+                include_tombstoned: true,
+                limit: 10,
+                ..ListToolsFilter::default()
+            })
+            .await
+            .expect("fixture tools list")
+            .items[0]
+            .id
+            .clone();
+        let tool = catalog.tool(&tool_id).await.expect("fixture tool reads");
+        (source, tool)
+    }
+
+    async fn create_mcp_watcher_fixture(
+        catalog: &crate::catalog::CatalogStore,
+        slug: &str,
+        kind: SourceKind,
+    ) -> crate::catalog::SourceRecord {
+        let (configuration, credential, binding) = match kind {
+            SourceKind::McpHttp => (
+                json!({
+                    "endpoint": "http://127.0.0.1:1/mcp",
+                    "allowPrivateNetwork": true,
+                    "negotiatedProtocolVersion": crate::mcp::upstream::http::DEFAULT_PROTOCOL_VERSION,
+                }),
+                json!({
+                    "endpoint": "http://127.0.0.1:1/mcp",
+                    "credential": {
+                        "type": "bearer",
+                        "token": "delete-rollback-secret"
+                    }
+                }),
+                ToolBinding::McpHttpV1(McpToolBindingV1 {
+                    version: 1,
+                    tool_name: "fixture".to_owned(),
+                }),
+            ),
+            SourceKind::McpStdio => (
+                json!({
+                    "templateName": "delete-fixture",
+                    "negotiatedProtocolVersion": crate::mcp::upstream::stdio::DEFAULT_PROTOCOL_VERSION,
+                }),
+                json!({
+                    "templateName": "delete-fixture",
+                    "secretValues": {
+                        "API_TOKEN": "delete-rollback-secret"
+                    }
+                }),
+                ToolBinding::McpStdioV1(McpToolBindingV1 {
+                    version: 1,
+                    tool_name: "fixture".to_owned(),
+                }),
+            ),
+            SourceKind::Openapi | SourceKind::Graphql => {
+                unreachable!("MCP watcher fixtures require MCP source kinds")
+            }
+        };
+        catalog
+            .create_source_with_catalog(
+                crate::catalog::CreateSource {
+                    kind,
+                    preferred_slug: slug.to_owned(),
+                    display_name: slug.to_owned(),
+                    description: None,
+                    configuration: configuration
+                        .as_object()
+                        .expect("MCP configuration is an object")
+                        .clone(),
+                },
+                &CredentialPayload {
+                    schema_version: 1,
+                    payload: credential,
+                },
+                InitialCatalogSnapshot {
+                    artifacts: vec![StagedArtifact {
+                        kind: crate::catalog::ArtifactKind::McpCapabilities,
+                        stable_key: "mcp-server".to_owned(),
+                        content: json!({
+                            "protocolVersion": crate::mcp::upstream::http::DEFAULT_PROTOCOL_VERSION,
+                            "serverInfo": { "name": "fixture", "version": "1" },
+                            "instructions": null,
+                            "capabilities": { "tools": { "listChanged": true } },
+                            "toolsListChanged": true
+                        }),
+                    }],
+                    tools: vec![staged_tool("fixture", "fixture")],
+                },
+                vec![StagedToolBinding {
+                    stable_key: "fixture".to_owned(),
+                    binding,
+                }],
+                AuditContext::system(Some("mcp-watcher-fixture")),
+            )
+            .await
+            .expect("MCP watcher fixture creates")
+            .0
+    }
+
+    async fn install_test_watcher(
+        manager: &McpConnectionManager,
+        source_id: &str,
+        source_revision: i64,
+    ) -> WatcherRevisionLease {
+        let (lease_sender, lease_receiver) = tokio::sync::oneshot::channel();
+        assert!(
+            manager
+                .replace_watcher(
+                    source_id.to_owned(),
+                    source_revision,
+                    move |mut canceled, lease| async move {
+                        lease_sender.send(lease).ok();
+                        let _ = (&mut canceled).await;
+                    },
+                )
+                .await
+                .expect("test watcher installs")
+        );
+        lease_receiver.await.expect("test watcher exposes lease")
+    }
+
+    struct BlockingWatcherSentinel {
+        canceled: tokio::sync::Notify,
+        release: tokio::sync::Notify,
+        in_use: std::sync::atomic::AtomicBool,
+    }
+
+    async fn install_blocking_test_watcher(
+        manager: &McpConnectionManager,
+        source_id: &str,
+        source_revision: i64,
+    ) -> (WatcherRevisionLease, Arc<BlockingWatcherSentinel>) {
+        let sentinel = Arc::new(BlockingWatcherSentinel {
+            canceled: tokio::sync::Notify::new(),
+            release: tokio::sync::Notify::new(),
+            in_use: std::sync::atomic::AtomicBool::new(false),
+        });
+        let (lease_sender, lease_receiver) = tokio::sync::oneshot::channel();
+        assert!(
+            manager
+                .replace_watcher(source_id.to_owned(), source_revision, {
+                    let sentinel = sentinel.clone();
+                    move |mut canceled, lease| async move {
+                        sentinel
+                            .in_use
+                            .store(true, std::sync::atomic::Ordering::SeqCst);
+                        lease_sender.send(lease).ok();
+                        let _ = (&mut canceled).await;
+                        sentinel.canceled.notify_one();
+                        sentinel.release.notified().await;
+                        sentinel
+                            .in_use
+                            .store(false, std::sync::atomic::Ordering::SeqCst);
+                    }
+                })
+                .await
+                .expect("blocking test watcher installs")
+        );
+        (
+            lease_receiver
+                .await
+                .expect("blocking test watcher exposes lease"),
+            sentinel,
+        )
+    }
+
+    async fn commit_mcp_http_credential_replacement(
+        catalog: &crate::catalog::CatalogStore,
+        source: &crate::catalog::SourceRecord,
+    ) -> crate::catalog::SourceRecord {
+        let credential_revision = catalog
+            .credential(&source.id)
+            .await
+            .expect("MCP credential reads")
+            .expect("MCP credential exists")
+            .revision;
+        catalog
+            .replace_credential_and_sync_catalog(
+                &source.id,
+                &CredentialPayload {
+                    schema_version: 1,
+                    payload: json!({
+                        "endpoint": "http://127.0.0.1:1/mcp",
+                        "credential": {
+                            "type": "bearer",
+                            "token": "replacement-secret"
+                        }
+                    }),
+                },
+                CatalogSnapshot {
+                    expected_source_revision: source.revision,
+                    expected_credential_revision: Some(credential_revision),
+                    artifacts: vec![StagedArtifact {
+                        kind: crate::catalog::ArtifactKind::McpCapabilities,
+                        stable_key: "mcp-server".to_owned(),
+                        content: json!({
+                            "protocolVersion": crate::mcp::upstream::http::DEFAULT_PROTOCOL_VERSION,
+                            "serverInfo": { "name": "fixture", "version": "1" },
+                            "instructions": null,
+                            "capabilities": { "tools": { "listChanged": true } },
+                            "toolsListChanged": true
+                        }),
+                    }],
+                    tools: vec![staged_tool("fixture", "fixture")],
+                },
+                vec![StagedToolBinding {
+                    stable_key: "fixture".to_owned(),
+                    binding: ToolBinding::McpHttpV1(McpToolBindingV1 {
+                        version: 1,
+                        tool_name: "fixture".to_owned(),
+                    }),
+                }],
+                AuditContext::system(Some("replacement-during-unavailable-persist")),
+            )
+            .await
+            .expect("MCP credential replacement commits")
+            .2
+    }
+
+    #[test]
+    fn registry_supports_all_imported_protocols() {
+        let registry = ProtocolRegistry::default();
+        assert_eq!(
+            registry.registration(SourceKind::Openapi),
+            ProtocolRegistration::OpenApi
+        );
+        assert_eq!(
+            registry.registration(SourceKind::Graphql),
+            ProtocolRegistration::Graphql
+        );
+        assert_eq!(
+            registry.registration(SourceKind::McpHttp),
+            ProtocolRegistration::McpHttp
+        );
+        assert_eq!(
+            registry.registration(SourceKind::McpStdio),
+            ProtocolRegistration::McpStdio
+        );
+    }
+
+    #[test]
+    fn malformed_create_and_credential_values_are_invalid_json() {
+        let create_error = decode_protocol_input::<CreateOpenApiSource>(json!({
+            "displayName": "Example",
+            "spec": { "type": "inline", "content": 42 }
+        }))
+        .expect_err("malformed create input is rejected");
+        assert_eq!(create_error.code, "invalid_json");
+        assert_eq!(create_error.category, ProtocolErrorCategory::InvalidInput);
+
+        let credential_error = decode_protocol_input::<OpenApiCredentialSet>(json!({
+            "schemes": { "token": { "type": "bearer", "token": 42 } }
+        }))
+        .expect_err("malformed credential input is rejected");
+        assert_eq!(credential_error.code, "invalid_json");
+        assert_eq!(
+            credential_error.category,
+            ProtocolErrorCategory::InvalidInput
+        );
+    }
+
+    #[test]
+    fn oauth_binding_catalog_validation_is_a_protocol_conflict() {
+        let error = protocol_catalog_error(CatalogError::Validation {
+            code: "oauth_binding_changed",
+            message: "The managed OAuth binding changed.".to_owned(),
+        });
+        assert_eq!(error.category, ProtocolErrorCategory::Conflict);
+        assert_eq!(error.code, "oauth_binding_changed");
+    }
+
+    #[tokio::test]
+    async fn mcp_watcher_revision_rebases_across_every_catalog_mode_mutation() {
+        let (sources, catalog, connections, pool) = source_service_fixture().await;
+        let (mut source, mut tool) =
+            create_invalid_refresh_fixture(&catalog, SourceKind::McpHttp, "mode-revisions").await;
+        let watcher = install_test_watcher(&connections, &source.id, source.revision).await;
+
+        source = sources
+            .set_source_mode(
+                &source.id,
+                Some(ToolMode::Ask),
+                source.revision,
+                AuditContext::system(Some("source-mode")),
+            )
+            .await
+            .expect("source mode changes");
+        assert_eq!(watcher.current_revision(), Some(source.revision));
+
+        tool = sources
+            .set_tool_mode(
+                &tool.id,
+                Some(ToolMode::Disabled),
+                tool.revision,
+                AuditContext::system(Some("tool-mode")),
+            )
+            .await
+            .expect("tool mode changes");
+        source = catalog.source(&source.id).await.expect("source reads");
+        assert_eq!(watcher.current_revision(), Some(source.revision));
+
+        let bulk_source = sources
+            .bulk_set_source_tool_modes(
+                &source.id,
+                Some(ToolMode::Enabled),
+                source.revision,
+                AuditContext::system(Some("bulk-source-mode")),
+            )
+            .await
+            .expect("source tool modes change");
+        assert_eq!(
+            watcher.current_revision(),
+            bulk_source.source_revisions.get(&source.id).copied()
+        );
+
+        let bulk_tools = sources
+            .bulk_set_tool_modes(
+                &[tool.id.clone()],
+                None,
+                bulk_source.catalog_revision,
+                AuditContext::system(Some("bulk-explicit-mode")),
+            )
+            .await
+            .expect("explicit tool modes change");
+        let final_revision = bulk_tools.source_revisions[&source.id];
+        assert_eq!(watcher.current_revision(), Some(final_revision));
+        assert!(
+            connections
+                .stop_watcher_and_wait_at_revision(&source.id, final_revision)
+                .await
+        );
+        connections.shutdown().await;
+        pool.close().await;
+    }
+
+    #[tokio::test]
+    async fn failed_mcp_delete_reloads_authoritative_revision_before_restoring_watcher() {
+        let (mut sources, catalog, connections, pool) = source_service_fixture().await;
+        let source =
+            create_mcp_watcher_fixture(&catalog, "delete-rollback-race", SourceKind::McpHttp).await;
+        let old_watcher = install_test_watcher(&connections, &source.id, source.revision).await;
+        sources.fail_next_source_delete();
+        let pause = sources.pause_source_delete_after_retire();
+        let deleting = tokio::spawn({
+            let sources = sources.clone();
+            let source_id = source.id.clone();
+            async move {
+                sources
+                    .delete(&source_id, AuditContext::system(Some("failed-delete-race")))
+                    .await
+            }
+        });
+        timeout(Duration::from_secs(2), pause.reached())
+            .await
+            .expect("delete pauses after retiring its watcher");
+        assert!(!connections.has_watcher(&source.id));
+
+        let updated = sources
+            .set_source_mode(
+                &source.id,
+                Some(ToolMode::Ask),
+                source.revision,
+                AuditContext::system(Some("delete-race-mode")),
+            )
+            .await
+            .expect("concurrent source mutation commits");
+        pause.release();
+        let error = deleting
+            .await
+            .expect("failed delete task joins")
+            .expect_err("fixture delete fails");
+        assert_eq!(error.code, "internal_error");
+
+        let current = catalog
+            .source(&source.id)
+            .await
+            .expect("source remains after failed delete");
+        assert_eq!(current.revision, updated.revision);
+        assert_eq!(current.mode_override, Some(ToolMode::Ask));
+        assert_eq!(current.health_status, SourceHealth::Healthy);
+        assert_eq!(old_watcher.current_revision(), None);
+        assert_eq!(
+            connections.watcher_revision(&source.id),
+            Some(current.revision)
+        );
+
+        connections.shutdown().await;
+        pool.close().await;
+    }
+
+    #[tokio::test]
+    async fn failed_mcp_delete_marks_unavailable_when_recovery_fails_then_restores_once() {
+        let (mut sources, catalog, connections, pool) = source_service_fixture().await;
+        let source =
+            create_mcp_watcher_fixture(&catalog, "delete-recovery-failure", SourceKind::McpHttp)
+                .await;
+        let old_watcher = install_test_watcher(&connections, &source.id, source.revision).await;
+        let failures = Arc::new(std::sync::atomic::AtomicUsize::new(3));
+        sources.fail_mcp_watcher_capability_loads(failures.clone());
+        sources.fail_next_source_delete();
+
+        let error = sources
+            .delete(
+                &source.id,
+                AuditContext::system(Some("failed-delete-recovery")),
+            )
+            .await
+            .expect_err("fixture delete fails");
+        assert_eq!(error.code, "internal_error");
+        assert_eq!(failures.load(std::sync::atomic::Ordering::SeqCst), 0);
+        assert_eq!(old_watcher.current_revision(), None);
+        assert!(!connections.has_watcher(&source.id));
+
+        let unavailable = catalog
+            .source(&source.id)
+            .await
+            .expect("unavailable source remains readable");
+        assert_eq!(unavailable.health_status, SourceHealth::Error);
+        assert_eq!(
+            unavailable.health_error_code.as_deref(),
+            Some("mcp_watcher_unavailable")
+        );
+
+        sources
+            .restore_mcp_watchers()
+            .await
+            .expect("watcher recovery succeeds after the load failure clears");
+        assert_eq!(
+            connections.watcher_revision(&source.id),
+            Some(unavailable.revision)
+        );
+        let generation = connections
+            .watcher_generation(&source.id)
+            .expect("recovered watcher has a generation");
+        sources
+            .restore_mcp_watchers()
+            .await
+            .expect("repeated recovery preserves the current watcher");
+        assert_eq!(connections.watcher_generation(&source.id), Some(generation));
+
+        connections.shutdown().await;
+        pool.close().await;
+    }
+
+    async fn concurrent_mcp_deletes_keep_successful_retirement(kind: SourceKind) {
+        let (mut sources, catalog, connections, pool) = source_service_fixture().await;
+        let source = create_mcp_watcher_fixture(
+            &catalog,
+            &format!("concurrent-delete-{}", kind.as_str()),
+            kind,
+        )
+        .await;
+        let (old_watcher, sentinel) =
+            install_blocking_test_watcher(&connections, &source.id, source.revision).await;
+        sources.fail_next_source_delete();
+        let pause = sources.pause_source_delete_after_retire();
+
+        let failing_delete = tokio::spawn({
+            let sources = sources.clone();
+            let source_id = source.id.clone();
+            async move {
+                sources
+                    .delete(
+                        &source_id,
+                        AuditContext::system(Some("serialized-failed-delete")),
+                    )
+                    .await
+            }
+        });
+        timeout(Duration::from_secs(2), sentinel.canceled.notified())
+            .await
+            .expect("first delete cancels the old-secret watcher");
+        assert!(sentinel.in_use.load(std::sync::atomic::Ordering::SeqCst));
+
+        let successful_delete = tokio::spawn({
+            let sources = sources.clone();
+            let source_id = source.id.clone();
+            async move {
+                sources
+                    .delete(
+                        &source_id,
+                        AuditContext::system(Some("serialized-successful-delete")),
+                    )
+                    .await
+            }
+        });
+        tokio::task::yield_now().await;
+        assert!(!successful_delete.is_finished());
+
+        sentinel.release.notify_one();
+        timeout(Duration::from_secs(2), pause.reached())
+            .await
+            .expect("first delete pauses after joining the old-secret watcher");
+        assert!(!successful_delete.is_finished());
+        pause.release();
+
+        let failure = failing_delete
+            .await
+            .expect("failed delete task joins")
+            .expect_err("first delete receives the injected failure");
+        assert_eq!(failure.code, "internal_error");
+        successful_delete
+            .await
+            .expect("successful delete task joins")
+            .expect("second delete commits");
+
+        assert!(matches!(
+            catalog.source(&source.id).await,
+            Err(CatalogError::NotFound { .. })
+        ));
+        assert!(!connections.has_watcher(&source.id));
+        assert_eq!(old_watcher.current_revision(), None);
+        assert!(!sentinel.in_use.load(std::sync::atomic::Ordering::SeqCst));
+
+        let stale_started = Arc::new(std::sync::atomic::AtomicBool::new(false));
+        let installed = connections
+            .replace_watcher(source.id.clone(), source.revision, {
+                let stale_started = stale_started.clone();
+                move |_canceled, _lease| async move {
+                    stale_started.store(true, std::sync::atomic::Ordering::SeqCst);
+                }
+            })
+            .await
+            .expect("manager remains available");
+        assert!(!installed);
+        assert!(!stale_started.load(std::sync::atomic::Ordering::SeqCst));
+
+        connections.shutdown().await;
+        pool.close().await;
+    }
+
+    #[tokio::test]
+    async fn concurrent_http_deletes_cannot_restore_after_successful_delete() {
+        concurrent_mcp_deletes_keep_successful_retirement(SourceKind::McpHttp).await;
+    }
+
+    #[tokio::test]
+    async fn concurrent_stdio_deletes_cannot_restore_after_successful_delete() {
+        concurrent_mcp_deletes_keep_successful_retirement(SourceKind::McpStdio).await;
+    }
+
+    #[tokio::test]
+    async fn stale_unavailable_persistence_cannot_overwrite_newer_credential_recovery() {
+        let (mut sources, catalog, connections, pool) = source_service_fixture().await;
+        let source = create_mcp_watcher_fixture(
+            &catalog,
+            "stale-unavailable-persistence",
+            SourceKind::McpHttp,
+        )
+        .await;
+        let old_watcher = install_test_watcher(&connections, &source.id, source.revision).await;
+        sources.fail_mcp_watcher_capability_loads(Arc::new(std::sync::atomic::AtomicUsize::new(3)));
+        sources.fail_next_source_delete();
+        let pause = sources.pause_mcp_watcher_unavailable_persistence();
+
+        let deleting = tokio::spawn({
+            let sources = sources.clone();
+            let source_id = source.id.clone();
+            async move {
+                sources
+                    .delete(
+                        &source_id,
+                        AuditContext::system(Some("stale-unavailable-delete")),
+                    )
+                    .await
+            }
+        });
+        timeout(Duration::from_secs(2), pause.reached())
+            .await
+            .expect("failed recovery pauses before unavailable persistence");
+        assert!(!connections.has_watcher(&source.id));
+        assert_eq!(old_watcher.current_revision(), None);
+
+        let committed = commit_mcp_http_credential_replacement(&catalog, &source).await;
+        let committed_revision = committed.revision;
+        let finishing = tokio::spawn({
+            let adapter = sources.registry.mcp.clone();
+            let catalog = catalog.clone();
+            let source_id = source.id.clone();
+            async move {
+                adapter
+                    .finish_source_watcher_reconciliation(&catalog, &source_id, committed_revision)
+                    .await
+            }
+        });
+        tokio::task::yield_now().await;
+        assert!(!finishing.is_finished());
+        pause.release();
+
+        let failure = deleting
+            .await
+            .expect("failed delete task joins")
+            .expect_err("delete keeps its injected failure");
+        assert_eq!(failure.code, "internal_error");
+        finishing
+            .await
+            .expect("newer reconciliation task joins")
+            .expect("newer credential watcher installs");
+
+        let current = catalog
+            .source(&source.id)
+            .await
+            .expect("newer source remains readable");
+        assert_eq!(current.revision, committed_revision);
+        assert_eq!(current.health_status, SourceHealth::Healthy);
+        assert!(current.health_error_code.is_none());
+        assert_eq!(
+            connections.watcher_revision(&source.id),
+            Some(committed_revision)
+        );
+        let credential = catalog
+            .credential(&source.id)
+            .await
+            .expect("replacement credential reads")
+            .expect("replacement credential exists");
+        assert_eq!(
+            credential.credential.payload["credential"]["token"],
+            "replacement-secret"
+        );
+
+        assert!(
+            connections
+                .stop_watcher_and_wait_at_revision(&source.id, committed_revision)
+                .await
+        );
+        connections.shutdown().await;
+        pool.close().await;
+    }
+
+    #[tokio::test]
+    async fn refresh_failures_persist_health_and_retain_last_good_catalogs() {
+        let (sources, catalog, connections, pool) = source_service_fixture().await;
+        for (kind, slug, health_code) in [
+            (
+                SourceKind::Openapi,
+                "openapi-refresh-failure",
+                "openapi_refresh_failed",
+            ),
+            (
+                SourceKind::Graphql,
+                "graphql-refresh-failure",
+                "graphql_refresh_failed",
+            ),
+            (
+                SourceKind::McpHttp,
+                "mcp-refresh-failure",
+                "mcp_refresh_failed",
+            ),
+        ] {
+            let (source, last_good_tool) =
+                create_invalid_refresh_fixture(&catalog, kind, slug).await;
+            let watcher = if kind == SourceKind::McpHttp {
+                Some(install_test_watcher(&connections, &source.id, source.revision).await)
+            } else {
+                None
+            };
+
+            let error = sources
+                .refresh(&source.id, AuditContext::system(Some("failed-refresh")))
+                .await
+                .expect_err("invalid stored configuration fails refresh");
+            assert_eq!(error.code, "invalid_source_configuration");
+            let current = catalog
+                .source(&source.id)
+                .await
+                .expect("source remains readable");
+            assert_eq!(current.health_status, SourceHealth::Error);
+            assert_eq!(current.health_error_code.as_deref(), Some(health_code));
+            assert_eq!(current.catalog_revision, source.catalog_revision);
+
+            let retained = catalog
+                .tool(&last_good_tool.id)
+                .await
+                .expect("last-good tool remains readable");
+            assert_eq!(retained.id, last_good_tool.id);
+            assert_eq!(retained.local_name, last_good_tool.local_name);
+            assert!(retained.present);
+            if let Some(watcher) = watcher {
+                assert_eq!(watcher.current_revision(), Some(current.revision));
+                assert!(
+                    connections
+                        .stop_watcher_and_wait_at_revision(&source.id, current.revision)
+                        .await
+                );
+            }
+        }
+        connections.shutdown().await;
+        pool.close().await;
+    }
+
+    #[tokio::test]
+    async fn stale_refresh_failure_cannot_overwrite_a_concurrent_source_revision() {
+        let (sources, catalog, connections, pool) = source_service_fixture().await;
+        let (source, _) =
+            create_invalid_refresh_fixture(&catalog, SourceKind::Openapi, "stale-failure").await;
+        let updated = sources
+            .set_source_mode(
+                &source.id,
+                Some(ToolMode::Ask),
+                source.revision,
+                AuditContext::system(Some("concurrent-source-mode")),
+            )
+            .await
+            .expect("concurrent source mutation commits");
+        sources
+            .persist_refresh_failure(
+                &source,
+                &ProtocolError::new(
+                    ProtocolErrorCategory::Upstream,
+                    "fixture_refresh_failed",
+                    "fixture refresh failed",
+                ),
+                AuditContext::system(Some("stale-refresh-failure")),
+            )
+            .await;
+
+        let current = catalog
+            .source(&source.id)
+            .await
+            .expect("source remains readable");
+        assert_eq!(current.revision, updated.revision);
+        assert_eq!(current.mode_override, Some(ToolMode::Ask));
+        assert_eq!(current.health_status, SourceHealth::Healthy);
+        assert!(current.health_error_code.is_none());
+        connections.shutdown().await;
+        pool.close().await;
+    }
+
+    #[tokio::test]
+    async fn then_aliases_are_reserved_without_changing_tool_identity_across_tombstones() {
+        let (_sources, catalog, connections, pool) = source_service_fixture().await;
+        let stable_key = "stable-then";
+        let binding = StagedToolBinding {
+            stable_key: stable_key.to_owned(),
+            binding: openapi_binding("/then"),
+        };
+        let credential = CredentialPayload {
+            schema_version: 1,
+            payload: json!({}),
+        };
+        let (source, _) = catalog
+            .create_source_with_catalog(
+                crate::catalog::CreateSource {
+                    kind: SourceKind::Openapi,
+                    preferred_slug: "then".to_owned(),
+                    display_name: "Then".to_owned(),
+                    description: None,
+                    configuration: Map::new(),
+                },
+                &credential,
+                InitialCatalogSnapshot {
+                    artifacts: Vec::new(),
+                    tools: vec![staged_tool(stable_key, "then")],
+                },
+                vec![binding.clone()],
+                AuditContext::system(Some("then-alias-create")),
+            )
+            .await
+            .expect("source is created");
+        assert_ne!(source.slug, "then");
+        let original = catalog
+            .list_tools(ListToolsFilter {
+                source_id: Some(source.id.clone()),
+                include_tombstoned: true,
+                limit: 10,
+                ..ListToolsFilter::default()
+            })
+            .await
+            .expect("tools list")
+            .items
+            .into_iter()
+            .next()
+            .expect("tool exists");
+        assert_ne!(original.local_name, "then");
+
+        let removed = catalog
+            .sync_catalog_with_bindings(
+                &source.id,
+                CatalogSnapshot {
+                    expected_source_revision: source.revision,
+                    expected_credential_revision: Some(0),
+                    artifacts: Vec::new(),
+                    tools: Vec::new(),
+                },
+                Vec::new(),
+                AuditContext::system(Some("then-alias-remove")),
+            )
+            .await
+            .expect("tool is tombstoned");
+        let tombstone = catalog.tool(&original.id).await.expect("tombstone reads");
+        assert!(!tombstone.present);
+
+        catalog
+            .sync_catalog_with_bindings(
+                &source.id,
+                CatalogSnapshot {
+                    expected_source_revision: removed.source_revision,
+                    expected_credential_revision: Some(0),
+                    artifacts: Vec::new(),
+                    tools: vec![staged_tool(stable_key, "then")],
+                },
+                vec![binding],
+                AuditContext::system(Some("then-alias-restore")),
+            )
+            .await
+            .expect("tool is restored");
+        let restored = catalog
+            .tool(&original.id)
+            .await
+            .expect("restored tool reads");
+        assert!(restored.present);
+        assert_eq!(restored.id, original.id);
+        assert_eq!(restored.local_name, original.local_name);
+        assert_eq!(restored.stable_key, original.stable_key);
+        connections.shutdown().await;
+        pool.close().await;
+    }
+
+    #[tokio::test]
+    async fn preparation_has_no_network_and_the_lease_lives_through_execution() {
+        let listener = TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("test listener binds");
+        let server_url = format!(
+            "http://{}",
+            listener.local_addr().expect("test listener has an address")
+        );
+        let mutation_gate = Arc::new(RwLock::new(()));
+        let guard = mutation_gate.clone().read_owned().await;
+        let input_schema = json!({ "type": "object" });
+        let lease = InvocationLease {
+            lookup: InvocationLookup {
+                tool_id: "tool".to_owned(),
+                source_id: "source".to_owned(),
+                source_display_name: "Source".to_owned(),
+                tool_display_name: "Tool".to_owned(),
+                callable_path: "source.tool".to_owned(),
+                sandbox_path: "tools.source.tool".to_owned(),
+                effective_mode: ToolMode::Enabled,
+                mode_provenance: ModeProvenance::Intrinsic,
+                requires_approval: false,
+            },
+            revisions: InvocationRevisionToken {
+                source_id: "source".to_owned(),
+                tool_id: "tool".to_owned(),
+                source_revision: 0,
+                catalog_revision: 0,
+                tool_revision: 0,
+                binding_revision: 0,
+                credential_revision: Some(0),
+            },
+            source_kind: SourceKind::Openapi,
+            binding: ToolBinding::OpenapiV1(OpenApiBinding {
+                version: 1,
+                method: "GET".to_owned(),
+                path_template: "/execute".to_owned(),
+                server_url,
+                parameters: Vec::new(),
+                request_body: None,
+                security: vec![OpenApiSecurityAlternative {
+                    requirements: Vec::new(),
+                }],
+            }),
+            input_schema: input_schema.clone(),
+            input_validator: jsonschema::validator_for(&input_schema)
+                .expect("test input schema compiles"),
+            source_configuration: json!({
+                "spec": { "type": "inline" },
+                "allowPrivateNetwork": true
+            })
+            .as_object()
+            .expect("test source configuration is an object")
+            .clone(),
+            credential: Some(StoredCredential {
+                revision: 0,
+                credential: CredentialPayload {
+                    schema_version: 1,
+                    payload: json!({
+                        "locator": { "type": "inline" },
+                        "credentials": { "schemes": {} }
+                    }),
+                },
+            }),
+            _guard: guard,
+        };
+        let registry = ProtocolRegistry::default();
+        let prepared = registry
+            .prepare_invocation(lease, &json!({}), None)
+            .await
+            .expect("invocation preparation succeeds");
+
+        assert!(
+            timeout(Duration::from_millis(50), listener.accept())
+                .await
+                .is_err(),
+            "preparation must not connect to the upstream"
+        );
+        assert!(
+            mutation_gate.try_write().is_err(),
+            "the prepared invocation retains its lease"
+        );
+
+        let execution = tokio::spawn(async move { registry.execute_invocation(prepared).await });
+        let (mut connection, _) = timeout(Duration::from_secs(2), listener.accept())
+            .await
+            .expect("execution connects to the upstream")
+            .expect("test listener accepts the connection");
+        assert!(
+            mutation_gate.try_write().is_err(),
+            "the lease remains held while transport is in flight"
+        );
+        let mut request = vec![0_u8; 4096];
+        let read = timeout(Duration::from_secs(2), connection.read(&mut request))
+            .await
+            .expect("upstream request arrives")
+            .expect("upstream request is readable");
+        assert!(
+            String::from_utf8_lossy(&request[..read]).starts_with("GET /execute HTTP/1.1"),
+            "the prepared request is executed"
+        );
+        connection
+            .write_all(
+                b"HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: 11\r\nConnection: close\r\n\r\n{\"ok\":true}",
+            )
+            .await
+            .expect("test response writes");
+
+        let response = execution
+            .await
+            .expect("protocol execution task completes")
+            .expect("protocol execution succeeds");
+        assert!(response.ok);
+        assert_eq!(response.data, Some(json!({ "ok": true })));
+        assert!(
+            mutation_gate.try_write().is_ok(),
+            "the lease is released after execution"
+        );
+    }
+}
diff --git a/src/protocols/openapi.rs b/src/protocols/openapi.rs
new file mode 100644
index 000000000..015226d85
--- /dev/null
+++ b/src/protocols/openapi.rs
@@ -0,0 +1,3340 @@
+use std::collections::{BTreeMap, BTreeSet};
+
+use base64::{Engine as _, engine::general_purpose::STANDARD};
+use reqwest::{
+    Method,
+    header::{self, HeaderMap, HeaderName, HeaderValue},
+};
+use serde::{Deserialize, Serialize};
+use serde_json::{Map, Value, json};
+use thiserror::Error;
+use url::Url;
+
+use super::{
+    ConfiguredCredential, CredentialMetadata, ProtocolError, ProtocolErrorCategory,
+    ProtocolExecutionResponse, ProtocolHttpMetadata, ProtocolResponseError, protocol_catalog_error,
+    protocol_outbound_error,
+};
+use crate::{
+    catalog::{
+        ArtifactKind, AuditContext, CatalogSnapshot, CatalogStore, CatalogSyncResult, CreateSource,
+        CredentialPayload, InitialCatalogSnapshot, SourceKind, SourceRecord, StagedArtifact,
+        StagedTool, StagedToolBinding, StoredCredential, ToolBinding,
+    },
+    oauth::{OAuthBinding, OAuthError, OAuthService},
+    openapi::{
+        CompiledOpenApi, OpenApiBinding, OpenApiCredentialSet, OpenApiError,
+        OpenApiInvocationError, OpenApiOAuthFlows, OpenApiParameterLocation,
+        OpenApiSecurityRequirement, OpenApiSecurityScheme, build_protocol_request_with_base,
+        compile_document,
+    },
+    outbound::{HardenedHttpClient, OutboundError, OutboundPolicy, OutboundRequest, parse_url},
+};
+
+const MAX_SPEC_BYTES: usize = 16 * 1024 * 1024;
+const OPENAPI_CREDENTIAL_SCHEMA_VERSION: u32 = 1;
+const MANAGED_OAUTH_PLACEHOLDER: &str = "executor-managed-oauth-placeholder";
+const MAX_MANAGED_OAUTH_OPTIONS: usize = 64;
+const MAX_MANAGED_OAUTH_SCOPES: usize = 64;
+const MAX_MANAGED_OAUTH_KEY_BYTES: usize = 128;
+const MAX_MANAGED_OAUTH_SCOPE_BYTES: usize = 256;
+const MAX_BOUND_CREDENTIAL_SCHEMES: usize = 128;
+const MAX_CREDENTIAL_ORIGINS_PER_SCHEME: usize = 1_024;
+const MAX_ORIGIN_RETIRE_CAS_ATTEMPTS: usize = 4;
+
+#[derive(Clone, Debug, Deserialize)]
+#[serde(tag = "type", rename_all = "snake_case", deny_unknown_fields)]
+pub enum OpenApiSpecInput {
+    Inline { content: String },
+    Url { url: String },
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct CreateOpenApiSource {
+    pub display_name: String,
+    pub preferred_slug: Option<String>,
+    pub description: Option<String>,
+    pub spec: OpenApiSpecInput,
+    #[serde(default)]
+    pub allow_private_network: bool,
+    #[serde(default)]
+    pub credential: OpenApiCredentialSet,
+}
+
+#[derive(Clone, Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct OpenApiPreview {
+    pub title: String,
+    pub description: Option<String>,
+    pub tool_count: usize,
+    pub tools: Vec<OpenApiPreviewTool>,
+    pub security_schemes: Vec<OpenApiPreviewSecurityScheme>,
+}
+
+#[derive(Clone, Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct OpenApiPreviewTool {
+    pub preferred_name: String,
+    pub display_name: String,
+    pub description: Option<String>,
+    pub intrinsic_mode: crate::catalog::ToolMode,
+    pub security: Vec<Vec<String>>,
+}
+
+#[derive(Clone, Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct OpenApiPreviewSecurityScheme {
+    pub name: String,
+    pub credential_type: &'static str,
+    pub placement: Option<&'static str>,
+    pub supported: bool,
+    pub oauth_flows: Option<OpenApiOAuthFlows>,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub(crate) struct OpenApiManagedOAuthOption {
+    pub(crate) credential_key: String,
+    pub(crate) scopes: Vec<String>,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+#[serde(
+    tag = "type",
+    rename_all = "snake_case",
+    rename_all_fields = "camelCase",
+    deny_unknown_fields
+)]
+enum StoredOpenApiSpecV1 {
+    Inline,
+    Url { display_url: String },
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct OpenApiSourceConfigurationV1 {
+    spec: StoredOpenApiSpecV1,
+    allow_private_network: bool,
+}
+
+impl OpenApiSourceConfigurationV1 {
+    fn decode(configuration: &Map<String, Value>) -> Result<Self, ProtocolError> {
+        let decoded: Self =
+            serde_json::from_value(Value::Object(configuration.clone())).map_err(|_| {
+                ProtocolError::corrupt(
+                    "invalid_source_configuration",
+                    "The stored OpenAPI source configuration is invalid.",
+                )
+            })?;
+        if let StoredOpenApiSpecV1::Url { display_url } = &decoded.spec {
+            require_http_url(display_url).map_err(|_| {
+                ProtocolError::corrupt(
+                    "invalid_source_configuration",
+                    "The stored OpenAPI source configuration is invalid.",
+                )
+            })?;
+        }
+        Ok(decoded)
+    }
+
+    fn encode(&self) -> Result<Map<String, Value>, ProtocolError> {
+        serde_json::to_value(self)
+            .map_err(internal_encoding_error)?
+            .as_object()
+            .cloned()
+            .ok_or_else(|| {
+                internal_encoding_error(serde_json::Error::io(std::io::Error::other(
+                    "OpenAPI source configuration did not encode as an object",
+                )))
+            })
+    }
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+#[serde(
+    tag = "type",
+    rename_all = "snake_case",
+    rename_all_fields = "camelCase",
+    deny_unknown_fields
+)]
+enum StoredOpenApiLocatorV1 {
+    Inline,
+    Url {
+        url: String,
+        document_base_url: String,
+    },
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct StoredOpenApiCredentialV1 {
+    locator: StoredOpenApiLocatorV1,
+    credentials: OpenApiCredentialSet,
+    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+    credential_origins: BTreeMap<String, Vec<String>>,
+}
+
+impl StoredOpenApiCredentialV1 {
+    fn decode(stored: &StoredCredential) -> Result<Self, ProtocolError> {
+        if stored.credential.schema_version != OPENAPI_CREDENTIAL_SCHEMA_VERSION {
+            return Err(ProtocolError::new(
+                ProtocolErrorCategory::Conflict,
+                "unsupported_credential_schema",
+                "The stored OpenAPI credential schema is not supported.",
+            ));
+        }
+        let decoded: Self =
+            serde_json::from_value(stored.credential.payload.clone()).map_err(|_| {
+                ProtocolError::corrupt(
+                    "invalid_source_credentials",
+                    "The stored OpenAPI credential state is invalid.",
+                )
+            })?;
+        decoded.validate_stored()?;
+        Ok(decoded)
+    }
+
+    fn validate_stored(&self) -> Result<(), ProtocolError> {
+        self.credentials.validate().map_err(|_| {
+            ProtocolError::corrupt(
+                "invalid_source_credentials",
+                "The stored OpenAPI credential state is invalid.",
+            )
+        })?;
+        if let StoredOpenApiLocatorV1::Url {
+            url,
+            document_base_url,
+        } = &self.locator
+        {
+            require_http_url(url).map_err(|_| {
+                ProtocolError::corrupt(
+                    "invalid_source_credentials",
+                    "The stored OpenAPI credential state is invalid.",
+                )
+            })?;
+            require_http_url(document_base_url).map_err(|_| {
+                ProtocolError::corrupt(
+                    "invalid_source_credentials",
+                    "The stored OpenAPI credential state is invalid.",
+                )
+            })?;
+        }
+        if self.credential_origins.len() > MAX_BOUND_CREDENTIAL_SCHEMES {
+            return Err(invalid_stored_credentials());
+        }
+        for (scheme_name, origins) in &self.credential_origins {
+            if scheme_name.is_empty()
+                || scheme_name.len() > 256
+                || scheme_name.chars().any(char::is_control)
+                || origins.len() > MAX_CREDENTIAL_ORIGINS_PER_SCHEME
+                || origins.windows(2).any(|pair| pair[0] >= pair[1])
+            {
+                return Err(invalid_stored_credentials());
+            }
+            for origin in origins {
+                let parsed = require_http_url(origin).map_err(|_| invalid_stored_credentials())?;
+                if parsed.origin().ascii_serialization() != origin.as_str() {
+                    return Err(invalid_stored_credentials());
+                }
+            }
+        }
+        Ok(())
+    }
+
+    fn decode_for_invocation(stored: &StoredCredential) -> Result<Self, ProtocolError> {
+        if stored.credential.schema_version != OPENAPI_CREDENTIAL_SCHEMA_VERSION {
+            return Err(ProtocolError::new(
+                ProtocolErrorCategory::InvalidInput,
+                "unsupported_credential_schema",
+                "The stored OpenAPI credential schema is not supported.",
+            ));
+        }
+        Self::decode(stored)
+    }
+
+    fn payload(&self) -> Result<CredentialPayload, ProtocolError> {
+        Ok(CredentialPayload {
+            schema_version: OPENAPI_CREDENTIAL_SCHEMA_VERSION,
+            payload: serde_json::to_value(self).map_err(internal_encoding_error)?,
+        })
+    }
+}
+
+pub(super) struct PreparedOpenApiInvocation {
+    request: OutboundRequest,
+    policy: OutboundPolicy,
+    oauth_authorization: Option<PreparedOAuthAuthorization>,
+}
+
+struct PreparedOAuthAuthorization {
+    source_id: String,
+    scheme_name: String,
+    required_scopes: Vec<String>,
+    expected_binding: OAuthBinding,
+}
+
+#[derive(Debug, Error)]
+pub enum OpenApiExecutionError {
+    #[error("OpenAPI transport is not confidential")]
+    InsecureTransport,
+    #[error("OpenAPI transport failed")]
+    Outbound {
+        #[source]
+        source: crate::outbound::OutboundError,
+        outcome_unknown: bool,
+    },
+    #[error("the OpenAPI mutation outcome is unknown")]
+    Indeterminate,
+    #[error("managed OAuth authorization is unavailable")]
+    OAuth(#[source] OAuthError),
+}
+
+impl OpenApiExecutionError {
+    pub const fn outcome_unknown(&self) -> bool {
+        matches!(
+            self,
+            Self::Outbound {
+                outcome_unknown: true,
+                ..
+            } | Self::Indeterminate
+        )
+    }
+
+    pub fn code(&self) -> &'static str {
+        match self {
+            Self::InsecureTransport => "insecure_openapi_transport",
+            Self::Outbound {
+                source: OutboundError::InsecureTransport,
+                ..
+            } => "insecure_openapi_transport",
+            Self::Outbound { source, .. } => source.code(),
+            Self::Indeterminate => "openapi_outcome_unknown",
+            Self::OAuth(error) => error.code(),
+        }
+    }
+}
+
+#[derive(Clone, Default)]
+pub struct OpenApiAdapter {
+    oauth: Option<OAuthService>,
+}
+
+impl OpenApiAdapter {
+    pub(crate) fn with_oauth(oauth: OAuthService) -> Self {
+        Self { oauth: Some(oauth) }
+    }
+
+    pub(super) async fn prepare_invocation(
+        &self,
+        source_id: &str,
+        binding: &OpenApiBinding,
+        source_configuration: &Map<String, Value>,
+        stored: Option<&StoredCredential>,
+        arguments: &Value,
+        expected_oauth_bindings: Option<&[OAuthBinding]>,
+    ) -> Result<PreparedOpenApiInvocation, ProtocolError> {
+        let static_plan = self.plan_invocation(
+            source_id,
+            binding,
+            source_configuration,
+            stored,
+            arguments,
+            &BTreeMap::new(),
+        );
+        match static_plan {
+            Ok(prepared) => Ok(prepared),
+            Err(error) if error.code == "missing_source_credentials" => {
+                let (eligible_binding, resolved_oauth) = self
+                    .resolve_managed_oauth(source_id, binding, stored, expected_oauth_bindings)
+                    .await?;
+                self.plan_invocation(
+                    source_id,
+                    &eligible_binding,
+                    source_configuration,
+                    stored,
+                    arguments,
+                    &resolved_oauth,
+                )
+            }
+            Err(error) => Err(error),
+        }
+    }
+
+    pub(super) async fn execute_invocation(
+        &self,
+        prepared: PreparedOpenApiInvocation,
+    ) -> Result<ProtocolExecutionResponse, OpenApiExecutionError> {
+        let client = HardenedHttpClient::new(prepared.policy.clone());
+        self.execute_invocation_with_client(prepared, client).await
+    }
+
+    async fn execute_invocation_with_client(
+        &self,
+        mut prepared: PreparedOpenApiInvocation,
+        client: HardenedHttpClient,
+    ) -> Result<ProtocolExecutionResponse, OpenApiExecutionError> {
+        if !is_confidential_openapi_url(&prepared.request.url) {
+            return Err(OpenApiExecutionError::InsecureTransport);
+        }
+        if let Some(authorization) = prepared.oauth_authorization {
+            let oauth = self
+                .oauth
+                .as_ref()
+                .ok_or(OpenApiExecutionError::OAuth(OAuthError::Internal))?;
+            let current_binding = oauth
+                .ready_binding_for_scopes(
+                    &authorization.source_id,
+                    &authorization.scheme_name,
+                    &authorization.required_scopes,
+                )
+                .await
+                .map_err(openapi_oauth_error)?;
+            let binding = match current_binding {
+                Some(current) if authorization.expected_binding == current => {
+                    authorization.expected_binding
+                }
+                _ => {
+                    return Err(OpenApiExecutionError::OAuth(OAuthError::Conflict {
+                        code: "oauth_binding_changed",
+                        message: "The managed OAuth binding changed before dispatch.",
+                    }));
+                }
+            };
+            let token = oauth
+                .access_token_for_binding(&binding)
+                .await
+                .map_err(openapi_oauth_error)?;
+            let mut value = HeaderValue::from_str(&format!("Bearer {}", token.expose()))
+                .map_err(|_| OpenApiExecutionError::OAuth(OAuthError::Internal))?;
+            value.set_sensitive(true);
+            prepared
+                .request
+                .headers
+                .insert(header::AUTHORIZATION, value);
+        }
+        let mutating = prepared.request.method != Method::GET
+            && prepared.request.method != Method::HEAD
+            && prepared.request.method != Method::OPTIONS;
+        let response = client.execute(prepared.request).await.map_err(|source| {
+            OpenApiExecutionError::Outbound {
+                outcome_unknown: mutating && may_have_dispatched(&source),
+                source,
+            }
+        })?;
+        let succeeded = response.status.is_success();
+        if mutating
+            && (response.status.is_server_error()
+                || response.status == reqwest::StatusCode::REQUEST_TIMEOUT)
+        {
+            return Err(OpenApiExecutionError::Indeterminate);
+        }
+        let data = response_data(&response.headers, &response.body);
+        Ok(ProtocolExecutionResponse {
+            ok: succeeded,
+            data: succeeded.then_some(data),
+            error: (!succeeded).then_some(ProtocolResponseError {
+                code: "upstream_http_error".to_owned(),
+                message: "The upstream API returned an error response.".to_owned(),
+            }),
+            http: Some(ProtocolHttpMetadata {
+                status: response.status.as_u16(),
+                headers: safe_response_headers(&response.headers),
+                truncated: false,
+            }),
+        })
+    }
+
+    async fn resolve_managed_oauth(
+        &self,
+        source_id: &str,
+        binding: &OpenApiBinding,
+        stored: Option<&StoredCredential>,
+        expected_oauth_bindings: Option<&[OAuthBinding]>,
+    ) -> Result<(OpenApiBinding, BTreeMap<String, OAuthBinding>), ProtocolError> {
+        let stored = stored.ok_or_else(|| {
+            ProtocolError::corrupt(
+                "source_credentials_missing",
+                "The source credential state is missing.",
+            )
+        })?;
+        let credential = StoredOpenApiCredentialV1::decode_for_invocation(stored)?;
+        let oauth = self.oauth.as_ref().ok_or_else(|| {
+            ProtocolError::new(
+                ProtocolErrorCategory::Internal,
+                "oauth_service_unavailable",
+                "Managed OAuth is unavailable.",
+            )
+        })?;
+        if let Some(expected) = expected_oauth_bindings {
+            return Self::resolve_snapshotted_managed_oauth(
+                oauth,
+                source_id,
+                binding,
+                &credential,
+                expected,
+            )
+            .await;
+        }
+        let mut eligible_binding = binding.clone();
+        eligible_binding.security.clear();
+        let mut resolved = BTreeMap::new();
+        let mut candidates = std::collections::BTreeSet::new();
+        for alternative in &binding.security {
+            let mut eligible = true;
+            for requirement in &alternative.requirements {
+                if credential
+                    .credentials
+                    .schemes
+                    .contains_key(&requirement.scheme_name)
+                    || !managed_oauth_supported(requirement)
+                {
+                    continue;
+                }
+                let candidate = (requirement.scheme_name.clone(), requirement.scopes.clone());
+                if candidates.insert(candidate) && candidates.len() > MAX_MANAGED_OAUTH_OPTIONS {
+                    return Err(ProtocolError::new(
+                        ProtocolErrorCategory::InvalidInput,
+                        "openapi_oauth_scheme_limit_exceeded",
+                        "The OpenAPI operation has too many managed OAuth alternatives.",
+                    ));
+                }
+                let current = match oauth
+                    .ready_binding_for_scopes(
+                        source_id,
+                        &requirement.scheme_name,
+                        &requirement.scopes,
+                    )
+                    .await
+                {
+                    Ok(current) => current,
+                    Err(
+                        OAuthError::Validation {
+                            code: "oauth_scope_not_requested",
+                            ..
+                        }
+                        | OAuthError::Conflict {
+                            code: "oauth_scope_not_granted",
+                            ..
+                        },
+                    ) => {
+                        eligible = false;
+                        break;
+                    }
+                    Err(error) => return Err(openapi_oauth_prepare_error(error)),
+                };
+                let selected = current;
+                let Some(selected) = selected else {
+                    eligible = false;
+                    break;
+                };
+                resolved.insert(requirement.scheme_name.clone(), selected);
+            }
+            if eligible {
+                eligible_binding.security.push(alternative.clone());
+            }
+        }
+        Ok((eligible_binding, resolved))
+    }
+
+    async fn resolve_snapshotted_managed_oauth(
+        oauth: &OAuthService,
+        source_id: &str,
+        binding: &OpenApiBinding,
+        credential: &StoredOpenApiCredentialV1,
+        expected: &[OAuthBinding],
+    ) -> Result<(OpenApiBinding, BTreeMap<String, OAuthBinding>), ProtocolError> {
+        let expected = expected
+            .iter()
+            .map(|binding| (binding.credential_key.as_str(), binding))
+            .collect::<BTreeMap<_, _>>();
+        let selected = binding.security.iter().find(|alternative| {
+            alternative.requirements.iter().all(|requirement| {
+                credential
+                    .credentials
+                    .schemes
+                    .contains_key(&requirement.scheme_name)
+                    || (managed_oauth_supported(requirement)
+                        && expected
+                            .get(requirement.scheme_name.as_str())
+                            .is_some_and(|binding| {
+                                requirement
+                                    .scopes
+                                    .iter()
+                                    .all(|scope| binding.granted_scopes.contains(scope))
+                            }))
+            })
+        });
+        let Some(selected) = selected else {
+            let mut eligible_binding = binding.clone();
+            eligible_binding.security.clear();
+            return Ok((eligible_binding, BTreeMap::new()));
+        };
+        let mut resolved = BTreeMap::new();
+        for requirement in &selected.requirements {
+            if credential
+                .credentials
+                .schemes
+                .contains_key(&requirement.scheme_name)
+            {
+                continue;
+            }
+            let expected = expected
+                .get(requirement.scheme_name.as_str())
+                .expect("the snapshotted alternative was selected from this binding map");
+            let current = oauth
+                .binding(source_id, &requirement.scheme_name)
+                .await
+                .map_err(openapi_oauth_prepare_error)?;
+            if current.as_ref() != Some(*expected) {
+                return Err(oauth_binding_changed());
+            }
+            let ready = oauth
+                .ready_binding_for_scopes(source_id, &requirement.scheme_name, &requirement.scopes)
+                .await
+                .map_err(openapi_oauth_prepare_error)?;
+            if ready.as_ref() != Some(*expected) {
+                return Err(oauth_binding_changed());
+            }
+            resolved.insert(requirement.scheme_name.clone(), (*expected).clone());
+        }
+        let mut eligible_binding = binding.clone();
+        eligible_binding.security = vec![selected.clone()];
+        Ok((eligible_binding, resolved))
+    }
+
+    pub async fn preview(
+        &self,
+        spec: &OpenApiSpecInput,
+        allow_private_network: bool,
+    ) -> Result<OpenApiPreview, ProtocolError> {
+        let fetched = fetch_and_compile(spec, allow_private_network).await?;
+        Ok(preview_response(fetched.compiled))
+    }
+
+    pub async fn create_source(
+        &self,
+        catalog: &CatalogStore,
+        input: CreateOpenApiSource,
+        audit: AuditContext<'_>,
+    ) -> Result<SourceRecord, ProtocolError> {
+        validate_input_credentials(&input.credential)?;
+        let fetched = fetch_and_compile(&input.spec, input.allow_private_network).await?;
+        let configuration = source_configuration(&input.spec, input.allow_private_network)?;
+        let preferred_slug = input
+            .preferred_slug
+            .unwrap_or_else(|| input.display_name.clone());
+        let mut credential = StoredOpenApiCredentialV1 {
+            locator: fetched.locator,
+            credentials: input.credential,
+            credential_origins: BTreeMap::new(),
+        };
+        let credential_keys = credential
+            .credentials
+            .schemes
+            .keys()
+            .cloned()
+            .collect::<Vec<_>>();
+        bind_missing_credential_origins(
+            &mut credential,
+            fetched.compiled.tools.iter().map(|tool| &tool.binding),
+            credential_keys,
+            OriginInput::Untrusted,
+        )?;
+        let snapshot = initial_catalog_snapshot(&fetched.compiled);
+        let bindings = staged_bindings(&fetched.compiled);
+        let (source, _) = catalog
+            .create_source_with_catalog(
+                CreateSource {
+                    kind: SourceKind::Openapi,
+                    preferred_slug,
+                    display_name: input.display_name,
+                    description: input.description,
+                    configuration,
+                },
+                &credential.payload()?,
+                snapshot,
+                bindings,
+                audit,
+            )
+            .await
+            .map_err(protocol_catalog_error)?;
+        Ok(source)
+    }
+
+    pub async fn refresh_source(
+        &self,
+        catalog: &CatalogStore,
+        source: SourceRecord,
+        audit: AuditContext<'_>,
+    ) -> Result<CatalogSyncResult, ProtocolError> {
+        if source.kind != SourceKind::Openapi {
+            return Err(ProtocolError::corrupt(
+                "source_protocol_mismatch",
+                "The stored source does not match the OpenAPI protocol.",
+            ));
+        }
+        let configuration = OpenApiSourceConfigurationV1::decode(&source.configuration)?;
+        let stored = required_stored_credential(catalog, &source.id).await?;
+        let credential = StoredOpenApiCredentialV1::decode(&stored)?;
+        let fetched = match &credential.locator {
+            StoredOpenApiLocatorV1::Inline => {
+                let document = sqlx::query_scalar::<_, String>(
+                    "SELECT content_json FROM source_artifacts WHERE source_id = ? \
+                     AND artifact_kind = 'openapi_document' AND stable_key = 'document'",
+                )
+                .bind(&source.id)
+                .fetch_optional(catalog.pool())
+                .await
+                .map_err(|_| internal_storage_error())?
+                .ok_or_else(|| {
+                    ProtocolError::new(
+                        ProtocolErrorCategory::Conflict,
+                        "source_artifact_missing",
+                        "The source has no OpenAPI document to refresh.",
+                    )
+                })?;
+                let compiled = compile_bytes(document.into_bytes()).await?;
+                validate_inline_operation_transports(&compiled)?;
+                FetchedSpec {
+                    compiled,
+                    locator: StoredOpenApiLocatorV1::Inline,
+                }
+            }
+            StoredOpenApiLocatorV1::Url { url, .. } => {
+                fetch_url(url, configuration.allow_private_network).await?
+            }
+        };
+        verify_refresh_credential_origins(&credential, &fetched.compiled)?;
+        let snapshot = catalog_snapshot(&fetched.compiled, source.revision, stored.revision);
+        catalog
+            .sync_catalog_with_bindings(
+                &source.id,
+                snapshot,
+                staged_bindings(&fetched.compiled),
+                audit,
+            )
+            .await
+            .map_err(protocol_catalog_error)
+    }
+
+    pub async fn credential_metadata(
+        &self,
+        catalog: &CatalogStore,
+        source_id: &str,
+    ) -> Result<CredentialMetadata, ProtocolError> {
+        let stored = required_stored_credential(catalog, source_id).await?;
+        let credential = StoredOpenApiCredentialV1::decode(&stored)?;
+        Ok(credential_metadata(stored.revision, credential))
+    }
+
+    pub(crate) async fn managed_oauth_options(
+        &self,
+        catalog: &CatalogStore,
+        source_id: &str,
+    ) -> Result<Vec<OpenApiManagedOAuthOption>, ProtocolError> {
+        let source = catalog
+            .source(source_id)
+            .await
+            .map_err(protocol_catalog_error)?;
+        if source.kind != SourceKind::Openapi {
+            return Err(ProtocolError::new(
+                ProtocolErrorCategory::InvalidInput,
+                "oauth_source_protocol_mismatch",
+                "Managed OpenAPI OAuth can only be configured for an OpenAPI source.",
+            ));
+        }
+        let document = stored_openapi_document(catalog, source_id).await?;
+        let compiled = compile_bytes(document.into_bytes()).await?;
+        managed_oauth_options(&compiled)
+    }
+
+    pub async fn replace_credentials(
+        &self,
+        catalog: &CatalogStore,
+        source_id: &str,
+        expected_revision: i64,
+        credential_set: OpenApiCredentialSet,
+        audit: AuditContext<'_>,
+    ) -> Result<CredentialMetadata, ProtocolError> {
+        validate_input_credentials(&credential_set)?;
+        let stored = required_stored_credential(catalog, source_id).await?;
+        if expected_revision != stored.revision {
+            return Err(revision_conflict());
+        }
+        let mut credential = StoredOpenApiCredentialV1::decode(&stored)?;
+        let bindings = stored_openapi_bindings(catalog, source_id).await?;
+        credential.credentials = credential_set;
+        self.retire_unused_credential_origins(source_id, &mut credential)
+            .await?;
+        let credential_keys = credential
+            .credentials
+            .schemes
+            .keys()
+            .cloned()
+            .collect::<Vec<_>>();
+        bind_missing_credential_origins(
+            &mut credential,
+            bindings.iter(),
+            credential_keys,
+            OriginInput::Stored,
+        )?;
+        catalog
+            .put_credential(
+                source_id,
+                &credential.payload()?,
+                Some(stored.revision),
+                audit,
+            )
+            .await
+            .map_err(protocol_catalog_error)?;
+        self.credential_metadata(catalog, source_id).await
+    }
+
+    pub(crate) async fn ensure_managed_oauth_origin_bound(
+        &self,
+        catalog: &CatalogStore,
+        source_id: &str,
+        credential_key: &str,
+        audit: AuditContext<'_>,
+    ) -> Result<(), ProtocolError> {
+        let stored = required_stored_credential(catalog, source_id).await?;
+        let mut credential = StoredOpenApiCredentialV1::decode(&stored)?;
+        let bindings = stored_openapi_bindings(catalog, source_id).await?;
+        if !matches!(credential.locator, StoredOpenApiLocatorV1::Url { .. })
+            || credential.credential_origins.contains_key(credential_key)
+        {
+            return Ok(());
+        }
+        bind_missing_credential_origins(
+            &mut credential,
+            bindings.iter(),
+            [credential_key.to_owned()],
+            OriginInput::Stored,
+        )?;
+        catalog
+            .put_credential(
+                source_id,
+                &credential.payload()?,
+                Some(stored.revision),
+                audit,
+            )
+            .await
+            .map_err(protocol_catalog_error)?;
+        Ok(())
+    }
+
+    pub(crate) async fn retire_managed_oauth_origin(
+        &self,
+        catalog: &CatalogStore,
+        source_id: &str,
+        credential_key: &str,
+        audit: AuditContext<'_>,
+    ) -> Result<(), ProtocolError> {
+        let Some(oauth) = self.oauth.as_ref() else {
+            return Ok(());
+        };
+        for _ in 0..MAX_ORIGIN_RETIRE_CAS_ATTEMPTS {
+            let stored = required_stored_credential(catalog, source_id).await?;
+            let mut credential = StoredOpenApiCredentialV1::decode(&stored)?;
+            if !credential.credential_origins.contains_key(credential_key)
+                || credential.credentials.schemes.contains_key(credential_key)
+                || oauth
+                    .binding(source_id, credential_key)
+                    .await
+                    .map_err(openapi_oauth_prepare_error)?
+                    .is_some()
+            {
+                return Ok(());
+            }
+            credential.credential_origins.remove(credential_key);
+            match catalog
+                .put_credential(
+                    source_id,
+                    &credential.payload()?,
+                    Some(stored.revision),
+                    audit,
+                )
+                .await
+            {
+                Ok(_) => return Ok(()),
+                Err(error) => {
+                    let error = protocol_catalog_error(error);
+                    if error.code != "revision_conflict" {
+                        return Err(error);
+                    }
+                }
+            }
+        }
+        Err(revision_conflict())
+    }
+
+    pub async fn clear_credentials(
+        &self,
+        catalog: &CatalogStore,
+        source_id: &str,
+        expected_revision: i64,
+        audit: AuditContext<'_>,
+    ) -> Result<CredentialMetadata, ProtocolError> {
+        let stored = required_stored_credential(catalog, source_id).await?;
+        if expected_revision != stored.revision {
+            return Err(revision_conflict());
+        }
+        let mut credential = StoredOpenApiCredentialV1::decode(&stored)?;
+        credential.credentials = OpenApiCredentialSet::default();
+        self.retire_unused_credential_origins(source_id, &mut credential)
+            .await?;
+        catalog
+            .put_credential(
+                source_id,
+                &credential.payload()?,
+                Some(stored.revision),
+                audit,
+            )
+            .await
+            .map_err(protocol_catalog_error)?;
+        self.credential_metadata(catalog, source_id).await
+    }
+
+    async fn retire_unused_credential_origins(
+        &self,
+        source_id: &str,
+        credential: &mut StoredOpenApiCredentialV1,
+    ) -> Result<(), ProtocolError> {
+        let static_keys = credential
+            .credentials
+            .schemes
+            .keys()
+            .cloned()
+            .collect::<BTreeSet<_>>();
+        let Some(oauth) = self.oauth.as_ref() else {
+            return Ok(());
+        };
+        let mut retained = BTreeSet::new();
+        for key in credential.credential_origins.keys() {
+            if static_keys.contains(key) {
+                continue;
+            }
+            if oauth
+                .binding(source_id, key)
+                .await
+                .map_err(openapi_oauth_prepare_error)?
+                .is_some()
+            {
+                retained.insert(key.clone());
+            }
+        }
+        credential
+            .credential_origins
+            .retain(|key, _| static_keys.contains(key) || retained.contains(key));
+        Ok(())
+    }
+
+    fn plan_invocation(
+        &self,
+        source_id: &str,
+        binding: &OpenApiBinding,
+        source_configuration: &Map<String, Value>,
+        stored: Option<&StoredCredential>,
+        arguments: &Value,
+        resolved_oauth: &BTreeMap<String, OAuthBinding>,
+    ) -> Result<PreparedOpenApiInvocation, ProtocolError> {
+        if binding.version != 1 {
+            return Err(ProtocolError::corrupt(
+                "unsupported_binding_schema",
+                "The stored OpenAPI tool binding schema is not supported.",
+            ));
+        }
+        let binding_url =
+            require_http_url(&binding.server_url).map_err(|_| invalid_tool_binding())?;
+        require_confidential_stored_url(&binding_url)?;
+        let configuration = OpenApiSourceConfigurationV1::decode(source_configuration)?;
+        let stored = stored.ok_or_else(|| {
+            ProtocolError::corrupt(
+                "source_credentials_missing",
+                "The source credential state is missing.",
+            )
+        })?;
+        let credential = StoredOpenApiCredentialV1::decode_for_invocation(stored)?;
+        let document_base_url = match &credential.locator {
+            StoredOpenApiLocatorV1::Inline => None,
+            StoredOpenApiLocatorV1::Url {
+                url,
+                document_base_url,
+            } => {
+                let locator_url = require_http_url(url).map_err(|_| {
+                    ProtocolError::corrupt(
+                        "invalid_source_credentials",
+                        "The stored OpenAPI credential state is invalid.",
+                    )
+                })?;
+                require_confidential_stored_url(&locator_url)?;
+                let document_base_url = require_http_url(document_base_url).map_err(|_| {
+                    ProtocolError::corrupt(
+                        "invalid_source_credentials",
+                        "The stored OpenAPI credential state is invalid.",
+                    )
+                })?;
+                require_confidential_stored_url(&document_base_url)?;
+                Some(document_base_url)
+            }
+        };
+        let mut invocation_credentials = credential.credentials.clone();
+        for scheme_name in resolved_oauth.keys() {
+            if !invocation_credentials.schemes.contains_key(scheme_name) {
+                invocation_credentials.schemes.insert(
+                    scheme_name.clone(),
+                    crate::openapi::OpenApiCredential::OAuthAccessToken {
+                        access_token: MANAGED_OAUTH_PLACEHOLDER.to_owned(),
+                    },
+                );
+            }
+        }
+        let mut protocol_request = build_protocol_request_with_base(
+            binding,
+            arguments,
+            &invocation_credentials,
+            document_base_url.as_ref(),
+        )
+        .map_err(invocation_error)?;
+        require_confidential_stored_url(&protocol_request.url)?;
+        verify_invocation_credential_origins(&credential, &protocol_request)?;
+        let managed = protocol_request
+            .selected_security_schemes
+            .iter()
+            .filter(|scheme_name| {
+                !credential.credentials.schemes.contains_key(*scheme_name)
+                    && resolved_oauth.contains_key(*scheme_name)
+            })
+            .cloned()
+            .collect::<Vec<_>>();
+        if managed.len() > 1 {
+            return Err(ProtocolError::corrupt(
+                "oauth_carrier_conflict",
+                "The OpenAPI operation requires conflicting managed OAuth credentials.",
+            ));
+        }
+        let oauth_authorization = match managed.first() {
+            Some(scheme_name) => {
+                let requirement =
+                    selected_security_requirement(binding, &protocol_request, scheme_name)
+                        .ok_or_else(|| {
+                            ProtocolError::corrupt(
+                                "invalid_tool_binding",
+                                "The stored OpenAPI tool binding is invalid.",
+                            )
+                        })?;
+                Some(PreparedOAuthAuthorization {
+                    source_id: source_id.to_owned(),
+                    scheme_name: scheme_name.clone(),
+                    required_scopes: requirement.scopes.clone(),
+                    expected_binding: resolved_oauth.get(scheme_name).cloned().ok_or_else(
+                        || {
+                            ProtocolError::corrupt(
+                                "invalid_oauth_binding",
+                                "The resolved OpenAPI OAuth binding is invalid.",
+                            )
+                        },
+                    )?,
+                })
+            }
+            None => None,
+        };
+        if oauth_authorization.is_some() {
+            protocol_request.headers.remove("authorization");
+        }
+        let method = Method::from_bytes(protocol_request.method.as_bytes()).map_err(|_| {
+            ProtocolError::corrupt(
+                "invalid_tool_binding",
+                "The stored OpenAPI tool binding is invalid.",
+            )
+        })?;
+        let mut request = OutboundRequest::new(method, protocol_request.url);
+        for (name, value) in protocol_request.headers {
+            let name = HeaderName::from_bytes(name.as_bytes()).map_err(|_| {
+                ProtocolError::corrupt(
+                    "invalid_tool_binding",
+                    "The stored OpenAPI tool binding is invalid.",
+                )
+            })?;
+            let value = HeaderValue::from_str(&value).map_err(|_| {
+                ProtocolError::new(
+                    ProtocolErrorCategory::InvalidInput,
+                    "invalid_tool_arguments",
+                    "The tool arguments are invalid.",
+                )
+            })?;
+            request.headers.insert(name, value);
+        }
+        request.body = protocol_request.body;
+        Ok(PreparedOpenApiInvocation {
+            request,
+            policy: OutboundPolicy {
+                allow_private_networks: configuration.allow_private_network,
+                require_https_or_loopback: true,
+                ..OutboundPolicy::default()
+            },
+            oauth_authorization,
+        })
+    }
+}
+
+fn openapi_oauth_error(error: OAuthError) -> OpenApiExecutionError {
+    OpenApiExecutionError::OAuth(error)
+}
+
+fn openapi_oauth_prepare_error(error: OAuthError) -> ProtocolError {
+    match error {
+        OAuthError::Validation { code, message } => {
+            ProtocolError::new(ProtocolErrorCategory::InvalidInput, code, message)
+        }
+        OAuthError::Conflict { code, message } => {
+            ProtocolError::new(ProtocolErrorCategory::Conflict, code, message)
+        }
+        OAuthError::NotFound => ProtocolError::new(
+            ProtocolErrorCategory::Conflict,
+            "oauth_connection_required",
+            "The OAuth connection must be configured before this operation can run.",
+        ),
+        OAuthError::Upstream { code } => ProtocolError::new(
+            ProtocolErrorCategory::Upstream,
+            code,
+            "The OAuth provider request failed.",
+        ),
+        OAuthError::UnauthorizedTransaction
+        | OAuthError::AuthorizationDenied { .. }
+        | OAuthError::Internal => ProtocolError::new(
+            ProtocolErrorCategory::Internal,
+            "oauth_internal_error",
+            "Managed OAuth could not be resolved safely.",
+        ),
+    }
+}
+
+fn oauth_binding_changed() -> ProtocolError {
+    ProtocolError::new(
+        ProtocolErrorCategory::Conflict,
+        "oauth_binding_changed",
+        "The OAuth connection changed before execution.",
+    )
+}
+
+fn may_have_dispatched(error: &crate::outbound::OutboundError) -> bool {
+    matches!(
+        error,
+        crate::outbound::OutboundError::Timeout
+            | crate::outbound::OutboundError::Request
+            | crate::outbound::OutboundError::ResponseHeadersTooLarge
+            | crate::outbound::OutboundError::ResponseBodyTooLarge
+            | crate::outbound::OutboundError::UnsupportedContentEncoding
+    )
+}
+
+fn response_data(headers: &HeaderMap, body: &[u8]) -> Value {
+    let content_type = headers
+        .get(header::CONTENT_TYPE)
+        .and_then(|value| value.to_str().ok())
+        .unwrap_or_default();
+    if (content_type.contains("/json") || content_type.contains("+json"))
+        && let Ok(value) = serde_json::from_slice(body)
+    {
+        value
+    } else if let Ok(value) = std::str::from_utf8(body) {
+        Value::String(value.to_owned())
+    } else {
+        json!({ "encoding": "base64", "data": STANDARD.encode(body) })
+    }
+}
+
+fn safe_response_headers(headers: &HeaderMap) -> BTreeMap<String, String> {
+    [
+        header::CONTENT_TYPE,
+        header::CONTENT_LENGTH,
+        header::RETRY_AFTER,
+    ]
+    .into_iter()
+    .filter_map(|name| {
+        headers
+            .get(&name)
+            .and_then(|value| value.to_str().ok())
+            .map(|value| (name.as_str().to_owned(), value.to_owned()))
+    })
+    .collect()
+}
+
+#[derive(Clone, Copy)]
+enum OriginInput {
+    Stored,
+    Untrusted,
+}
+
+fn bind_missing_credential_origins<'a>(
+    credential: &mut StoredOpenApiCredentialV1,
+    bindings: impl IntoIterator<Item = &'a OpenApiBinding>,
+    credential_keys: impl IntoIterator<Item = String>,
+    input: OriginInput,
+) -> Result<(), ProtocolError> {
+    if !matches!(&credential.locator, StoredOpenApiLocatorV1::Url { .. }) {
+        return Ok(());
+    }
+    let missing = credential_keys
+        .into_iter()
+        .filter(|key| !credential.credential_origins.contains_key(key))
+        .collect::<BTreeSet<_>>();
+    if missing.is_empty() {
+        return Ok(());
+    }
+    if credential
+        .credential_origins
+        .len()
+        .checked_add(missing.len())
+        .is_none_or(|count| count > MAX_BOUND_CREDENTIAL_SCHEMES)
+    {
+        return Err(origin_limit_error(input));
+    }
+    credential
+        .credential_origins
+        .extend(credential_origins_for_bindings(bindings, missing, input)?);
+    Ok(())
+}
+
+fn credential_origins_for_bindings<'a>(
+    bindings: impl IntoIterator<Item = &'a OpenApiBinding>,
+    credential_keys: impl IntoIterator<Item = String>,
+    input: OriginInput,
+) -> Result<BTreeMap<String, Vec<String>>, ProtocolError> {
+    let mut origins = credential_keys
+        .into_iter()
+        .map(|key| (key, BTreeSet::new()))
+        .collect::<BTreeMap<_, _>>();
+    if origins.len() > MAX_BOUND_CREDENTIAL_SCHEMES {
+        return Err(origin_limit_error(input));
+    }
+    for binding in bindings {
+        let matching = binding
+            .security
+            .iter()
+            .flat_map(|alternative| &alternative.requirements)
+            .map(|requirement| requirement.scheme_name.as_str())
+            .filter(|scheme_name| origins.contains_key(*scheme_name))
+            .collect::<BTreeSet<_>>();
+        if matching.is_empty() {
+            continue;
+        }
+        let server_url = require_http_url(&binding.server_url).map_err(|_| match input {
+            OriginInput::Stored => invalid_tool_binding(),
+            OriginInput::Untrusted => ProtocolError::new(
+                ProtocolErrorCategory::InvalidInput,
+                "invalid_openapi_document",
+                "The OpenAPI document contains an invalid server URL.",
+            ),
+        })?;
+        require_confidential_untrusted_url(&server_url)?;
+        let origin = normalized_http_origin(&binding.server_url).map_err(|_| match input {
+            OriginInput::Stored => ProtocolError::corrupt(
+                "invalid_tool_binding",
+                "The stored OpenAPI tool binding is invalid.",
+            ),
+            OriginInput::Untrusted => ProtocolError::new(
+                ProtocolErrorCategory::InvalidInput,
+                "invalid_openapi_document",
+                "The OpenAPI document contains an invalid server URL.",
+            ),
+        })?;
+        for scheme_name in matching {
+            let destinations = origins
+                .get_mut(scheme_name)
+                .expect("the matching credential key came from the destination map");
+            destinations.insert(origin.clone());
+            if destinations.len() > MAX_CREDENTIAL_ORIGINS_PER_SCHEME {
+                return Err(origin_limit_error(input));
+            }
+        }
+    }
+    Ok(origins
+        .into_iter()
+        .map(|(key, origins)| (key, origins.into_iter().collect()))
+        .collect())
+}
+
+fn verify_refresh_credential_origins(
+    credential: &StoredOpenApiCredentialV1,
+    compiled: &CompiledOpenApi,
+) -> Result<(), ProtocolError> {
+    verify_candidate_credential_origins(credential, compiled.tools.iter().map(|tool| &tool.binding))
+}
+
+fn verify_candidate_credential_origins<'a>(
+    credential: &StoredOpenApiCredentialV1,
+    bindings: impl IntoIterator<Item = &'a OpenApiBinding>,
+) -> Result<(), ProtocolError> {
+    if !matches!(&credential.locator, StoredOpenApiLocatorV1::Url { .. }) {
+        return Ok(());
+    }
+    for key in credential.credentials.schemes.keys() {
+        if !credential.credential_origins.contains_key(key) {
+            return Err(unbound_credential_origin());
+        }
+    }
+    let candidates = credential_origins_for_bindings(
+        bindings,
+        credential.credential_origins.keys().cloned(),
+        OriginInput::Untrusted,
+    )?;
+    for (scheme_name, destinations) in candidates {
+        let allowed = credential
+            .credential_origins
+            .get(&scheme_name)
+            .ok_or_else(unbound_credential_origin)?;
+        if destinations
+            .iter()
+            .any(|destination| allowed.binary_search(destination).is_err())
+        {
+            return Err(changed_credential_origin());
+        }
+    }
+    Ok(())
+}
+
+fn verify_invocation_credential_origins(
+    credential: &StoredOpenApiCredentialV1,
+    request: &crate::openapi::OpenApiProtocolRequest,
+) -> Result<(), ProtocolError> {
+    if !matches!(&credential.locator, StoredOpenApiLocatorV1::Url { .. })
+        || request.selected_security_schemes.is_empty()
+    {
+        return Ok(());
+    }
+    let destination = request.url.origin().ascii_serialization();
+    for scheme_name in &request.selected_security_schemes {
+        let allowed = credential
+            .credential_origins
+            .get(scheme_name)
+            .ok_or_else(unbound_credential_origin)?;
+        if allowed.binary_search(&destination).is_err() {
+            return Err(changed_credential_origin());
+        }
+    }
+    Ok(())
+}
+
+fn normalized_http_origin(value: &str) -> Result<String, crate::outbound::OutboundError> {
+    Ok(require_http_url(value)?.origin().ascii_serialization())
+}
+
+fn origin_limit_error(input: OriginInput) -> ProtocolError {
+    match input {
+        OriginInput::Stored => invalid_stored_credentials(),
+        OriginInput::Untrusted => ProtocolError::new(
+            ProtocolErrorCategory::InvalidInput,
+            "openapi_credential_origin_limit_exceeded",
+            "The OpenAPI document declares too many credential destinations.",
+        ),
+    }
+}
+
+fn unbound_credential_origin() -> ProtocolError {
+    ProtocolError::new(
+        ProtocolErrorCategory::Conflict,
+        "openapi_credential_origin_unbound",
+        "The OpenAPI credential destination is not bound. Save the credential again before use.",
+    )
+}
+
+fn changed_credential_origin() -> ProtocolError {
+    ProtocolError::new(
+        ProtocolErrorCategory::Conflict,
+        "openapi_credential_origin_changed",
+        "The OpenAPI refresh changed a credential destination origin.",
+    )
+}
+
+fn invalid_stored_credentials() -> ProtocolError {
+    ProtocolError::corrupt(
+        "invalid_source_credentials",
+        "The stored OpenAPI credential state is invalid.",
+    )
+}
+
+async fn stored_openapi_bindings(
+    catalog: &CatalogStore,
+    source_id: &str,
+) -> Result<Vec<OpenApiBinding>, ProtocolError> {
+    let rows = sqlx::query_as::<_, (i64, String)>(
+        "SELECT tool_bindings.binding_version, tool_bindings.definition_json \
+         FROM tool_bindings JOIN tools ON tools.id = tool_bindings.tool_id \
+         WHERE tools.source_id = ? AND tools.present = 1 \
+         AND tool_bindings.protocol = 'openapi' ORDER BY tools.stable_key",
+    )
+    .bind(source_id)
+    .fetch_all(catalog.pool())
+    .await
+    .map_err(|_| internal_storage_error())?;
+    rows.into_iter()
+        .map(|(version, definition)| {
+            let binding: OpenApiBinding =
+                serde_json::from_str(&definition).map_err(|_| invalid_tool_binding())?;
+            if version != 1 || binding.version != 1 {
+                return Err(invalid_tool_binding());
+            }
+            let server_url =
+                require_http_url(&binding.server_url).map_err(|_| invalid_tool_binding())?;
+            require_confidential_untrusted_url(&server_url)?;
+            Ok(binding)
+        })
+        .collect()
+}
+
+fn invalid_tool_binding() -> ProtocolError {
+    ProtocolError::corrupt(
+        "invalid_tool_binding",
+        "The stored OpenAPI tool binding is invalid.",
+    )
+}
+
+struct FetchedSpec {
+    compiled: CompiledOpenApi,
+    locator: StoredOpenApiLocatorV1,
+}
+
+async fn fetch_and_compile(
+    spec: &OpenApiSpecInput,
+    allow_private_network: bool,
+) -> Result<FetchedSpec, ProtocolError> {
+    match spec {
+        OpenApiSpecInput::Inline { content } => {
+            if content.len() > MAX_SPEC_BYTES {
+                return Err(ProtocolError::new(
+                    ProtocolErrorCategory::InvalidInput,
+                    "openapi_document_too_large",
+                    "The OpenAPI document exceeds the allowed size.",
+                ));
+            }
+            let compiled = compile_bytes(content.as_bytes().to_vec()).await?;
+            validate_inline_operation_transports(&compiled)?;
+            Ok(FetchedSpec {
+                compiled,
+                locator: StoredOpenApiLocatorV1::Inline,
+            })
+        }
+        OpenApiSpecInput::Url { url } => fetch_url(url, allow_private_network).await,
+    }
+}
+
+fn validate_inline_operation_transports(compiled: &CompiledOpenApi) -> Result<(), ProtocolError> {
+    for tool in &compiled.tools {
+        let url = require_http_url(&tool.binding.server_url).map_err(|_| {
+            ProtocolError::new(
+                ProtocolErrorCategory::InvalidInput,
+                "inline_openapi_server_required",
+                "Inline OpenAPI documents must define an absolute HTTP or HTTPS server URL.",
+            )
+        })?;
+        require_confidential_untrusted_url(&url)?;
+    }
+    Ok(())
+}
+
+async fn fetch_url(url: &str, allow_private_network: bool) -> Result<FetchedSpec, ProtocolError> {
+    let policy = OutboundPolicy {
+        allow_private_networks: allow_private_network,
+        require_https_or_loopback: true,
+        max_response_bytes: MAX_SPEC_BYTES,
+        ..OutboundPolicy::default()
+    };
+    let transport_url =
+        Url::parse(url).map_err(|_| protocol_outbound_error(OutboundError::InvalidUrl))?;
+    require_confidential_untrusted_url(&transport_url)?;
+    let url = parse_url(url, &policy).map_err(protocol_outbound_error)?;
+    let response = HardenedHttpClient::new(policy)
+        .fetch_spec_with_url_policy(url.clone(), HeaderMap::new(), |candidate| {
+            if is_confidential_openapi_url(candidate) {
+                Ok(())
+            } else {
+                Err(OutboundError::RedirectDowngrade)
+            }
+        })
+        .await
+        .map_err(|error| match error {
+            OutboundError::RedirectDowngrade | OutboundError::InsecureTransport => {
+                insecure_openapi_transport(ProtocolErrorCategory::InvalidInput)
+            }
+            error => protocol_outbound_error(error),
+        })?;
+    require_confidential_untrusted_url(&response.final_url)?;
+    let mut compiled = compile_bytes(response.body).await?;
+    let mut document_base_url = response.final_url.clone();
+    document_base_url.set_query(None);
+    document_base_url.set_fragment(None);
+    for tool in &mut compiled.tools {
+        tool.binding.server_url =
+            resolved_document_server_url(&document_base_url, &tool.binding.server_url)?;
+    }
+    Ok(FetchedSpec {
+        compiled,
+        locator: StoredOpenApiLocatorV1::Url {
+            url: url.to_string(),
+            document_base_url: document_base_url.to_string(),
+        },
+    })
+}
+
+fn resolved_document_server_url(
+    document_base_url: &Url,
+    server_url: &str,
+) -> Result<String, ProtocolError> {
+    let resolved = document_base_url.join(server_url).map_err(|_| {
+        ProtocolError::new(
+            ProtocolErrorCategory::InvalidInput,
+            "invalid_openapi_document",
+            "The OpenAPI document contains an invalid server URL.",
+        )
+    })?;
+    if !matches!(resolved.scheme(), "http" | "https")
+        || !resolved.username().is_empty()
+        || resolved.password().is_some()
+        || resolved.query().is_some()
+        || resolved.fragment().is_some()
+    {
+        return Err(ProtocolError::new(
+            ProtocolErrorCategory::InvalidInput,
+            "invalid_openapi_document",
+            "The OpenAPI document contains an invalid server URL.",
+        ));
+    }
+    require_confidential_untrusted_url(&resolved)?;
+    Ok(resolved.to_string())
+}
+
+async fn compile_bytes(bytes: Vec<u8>) -> Result<CompiledOpenApi, ProtocolError> {
+    tokio::task::spawn_blocking(move || compile_document(&bytes))
+        .await
+        .map_err(|_| internal_compile_error())?
+        .map_err(openapi_error)
+}
+
+fn source_configuration(
+    spec: &OpenApiSpecInput,
+    allow_private_network: bool,
+) -> Result<Map<String, Value>, ProtocolError> {
+    let spec = match spec {
+        OpenApiSpecInput::Inline { .. } => StoredOpenApiSpecV1::Inline,
+        OpenApiSpecInput::Url { url } => {
+            let mut display = require_http_url(url).map_err(protocol_outbound_error)?;
+            display.set_query(None);
+            StoredOpenApiSpecV1::Url {
+                display_url: display.to_string(),
+            }
+        }
+    };
+    OpenApiSourceConfigurationV1 {
+        spec,
+        allow_private_network,
+    }
+    .encode()
+}
+
+fn initial_catalog_snapshot(compiled: &CompiledOpenApi) -> InitialCatalogSnapshot {
+    InitialCatalogSnapshot {
+        artifacts: staged_artifacts(compiled),
+        tools: staged_tools(compiled),
+    }
+}
+
+fn catalog_snapshot(
+    compiled: &CompiledOpenApi,
+    source_revision: i64,
+    credential_revision: i64,
+) -> CatalogSnapshot {
+    CatalogSnapshot {
+        expected_source_revision: source_revision,
+        expected_credential_revision: Some(credential_revision),
+        artifacts: staged_artifacts(compiled),
+        tools: staged_tools(compiled),
+    }
+}
+
+fn staged_tools(compiled: &CompiledOpenApi) -> Vec<StagedTool> {
+    compiled
+        .tools
+        .iter()
+        .map(|tool| StagedTool {
+            stable_key: tool.stable_key.clone(),
+            preferred_name: tool.preferred_name.clone(),
+            display_name: tool.display_name.clone(),
+            description: tool.description.clone(),
+            input_schema: tool.input_schema.clone(),
+            output_schema: tool.output_schema.clone(),
+            input_typescript: None,
+            output_typescript: None,
+            typescript_definitions: BTreeMap::new(),
+            intrinsic_mode: tool.intrinsic_mode,
+        })
+        .collect()
+}
+
+fn staged_bindings(compiled: &CompiledOpenApi) -> Vec<StagedToolBinding> {
+    compiled
+        .tools
+        .iter()
+        .map(|tool| StagedToolBinding {
+            stable_key: tool.stable_key.clone(),
+            binding: ToolBinding::OpenapiV1(tool.binding.clone()),
+        })
+        .collect()
+}
+
+fn staged_artifacts(compiled: &CompiledOpenApi) -> Vec<StagedArtifact> {
+    vec![StagedArtifact {
+        kind: ArtifactKind::OpenapiDocument,
+        stable_key: "document".to_owned(),
+        content: compiled.document.clone(),
+    }]
+}
+
+fn preview_response(compiled: CompiledOpenApi) -> OpenApiPreview {
+    let tool_count = compiled.tools.len();
+    let mut security_schemes = BTreeMap::new();
+    for tool in &compiled.tools {
+        for alternative in &tool.binding.security {
+            for requirement in &alternative.requirements {
+                security_schemes
+                    .entry(requirement.scheme_name.clone())
+                    .or_insert_with(|| preview_security_scheme(requirement));
+            }
+        }
+    }
+    OpenApiPreview {
+        title: compiled.title,
+        description: compiled.description,
+        tool_count,
+        tools: compiled
+            .tools
+            .into_iter()
+            .map(|tool| OpenApiPreviewTool {
+                preferred_name: tool.preferred_name,
+                display_name: tool.display_name,
+                description: tool.description,
+                intrinsic_mode: tool.intrinsic_mode,
+                security: tool
+                    .binding
+                    .security
+                    .into_iter()
+                    .map(|alternative| {
+                        alternative
+                            .requirements
+                            .into_iter()
+                            .map(|requirement| requirement.scheme_name)
+                            .collect()
+                    })
+                    .collect(),
+            })
+            .collect(),
+        security_schemes: security_schemes.into_values().collect(),
+    }
+}
+
+fn preview_security_scheme(
+    requirement: &OpenApiSecurityRequirement,
+) -> OpenApiPreviewSecurityScheme {
+    let (credential_type, placement, supported) = match &requirement.scheme {
+        OpenApiSecurityScheme::ApiKey { location, .. } => (
+            "api_key",
+            Some(match location {
+                OpenApiParameterLocation::Header => "header",
+                OpenApiParameterLocation::Query => "query",
+                OpenApiParameterLocation::Cookie => "cookie",
+                OpenApiParameterLocation::Path => "path",
+            }),
+            *location != OpenApiParameterLocation::Path,
+        ),
+        OpenApiSecurityScheme::Http { scheme, .. } if scheme == "bearer" => {
+            ("bearer", Some("header"), true)
+        }
+        OpenApiSecurityScheme::Http { scheme, .. } if scheme == "basic" => {
+            ("basic", Some("header"), true)
+        }
+        OpenApiSecurityScheme::Http { .. } => ("http", Some("header"), false),
+        OpenApiSecurityScheme::OAuth2 | OpenApiSecurityScheme::OpenIdConnect { .. } => {
+            ("manual_oauth_access_token", Some("header"), true)
+        }
+        OpenApiSecurityScheme::MutualTls => ("mutual_tls", None, false),
+    };
+    OpenApiPreviewSecurityScheme {
+        name: requirement.scheme_name.clone(),
+        credential_type,
+        placement,
+        supported,
+        oauth_flows: requirement.oauth_flows.clone(),
+    }
+}
+
+async fn required_stored_credential(
+    catalog: &CatalogStore,
+    source_id: &str,
+) -> Result<StoredCredential, ProtocolError> {
+    catalog
+        .credential(source_id)
+        .await
+        .map_err(protocol_catalog_error)?
+        .ok_or_else(|| {
+            ProtocolError::corrupt(
+                "source_credentials_missing",
+                "The source credential state is missing.",
+            )
+        })
+}
+
+async fn stored_openapi_document(
+    catalog: &CatalogStore,
+    source_id: &str,
+) -> Result<String, ProtocolError> {
+    sqlx::query_scalar::<_, String>(
+        "SELECT content_json FROM source_artifacts WHERE source_id = ? \
+         AND artifact_kind = 'openapi_document' AND stable_key = 'document'",
+    )
+    .bind(source_id)
+    .fetch_optional(catalog.pool())
+    .await
+    .map_err(|_| internal_storage_error())?
+    .ok_or_else(|| {
+        ProtocolError::new(
+            ProtocolErrorCategory::Conflict,
+            "source_artifact_missing",
+            "The source has no OpenAPI document.",
+        )
+    })
+}
+
+fn managed_oauth_options(
+    compiled: &CompiledOpenApi,
+) -> Result<Vec<OpenApiManagedOAuthOption>, ProtocolError> {
+    let mut options = BTreeMap::<String, std::collections::BTreeSet<String>>::new();
+    for requirement in compiled
+        .tools
+        .iter()
+        .flat_map(|tool| &tool.binding.security)
+        .flat_map(|alternative| &alternative.requirements)
+    {
+        if !matches!(requirement.scheme, OpenApiSecurityScheme::OAuth2) {
+            continue;
+        }
+        let Some(flow) = requirement
+            .oauth_flows
+            .as_ref()
+            .and_then(|flows| flows.authorization_code.as_ref())
+        else {
+            continue;
+        };
+        if requirement.scheme_name.is_empty()
+            || requirement.scheme_name.len() > MAX_MANAGED_OAUTH_KEY_BYTES
+            || requirement.scheme_name.chars().any(char::is_control)
+        {
+            return Err(ProtocolError::new(
+                ProtocolErrorCategory::InvalidInput,
+                "invalid_oauth_credential_key",
+                "An OpenAPI managed OAuth credential key is invalid.",
+            ));
+        }
+        if !options.contains_key(&requirement.scheme_name)
+            && options.len() >= MAX_MANAGED_OAUTH_OPTIONS
+        {
+            return Err(ProtocolError::new(
+                ProtocolErrorCategory::InvalidInput,
+                "openapi_oauth_scheme_limit_exceeded",
+                "The OpenAPI document declares too many managed OAuth schemes.",
+            ));
+        }
+        let scopes = options.entry(requirement.scheme_name.clone()).or_default();
+        for scope in &requirement.scopes {
+            if !flow.scopes.contains_key(scope)
+                || scope.is_empty()
+                || scope.len() > MAX_MANAGED_OAUTH_SCOPE_BYTES
+                || !scope
+                    .bytes()
+                    .all(|byte| matches!(byte, 0x21 | 0x23..=0x5b | 0x5d..=0x7e))
+            {
+                return Err(ProtocolError::new(
+                    ProtocolErrorCategory::InvalidInput,
+                    "invalid_oauth_scopes",
+                    "An OpenAPI managed OAuth scope is invalid.",
+                ));
+            }
+            if !scopes.contains(scope) && scopes.len() >= MAX_MANAGED_OAUTH_SCOPES {
+                return Err(ProtocolError::new(
+                    ProtocolErrorCategory::InvalidInput,
+                    "openapi_oauth_scope_limit_exceeded",
+                    "An OpenAPI managed OAuth scheme declares too many scopes.",
+                ));
+            }
+            scopes.insert(scope.clone());
+        }
+    }
+    Ok(options
+        .into_iter()
+        .map(|(credential_key, scopes)| OpenApiManagedOAuthOption {
+            credential_key,
+            scopes: scopes.into_iter().collect(),
+        })
+        .collect())
+}
+
+fn managed_oauth_supported(requirement: &OpenApiSecurityRequirement) -> bool {
+    matches!(requirement.scheme, OpenApiSecurityScheme::OAuth2)
+        && requirement
+            .oauth_flows
+            .as_ref()
+            .is_some_and(|flows| flows.authorization_code.is_some())
+}
+
+fn selected_security_requirement<'a>(
+    binding: &'a OpenApiBinding,
+    request: &crate::openapi::OpenApiProtocolRequest,
+    scheme_name: &str,
+) -> Option<&'a OpenApiSecurityRequirement> {
+    binding
+        .security
+        .iter()
+        .find(|alternative| {
+            alternative.requirements.len() == request.selected_security_schemes.len()
+                && alternative
+                    .requirements
+                    .iter()
+                    .zip(&request.selected_security_schemes)
+                    .all(|(requirement, selected)| requirement.scheme_name == *selected)
+        })?
+        .requirements
+        .iter()
+        .find(|requirement| requirement.scheme_name == scheme_name)
+}
+
+fn credential_metadata(revision: i64, stored: StoredOpenApiCredentialV1) -> CredentialMetadata {
+    CredentialMetadata {
+        revision,
+        configured_schemes: stored
+            .credentials
+            .schemes
+            .into_iter()
+            .map(|(name, credential)| ConfiguredCredential {
+                name,
+                credential_type: credential.credential_type(),
+            })
+            .collect(),
+    }
+}
+
+fn validate_input_credentials(credentials: &OpenApiCredentialSet) -> Result<(), ProtocolError> {
+    credentials.validate().map_err(|error| match error {
+        crate::openapi::OpenApiCredentialError::InvalidBasicUsername => ProtocolError::new(
+            ProtocolErrorCategory::InvalidInput,
+            "invalid_basic_username",
+            "An HTTP Basic username must not contain a colon.",
+        ),
+        crate::openapi::OpenApiCredentialError::InvalidBasicValue => ProtocolError::new(
+            ProtocolErrorCategory::InvalidInput,
+            "invalid_basic_credentials",
+            "HTTP Basic credentials must not contain control characters.",
+        ),
+        _ => ProtocolError::new(
+            ProtocolErrorCategory::InvalidInput,
+            "invalid_credentials",
+            "The static credential configuration is invalid.",
+        ),
+    })
+}
+
+fn invocation_error(error: OpenApiInvocationError) -> ProtocolError {
+    match error {
+        OpenApiInvocationError::InvalidArguments | OpenApiInvocationError::InvalidArgument(_) => {
+            ProtocolError::new(
+                ProtocolErrorCategory::InvalidInput,
+                "invalid_tool_arguments",
+                "The tool arguments are invalid.",
+            )
+        }
+        OpenApiInvocationError::MissingArgument(_) => ProtocolError::new(
+            ProtocolErrorCategory::InvalidInput,
+            "missing_tool_argument",
+            "A required tool argument is missing.",
+        ),
+        OpenApiInvocationError::UnsatisfiedSecurity => ProtocolError::new(
+            ProtocolErrorCategory::InvalidInput,
+            "missing_source_credentials",
+            "No configured credential satisfies this operation.",
+        ),
+        OpenApiInvocationError::InvalidCredential(_) => ProtocolError::new(
+            ProtocolErrorCategory::InvalidInput,
+            "unsupported_authentication",
+            "This operation requires an authentication method that is not configured.",
+        ),
+        OpenApiInvocationError::InvalidCredentialConfiguration => ProtocolError::corrupt(
+            "invalid_source_credentials",
+            "The stored OpenAPI credential state is invalid.",
+        ),
+        OpenApiInvocationError::InvalidHeader(_) => ProtocolError::new(
+            ProtocolErrorCategory::InvalidInput,
+            "forbidden_tool_header",
+            "Tool arguments cannot set a protected HTTP header.",
+        ),
+        OpenApiInvocationError::InvalidUrl => ProtocolError::corrupt(
+            "invalid_openapi_server",
+            "The OpenAPI operation has no usable server URL.",
+        ),
+    }
+}
+
+fn openapi_error(error: OpenApiError) -> ProtocolError {
+    let code = match &error {
+        OpenApiError::Parse => "invalid_openapi_document",
+        OpenApiError::UnsupportedVersion => "unsupported_openapi_version",
+        OpenApiError::ExternalReference(_) => "external_reference_unsupported",
+        OpenApiError::ReferenceNotFound(_) => "openapi_reference_not_found",
+        OpenApiError::ReferenceCycle(_) => "openapi_reference_cycle",
+        OpenApiError::ReferenceDepth => "openapi_reference_depth",
+        OpenApiError::LimitExceeded { code } => code,
+        OpenApiError::InvalidDocument(_) | OpenApiError::InvalidOperation { .. } => {
+            "invalid_openapi_document"
+        }
+    };
+    ProtocolError::new(ProtocolErrorCategory::InvalidInput, code, error.to_string())
+}
+
+fn require_http_url(value: &str) -> Result<Url, crate::outbound::OutboundError> {
+    let url = Url::parse(value).map_err(|_| crate::outbound::OutboundError::InvalidUrl)?;
+    if !matches!(url.scheme(), "http" | "https") {
+        return Err(crate::outbound::OutboundError::UnsupportedScheme);
+    }
+    if url.host().is_none() {
+        return Err(crate::outbound::OutboundError::MissingHost);
+    }
+    if !url.username().is_empty() || url.password().is_some() {
+        return Err(crate::outbound::OutboundError::CredentialsNotAllowed);
+    }
+    if url.fragment().is_some() {
+        return Err(crate::outbound::OutboundError::FragmentNotAllowed);
+    }
+    Ok(url)
+}
+
+fn is_confidential_openapi_url(url: &Url) -> bool {
+    match url.scheme() {
+        "https" => url.host().is_some(),
+        "http" => match url.host() {
+            Some(url::Host::Domain(domain)) => domain.eq_ignore_ascii_case("localhost"),
+            Some(url::Host::Ipv4(address)) => address.is_loopback(),
+            Some(url::Host::Ipv6(address)) => address.is_loopback(),
+            None => false,
+        },
+        _ => false,
+    }
+}
+
+fn require_confidential_untrusted_url(url: &Url) -> Result<(), ProtocolError> {
+    if is_confidential_openapi_url(url) {
+        Ok(())
+    } else {
+        Err(insecure_openapi_transport(
+            ProtocolErrorCategory::InvalidInput,
+        ))
+    }
+}
+
+fn require_confidential_stored_url(url: &Url) -> Result<(), ProtocolError> {
+    if is_confidential_openapi_url(url) {
+        Ok(())
+    } else {
+        Err(insecure_openapi_transport(ProtocolErrorCategory::Conflict))
+    }
+}
+
+fn insecure_openapi_transport(category: ProtocolErrorCategory) -> ProtocolError {
+    ProtocolError::new(
+        category,
+        "insecure_openapi_transport",
+        "OpenAPI URLs must use HTTPS, except for loopback HTTP endpoints.",
+    )
+}
+
+fn revision_conflict() -> ProtocolError {
+    ProtocolError::new(
+        ProtocolErrorCategory::Conflict,
+        "revision_conflict",
+        "The source changed. Refresh and retry the update.",
+    )
+}
+
+fn internal_storage_error() -> ProtocolError {
+    ProtocolError::new(
+        ProtocolErrorCategory::Internal,
+        "internal_error",
+        "The protocol operation could not be completed.",
+    )
+}
+
+fn internal_compile_error() -> ProtocolError {
+    ProtocolError::new(
+        ProtocolErrorCategory::Internal,
+        "openapi_compiler_failed",
+        "The OpenAPI document could not be compiled.",
+    )
+}
+
+fn internal_encoding_error(_error: serde_json::Error) -> ProtocolError {
+    ProtocolError::new(
+        ProtocolErrorCategory::Internal,
+        "internal_error",
+        "The protocol operation could not be completed.",
+    )
+}
+
+#[cfg(test)]
+mod tests {
+    use std::collections::BTreeMap;
+
+    use reqwest::header::{
+        AUTHORIZATION, CONTENT_LENGTH, CONTENT_TYPE, HeaderMap, HeaderValue, RETRY_AFTER,
+        SET_COOKIE,
+    };
+    use serde_json::json;
+    use sqlx::sqlite::SqlitePoolOptions;
+    use tokio::{
+        io::{AsyncReadExt, AsyncWriteExt},
+        net::TcpListener,
+        time::{Duration, timeout},
+    };
+    use url::Url;
+
+    use super::{
+        OpenApiAdapter, OpenApiSourceConfigurationV1, StoredOpenApiCredentialV1,
+        StoredOpenApiLocatorV1, is_confidential_openapi_url, normalized_http_origin, response_data,
+        safe_response_headers, verify_candidate_credential_origins,
+    };
+    use crate::{
+        catalog::{CredentialPayload, StoredCredential},
+        crypto::Keyring,
+        oauth::{
+            OAuthBinding, OAuthService,
+            model::{
+                OAuthClientAuthentication, OAuthClientSecretUpdate, OAuthConnectionConfig,
+                OAuthSecretSet,
+            },
+            store::OAuthStore,
+        },
+        openapi::{
+            OpenApiBinding, OpenApiCredential, OpenApiCredentialSet, OpenApiSecurityAlternative,
+            OpenApiSecurityRequirement, OpenApiSecurityScheme, compile_document,
+        },
+        outbound::{HardenedHttpClient, OutboundPolicy},
+        protocols::ProtocolErrorCategory,
+    };
+
+    fn origin_binding(server_url: &str, scheme_name: &str) -> OpenApiBinding {
+        OpenApiBinding {
+            version: 1,
+            method: "GET".to_owned(),
+            path_template: "/credential".to_owned(),
+            server_url: server_url.to_owned(),
+            parameters: Vec::new(),
+            request_body: None,
+            security: vec![OpenApiSecurityAlternative {
+                requirements: vec![OpenApiSecurityRequirement {
+                    scheme_name: scheme_name.to_owned(),
+                    scopes: Vec::new(),
+                    scheme: OpenApiSecurityScheme::Http {
+                        scheme: "bearer".to_owned(),
+                        bearer_format: None,
+                    },
+                    oauth_flows: None,
+                }],
+            }],
+        }
+    }
+
+    struct ManagedAlternativeFixture {
+        adapter: OpenApiAdapter,
+        oauth: OAuthService,
+        store: OAuthStore,
+        pool: sqlx::SqlitePool,
+        binding: OpenApiBinding,
+        configuration: serde_json::Map<String, serde_json::Value>,
+        stored: StoredCredential,
+        expected: Vec<OAuthBinding>,
+        config: OAuthConnectionConfig,
+        first_connection_revision: i64,
+    }
+
+    async fn managed_alternative_fixture() -> ManagedAlternativeFixture {
+        let pool = SqlitePoolOptions::new()
+            .max_connections(1)
+            .connect("sqlite::memory:")
+            .await
+            .expect("test database opens");
+        sqlx::migrate!("./migrations")
+            .run(&pool)
+            .await
+            .expect("migrations apply");
+        sqlx::query(
+            "INSERT INTO sources (
+                id, kind, slug, display_name, configuration_json, health_status,
+                revision, catalog_revision, created_at, updated_at
+             ) VALUES (?, 'openapi', 'alternatives', 'Alternatives', ?, 'unknown', 0, 0, 1, 1)",
+        )
+        .bind("source-alternatives")
+        .bind(r#"{"spec":{"type":"inline"},"allowPrivateNetwork":false}"#)
+        .execute(&pool)
+        .await
+        .expect("source inserts");
+        let keyring = Keyring::from_master_key([57; 32]).expect("test keyring");
+        let store = OAuthStore::new(pool.clone(), keyring.clone());
+        let config = OAuthConnectionConfig {
+            issuer: "https://auth.example.test".to_owned(),
+            authorization_endpoint: "https://auth.example.test/authorize".to_owned(),
+            token_endpoint: "https://auth.example.test/token".to_owned(),
+            client_id: "client".to_owned(),
+            client_authentication: OAuthClientAuthentication::None,
+            token_endpoint_auth_methods_supported: vec!["none".to_owned()],
+            scopes: vec!["read".to_owned()],
+            allow_private_network: false,
+            resource: None,
+        };
+        let secrets = |token: &str| OAuthSecretSet {
+            access_token: Some(token.to_owned()),
+            token_type: Some("Bearer".to_owned()),
+            granted_scopes: vec!["read".to_owned()],
+            access_token_expires_at: Some(i64::MAX),
+            ..OAuthSecretSet::default()
+        };
+        let first = store
+            .create_connection(
+                "source-alternatives",
+                "oauthA",
+                &config,
+                Some(&secrets("token-a")),
+                1,
+            )
+            .await
+            .expect("first OAuth connection inserts");
+        store
+            .create_connection(
+                "source-alternatives",
+                "oauthB",
+                &config,
+                Some(&secrets("token-b")),
+                1,
+            )
+            .await
+            .expect("second OAuth connection inserts");
+        let oauth = OAuthService::new(
+            pool.clone(),
+            keyring,
+            "http://127.0.0.1:4788".to_owned(),
+            OutboundPolicy::default(),
+        );
+        let expected = oauth
+            .bindings_for_source("source-alternatives")
+            .await
+            .expect("approval OAuth snapshot reads");
+        let document = json!({
+            "openapi": "3.1.0",
+            "info": { "title": "Managed alternatives" },
+            "servers": [{ "url": "https://api.example.test" }],
+            "components": { "securitySchemes": {
+                "oauthA": { "type": "oauth2", "flows": { "authorizationCode": {
+                    "authorizationUrl": "https://auth.example.test/authorize",
+                    "tokenUrl": "https://auth.example.test/token",
+                    "scopes": { "read": "Read" }
+                }}},
+                "oauthB": { "type": "oauth2", "flows": { "authorizationCode": {
+                    "authorizationUrl": "https://auth.example.test/authorize",
+                    "tokenUrl": "https://auth.example.test/token",
+                    "scopes": { "read": "Read" }
+                }}}
+            }},
+            "paths": { "/items": { "get": {
+                "security": [{ "oauthA": ["read"] }, { "oauthB": ["read"] }],
+                "responses": { "200": { "description": "ok" } }
+            }}}
+        });
+        let binding = compile_document(&serde_json::to_vec(&document).unwrap())
+            .expect("OAuth alternatives compile")
+            .tools
+            .remove(0)
+            .binding;
+        ManagedAlternativeFixture {
+            adapter: OpenApiAdapter::with_oauth(oauth.clone()),
+            oauth,
+            store,
+            pool,
+            binding,
+            configuration: json!({
+                "spec": { "type": "inline" },
+                "allowPrivateNetwork": false
+            })
+            .as_object()
+            .unwrap()
+            .clone(),
+            stored: StoredCredential {
+                revision: 1,
+                credential: CredentialPayload {
+                    schema_version: 1,
+                    payload: json!({
+                        "locator": { "type": "inline" },
+                        "credentials": { "schemes": {} }
+                    }),
+                },
+            },
+            expected,
+            config,
+            first_connection_revision: first.connection.revision,
+        }
+    }
+
+    #[test]
+    fn credential_origin_normalization_covers_default_ports_idna_case_and_ipv6() {
+        assert_eq!(
+            normalized_http_origin("HTTPS://EXAMPLE.COM:443/v1").unwrap(),
+            "https://example.com"
+        );
+        assert_eq!(
+            normalized_http_origin("https://bücher.example/v1").unwrap(),
+            "https://xn--bcher-kva.example"
+        );
+        assert_eq!(
+            normalized_http_origin("http://[2001:db8::1]:80/v1").unwrap(),
+            "http://[2001:db8::1]"
+        );
+        assert_eq!(
+            normalized_http_origin("https://example.com:8443/v1").unwrap(),
+            "https://example.com:8443"
+        );
+    }
+
+    #[test]
+    fn confidential_transport_allows_https_and_only_loopback_http() {
+        for allowed in [
+            "https://api.example.test/v1",
+            "http://localhost:8080/v1",
+            "http://127.0.0.1/v1",
+            "http://127.255.10.20/v1",
+            "http://[::1]:8080/v1",
+        ] {
+            assert!(
+                is_confidential_openapi_url(&Url::parse(allowed).expect("allowed URL parses")),
+                "{allowed} should be confidential"
+            );
+        }
+        for rejected in [
+            "http://example.com/v1",
+            "http://10.0.0.1/v1",
+            "http://192.168.1.10/v1",
+            "http://[fd00::1]/v1",
+            "http://[::]/v1",
+            "http://localhost.example/v1",
+        ] {
+            assert!(
+                !is_confidential_openapi_url(&Url::parse(rejected).expect("rejected URL parses")),
+                "{rejected} should be rejected"
+            );
+        }
+    }
+
+    #[test]
+    fn credential_origins_are_compared_per_scheme_and_unused_keys_bind_empty() {
+        let credential = StoredOpenApiCredentialV1 {
+            locator: StoredOpenApiLocatorV1::Url {
+                url: "https://spec.example/openapi.json".to_owned(),
+                document_base_url: "https://spec.example/openapi.json".to_owned(),
+            },
+            credentials: OpenApiCredentialSet {
+                schemes: [(
+                    "unused".to_owned(),
+                    OpenApiCredential::Bearer {
+                        token: "secret".to_owned(),
+                    },
+                )]
+                .into_iter()
+                .collect(),
+            },
+            credential_origins: BTreeMap::from([
+                ("first".to_owned(), vec!["https://one.example".to_owned()]),
+                ("second".to_owned(), vec!["https://two.example".to_owned()]),
+                ("unused".to_owned(), Vec::new()),
+            ]),
+        };
+        let same_origins_new_paths = [
+            origin_binding("https://one.example/new/path", "first"),
+            origin_binding("https://two.example:443/other", "second"),
+        ];
+        verify_candidate_credential_origins(&credential, same_origins_new_paths.iter())
+            .expect("same-origin path changes remain valid");
+
+        let swapped = [
+            origin_binding("https://two.example/path", "first"),
+            origin_binding("https://one.example/path", "second"),
+        ];
+        assert_eq!(
+            verify_candidate_credential_origins(&credential, swapped.iter())
+                .expect_err("per-scheme destination swaps must fail")
+                .code,
+            "openapi_credential_origin_changed"
+        );
+
+        let newly_used = [origin_binding("https://one.example/path", "unused")];
+        assert_eq!(
+            verify_candidate_credential_origins(&credential, newly_used.iter())
+                .expect_err("an unused configured credential has no approved destination")
+                .code,
+            "openapi_credential_origin_changed"
+        );
+    }
+
+    #[tokio::test]
+    async fn clearing_static_credentials_retires_only_unused_origin_pins() {
+        let fixture = managed_alternative_fixture().await;
+        let mut credential = StoredOpenApiCredentialV1 {
+            locator: StoredOpenApiLocatorV1::Url {
+                url: "https://spec.example/openapi.json".to_owned(),
+                document_base_url: "https://spec.example/openapi.json".to_owned(),
+            },
+            credentials: OpenApiCredentialSet::default(),
+            credential_origins: BTreeMap::from([
+                ("oauthA".to_owned(), vec!["https://api.example".to_owned()]),
+                (
+                    "retiredStatic".to_owned(),
+                    vec!["https://old.example".to_owned()],
+                ),
+            ]),
+        };
+        let mut unavailable = credential.clone();
+        OpenApiAdapter::default()
+            .retire_unused_credential_origins("source-alternatives", &mut unavailable)
+            .await
+            .expect("an unavailable OAuth registry fails closed");
+        assert_eq!(
+            unavailable.credential_origins,
+            credential.credential_origins
+        );
+        fixture
+            .adapter
+            .retire_unused_credential_origins("source-alternatives", &mut credential)
+            .await
+            .expect("origin pins reconcile");
+        assert!(credential.credential_origins.contains_key("oauthA"));
+        assert!(!credential.credential_origins.contains_key("retiredStatic"));
+
+        fixture
+            .oauth
+            .delete_connection(
+                "source-alternatives",
+                "oauthA",
+                fixture.first_connection_revision,
+            )
+            .await
+            .expect("managed OAuth connection deletes");
+        fixture
+            .adapter
+            .retire_unused_credential_origins("source-alternatives", &mut credential)
+            .await
+            .expect("origin pins reconcile after OAuth deletion");
+        assert!(credential.credential_origins.is_empty());
+    }
+
+    #[tokio::test]
+    async fn approved_oauth_alternative_does_not_fall_through_when_preferred_disappears() {
+        let fixture = managed_alternative_fixture().await;
+        let prepared = fixture
+            .adapter
+            .prepare_invocation(
+                "source-alternatives",
+                &fixture.binding,
+                &fixture.configuration,
+                Some(&fixture.stored),
+                &json!({}),
+                Some(&fixture.expected),
+            )
+            .await
+            .expect("the approval snapshot should select its first alternative");
+        assert_eq!(
+            prepared
+                .oauth_authorization
+                .as_ref()
+                .map(|authorization| authorization.scheme_name.as_str()),
+            Some("oauthA")
+        );
+        fixture
+            .oauth
+            .delete_connection(
+                "source-alternatives",
+                "oauthA",
+                fixture.first_connection_revision,
+            )
+            .await
+            .expect("the preferred connection deletes");
+        assert!(
+            fixture
+                .oauth
+                .ready_binding_for_scopes("source-alternatives", "oauthB", &["read".to_owned()])
+                .await
+                .expect("fallback binding reads")
+                .is_some(),
+            "the fallback remains eligible"
+        );
+        let error = match fixture
+            .adapter
+            .prepare_invocation(
+                "source-alternatives",
+                &fixture.binding,
+                &fixture.configuration,
+                Some(&fixture.stored),
+                &json!({}),
+                Some(&fixture.expected),
+            )
+            .await
+        {
+            Ok(_) => panic!("the approved connection may not fall through to another alternative"),
+            Err(error) => error,
+        };
+        assert_eq!(error.code, "oauth_binding_changed");
+        assert_eq!(error.category, ProtocolErrorCategory::Conflict);
+    }
+
+    #[tokio::test]
+    async fn approved_oauth_alternative_does_not_fall_through_after_revision_change() {
+        let fixture = managed_alternative_fixture().await;
+        fixture
+            .store
+            .upsert_connection(
+                "source-alternatives",
+                "oauthA",
+                fixture.first_connection_revision,
+                &fixture.config,
+                OAuthClientSecretUpdate::Preserve,
+                2,
+            )
+            .await
+            .expect("the preferred connection revision changes");
+        assert!(
+            fixture
+                .oauth
+                .ready_binding_for_scopes("source-alternatives", "oauthB", &["read".to_owned()])
+                .await
+                .expect("fallback binding reads")
+                .is_some(),
+            "the fallback remains eligible"
+        );
+        let error = match fixture
+            .adapter
+            .prepare_invocation(
+                "source-alternatives",
+                &fixture.binding,
+                &fixture.configuration,
+                Some(&fixture.stored),
+                &json!({}),
+                Some(&fixture.expected),
+            )
+            .await
+        {
+            Ok(_) => panic!("a changed approved connection may not fall through"),
+            Err(error) => error,
+        };
+        assert_eq!(error.code, "oauth_binding_changed");
+        assert_eq!(error.category, ProtocolErrorCategory::Conflict);
+    }
+
+    #[tokio::test]
+    async fn approval_scope_snapshot_keeps_the_originally_eligible_alternative() {
+        let mut fixture = managed_alternative_fixture().await;
+        sqlx::query(
+            "UPDATE oauth_connections SET granted_scopes_json = '[]' \
+             WHERE source_id = ? AND credential_key = 'oauthA'",
+        )
+        .bind("source-alternatives")
+        .execute(&fixture.pool)
+        .await
+        .expect("first alternative loses its grant before approval");
+        fixture.expected = fixture
+            .oauth
+            .bindings_for_source("source-alternatives")
+            .await
+            .expect("approval OAuth snapshot reads");
+        assert_eq!(fixture.expected.len(), 2);
+        assert!(
+            fixture
+                .expected
+                .iter()
+                .find(|binding| binding.credential_key == "oauthA")
+                .expect("first OAuth alternative is snapshotted")
+                .granted_scopes
+                .is_empty()
+        );
+
+        let selected = fixture
+            .adapter
+            .prepare_invocation(
+                "source-alternatives",
+                &fixture.binding,
+                &fixture.configuration,
+                Some(&fixture.stored),
+                &json!({}),
+                Some(&fixture.expected),
+            )
+            .await
+            .expect("the scope-eligible second alternative prepares");
+        assert_eq!(
+            selected
+                .oauth_authorization
+                .as_ref()
+                .map(|authorization| authorization.scheme_name.as_str()),
+            Some("oauthB")
+        );
+
+        sqlx::query(
+            "UPDATE oauth_connections SET granted_scopes_json = '[\"read\"]' \
+             WHERE source_id = ? AND credential_key = 'oauthA'",
+        )
+        .bind("source-alternatives")
+        .execute(&fixture.pool)
+        .await
+        .expect("first alternative gains scope while approval waits");
+        assert!(
+            !fixture
+                .oauth
+                .bindings_match("source-alternatives", &fixture.expected)
+                .await
+                .expect("approval OAuth snapshot compares"),
+            "a changed approval-time scope snapshot must become stale"
+        );
+        let still_selected = fixture
+            .adapter
+            .prepare_invocation(
+                "source-alternatives",
+                &fixture.binding,
+                &fixture.configuration,
+                Some(&fixture.stored),
+                &json!({}),
+                Some(&fixture.expected),
+            )
+            .await
+            .expect("selection is reconstructed from approval-time scopes");
+        assert_eq!(
+            still_selected
+                .oauth_authorization
+                .as_ref()
+                .map(|authorization| authorization.scheme_name.as_str()),
+            Some("oauthB")
+        );
+    }
+
+    #[tokio::test]
+    async fn prepared_oauth_invocation_rechecks_active_state_before_dispatch() {
+        let mut fixture = managed_alternative_fixture().await;
+        let listener = TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("upstream listener binds");
+        fixture.binding.server_url = format!(
+            "http://{}",
+            listener.local_addr().expect("listener address reads")
+        );
+        fixture.configuration.insert(
+            "allowPrivateNetwork".to_owned(),
+            serde_json::Value::Bool(true),
+        );
+        let prepared = fixture
+            .adapter
+            .prepare_invocation(
+                "source-alternatives",
+                &fixture.binding,
+                &fixture.configuration,
+                Some(&fixture.stored),
+                &json!({}),
+                Some(&fixture.expected),
+            )
+            .await
+            .expect("active OAuth invocation prepares");
+        fixture
+            .store
+            .begin_authorization(
+                "source-alternatives",
+                "oauthA",
+                fixture.first_connection_revision,
+                &[9_u8; 32],
+                10,
+                100,
+            )
+            .await
+            .expect("reauthorization transitions the selected connection to connecting");
+
+        let error = fixture
+            .adapter
+            .execute_invocation(prepared)
+            .await
+            .expect_err("a connecting OAuth binding cannot dispatch");
+        assert_eq!(error.code(), "oauth_binding_changed");
+        assert!(
+            timeout(Duration::from_millis(100), listener.accept())
+                .await
+                .is_err(),
+            "the upstream must receive no request after the OAuth state transition"
+        );
+    }
+
+    #[tokio::test]
+    async fn prepared_oauth_invocation_rechecks_connection_existence_before_dispatch() {
+        let mut fixture = managed_alternative_fixture().await;
+        let listener = TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("upstream listener binds");
+        fixture.binding.server_url = format!(
+            "http://{}",
+            listener.local_addr().expect("listener address reads")
+        );
+        fixture.configuration.insert(
+            "allowPrivateNetwork".to_owned(),
+            serde_json::Value::Bool(true),
+        );
+        let prepared = fixture
+            .adapter
+            .prepare_invocation(
+                "source-alternatives",
+                &fixture.binding,
+                &fixture.configuration,
+                Some(&fixture.stored),
+                &json!({}),
+                Some(&fixture.expected),
+            )
+            .await
+            .expect("active OAuth invocation prepares");
+        fixture
+            .oauth
+            .delete_connection(
+                "source-alternatives",
+                "oauthA",
+                fixture.first_connection_revision,
+            )
+            .await
+            .expect("the selected OAuth connection deletes");
+
+        let error = fixture
+            .adapter
+            .execute_invocation(prepared)
+            .await
+            .expect_err("a deleted OAuth binding cannot dispatch");
+        assert_eq!(error.code(), "oauth_binding_changed");
+        assert!(
+            timeout(Duration::from_millis(100), listener.accept())
+                .await
+                .is_err(),
+            "the upstream must receive no request after OAuth revocation"
+        );
+    }
+
+    #[test]
+    fn malformed_source_configuration_is_corrupt_data() {
+        let malformed = json!({
+            "spec": { "type": "inline" },
+            "allowPrivateNetwork": "yes"
+        })
+        .as_object()
+        .expect("test configuration is an object")
+        .clone();
+        let error = OpenApiSourceConfigurationV1::decode(&malformed)
+            .expect_err("malformed stored configuration fails closed");
+        assert_eq!(error.code, "invalid_source_configuration");
+        assert_eq!(error.category, ProtocolErrorCategory::CorruptData);
+    }
+
+    #[test]
+    fn incomplete_source_configuration_is_corrupt_data() {
+        let incomplete = json!({ "spec": { "type": "inline" } })
+            .as_object()
+            .expect("test configuration is an object")
+            .clone();
+        let error = OpenApiSourceConfigurationV1::decode(&incomplete)
+            .expect_err("incomplete stored configuration fails closed");
+        assert_eq!(error.code, "invalid_source_configuration");
+        assert_eq!(error.category, ProtocolErrorCategory::CorruptData);
+    }
+
+    #[test]
+    fn malformed_stored_credentials_are_corrupt_data() {
+        let stored = StoredCredential {
+            revision: 4,
+            credential: CredentialPayload {
+                schema_version: 1,
+                payload: json!({
+                    "locator": { "type": "inline" },
+                    "credentials": {
+                        "schemes": {
+                            "oauth": { "type": "oauth_access_token", "access_token": "" }
+                        }
+                    }
+                }),
+            },
+        };
+        let error = StoredOpenApiCredentialV1::decode(&stored)
+            .expect_err("invalid persisted credential values fail closed");
+        assert_eq!(error.code, "invalid_source_credentials");
+        assert_eq!(error.category, ProtocolErrorCategory::CorruptData);
+    }
+
+    #[test]
+    fn protocol_response_data_preserves_json_text_and_binary_bodies() {
+        let mut headers = HeaderMap::new();
+        headers.insert(CONTENT_TYPE, HeaderValue::from_static("application/json"));
+        assert_eq!(
+            response_data(&headers, br#"{"ok":true}"#),
+            json!({ "ok": true })
+        );
+
+        headers.insert(
+            CONTENT_TYPE,
+            HeaderValue::from_static("application/problem+json"),
+        );
+        assert_eq!(
+            response_data(&headers, br#"{"title":"problem"}"#),
+            json!({ "title": "problem" })
+        );
+
+        headers.insert(CONTENT_TYPE, HeaderValue::from_static("text/plain"));
+        assert_eq!(response_data(&headers, b"hello"), json!("hello"));
+        assert_eq!(
+            response_data(&headers, &[0xff, 0x00]),
+            json!({ "encoding": "base64", "data": "/wA=" })
+        );
+    }
+
+    #[test]
+    fn protocol_response_headers_use_the_existing_safe_allowlist() {
+        let mut headers = HeaderMap::new();
+        headers.insert(CONTENT_TYPE, HeaderValue::from_static("application/json"));
+        headers.insert(CONTENT_LENGTH, HeaderValue::from_static("12"));
+        headers.insert(RETRY_AFTER, HeaderValue::from_static("5"));
+        headers.insert(AUTHORIZATION, HeaderValue::from_static("Bearer secret"));
+        headers.insert(SET_COOKIE, HeaderValue::from_static("session=secret"));
+        headers.insert("x-upstream-secret", HeaderValue::from_static("secret"));
+
+        assert_eq!(
+            safe_response_headers(&headers),
+            BTreeMap::from([
+                ("content-length".to_owned(), "12".to_owned()),
+                ("content-type".to_owned(), "application/json".to_owned()),
+                ("retry-after".to_owned(), "5".to_owned()),
+            ])
+        );
+    }
+
+    #[test]
+    fn managed_oauth_is_selected_only_when_the_scheme_has_no_static_credential() {
+        let document = json!({
+            "openapi": "3.1.0",
+            "info": { "title": "Managed OAuth" },
+            "servers": [{ "url": "https://api.example.test" }],
+            "components": { "securitySchemes": {
+                "oauth": { "type": "oauth2", "flows": { "authorizationCode": {
+                    "authorizationUrl": "https://auth.example.test/authorize",
+                    "tokenUrl": "https://auth.example.test/token",
+                    "scopes": {}
+                }} }
+            }},
+            "paths": {
+                "/items": { "get": {
+                    "security": [{ "oauth": [] }],
+                    "responses": { "200": { "description": "ok" } }
+                }},
+                "/public": { "get": {
+                    "security": [{ "oauth": [] }, {}],
+                    "responses": { "200": { "description": "ok" } }
+                }}
+            }
+        });
+        let compiled = compile_document(&serde_json::to_vec(&document).unwrap())
+            .expect("OAuth document compiles");
+        let binding = &compiled
+            .tools
+            .iter()
+            .find(|tool| tool.binding.path_template == "/items")
+            .expect("OAuth operation exists")
+            .binding;
+        let configuration = json!({
+            "spec": { "type": "inline" },
+            "allowPrivateNetwork": false
+        })
+        .as_object()
+        .unwrap()
+        .clone();
+        let stored = |credentials: OpenApiCredentialSet| StoredCredential {
+            revision: 1,
+            credential: CredentialPayload {
+                schema_version: 1,
+                payload: json!({
+                    "locator": { "type": "inline" },
+                    "credentials": credentials
+                }),
+            },
+        };
+        let expected = crate::oauth::OAuthBinding {
+            connection_id: "connection-id".to_owned(),
+            credential_key: "oauth".to_owned(),
+            config_revision: 3,
+            granted_scopes: Vec::new(),
+        };
+        let resolved = BTreeMap::from([("oauth".to_owned(), expected.clone())]);
+
+        let managed = OpenApiAdapter::default()
+            .plan_invocation(
+                "source-id",
+                binding,
+                &configuration,
+                Some(&stored(OpenApiCredentialSet::default())),
+                &json!({}),
+                &resolved,
+            )
+            .expect("missing static OAuth selects managed OAuth");
+        let authorization = managed
+            .oauth_authorization
+            .expect("managed OAuth is deferred until execution");
+        assert_eq!(authorization.source_id, "source-id");
+        assert_eq!(authorization.scheme_name, "oauth");
+        assert!(!managed.request.headers.contains_key(AUTHORIZATION));
+
+        let snapshotted = OpenApiAdapter::default()
+            .plan_invocation(
+                "source-id",
+                binding,
+                &configuration,
+                Some(&stored(OpenApiCredentialSet::default())),
+                &json!({}),
+                &resolved,
+            )
+            .expect("the snapshotted OAuth binding is retained exactly");
+        assert_eq!(
+            snapshotted
+                .oauth_authorization
+                .map(|authorization| authorization.expected_binding),
+            Some(expected)
+        );
+
+        let public_binding = &compiled
+            .tools
+            .iter()
+            .find(|tool| tool.binding.path_template == "/public")
+            .expect("public operation exists")
+            .binding;
+        let public = OpenApiAdapter::default()
+            .plan_invocation(
+                "source-id",
+                public_binding,
+                &configuration,
+                Some(&stored(OpenApiCredentialSet::default())),
+                &json!({}),
+                &BTreeMap::new(),
+            )
+            .expect("an anonymous alternative remains anonymous");
+        assert!(public.oauth_authorization.is_none());
+        assert!(!public.request.headers.contains_key(AUTHORIZATION));
+
+        let static_credentials = OpenApiCredentialSet {
+            schemes: [(
+                "oauth".to_owned(),
+                OpenApiCredential::OAuthAccessToken {
+                    access_token: "static-access".to_owned(),
+                },
+            )]
+            .into_iter()
+            .collect(),
+        };
+        let static_plan = OpenApiAdapter::default()
+            .plan_invocation(
+                "source-id",
+                binding,
+                &configuration,
+                Some(&stored(static_credentials)),
+                &json!({}),
+                &BTreeMap::new(),
+            )
+            .expect("a configured static credential remains authoritative");
+        assert!(static_plan.oauth_authorization.is_none());
+        assert_eq!(
+            static_plan
+                .request
+                .headers
+                .get(AUTHORIZATION)
+                .and_then(|value| value.to_str().ok()),
+            Some("Bearer static-access")
+        );
+    }
+
+    #[test]
+    fn managed_oauth_options_expose_only_authorization_code_keys_and_scopes() {
+        let document = json!({
+            "openapi": "3.1.0",
+            "info": { "title": "OAuth options" },
+            "servers": [{ "url": "https://api.example.test" }],
+            "components": { "securitySchemes": {
+                "authorizationCode": {
+                    "type": "oauth2",
+                    "flows": { "authorizationCode": {
+                        "authorizationUrl": "https://auth.example.test/authorize",
+                        "tokenUrl": "https://auth.example.test/token",
+                        "scopes": { "write:items": "Write", "read:items": "Read" }
+                    }}
+                },
+                "clientCredentials": {
+                    "type": "oauth2",
+                    "flows": { "clientCredentials": {
+                        "tokenUrl": "https://auth.example.test/token",
+                        "scopes": { "service": "Service" }
+                    }}
+                },
+                "bearer": { "type": "http", "scheme": "bearer" }
+            }},
+            "paths": {
+                "/items": { "get": {
+                    "security": [
+                        { "authorizationCode": ["read:items"] },
+                        { "clientCredentials": ["service"] },
+                        { "bearer": [] }
+                    ],
+                    "responses": { "200": { "description": "ok" } }
+                }}
+            }
+        });
+        let compiled = compile_document(&serde_json::to_vec(&document).unwrap())
+            .expect("OAuth document compiles");
+        assert_eq!(
+            super::managed_oauth_options(&compiled).expect("options are bounded"),
+            vec![super::OpenApiManagedOAuthOption {
+                credential_key: "authorizationCode".to_owned(),
+                scopes: vec!["read:items".to_owned()],
+            }]
+        );
+    }
+
+    #[tokio::test]
+    async fn non_idempotent_unauthorized_response_is_never_replayed() {
+        let listener = TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("test listener binds");
+        let server_url = format!(
+            "http://{}",
+            listener.local_addr().expect("listener address")
+        );
+        let document = json!({
+            "openapi": "3.1.0",
+            "info": { "title": "No OAuth replay" },
+            "servers": [{ "url": server_url }],
+            "components": { "securitySchemes": {
+                "oauth": { "type": "oauth2", "flows": {} }
+            }},
+            "paths": { "/write": { "post": {
+                "security": [{ "oauth": [] }],
+                "responses": { "200": { "description": "ok" } }
+            }}}
+        });
+        let compiled = compile_document(&serde_json::to_vec(&document).unwrap())
+            .expect("OAuth document compiles");
+        let configuration = json!({
+            "spec": { "type": "inline" },
+            "allowPrivateNetwork": true
+        })
+        .as_object()
+        .unwrap()
+        .clone();
+        let stored = StoredCredential {
+            revision: 1,
+            credential: CredentialPayload {
+                schema_version: 1,
+                payload: json!({
+                    "locator": { "type": "inline" },
+                    "credentials": { "schemes": {
+                        "oauth": {
+                            "type": "oauth_access_token",
+                            "access_token": "static-access"
+                        }
+                    }}
+                }),
+            },
+        };
+        let adapter = OpenApiAdapter::default();
+        let prepared = adapter
+            .plan_invocation(
+                "source-id",
+                &compiled.tools[0].binding,
+                &configuration,
+                Some(&stored),
+                &json!({}),
+                &BTreeMap::new(),
+            )
+            .expect("invocation plans");
+        let server = tokio::spawn(async move {
+            let (mut stream, _) = listener.accept().await.expect("request accepted");
+            let mut request = vec![0_u8; 4096];
+            let read = stream.read(&mut request).await.expect("request reads");
+            let request = String::from_utf8_lossy(&request[..read]);
+            assert!(request.starts_with("POST /write HTTP/1.1"));
+            assert!(request.contains("authorization: Bearer static-access"));
+            stream
+                .write_all(
+                    b"HTTP/1.1 401 Unauthorized\r\nContent-Length: 0\r\nConnection: close\r\n\r\n",
+                )
+                .await
+                .expect("response writes");
+            assert!(
+                timeout(Duration::from_millis(100), listener.accept())
+                    .await
+                    .is_err(),
+                "a 401 response must not trigger a blind replay"
+            );
+        });
+        let response = adapter
+            .execute_invocation(prepared)
+            .await
+            .expect("a 401 is a completed upstream response");
+        assert!(!response.ok);
+        assert_eq!(response.http.expect("HTTP metadata").status, 401);
+        server.await.expect("test server completes");
+    }
+
+    #[tokio::test]
+    async fn mutating_server_errors_are_single_attempt_and_indeterminate() {
+        let document = json!({
+            "openapi": "3.1.0",
+            "info": { "title": "Indeterminate mutations" },
+            "servers": [{ "url": "https://placeholder.example.test" }],
+            "components": { "securitySchemes": {
+                "oauth": { "type": "oauth2", "flows": {} }
+            }},
+            "paths": { "/write": { "post": {
+                "security": [{ "oauth": [] }],
+                "responses": { "200": { "description": "ok" } }
+            }}}
+        });
+        let compiled = compile_document(&serde_json::to_vec(&document).unwrap())
+            .expect("OpenAPI document compiles");
+        let configuration = json!({
+            "spec": { "type": "inline" },
+            "allowPrivateNetwork": true
+        })
+        .as_object()
+        .unwrap()
+        .clone();
+        let stored = StoredCredential {
+            revision: 1,
+            credential: CredentialPayload {
+                schema_version: 1,
+                payload: json!({
+                    "locator": { "type": "inline" },
+                    "credentials": { "schemes": {
+                        "oauth": {
+                            "type": "oauth_access_token",
+                            "access_token": "static-access"
+                        }
+                    }}
+                }),
+            },
+        };
+
+        for method in ["POST", "PATCH", "DELETE"] {
+            let listener = TcpListener::bind("127.0.0.1:0")
+                .await
+                .expect("test listener binds");
+            let mut binding = compiled.tools[0].binding.clone();
+            binding.method = method.to_owned();
+            binding.server_url = format!(
+                "http://{}",
+                listener.local_addr().expect("listener address")
+            );
+            let adapter = OpenApiAdapter::default();
+            let prepared = adapter
+                .plan_invocation(
+                    "source-id",
+                    &binding,
+                    &configuration,
+                    Some(&stored),
+                    &json!({}),
+                    &BTreeMap::new(),
+                )
+                .expect("mutation plans");
+            let expected_method = method.to_owned();
+            let server = tokio::spawn(async move {
+                let (mut stream, _) = listener.accept().await.expect("request accepted");
+                let mut request = vec![0_u8; 4096];
+                let read = stream.read(&mut request).await.expect("request reads");
+                let request = String::from_utf8_lossy(&request[..read]);
+                assert!(request.starts_with(&format!("{expected_method} /write HTTP/1.1")));
+                stream
+                    .write_all(
+                        b"HTTP/1.1 500 Internal Server Error\r\nContent-Length: 0\r\nConnection: close\r\n\r\n",
+                    )
+                    .await
+                    .expect("response writes");
+                assert!(
+                    timeout(Duration::from_millis(100), listener.accept())
+                        .await
+                        .is_err(),
+                    "an ambiguous mutation response must not trigger a replay"
+                );
+            });
+            let error = adapter
+                .execute_invocation(prepared)
+                .await
+                .expect_err("a mutation 5xx outcome is indeterminate");
+            assert!(matches!(error, super::OpenApiExecutionError::Indeterminate));
+            assert!(error.outcome_unknown());
+            server.await.expect("test server completes");
+        }
+    }
+
+    #[tokio::test]
+    async fn managed_oauth_authorized_invocation_injects_bearer_only_at_execution() {
+        let listener = TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("test listener binds");
+        let server_url = format!(
+            "http://{}",
+            listener.local_addr().expect("listener address")
+        );
+        let document = json!({
+            "openapi": "3.1.0",
+            "info": { "title": "Managed OAuth execution" },
+            "servers": [{ "url": server_url }],
+            "components": { "securitySchemes": {
+                "oauthPending": { "type": "oauth2", "flows": { "authorizationCode": {
+                    "authorizationUrl": "https://auth.example.test/authorize",
+                    "tokenUrl": "https://auth.example.test/token",
+                    "scopes": { "write:items": "Write items" }
+                }} },
+                "oauthActive": { "type": "oauth2", "flows": { "authorizationCode": {
+                    "authorizationUrl": "https://auth.example.test/authorize",
+                    "tokenUrl": "https://auth.example.test/token",
+                    "scopes": { "write:items": "Write items" }
+                }} }
+            }},
+            "paths": { "/write": { "post": {
+                "security": [
+                    { "oauthPending": ["write:items"] },
+                    { "oauthActive": ["write:items"] }
+                ],
+                "responses": { "200": { "description": "ok" } }
+            }}}
+        });
+        let compiled = compile_document(&serde_json::to_vec(&document).unwrap())
+            .expect("OAuth document compiles");
+        let pool = SqlitePoolOptions::new()
+            .max_connections(1)
+            .connect("sqlite::memory:")
+            .await
+            .expect("test database opens");
+        sqlx::migrate!("./migrations")
+            .run(&pool)
+            .await
+            .expect("migrations apply");
+        sqlx::query(
+            "INSERT INTO sources (
+                id, kind, slug, display_name, configuration_json, health_status,
+                revision, catalog_revision, created_at, updated_at
+             ) VALUES (?, 'openapi', 'managed', 'Managed', ?, 'unknown', 0, 0, 1, 1)",
+        )
+        .bind("source-id")
+        .bind(r#"{"spec":{"type":"inline"},"allowPrivateNetwork":true}"#)
+        .execute(&pool)
+        .await
+        .expect("source inserts");
+        let keyring = Keyring::from_master_key([41; 32]).expect("test keyring");
+        let oauth_store = OAuthStore::new(pool.clone(), keyring.clone());
+        let connection_config = OAuthConnectionConfig {
+            issuer: "https://auth.example.test".to_owned(),
+            authorization_endpoint: "https://auth.example.test/authorize".to_owned(),
+            token_endpoint: "https://auth.example.test/token".to_owned(),
+            client_id: "client".to_owned(),
+            client_authentication: OAuthClientAuthentication::None,
+            token_endpoint_auth_methods_supported: vec!["none".to_owned()],
+            scopes: vec!["write:items".to_owned()],
+            allow_private_network: true,
+            resource: None,
+        };
+        let pending = oauth_store
+            .create_connection(
+                "source-id",
+                "oauthPending",
+                &connection_config,
+                Some(&OAuthSecretSet {
+                    access_token: Some("pending-access-token".to_owned()),
+                    token_type: Some("Bearer".to_owned()),
+                    granted_scopes: vec!["write:items".to_owned()],
+                    access_token_expires_at: Some(i64::MAX),
+                    ..OAuthSecretSet::default()
+                }),
+                1,
+            )
+            .await
+            .expect("pending OAuth connection inserts");
+        sqlx::query("UPDATE oauth_connections SET status = 'connecting' WHERE id = ?")
+            .bind(&pending.connection.id)
+            .execute(&pool)
+            .await
+            .expect("first OAuth alternative becomes pending");
+        oauth_store
+            .create_connection(
+                "source-id",
+                "oauthActive",
+                &connection_config,
+                Some(&OAuthSecretSet {
+                    access_token: Some("managed-access-token".to_owned()),
+                    token_type: Some("Bearer".to_owned()),
+                    granted_scopes: vec!["write:items".to_owned()],
+                    access_token_expires_at: Some(i64::MAX),
+                    ..OAuthSecretSet::default()
+                }),
+                1,
+            )
+            .await
+            .expect("managed OAuth connection inserts");
+        let oauth = OAuthService::new(
+            pool.clone(),
+            keyring,
+            "http://127.0.0.1:4788".to_owned(),
+            OutboundPolicy::default(),
+        );
+        let expected_oauth_bindings = oauth
+            .bindings_for_source("source-id")
+            .await
+            .expect("approval OAuth bindings snapshot");
+        assert_eq!(expected_oauth_bindings.len(), 1);
+        assert_eq!(expected_oauth_bindings[0].credential_key, "oauthActive");
+        sqlx::query("UPDATE oauth_connections SET status = 'active' WHERE id = ?")
+            .bind(&pending.connection.id)
+            .execute(&pool)
+            .await
+            .expect("first OAuth alternative becomes ready while approval waits");
+        assert!(
+            oauth
+                .bindings_match("source-id", &expected_oauth_bindings)
+                .await
+                .expect("selected approval binding remains valid"),
+            "a newly ready unselected alternative must not invalidate the approved binding"
+        );
+        let adapter = OpenApiAdapter::with_oauth(oauth);
+        let configuration = json!({
+            "spec": { "type": "inline" },
+            "allowPrivateNetwork": true
+        })
+        .as_object()
+        .unwrap()
+        .clone();
+        let stored = StoredCredential {
+            revision: 1,
+            credential: CredentialPayload {
+                schema_version: 1,
+                payload: json!({
+                    "locator": { "type": "inline" },
+                    "credentials": { "schemes": {} }
+                }),
+            },
+        };
+        let mut insecure = adapter
+            .prepare_invocation(
+                "source-id",
+                &compiled.tools[0].binding,
+                &configuration,
+                Some(&stored),
+                &json!({}),
+                Some(&expected_oauth_bindings),
+            )
+            .await
+            .expect("managed OAuth invocation prepares");
+        insecure.request.url = Url::parse(&format!(
+            "http://0.0.0.0:{}/write",
+            listener
+                .local_addr()
+                .expect("listener address reads")
+                .port()
+        ))
+        .expect("insecure target URL parses");
+        assert_eq!(
+            insecure
+                .oauth_authorization
+                .as_ref()
+                .map(|authorization| authorization.scheme_name.as_str()),
+            Some("oauthActive")
+        );
+        assert!(!insecure.request.headers.contains_key(AUTHORIZATION));
+        let error = adapter
+            .execute_invocation(insecure)
+            .await
+            .expect_err("managed OAuth cannot dispatch over non-loopback HTTP");
+        assert_eq!(error.code(), "insecure_openapi_transport");
+        assert!(
+            timeout(Duration::from_millis(100), listener.accept())
+                .await
+                .is_err(),
+            "the insecure target must receive no managed OAuth request"
+        );
+        let mut poisoned = adapter
+            .prepare_invocation(
+                "source-id",
+                &compiled.tools[0].binding,
+                &configuration,
+                Some(&stored),
+                &json!({}),
+                Some(&expected_oauth_bindings),
+            )
+            .await
+            .expect("managed OAuth invocation prepares for a poisoned localhost");
+        poisoned.request.url = Url::parse(&format!(
+            "http://localhost:{}/write",
+            listener
+                .local_addr()
+                .expect("listener address reads")
+                .port()
+        ))
+        .expect("poisoned localhost URL parses");
+        let poisoned_client = HardenedHttpClient::new(poisoned.policy.clone())
+            .with_test_dns_resolution(
+                "localhost",
+                vec!["8.8.8.8".parse().expect("test IP parses")],
+            );
+        let error = adapter
+            .execute_invocation_with_client(poisoned, poisoned_client)
+            .await
+            .expect_err("managed OAuth cannot dispatch when localhost resolves off loopback");
+        assert_eq!(error.code(), "insecure_openapi_transport");
+        assert!(
+            timeout(Duration::from_millis(100), listener.accept())
+                .await
+                .is_err(),
+            "a poisoned localhost must receive no managed OAuth request"
+        );
+        let prepared = adapter
+            .prepare_invocation(
+                "source-id",
+                &compiled.tools[0].binding,
+                &configuration,
+                Some(&stored),
+                &json!({}),
+                Some(&expected_oauth_bindings),
+            )
+            .await
+            .expect("loopback managed OAuth invocation prepares");
+        let server = tokio::spawn(async move {
+            let (mut stream, _) = listener.accept().await.expect("request accepted");
+            let mut request = vec![0_u8; 4096];
+            let read = stream.read(&mut request).await.expect("request reads");
+            let request = String::from_utf8_lossy(&request[..read]);
+            assert!(request.contains("authorization: Bearer managed-access-token"));
+            stream
+                .write_all(
+                    b"HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: 11\r\nConnection: close\r\n\r\n{\"ok\":true}",
+                )
+                .await
+                .expect("response writes");
+        });
+        let response = adapter
+            .execute_invocation(prepared)
+            .await
+            .expect("managed OAuth invocation executes");
+        assert!(response.ok);
+        assert_eq!(response.data, Some(json!({ "ok": true })));
+        server.await.expect("test server completes");
+    }
+}
diff --git a/src/request_logs.rs b/src/request_logs.rs
new file mode 100644
index 000000000..74ab37894
--- /dev/null
+++ b/src/request_logs.rs
@@ -0,0 +1,431 @@
+use std::sync::{
+    Arc,
+    atomic::{AtomicU64, Ordering},
+};
+
+#[cfg(test)]
+use std::sync::atomic::AtomicBool;
+
+use tokio::sync::{
+    mpsc::{self, error::TrySendError},
+    oneshot,
+};
+use tokio::task::JoinHandle;
+
+#[cfg(test)]
+use tokio::sync::Notify;
+
+use crate::{
+    catalog::{CatalogError, CatalogStore, NewRequestLog},
+    database::Database,
+};
+
+const DEFAULT_CAPACITY: usize = 1_024;
+const MAX_BATCH_SIZE: usize = 64;
+
+#[derive(Clone)]
+pub(crate) struct RequestLogSink {
+    sender: mpsc::Sender<QueuedRequestLog>,
+    database: Database,
+    telemetry: Arc<RequestLogTelemetry>,
+    consumer: Arc<std::sync::Mutex<Option<JoinHandle<()>>>>,
+    shutdown: Arc<std::sync::Mutex<Option<oneshot::Sender<()>>>>,
+    #[cfg(test)]
+    write_pause: Arc<std::sync::Mutex<Option<Arc<RequestLogWritePause>>>>,
+}
+
+#[cfg(test)]
+#[derive(Default)]
+pub(crate) struct RequestLogWritePause {
+    reached: Notify,
+    release: Notify,
+    finished: Notify,
+    succeeded: AtomicBool,
+}
+
+#[cfg(test)]
+impl RequestLogWritePause {
+    pub(crate) async fn reached(&self) {
+        self.reached.notified().await;
+    }
+
+    pub(crate) fn release(&self) {
+        self.release.notify_one();
+    }
+
+    pub(crate) async fn finished(&self) -> bool {
+        self.finished.notified().await;
+        self.succeeded.load(Ordering::Acquire)
+    }
+}
+
+struct QueuedRequestLog {
+    log: NewRequestLog,
+    _database_guard: Database,
+    completion: Option<oneshot::Sender<bool>>,
+}
+
+#[derive(Default)]
+struct RequestLogTelemetry {
+    dropped: AtomicU64,
+    dropped_full: AtomicU64,
+    dropped_closed: AtomicU64,
+    write_failures: AtomicU64,
+    writes: AtomicU64,
+}
+
+#[derive(Clone, Copy)]
+enum DropReason {
+    Full,
+    Closed,
+}
+
+impl RequestLogSink {
+    pub(crate) fn new(database: Database, catalog: CatalogStore) -> Self {
+        Self::with_capacity(database, catalog, DEFAULT_CAPACITY)
+    }
+
+    pub(super) fn with_capacity(
+        database: Database,
+        catalog: CatalogStore,
+        capacity: usize,
+    ) -> Self {
+        assert!(capacity > 0, "request-log sink capacity must be positive");
+        let (sender, receiver) = mpsc::channel(capacity);
+        let (shutdown, shutdown_requested) = oneshot::channel();
+        let telemetry = Arc::new(RequestLogTelemetry::default());
+        #[cfg(test)]
+        let write_pause = Arc::new(std::sync::Mutex::new(None));
+        let consumer = tokio::spawn(consume(
+            receiver,
+            catalog,
+            telemetry.clone(),
+            shutdown_requested,
+            #[cfg(test)]
+            write_pause.clone(),
+        ));
+        Self {
+            sender,
+            database,
+            telemetry,
+            consumer: Arc::new(std::sync::Mutex::new(Some(consumer))),
+            shutdown: Arc::new(std::sync::Mutex::new(Some(shutdown))),
+            #[cfg(test)]
+            write_pause,
+        }
+    }
+
+    #[cfg(test)]
+    pub(crate) fn pause_next_write(&self) -> Arc<RequestLogWritePause> {
+        let pause = Arc::new(RequestLogWritePause::default());
+        *self
+            .write_pause
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner) = Some(pause.clone());
+        pause
+    }
+
+    pub(crate) fn try_record(&self, log: NewRequestLog) -> bool {
+        let queued = QueuedRequestLog {
+            log,
+            _database_guard: self.database.clone(),
+            completion: None,
+        };
+        match self.sender.try_send(queued) {
+            Ok(()) => true,
+            Err(TrySendError::Full(queued)) => {
+                self.telemetry
+                    .record_drop(DropReason::Full, &queued.log.request_id);
+                false
+            }
+            Err(TrySendError::Closed(queued)) => {
+                self.telemetry
+                    .record_drop(DropReason::Closed, &queued.log.request_id);
+                false
+            }
+        }
+    }
+
+    pub(crate) async fn record_durable(&self, log: NewRequestLog) -> bool {
+        let (completion, completed) = oneshot::channel();
+        let queued = QueuedRequestLog {
+            log,
+            _database_guard: self.database.clone(),
+            completion: Some(completion),
+        };
+        if self.sender.send(queued).await.is_err() {
+            return false;
+        }
+        completed.await.unwrap_or(false)
+    }
+
+    pub(crate) async fn shutdown(&self) {
+        if let Some(shutdown) = self
+            .shutdown
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+            .take()
+        {
+            let _ = shutdown.send(());
+        }
+        let consumer = self
+            .consumer
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+            .take();
+        if let Some(consumer) = consumer {
+            let _ = consumer.await;
+        }
+    }
+
+    #[cfg(test)]
+    fn counters(&self) -> RequestLogSinkCounters {
+        self.telemetry.counters()
+    }
+}
+
+impl RequestLogTelemetry {
+    fn record_drop(&self, reason: DropReason, request_id: &str) {
+        let reason_total = match reason {
+            DropReason::Full => increment(&self.dropped_full),
+            DropReason::Closed => increment(&self.dropped_closed),
+        };
+        let dropped_total = increment(&self.dropped);
+        if should_emit(dropped_total) {
+            tracing::warn!(
+                event = "gateway_request_log_dropped",
+                reason = reason.as_str(),
+                request_id,
+                dropped_total,
+                reason_total,
+                "gateway request log was not queued"
+            );
+        }
+    }
+
+    fn record_write_failure(&self, request_id: &str, error: &CatalogError) {
+        let write_failures = increment(&self.write_failures);
+        if should_emit(write_failures) {
+            tracing::error!(
+                event = "gateway_request_log_write_failed",
+                request_id,
+                error = %error,
+                write_failures,
+                "gateway request log write failed"
+            );
+        }
+    }
+
+    fn record_write(&self) {
+        increment(&self.writes);
+    }
+
+    #[cfg(test)]
+    fn counters(&self) -> RequestLogSinkCounters {
+        RequestLogSinkCounters {
+            dropped: self.dropped.load(Ordering::Relaxed),
+            dropped_full: self.dropped_full.load(Ordering::Relaxed),
+            dropped_closed: self.dropped_closed.load(Ordering::Relaxed),
+            write_failures: self.write_failures.load(Ordering::Relaxed),
+            writes: self.writes.load(Ordering::Relaxed),
+        }
+    }
+}
+
+impl DropReason {
+    fn as_str(self) -> &'static str {
+        match self {
+            Self::Full => "full",
+            Self::Closed => "closed",
+        }
+    }
+}
+
+async fn consume(
+    mut receiver: mpsc::Receiver<QueuedRequestLog>,
+    catalog: CatalogStore,
+    telemetry: Arc<RequestLogTelemetry>,
+    mut shutdown: oneshot::Receiver<()>,
+    #[cfg(test)] write_pause: Arc<std::sync::Mutex<Option<Arc<RequestLogWritePause>>>>,
+) {
+    let mut batch = Vec::with_capacity(MAX_BATCH_SIZE);
+    let mut draining = false;
+    loop {
+        let queued = if draining {
+            receiver.recv().await
+        } else {
+            tokio::select! {
+                queued = receiver.recv() => queued,
+                _ = &mut shutdown => {
+                    receiver.close();
+                    draining = true;
+                    receiver.recv().await
+                }
+            }
+        };
+        let Some(queued) = queued else {
+            break;
+        };
+        batch.push(queued);
+        while batch.len() < MAX_BATCH_SIZE {
+            match receiver.try_recv() {
+                Ok(queued) => batch.push(queued),
+                Err(_) => break,
+            }
+        }
+
+        for queued in batch.drain(..) {
+            let QueuedRequestLog {
+                log,
+                _database_guard,
+                completion,
+            } = queued;
+            #[cfg(test)]
+            let pause = write_pause
+                .lock()
+                .unwrap_or_else(std::sync::PoisonError::into_inner)
+                .take();
+            #[cfg(test)]
+            if let Some(pause) = pause.as_ref() {
+                pause.reached.notify_one();
+                pause.release.notified().await;
+            }
+            let request_id = log.request_id.clone();
+            let succeeded = match catalog.record_request(log).await {
+                Ok(()) => {
+                    telemetry.record_write();
+                    true
+                }
+                Err(error) => {
+                    if catalog.request_log(&request_id).await.is_ok() {
+                        true
+                    } else {
+                        telemetry.record_write_failure(&request_id, &error);
+                        false
+                    }
+                }
+            };
+            #[cfg(test)]
+            if let Some(pause) = pause {
+                pause.succeeded.store(succeeded, Ordering::Release);
+                pause.finished.notify_one();
+            }
+            if let Some(completion) = completion {
+                let _ = completion.send(succeeded);
+            }
+        }
+    }
+}
+
+fn increment(counter: &AtomicU64) -> u64 {
+    counter.fetch_add(1, Ordering::Relaxed).saturating_add(1)
+}
+
+fn should_emit(total: u64) -> bool {
+    total.is_power_of_two()
+}
+
+#[cfg(test)]
+#[derive(Debug, Eq, PartialEq)]
+struct RequestLogSinkCounters {
+    dropped: u64,
+    dropped_full: u64,
+    dropped_closed: u64,
+    write_failures: u64,
+    writes: u64,
+}
+
+#[cfg(test)]
+mod tests {
+    use std::{sync::Arc, time::Duration};
+
+    use tempfile::TempDir;
+    use tokio::{sync::mpsc, time::timeout};
+
+    use super::{RequestLogSink, RequestLogTelemetry};
+    use crate::{
+        AppConfig,
+        catalog::{CatalogStore, NewRequestLog, RequestOutcome, RequestSurface},
+        database::{Database, OpenedDatabase},
+    };
+
+    fn request_log(request_id: &str) -> NewRequestLog {
+        NewRequestLog {
+            request_id: request_id.to_owned(),
+            actor_api_token_id: None,
+            surface: RequestSurface::Mcp,
+            source_id: None,
+            tool_id: None,
+            path_snapshot: Some("tools.example.run".to_owned()),
+            outcome: RequestOutcome::PendingApproval,
+            error_code: Some("approval_required".to_owned()),
+            duration_ms: 37,
+            approval_id: Some("approval-1".to_owned()),
+            created_at: 1_750_000_000,
+        }
+    }
+
+    async fn open_database() -> (TempDir, Database, CatalogStore) {
+        let directory = tempfile::tempdir().expect("temporary data directory");
+        let OpenedDatabase { database, .. } =
+            Database::open(&AppConfig::new(directory.path().into()))
+                .await
+                .expect("test database opens");
+        let catalog = CatalogStore::new(database.pool.clone(), database.keyring.clone());
+        (directory, database, catalog)
+    }
+
+    #[tokio::test]
+    async fn bounded_sender_drops_without_waiting_when_full() {
+        let (_directory, database, _catalog) = open_database().await;
+        let (sender, _receiver) = mpsc::channel(1);
+        let telemetry = Arc::new(RequestLogTelemetry::default());
+        let sink = RequestLogSink {
+            sender,
+            database,
+            telemetry,
+            consumer: Arc::new(std::sync::Mutex::new(None)),
+            shutdown: Arc::new(std::sync::Mutex::new(None)),
+            write_pause: Arc::new(std::sync::Mutex::new(None)),
+        };
+
+        assert!(sink.try_record(request_log("queued")));
+        assert!(!sink.try_record(request_log("dropped")));
+        assert_eq!(sink.counters().dropped, 1);
+        assert_eq!(sink.counters().dropped_full, 1);
+        assert_eq!(sink.counters().dropped_closed, 0);
+    }
+
+    #[tokio::test]
+    async fn consumer_recovers_after_a_failed_record_and_preserves_metadata() {
+        let (_directory, database, catalog) = open_database().await;
+        let sink = RequestLogSink::with_capacity(database, catalog.clone(), 2);
+
+        assert!(!sink.record_durable(request_log("")).await);
+        assert!(sink.record_durable(request_log("recorded")).await);
+
+        let stored = timeout(Duration::from_secs(2), async {
+            loop {
+                let counters = sink.counters();
+                if counters.write_failures == 1
+                    && counters.writes == 1
+                    && let Ok(stored) = catalog.request_log("recorded").await
+                {
+                    break stored;
+                }
+                tokio::time::sleep(Duration::from_millis(10)).await;
+            }
+        })
+        .await
+        .expect("the consumer continues after a failed record");
+
+        assert_eq!(stored.request_id, "recorded");
+        assert_eq!(stored.surface, RequestSurface::Mcp);
+        assert_eq!(stored.path_snapshot.as_deref(), Some("tools.example.run"));
+        assert_eq!(stored.outcome, RequestOutcome::PendingApproval);
+        assert_eq!(stored.error_code.as_deref(), Some("approval_required"));
+        assert_eq!(stored.duration_ms, 37);
+        assert_eq!(stored.approval_id.as_deref(), Some("approval-1"));
+        assert_eq!(stored.created_at, 1_750_000_000);
+    }
+}
diff --git a/src/runtime/invocation.rs b/src/runtime/invocation.rs
new file mode 100644
index 000000000..9d3811669
--- /dev/null
+++ b/src/runtime/invocation.rs
@@ -0,0 +1,436 @@
+use std::sync::{Arc, atomic::Ordering};
+
+use async_trait::async_trait;
+use serde::Deserialize;
+use serde_json::Value;
+use sha2::{Digest, Sha256};
+
+use super::{
+    ExecutionCancellation, HostToolDispatcher, ToolCall as RuntimeToolCall,
+    ToolResult as RuntimeToolResult,
+};
+use crate::{
+    actor::ToolActor,
+    approval::ApprovalStatus,
+    catalog::{CatalogError, RequestSurface},
+    invocation::{
+        ApprovalWaitError, ToolCall, ToolCallError, ToolCallOAuthError, ToolCallService,
+        ToolCallSubmission, ToolDiscoveryError, ToolResult as InvocationToolResult,
+    },
+};
+
+#[derive(Clone, Debug)]
+pub struct InvocationContext {
+    pub request_id: String,
+    pub actor: ToolActor,
+    pub surface: RequestSurface,
+    pub execution_id: String,
+}
+
+pub struct InvocationToolDispatcher {
+    service: ToolCallService,
+    context: InvocationContext,
+    cleanup_completed: tokio::sync::Mutex<bool>,
+}
+
+impl InvocationToolDispatcher {
+    pub fn new(service: ToolCallService, context: InvocationContext) -> Self {
+        Self {
+            service,
+            context,
+            cleanup_completed: tokio::sync::Mutex::new(false),
+        }
+    }
+
+    pub async fn finish(&self) {
+        self.cancel_pending_once().await;
+    }
+
+    pub(crate) fn discard_unstarted(&self) {
+        self.service
+            .clear_execution_stopping_flag(&self.context.execution_id);
+    }
+
+    async fn cancel_pending_once(&self) {
+        let mut completed = self.cleanup_completed.lock().await;
+        if *completed {
+            return;
+        }
+        self.service
+            .cancel_lost_execution(&self.context.execution_id)
+            .await;
+        *completed = true;
+    }
+
+    async fn dispatch_call(
+        &self,
+        call: RuntimeToolCall,
+        cancellation: ExecutionCancellation,
+    ) -> RuntimeToolResult {
+        if call.execution_id != self.context.execution_id {
+            return internal_failure("tool_correlation_failed");
+        }
+        if cancellation.is_cancelled() {
+            return internal_failure("execution_cancelled");
+        }
+        let service_call = ToolCall {
+            request_id: execution_call_request_id(&self.context.request_id, call.call_id),
+            actor: self.context.actor.clone(),
+            surface: self.context.surface,
+            execution_id: self.context.execution_id.clone(),
+            call_id: call.call_id.to_string(),
+            worker_generation: call.worker_generation,
+            path: call.path.clone(),
+            arguments: call.arguments.clone(),
+        };
+        if let Some(result) = self
+            .dispatch_builtin(&service_call, cancellation.clone())
+            .await
+        {
+            return result;
+        }
+
+        let call_id = service_call.call_id.clone();
+        let submission = tokio::select! {
+            result = self.service.submit(service_call) => result,
+            () = cancellation.cancelled() => {
+                return internal_failure("execution_cancelled");
+            }
+        };
+        let submission = match submission {
+            Ok(submission) => submission,
+            Err(error) => return tool_call_failure(&error),
+        };
+        match submission {
+            ToolCallSubmission::Completed(result) => invocation_result(result),
+            ToolCallSubmission::ApprovalRequired(approval) => {
+                let detail = self
+                    .service
+                    .wait_for_approval(
+                        approval,
+                        &self.context.actor,
+                        &self.context.execution_id,
+                        &call_id,
+                        cancellation.cancelled(),
+                    )
+                    .await;
+                match detail {
+                    Ok(detail) => approval_result(detail.record.status, detail.result),
+                    Err(ApprovalWaitError::Canceled) => internal_failure("execution_cancelled"),
+                    Err(ApprovalWaitError::Approval(_)) => internal_failure("approval_wait_failed"),
+                }
+            }
+        }
+    }
+
+    async fn dispatch_builtin(
+        &self,
+        call: &ToolCall,
+        cancellation: ExecutionCancellation,
+    ) -> Option<RuntimeToolResult> {
+        let result = match call.path.as_str() {
+            "search" => {
+                let arguments: SearchArguments =
+                    match serde_json::from_value(call.arguments.clone()) {
+                        Ok(arguments) => arguments,
+                        Err(_) => {
+                            return Some(failure(
+                                "invalid_tool_arguments",
+                                "Search arguments are invalid.",
+                            ));
+                        }
+                    };
+                if arguments.query.chars().count() > 256 {
+                    return Some(failure(
+                        "invalid_query",
+                        "Search queries may contain at most 256 characters.",
+                    ));
+                }
+                tokio::select! {
+                    result = self.service.discover_search(
+                        call,
+                        arguments.query,
+                        arguments.namespace,
+                        arguments.limit.unwrap_or(12),
+                        arguments.offset.unwrap_or(0),
+                    ) => result.map(|page| serde_json::to_value(page).expect("discovery pages serialize")),
+                    () = cancellation.cancelled() => {
+                        return Some(internal_failure("execution_cancelled"));
+                    }
+                }
+            }
+            "describe" => {
+                let arguments: PathArguments = match serde_json::from_value(call.arguments.clone())
+                {
+                    Ok(arguments) => arguments,
+                    Err(_) => {
+                        return Some(failure(
+                            "invalid_tool_arguments",
+                            "Describe arguments are invalid.",
+                        ));
+                    }
+                };
+                tokio::select! {
+                    result = self.service.discover_describe(call, &arguments.path) => result.map(|tool| serde_json::to_value(tool).expect("described tools serialize")),
+                    () = cancellation.cancelled() => {
+                        return Some(internal_failure("execution_cancelled"));
+                    }
+                }
+            }
+            "sources" => tokio::select! {
+                result = self.service.discover_sources(call) => result,
+                () = cancellation.cancelled() => {
+                    return Some(internal_failure("execution_cancelled"));
+                }
+            },
+            _ => return None,
+        };
+        Some(match result {
+            Ok(value) => RuntimeToolResult::Success { value },
+            Err(error) => discovery_failure(&error),
+        })
+    }
+}
+
+fn discovery_failure(error: &ToolDiscoveryError) -> RuntimeToolResult {
+    match error {
+        ToolDiscoveryError::Busy => {
+            failure("search_busy", "Tool search is busy. Try again shortly.")
+        }
+        ToolDiscoveryError::Catalog(error) => catalog_failure(error),
+        ToolDiscoveryError::Interrupted => internal_failure("discovery_interrupted"),
+    }
+}
+
+#[async_trait]
+impl HostToolDispatcher for InvocationToolDispatcher {
+    async fn dispatch(
+        &self,
+        call: RuntimeToolCall,
+        cancellation: ExecutionCancellation,
+    ) -> RuntimeToolResult {
+        self.dispatch_call(call, cancellation).await
+    }
+
+    async fn execution_finished(&self, execution_id: &str) {
+        if execution_id == self.context.execution_id {
+            self.cancel_pending_once().await;
+        }
+    }
+
+    async fn execution_stopping(&self, execution_id: &str) {
+        if execution_id == self.context.execution_id {
+            self.service.mark_execution_lost(execution_id).await;
+        }
+    }
+
+    fn cancellation_hook(&self, execution_id: &str) -> Option<Arc<dyn Fn() + Send + Sync>> {
+        if execution_id != self.context.execution_id {
+            return None;
+        }
+        let execution_stopping = self.service.execution_stopping_flag(execution_id);
+        Some(Arc::new(move || {
+            execution_stopping.store(true, Ordering::Release);
+        }))
+    }
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct SearchArguments {
+    query: String,
+    namespace: Option<String>,
+    limit: Option<u32>,
+    offset: Option<u32>,
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct PathArguments {
+    path: String,
+}
+
+fn approval_result(status: ApprovalStatus, result: Option<Value>) -> RuntimeToolResult {
+    match status {
+        ApprovalStatus::Succeeded | ApprovalStatus::Failed => result
+            .and_then(|result| serde_json::from_value::<InvocationToolResult>(result).ok())
+            .map(invocation_result)
+            .unwrap_or_else(|| internal_failure("approval_result_invalid")),
+        ApprovalStatus::Denied => failure("approval_denied", "The tool call was denied."),
+        ApprovalStatus::Expired => failure("approval_expired", "The tool approval expired."),
+        ApprovalStatus::Canceled => failure("approval_canceled", "The tool call was canceled."),
+        ApprovalStatus::Stale => failure(
+            "approval_stale",
+            "The tool changed before approval completed.",
+        ),
+        ApprovalStatus::Interrupted => result
+            .and_then(|result| serde_json::from_value::<InvocationToolResult>(result).ok())
+            .map(invocation_result)
+            .unwrap_or_else(|| internal_failure("approval_interrupted")),
+        ApprovalStatus::Pending | ApprovalStatus::Approved | ApprovalStatus::Executing => {
+            internal_failure("approval_state_invalid")
+        }
+    }
+}
+
+fn invocation_result(result: InvocationToolResult) -> RuntimeToolResult {
+    if result.ok {
+        RuntimeToolResult::Success {
+            value: result.data.unwrap_or(Value::Null),
+        }
+    } else if let Some(error) = result.error {
+        failure(error.code, error.message)
+    } else {
+        internal_failure("tool_result_invalid")
+    }
+}
+
+fn tool_call_failure(error: &ToolCallError) -> RuntimeToolResult {
+    match error {
+        ToolCallError::Catalog(error) => catalog_failure(error),
+        ToolCallError::Adapter { code, message } => failure(*code, message.clone()),
+        ToolCallError::OAuth(error) if matches!(error, ToolCallOAuthError::Internal) => {
+            internal_failure(error.code())
+        }
+        ToolCallError::OAuth(error) => failure(
+            error.code(),
+            "Managed OAuth could not be resolved safely for this tool call.",
+        ),
+        ToolCallError::ArgumentsTooLarge => failure(
+            "arguments_too_large",
+            "Tool arguments exceed the allowed size.",
+        ),
+        ToolCallError::InvalidArguments => failure(
+            "invalid_tool_arguments",
+            "Tool arguments do not match the input schema.",
+        ),
+        ToolCallError::Stale => failure("invocation_stale", "The tool changed before invocation."),
+        ToolCallError::Outbound(error) => failure(
+            error.code(),
+            "The upstream request could not be completed safely.",
+        ),
+        ToolCallError::Protocol(error) => match error.category {
+            crate::protocols::ProtocolErrorCategory::CorruptData
+            | crate::protocols::ProtocolErrorCategory::Internal => internal_failure(error.code),
+            _ => failure(error.code, error.message.clone()),
+        },
+        ToolCallError::ResultTooLarge => failure(
+            "result_too_large",
+            "The tool result exceeds the allowed size.",
+        ),
+        ToolCallError::Approval(error) => approval_failure(error),
+    }
+}
+
+fn approval_failure(error: &crate::approval::ApprovalError) -> RuntimeToolResult {
+    use crate::approval::ApprovalError;
+
+    match error {
+        ApprovalError::Capacity { .. } => failure(
+            "approval_capacity",
+            "Too many approvals are active. Resolve an existing approval and retry.",
+        ),
+        ApprovalError::OwnerTokenInactive => failure(
+            "token_revoked",
+            "The API token that owns this execution is no longer active.",
+        ),
+        ApprovalError::Expired => failure("approval_expired", "The tool approval expired."),
+        ApprovalError::WorkerGenerationConflict => failure(
+            "approval_stale",
+            "The approval belongs to another execution generation.",
+        ),
+        ApprovalError::RevisionConflict { .. } | ApprovalError::DecisionConflict => failure(
+            "approval_conflict",
+            "The approval changed before the request completed.",
+        ),
+        ApprovalError::CorrelationConflict => failure(
+            "approval_correlation_conflict",
+            "The execution call was reused for a different request.",
+        ),
+        ApprovalError::CorrelationRetired => failure(
+            "approval_correlation_retired",
+            "The execution call replay is no longer available.",
+        ),
+        ApprovalError::InvalidTransition { .. } => failure(
+            "approval_invalid_state",
+            "The approval can no longer make this transition.",
+        ),
+        ApprovalError::Validation { code, message } => failure(*code, message.clone()),
+        ApprovalError::PayloadTooLarge { .. } => failure(
+            "approval_payload_too_large",
+            "The approval payload exceeds the allowed size.",
+        ),
+        ApprovalError::NotFound => failure("approval_not_found", "The approval was not found."),
+        ApprovalError::Database(_)
+        | ApprovalError::Crypto(_)
+        | ApprovalError::Json(_)
+        | ApprovalError::CorruptData(_) => internal_failure("approval_submit_failed"),
+    }
+}
+
+fn catalog_failure(error: &CatalogError) -> RuntimeToolResult {
+    match error {
+        CatalogError::Validation { code, message } => failure(*code, message.clone()),
+        CatalogError::ToolDisabled { .. } => {
+            failure("tool_disabled", "The requested tool is disabled.")
+        }
+        CatalogError::ToolNotFound { .. } | CatalogError::NotFound { .. } => {
+            failure("tool_not_found", "The requested tool does not exist.")
+        }
+        CatalogError::RevisionConflict { .. } => failure(
+            "revision_conflict",
+            "The catalog changed before the request completed.",
+        ),
+        CatalogError::Database(_)
+        | CatalogError::Crypto(_)
+        | CatalogError::Json(_)
+        | CatalogError::CorruptData(_) => internal_failure("catalog_failed"),
+    }
+}
+
+fn failure(code: impl Into<String>, message: impl Into<String>) -> RuntimeToolResult {
+    RuntimeToolResult::Failure {
+        code: code.into(),
+        message: message.into(),
+    }
+}
+
+fn internal_failure(code: impl Into<String>) -> RuntimeToolResult {
+    RuntimeToolResult::InternalFailure { code: code.into() }
+}
+
+fn execution_call_request_id(request_id: &str, call_id: u64) -> String {
+    const MAX_REQUEST_LOG_ID_BYTES: usize = 128;
+    let suffix = format!(":call:{call_id}");
+    if request_id.len() + suffix.len() <= MAX_REQUEST_LOG_ID_BYTES {
+        return format!("{request_id}{suffix}");
+    }
+
+    let mut digest = Sha256::new();
+    digest.update(b"executor-runtime-request-log-v1");
+    digest.update((request_id.len() as u64).to_be_bytes());
+    digest.update(request_id.as_bytes());
+    format!("exec:{:x}{suffix}", digest.finalize())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::execution_call_request_id;
+
+    #[test]
+    fn execution_call_request_ids_respect_the_request_log_bound() {
+        let bounded_parent = "x".repeat(102);
+        let bounded = execution_call_request_id(&bounded_parent, u64::MAX);
+        assert_eq!(bounded.len(), 128);
+        assert!(bounded.starts_with(&bounded_parent));
+
+        let oversized_parent = "private-request-identity".repeat(64);
+        let first = execution_call_request_id(&oversized_parent, u64::MAX);
+        let repeated = execution_call_request_id(&oversized_parent, u64::MAX);
+        let distinct = execution_call_request_id(&format!("{oversized_parent}-other"), u64::MAX);
+        assert_eq!(first, repeated);
+        assert_ne!(first, distinct);
+        assert!(first.len() <= 128);
+        assert!(!first.contains(oversized_parent.as_str()));
+    }
+}
diff --git a/src/runtime/mod.rs b/src/runtime/mod.rs
new file mode 100644
index 000000000..cdea8086e
--- /dev/null
+++ b/src/runtime/mod.rs
@@ -0,0 +1,322 @@
+use std::sync::{
+    Arc,
+    atomic::{AtomicBool, Ordering},
+};
+use std::time::Duration;
+
+use async_trait::async_trait;
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+use tokio::sync::Notify;
+
+mod parent;
+mod protocol;
+mod transform;
+mod worker;
+
+mod invocation;
+
+pub use invocation::{InvocationContext, InvocationToolDispatcher};
+pub use parent::RuntimeManager;
+pub use worker::worker_main;
+
+pub const MAX_SOURCE_BYTES: usize = 1024 * 1024;
+
+#[derive(Clone, Debug)]
+pub struct ExecutionRequest {
+    pub execution_id: String,
+    pub code: String,
+    pub timeout: Duration,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct RuntimeLimits {
+    pub wall_time_millis: u64,
+    pub heap_bytes: usize,
+    pub stack_bytes: usize,
+    pub argument_bytes: usize,
+    pub result_bytes: usize,
+    pub aggregate_bytes: usize,
+    pub max_calls: usize,
+    pub max_concurrent_calls: usize,
+    pub max_console_entries: usize,
+    pub max_console_bytes: usize,
+    pub max_emits: usize,
+    pub max_emit_bytes: usize,
+}
+
+impl Default for RuntimeLimits {
+    fn default() -> Self {
+        Self {
+            wall_time_millis: 30_000,
+            heap_bytes: 64 * 1024 * 1024,
+            stack_bytes: 1024 * 1024,
+            argument_bytes: 8 * 1024 * 1024,
+            result_bytes: 8 * 1024 * 1024,
+            aggregate_bytes: 32 * 1024 * 1024,
+            max_calls: 128,
+            max_concurrent_calls: 16,
+            max_console_entries: 1000,
+            max_console_bytes: 256 * 1024,
+            max_emits: 100,
+            max_emit_bytes: 8 * 1024 * 1024,
+        }
+    }
+}
+
+impl RuntimeLimits {
+    fn validate(&self) -> Result<(), RuntimeFailure> {
+        let valid = self.wall_time_millis > 0
+            && self.wall_time_millis <= 300_000
+            && self.heap_bytes > 0
+            && self.heap_bytes <= 64 * 1024 * 1024
+            && self.stack_bytes > 0
+            && self.stack_bytes <= 1024 * 1024
+            && self.argument_bytes > 0
+            && self.argument_bytes <= 8 * 1024 * 1024
+            && self.result_bytes > 0
+            && self.result_bytes <= 8 * 1024 * 1024
+            && self.aggregate_bytes > 0
+            && self.aggregate_bytes <= 32 * 1024 * 1024
+            && self.max_calls > 0
+            && self.max_calls <= 128
+            && self.max_concurrent_calls > 0
+            && self.max_concurrent_calls <= 16
+            && self.max_console_entries <= 1000
+            && self.max_console_bytes <= 256 * 1024
+            && self.max_emits <= 100
+            && self.max_emit_bytes <= 8 * 1024 * 1024;
+        if valid {
+            Ok(())
+        } else {
+            Err(RuntimeFailure::internal(
+                "runtime_limits_invalid",
+                "sandbox limits exceeded the supported maximum",
+            ))
+        }
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
+#[serde(rename_all = "snake_case")]
+pub enum ConsoleLevel {
+    Debug,
+    Info,
+    Log,
+    Warn,
+    Error,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
+#[serde(deny_unknown_fields)]
+pub struct ConsoleEntry {
+    pub level: ConsoleLevel,
+    pub message: String,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
+#[serde(tag = "kind", rename_all = "snake_case", deny_unknown_fields)]
+pub enum ToolResult {
+    Success {
+        value: Value,
+    },
+    Failure {
+        code: String,
+        message: String,
+    },
+    #[doc(hidden)]
+    InternalFailure {
+        code: String,
+    },
+}
+
+#[derive(Clone, Debug)]
+pub struct ToolCall {
+    pub execution_id: String,
+    pub worker_generation: u64,
+    pub call_id: u64,
+    pub path: String,
+    pub arguments: Value,
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ToolCallRecord {
+    pub call_id: u64,
+    pub path: String,
+    pub result: ToolResult,
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ExecutionOutput {
+    pub result: Value,
+    pub emits: Vec<Value>,
+    pub console: Vec<ConsoleEntry>,
+    pub tool_calls: Vec<ToolCallRecord>,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
+#[serde(deny_unknown_fields)]
+pub struct RuntimeFailure {
+    pub code: String,
+    pub message: String,
+    pub internal: bool,
+}
+
+impl RuntimeFailure {
+    pub fn public(code: impl Into<String>, message: impl Into<String>) -> Self {
+        Self {
+            code: code.into(),
+            message: message.into(),
+            internal: false,
+        }
+    }
+
+    pub(crate) fn internal(code: impl Into<String>, message: impl Into<String>) -> Self {
+        Self {
+            code: code.into(),
+            message: message.into(),
+            internal: true,
+        }
+    }
+}
+
+impl std::fmt::Display for RuntimeFailure {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(formatter, "{}: {}", self.code, self.message)
+    }
+}
+
+impl std::error::Error for RuntimeFailure {}
+
+#[derive(Clone, Default)]
+pub struct ExecutionCancellation {
+    inner: Arc<CancellationInner>,
+}
+
+#[derive(Default)]
+struct CancellationInner {
+    cancelled: AtomicBool,
+    notify: Notify,
+    hooks: std::sync::Mutex<CancellationHooks>,
+}
+
+#[derive(Default)]
+struct CancellationHooks {
+    cancelling: bool,
+    pending: Vec<Arc<dyn Fn() + Send + Sync>>,
+}
+
+impl ExecutionCancellation {
+    pub fn cancel(&self) {
+        let mut pending = {
+            let mut hooks = self
+                .inner
+                .hooks
+                .lock()
+                .unwrap_or_else(std::sync::PoisonError::into_inner);
+            if self.inner.cancelled.load(Ordering::Acquire) || hooks.cancelling {
+                return;
+            }
+            hooks.cancelling = true;
+            std::mem::take(&mut hooks.pending)
+        };
+        loop {
+            for hook in pending.drain(..) {
+                let _ = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| hook()));
+            }
+            let mut hooks = self
+                .inner
+                .hooks
+                .lock()
+                .unwrap_or_else(std::sync::PoisonError::into_inner);
+            if hooks.pending.is_empty() {
+                self.inner.cancelled.store(true, Ordering::Release);
+                hooks.cancelling = false;
+                break;
+            }
+            pending = std::mem::take(&mut hooks.pending);
+        }
+        self.inner.notify.notify_waiters();
+    }
+
+    pub fn register_cancel_hook(&self, hook: Arc<dyn Fn() + Send + Sync>) {
+        let mut hooks = self
+            .inner
+            .hooks
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        if self.inner.cancelled.load(Ordering::Acquire) {
+            drop(hooks);
+            hook();
+        } else {
+            hooks.pending.push(hook);
+        }
+    }
+
+    pub fn is_cancelled(&self) -> bool {
+        self.inner.cancelled.load(Ordering::Acquire)
+    }
+
+    pub async fn cancelled(&self) {
+        loop {
+            let notified = self.inner.notify.notified();
+            tokio::pin!(notified);
+            notified.as_mut().enable();
+            if self.is_cancelled() {
+                return;
+            }
+            notified.await;
+        }
+    }
+}
+
+#[async_trait]
+pub trait HostToolDispatcher: Send + Sync + 'static {
+    async fn dispatch(&self, call: ToolCall, cancellation: ExecutionCancellation) -> ToolResult;
+
+    async fn execution_stopping(&self, _execution_id: &str) {}
+
+    fn cancellation_hook(&self, _execution_id: &str) -> Option<Arc<dyn Fn() + Send + Sync>> {
+        None
+    }
+
+    async fn execution_finished(&self, _execution_id: &str) {}
+}
+
+#[cfg(test)]
+mod tests {
+    use std::sync::{
+        Arc,
+        atomic::{AtomicBool, Ordering},
+    };
+
+    use super::ExecutionCancellation;
+
+    #[test]
+    fn cancellation_hooks_are_reentrant_and_panic_safe() {
+        let cancellation = ExecutionCancellation::default();
+        let first_hook_ran = Arc::new(AtomicBool::new(false));
+        let nested_hook_ran = Arc::new(AtomicBool::new(false));
+        let hook_cancellation = cancellation.clone();
+        let hook_first = first_hook_ran.clone();
+        let hook_nested = nested_hook_ran.clone();
+        cancellation.register_cancel_hook(Arc::new(move || {
+            hook_first.store(true, Ordering::Release);
+            hook_cancellation.register_cancel_hook(Arc::new({
+                let hook_nested = hook_nested.clone();
+                move || hook_nested.store(true, Ordering::Release)
+            }));
+            hook_cancellation.cancel();
+        }));
+        cancellation.register_cancel_hook(Arc::new(|| panic!("hook failure")));
+
+        cancellation.cancel();
+
+        assert!(cancellation.is_cancelled());
+        assert!(first_hook_ran.load(Ordering::Acquire));
+        assert!(nested_hook_ran.load(Ordering::Acquire));
+    }
+}
diff --git a/src/runtime/parent.rs b/src/runtime/parent.rs
new file mode 100644
index 000000000..98914ce13
--- /dev/null
+++ b/src/runtime/parent.rs
@@ -0,0 +1,1127 @@
+use std::{
+    future::Future,
+    os::fd::AsRawFd,
+    path::{Path, PathBuf},
+    pin::Pin,
+    process::Stdio,
+    sync::{
+        Arc, OnceLock,
+        atomic::{AtomicUsize, Ordering},
+    },
+};
+
+use tokio::{
+    net::UnixStream,
+    process::{Child, Command},
+    sync::{Mutex, Semaphore, mpsc},
+    task::{JoinHandle, JoinSet},
+};
+
+use super::{
+    ExecutionCancellation, ExecutionOutput, ExecutionRequest, HostToolDispatcher, RuntimeFailure,
+    RuntimeLimits, ToolCall, ToolCallRecord, ToolResult,
+    protocol::{
+        PROTOCOL_VERSION, ParentMessage, WorkerMessage, encode_frame, read_frame,
+        write_encoded_frame,
+    },
+};
+
+static WORKER_PERMITS: OnceLock<Arc<Semaphore>> = OnceLock::new();
+const EXECUTION_SHUTDOWN_GRACE: std::time::Duration = std::time::Duration::from_secs(1);
+
+#[cfg(target_os = "linux")]
+type RlimitResource = libc::__rlimit_resource_t;
+#[cfg(target_os = "macos")]
+type RlimitResource = libc::c_int;
+
+#[cfg(target_os = "macos")]
+unsafe extern "C" {
+    fn closefrom(low_fd: libc::c_int);
+}
+
+#[derive(Clone, Debug)]
+pub struct RuntimeManager {
+    executable: PathBuf,
+    limits: RuntimeLimits,
+}
+
+impl RuntimeManager {
+    pub fn current_executable() -> Result<Self, RuntimeFailure> {
+        let executable = std::env::current_exe().map_err(|_| {
+            RuntimeFailure::internal("worker_unavailable", "could not locate Executor binary")
+        })?;
+        Ok(Self::new(executable))
+    }
+
+    pub fn new(executable: impl Into<PathBuf>) -> Self {
+        Self {
+            executable: executable.into(),
+            limits: RuntimeLimits::default(),
+        }
+    }
+
+    pub fn with_limits(mut self, limits: RuntimeLimits) -> Self {
+        self.limits = limits;
+        self
+    }
+
+    pub async fn execute(
+        &self,
+        request: ExecutionRequest,
+        dispatcher: Arc<dyn HostToolDispatcher>,
+        cancellation: ExecutionCancellation,
+    ) -> Result<ExecutionOutput, RuntimeFailure> {
+        let actor_cancellation = ExecutionCancellation::default();
+        if let Some(hook) = dispatcher.cancellation_hook(&request.execution_id) {
+            cancellation.register_cancel_hook(hook.clone());
+            actor_cancellation.register_cancel_hook(hook);
+        }
+        let mut drop_guard = ExecutionDropGuard(Some(actor_cancellation.clone()));
+        let manager = self.clone();
+        let actor_token = actor_cancellation.clone();
+        let actor = tokio::spawn(async move {
+            let forwarding_token = actor_token.clone();
+            let forward_cancellation = tokio::spawn(async move {
+                cancellation.cancelled().await;
+                forwarding_token.cancel();
+            });
+            let execution_id = request.execution_id.clone();
+            let cleanup_dispatcher = dispatcher.clone();
+            let result = manager
+                .execute_owned(request, dispatcher, actor_token)
+                .await;
+            let _ = tokio::time::timeout(
+                EXECUTION_SHUTDOWN_GRACE,
+                cleanup_dispatcher.execution_finished(&execution_id),
+            )
+            .await;
+            forward_cancellation.abort();
+            let _ = forward_cancellation.await;
+            result
+        });
+        let result = actor.await.map_err(|_| {
+            RuntimeFailure::internal("execution_actor_failed", "execution actor failed")
+        })?;
+        drop_guard.0 = None;
+        result
+    }
+
+    async fn execute_owned(
+        &self,
+        request: ExecutionRequest,
+        dispatcher: Arc<dyn HostToolDispatcher>,
+        cancellation: ExecutionCancellation,
+    ) -> Result<ExecutionOutput, RuntimeFailure> {
+        if request.code.len() > super::MAX_SOURCE_BYTES {
+            return Err(RuntimeFailure::public(
+                "source_too_large",
+                "TypeScript source exceeded 1 MiB",
+            ));
+        }
+        if request.timeout.is_zero() {
+            return Err(RuntimeFailure::public(
+                "invalid_timeout",
+                "execution timeout must be positive",
+            ));
+        }
+        if request.timeout > std::time::Duration::from_secs(300) {
+            return Err(RuntimeFailure::public(
+                "invalid_timeout",
+                "execution timeout cannot exceed five minutes",
+            ));
+        }
+        let mut execution_limits = self.limits.clone();
+        execution_limits.wall_time_millis = request.timeout.as_millis() as u64;
+        execution_limits.validate()?;
+        let permits = WORKER_PERMITS
+            .get_or_init(|| Arc::new(Semaphore::new(8)))
+            .clone();
+        if cancellation.is_cancelled() {
+            return Err(cancelled());
+        }
+        let permit = permits.try_acquire_owned().map_err(|_| {
+            RuntimeFailure::public("runtime_busy", "all sandbox worker slots are busy")
+        })?;
+        let generation = random_generation();
+        let temp_dir = PrivateTempDir::create()?;
+        let (stream, mut child) = spawn_worker(
+            &self.executable,
+            generation,
+            temp_dir.path(),
+            request.timeout,
+        )?;
+        let mut process_group = ProcessGroupGuard(child.id());
+        let execution_id = request.execution_id.clone();
+        let run = run_execution(
+            stream,
+            generation,
+            request.execution_id,
+            request.code,
+            execution_limits,
+            dispatcher.clone(),
+            cancellation.clone(),
+        );
+        tokio::pin!(run);
+        let (outcome, timed_out) = match tokio::time::timeout(request.timeout, &mut run).await {
+            Ok(result) => (result, false),
+            Err(_) => {
+                cancellation.cancel();
+                drain_timed_out_execution(run.as_mut(), &dispatcher, &execution_id).await;
+                (
+                    Err(RuntimeFailure::public(
+                        "execution_timeout",
+                        "TypeScript execution timed out",
+                    )),
+                    true,
+                )
+            }
+        };
+        if outcome.is_err() {
+            cancellation.cancel();
+            if !timed_out {
+                let _ = tokio::time::timeout(
+                    EXECUTION_SHUTDOWN_GRACE,
+                    dispatcher.execution_stopping(&execution_id),
+                )
+                .await;
+            }
+            terminate_worker(&mut child).await;
+            process_group.disarm();
+        } else {
+            let status = tokio::time::timeout(std::time::Duration::from_secs(1), child.wait())
+                .await
+                .ok()
+                .and_then(Result::ok);
+            if !status.is_some_and(|status| status.success()) {
+                cancellation.cancel();
+                terminate_worker(&mut child).await;
+                process_group.disarm();
+                drop(permit);
+                return Err(RuntimeFailure::internal(
+                    "worker_crashed",
+                    "sandbox worker exited unexpectedly",
+                ));
+            }
+            process_group.disarm();
+        }
+        drop(permit);
+        outcome
+    }
+}
+
+struct ExecutionDropGuard(Option<ExecutionCancellation>);
+
+impl Drop for ExecutionDropGuard {
+    fn drop(&mut self) {
+        if let Some(cancellation) = self.0.take() {
+            cancellation.cancel();
+        }
+    }
+}
+
+async fn run_execution(
+    stream: UnixStream,
+    generation: u64,
+    execution_id: String,
+    code: String,
+    limits: RuntimeLimits,
+    dispatcher: Arc<dyn HostToolDispatcher>,
+    cancellation: ExecutionCancellation,
+) -> Result<ExecutionOutput, RuntimeFailure> {
+    let (reader, writer) = stream.into_split();
+    let writer = Arc::new(Mutex::new(writer));
+    let aggregate_bytes = Arc::new(AtomicUsize::new(0));
+    let mut reader =
+        WorkerFrameReader::spawn(reader, aggregate_bytes.clone(), limits.aggregate_bytes);
+    write_parent_message(
+        &writer,
+        &aggregate_bytes,
+        &ParentMessage::Start {
+            version: PROTOCOL_VERSION,
+            generation,
+            code,
+            limits: limits.clone(),
+        },
+        limits.aggregate_bytes,
+    )
+    .await?;
+
+    let call_permits = Arc::new(Semaphore::new(limits.max_concurrent_calls));
+    let records = Arc::new(Mutex::new(Vec::new()));
+    let mut calls = JoinSet::new();
+    let mut expected_call_id = 1u64;
+    let outcome = async {
+        loop {
+            let message = tokio::select! {
+                frame = reader.recv() => frame?,
+                completed = calls.join_next(), if !calls.is_empty() => {
+                    match completed {
+                        Some(Ok(Ok(()))) => continue,
+                        Some(Ok(Err(error))) => return Err(error),
+                        Some(Err(_)) | None => {
+                            return Err(RuntimeFailure::internal(
+                                "tool_bridge_failed",
+                                "tool dispatch task failed",
+                            ));
+                        }
+                    }
+                }
+                () = cancellation.cancelled() => return Err(cancelled()),
+            };
+            match message {
+                WorkerMessage::ToolCall {
+                    version,
+                    generation: message_generation,
+                    call_id,
+                    path,
+                    arguments,
+                } => {
+                validate_header(version, message_generation, generation)?;
+                if call_id as usize > limits.max_calls {
+                    return Err(RuntimeFailure::public(
+                        "tool_call_limit_exceeded",
+                        "execution exceeded 128 tool calls",
+                    ));
+                }
+                if call_id != expected_call_id {
+                    return Err(RuntimeFailure::internal(
+                        "ipc_protocol_violation",
+                        "worker tool call ID was invalid",
+                    ));
+                }
+                expected_call_id += 1;
+                if path.is_empty() || path.len() > 512 || path.split('.').any(str::is_empty) {
+                    return Err(RuntimeFailure::public(
+                        "tool_path_invalid",
+                        "tool path was invalid",
+                    ));
+                }
+                let argument_size = serde_json::to_vec(&arguments)
+                    .map_err(|_| {
+                        RuntimeFailure::internal("ipc_frame_invalid", "arguments were invalid")
+                    })?
+                    .len();
+                if argument_size > limits.argument_bytes {
+                    return Err(RuntimeFailure::public(
+                        "argument_too_large",
+                        "tool arguments exceeded 8 MiB",
+                    ));
+                }
+                let permit = tokio::select! {
+                    permit = call_permits.clone().acquire_owned() => permit.map_err(|_| RuntimeFailure::internal("runtime_closed", "runtime is shutting down"))?,
+                    () = cancellation.cancelled() => return Err(cancelled()),
+                };
+                let writer = writer.clone();
+                let aggregate_bytes = aggregate_bytes.clone();
+                let records = records.clone();
+                let dispatcher = dispatcher.clone();
+                let call_cancellation = cancellation.clone();
+                let call_execution_id = execution_id.clone();
+                let aggregate_limit = limits.aggregate_bytes;
+                let result_limit = limits.result_bytes;
+                calls.spawn(async move {
+                    let call = ToolCall {
+                        execution_id: call_execution_id,
+                        worker_generation: generation,
+                        call_id,
+                        path: path.clone(),
+                        arguments,
+                    };
+                    let mut result = dispatcher.dispatch(call, call_cancellation).await;
+                    if serde_json::to_vec(&result).map_or(true, |bytes| bytes.len() > result_limit)
+                    {
+                        result = ToolResult::InternalFailure {
+                            code: "tool_result_too_large".into(),
+                        };
+                    }
+                    records.lock().await.push(ToolCallRecord {
+                        call_id,
+                        path,
+                        result: result.clone(),
+                    });
+                    write_parent_message(
+                        &writer,
+                        &aggregate_bytes,
+                        &ParentMessage::ToolResult {
+                            version: PROTOCOL_VERSION,
+                            generation,
+                            call_id,
+                            result,
+                        },
+                        aggregate_limit,
+                    )
+                    .await?;
+                    drop(permit);
+                    Ok::<_, RuntimeFailure>(())
+                });
+                }
+                WorkerMessage::Complete {
+                    version,
+                    generation: message_generation,
+                    result,
+                    emits,
+                    console,
+                } => {
+                validate_header(version, message_generation, generation)?;
+                validate_output(&result, &emits, &console, &limits)?;
+                while let Some(call) = calls.join_next().await {
+                    call.map_err(|_| {
+                        RuntimeFailure::internal("tool_bridge_failed", "tool dispatch task failed")
+                    })??;
+                }
+                let mut tool_calls = records.lock().await.clone();
+                tool_calls.sort_by_key(|record| record.call_id);
+                return Ok(ExecutionOutput {
+                    result,
+                    emits,
+                    console,
+                    tool_calls,
+                });
+                }
+                WorkerMessage::Failed {
+                    version,
+                    generation: message_generation,
+                    failure,
+                } => {
+                validate_header(version, message_generation, generation)?;
+                calls.abort_all();
+                return Err(sanitize_worker_failure(failure));
+                }
+            }
+        }
+    }
+    .await;
+    reader.stop().await;
+    if outcome.is_err() {
+        calls.abort_all();
+        while calls.join_next().await.is_some() {}
+    }
+    outcome
+}
+
+async fn drain_timed_out_execution<F>(
+    run: Pin<&mut F>,
+    dispatcher: &Arc<dyn HostToolDispatcher>,
+    execution_id: &str,
+) where
+    F: Future<Output = Result<ExecutionOutput, RuntimeFailure>>,
+{
+    let stopping = dispatcher.execution_stopping(execution_id);
+    let _ = tokio::time::timeout(EXECUTION_SHUTDOWN_GRACE, async {
+        let _ = tokio::join!(stopping, run);
+    })
+    .await;
+}
+
+struct WorkerFrameReader {
+    frames: mpsc::Receiver<Result<WorkerMessage, RuntimeFailure>>,
+    task: Option<JoinHandle<()>>,
+}
+
+impl WorkerFrameReader {
+    fn spawn(
+        mut reader: tokio::net::unix::OwnedReadHalf,
+        aggregate_bytes: Arc<AtomicUsize>,
+        aggregate_limit: usize,
+    ) -> Self {
+        let (sender, frames) = mpsc::channel(1);
+        let task = tokio::spawn(async move {
+            loop {
+                let frame = read_frame::<_, WorkerMessage>(&mut reader).await.and_then(
+                    |(message, frame_bytes)| {
+                        add_aggregate_bytes(&aggregate_bytes, frame_bytes, aggregate_limit)?;
+                        Ok(message)
+                    },
+                );
+                let terminal = frame.is_err();
+                if sender.send(frame).await.is_err() || terminal {
+                    break;
+                }
+            }
+        });
+        Self {
+            frames,
+            task: Some(task),
+        }
+    }
+
+    async fn recv(&mut self) -> Result<WorkerMessage, RuntimeFailure> {
+        self.frames.recv().await.unwrap_or_else(|| {
+            Err(RuntimeFailure::internal(
+                "worker_disconnected",
+                "sandbox worker disconnected",
+            ))
+        })
+    }
+
+    async fn stop(&mut self) {
+        if let Some(task) = self.task.take() {
+            task.abort();
+            let _ = task.await;
+        }
+    }
+}
+
+impl Drop for WorkerFrameReader {
+    fn drop(&mut self) {
+        if let Some(task) = self.task.take() {
+            task.abort();
+        }
+    }
+}
+
+fn sanitize_worker_failure(failure: RuntimeFailure) -> RuntimeFailure {
+    match failure.code.as_str() {
+        "source_too_large" => {
+            RuntimeFailure::public("source_too_large", "TypeScript source exceeded 1 MiB")
+        }
+        "typescript_invalid" => {
+            RuntimeFailure::public("typescript_invalid", "TypeScript could not be parsed")
+        }
+        "typescript_unsupported" => RuntimeFailure::public(
+            "typescript_unsupported",
+            "TypeScript used unsupported syntax",
+        ),
+        "transformed_source_too_large" => RuntimeFailure::public(
+            "transformed_source_too_large",
+            "transformed JavaScript exceeded 1 MiB",
+        ),
+        "execution_failed" => {
+            RuntimeFailure::public("execution_failed", "TypeScript execution failed")
+        }
+        "result_too_large" => RuntimeFailure::public(
+            "result_too_large",
+            "execution output exceeded its size limit",
+        ),
+        "result_not_json" => RuntimeFailure::public(
+            "result_not_json",
+            "execution result was not JSON serializable",
+        ),
+        "javascript_runtime_failed" => RuntimeFailure::internal(
+            "javascript_runtime_failed",
+            "could not initialize JavaScript runtime",
+        ),
+        "tool_bridge_failed" => {
+            RuntimeFailure::internal("tool_bridge_failed", "tool bridge failed")
+        }
+        _ => RuntimeFailure::internal("worker_failed", "sandbox worker failed"),
+    }
+}
+
+fn validate_output(
+    result: &serde_json::Value,
+    emits: &[serde_json::Value],
+    console: &[super::ConsoleEntry],
+    limits: &RuntimeLimits,
+) -> Result<(), RuntimeFailure> {
+    let result_bytes = serde_json::to_vec(result)
+        .map_err(|_| RuntimeFailure::internal("ipc_frame_invalid", "worker result was invalid"))?
+        .len();
+    if result_bytes > limits.result_bytes {
+        return Err(RuntimeFailure::public(
+            "result_too_large",
+            "execution result exceeded 8 MiB",
+        ));
+    }
+    let emit_bytes = emits.iter().try_fold(0usize, |total, emit| {
+        serde_json::to_vec(emit)
+            .ok()
+            .and_then(|encoded| total.checked_add(encoded.len()))
+            .ok_or_else(|| {
+                RuntimeFailure::internal("ipc_frame_invalid", "worker emits were invalid")
+            })
+    })?;
+    if emits.len() > limits.max_emits || emit_bytes > limits.max_emit_bytes {
+        return Err(RuntimeFailure::internal(
+            "ipc_protocol_violation",
+            "worker emit limits were invalid",
+        ));
+    }
+    let console_bytes = console
+        .iter()
+        .map(|entry| entry.message.len())
+        .sum::<usize>();
+    if console.len() > limits.max_console_entries || console_bytes > limits.max_console_bytes {
+        return Err(RuntimeFailure::internal(
+            "ipc_protocol_violation",
+            "worker console limits were invalid",
+        ));
+    }
+    Ok(())
+}
+
+async fn write_parent_message(
+    writer: &Arc<Mutex<tokio::net::unix::OwnedWriteHalf>>,
+    aggregate_bytes: &AtomicUsize,
+    message: &ParentMessage,
+    aggregate_limit: usize,
+) -> Result<(), RuntimeFailure> {
+    let payload = encode_frame(message)?;
+    add_aggregate_bytes(aggregate_bytes, payload.len() + 4, aggregate_limit)?;
+    let mut guard = writer.lock().await;
+    write_encoded_frame(&mut *guard, &payload).await?;
+    Ok(())
+}
+
+fn add_aggregate_bytes(
+    aggregate: &AtomicUsize,
+    bytes: usize,
+    limit: usize,
+) -> Result<(), RuntimeFailure> {
+    aggregate
+        .fetch_update(Ordering::AcqRel, Ordering::Acquire, |current| {
+            current
+                .checked_add(bytes)
+                .filter(|updated| *updated <= limit)
+        })
+        .map(|_| ())
+        .map_err(|_| RuntimeFailure::internal("ipc_limit_exceeded", "IPC byte limit exceeded"))
+}
+
+fn validate_header(
+    version: u16,
+    message_generation: u64,
+    generation: u64,
+) -> Result<(), RuntimeFailure> {
+    if version != PROTOCOL_VERSION || message_generation != generation {
+        return Err(RuntimeFailure::internal(
+            "ipc_protocol_violation",
+            "worker IPC version or generation was invalid",
+        ));
+    }
+    Ok(())
+}
+
+fn spawn_worker(
+    executable: &Path,
+    generation: u64,
+    working_directory: &Path,
+    timeout: std::time::Duration,
+) -> Result<(UnixStream, Child), RuntimeFailure> {
+    let (parent, child_socket) = std::os::unix::net::UnixStream::pair().map_err(spawn_failure)?;
+    parent.set_nonblocking(true).map_err(spawn_failure)?;
+    let child_fd = child_socket.as_raw_fd();
+    #[cfg(target_os = "linux")]
+    let expected_parent = unsafe { libc::getpid() };
+    let configured_max_fd = unsafe { libc::sysconf(libc::_SC_OPEN_MAX) };
+    let max_fd = if configured_max_fd < 0 {
+        1_048_576
+    } else {
+        configured_max_fd.min(i32::MAX as libc::c_long) as i32
+    };
+    let cpu_seconds = cpu_limit_seconds(timeout);
+    let mut command = Command::new(executable);
+    command
+        .arg("sandbox-worker")
+        .arg("--ipc-fd")
+        .arg("3")
+        .arg("--generation")
+        .arg(generation.to_string())
+        .env_clear()
+        .current_dir(working_directory)
+        .stdin(Stdio::null())
+        .stdout(Stdio::null())
+        .stderr(Stdio::null());
+    command.kill_on_drop(true);
+    unsafe {
+        command.pre_exec(move || {
+            if libc::setsid() == -1 {
+                return Err(std::io::Error::last_os_error());
+            }
+            #[cfg(target_os = "linux")]
+            {
+                if libc::prctl(libc::PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) == -1
+                    || libc::prctl(libc::PR_SET_PDEATHSIG, libc::SIGKILL) == -1
+                    || libc::getppid() != expected_parent
+                {
+                    return Err(std::io::Error::last_os_error());
+                }
+            }
+            libc::umask(0o077);
+            set_limit(libc::RLIMIT_CORE, 0)?;
+            set_limit(libc::RLIMIT_FSIZE, 0)?;
+            set_limit(libc::RLIMIT_NOFILE, 16)?;
+            set_limit(libc::RLIMIT_STACK, 8 * 1024 * 1024)?;
+            set_limit(libc::RLIMIT_AS, 2 * 1024 * 1024 * 1024)?;
+            set_limit(libc::RLIMIT_CPU, cpu_seconds)?;
+            if child_fd != 3 && libc::dup2(child_fd, 3) == -1 {
+                return Err(std::io::Error::last_os_error());
+            }
+            let flags = libc::fcntl(3, libc::F_GETFD);
+            if flags == -1 || libc::fcntl(3, libc::F_SETFD, flags & !libc::FD_CLOEXEC) == -1 {
+                return Err(std::io::Error::last_os_error());
+            }
+            close_extra_fds(max_fd)?;
+            Ok(())
+        });
+    }
+    let child = command.spawn().map_err(spawn_failure)?;
+    drop(child_socket);
+    let parent = UnixStream::from_std(parent).map_err(spawn_failure)?;
+    Ok((parent, child))
+}
+
+unsafe fn close_extra_fds(max_fd: i32) -> std::io::Result<()> {
+    #[cfg(target_os = "linux")]
+    {
+        if unsafe { libc::syscall(libc::SYS_close_range, 4u32, u32::MAX, 0u32) } == 0 {
+            return Ok(());
+        }
+        let error = std::io::Error::last_os_error();
+        if error.raw_os_error() != Some(libc::ENOSYS) {
+            return Err(error);
+        }
+    }
+    #[cfg(target_os = "macos")]
+    {
+        unsafe { closefrom(4) };
+        return Ok(());
+    }
+    #[allow(unreachable_code)]
+    {
+        for fd in 4..max_fd {
+            unsafe { libc::close(fd) };
+        }
+        Ok(())
+    }
+}
+
+unsafe fn set_limit(resource: RlimitResource, value: u64) -> std::io::Result<()> {
+    let limit = libc::rlimit {
+        rlim_cur: value as libc::rlim_t,
+        rlim_max: value as libc::rlim_t,
+    };
+    if unsafe { libc::setrlimit(resource, &limit) } == -1 {
+        Err(std::io::Error::last_os_error())
+    } else {
+        Ok(())
+    }
+}
+
+async fn terminate_worker(child: &mut Child) {
+    if let Some(id) = child.id() {
+        unsafe {
+            libc::killpg(id as i32, libc::SIGKILL);
+        }
+    }
+    let _ = child.start_kill();
+    let _ = tokio::time::timeout(EXECUTION_SHUTDOWN_GRACE, child.wait()).await;
+}
+
+fn random_generation() -> u64 {
+    let bytes = uuid::Uuid::new_v4().into_bytes();
+    u64::from_le_bytes(bytes[..8].try_into().expect("UUID has eight bytes"))
+        .rem_euclid(i64::MAX as u64)
+        + 1
+}
+
+fn cpu_limit_seconds(timeout: std::time::Duration) -> u64 {
+    timeout
+        .as_secs()
+        .saturating_add(u64::from(timeout.subsec_nanos() != 0))
+        .max(1)
+}
+
+fn spawn_failure(_: std::io::Error) -> RuntimeFailure {
+    RuntimeFailure::internal("worker_unavailable", "could not start sandbox worker")
+}
+
+fn cancelled() -> RuntimeFailure {
+    RuntimeFailure::public("execution_cancelled", "TypeScript execution was cancelled")
+}
+
+struct PrivateTempDir(PathBuf);
+
+impl PrivateTempDir {
+    fn create() -> Result<Self, RuntimeFailure> {
+        use std::os::unix::fs::DirBuilderExt;
+
+        let path = std::env::temp_dir().join(format!("executor-sandbox-{}", uuid::Uuid::new_v4()));
+        let mut builder = std::fs::DirBuilder::new();
+        builder.mode(0o700);
+        builder.create(&path).map_err(|_| {
+            RuntimeFailure::internal("worker_unavailable", "could not create sandbox directory")
+        })?;
+        Ok(Self(path))
+    }
+
+    fn path(&self) -> &Path {
+        &self.0
+    }
+}
+
+impl Drop for PrivateTempDir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+struct ProcessGroupGuard(Option<u32>);
+
+impl ProcessGroupGuard {
+    fn disarm(&mut self) {
+        self.0 = None;
+    }
+}
+
+impl Drop for ProcessGroupGuard {
+    fn drop(&mut self) {
+        if let Some(pid) = self.0 {
+            unsafe {
+                libc::killpg(pid as i32, libc::SIGKILL);
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::{mem::size_of, sync::Arc, time::Duration};
+
+    use async_trait::async_trait;
+    use serde_json::json;
+    use tokio::{
+        io::{AsyncWriteExt, Interest},
+        sync::Notify,
+    };
+
+    use super::*;
+
+    const TEST_GENERATION: u64 = 41;
+
+    #[derive(Default)]
+    struct BlockingFirstCallDispatcher {
+        first_started: Notify,
+        release_first: Notify,
+        call_ids: Mutex<Vec<u64>>,
+    }
+
+    #[async_trait]
+    impl HostToolDispatcher for BlockingFirstCallDispatcher {
+        async fn dispatch(
+            &self,
+            call: ToolCall,
+            _cancellation: ExecutionCancellation,
+        ) -> ToolResult {
+            self.call_ids.lock().await.push(call.call_id);
+            if call.call_id == 1 {
+                self.first_started.notify_one();
+                self.release_first.notified().await;
+            }
+            ToolResult::Success {
+                value: json!({ "callId": call.call_id }),
+            }
+        }
+    }
+
+    struct NoopDispatcher;
+
+    #[async_trait]
+    impl HostToolDispatcher for NoopDispatcher {
+        async fn dispatch(
+            &self,
+            call: ToolCall,
+            _cancellation: ExecutionCancellation,
+        ) -> ToolResult {
+            ToolResult::Success {
+                value: json!({ "callId": call.call_id }),
+            }
+        }
+    }
+
+    struct StalledStoppingDispatcher;
+
+    #[async_trait]
+    impl HostToolDispatcher for StalledStoppingDispatcher {
+        async fn dispatch(
+            &self,
+            _call: ToolCall,
+            _cancellation: ExecutionCancellation,
+        ) -> ToolResult {
+            unreachable!("timeout drain test never dispatches a tool")
+        }
+
+        async fn execution_stopping(&self, _execution_id: &str) {
+            std::future::pending::<()>().await;
+        }
+    }
+
+    fn spawn_test_execution(
+        dispatcher: Arc<dyn HostToolDispatcher>,
+        cancellation: ExecutionCancellation,
+    ) -> (
+        UnixStream,
+        JoinHandle<Result<ExecutionOutput, RuntimeFailure>>,
+    ) {
+        let (parent, worker) = UnixStream::pair().expect("Unix stream pair creates");
+        let execution = tokio::spawn(run_execution(
+            parent,
+            TEST_GENERATION,
+            "ipc-test".to_owned(),
+            "".to_owned(),
+            RuntimeLimits::default(),
+            dispatcher,
+            cancellation,
+        ));
+        (worker, execution)
+    }
+
+    async fn read_start(worker: &mut UnixStream) {
+        let (message, _) = read_frame::<_, ParentMessage>(worker)
+            .await
+            .expect("start frame reads");
+        assert!(matches!(
+            message,
+            ParentMessage::Start {
+                version: PROTOCOL_VERSION,
+                generation: TEST_GENERATION,
+                ..
+            }
+        ));
+    }
+
+    async fn write_worker_message(worker: &mut UnixStream, message: &WorkerMessage) {
+        let payload = encode_frame(message).expect("worker frame encodes");
+        write_encoded_frame(worker, &payload)
+            .await
+            .expect("worker frame writes");
+    }
+
+    async fn read_tool_result(worker: &mut UnixStream, expected_call_id: u64) {
+        let (message, _) = read_frame::<_, ParentMessage>(worker)
+            .await
+            .expect("tool result reads");
+        assert!(matches!(
+            message,
+            ParentMessage::ToolResult {
+                version: PROTOCOL_VERSION,
+                generation: TEST_GENERATION,
+                call_id,
+                ..
+            } if call_id == expected_call_id
+        ));
+    }
+
+    fn shrink_send_buffer(worker: &UnixStream) {
+        let bytes: libc::c_int = 4 * 1024;
+        let result = unsafe {
+            libc::setsockopt(
+                worker.as_raw_fd(),
+                libc::SOL_SOCKET,
+                libc::SO_SNDBUF,
+                std::ptr::from_ref(&bytes).cast(),
+                size_of::<libc::c_int>() as libc::socklen_t,
+            )
+        };
+        assert_eq!(result, 0, "send buffer should shrink");
+    }
+
+    async fn assert_peer_reader_closed(worker: &mut UnixStream) {
+        let chunk = [0_u8; 8 * 1024];
+        tokio::time::timeout(Duration::from_secs(1), async {
+            loop {
+                worker
+                    .ready(Interest::WRITABLE)
+                    .await
+                    .expect("worker socket readiness");
+                match worker.try_write(&chunk) {
+                    Ok(_) => tokio::task::yield_now().await,
+                    Err(error) if error.kind() == std::io::ErrorKind::WouldBlock => {
+                        tokio::task::yield_now().await;
+                    }
+                    Err(_) => return,
+                }
+            }
+        })
+        .await
+        .expect("framed reader task releases its socket");
+    }
+
+    #[test]
+    fn cpu_limit_rounds_fractional_seconds_up_without_padding_exact_seconds() {
+        assert_eq!(cpu_limit_seconds(Duration::from_millis(1)), 1);
+        assert_eq!(cpu_limit_seconds(Duration::from_secs(1)), 1);
+        assert_eq!(cpu_limit_seconds(Duration::from_millis(1_001)), 2);
+        assert_eq!(cpu_limit_seconds(Duration::from_secs(300)), 300);
+    }
+
+    #[tokio::test]
+    async fn fragmented_frame_survives_tool_completion_select_branch() {
+        let dispatcher = Arc::new(BlockingFirstCallDispatcher::default());
+        let (mut worker, execution) =
+            spawn_test_execution(dispatcher.clone(), ExecutionCancellation::default());
+        read_start(&mut worker).await;
+        write_worker_message(
+            &mut worker,
+            &WorkerMessage::ToolCall {
+                version: PROTOCOL_VERSION,
+                generation: TEST_GENERATION,
+                call_id: 1,
+                path: "first.call".to_owned(),
+                arguments: json!({}),
+            },
+        )
+        .await;
+        dispatcher.first_started.notified().await;
+
+        shrink_send_buffer(&worker);
+        let second_payload = encode_frame(&WorkerMessage::ToolCall {
+            version: PROTOCOL_VERSION,
+            generation: TEST_GENERATION,
+            call_id: 2,
+            path: "second.call".to_owned(),
+            arguments: json!({ "padding": "x".repeat(512 * 1024) }),
+        })
+        .expect("second call frame encodes");
+        worker
+            .write_u32(second_payload.len() as u32)
+            .await
+            .expect("second call length writes");
+        worker
+            .write_all(&second_payload[..second_payload.len() - 1])
+            .await
+            .expect("partial second call writes");
+
+        dispatcher.release_first.notify_one();
+        read_tool_result(&mut worker, 1).await;
+        for _ in 0..8 {
+            tokio::task::yield_now().await;
+        }
+        worker
+            .write_all(&second_payload[second_payload.len() - 1..])
+            .await
+            .expect("second call finishes");
+        read_tool_result(&mut worker, 2).await;
+        write_worker_message(
+            &mut worker,
+            &WorkerMessage::Complete {
+                version: PROTOCOL_VERSION,
+                generation: TEST_GENERATION,
+                result: json!({ "complete": true }),
+                emits: Vec::new(),
+                console: Vec::new(),
+            },
+        )
+        .await;
+
+        let output = tokio::time::timeout(Duration::from_secs(2), execution)
+            .await
+            .expect("execution completes")
+            .expect("execution task joins")
+            .expect("execution succeeds");
+        assert_eq!(output.result, json!({ "complete": true }));
+        assert_eq!(
+            output
+                .tool_calls
+                .iter()
+                .map(|record| record.call_id)
+                .collect::<Vec<_>>(),
+            [1, 2]
+        );
+        assert_eq!(*dispatcher.call_ids.lock().await, [1, 2]);
+    }
+
+    #[tokio::test]
+    async fn cancellation_aborts_a_fragmented_reader_without_leaking_its_task() {
+        let cancellation = ExecutionCancellation::default();
+        let (mut worker, execution) =
+            spawn_test_execution(Arc::new(NoopDispatcher), cancellation.clone());
+        read_start(&mut worker).await;
+        worker.write_u32(1024).await.expect("frame length writes");
+        worker.write_all(b"{").await.expect("frame prefix writes");
+
+        cancellation.cancel();
+        let error = tokio::time::timeout(Duration::from_secs(1), execution)
+            .await
+            .expect("cancellation completes")
+            .expect("execution task joins")
+            .expect_err("execution is canceled");
+        assert_eq!(error.code, "execution_cancelled");
+        assert_peer_reader_closed(&mut worker).await;
+    }
+
+    #[tokio::test]
+    async fn aborting_execution_drops_the_fragmented_reader_task() {
+        let (mut worker, execution) =
+            spawn_test_execution(Arc::new(NoopDispatcher), ExecutionCancellation::default());
+        read_start(&mut worker).await;
+        worker.write_u32(1024).await.expect("frame length writes");
+        worker.write_all(b"{").await.expect("frame prefix writes");
+
+        execution.abort();
+        let _ = execution.await;
+        assert_peer_reader_closed(&mut worker).await;
+    }
+
+    #[tokio::test]
+    async fn truncated_and_oversized_worker_frames_fail_closed() {
+        let (mut truncated_worker, truncated_execution) =
+            spawn_test_execution(Arc::new(NoopDispatcher), ExecutionCancellation::default());
+        read_start(&mut truncated_worker).await;
+        truncated_worker
+            .write_u32(64)
+            .await
+            .expect("truncated frame length writes");
+        truncated_worker
+            .write_all(b"{}")
+            .await
+            .expect("truncated frame prefix writes");
+        truncated_worker
+            .shutdown()
+            .await
+            .expect("worker write side closes");
+        let truncated = truncated_execution
+            .await
+            .expect("truncated execution joins")
+            .expect_err("truncated frame fails");
+        assert_eq!(truncated.code, "worker_disconnected");
+
+        let (mut oversized_worker, oversized_execution) =
+            spawn_test_execution(Arc::new(NoopDispatcher), ExecutionCancellation::default());
+        read_start(&mut oversized_worker).await;
+        oversized_worker
+            .write_u32((super::super::protocol::FRAME_LIMIT + 1) as u32)
+            .await
+            .expect("oversized frame length writes");
+        let oversized = oversized_execution
+            .await
+            .expect("oversized execution joins")
+            .expect_err("oversized frame fails");
+        assert_eq!(oversized.code, "ipc_frame_invalid");
+        assert_peer_reader_closed(&mut oversized_worker).await;
+    }
+
+    #[tokio::test]
+    async fn timeout_drain_is_bounded_when_cleanup_never_finishes() {
+        let dispatcher: Arc<dyn HostToolDispatcher> = Arc::new(StalledStoppingDispatcher);
+        let mut run = Box::pin(std::future::pending::<
+            Result<ExecutionOutput, RuntimeFailure>,
+        >());
+        tokio::time::timeout(
+            Duration::from_secs(2),
+            drain_timed_out_execution(run.as_mut(), &dispatcher, "timeout-test"),
+        )
+        .await
+        .expect("timeout cleanup is bounded");
+    }
+
+    #[tokio::test]
+    async fn worker_reap_wait_is_bounded() {
+        let mut child = Command::new("sleep")
+            .arg("30")
+            .kill_on_drop(true)
+            .spawn()
+            .expect("test child starts");
+
+        tokio::time::timeout(Duration::from_secs(2), terminate_worker(&mut child))
+            .await
+            .expect("worker termination is bounded");
+        assert!(
+            child
+                .try_wait()
+                .expect("worker status is readable")
+                .is_some(),
+            "terminated worker is reaped"
+        );
+    }
+}
diff --git a/src/runtime/protocol.rs b/src/runtime/protocol.rs
new file mode 100644
index 000000000..bb2c96dba
--- /dev/null
+++ b/src/runtime/protocol.rs
@@ -0,0 +1,252 @@
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+use tokio::io::{AsyncRead, AsyncReadExt, AsyncWrite, AsyncWriteExt};
+
+use super::{ConsoleEntry, RuntimeFailure, RuntimeLimits, ToolResult};
+
+pub(crate) const PROTOCOL_VERSION: u16 = 1;
+pub(crate) const FRAME_LIMIT: usize = 18 * 1024 * 1024;
+
+#[derive(Debug, Serialize, Deserialize)]
+#[serde(tag = "type", rename_all = "snake_case", deny_unknown_fields)]
+pub(crate) enum ParentMessage {
+    Start {
+        version: u16,
+        generation: u64,
+        code: String,
+        limits: RuntimeLimits,
+    },
+    ToolResult {
+        version: u16,
+        generation: u64,
+        call_id: u64,
+        result: ToolResult,
+    },
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+#[serde(tag = "type", rename_all = "snake_case", deny_unknown_fields)]
+pub(crate) enum WorkerMessage {
+    ToolCall {
+        version: u16,
+        generation: u64,
+        call_id: u64,
+        path: String,
+        arguments: Value,
+    },
+    Complete {
+        version: u16,
+        generation: u64,
+        result: Value,
+        emits: Vec<Value>,
+        console: Vec<ConsoleEntry>,
+    },
+    Failed {
+        version: u16,
+        generation: u64,
+        failure: RuntimeFailure,
+    },
+}
+
+pub(crate) fn encode_frame<T: Serialize>(value: &T) -> Result<Vec<u8>, RuntimeFailure> {
+    let payload = serde_json::to_vec(value)
+        .map_err(|_| RuntimeFailure::internal("ipc_encode_failed", "could not encode IPC frame"))?;
+    if payload.len() > FRAME_LIMIT {
+        return Err(RuntimeFailure::internal(
+            "ipc_frame_too_large",
+            "IPC frame exceeded its size limit",
+        ));
+    }
+    Ok(payload)
+}
+
+pub(crate) async fn write_encoded_frame<W>(
+    writer: &mut W,
+    payload: &[u8],
+) -> Result<usize, RuntimeFailure>
+where
+    W: AsyncWrite + Unpin,
+{
+    writer
+        .write_u32(payload.len() as u32)
+        .await
+        .map_err(io_failure)?;
+    writer.write_all(payload).await.map_err(io_failure)?;
+    writer.flush().await.map_err(io_failure)?;
+    Ok(payload.len() + 4)
+}
+
+pub(crate) async fn read_frame<R, T>(reader: &mut R) -> Result<(T, usize), RuntimeFailure>
+where
+    R: AsyncRead + Unpin,
+    T: for<'de> Deserialize<'de>,
+{
+    let length = reader.read_u32().await.map_err(io_failure)? as usize;
+    if length == 0 || length > FRAME_LIMIT {
+        return Err(RuntimeFailure::internal(
+            "ipc_frame_invalid",
+            "IPC frame length was invalid",
+        ));
+    }
+    let mut payload = vec![0; length];
+    reader.read_exact(&mut payload).await.map_err(io_failure)?;
+    validate_json_structure(&payload)?;
+    let value = serde_json::from_slice(&payload).map_err(|_| {
+        RuntimeFailure::internal("ipc_frame_invalid", "IPC frame schema was invalid")
+    })?;
+    Ok((value, length + 4))
+}
+
+fn validate_json_structure(payload: &[u8]) -> Result<(), RuntimeFailure> {
+    const MAX_JSON_NODES: usize = 250_000;
+    const MAX_JSON_DEPTH: usize = 128;
+
+    let mut in_string = false;
+    let mut escaped = false;
+    let mut depth = 0usize;
+    let mut nodes = 1usize;
+    for byte in payload {
+        if in_string {
+            if escaped {
+                escaped = false;
+            } else if *byte == b'\\' {
+                escaped = true;
+            } else if *byte == b'"' {
+                in_string = false;
+            }
+            continue;
+        }
+        match *byte {
+            b'"' => in_string = true,
+            b'{' | b'[' => {
+                depth += 1;
+                nodes += 1;
+                if depth > MAX_JSON_DEPTH {
+                    return Err(invalid_structure());
+                }
+            }
+            b'}' | b']' => {
+                depth = depth.checked_sub(1).ok_or_else(invalid_structure)?;
+            }
+            b',' => nodes += 1,
+            _ => {}
+        }
+        if nodes > MAX_JSON_NODES {
+            return Err(invalid_structure());
+        }
+    }
+    if in_string || depth != 0 {
+        return Err(invalid_structure());
+    }
+    Ok(())
+}
+
+fn invalid_structure() -> RuntimeFailure {
+    RuntimeFailure::internal("ipc_frame_invalid", "IPC JSON structure was invalid")
+}
+
+fn io_failure(_: std::io::Error) -> RuntimeFailure {
+    RuntimeFailure::internal("worker_disconnected", "sandbox worker disconnected")
+}
+
+#[cfg(test)]
+mod tests {
+    use tokio::io::AsyncWriteExt;
+
+    use super::*;
+
+    #[tokio::test]
+    async fn rejects_oversized_length_before_reading_payload() {
+        let (mut writer, mut reader) = tokio::io::duplex(16);
+        writer
+            .write_u32((FRAME_LIMIT + 1) as u32)
+            .await
+            .expect("length should write");
+        let error = read_frame::<_, ParentMessage>(&mut reader)
+            .await
+            .expect_err("oversized frame must fail");
+        assert_eq!(error.code, "ipc_frame_invalid");
+    }
+
+    #[tokio::test]
+    async fn rejects_partial_and_unknown_field_frames() {
+        let (mut writer, mut reader) = tokio::io::duplex(128);
+        writer.write_u32(10).await.expect("length should write");
+        writer.write_all(b"{}").await.expect("payload should write");
+        drop(writer);
+        assert_eq!(
+            read_frame::<_, ParentMessage>(&mut reader)
+                .await
+                .expect_err("partial frame must fail")
+                .code,
+            "worker_disconnected"
+        );
+
+        let payload =
+            br#"{"type":"start","version":1,"generation":1,"code":"","limits":{},"host":"leak"}"#;
+        let (mut writer, mut reader) = tokio::io::duplex(256);
+        writer
+            .write_u32(payload.len() as u32)
+            .await
+            .expect("length should write");
+        writer
+            .write_all(payload)
+            .await
+            .expect("payload should write");
+        assert_eq!(
+            read_frame::<_, ParentMessage>(&mut reader)
+                .await
+                .expect_err("unknown field must fail")
+                .code,
+            "ipc_frame_invalid"
+        );
+    }
+
+    #[tokio::test]
+    async fn rejects_deeply_nested_json() {
+        let nested = format!("{}null{}", "[".repeat(256), "]".repeat(256));
+        let payload = format!(
+            r#"{{"type":"tool_call","version":1,"generation":1,"call_id":1,"path":"safe.path","arguments":{nested}}}"#
+        );
+        let (mut writer, mut reader) = tokio::io::duplex(payload.len() + 8);
+        writer
+            .write_u32(payload.len() as u32)
+            .await
+            .expect("length should write");
+        writer
+            .write_all(payload.as_bytes())
+            .await
+            .expect("payload should write");
+        assert_eq!(
+            read_frame::<_, WorkerMessage>(&mut reader)
+                .await
+                .expect_err("deep JSON must fail")
+                .code,
+            "ipc_frame_invalid"
+        );
+    }
+
+    #[tokio::test]
+    async fn rejects_excessively_wide_json_before_deserialization() {
+        let arguments = format!("[{}]", "0,".repeat(250_001));
+        let payload = format!(
+            r#"{{"type":"tool_call","version":1,"generation":1,"call_id":1,"path":"safe.path","arguments":{arguments}}}"#
+        );
+        let (mut writer, mut reader) = tokio::io::duplex(payload.len() + 8);
+        writer
+            .write_u32(payload.len() as u32)
+            .await
+            .expect("length should write");
+        writer
+            .write_all(payload.as_bytes())
+            .await
+            .expect("payload should write");
+        assert_eq!(
+            read_frame::<_, WorkerMessage>(&mut reader)
+                .await
+                .expect_err("wide JSON must fail")
+                .code,
+            "ipc_frame_invalid"
+        );
+    }
+}
diff --git a/src/runtime/transform.rs b/src/runtime/transform.rs
new file mode 100644
index 000000000..b9b0c4bcf
--- /dev/null
+++ b/src/runtime/transform.rs
@@ -0,0 +1,336 @@
+use std::path::Path;
+
+use oxc::{
+    allocator::Allocator,
+    ast::ast::{
+        BindingPattern, CallExpression, Decorator, ExportDefaultDeclarationKind, Expression,
+        ImportDeclaration, ImportExpression, JSXElement, JSXFragment, Program, Statement,
+        TSEnumDeclaration, TSModuleDeclaration,
+    },
+    ast_visit::{Visit, walk},
+    codegen::Codegen,
+    parser::Parser,
+    semantic::SemanticBuilder,
+    span::{GetSpan, SourceType},
+    transformer::{TransformOptions, Transformer},
+};
+
+use super::{MAX_SOURCE_BYTES, RuntimeFailure};
+
+pub(crate) fn recover_and_transform(input: &str) -> Result<String, RuntimeFailure> {
+    if input.len() > MAX_SOURCE_BYTES {
+        return Err(RuntimeFailure::public(
+            "source_too_large",
+            "TypeScript source exceeded 1 MiB",
+        ));
+    }
+    let recovered = first_fenced_block(input).unwrap_or(input).trim();
+    let wrapped = wrap_entrypoint(recovered)?;
+
+    let allocator = Allocator::default();
+    let source_type = SourceType::ts().with_module(true);
+    let parsed = Parser::new(&allocator, &wrapped, source_type).parse();
+    if !parsed.diagnostics.is_empty() {
+        return Err(RuntimeFailure::public(
+            "typescript_invalid",
+            "TypeScript could not be parsed",
+        ));
+    }
+    let mut program = parsed.program;
+    validate_program(&program)?;
+    let semantic = SemanticBuilder::new().with_enum_eval(true).build(&program);
+    if !semantic.diagnostics.is_empty() {
+        return Err(RuntimeFailure::public(
+            "typescript_invalid",
+            "TypeScript semantic analysis failed",
+        ));
+    }
+    let transformed = Transformer::new(
+        &allocator,
+        Path::new("executor-input.ts"),
+        &TransformOptions::default(),
+    )
+    .build_with_scoping(semantic.semantic.into_scoping(), &mut program);
+    if !transformed.diagnostics.is_empty() {
+        return Err(RuntimeFailure::public(
+            "typescript_unsupported",
+            "TypeScript used unsupported syntax",
+        ));
+    }
+    let output = Codegen::new().build(&program).code;
+    if output.len() > MAX_SOURCE_BYTES {
+        return Err(RuntimeFailure::public(
+            "transformed_source_too_large",
+            "transformed JavaScript exceeded 1 MiB",
+        ));
+    }
+    Ok(output)
+}
+
+fn first_fenced_block(input: &str) -> Option<&str> {
+    let start = input.find("```")?;
+    let after_ticks = &input[start + 3..];
+    let body_start = after_ticks.find('\n').map_or(0, |index| index + 1);
+    let body = &after_ticks[body_start..];
+    let end = body.find("```")?;
+    Some(&body[..end])
+}
+
+fn validate_program(program: &Program<'_>) -> Result<(), RuntimeFailure> {
+    let mut validator = UnsupportedSyntax::default();
+    validator.visit_program(program);
+    match validator.unsupported {
+        Some(name) => Err(RuntimeFailure::public(
+            "typescript_unsupported",
+            format!("{name} are not supported"),
+        )),
+        None => Ok(()),
+    }
+}
+
+#[derive(Default)]
+struct UnsupportedSyntax {
+    unsupported: Option<&'static str>,
+}
+
+impl<'a> Visit<'a> for UnsupportedSyntax {
+    fn visit_import_declaration(&mut self, _: &ImportDeclaration<'a>) {
+        self.unsupported.get_or_insert("imports");
+    }
+
+    fn visit_import_expression(&mut self, _: &ImportExpression<'a>) {
+        self.unsupported.get_or_insert("dynamic imports");
+    }
+
+    fn visit_call_expression(&mut self, expression: &CallExpression<'a>) {
+        if matches!(&expression.callee, Expression::Identifier(identifier) if identifier.name == "require")
+        {
+            self.unsupported.get_or_insert("module loading");
+        }
+        walk::walk_call_expression(self, expression);
+    }
+
+    fn visit_ts_enum_declaration(&mut self, _: &TSEnumDeclaration<'a>) {
+        self.unsupported.get_or_insert("TypeScript enums");
+    }
+
+    fn visit_ts_module_declaration(&mut self, _: &TSModuleDeclaration<'a>) {
+        self.unsupported.get_or_insert("TypeScript namespaces");
+    }
+
+    fn visit_decorator(&mut self, _: &Decorator<'a>) {
+        self.unsupported.get_or_insert("decorators");
+    }
+
+    fn visit_jsx_element(&mut self, _: &JSXElement<'a>) {
+        self.unsupported.get_or_insert("JSX elements");
+    }
+
+    fn visit_jsx_fragment(&mut self, _: &JSXFragment<'a>) {
+        self.unsupported.get_or_insert("JSX fragments");
+    }
+}
+
+fn wrap_entrypoint(source: &str) -> Result<String, RuntimeFailure> {
+    if source.is_empty() {
+        return Err(RuntimeFailure::public(
+            "typescript_invalid",
+            "TypeScript source was empty",
+        ));
+    }
+    let trimmed = source.trim();
+    match classify_entrypoint(trimmed)? {
+        Entrypoint::Body => Ok(format!(
+            "globalThis.__executor_entry = (async () => {{ {trimmed}\n }})();"
+        )),
+        Entrypoint::Named(name) => Ok(format!(
+            "globalThis.__executor_entry = (async () => {{ {trimmed}; return await {name}(); }})();"
+        )),
+        Entrypoint::Expression => Ok(format!(
+            "globalThis.__executor_entry = (async () => {{ const entry = ({trimmed}); return await entry(); }})();"
+        )),
+        Entrypoint::Default { start, end } => {
+            let expression = trimmed[start..end].trim_end_matches(';').trim_end();
+            Ok(format!(
+                "globalThis.__executor_entry = (async () => {{ const entry = ({expression}); return await entry(); }})();"
+            ))
+        }
+    }
+}
+
+enum Entrypoint {
+    Body,
+    Named(String),
+    Expression,
+    Default { start: usize, end: usize },
+}
+
+fn classify_entrypoint(source: &str) -> Result<Entrypoint, RuntimeFailure> {
+    let allocator = Allocator::default();
+    let parsed = Parser::new(&allocator, source, SourceType::ts().with_module(true)).parse();
+    if !parsed.diagnostics.is_empty() {
+        let expression_source = format!("({source})");
+        let expression_allocator = Allocator::default();
+        let expression = Parser::new(
+            &expression_allocator,
+            &expression_source,
+            SourceType::ts().with_module(true),
+        )
+        .parse();
+        if expression.diagnostics.is_empty() {
+            validate_program(&expression.program)?;
+            if matches!(
+                expression.program.body.first(),
+                Some(Statement::ExpressionStatement(statement))
+                    if is_callable_expression(&statement.expression)
+            ) {
+                return Ok(Entrypoint::Expression);
+            }
+        }
+        return Ok(Entrypoint::Body);
+    }
+    validate_program(&parsed.program)?;
+    let Some(first) = parsed.program.body.first() else {
+        return Ok(Entrypoint::Body);
+    };
+    match first {
+        Statement::FunctionDeclaration(function) => {
+            Ok(function.id.as_ref().map_or(Entrypoint::Body, |id| {
+                Entrypoint::Named(id.name.to_string())
+            }))
+        }
+        Statement::VariableDeclaration(declaration) => {
+            let Some(variable) = declaration.declarations.first() else {
+                return Ok(Entrypoint::Body);
+            };
+            let callable = variable.init.as_ref().is_some_and(is_callable_expression);
+            match (&variable.id, callable) {
+                (BindingPattern::BindingIdentifier(identifier), true) => {
+                    Ok(Entrypoint::Named(identifier.name.to_string()))
+                }
+                _ => Ok(Entrypoint::Body),
+            }
+        }
+        Statement::ExpressionStatement(statement)
+            if is_callable_expression(&statement.expression) =>
+        {
+            Ok(Entrypoint::Expression)
+        }
+        Statement::ExportDefaultDeclaration(declaration)
+            if matches!(
+                declaration.declaration,
+                ExportDefaultDeclarationKind::FunctionDeclaration(_)
+                    | ExportDefaultDeclarationKind::ArrowFunctionExpression(_)
+                    | ExportDefaultDeclarationKind::FunctionExpression(_)
+            ) =>
+        {
+            let span = declaration.declaration.span();
+            Ok(Entrypoint::Default {
+                start: span.start as usize,
+                end: span.end as usize,
+            })
+        }
+        _ => Ok(Entrypoint::Body),
+    }
+}
+
+fn is_callable_expression(expression: &Expression<'_>) -> bool {
+    match expression {
+        Expression::ArrowFunctionExpression(_) | Expression::FunctionExpression(_) => true,
+        Expression::ParenthesizedExpression(parenthesized) => {
+            is_callable_expression(&parenthesized.expression)
+        }
+        _ => false,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn recovers_first_fenced_block_and_removes_types() {
+        let output = recover_and_transform(
+            "before\n```ts\nconst value: number = 2; return value\n```\nafter",
+        )
+        .expect("source should transform");
+        assert!(output.contains("const value = 2"));
+        assert!(!output.contains(": number"));
+        assert!(!output.contains("after"));
+    }
+
+    #[test]
+    fn supports_function_and_default_export_entries() {
+        assert!(
+            recover_and_transform("async function main(): Promise<number> { return 4 }")
+                .expect("declaration should transform")
+                .contains("main()")
+        );
+        assert!(
+            recover_and_transform("export default async () => 5;")
+                .expect("default export should transform")
+                .contains("entry()")
+        );
+        assert!(
+            recover_and_transform("const main = async function (): Promise<number> { return 6 }")
+                .expect("callable variable should transform")
+                .contains("main()")
+        );
+        assert!(
+            recover_and_transform("function $main() { return 7 }")
+                .expect("dollar identifier should transform")
+                .contains("$main()")
+        );
+        assert!(
+            recover_and_transform("const main=async function() { return 8 }")
+                .expect("compact callable variable should transform")
+                .contains("main()")
+        );
+        assert!(
+            recover_and_transform("async function () { return 9 }")
+                .expect("anonymous function expression should transform")
+                .contains("entry()")
+        );
+    }
+
+    #[test]
+    fn rejects_capabilities_and_unsupported_syntax() {
+        for source in [
+            "import x from 'x'",
+            "return import('x')",
+            "enum X { A }",
+            "@sealed class X {}",
+            "return <div />",
+        ] {
+            let code = recover_and_transform(source)
+                .expect_err("source must be rejected")
+                .code;
+            assert!(
+                matches!(
+                    code.as_str(),
+                    "typescript_unsupported" | "typescript_invalid"
+                ),
+                "unexpected rejection code for {source}: {code}"
+            );
+        }
+    }
+
+    #[test]
+    fn unsupported_markers_inside_strings_and_comments_are_data() {
+        recover_and_transform(
+            r#"// import is documentation
+            const email = "person@example.com";
+            return { email, note: "enum import require(" };"#,
+        )
+        .expect("string and comment contents should not be syntax");
+        recover_and_transform("return /@/.test('x');")
+            .expect("regular expression contents should remain data");
+    }
+
+    #[test]
+    fn rejects_unsupported_syntax_nested_in_templates_without_panicking() {
+        let error = recover_and_transform("return `${(() => { enum X { A }; return X.A })()}`;")
+            .expect_err("nested enum must be rejected");
+        assert_eq!(error.code, "typescript_unsupported");
+    }
+}
diff --git a/src/runtime/worker.rs b/src/runtime/worker.rs
new file mode 100644
index 000000000..ac896bdc6
--- /dev/null
+++ b/src/runtime/worker.rs
@@ -0,0 +1,426 @@
+use std::{
+    collections::HashMap,
+    os::fd::OwnedFd,
+    sync::{
+        Arc,
+        atomic::{AtomicU64, AtomicUsize, Ordering},
+    },
+    time::{Duration, Instant},
+};
+
+use rquickjs::{
+    AsyncContext, AsyncRuntime, CatchResultExt, Promise, Value,
+    function::{Async, Func},
+};
+use serde::Deserialize;
+use serde_json::Value as JsonValue;
+use tokio::{
+    net::UnixStream,
+    sync::{Mutex, mpsc, oneshot},
+};
+
+use super::{
+    ConsoleEntry, RuntimeFailure, RuntimeLimits, ToolResult,
+    protocol::{
+        PROTOCOL_VERSION, ParentMessage, WorkerMessage, encode_frame, read_frame,
+        write_encoded_frame,
+    },
+    transform::recover_and_transform,
+};
+
+type PendingCalls = Arc<Mutex<HashMap<u64, oneshot::Sender<ToolResult>>>>;
+
+/// Runs the internal sandbox worker over an exclusively owned Unix stream.
+#[doc(hidden)]
+pub async fn worker_main(ipc_fd: OwnedFd, expected_generation: u64) -> Result<(), RuntimeFailure> {
+    let std_stream = std::os::unix::net::UnixStream::from(ipc_fd);
+    std_stream.set_nonblocking(true).map_err(|_| {
+        RuntimeFailure::internal("worker_ipc_failed", "could not configure worker IPC")
+    })?;
+    let stream = UnixStream::from_std(std_stream)
+        .map_err(|_| RuntimeFailure::internal("worker_ipc_failed", "could not open worker IPC"))?;
+    let (mut reader, mut writer) = stream.into_split();
+    let (start, initial_bytes) = read_frame::<_, ParentMessage>(&mut reader).await?;
+    let (generation, code, limits) = match start {
+        ParentMessage::Start {
+            version,
+            generation,
+            code,
+            limits,
+        } if version == PROTOCOL_VERSION && generation == expected_generation => {
+            (generation, code, limits)
+        }
+        _ => {
+            return Err(RuntimeFailure::internal(
+                "ipc_protocol_violation",
+                "worker start frame was invalid",
+            ));
+        }
+    };
+    limits.validate()?;
+
+    let (outgoing_tx, mut outgoing_rx) = mpsc::channel::<WorkerMessage>(32);
+    let aggregate_bytes = Arc::new(AtomicUsize::new(initial_bytes));
+    let writer_aggregate = aggregate_bytes.clone();
+    let aggregate_limit = limits.aggregate_bytes;
+    let writer_task = tokio::spawn(async move {
+        while let Some(message) = outgoing_rx.recv().await {
+            let payload = encode_frame(&message)?;
+            let bytes = payload.len() + 4;
+            if writer_aggregate
+                .fetch_update(Ordering::AcqRel, Ordering::Acquire, |current| {
+                    current
+                        .checked_add(bytes)
+                        .filter(|updated| *updated <= aggregate_limit)
+                })
+                .is_err()
+            {
+                return Err(RuntimeFailure::internal(
+                    "ipc_limit_exceeded",
+                    "IPC byte limit exceeded",
+                ));
+            }
+            write_encoded_frame(&mut writer, &payload).await?;
+        }
+        Ok::<_, RuntimeFailure>(())
+    });
+
+    let pending: PendingCalls = Arc::new(Mutex::new(HashMap::new()));
+    let pending_reader = pending.clone();
+    let reader_aggregate = aggregate_bytes;
+    let mut reader_task = tokio::spawn(async move {
+        loop {
+            let (message, bytes) = read_frame::<_, ParentMessage>(&mut reader).await?;
+            if reader_aggregate
+                .fetch_update(Ordering::AcqRel, Ordering::Acquire, |current| {
+                    current
+                        .checked_add(bytes)
+                        .filter(|updated| *updated <= aggregate_limit)
+                })
+                .is_err()
+            {
+                return Err(RuntimeFailure::internal(
+                    "ipc_limit_exceeded",
+                    "IPC byte limit exceeded",
+                ));
+            }
+            match message {
+                ParentMessage::ToolResult {
+                    version,
+                    generation: message_generation,
+                    call_id,
+                    result,
+                } if version == PROTOCOL_VERSION && message_generation == generation => {
+                    let sender = pending_reader
+                        .lock()
+                        .await
+                        .remove(&call_id)
+                        .ok_or_else(|| {
+                            RuntimeFailure::internal(
+                                "ipc_protocol_violation",
+                                "tool result had an unknown or duplicate call ID",
+                            )
+                        })?;
+                    let _ = sender.send(result);
+                }
+                _ => {
+                    return Err(RuntimeFailure::internal(
+                        "ipc_protocol_violation",
+                        "parent IPC message was invalid",
+                    ));
+                }
+            }
+        }
+        #[allow(unreachable_code)]
+        Ok::<(), RuntimeFailure>(())
+    });
+
+    let execution = tokio::select! {
+        execution = execute_javascript(
+            code,
+            limits.clone(),
+            generation,
+            outgoing_tx.clone(),
+            pending,
+        ) => execution,
+        reader = &mut reader_task => {
+            return Err(match reader {
+                Ok(Err(failure)) => failure,
+                Ok(Ok(())) => RuntimeFailure::internal("worker_disconnected", "sandbox parent disconnected"),
+                Err(_) => RuntimeFailure::internal("worker_failed", "IPC reader failed"),
+            });
+        }
+    };
+    let final_message = match execution {
+        Ok((result, emits, console)) => WorkerMessage::Complete {
+            version: PROTOCOL_VERSION,
+            generation,
+            result,
+            emits,
+            console,
+        },
+        Err(failure) => WorkerMessage::Failed {
+            version: PROTOCOL_VERSION,
+            generation,
+            failure,
+        },
+    };
+    outgoing_tx.send(final_message).await.map_err(|_| {
+        RuntimeFailure::internal("worker_disconnected", "sandbox parent disconnected")
+    })?;
+    drop(outgoing_tx);
+    reader_task.abort();
+    writer_task
+        .await
+        .map_err(|_| RuntimeFailure::internal("worker_failed", "IPC writer failed"))??;
+    Ok(())
+}
+
+async fn execute_javascript(
+    source: String,
+    limits: RuntimeLimits,
+    generation: u64,
+    outgoing: mpsc::Sender<WorkerMessage>,
+    pending: PendingCalls,
+) -> Result<(JsonValue, Vec<JsonValue>, Vec<ConsoleEntry>), RuntimeFailure> {
+    let transformed = recover_and_transform(&source)?;
+    let runtime = AsyncRuntime::new().map_err(js_internal)?;
+    runtime.set_memory_limit(limits.heap_bytes).await;
+    runtime.set_max_stack_size(limits.stack_bytes).await;
+    let deadline = Instant::now() + Duration::from_millis(limits.wall_time_millis);
+    runtime
+        .set_interrupt_handler(Some(Box::new(move || Instant::now() >= deadline)))
+        .await;
+    let context = AsyncContext::full(&runtime).await.map_err(js_internal)?;
+    let next_call_id = Arc::new(AtomicU64::new(1));
+    let issue_lock = Arc::new(Mutex::new(()));
+
+    let collected = context
+        .async_with(async |ctx| {
+            let sender = outgoing.clone();
+            let pending_calls = pending.clone();
+            let call_ids = next_call_id.clone();
+            let issue_calls = issue_lock.clone();
+            let argument_limit = limits.argument_bytes;
+            ctx.globals()
+                .set(
+                    "__executor_host_call",
+                    Func::from(Async(move |path: String, arguments: String| {
+                        let sender = sender.clone();
+                        let pending_calls = pending_calls.clone();
+                        let call_ids = call_ids.clone();
+                        let issue_calls = issue_calls.clone();
+                        async move {
+                            if arguments.len() > argument_limit {
+                                return Ok::<_, rquickjs::Error>(internal_result_json(
+                                    "argument_too_large",
+                                ));
+                            }
+                            let parsed: JsonValue = match serde_json::from_str(&arguments) {
+                                Ok(value) => value,
+                                Err(_) => {
+                                    return Ok(internal_result_json("argument_not_json"));
+                                }
+                            };
+                            let response_rx = {
+                                let _issue = issue_calls.lock().await;
+                                let call_id = call_ids.fetch_add(1, Ordering::Relaxed);
+                                let (response_tx, response_rx) = oneshot::channel();
+                                pending_calls.lock().await.insert(call_id, response_tx);
+                                if sender
+                                    .send(WorkerMessage::ToolCall {
+                                        version: PROTOCOL_VERSION,
+                                        generation,
+                                        call_id,
+                                        path,
+                                        arguments: parsed,
+                                    })
+                                    .await
+                                    .is_err()
+                                {
+                                    pending_calls.lock().await.remove(&call_id);
+                                    return Ok(internal_result_json("tool_bridge_failed"));
+                                }
+                                response_rx
+                            };
+                            match response_rx.await {
+                                Ok(result) => serde_json::to_string(&result)
+                                    .map_err(|_| rquickjs::Error::Unknown),
+                                Err(_) => Ok(internal_result_json("tool_bridge_failed")),
+                            }
+                        }
+                    })),
+                )
+                .map_err(js_public)?;
+
+            let bootstrap = bootstrap_script(&limits);
+            ctx.eval::<(), _>(bootstrap).map_err(|error| js_caught(&ctx, error))?;
+            ctx.eval::<(), _>(transformed)
+                .map_err(|error| js_caught(&ctx, error))?;
+            let promise: Promise = ctx
+                .globals()
+                .get("__executor_entry")
+                .map_err(|error| js_caught(&ctx, error))?;
+            let value: Value = promise
+                .into_future()
+                .await
+                .catch(&ctx)
+                .map_err(|_| RuntimeFailure::public("execution_failed", "TypeScript execution failed"))?;
+            ctx.globals()
+                .set("__executor_result", value)
+                .map_err(|error| js_caught(&ctx, error))?;
+            let serialized: String = ctx
+                .eval("JSON.stringify({result: __executor_result === undefined ? null : __executor_result, emits: __executor_emits, console: __executor_console})")
+                .map_err(|error| js_caught(&ctx, error))?;
+            if serialized.len() > limits.result_bytes + limits.max_emit_bytes + limits.max_console_bytes {
+                return Err(RuntimeFailure::public(
+                    "result_too_large",
+                    "execution output exceeded its size limit",
+                ));
+            }
+            let collected: CollectedOutput = serde_json::from_str(&serialized).map_err(|_| {
+                RuntimeFailure::public("result_not_json", "execution result was not JSON serializable")
+            })?;
+            if serde_json::to_vec(&collected.result).map_or(true, |value| value.len() > limits.result_bytes) {
+                return Err(RuntimeFailure::public(
+                    "result_too_large",
+                    "execution result exceeded 8 MiB",
+                ));
+            }
+            Ok(collected)
+        })
+        .await?;
+    runtime.idle().await;
+    if !pending.lock().await.is_empty() {
+        return Err(RuntimeFailure::internal(
+            "tool_bridge_failed",
+            "tool calls did not settle",
+        ));
+    }
+    Ok((collected.result, collected.emits, collected.console))
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct CollectedOutput {
+    result: JsonValue,
+    emits: Vec<JsonValue>,
+    console: Vec<ConsoleEntry>,
+}
+
+fn bootstrap_script(limits: &RuntimeLimits) -> String {
+    format!(
+        r#"
+        (() => {{
+          'use strict';
+          const hostCall = globalThis.__executor_host_call;
+          delete globalThis.__executor_host_call;
+          const safeString = (value) => {{
+            try {{
+              if (typeof value === 'string') return value;
+              const encoded = JSON.stringify(value);
+              return encoded === undefined ? String(value) : encoded;
+            }} catch (_) {{ return '[unserializable]'; }}
+          }};
+          const utf8Bytes = (value) => {{
+            let bytes = 0;
+            for (const character of value) {{
+              const point = character.codePointAt(0);
+              bytes += point <= 0x7f ? 1 : point <= 0x7ff ? 2 : point <= 0xffff ? 3 : 4;
+            }}
+            return bytes;
+          }};
+          globalThis.__executor_console = [];
+          let consoleBytes = 0;
+          const capture = (level, values) => {{
+            if (__executor_console.length >= {console_count}) return;
+            const message = values.map(safeString).join(' ');
+            consoleBytes += utf8Bytes(message);
+            if (consoleBytes <= {console_bytes}) __executor_console.push({{ level, message }});
+          }};
+          globalThis.console = Object.freeze({{
+            debug: (...v) => capture('debug', v), info: (...v) => capture('info', v),
+            log: (...v) => capture('log', v), warn: (...v) => capture('warn', v),
+            error: (...v) => capture('error', v)
+          }});
+          globalThis.__executor_emits = [];
+          let emitBytes = 0;
+          globalThis.emit = (value) => {{
+            if (__executor_emits.length >= {emit_count}) throw new Error('emit_limit_exceeded');
+            const encoded = JSON.stringify(value);
+            if (encoded === undefined) throw new Error('emit_not_json');
+            emitBytes += utf8Bytes(encoded);
+            if (emitBytes > {emit_bytes}) throw new Error('emit_limit_exceeded');
+            __executor_emits.push(JSON.parse(encoded));
+          }};
+          const makeTools = (path = []) => {{
+            const target = (..._args) => {{}};
+            delete target.name;
+            delete target.length;
+            Object.freeze(target);
+            return new Proxy(target, {{
+              get(_target, key) {{
+                if (key === 'then' || typeof key === 'symbol') return undefined;
+                return makeTools(path.concat(String(key)));
+              }},
+              apply(_target, _this, args) {{
+                const argument = args.length === 0 ? {{}} : args[0];
+                let encoded;
+                try {{ encoded = JSON.stringify(argument); }}
+                catch (_) {{ return Promise.reject(new Error('tool_argument_not_json')); }}
+                if (encoded === undefined) return Promise.reject(new Error('tool_argument_not_json'));
+                return hostCall(path.join('.'), encoded).then((raw) => {{
+                  const response = JSON.parse(raw);
+                  if (response.kind === 'success') return response.value;
+                  if (response.kind === 'failure') return {{ error: {{ code: response.code, message: response.message }} }};
+                  throw new Error(response.code || 'tool_bridge_failed');
+                }});
+              }}
+            }});
+          }};
+          globalThis.tools = makeTools();
+          for (const name of ['fetch','XMLHttpRequest','WebSocket','process','require','module','Deno','Bun']) {{
+            try {{ delete globalThis[name]; }} catch (_) {{ globalThis[name] = undefined; }}
+          }}
+        }})();
+        "#,
+        console_count = limits.max_console_entries,
+        console_bytes = limits.max_console_bytes,
+        emit_count = limits.max_emits,
+        emit_bytes = limits.max_emit_bytes,
+    )
+}
+
+fn internal_result_json(code: &str) -> String {
+    format!(r#"{{"kind":"internal_error","code":"{code}"}}"#)
+}
+
+fn js_internal(_: rquickjs::Error) -> RuntimeFailure {
+    RuntimeFailure::internal(
+        "javascript_runtime_failed",
+        "could not initialize JavaScript runtime",
+    )
+}
+
+fn js_public(_: rquickjs::Error) -> RuntimeFailure {
+    RuntimeFailure::public("execution_failed", "TypeScript execution failed")
+}
+
+fn js_caught<'js>(ctx: &rquickjs::Ctx<'js>, error: rquickjs::Error) -> RuntimeFailure {
+    let _ = (ctx, error);
+    RuntimeFailure::public("execution_failed", "TypeScript execution failed")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::bootstrap_script;
+    use crate::runtime::RuntimeLimits;
+
+    #[test]
+    fn bootstrap_does_not_embed_capabilities() {
+        let script = bootstrap_script(&RuntimeLimits::default());
+        assert!(script.contains("delete globalThis[name]"));
+        assert!(!script.contains("actor"));
+        assert!(!script.contains("credential"));
+    }
+}
diff --git a/src/service.rs b/src/service.rs
new file mode 100644
index 000000000..d185e50c4
--- /dev/null
+++ b/src/service.rs
@@ -0,0 +1,3503 @@
+use std::{
+    ffi::{OsStr, OsString},
+    fs::{self, DirBuilder, File, OpenOptions},
+    io::{Read, Write},
+    path::{Path, PathBuf},
+    process::Command,
+};
+
+use anyhow::{Context, Result, bail};
+use clap::{Args, Subcommand};
+use directories::BaseDirs;
+use sha2::{Digest, Sha256};
+use uuid::Uuid;
+
+const SYSTEMD_SERVICE: &str = "executor.service";
+const LAUNCHD_LABEL: &str = "dev.executor.gateway";
+const STATUS_INACTIVE: i32 = 3;
+
+const SYSTEMD_INSTALLER: &[u8] = include_bytes!("../scripts/install-systemd.sh");
+const SYSTEMD_KEY_HELPER: &[u8] = include_bytes!("../scripts/lib/install-systemd-master-key.sh");
+const SYSTEMD_UNIT: &[u8] = include_bytes!("../packaging/systemd/executor.service");
+const SYSTEMD_ENV: &[u8] = include_bytes!("../packaging/systemd/executor.env.example");
+const LAUNCHD_INSTALLER: &[u8] = include_bytes!("../scripts/install-launchd.sh");
+const LAUNCHD_PLIST: &[u8] = include_bytes!("../packaging/launchd/dev.executor.gateway.plist");
+const BOUNDED_LOGGER: &[u8] = include_bytes!("../packaging/launchd/bounded-log.sh");
+
+#[derive(Args, Debug)]
+pub struct ServiceArgs {
+    #[command(subcommand)]
+    pub command: ServiceCommand,
+}
+
+#[derive(Subcommand, Debug)]
+pub enum ServiceCommand {
+    Install(ServiceInstallArgs),
+    Status,
+    Start,
+    Stop,
+    Restart,
+    Remove,
+}
+
+#[derive(Args, Debug)]
+pub struct ServiceInstallArgs {
+    #[arg(long, help = "Install the service without starting it")]
+    pub no_start: bool,
+}
+
+#[derive(Debug)]
+pub struct ServiceOutcome {
+    exit_code: i32,
+    stdout: Vec<u8>,
+    stderr: Vec<u8>,
+}
+
+impl ServiceOutcome {
+    fn success(message: impl Into<Vec<u8>>) -> Self {
+        Self {
+            exit_code: 0,
+            stdout: message.into(),
+            stderr: Vec::new(),
+        }
+    }
+
+    fn inactive() -> Self {
+        Self {
+            exit_code: STATUS_INACTIVE,
+            stdout: b"inactive\n".to_vec(),
+            stderr: Vec::new(),
+        }
+    }
+
+    fn from_process(output: ProcessOutput, fallback: &[u8]) -> Self {
+        let stdout = if output.stdout.is_empty() {
+            fallback.to_vec()
+        } else {
+            output.stdout
+        };
+        Self {
+            exit_code: 0,
+            stdout,
+            stderr: output.stderr,
+        }
+    }
+
+    pub fn emit(self) -> Result<()> {
+        let mut stdout = std::io::stdout().lock();
+        stdout.write_all(&self.stdout)?;
+        stdout.flush()?;
+        let mut stderr = std::io::stderr().lock();
+        stderr.write_all(&self.stderr)?;
+        stderr.flush()?;
+        if self.exit_code != 0 {
+            std::process::exit(self.exit_code);
+        }
+        Ok(())
+    }
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+enum Platform {
+    Linux,
+    MacOs,
+    Unsupported,
+}
+
+#[derive(Clone, Debug)]
+struct ServicePaths {
+    linux_binary: PathBuf,
+    linux_unit: PathBuf,
+    linux_manifest: PathBuf,
+    linux_recovery: PathBuf,
+    linux_lock: PathBuf,
+    mac_executor_root: PathBuf,
+    mac_install_root: PathBuf,
+    mac_binary_dir: PathBuf,
+    mac_binary: PathBuf,
+    mac_library: PathBuf,
+    mac_launch_agents: PathBuf,
+    mac_plist: PathBuf,
+    mac_wrapper: PathBuf,
+    mac_logger: PathBuf,
+    mac_manifest: PathBuf,
+    mac_recovery: PathBuf,
+    mac_config: PathBuf,
+    mac_lock: PathBuf,
+}
+
+impl ServicePaths {
+    fn for_home(home: &Path) -> Self {
+        let mac_executor_root = home.join(".executor");
+        let mac_install_root = mac_executor_root.join("service");
+        let mac_binary_dir = mac_install_root.join("bin");
+        let mac_library = home.join("Library");
+        let mac_launch_agents = mac_library.join("LaunchAgents");
+        let mac_manifest = mac_install_root.join("service-install.manifest");
+        let mac_recovery = mac_install_root.join("service-install.recovery");
+        let mac_config = mac_install_root.join("service-config");
+        let mac_lock = mac_install_root.join("service-operation.lock");
+        let mac_wrapper = mac_install_root.join("run-launchd.sh");
+        let mac_logger = mac_install_root.join("bounded-log.sh");
+        Self {
+            linux_binary: PathBuf::from("/usr/local/bin/executor"),
+            linux_unit: PathBuf::from("/etc/systemd/system/executor.service"),
+            linux_manifest: PathBuf::from("/etc/executor/service-install.manifest"),
+            linux_recovery: PathBuf::from("/etc/executor/service-install.recovery"),
+            linux_lock: PathBuf::from("/etc/executor/service-operation.lock"),
+            mac_executor_root,
+            mac_binary: mac_binary_dir.join("executor"),
+            mac_binary_dir,
+            mac_install_root,
+            mac_plist: mac_launch_agents.join("dev.executor.gateway.plist"),
+            mac_wrapper,
+            mac_logger,
+            mac_manifest,
+            mac_recovery,
+            mac_config,
+            mac_lock,
+            mac_library,
+            mac_launch_agents,
+        }
+    }
+}
+
+#[derive(Clone, Debug)]
+struct ServiceContext {
+    platform: Platform,
+    effective_uid: u32,
+    filesystem_uid: u32,
+    current_exe: PathBuf,
+    installation_source: PathBuf,
+    home: PathBuf,
+    temporary_root: PathBuf,
+    paths: ServicePaths,
+    #[cfg(test)]
+    directory_sync_test: DirectorySyncTestState,
+}
+
+#[cfg(test)]
+#[derive(Clone, Debug, Default)]
+struct DirectorySyncTestState {
+    failure: std::rc::Rc<std::cell::RefCell<Option<PathBuf>>>,
+    events: std::rc::Rc<std::cell::RefCell<Vec<PathBuf>>>,
+}
+
+impl ServiceContext {
+    fn system() -> Result<Self> {
+        let platform = if cfg!(target_os = "linux") {
+            Platform::Linux
+        } else if cfg!(target_os = "macos") {
+            Platform::MacOs
+        } else {
+            Platform::Unsupported
+        };
+        let home = BaseDirs::new()
+            .context("could not determine the current user's home directory")?
+            .home_dir()
+            .to_path_buf();
+        let effective_uid = effective_uid();
+        let temporary_root = if platform == Platform::Linux {
+            PathBuf::from("/var/tmp")
+        } else {
+            std::env::temp_dir()
+        };
+        let current_exe =
+            std::env::current_exe().context("could not locate the running Executor binary")?;
+        let installation_source = if platform == Platform::Linux {
+            PathBuf::from("/proc/self/exe")
+        } else {
+            current_exe.clone()
+        };
+        Ok(Self {
+            platform,
+            effective_uid,
+            filesystem_uid: effective_uid,
+            current_exe,
+            installation_source,
+            paths: ServicePaths::for_home(&home),
+            home,
+            temporary_root,
+            #[cfg(test)]
+            directory_sync_test: DirectorySyncTestState::default(),
+        })
+    }
+}
+
+#[derive(Debug)]
+struct ProcessOutput {
+    code: Option<i32>,
+    stdout: Vec<u8>,
+    stderr: Vec<u8>,
+}
+
+impl ProcessOutput {
+    fn success(&self) -> bool {
+        self.code == Some(0)
+    }
+}
+
+trait CommandRunner {
+    fn run(&mut self, program: &OsStr, arguments: &[OsString]) -> Result<ProcessOutput>;
+}
+
+struct SystemCommandRunner;
+
+impl CommandRunner for SystemCommandRunner {
+    fn run(&mut self, program: &OsStr, arguments: &[OsString]) -> Result<ProcessOutput> {
+        let output = Command::new(program)
+            .args(arguments)
+            .output()
+            .with_context(|| format!("could not run {}", program.to_string_lossy()))?;
+        Ok(ProcessOutput {
+            code: output.status.code(),
+            stdout: output.stdout,
+            stderr: output.stderr,
+        })
+    }
+}
+
+#[derive(Clone, Copy)]
+enum BundleKind {
+    Systemd,
+    Launchd,
+}
+
+struct InstallerBundle {
+    root: PathBuf,
+}
+
+impl InstallerBundle {
+    fn create(context: &ServiceContext, kind: BundleKind) -> Result<Self> {
+        let temporary_root =
+            validate_temporary_root(&context.temporary_root, context.filesystem_uid)?;
+        let root =
+            create_private_directory(&temporary_root, ".executor-service", context.filesystem_uid)?;
+        let bundle = Self { root };
+        let files: &[(&str, &[u8], u32)] = match kind {
+            BundleKind::Systemd => &[
+                ("scripts/install-systemd.sh", SYSTEMD_INSTALLER, 0o700),
+                (
+                    "scripts/lib/install-systemd-master-key.sh",
+                    SYSTEMD_KEY_HELPER,
+                    0o600,
+                ),
+                ("packaging/systemd/executor.service", SYSTEMD_UNIT, 0o600),
+                ("packaging/systemd/executor.env.example", SYSTEMD_ENV, 0o600),
+            ],
+            BundleKind::Launchd => &[
+                ("scripts/install-launchd.sh", LAUNCHD_INSTALLER, 0o700),
+                (
+                    "packaging/launchd/dev.executor.gateway.plist",
+                    LAUNCHD_PLIST,
+                    0o600,
+                ),
+                ("packaging/launchd/bounded-log.sh", BOUNDED_LOGGER, 0o700),
+            ],
+        };
+        for (relative_path, contents, mode) in files {
+            bundle.write(relative_path, contents, *mode)?;
+        }
+        Ok(bundle)
+    }
+
+    fn write(&self, relative_path: &str, contents: &[u8], mode: u32) -> Result<()> {
+        let destination = self.root.join(relative_path);
+        let parent = destination
+            .parent()
+            .context("embedded installer path has no parent")?;
+        create_private_tree(&self.root, parent)?;
+        write_new_file(&destination, contents, mode)
+    }
+
+    fn script(&self, relative_path: &str) -> PathBuf {
+        self.root.join(relative_path)
+    }
+
+    fn stage_executable(&self, source: &Path) -> Result<PathBuf> {
+        let destination = self.root.join("executor");
+        copy_to_new_file(source, &destination, 0o700)?;
+        Ok(destination)
+    }
+}
+
+impl Drop for InstallerBundle {
+    fn drop(&mut self) {
+        let _ = fs::remove_dir_all(&self.root);
+    }
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+enum MacLoadState {
+    NotLoaded,
+    LoadedInactive,
+    Active,
+}
+
+const SERVICE_MANIFEST_HEADER: &str = "executor-service-install-v1";
+const SERVICE_RECOVERY_CONTENTS: &str = "executor-service-install-recovery-v1\n";
+const MAX_MANIFEST_BYTES: u64 = 4 * 1024;
+const MAX_MANAGED_FILE_BYTES: u64 = 512 * 1024 * 1024;
+
+struct ManagedFileSpec<'a> {
+    name: &'static str,
+    description: &'static str,
+    path: &'a Path,
+    mode: u32,
+    remove_with_service: bool,
+    allow_without_manifest: bool,
+}
+
+fn managed_file_specs(context: &ServiceContext) -> Vec<ManagedFileSpec<'_>> {
+    match context.platform {
+        Platform::Linux => vec![
+            ManagedFileSpec {
+                name: "binary",
+                description: "installed Executor binary",
+                path: &context.paths.linux_binary,
+                mode: 0o755,
+                remove_with_service: true,
+                allow_without_manifest: false,
+            },
+            ManagedFileSpec {
+                name: "unit",
+                description: "systemd unit",
+                path: &context.paths.linux_unit,
+                mode: 0o644,
+                remove_with_service: true,
+                allow_without_manifest: false,
+            },
+        ],
+        Platform::MacOs => vec![
+            ManagedFileSpec {
+                name: "binary",
+                description: "installed Executor binary",
+                path: &context.paths.mac_binary,
+                mode: 0o755,
+                remove_with_service: true,
+                allow_without_manifest: false,
+            },
+            ManagedFileSpec {
+                name: "plist",
+                description: "LaunchAgent plist",
+                path: &context.paths.mac_plist,
+                mode: 0o600,
+                remove_with_service: true,
+                allow_without_manifest: false,
+            },
+            ManagedFileSpec {
+                name: "wrapper",
+                description: "LaunchAgent wrapper",
+                path: &context.paths.mac_wrapper,
+                mode: 0o700,
+                remove_with_service: true,
+                allow_without_manifest: false,
+            },
+            ManagedFileSpec {
+                name: "logger",
+                description: "bounded log helper",
+                path: &context.paths.mac_logger,
+                mode: 0o700,
+                remove_with_service: true,
+                allow_without_manifest: false,
+            },
+            ManagedFileSpec {
+                name: "config",
+                description: "persisted LaunchAgent configuration",
+                path: &context.paths.mac_config,
+                mode: 0o600,
+                remove_with_service: false,
+                allow_without_manifest: true,
+            },
+        ],
+        Platform::Unsupported => Vec::new(),
+    }
+}
+
+fn service_manifest_path(context: &ServiceContext) -> &Path {
+    match context.platform {
+        Platform::Linux => &context.paths.linux_manifest,
+        Platform::MacOs | Platform::Unsupported => &context.paths.mac_manifest,
+    }
+}
+
+fn service_recovery_path(context: &ServiceContext) -> &Path {
+    match context.platform {
+        Platform::Linux => &context.paths.linux_recovery,
+        Platform::MacOs | Platform::Unsupported => &context.paths.mac_recovery,
+    }
+}
+
+fn preflight_service_install(context: &ServiceContext) -> Result<()> {
+    if service_recovery_exists(context)? {
+        return Ok(());
+    }
+    let specs = managed_file_specs(context);
+    if service_manifest_exists(context)? {
+        return verify_service_manifest_entries(context, &specs, false);
+    }
+
+    let source_hash = hash_source_file(&context.installation_source)?;
+    for spec in &specs {
+        if !managed_file_exists(context, spec)? {
+            continue;
+        }
+        if spec.allow_without_manifest {
+            continue;
+        }
+        if spec.name == "binary" && hash_managed_file(context, spec)? == source_hash {
+            continue;
+        }
+        bail!(
+            "refusing to replace unmanaged {} at {}; remove it manually or restore the Executor ownership manifest",
+            spec.description,
+            spec.path.display()
+        );
+    }
+    Ok(())
+}
+
+fn preflight_service_removal(context: &ServiceContext) -> Result<Vec<bool>> {
+    reject_incomplete_service_install(context)?;
+    let specs = managed_file_specs(context);
+    let manifest_exists = service_manifest_exists(context)?;
+    let existing = specs
+        .iter()
+        .map(|spec| {
+            if manifest_exists || spec.remove_with_service {
+                managed_file_exists(context, spec)
+            } else {
+                Ok(false)
+            }
+        })
+        .collect::<Result<Vec<_>>>()?;
+    if manifest_exists {
+        verify_service_manifest_entries(context, &specs, true)?;
+    } else if specs
+        .iter()
+        .zip(&existing)
+        .any(|(spec, exists)| spec.remove_with_service && *exists)
+    {
+        bail!(
+            "refusing to remove service files without the Executor ownership manifest at {}",
+            service_manifest_path(context).display()
+        );
+    }
+    Ok(existing)
+}
+
+fn verify_service_manifest(context: &ServiceContext) -> Result<()> {
+    reject_incomplete_service_install(context)?;
+    if !service_manifest_exists(context)? {
+        bail!(
+            "the Executor ownership manifest is missing at {}; rerun service install before mutating the service",
+            service_manifest_path(context).display()
+        );
+    }
+    verify_service_manifest_entries(context, &managed_file_specs(context), false)
+}
+
+fn reject_incomplete_service_install(context: &ServiceContext) -> Result<()> {
+    if service_recovery_exists(context)? {
+        bail!(
+            "a previous service installation did not finish; rerun service install before any other lifecycle command ({})",
+            service_recovery_path(context).display()
+        );
+    }
+    Ok(())
+}
+
+fn verify_service_manifest_entries(
+    context: &ServiceContext,
+    specs: &[ManagedFileSpec<'_>],
+    allow_missing: bool,
+) -> Result<()> {
+    let recorded = read_service_manifest(context, specs)?;
+    for (spec, expected_hash) in specs.iter().zip(recorded) {
+        if !managed_file_exists(context, spec)? {
+            if allow_missing && spec.remove_with_service {
+                continue;
+            }
+            bail!(
+                "managed {} recorded by the Executor ownership manifest is missing at {}",
+                spec.description,
+                spec.path.display()
+            );
+        }
+        let actual_hash = hash_managed_file(context, spec)?;
+        if actual_hash != expected_hash {
+            bail!(
+                "refusing to mutate replaced {} at {}; its contents do not match the Executor ownership manifest",
+                spec.description,
+                spec.path.display()
+            );
+        }
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+fn write_service_manifest(context: &ServiceContext) -> Result<()> {
+    let specs = managed_file_specs(context);
+    let mut contents = String::from(SERVICE_MANIFEST_HEADER);
+    contents.push('\n');
+    for spec in &specs {
+        contents.push_str(spec.name);
+        contents.push(' ');
+        contents.push_str(&hash_managed_file(context, spec)?);
+        contents.push('\n');
+    }
+
+    let manifest = service_manifest_path(context);
+    if let Some(parent) = manifest.parent() {
+        validate_owned_directory(parent, context.filesystem_uid, "service manifest directory")?;
+    }
+    validate_manifest_file(context)?;
+    let parent = manifest
+        .parent()
+        .context("service manifest has no parent")?;
+    let temporary = parent.join(format!(".service-install-{}.tmp", Uuid::new_v4()));
+    let write_result = (|| -> Result<()> {
+        write_new_file(&temporary, contents.as_bytes(), 0o600)?;
+        fs::rename(&temporary, manifest)?;
+        File::open(parent)?.sync_all()?;
+        Ok(())
+    })();
+    if write_result.is_err() {
+        let _ = fs::remove_file(&temporary);
+    }
+    write_result.with_context(|| {
+        format!(
+            "could not publish the Executor ownership manifest at {}",
+            manifest.display()
+        )
+    })
+}
+
+fn read_service_manifest(
+    context: &ServiceContext,
+    specs: &[ManagedFileSpec<'_>],
+) -> Result<Vec<String>> {
+    let path = service_manifest_path(context);
+    let mut file = open_no_follow(path)
+        .with_context(|| format!("could not open service manifest {}", path.display()))?;
+    let metadata = file
+        .metadata()
+        .with_context(|| format!("could not inspect service manifest {}", path.display()))?;
+    validate_control_file_metadata(context, path, &metadata, "service manifest")?;
+    if metadata.len() > MAX_MANIFEST_BYTES {
+        bail!("service manifest is too large: {}", path.display());
+    }
+    let mut contents = String::new();
+    std::io::Read::by_ref(&mut file)
+        .take(MAX_MANIFEST_BYTES + 1)
+        .read_to_string(&mut contents)
+        .with_context(|| format!("could not read service manifest {}", path.display()))?;
+    if contents.len() as u64 > MAX_MANIFEST_BYTES {
+        bail!("service manifest is too large: {}", path.display());
+    }
+    let mut lines = contents.lines();
+    if lines.next() != Some(SERVICE_MANIFEST_HEADER) {
+        bail!(
+            "service manifest has an unsupported format: {}",
+            path.display()
+        );
+    }
+    let mut hashes = Vec::with_capacity(specs.len());
+    for spec in specs {
+        let line = lines
+            .next()
+            .with_context(|| format!("service manifest is incomplete: {}", path.display()))?;
+        let (name, hash) = line
+            .split_once(' ')
+            .with_context(|| format!("service manifest is malformed: {}", path.display()))?;
+        if name != spec.name
+            || hash.len() != 64
+            || !hash
+                .bytes()
+                .all(|byte| byte.is_ascii_hexdigit() && !byte.is_ascii_uppercase())
+        {
+            bail!("service manifest is malformed: {}", path.display());
+        }
+        hashes.push(hash.to_owned());
+    }
+    if lines.next().is_some() {
+        bail!(
+            "service manifest has unexpected entries: {}",
+            path.display()
+        );
+    }
+    Ok(hashes)
+}
+
+fn service_manifest_exists(context: &ServiceContext) -> Result<bool> {
+    validate_manifest_file(context)
+}
+
+#[cfg(unix)]
+fn recover_service_recovery_publication_alias(context: &ServiceContext) -> Result<()> {
+    use std::os::unix::fs::MetadataExt;
+
+    let path = service_recovery_path(context);
+    let destination = match fs::symlink_metadata(path) {
+        Ok(metadata) => metadata,
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => return Ok(()),
+        Err(error) => {
+            return Err(error).with_context(|| {
+                format!(
+                    "could not inspect service recovery marker {}",
+                    path.display()
+                )
+            });
+        }
+    };
+    if !destination.is_file() || destination.nlink() != 2 {
+        return Ok(());
+    }
+    let parent = path
+        .parent()
+        .context("service recovery marker has no parent")?;
+    let mut matching_alias = None;
+    for entry in fs::read_dir(parent)? {
+        let entry = entry?;
+        let name = entry.file_name();
+        let Some(name) = name.to_str() else {
+            continue;
+        };
+        let Some(uuid) = name
+            .strip_prefix(".service-recovery-")
+            .and_then(|name| name.strip_suffix(".tmp"))
+        else {
+            continue;
+        };
+        if Uuid::parse_str(uuid).is_err() {
+            continue;
+        }
+        let alias_path = entry.path();
+        let alias = fs::symlink_metadata(&alias_path)?;
+        let is_matching = alias.is_file()
+            && alias.dev() == destination.dev()
+            && alias.ino() == destination.ino()
+            && alias.nlink() == 2
+            && alias.uid() == context.filesystem_uid
+            && alias.uid() == destination.uid()
+            && alias.gid() == destination.gid()
+            && alias.mode() == destination.mode()
+            && alias.mode() & 0o7777 == 0o600
+            && alias.len() == SERVICE_RECOVERY_CONTENTS.len() as u64
+            && alias.len() == destination.len();
+        if !is_matching {
+            continue;
+        }
+        if matching_alias.replace(alias_path).is_some() {
+            return Ok(());
+        }
+    }
+
+    if let Some(alias) = matching_alias {
+        let contents = fs::read(path)?;
+        if contents == SERVICE_RECOVERY_CONTENTS.as_bytes() {
+            fs::remove_file(alias)?;
+            sync_service_directory(context, parent, "service recovery directory")?;
+        }
+    }
+    Ok(())
+}
+
+#[cfg(not(unix))]
+fn recover_service_recovery_publication_alias(_context: &ServiceContext) -> Result<()> {
+    Ok(())
+}
+
+fn service_recovery_exists(context: &ServiceContext) -> Result<bool> {
+    recover_service_recovery_publication_alias(context)?;
+    let path = service_recovery_path(context);
+    let metadata = match fs::symlink_metadata(path) {
+        Ok(metadata) => metadata,
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => return Ok(false),
+        Err(error) => {
+            return Err(error).with_context(|| {
+                format!(
+                    "could not inspect service recovery marker {}",
+                    path.display()
+                )
+            });
+        }
+    };
+    validate_control_file_metadata(context, path, &metadata, "service recovery marker")?;
+    if metadata.len() != SERVICE_RECOVERY_CONTENTS.len() as u64 {
+        bail!("service recovery marker is malformed: {}", path.display());
+    }
+    let mut file = open_no_follow(path)
+        .with_context(|| format!("could not open service recovery marker {}", path.display()))?;
+    let mut contents = String::new();
+    std::io::Read::by_ref(&mut file)
+        .take((SERVICE_RECOVERY_CONTENTS.len() + 1) as u64)
+        .read_to_string(&mut contents)
+        .with_context(|| format!("could not read service recovery marker {}", path.display()))?;
+    if contents != SERVICE_RECOVERY_CONTENTS {
+        bail!("service recovery marker is malformed: {}", path.display());
+    }
+    let parent = path
+        .parent()
+        .context("service recovery marker has no parent")?;
+    sync_service_directory(context, parent, "service recovery directory")?;
+    Ok(true)
+}
+
+fn ensure_service_recovery_marker(context: &ServiceContext) -> Result<()> {
+    if service_recovery_exists(context)? {
+        return Ok(());
+    }
+    let path = service_recovery_path(context);
+    let parent = path
+        .parent()
+        .context("service recovery marker has no parent")?;
+    validate_owned_directory(parent, context.filesystem_uid, "service recovery directory")?;
+    let temporary = parent.join(format!(".service-recovery-{}.tmp", Uuid::new_v4()));
+    let publish_result = (|| -> Result<()> {
+        write_new_file(&temporary, SERVICE_RECOVERY_CONTENTS.as_bytes(), 0o600)?;
+        fs::hard_link(&temporary, path)?;
+        fs::remove_file(&temporary)?;
+        sync_service_directory(context, parent, "service recovery directory")?;
+        Ok(())
+    })();
+    if publish_result.is_err() {
+        let _ = fs::remove_file(&temporary);
+    }
+    publish_result.with_context(|| {
+        format!(
+            "could not publish service installation recovery marker {}",
+            path.display()
+        )
+    })
+}
+
+fn validate_manifest_file(context: &ServiceContext) -> Result<bool> {
+    let path = service_manifest_path(context);
+    match fs::symlink_metadata(path) {
+        Ok(metadata) => {
+            validate_control_file_metadata(context, path, &metadata, "service manifest")?;
+            Ok(true)
+        }
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => Ok(false),
+        Err(error) => Err(error)
+            .with_context(|| format!("could not inspect service manifest {}", path.display())),
+    }
+}
+
+fn validate_control_file_metadata(
+    context: &ServiceContext,
+    path: &Path,
+    metadata: &fs::Metadata,
+    description: &str,
+) -> Result<()> {
+    if metadata.file_type().is_symlink() || !metadata.is_file() {
+        bail!("{description} must be a regular file: {}", path.display());
+    }
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::MetadataExt;
+        if metadata.uid() != context.filesystem_uid
+            || metadata.nlink() != 1
+            || metadata.mode() & 0o7777 != 0o600
+        {
+            bail!(
+                "{description} must be owned by the service installer with mode 0600 and one hard link: {}",
+                path.display()
+            );
+        }
+    }
+    Ok(())
+}
+
+fn managed_file_exists(context: &ServiceContext, spec: &ManagedFileSpec<'_>) -> Result<bool> {
+    match fs::symlink_metadata(spec.path) {
+        Ok(metadata) => {
+            validate_managed_file_metadata(context, spec, &metadata)?;
+            Ok(true)
+        }
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => Ok(false),
+        Err(error) => Err(error).with_context(|| {
+            format!(
+                "could not inspect {}: {}",
+                spec.description,
+                spec.path.display()
+            )
+        }),
+    }
+}
+
+fn validate_managed_file_metadata(
+    context: &ServiceContext,
+    spec: &ManagedFileSpec<'_>,
+    metadata: &fs::Metadata,
+) -> Result<()> {
+    if metadata.file_type().is_symlink() || !metadata.is_file() {
+        bail!(
+            "{} must be a regular file: {}",
+            spec.description,
+            spec.path.display()
+        );
+    }
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::MetadataExt;
+        if metadata.uid() != context.filesystem_uid
+            || metadata.nlink() != 1
+            || metadata.mode() & 0o7777 != spec.mode
+        {
+            bail!(
+                "{} has unexpected ownership, links, or mode: {}",
+                spec.description,
+                spec.path.display()
+            );
+        }
+    }
+    if metadata.len() > MAX_MANAGED_FILE_BYTES {
+        bail!(
+            "{} is unexpectedly large: {}",
+            spec.description,
+            spec.path.display()
+        );
+    }
+    Ok(())
+}
+
+fn hash_managed_file(context: &ServiceContext, spec: &ManagedFileSpec<'_>) -> Result<String> {
+    let mut file = open_no_follow(spec.path).with_context(|| {
+        format!(
+            "could not open {}: {}",
+            spec.description,
+            spec.path.display()
+        )
+    })?;
+    let metadata = file.metadata().with_context(|| {
+        format!(
+            "could not inspect {}: {}",
+            spec.description,
+            spec.path.display()
+        )
+    })?;
+    validate_managed_file_metadata(context, spec, &metadata)?;
+    hash_reader(&mut file, spec.description)
+}
+
+fn hash_source_file(path: &Path) -> Result<String> {
+    let mut file = File::open(path)
+        .with_context(|| format!("could not open running Executor binary {}", path.display()))?;
+    let metadata = file.metadata().with_context(|| {
+        format!(
+            "could not inspect running Executor binary {}",
+            path.display()
+        )
+    })?;
+    if !metadata.is_file() || metadata.len() > MAX_MANAGED_FILE_BYTES {
+        bail!(
+            "running Executor binary is not a bounded regular file: {}",
+            path.display()
+        );
+    }
+    hash_reader(&mut file, "running Executor binary")
+}
+
+fn hash_reader(reader: &mut File, description: &str) -> Result<String> {
+    let mut digest = Sha256::new();
+    let mut buffer = [0_u8; 64 * 1024];
+    let mut total = 0_u64;
+    loop {
+        let read = reader
+            .read(&mut buffer)
+            .with_context(|| format!("could not read {description}"))?;
+        if read == 0 {
+            break;
+        }
+        total = total.saturating_add(read as u64);
+        if total > MAX_MANAGED_FILE_BYTES {
+            bail!("{description} is unexpectedly large");
+        }
+        digest.update(&buffer[..read]);
+    }
+    Ok(format!("{:x}", digest.finalize()))
+}
+
+fn open_no_follow(path: &Path) -> Result<File, std::io::Error> {
+    let mut options = OpenOptions::new();
+    options.read(true);
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::OpenOptionsExt;
+        options.custom_flags(libc::O_NOFOLLOW | libc::O_NONBLOCK);
+    }
+    options.open(path)
+}
+
+fn sync_service_directory(context: &ServiceContext, path: &Path, description: &str) -> Result<()> {
+    #[cfg(not(test))]
+    let _ = context;
+    #[cfg(test)]
+    {
+        context
+            .directory_sync_test
+            .events
+            .borrow_mut()
+            .push(path.to_path_buf());
+        if context.directory_sync_test.failure.borrow().as_deref() == Some(path) {
+            bail!("injected directory sync failure for {}", path.display());
+        }
+    }
+
+    let mut options = OpenOptions::new();
+    options.read(true);
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::OpenOptionsExt;
+        options.custom_flags(libc::O_DIRECTORY | libc::O_NOFOLLOW);
+    }
+    options
+        .open(path)
+        .and_then(|directory| directory.sync_all())
+        .with_context(|| format!("could not sync {description} {}", path.display()))
+}
+
+fn sync_removed_managed_file_parents(context: &ServiceContext) -> Result<()> {
+    let mut synced = Vec::new();
+    for spec in managed_file_specs(context)
+        .into_iter()
+        .filter(|spec| spec.remove_with_service)
+    {
+        let parent = spec
+            .path
+            .parent()
+            .with_context(|| format!("managed path has no parent: {}", spec.path.display()))?;
+        if synced
+            .iter()
+            .any(|synced_path: &PathBuf| synced_path == parent)
+        {
+            continue;
+        }
+        sync_service_directory(context, parent, "managed service directory")?;
+        synced.push(parent.to_path_buf());
+    }
+    Ok(())
+}
+
+fn remove_service_manifest(context: &ServiceContext) -> Result<()> {
+    let manifest = service_manifest_path(context);
+    let parent = manifest
+        .parent()
+        .context("service manifest has no parent")?;
+    if validate_manifest_file(context)? {
+        fs::remove_file(manifest)
+            .with_context(|| format!("could not remove service manifest {}", manifest.display()))?;
+    }
+    match fs::symlink_metadata(parent) {
+        Ok(metadata) if metadata.is_dir() && !metadata.file_type().is_symlink() => {
+            sync_service_directory(context, parent, "service manifest directory")?;
+        }
+        Ok(_) => bail!(
+            "service manifest parent must be a non-symlinked directory: {}",
+            parent.display()
+        ),
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => {}
+        Err(error) => {
+            return Err(error).with_context(|| {
+                format!(
+                    "could not inspect service manifest parent {}",
+                    parent.display()
+                )
+            });
+        }
+    }
+    Ok(())
+}
+
+pub fn execute(arguments: ServiceArgs) -> Result<ServiceOutcome> {
+    let context = ServiceContext::system()?;
+    execute_with(&context, &mut SystemCommandRunner, arguments.command)
+}
+
+struct ServiceOperationLock {
+    _file: File,
+}
+
+fn acquire_service_operation_lock(context: &ServiceContext) -> Result<ServiceOperationLock> {
+    let (path, parent): (&Path, &Path) = match context.platform {
+        Platform::Linux => {
+            let path = &context.paths.linux_lock;
+            let parent = path.parent().context("Linux service lock has no parent")?;
+            let trusted_parent = parent
+                .parent()
+                .context("Linux service lock directory has no trusted parent")?;
+            validate_owned_directory(
+                trusted_parent,
+                context.filesystem_uid,
+                "Linux service lock parent",
+            )?;
+            ensure_owned_directory(
+                parent,
+                context.filesystem_uid,
+                0o700,
+                "Linux service lock directory",
+                false,
+            )?;
+            (path.as_path(), parent)
+        }
+        Platform::MacOs => {
+            validate_owned_directory(
+                &context.home,
+                context.filesystem_uid,
+                "service lock home directory",
+            )?;
+            ensure_owned_directory(
+                &context.paths.mac_executor_root,
+                context.filesystem_uid,
+                0o700,
+                "Executor root directory",
+                false,
+            )?;
+            ensure_owned_directory(
+                &context.paths.mac_install_root,
+                context.filesystem_uid,
+                0o700,
+                "Executor service directory",
+                false,
+            )?;
+            (
+                context.paths.mac_lock.as_path(),
+                context.paths.mac_install_root.as_path(),
+            )
+        }
+        Platform::Unsupported => bail!("unsupported service lock platform"),
+    };
+    #[cfg(unix)]
+    {
+        use std::os::fd::AsRawFd;
+        use std::os::unix::fs::{MetadataExt, OpenOptionsExt};
+
+        let mut create = OpenOptions::new();
+        create
+            .read(true)
+            .write(true)
+            .create_new(true)
+            .mode(0o600)
+            .custom_flags(libc::O_NOFOLLOW | libc::O_NONBLOCK);
+        let file = match create.open(path) {
+            Ok(file) => {
+                file.sync_all().with_context(|| {
+                    format!(
+                        "could not sync new service operation lock {}",
+                        path.display()
+                    )
+                })?;
+                File::open(parent)
+                    .and_then(|directory| directory.sync_all())
+                    .with_context(|| {
+                        format!(
+                            "could not sync service operation lock directory {}",
+                            parent.display()
+                        )
+                    })?;
+                file
+            }
+            Err(error) if error.kind() == std::io::ErrorKind::AlreadyExists => {
+                let mut existing = OpenOptions::new();
+                existing
+                    .read(true)
+                    .write(true)
+                    .custom_flags(libc::O_NOFOLLOW | libc::O_NONBLOCK);
+                existing.open(path).with_context(|| {
+                    format!("could not open service operation lock {}", path.display())
+                })?
+            }
+            Err(error) => {
+                return Err(error).with_context(|| {
+                    format!("could not create service operation lock {}", path.display())
+                });
+            }
+        };
+        let metadata = file.metadata().with_context(|| {
+            format!(
+                "could not inspect service operation lock {}",
+                path.display()
+            )
+        })?;
+        if !metadata.is_file()
+            || metadata.uid() != context.filesystem_uid
+            || metadata.nlink() != 1
+            || metadata.mode() & 0o7777 != 0o600
+        {
+            bail!(
+                "service operation lock must be an installer-owned 0600 regular file with one link: {}",
+                path.display()
+            );
+        }
+        file.sync_all()
+            .with_context(|| format!("could not sync service operation lock {}", path.display()))?;
+        File::open(parent)
+            .and_then(|directory| directory.sync_all())
+            .with_context(|| {
+                format!(
+                    "could not sync service operation lock directory {}",
+                    parent.display()
+                )
+            })?;
+        let result = unsafe { libc::flock(file.as_raw_fd(), libc::LOCK_EX | libc::LOCK_NB) };
+        if result != 0 {
+            let error = std::io::Error::last_os_error();
+            if matches!(error.kind(), std::io::ErrorKind::WouldBlock) {
+                bail!("another Executor service operation is already active");
+            }
+            return Err(error).context("could not acquire the Executor service operation lock");
+        }
+        Ok(ServiceOperationLock { _file: file })
+    }
+    #[cfg(not(unix))]
+    {
+        let _ = (path, parent);
+        bail!("service operation locking requires a Unix platform")
+    }
+}
+
+fn execute_with(
+    context: &ServiceContext,
+    runner: &mut impl CommandRunner,
+    command: ServiceCommand,
+) -> Result<ServiceOutcome> {
+    match context.platform {
+        Platform::Linux => execute_linux(context, runner, command),
+        Platform::MacOs => execute_macos(context, runner, command),
+        Platform::Unsupported => {
+            bail!("service management is supported only on Linux and macOS")
+        }
+    }
+}
+
+fn execute_linux(
+    context: &ServiceContext,
+    runner: &mut impl CommandRunner,
+    command: ServiceCommand,
+) -> Result<ServiceOutcome> {
+    let _operation_lock = if matches!(&command, ServiceCommand::Status) {
+        None
+    } else {
+        require_linux_root(context)?;
+        Some(acquire_service_operation_lock(context)?)
+    };
+    match command {
+        ServiceCommand::Install(arguments) => {
+            require_linux_root(context)?;
+            preflight_service_install(context)?;
+            let bundle = InstallerBundle::create(context, BundleKind::Systemd)?;
+            let staged_binary = bundle.stage_executable(&context.installation_source)?;
+            let mut command_arguments = vec![
+                bundle.script("scripts/install-systemd.sh").into_os_string(),
+                OsString::from("--binary"),
+                staged_binary.into_os_string(),
+            ];
+            if arguments.no_start {
+                command_arguments.push(OsString::from("--no-start"));
+            }
+            let output = run_checked(
+                runner,
+                OsStr::new("/bin/bash"),
+                &command_arguments,
+                "systemd installation",
+            )?;
+            verify_service_manifest(context)?;
+            Ok(ServiceOutcome::from_process(
+                output,
+                b"Executor system service installed.\n",
+            ))
+        }
+        ServiceCommand::Status => linux_status(runner),
+        ServiceCommand::Start => {
+            require_linux_root(context)?;
+            require_regular_file(&context.paths.linux_unit, "systemd unit")?;
+            require_regular_file(&context.paths.linux_binary, "installed Executor binary")?;
+            verify_service_manifest(context)?;
+            let output = run_checked(
+                runner,
+                OsStr::new("systemctl"),
+                &os_args(&["start", SYSTEMD_SERVICE]),
+                "starting executor.service",
+            )?;
+            Ok(ServiceOutcome::from_process(
+                output,
+                b"Executor service started.\n",
+            ))
+        }
+        ServiceCommand::Stop => {
+            require_linux_root(context)?;
+            if linux_is_active(runner)? {
+                verify_service_manifest(context)?;
+                let output = run_checked(
+                    runner,
+                    OsStr::new("systemctl"),
+                    &os_args(&["stop", SYSTEMD_SERVICE]),
+                    "stopping executor.service",
+                )?;
+                Ok(ServiceOutcome::from_process(
+                    output,
+                    b"Executor service stopped.\n",
+                ))
+            } else {
+                Ok(ServiceOutcome::success(
+                    b"Executor service is already stopped.\n".to_vec(),
+                ))
+            }
+        }
+        ServiceCommand::Restart => {
+            require_linux_root(context)?;
+            require_regular_file(&context.paths.linux_unit, "systemd unit")?;
+            require_regular_file(&context.paths.linux_binary, "installed Executor binary")?;
+            verify_service_manifest(context)?;
+            let output = run_checked(
+                runner,
+                OsStr::new("systemctl"),
+                &os_args(&["restart", SYSTEMD_SERVICE]),
+                "restarting executor.service",
+            )?;
+            Ok(ServiceOutcome::from_process(
+                output,
+                b"Executor service restarted.\n",
+            ))
+        }
+        ServiceCommand::Remove => {
+            require_linux_root(context)?;
+            let manifest_exists = service_manifest_exists(context)?;
+            let managed = preflight_service_removal(context)?;
+            let unit_exists = managed[1];
+            let binary_exists = managed[0];
+            let active = linux_is_active(runner)?;
+            if active && !manifest_exists {
+                bail!("executor.service is active but has no Executor ownership manifest");
+            }
+            if unit_exists || active {
+                run_checked(
+                    runner,
+                    OsStr::new("systemctl"),
+                    &os_args(&["disable", "--now", SYSTEMD_SERVICE]),
+                    "disabling executor.service",
+                )?;
+            }
+            if binary_exists {
+                fs::remove_file(&context.paths.linux_binary)
+                    .context("could not remove the installed Executor binary")?;
+            }
+            if unit_exists {
+                fs::remove_file(&context.paths.linux_unit)
+                    .context("could not remove the systemd unit")?;
+            }
+            if manifest_exists {
+                sync_removed_managed_file_parents(context)?;
+            }
+            if unit_exists || manifest_exists {
+                run_checked(
+                    runner,
+                    OsStr::new("systemctl"),
+                    &os_args(&["daemon-reload"]),
+                    "reloading systemd",
+                )?;
+            }
+            remove_service_manifest(context)?;
+            Ok(ServiceOutcome::success(
+                b"Executor service removed. Data and configuration were preserved.\n".to_vec(),
+            ))
+        }
+    }
+}
+
+fn execute_macos(
+    context: &ServiceContext,
+    runner: &mut impl CommandRunner,
+    command: ServiceCommand,
+) -> Result<ServiceOutcome> {
+    require_macos_user(context)?;
+    let _operation_lock = if matches!(&command, ServiceCommand::Status) {
+        None
+    } else {
+        Some(acquire_service_operation_lock(context)?)
+    };
+    match command {
+        ServiceCommand::Install(arguments) => {
+            preflight_service_install(context)?;
+            let bundle = InstallerBundle::create(context, BundleKind::Launchd)?;
+            let staged_binary = bundle.stage_executable(&context.current_exe)?;
+            run_checked(
+                runner,
+                OsStr::new("/bin/bash"),
+                &[
+                    bundle.script("scripts/install-launchd.sh").into_os_string(),
+                    OsString::from("--binary"),
+                    staged_binary.into_os_string(),
+                    OsString::from("--validate-only"),
+                ],
+                "validating the LaunchAgent installation",
+            )?;
+            if mac_load_state(context, runner)? != MacLoadState::NotLoaded {
+                run_checked(
+                    runner,
+                    OsStr::new("launchctl"),
+                    &[OsString::from("bootout"), mac_service_target(context)],
+                    "stopping the existing LaunchAgent",
+                )?;
+            }
+            prepare_macos_directories(context)?;
+            ensure_service_recovery_marker(context)?;
+            atomic_copy_executable(&context.current_exe, &context.paths.mac_binary)?;
+            let mut command_arguments = vec![
+                bundle.script("scripts/install-launchd.sh").into_os_string(),
+                OsString::from("--binary"),
+                context.paths.mac_binary.clone().into_os_string(),
+            ];
+            if arguments.no_start {
+                command_arguments.push(OsString::from("--no-start"));
+            }
+            let output = run_checked(
+                runner,
+                OsStr::new("/bin/bash"),
+                &command_arguments,
+                "LaunchAgent installation",
+            )?;
+            verify_service_manifest(context)?;
+            Ok(ServiceOutcome::from_process(
+                output,
+                b"Executor LaunchAgent installed.\n",
+            ))
+        }
+        ServiceCommand::Status => match mac_load_state(context, runner)? {
+            MacLoadState::Active => Ok(ServiceOutcome::success(b"active\n".to_vec())),
+            MacLoadState::LoadedInactive | MacLoadState::NotLoaded => {
+                Ok(ServiceOutcome::inactive())
+            }
+        },
+        ServiceCommand::Start => {
+            require_macos_runtime_files(context)?;
+            verify_service_manifest(context)?;
+            match mac_load_state(context, runner)? {
+                MacLoadState::Active => Ok(ServiceOutcome::success(
+                    b"Executor service is already active.\n".to_vec(),
+                )),
+                MacLoadState::LoadedInactive => {
+                    let output = run_checked(
+                        runner,
+                        OsStr::new("launchctl"),
+                        &[OsString::from("kickstart"), mac_service_target(context)],
+                        "starting the Executor LaunchAgent",
+                    )?;
+                    Ok(ServiceOutcome::from_process(
+                        output,
+                        b"Executor service started.\n",
+                    ))
+                }
+                MacLoadState::NotLoaded => {
+                    launchctl_enable(context, runner)?;
+                    let output = launchctl_bootstrap(context, runner)?;
+                    Ok(ServiceOutcome::from_process(
+                        output,
+                        b"Executor service started.\n",
+                    ))
+                }
+            }
+        }
+        ServiceCommand::Stop => {
+            if mac_load_state(context, runner)? == MacLoadState::NotLoaded {
+                return Ok(ServiceOutcome::success(
+                    b"Executor service is already stopped.\n".to_vec(),
+                ));
+            }
+            verify_service_manifest(context)?;
+            let output = run_checked(
+                runner,
+                OsStr::new("launchctl"),
+                &[OsString::from("bootout"), mac_service_target(context)],
+                "stopping the Executor LaunchAgent",
+            )?;
+            Ok(ServiceOutcome::from_process(
+                output,
+                b"Executor service stopped.\n",
+            ))
+        }
+        ServiceCommand::Restart => {
+            require_macos_runtime_files(context)?;
+            verify_service_manifest(context)?;
+            if mac_load_state(context, runner)? != MacLoadState::NotLoaded {
+                run_checked(
+                    runner,
+                    OsStr::new("launchctl"),
+                    &[OsString::from("bootout"), mac_service_target(context)],
+                    "stopping the Executor LaunchAgent",
+                )?;
+            }
+            launchctl_enable(context, runner)?;
+            let output = launchctl_bootstrap(context, runner)?;
+            Ok(ServiceOutcome::from_process(
+                output,
+                b"Executor service restarted.\n",
+            ))
+        }
+        ServiceCommand::Remove => {
+            let manifest_exists = service_manifest_exists(context)?;
+            let existing = preflight_service_removal(context)?;
+            let load_state = mac_load_state(context, runner)?;
+            if load_state != MacLoadState::NotLoaded && !manifest_exists {
+                bail!("the Executor LaunchAgent is loaded but has no ownership manifest");
+            }
+            if load_state != MacLoadState::NotLoaded {
+                run_checked(
+                    runner,
+                    OsStr::new("launchctl"),
+                    &[OsString::from("bootout"), mac_service_target(context)],
+                    "stopping the Executor LaunchAgent",
+                )?;
+            }
+            for (spec, exists) in managed_file_specs(context).iter().zip(existing) {
+                if exists && spec.remove_with_service {
+                    fs::remove_file(spec.path).with_context(|| {
+                        format!("could not remove managed file {}", spec.path.display())
+                    })?;
+                }
+            }
+            if manifest_exists {
+                sync_removed_managed_file_parents(context)?;
+            }
+            remove_service_manifest(context)?;
+            Ok(ServiceOutcome::success(
+                b"Executor service removed. Data and logs were preserved.\n".to_vec(),
+            ))
+        }
+    }
+}
+
+fn linux_status(runner: &mut impl CommandRunner) -> Result<ServiceOutcome> {
+    if linux_is_active(runner)? {
+        Ok(ServiceOutcome::success(b"active\n".to_vec()))
+    } else {
+        Ok(ServiceOutcome::inactive())
+    }
+}
+
+fn linux_is_active(runner: &mut impl CommandRunner) -> Result<bool> {
+    let output = runner.run(
+        OsStr::new("systemctl"),
+        &os_args(&["is-active", SYSTEMD_SERVICE]),
+    )?;
+    if output.success() {
+        return Ok(true);
+    }
+    let state = String::from_utf8_lossy(&output.stdout);
+    if matches!(
+        state.trim(),
+        "inactive" | "failed" | "unknown" | "deactivating"
+    ) || matches!(output.code, Some(3 | 4))
+    {
+        return Ok(false);
+    }
+    command_failure(output, "querying executor.service status")
+}
+
+fn mac_load_state(
+    context: &ServiceContext,
+    runner: &mut impl CommandRunner,
+) -> Result<MacLoadState> {
+    let output = runner.run(
+        OsStr::new("launchctl"),
+        &[OsString::from("print"), mac_service_target(context)],
+    )?;
+    if output.success() {
+        let text = String::from_utf8_lossy(&output.stdout);
+        if text.lines().any(|line| line.trim() == "state = running") {
+            return Ok(MacLoadState::Active);
+        }
+        return Ok(MacLoadState::LoadedInactive);
+    }
+    let stderr = String::from_utf8_lossy(&output.stderr).to_ascii_lowercase();
+    if output.code == Some(113)
+        || stderr.contains("could not find service")
+        || stderr.contains("not found")
+    {
+        return Ok(MacLoadState::NotLoaded);
+    }
+    command_failure(output, "querying the Executor LaunchAgent")
+}
+
+fn launchctl_enable(
+    context: &ServiceContext,
+    runner: &mut impl CommandRunner,
+) -> Result<ProcessOutput> {
+    run_checked(
+        runner,
+        OsStr::new("launchctl"),
+        &[OsString::from("enable"), mac_service_target(context)],
+        "enabling the Executor LaunchAgent",
+    )
+}
+
+fn launchctl_bootstrap(
+    context: &ServiceContext,
+    runner: &mut impl CommandRunner,
+) -> Result<ProcessOutput> {
+    run_checked(
+        runner,
+        OsStr::new("launchctl"),
+        &[
+            OsString::from("bootstrap"),
+            mac_domain(context),
+            context.paths.mac_plist.clone().into_os_string(),
+        ],
+        "loading the Executor LaunchAgent",
+    )
+}
+
+fn require_linux_root(context: &ServiceContext) -> Result<()> {
+    if context.effective_uid != 0 {
+        bail!("this command manages a system service; rerun it with sudo")
+    }
+    Ok(())
+}
+
+fn require_macos_user(context: &ServiceContext) -> Result<()> {
+    if context.effective_uid == 0 {
+        bail!(
+            "the macOS LaunchAgent belongs to the logged-in user; do not run this command with sudo"
+        )
+    }
+    Ok(())
+}
+
+fn prepare_macos_directories(context: &ServiceContext) -> Result<()> {
+    validate_owned_directory(&context.home, context.filesystem_uid, "home directory")?;
+    ensure_owned_directory(
+        &context.paths.mac_executor_root,
+        context.filesystem_uid,
+        0o700,
+        "Executor root directory",
+        true,
+    )?;
+    ensure_owned_directory(
+        &context.paths.mac_install_root,
+        context.filesystem_uid,
+        0o700,
+        "Executor install directory",
+        true,
+    )?;
+    ensure_owned_directory(
+        &context.paths.mac_binary_dir,
+        context.filesystem_uid,
+        0o700,
+        "Executor binary directory",
+        true,
+    )?;
+    ensure_owned_directory(
+        &context.paths.mac_library,
+        context.filesystem_uid,
+        0o700,
+        "Library directory",
+        false,
+    )?;
+    ensure_owned_directory(
+        &context.paths.mac_launch_agents,
+        context.filesystem_uid,
+        0o700,
+        "LaunchAgents directory",
+        false,
+    )
+}
+
+fn require_macos_runtime_files(context: &ServiceContext) -> Result<()> {
+    require_regular_file(&context.paths.mac_plist, "LaunchAgent plist")?;
+    require_regular_file(&context.paths.mac_wrapper, "LaunchAgent wrapper")?;
+    require_regular_file(&context.paths.mac_logger, "bounded log helper")?;
+    require_regular_file(&context.paths.mac_binary, "installed Executor binary")
+}
+
+fn mac_domain(context: &ServiceContext) -> OsString {
+    OsString::from(format!("gui/{}", context.effective_uid))
+}
+
+fn mac_service_target(context: &ServiceContext) -> OsString {
+    OsString::from(format!("gui/{}/{}", context.effective_uid, LAUNCHD_LABEL))
+}
+
+fn run_checked(
+    runner: &mut impl CommandRunner,
+    program: &OsStr,
+    arguments: &[OsString],
+    action: &str,
+) -> Result<ProcessOutput> {
+    let output = runner.run(program, arguments)?;
+    if output.success() {
+        Ok(output)
+    } else {
+        command_failure(output, action)
+    }
+}
+
+fn command_failure<T>(output: ProcessOutput, action: &str) -> Result<T> {
+    let detail = String::from_utf8_lossy(&output.stderr);
+    let detail = detail.trim();
+    if detail.is_empty() {
+        bail!("{action} failed with exit status {:?}", output.code)
+    }
+    bail!("{action} failed: {detail}")
+}
+
+fn os_args(arguments: &[&str]) -> Vec<OsString> {
+    arguments.iter().map(OsString::from).collect()
+}
+
+fn validate_optional_regular_file(path: &Path, description: &str) -> Result<bool> {
+    match fs::symlink_metadata(path) {
+        Ok(metadata) if metadata.file_type().is_symlink() => {
+            bail!(
+                "refusing symbolic link at {description}: {}",
+                path.display()
+            )
+        }
+        Ok(metadata) if metadata.is_file() => Ok(true),
+        Ok(_) => bail!("{description} is not a regular file: {}", path.display()),
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => Ok(false),
+        Err(error) => Err(error)
+            .with_context(|| format!("could not inspect {description}: {}", path.display())),
+    }
+}
+
+fn require_regular_file(path: &Path, description: &str) -> Result<()> {
+    if !validate_optional_regular_file(path, description)? {
+        bail!("{description} is not installed at {}", path.display());
+    }
+    Ok(())
+}
+
+fn validate_temporary_root(path: &Path, expected_uid: u32) -> Result<PathBuf> {
+    let canonical = fs::canonicalize(path)
+        .with_context(|| format!("could not inspect temporary directory {}", path.display()))?;
+    let mut current = PathBuf::new();
+    for component in canonical.components() {
+        current.push(component);
+        let metadata = fs::symlink_metadata(&current).with_context(|| {
+            format!(
+                "could not inspect temporary directory ancestor {}",
+                current.display()
+            )
+        })?;
+        if metadata.file_type().is_symlink() || !metadata.is_dir() {
+            bail!(
+                "temporary path ancestor is not a canonical directory: {}",
+                current.display()
+            );
+        }
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::MetadataExt;
+            if !temporary_directory_metadata_is_safe(metadata.uid(), expected_uid, metadata.mode())
+            {
+                bail!(
+                    "temporary directory ancestor has unsafe ownership or permissions: {}",
+                    current.display()
+                );
+            }
+        }
+    }
+    Ok(canonical)
+}
+
+#[cfg(unix)]
+fn temporary_directory_metadata_is_safe(owner: u32, expected_uid: u32, mode: u32) -> bool {
+    if owner != 0 && owner != expected_uid {
+        return false;
+    }
+    if mode & 0o022 == 0 {
+        return true;
+    }
+    owner == 0 && mode & 0o1000 != 0
+}
+
+fn create_private_directory(parent: &Path, prefix: &str, expected_uid: u32) -> Result<PathBuf> {
+    #[cfg(unix)]
+    use std::os::unix::fs::{DirBuilderExt, MetadataExt};
+
+    for _ in 0..16 {
+        let path = parent.join(format!("{prefix}-{}", Uuid::new_v4()));
+        let mut builder = DirBuilder::new();
+        #[cfg(unix)]
+        builder.mode(0o700);
+        match builder.create(&path) {
+            Ok(()) => {
+                let validation = (|| -> Result<()> {
+                    set_mode(&path, 0o700)?;
+                    let metadata = fs::symlink_metadata(&path).with_context(|| {
+                        format!("could not inspect private directory {}", path.display())
+                    })?;
+                    if metadata.file_type().is_symlink() || !metadata.is_dir() {
+                        bail!(
+                            "private installer path is not a directory: {}",
+                            path.display()
+                        );
+                    }
+                    #[cfg(unix)]
+                    if metadata.uid() != expected_uid || metadata.mode() & 0o777 != 0o700 {
+                        bail!(
+                            "private installer directory has unsafe ownership or permissions: {}",
+                            path.display()
+                        );
+                    }
+                    Ok(())
+                })();
+                if let Err(error) = validation {
+                    let _ = fs::remove_dir(&path);
+                    return Err(error);
+                }
+                return Ok(path);
+            }
+            Err(error) if error.kind() == std::io::ErrorKind::AlreadyExists => continue,
+            Err(error) => {
+                return Err(error).with_context(|| {
+                    format!("could not create private directory {}", path.display())
+                });
+            }
+        }
+    }
+    bail!("could not allocate a unique private installer directory")
+}
+
+fn create_private_tree(root: &Path, destination: &Path) -> Result<()> {
+    let relative = destination
+        .strip_prefix(root)
+        .context("embedded installer path escaped its private directory")?;
+    let mut current = root.to_path_buf();
+    for component in relative.components() {
+        current.push(component);
+        match fs::create_dir(&current) {
+            Ok(()) => set_mode(&current, 0o700)?,
+            Err(error) if error.kind() == std::io::ErrorKind::AlreadyExists => {
+                let metadata = fs::symlink_metadata(&current)?;
+                if metadata.file_type().is_symlink() || !metadata.is_dir() {
+                    bail!(
+                        "installer bundle path is not a directory: {}",
+                        current.display()
+                    );
+                }
+            }
+            Err(error) => {
+                return Err(error).with_context(|| {
+                    format!(
+                        "could not create installer bundle path {}",
+                        current.display()
+                    )
+                });
+            }
+        }
+    }
+    Ok(())
+}
+
+fn write_new_file(path: &Path, contents: &[u8], mode: u32) -> Result<()> {
+    #[cfg(unix)]
+    use std::os::unix::fs::OpenOptionsExt;
+
+    let mut options = OpenOptions::new();
+    options.write(true).create_new(true);
+    #[cfg(unix)]
+    options.mode(mode);
+    let mut file = options
+        .open(path)
+        .with_context(|| format!("could not create {}", path.display()))?;
+    file.write_all(contents)?;
+    file.sync_all()?;
+    set_mode(path, mode)
+}
+
+fn validate_owned_directory(path: &Path, expected_uid: u32, description: &str) -> Result<()> {
+    let metadata = fs::symlink_metadata(path)
+        .with_context(|| format!("could not inspect {description}: {}", path.display()))?;
+    if metadata.file_type().is_symlink() || !metadata.is_dir() {
+        bail!(
+            "{description} must be a non-symlinked directory: {}",
+            path.display()
+        );
+    }
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::MetadataExt;
+        if metadata.uid() != expected_uid {
+            bail!(
+                "{description} is not owned by the current user: {}",
+                path.display()
+            );
+        }
+        if metadata.mode() & 0o022 != 0 {
+            bail!(
+                "{description} must not be group-writable or world-writable: {}",
+                path.display()
+            );
+        }
+    }
+    Ok(())
+}
+
+fn ensure_owned_directory(
+    path: &Path,
+    expected_uid: u32,
+    mode: u32,
+    description: &str,
+    harden_existing: bool,
+) -> Result<()> {
+    let created = match fs::symlink_metadata(path) {
+        Ok(_) => {
+            validate_owned_directory(path, expected_uid, description)?;
+            false
+        }
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => {
+            #[cfg(unix)]
+            use std::os::unix::fs::DirBuilderExt;
+            let mut builder = DirBuilder::new();
+            #[cfg(unix)]
+            builder.mode(mode);
+            builder
+                .create(path)
+                .with_context(|| format!("could not create {description}: {}", path.display()))?;
+            true
+        }
+        Err(error) => {
+            return Err(error)
+                .with_context(|| format!("could not inspect {description}: {}", path.display()));
+        }
+    };
+    if created || harden_existing {
+        set_mode(path, mode)
+    } else {
+        Ok(())
+    }
+}
+
+fn atomic_copy_executable(source: &Path, destination: &Path) -> Result<()> {
+    let metadata = fs::metadata(source)
+        .with_context(|| format!("could not inspect running binary {}", source.display()))?;
+    if !metadata.is_file() {
+        bail!(
+            "running Executor path is not a regular file: {}",
+            source.display()
+        );
+    }
+    validate_optional_regular_file(destination, "installed Executor binary")?;
+    let parent = destination
+        .parent()
+        .context("installed Executor path has no parent")?;
+    let temporary = parent.join(format!(".executor-{}", Uuid::new_v4()));
+    let copy_result = (|| -> Result<()> {
+        #[cfg(unix)]
+        use std::os::unix::fs::OpenOptionsExt;
+        let mut options = OpenOptions::new();
+        options.write(true).create_new(true);
+        #[cfg(unix)]
+        options.mode(0o700);
+        let mut target = options.open(&temporary)?;
+        let mut source = File::open(source)?;
+        let mut buffer = [0_u8; 64 * 1024];
+        loop {
+            let read = source.read(&mut buffer)?;
+            if read == 0 {
+                break;
+            }
+            target.write_all(&buffer[..read])?;
+        }
+        target.sync_all()?;
+        set_mode(&temporary, 0o755)?;
+        fs::rename(&temporary, destination)?;
+        File::open(parent)?.sync_all()?;
+        Ok(())
+    })();
+    if copy_result.is_err() {
+        let _ = fs::remove_file(&temporary);
+    }
+    copy_result.with_context(|| {
+        format!(
+            "could not install Executor binary at {}",
+            destination.display()
+        )
+    })
+}
+
+fn copy_to_new_file(source: &Path, destination: &Path, mode: u32) -> Result<()> {
+    #[cfg(unix)]
+    use std::os::unix::fs::OpenOptionsExt;
+
+    let mut options = OpenOptions::new();
+    options.write(true).create_new(true);
+    #[cfg(unix)]
+    options.mode(mode);
+    let mut target = options
+        .open(destination)
+        .with_context(|| format!("could not create {}", destination.display()))?;
+    let mut source = File::open(source)
+        .with_context(|| format!("could not open running binary {}", source.display()))?;
+    std::io::copy(&mut source, &mut target)?;
+    target.sync_all()?;
+    set_mode(destination, mode)
+}
+
+#[cfg(unix)]
+fn set_mode(path: &Path, mode: u32) -> Result<()> {
+    use std::os::unix::fs::PermissionsExt;
+    fs::set_permissions(path, fs::Permissions::from_mode(mode))?;
+    Ok(())
+}
+
+#[cfg(not(unix))]
+fn set_mode(_path: &Path, _mode: u32) -> Result<()> {
+    bail!("service management is supported only on Linux and macOS")
+}
+
+#[cfg(unix)]
+fn effective_uid() -> u32 {
+    unsafe { libc::geteuid() }
+}
+
+#[cfg(not(unix))]
+fn effective_uid() -> u32 {
+    0
+}
+
+#[cfg(test)]
+mod tests {
+    use std::{
+        collections::VecDeque,
+        os::unix::fs::{MetadataExt, PermissionsExt},
+    };
+
+    use super::*;
+
+    #[derive(Debug)]
+    struct Invocation {
+        program: OsString,
+        arguments: Vec<OsString>,
+    }
+
+    #[derive(Default)]
+    struct FakeRunner {
+        responses: VecDeque<FakeResponse>,
+        invocations: Vec<Invocation>,
+    }
+
+    struct FakeResponse {
+        output: ProcessOutput,
+        action: Option<Box<dyn FnOnce()>>,
+    }
+
+    impl FakeRunner {
+        fn respond(&mut self, code: i32, stdout: &str, stderr: &str) {
+            self.responses.push_back(FakeResponse {
+                output: ProcessOutput {
+                    code: Some(code),
+                    stdout: stdout.as_bytes().to_vec(),
+                    stderr: stderr.as_bytes().to_vec(),
+                },
+                action: None,
+            });
+        }
+
+        fn respond_with(
+            &mut self,
+            code: i32,
+            stdout: &str,
+            stderr: &str,
+            action: impl FnOnce() + 'static,
+        ) {
+            self.responses.push_back(FakeResponse {
+                output: ProcessOutput {
+                    code: Some(code),
+                    stdout: stdout.as_bytes().to_vec(),
+                    stderr: stderr.as_bytes().to_vec(),
+                },
+                action: Some(Box::new(action)),
+            });
+        }
+    }
+
+    impl CommandRunner for FakeRunner {
+        fn run(&mut self, program: &OsStr, arguments: &[OsString]) -> Result<ProcessOutput> {
+            self.invocations.push(Invocation {
+                program: program.to_os_string(),
+                arguments: arguments.to_vec(),
+            });
+            let response = self
+                .responses
+                .pop_front()
+                .context("fake command response was not configured")?;
+            if let Some(action) = response.action {
+                action();
+            }
+            Ok(response.output)
+        }
+    }
+
+    struct TestContext {
+        _directory: tempfile::TempDir,
+        context: ServiceContext,
+    }
+
+    impl TestContext {
+        fn new(platform: Platform, effective_uid: u32) -> Self {
+            let directory = tempfile::tempdir().expect("temporary directory");
+            let home = directory.path().join("home");
+            let temporary_root = directory.path().join("tmp");
+            let linux_lock_root = directory.path().join("etc");
+            fs::create_dir(&home).expect("home directory");
+            fs::create_dir(&temporary_root).expect("temporary root");
+            fs::create_dir(&linux_lock_root).expect("Linux lock root");
+            set_mode(&home, 0o700).expect("home mode");
+            set_mode(&temporary_root, 0o700).expect("temporary mode");
+            set_mode(&linux_lock_root, 0o700).expect("Linux lock root mode");
+            let current_exe = directory.path().join("executor-source");
+            fs::write(&current_exe, b"test executor binary").expect("source binary");
+            set_mode(&current_exe, 0o755).expect("source mode");
+            let filesystem_uid = fs::metadata(&home).expect("home metadata").uid();
+            let mut paths = ServicePaths::for_home(&home);
+            paths.linux_binary = directory.path().join("usr/local/bin/executor");
+            paths.linux_unit = directory.path().join("etc/systemd/system/executor.service");
+            paths.linux_manifest = directory
+                .path()
+                .join("etc/executor/service-install.manifest");
+            paths.linux_recovery = directory
+                .path()
+                .join("etc/executor/service-install.recovery");
+            paths.linux_lock = directory.path().join("etc/executor/service-operation.lock");
+            Self {
+                context: ServiceContext {
+                    platform,
+                    effective_uid,
+                    filesystem_uid,
+                    installation_source: current_exe.clone(),
+                    current_exe,
+                    paths,
+                    home,
+                    temporary_root,
+                    directory_sync_test: DirectorySyncTestState::default(),
+                },
+                _directory: directory,
+            }
+        }
+    }
+
+    fn write_managed_fixtures(context: &ServiceContext) {
+        for spec in managed_file_specs(context) {
+            fs::create_dir_all(spec.path.parent().expect("managed parent"))
+                .expect("managed parent");
+            fs::write(spec.path, format!("{} fixture", spec.name)).expect("managed fixture");
+            set_mode(spec.path, spec.mode).expect("managed fixture mode");
+        }
+        fs::create_dir_all(
+            service_manifest_path(context)
+                .parent()
+                .expect("manifest parent"),
+        )
+        .expect("manifest parent");
+        write_service_manifest(context).expect("ownership manifest");
+    }
+
+    fn queue_successful_macos_install(runner: &mut FakeRunner, context: &ServiceContext) {
+        queue_successful_macos_install_with_config(runner, context, b"config");
+    }
+
+    fn queue_successful_macos_install_with_config(
+        runner: &mut FakeRunner,
+        context: &ServiceContext,
+        config_contents: &[u8],
+    ) {
+        runner.respond(0, "LaunchAgent paths and configuration are valid.\n", "");
+        runner.respond(113, "", "Could not find service");
+        let paths = context.paths.clone();
+        let installed_context = context.clone();
+        let config_contents = config_contents.to_vec();
+        runner.respond_with(0, "installed\n", "", move || {
+            for (path, contents, mode) in [
+                (&paths.mac_plist, b"plist".as_slice(), 0o600),
+                (&paths.mac_wrapper, b"wrapper".as_slice(), 0o700),
+                (&paths.mac_logger, b"logger".as_slice(), 0o700),
+            ] {
+                fs::write(path, contents).expect("installed managed file");
+                set_mode(path, mode).expect("managed file mode");
+            }
+            fs::write(&paths.mac_config, config_contents).expect("installed service config");
+            set_mode(&paths.mac_config, 0o600).expect("service config mode");
+            write_service_manifest(&installed_context).expect("installed manifest");
+            fs::remove_file(&installed_context.paths.mac_recovery).expect("clear recovery marker");
+        });
+    }
+
+    fn encode_service_config_value(value: &Path) -> String {
+        value
+            .to_string_lossy()
+            .as_bytes()
+            .iter()
+            .map(|byte| format!("{byte:02x}"))
+            .collect()
+    }
+
+    fn write_archive_fixture(context: &ServiceContext, contents: &[u8]) -> (PathBuf, PathBuf) {
+        let archive_directory = context.home.join(".executor/bin");
+        let archive_binary = archive_directory.join("executor");
+        let archive_manifest = archive_directory.join(".executor-install-manifest");
+        fs::create_dir_all(&archive_directory).expect("archive directory");
+        fs::write(&archive_binary, contents).expect("archive binary");
+        set_mode(&archive_binary, 0o755).expect("archive binary mode");
+        let binary_hash = hash_source_file(&archive_binary).expect("archive binary hash");
+        fs::write(
+            &archive_manifest,
+            format!("executor-install-manifest-v1\n{binary_hash} executor\n"),
+        )
+        .expect("archive manifest");
+        set_mode(&archive_manifest, 0o600).expect("archive manifest mode");
+        (archive_binary, archive_manifest)
+    }
+
+    #[test]
+    fn temporary_directory_metadata_requires_trusted_ownership_and_permissions() {
+        let expected_uid = 501;
+        assert!(temporary_directory_metadata_is_safe(
+            0,
+            expected_uid,
+            0o40755
+        ));
+        assert!(temporary_directory_metadata_is_safe(
+            expected_uid,
+            expected_uid,
+            0o40700
+        ));
+        assert!(temporary_directory_metadata_is_safe(
+            0,
+            expected_uid,
+            0o41777
+        ));
+        assert!(!temporary_directory_metadata_is_safe(
+            502,
+            expected_uid,
+            0o41777
+        ));
+        assert!(!temporary_directory_metadata_is_safe(
+            expected_uid,
+            expected_uid,
+            0o41777
+        ));
+        assert!(!temporary_directory_metadata_is_safe(
+            0,
+            expected_uid,
+            0o40777
+        ));
+    }
+
+    #[test]
+    fn unsafe_temporary_ancestor_is_rejected_before_bundle_files_are_written() {
+        let mut test = TestContext::new(Platform::MacOs, 501);
+        set_mode(&test.context.temporary_root, 0o1777).expect("sticky temporary root");
+        test.context.filesystem_uid = if test.context.filesystem_uid == u32::MAX {
+            test.context.filesystem_uid - 1
+        } else {
+            test.context.filesystem_uid + 1
+        };
+
+        let error = match InstallerBundle::create(&test.context, BundleKind::Launchd) {
+            Ok(_) => panic!("attacker-owned sticky directory must fail closed"),
+            Err(error) => error,
+        };
+
+        assert!(
+            error
+                .to_string()
+                .contains("unsafe ownership or permissions")
+        );
+        assert!(
+            fs::read_dir(&test.context.temporary_root)
+                .expect("temporary root")
+                .next()
+                .is_none()
+        );
+    }
+
+    #[test]
+    fn temporary_root_is_canonicalized_before_bundle_creation() {
+        let mut test = TestContext::new(Platform::MacOs, 501);
+        let canonical_root = test.context.temporary_root.clone();
+        let alias = test._directory.path().join("temporary-root-alias");
+        std::os::unix::fs::symlink(&canonical_root, &alias).expect("temporary root alias");
+        test.context.temporary_root = alias;
+
+        let bundle = InstallerBundle::create(&test.context, BundleKind::Launchd)
+            .expect("canonical temporary root");
+
+        assert!(bundle.root.starts_with(&canonical_root));
+        assert_eq!(
+            fs::metadata(&bundle.root)
+                .expect("bundle metadata")
+                .permissions()
+                .mode()
+                & 0o777,
+            0o700
+        );
+    }
+
+    #[test]
+    fn linux_install_runs_the_embedded_hardened_installer() {
+        let test = TestContext::new(Platform::Linux, 0);
+        let mut runner = FakeRunner::default();
+        let paths = test.context.paths.clone();
+        let installed_context = test.context.clone();
+        runner.respond_with(0, "installed\n", "", move || {
+            fs::create_dir_all(paths.linux_binary.parent().expect("binary parent"))
+                .expect("binary parent");
+            fs::create_dir_all(paths.linux_unit.parent().expect("unit parent"))
+                .expect("unit parent");
+            fs::create_dir_all(paths.linux_manifest.parent().expect("manifest parent"))
+                .expect("manifest parent");
+            fs::write(&paths.linux_binary, b"test executor binary").expect("installed binary");
+            fs::write(&paths.linux_unit, SYSTEMD_UNIT).expect("installed unit");
+            set_mode(&paths.linux_binary, 0o755).expect("binary mode");
+            set_mode(&paths.linux_unit, 0o644).expect("unit mode");
+            write_service_manifest(&installed_context).expect("installed manifest");
+        });
+
+        let outcome = execute_with(
+            &test.context,
+            &mut runner,
+            ServiceCommand::Install(ServiceInstallArgs { no_start: true }),
+        )
+        .expect("installation plan");
+
+        assert_eq!(outcome.stdout, b"installed\n");
+        let invocation = &runner.invocations[0];
+        assert_eq!(invocation.program, OsStr::new("/bin/bash"));
+        assert!(
+            invocation.arguments[0]
+                .to_string_lossy()
+                .ends_with("scripts/install-systemd.sh")
+        );
+        assert_eq!(invocation.arguments[1], "--binary");
+        assert_ne!(invocation.arguments[2], test.context.current_exe);
+        assert!(
+            invocation.arguments[2]
+                .to_string_lossy()
+                .ends_with("/executor")
+        );
+        assert_eq!(invocation.arguments[3], "--no-start");
+    }
+
+    #[test]
+    fn linux_mutations_require_root_before_running_commands() {
+        let test = TestContext::new(Platform::Linux, 1000);
+        let mut runner = FakeRunner::default();
+        let error = execute_with(
+            &test.context,
+            &mut runner,
+            ServiceCommand::Install(ServiceInstallArgs { no_start: false }),
+        )
+        .expect_err("unprivileged install must fail");
+        assert!(error.to_string().contains("sudo"));
+        assert!(runner.invocations.is_empty());
+    }
+
+    #[test]
+    fn service_operation_lock_serializes_without_pid_identity_and_recovers_on_owner_exit() {
+        for (platform, effective_uid) in [(Platform::Linux, 0), (Platform::MacOs, 501)] {
+            let test = TestContext::new(platform, effective_uid);
+            let alternate_source = test._directory.path().join("alternate-executor");
+            fs::write(&alternate_source, b"different executor binary").expect("alternate binary");
+            set_mode(&alternate_source, 0o755).expect("alternate binary mode");
+            let mut alternate = test.context.clone();
+            alternate.current_exe = alternate_source.clone();
+            alternate.installation_source = alternate_source;
+            let held = acquire_service_operation_lock(&test.context).expect("first operation lock");
+
+            for command in [
+                ServiceCommand::Install(ServiceInstallArgs { no_start: true }),
+                ServiceCommand::Remove,
+                ServiceCommand::Start,
+                ServiceCommand::Stop,
+                ServiceCommand::Restart,
+            ] {
+                let mut runner = FakeRunner::default();
+                let error = execute_with(&alternate, &mut runner, command)
+                    .expect_err("concurrent mutation must fail before planning");
+                assert!(
+                    error
+                        .to_string()
+                        .contains("another Executor service operation is already active")
+                );
+                assert!(runner.invocations.is_empty());
+            }
+
+            drop(held);
+            acquire_service_operation_lock(&alternate)
+                .expect("kernel lock should recover when its owner exits");
+        }
+    }
+
+    #[test]
+    fn service_operation_lock_rejects_preopened_and_spoofed_inodes() {
+        for (platform, effective_uid) in [(Platform::Linux, 0), (Platform::MacOs, 501)] {
+            let test = TestContext::new(platform, effective_uid);
+            let lock_path = match platform {
+                Platform::Linux => &test.context.paths.linux_lock,
+                Platform::MacOs => &test.context.paths.mac_lock,
+                Platform::Unsupported => unreachable!(),
+            };
+            let lock_parent = lock_path.parent().expect("lock parent");
+            fs::create_dir_all(lock_parent).expect("lock parent");
+            if platform == Platform::MacOs {
+                set_mode(&test.context.paths.mac_executor_root, 0o700).expect("Executor root mode");
+            }
+            set_mode(lock_parent, 0o700).expect("lock parent mode");
+            let victim = test._directory.path().join("lock-victim");
+            fs::write(&victim, b"keep me").expect("lock victim");
+            set_mode(&victim, 0o600).expect("lock victim mode");
+            std::os::unix::fs::symlink(&victim, lock_path).expect("spoofed lock symlink");
+
+            assert!(
+                acquire_service_operation_lock(&test.context).is_err(),
+                "symbolic-link lock must fail closed"
+            );
+            assert_eq!(fs::read(&victim).expect("victim contents"), b"keep me");
+
+            fs::remove_file(lock_path).expect("remove spoofed symlink");
+            fs::write(lock_path, b"").expect("broad lock file");
+            set_mode(lock_path, 0o644).expect("broad lock mode");
+            assert!(
+                acquire_service_operation_lock(&test.context).is_err(),
+                "broad lock mode must fail closed"
+            );
+
+            set_mode(lock_path, 0o600).expect("private lock mode");
+            let alias = test
+                ._directory
+                .path()
+                .join(format!("{platform:?}-lock-alias"));
+            fs::hard_link(lock_path, &alias).expect("lock hard link");
+            assert!(
+                acquire_service_operation_lock(&test.context).is_err(),
+                "hard-linked lock must fail closed"
+            );
+            assert_eq!(fs::metadata(lock_path).expect("lock metadata").nlink(), 2);
+        }
+    }
+
+    #[test]
+    fn restart_recovers_the_exact_service_recovery_publication_alias() {
+        let test = TestContext::new(Platform::Linux, 0);
+        let path = &test.context.paths.linux_recovery;
+        let parent = path.parent().expect("recovery parent");
+        fs::create_dir_all(parent).expect("recovery parent");
+        fs::write(path, SERVICE_RECOVERY_CONTENTS).expect("recovery marker");
+        set_mode(path, 0o600).expect("recovery mode");
+        let alias = parent.join(format!(".service-recovery-{}.tmp", Uuid::new_v4()));
+        fs::hard_link(path, &alias).expect("recovery publication alias");
+
+        assert!(service_recovery_exists(&test.context).expect("recovery marker validation"));
+        assert!(!alias.exists());
+        assert_eq!(fs::metadata(path).expect("recovery metadata").nlink(), 1);
+    }
+
+    #[test]
+    fn service_recovery_directory_sync_failure_is_retried_before_use() {
+        let test = TestContext::new(Platform::Linux, 0);
+        let path = &test.context.paths.linux_recovery;
+        let parent = path.parent().expect("recovery parent").to_path_buf();
+        fs::create_dir_all(&parent).expect("recovery parent");
+        test.context
+            .directory_sync_test
+            .failure
+            .replace(Some(parent.clone()));
+
+        ensure_service_recovery_marker(&test.context)
+            .expect_err("recovery directory sync failure must be returned");
+        assert!(path.exists());
+        assert_eq!(fs::metadata(path).expect("recovery metadata").nlink(), 1);
+
+        test.context.directory_sync_test.failure.replace(None);
+        ensure_service_recovery_marker(&test.context)
+            .expect("recovery directory sync should be retried");
+        assert_eq!(
+            test.context.directory_sync_test.events.borrow().last(),
+            Some(&parent)
+        );
+    }
+
+    #[test]
+    fn restart_rejects_substituted_and_unknown_service_recovery_aliases() {
+        let test = TestContext::new(Platform::Linux, 0);
+        let path = &test.context.paths.linux_recovery;
+        let parent = path.parent().expect("recovery parent");
+        fs::create_dir_all(parent).expect("recovery parent");
+        fs::write(path, SERVICE_RECOVERY_CONTENTS).expect("recovery marker");
+        set_mode(path, 0o600).expect("recovery mode");
+        let unknown_alias = parent.join("unknown-recovery-alias");
+        fs::hard_link(path, &unknown_alias).expect("unknown recovery alias");
+        let substituted_alias = parent.join(format!(".service-recovery-{}.tmp", Uuid::new_v4()));
+        fs::write(&substituted_alias, SERVICE_RECOVERY_CONTENTS)
+            .expect("substituted recovery alias");
+        set_mode(&substituted_alias, 0o600).expect("substituted recovery mode");
+
+        service_recovery_exists(&test.context)
+            .expect_err("unknown recovery hard link must remain rejected");
+
+        assert_eq!(
+            fs::read(path).expect("recovery contents"),
+            SERVICE_RECOVERY_CONTENTS.as_bytes()
+        );
+        assert_eq!(
+            fs::read(&substituted_alias).expect("substituted recovery contents"),
+            SERVICE_RECOVERY_CONTENTS.as_bytes()
+        );
+        assert!(unknown_alias.exists());
+        assert_eq!(fs::metadata(path).expect("recovery metadata").nlink(), 2);
+    }
+
+    #[test]
+    fn interrupted_install_recovery_marker_allows_a_clean_rerun() {
+        let test = TestContext::new(Platform::Linux, 0);
+        for spec in managed_file_specs(&test.context) {
+            fs::create_dir_all(spec.path.parent().expect("managed parent"))
+                .expect("managed parent");
+            fs::write(spec.path, b"partially replaced").expect("partial managed file");
+            set_mode(spec.path, spec.mode).expect("managed mode");
+        }
+        fs::create_dir_all(
+            test.context
+                .paths
+                .linux_recovery
+                .parent()
+                .expect("recovery parent"),
+        )
+        .expect("recovery parent");
+        fs::write(
+            &test.context.paths.linux_recovery,
+            SERVICE_RECOVERY_CONTENTS,
+        )
+        .expect("recovery marker");
+        set_mode(&test.context.paths.linux_recovery, 0o600).expect("recovery mode");
+
+        let installed_context = test.context.clone();
+        let mut runner = FakeRunner::default();
+        runner.respond_with(0, "installed\n", "", move || {
+            fs::write(
+                &installed_context.paths.linux_binary,
+                b"test executor binary",
+            )
+            .expect("installed binary");
+            fs::write(&installed_context.paths.linux_unit, SYSTEMD_UNIT).expect("installed unit");
+            set_mode(&installed_context.paths.linux_binary, 0o755).expect("binary mode");
+            set_mode(&installed_context.paths.linux_unit, 0o644).expect("unit mode");
+            write_service_manifest(&installed_context).expect("installed manifest");
+            fs::remove_file(&installed_context.paths.linux_recovery)
+                .expect("clear recovery marker");
+        });
+
+        let outcome = execute_with(
+            &test.context,
+            &mut runner,
+            ServiceCommand::Install(ServiceInstallArgs { no_start: true }),
+        )
+        .expect("recovery install");
+
+        assert_eq!(outcome.stdout, b"installed\n");
+        assert!(!test.context.paths.linux_recovery.exists());
+        verify_service_manifest(&test.context).expect("recovered manifest");
+    }
+
+    #[test]
+    fn status_has_stable_active_and_inactive_exit_codes() {
+        let test = TestContext::new(Platform::Linux, 1000);
+        let mut active = FakeRunner::default();
+        active.respond(0, "active\n", "");
+        let outcome = execute_with(&test.context, &mut active, ServiceCommand::Status)
+            .expect("active status");
+        assert_eq!(outcome.exit_code, 0);
+        assert_eq!(outcome.stdout, b"active\n");
+
+        let mut inactive = FakeRunner::default();
+        inactive.respond(3, "inactive\n", "");
+        let outcome = execute_with(&test.context, &mut inactive, ServiceCommand::Status)
+            .expect("inactive status");
+        assert_eq!(outcome.exit_code, STATUS_INACTIVE);
+        assert_eq!(outcome.stdout, b"inactive\n");
+    }
+
+    #[test]
+    fn linux_lifecycle_commands_use_systemctl_without_host_mutation() {
+        let test = TestContext::new(Platform::Linux, 0);
+        write_managed_fixtures(&test.context);
+        let mut runner = FakeRunner::default();
+        runner.respond(0, "", "");
+        runner.respond(0, "active\n", "");
+        runner.respond(0, "", "");
+        runner.respond(0, "", "");
+
+        execute_with(&test.context, &mut runner, ServiceCommand::Start).expect("start");
+        execute_with(&test.context, &mut runner, ServiceCommand::Stop).expect("stop");
+        execute_with(&test.context, &mut runner, ServiceCommand::Restart).expect("restart");
+
+        let arguments = runner
+            .invocations
+            .iter()
+            .map(|invocation| invocation.arguments.clone())
+            .collect::<Vec<_>>();
+        assert_eq!(
+            arguments,
+            vec![
+                os_args(&["start", SYSTEMD_SERVICE]),
+                os_args(&["is-active", SYSTEMD_SERVICE]),
+                os_args(&["stop", SYSTEMD_SERVICE]),
+                os_args(&["restart", SYSTEMD_SERVICE]),
+            ]
+        );
+    }
+
+    #[test]
+    fn macos_install_copies_the_binary_and_runs_the_embedded_installer() {
+        let test = TestContext::new(Platform::MacOs, 501);
+        let mut runner = FakeRunner::default();
+        runner.respond(0, "LaunchAgent paths and configuration are valid.\n", "");
+        runner.respond(113, "", "Could not find service");
+        let paths = test.context.paths.clone();
+        let installed_context = test.context.clone();
+        runner.respond_with(0, "installed\n", "", move || {
+            for (path, contents, mode) in [
+                (&paths.mac_plist, b"plist".as_slice(), 0o600),
+                (&paths.mac_wrapper, b"wrapper".as_slice(), 0o700),
+                (&paths.mac_logger, b"logger".as_slice(), 0o700),
+                (&paths.mac_config, b"config".as_slice(), 0o600),
+            ] {
+                fs::write(path, contents).expect("installed managed file");
+                set_mode(path, mode).expect("managed file mode");
+            }
+            write_service_manifest(&installed_context).expect("installed manifest");
+            fs::remove_file(&installed_context.paths.mac_recovery).expect("clear recovery marker");
+        });
+
+        let outcome = execute_with(
+            &test.context,
+            &mut runner,
+            ServiceCommand::Install(ServiceInstallArgs { no_start: true }),
+        )
+        .expect("macOS installation");
+
+        assert_eq!(outcome.stdout, b"installed\n");
+        assert_eq!(
+            fs::read(&test.context.paths.mac_binary).expect("installed binary"),
+            b"test executor binary"
+        );
+        assert_eq!(
+            fs::metadata(&test.context.paths.mac_binary)
+                .expect("binary metadata")
+                .permissions()
+                .mode()
+                & 0o777,
+            0o755
+        );
+        let validation = &runner.invocations[0];
+        assert_eq!(validation.program, OsStr::new("/bin/bash"));
+        assert!(
+            validation.arguments[0]
+                .to_string_lossy()
+                .ends_with("scripts/install-launchd.sh")
+        );
+        assert_eq!(validation.arguments[1], "--binary");
+        assert_ne!(validation.arguments[2], test.context.paths.mac_binary);
+        assert_eq!(validation.arguments[3], "--validate-only");
+        assert_eq!(runner.invocations[1].program, OsStr::new("launchctl"));
+        let invocation = &runner.invocations[2];
+        assert_eq!(invocation.program, OsStr::new("/bin/bash"));
+        assert!(
+            invocation.arguments[0]
+                .to_string_lossy()
+                .ends_with("scripts/install-launchd.sh")
+        );
+        assert_eq!(invocation.arguments[1], "--binary");
+        assert_eq!(invocation.arguments[2], test.context.paths.mac_binary);
+        assert_eq!(invocation.arguments[3], "--no-start");
+        assert_eq!(invocation.arguments.len(), 4);
+    }
+
+    #[test]
+    fn macos_custom_data_configuration_uses_fixed_managed_paths_for_lifecycle() {
+        let test = TestContext::new(Platform::MacOs, 501);
+        let custom_data = test._directory.path().join("custom executor data");
+        let custom_templates = custom_data.join("custom templates.json");
+        let state_sentinel = custom_data.join("state-sentinel");
+        fs::create_dir(&custom_data).expect("custom data directory");
+        set_mode(&custom_data, 0o700).expect("custom data mode");
+        fs::write(&custom_templates, b"{\"templates\":[]}").expect("custom templates");
+        set_mode(&custom_templates, 0o600).expect("custom templates mode");
+        fs::write(&state_sentinel, b"preserve custom state").expect("custom state");
+        let config = format!(
+            "executor-launchd-config-v1\ndata_dir_hex={}\ntemplates_file_hex={}\npublic_origin_hex=\n",
+            encode_service_config_value(&custom_data),
+            encode_service_config_value(&custom_templates)
+        );
+        let mut install_runner = FakeRunner::default();
+        queue_successful_macos_install_with_config(
+            &mut install_runner,
+            &test.context,
+            config.as_bytes(),
+        );
+
+        execute_with(
+            &test.context,
+            &mut install_runner,
+            ServiceCommand::Install(ServiceInstallArgs { no_start: true }),
+        )
+        .expect("custom-data service install");
+
+        assert_eq!(
+            test.context
+                .paths
+                .mac_wrapper
+                .parent()
+                .expect("wrapper parent"),
+            test.context.paths.mac_install_root
+        );
+        assert_eq!(
+            test.context
+                .paths
+                .mac_logger
+                .parent()
+                .expect("logger parent"),
+            test.context.paths.mac_install_root
+        );
+        assert!(!custom_data.join("run-launchd.sh").exists());
+        assert!(!custom_data.join("bounded-log.sh").exists());
+        verify_service_manifest(&test.context).expect("custom-data service manifest");
+
+        let mut start_runner = FakeRunner::default();
+        start_runner.respond(113, "", "Could not find service");
+        start_runner.respond(0, "", "");
+        start_runner.respond(0, "", "");
+        execute_with(&test.context, &mut start_runner, ServiceCommand::Start)
+            .expect("start custom-data service");
+
+        let mut remove_runner = FakeRunner::default();
+        remove_runner.respond(0, "state = running\n", "");
+        remove_runner.respond(0, "", "");
+        execute_with(&test.context, &mut remove_runner, ServiceCommand::Remove)
+            .expect("remove custom-data service");
+
+        assert_eq!(
+            fs::read(&state_sentinel).expect("preserved custom state"),
+            b"preserve custom state"
+        );
+        assert!(custom_templates.exists());
+        assert_eq!(
+            fs::read(&test.context.paths.mac_config).expect("preserved custom config"),
+            config.as_bytes()
+        );
+        assert!(!test.context.paths.mac_wrapper.exists());
+        assert!(!test.context.paths.mac_logger.exists());
+    }
+
+    #[test]
+    fn macos_validation_failure_preserves_installation_and_does_not_block_remove() {
+        let test = TestContext::new(Platform::MacOs, 501);
+        write_managed_fixtures(&test.context);
+        let before = managed_file_specs(&test.context)
+            .iter()
+            .map(|spec| fs::read(spec.path).expect("managed file snapshot"))
+            .collect::<Vec<_>>();
+        let manifest_before =
+            fs::read(&test.context.paths.mac_manifest).expect("manifest snapshot");
+        fs::write(&test.context.current_exe, b"replacement executor binary")
+            .expect("replacement source");
+        set_mode(&test.context.current_exe, 0o755).expect("replacement source mode");
+        let mut install_runner = FakeRunner::default();
+        install_runner.respond(
+            1,
+            "",
+            "the MCP stdio template file must not overlap a managed service path",
+        );
+
+        let error = execute_with(
+            &test.context,
+            &mut install_runner,
+            ServiceCommand::Install(ServiceInstallArgs { no_start: true }),
+        )
+        .expect_err("colliding configuration must fail validation");
+
+        assert!(error.to_string().contains("must not overlap"));
+        assert_eq!(install_runner.invocations.len(), 1);
+        assert_eq!(
+            install_runner.invocations[0].program,
+            OsStr::new("/bin/bash")
+        );
+        assert_eq!(
+            install_runner.invocations[0].arguments[3],
+            "--validate-only"
+        );
+        assert!(!test.context.paths.mac_recovery.exists());
+        for (spec, expected) in managed_file_specs(&test.context).iter().zip(before) {
+            assert_eq!(
+                fs::read(spec.path).expect("preserved managed file"),
+                expected,
+                "preserved {}",
+                spec.description
+            );
+        }
+        assert_eq!(
+            fs::read(&test.context.paths.mac_manifest).expect("preserved manifest"),
+            manifest_before
+        );
+        verify_service_manifest(&test.context).expect("preserved ownership manifest");
+
+        let preserved_config =
+            fs::read(&test.context.paths.mac_config).expect("preserved config before remove");
+        let mut remove_runner = FakeRunner::default();
+        remove_runner.respond(113, "", "Could not find service");
+        execute_with(&test.context, &mut remove_runner, ServiceCommand::Remove)
+            .expect("remove after rejected install");
+        assert_eq!(
+            fs::read(&test.context.paths.mac_config).expect("config preserved by remove"),
+            preserved_config
+        );
+    }
+
+    #[test]
+    fn archive_then_service_upgrades_keep_each_installation_independently_owned() {
+        let test = TestContext::new(Platform::MacOs, 501);
+        let (archive_binary, archive_manifest) =
+            write_archive_fixture(&test.context, b"archive executor v1");
+        let mut context = test.context.clone();
+        context.current_exe = archive_binary.clone();
+        context.installation_source = archive_binary.clone();
+
+        let mut first_runner = FakeRunner::default();
+        queue_successful_macos_install(&mut first_runner, &context);
+        execute_with(
+            &context,
+            &mut first_runner,
+            ServiceCommand::Install(ServiceInstallArgs { no_start: true }),
+        )
+        .expect("service install from archive binary");
+        assert_eq!(
+            fs::read(&context.paths.mac_binary).expect("service binary v1"),
+            b"archive executor v1"
+        );
+
+        let (upgraded_archive_binary, upgraded_archive_manifest) =
+            write_archive_fixture(&context, b"archive executor v2");
+        assert_eq!(upgraded_archive_binary, archive_binary);
+        assert_eq!(upgraded_archive_manifest, archive_manifest);
+        let archive_manifest_contents =
+            fs::read(&archive_manifest).expect("upgraded archive manifest contents");
+        verify_service_manifest(&context).expect("archive upgrade must not alter service files");
+
+        let mut second_runner = FakeRunner::default();
+        queue_successful_macos_install(&mut second_runner, &context);
+        execute_with(
+            &context,
+            &mut second_runner,
+            ServiceCommand::Install(ServiceInstallArgs { no_start: true }),
+        )
+        .expect("service upgrade from upgraded archive binary");
+
+        assert_eq!(
+            fs::read(&context.paths.mac_binary).expect("service binary v2"),
+            b"archive executor v2"
+        );
+        assert_eq!(
+            fs::read(&archive_binary).expect("archive binary after service upgrade"),
+            b"archive executor v2"
+        );
+        assert_eq!(
+            fs::read(&archive_manifest).expect("archive manifest after service upgrade"),
+            archive_manifest_contents
+        );
+    }
+
+    #[test]
+    fn service_then_archive_upgrades_preserve_the_service_ownership_boundary() {
+        let test = TestContext::new(Platform::MacOs, 501);
+        let mut first_runner = FakeRunner::default();
+        queue_successful_macos_install(&mut first_runner, &test.context);
+        execute_with(
+            &test.context,
+            &mut first_runner,
+            ServiceCommand::Install(ServiceInstallArgs { no_start: true }),
+        )
+        .expect("initial service install");
+        let service_manifest_before_archive =
+            fs::read(&test.context.paths.mac_manifest).expect("service manifest");
+
+        let (archive_binary, archive_manifest) =
+            write_archive_fixture(&test.context, b"archive executor v2");
+        let archive_manifest_contents =
+            fs::read(&archive_manifest).expect("archive manifest contents");
+        assert_eq!(
+            fs::read(&test.context.paths.mac_manifest)
+                .expect("service manifest after archive install"),
+            service_manifest_before_archive
+        );
+        verify_service_manifest(&test.context)
+            .expect("archive install must preserve service files");
+
+        let mut upgraded_context = test.context.clone();
+        upgraded_context.current_exe = archive_binary.clone();
+        upgraded_context.installation_source = archive_binary.clone();
+        let mut second_runner = FakeRunner::default();
+        queue_successful_macos_install(&mut second_runner, &upgraded_context);
+        execute_with(
+            &upgraded_context,
+            &mut second_runner,
+            ServiceCommand::Install(ServiceInstallArgs { no_start: true }),
+        )
+        .expect("service upgrade after archive install");
+
+        assert_eq!(
+            fs::read(&upgraded_context.paths.mac_binary).expect("upgraded service binary"),
+            b"archive executor v2"
+        );
+        assert_eq!(
+            fs::read(&archive_binary).expect("preserved archive binary"),
+            b"archive executor v2"
+        );
+        assert_eq!(
+            fs::read(&archive_manifest).expect("preserved archive manifest"),
+            archive_manifest_contents
+        );
+    }
+
+    #[test]
+    fn macos_remove_preserves_archive_install_and_config_and_remains_idempotent() {
+        let test = TestContext::new(Platform::MacOs, 501);
+        write_managed_fixtures(&test.context);
+        let preserved_config =
+            fs::read(&test.context.paths.mac_config).expect("persisted service config");
+        let (archive_binary, archive_manifest) =
+            write_archive_fixture(&test.context, b"archive executor");
+        let archive_manifest_contents =
+            fs::read(&archive_manifest).expect("archive manifest contents");
+        let mut runner = FakeRunner::default();
+        runner.respond(113, "", "Could not find service");
+        runner.respond(113, "", "Could not find service");
+
+        execute_with(&test.context, &mut runner, ServiceCommand::Remove)
+            .expect("first service removal");
+        execute_with(&test.context, &mut runner, ServiceCommand::Remove)
+            .expect("idempotent service removal");
+
+        assert_eq!(
+            fs::read(&test.context.paths.mac_config).expect("preserved service config"),
+            preserved_config
+        );
+        assert_eq!(
+            fs::read(&archive_binary).expect("preserved archive binary"),
+            b"archive executor"
+        );
+        assert_eq!(
+            fs::read(&archive_manifest).expect("preserved archive manifest"),
+            archive_manifest_contents
+        );
+        for path in [
+            &test.context.paths.mac_binary,
+            &test.context.paths.mac_plist,
+            &test.context.paths.mac_wrapper,
+            &test.context.paths.mac_logger,
+            &test.context.paths.mac_manifest,
+        ] {
+            assert!(!path.exists(), "removed service file: {}", path.display());
+        }
+    }
+
+    #[test]
+    fn macos_remove_rejects_a_missing_persisted_config_while_manifest_exists() {
+        let test = TestContext::new(Platform::MacOs, 501);
+        write_managed_fixtures(&test.context);
+        fs::remove_file(&test.context.paths.mac_config).expect("remove persisted config");
+        let mut runner = FakeRunner::default();
+
+        let error = execute_with(&test.context, &mut runner, ServiceCommand::Remove)
+            .expect_err("missing preserved config must fail closed");
+
+        assert!(
+            error
+                .to_string()
+                .contains("persisted LaunchAgent configuration")
+        );
+        assert!(error.to_string().contains("is missing"));
+        assert!(test.context.paths.mac_binary.exists());
+        assert!(test.context.paths.mac_manifest.exists());
+        assert!(runner.invocations.is_empty());
+    }
+
+    #[test]
+    fn macos_bundle_failure_preserves_the_existing_installation_before_validation() {
+        let test = TestContext::new(Platform::MacOs, 501);
+        prepare_macos_directories(&test.context).expect("macOS directories");
+        write_managed_fixtures(&test.context);
+        let original_binary = fs::read(&test.context.paths.mac_binary).expect("original binary");
+        let original_manifest =
+            fs::read(&test.context.paths.mac_manifest).expect("original manifest");
+        fs::write(&test.context.current_exe, b"replacement executor binary")
+            .expect("replacement source");
+        set_mode(&test.context.current_exe, 0o755).expect("replacement source mode");
+        fs::remove_dir(&test.context.temporary_root).expect("remove temporary root");
+
+        let mut first_runner = FakeRunner::default();
+        let error = execute_with(
+            &test.context,
+            &mut first_runner,
+            ServiceCommand::Install(ServiceInstallArgs { no_start: true }),
+        )
+        .expect_err("bundle failure must leave the installation unchanged");
+
+        assert!(error.to_string().contains("temporary directory"));
+        assert!(!test.context.paths.mac_recovery.exists());
+        assert_eq!(
+            fs::read(&test.context.paths.mac_binary).expect("preserved binary"),
+            original_binary
+        );
+        assert_eq!(
+            fs::read(&test.context.paths.mac_manifest).expect("preserved manifest"),
+            original_manifest
+        );
+        assert!(first_runner.invocations.is_empty());
+
+        fs::create_dir(&test.context.temporary_root).expect("restore temporary root");
+        set_mode(&test.context.temporary_root, 0o700).expect("temporary root mode");
+        let mut second_runner = FakeRunner::default();
+        queue_successful_macos_install(&mut second_runner, &test.context);
+
+        execute_with(
+            &test.context,
+            &mut second_runner,
+            ServiceCommand::Install(ServiceInstallArgs { no_start: true }),
+        )
+        .expect("installation after restoring the temporary root");
+
+        assert!(!test.context.paths.mac_recovery.exists());
+        assert_eq!(
+            fs::read(&test.context.paths.mac_binary).expect("updated binary"),
+            b"replacement executor binary"
+        );
+        verify_service_manifest(&test.context).expect("updated manifest");
+    }
+
+    #[test]
+    fn macos_install_rejects_a_symlinked_binary_directory() {
+        let test = TestContext::new(Platform::MacOs, 501);
+        fs::create_dir_all(&test.context.paths.mac_install_root).expect("install root");
+        let victim = test._directory.path().join("victim");
+        fs::create_dir(&victim).expect("victim directory");
+        std::os::unix::fs::symlink(&victim, &test.context.paths.mac_binary_dir)
+            .expect("binary directory symlink");
+        let mut runner = FakeRunner::default();
+        runner.respond(0, "LaunchAgent paths and configuration are valid.\n", "");
+        runner.respond(113, "", "Could not find service");
+
+        let error = execute_with(
+            &test.context,
+            &mut runner,
+            ServiceCommand::Install(ServiceInstallArgs { no_start: false }),
+        )
+        .expect_err("symlinked binary directory must fail");
+        assert!(error.to_string().contains("non-symlinked directory"));
+        assert!(
+            fs::read_dir(victim)
+                .expect("victim directory")
+                .next()
+                .is_none()
+        );
+    }
+
+    #[test]
+    fn macos_install_preserves_safe_shared_parent_directory_modes() {
+        let test = TestContext::new(Platform::MacOs, 501);
+        for path in [
+            &test.context.paths.mac_library,
+            &test.context.paths.mac_launch_agents,
+        ] {
+            fs::create_dir_all(path).expect("shared parent directory");
+            set_mode(path, 0o755).expect("shared parent mode");
+        }
+
+        prepare_macos_directories(&test.context).expect("macOS directories");
+
+        for path in [
+            &test.context.paths.mac_library,
+            &test.context.paths.mac_launch_agents,
+        ] {
+            assert_eq!(
+                fs::metadata(path)
+                    .expect("shared parent metadata")
+                    .permissions()
+                    .mode()
+                    & 0o777,
+                0o755
+            );
+        }
+        for path in [
+            &test.context.paths.mac_executor_root,
+            &test.context.paths.mac_install_root,
+            &test.context.paths.mac_binary_dir,
+        ] {
+            assert_eq!(
+                fs::metadata(path)
+                    .expect("private directory metadata")
+                    .permissions()
+                    .mode()
+                    & 0o777,
+                0o700
+            );
+        }
+    }
+
+    #[test]
+    fn macos_install_rejects_writable_shared_parent_directories() {
+        for unsafe_directory in ["Library", "LaunchAgents"] {
+            let test = TestContext::new(Platform::MacOs, 501);
+            let path = match unsafe_directory {
+                "Library" => &test.context.paths.mac_library,
+                "LaunchAgents" => {
+                    fs::create_dir(&test.context.paths.mac_library).expect("Library directory");
+                    set_mode(&test.context.paths.mac_library, 0o755).expect("Library mode");
+                    &test.context.paths.mac_launch_agents
+                }
+                _ => unreachable!(),
+            };
+            fs::create_dir(path).expect("unsafe shared directory");
+            set_mode(path, 0o777).expect("unsafe shared mode");
+
+            let error = prepare_macos_directories(&test.context)
+                .expect_err("writable shared directory must fail closed");
+
+            assert!(error.to_string().contains("must not be group-writable"));
+            assert_eq!(
+                fs::metadata(path)
+                    .expect("unsafe directory metadata")
+                    .permissions()
+                    .mode()
+                    & 0o777,
+                0o777
+            );
+        }
+    }
+
+    #[test]
+    fn macos_status_distinguishes_loaded_but_inactive() {
+        let test = TestContext::new(Platform::MacOs, 501);
+        let mut runner = FakeRunner::default();
+        runner.respond(0, "state = exited\n", "");
+        let outcome = execute_with(&test.context, &mut runner, ServiceCommand::Status)
+            .expect("loaded status");
+        assert_eq!(outcome.exit_code, STATUS_INACTIVE);
+        assert_eq!(outcome.stdout, b"inactive\n");
+    }
+
+    #[test]
+    fn macos_lifecycle_commands_use_the_user_launchctl_domain() {
+        let test = TestContext::new(Platform::MacOs, 501);
+        prepare_macos_directories(&test.context).expect("macOS directories");
+        write_managed_fixtures(&test.context);
+        let mut runner = FakeRunner::default();
+        runner.respond(113, "", "Could not find service");
+        runner.respond(0, "", "");
+        runner.respond(0, "", "");
+        runner.respond(0, "state = running\n", "");
+        runner.respond(0, "", "");
+        runner.respond(0, "state = running\n", "");
+        runner.respond(0, "", "");
+        runner.respond(0, "", "");
+        runner.respond(0, "", "");
+
+        execute_with(&test.context, &mut runner, ServiceCommand::Start).expect("start");
+        execute_with(&test.context, &mut runner, ServiceCommand::Stop).expect("stop");
+        execute_with(&test.context, &mut runner, ServiceCommand::Restart).expect("restart");
+
+        assert_eq!(runner.invocations.len(), 9);
+        assert_eq!(runner.invocations[0].arguments[0], "print");
+        assert_eq!(
+            runner.invocations[0].arguments[1],
+            "gui/501/dev.executor.gateway"
+        );
+        assert_eq!(runner.invocations[1].arguments[0], "enable");
+        assert_eq!(runner.invocations[2].arguments[0], "bootstrap");
+        assert_eq!(runner.invocations[3].arguments[0], "print");
+        assert_eq!(runner.invocations[4].arguments[0], "bootout");
+        assert_eq!(runner.invocations[5].arguments[0], "print");
+        assert_eq!(runner.invocations[6].arguments[0], "bootout");
+        assert_eq!(runner.invocations[7].arguments[0], "enable");
+        assert_eq!(runner.invocations[8].arguments[0], "bootstrap");
+    }
+
+    #[test]
+    fn macos_service_commands_reject_sudo() {
+        let test = TestContext::new(Platform::MacOs, 0);
+        let mut runner = FakeRunner::default();
+        let error = execute_with(&test.context, &mut runner, ServiceCommand::Status)
+            .expect_err("root LaunchAgent management must fail");
+        assert!(
+            error
+                .to_string()
+                .contains("do not run this command with sudo")
+        );
+        assert!(runner.invocations.is_empty());
+    }
+
+    #[test]
+    fn linux_remove_is_idempotent_and_preserves_state_paths() {
+        let test = TestContext::new(Platform::Linux, 0);
+        let mut runner = FakeRunner::default();
+        runner.respond(3, "inactive\n", "");
+        let outcome = execute_with(&test.context, &mut runner, ServiceCommand::Remove)
+            .expect("idempotent remove");
+        assert_eq!(outcome.exit_code, 0);
+        assert_eq!(runner.invocations.len(), 1);
+        assert!(outcome.stdout.starts_with(b"Executor service removed"));
+    }
+
+    #[test]
+    fn linux_remove_retries_daemon_reload_after_files_were_removed() {
+        let test = TestContext::new(Platform::Linux, 0);
+        write_managed_fixtures(&test.context);
+        let mut first_runner = FakeRunner::default();
+        first_runner.respond(3, "inactive\n", "");
+        first_runner.respond(0, "", "");
+        first_runner.respond(1, "", "injected daemon-reload failure");
+
+        let error = execute_with(&test.context, &mut first_runner, ServiceCommand::Remove)
+            .expect_err("daemon-reload failure must be returned");
+
+        assert!(error.to_string().contains("injected daemon-reload failure"));
+        assert!(!test.context.paths.linux_binary.exists());
+        assert!(!test.context.paths.linux_unit.exists());
+        assert!(test.context.paths.linux_manifest.exists());
+
+        let mut second_runner = FakeRunner::default();
+        second_runner.respond(3, "inactive\n", "");
+        second_runner.respond(0, "", "");
+        execute_with(&test.context, &mut second_runner, ServiceCommand::Remove)
+            .expect("removal retry");
+
+        assert_eq!(
+            second_runner.invocations[1].arguments,
+            os_args(&["daemon-reload"])
+        );
+        assert!(!test.context.paths.linux_manifest.exists());
+    }
+
+    #[test]
+    fn linux_remove_keeps_the_manifest_when_a_managed_parent_sync_fails() {
+        let test = TestContext::new(Platform::Linux, 0);
+        write_managed_fixtures(&test.context);
+        let binary_parent = test
+            .context
+            .paths
+            .linux_binary
+            .parent()
+            .expect("binary parent")
+            .to_path_buf();
+        test.context
+            .directory_sync_test
+            .failure
+            .replace(Some(binary_parent.clone()));
+        let mut first_runner = FakeRunner::default();
+        first_runner.respond(3, "inactive\n", "");
+        first_runner.respond(0, "", "");
+
+        let error = execute_with(&test.context, &mut first_runner, ServiceCommand::Remove)
+            .expect_err("managed parent sync failure must stop removal");
+
+        assert!(
+            error
+                .to_string()
+                .contains("injected directory sync failure")
+        );
+        assert!(test.context.paths.linux_manifest.exists());
+        assert!(!test.context.paths.linux_binary.exists());
+        assert!(!test.context.paths.linux_unit.exists());
+        assert_eq!(
+            test.context.directory_sync_test.events.borrow().as_slice(),
+            [binary_parent.as_path()]
+        );
+        assert_eq!(first_runner.invocations.len(), 2);
+
+        test.context.directory_sync_test.failure.replace(None);
+        let mut second_runner = FakeRunner::default();
+        second_runner.respond(3, "inactive\n", "");
+        second_runner.respond(0, "", "");
+        execute_with(&test.context, &mut second_runner, ServiceCommand::Remove)
+            .expect("removal retry after managed parent sync failure");
+
+        assert!(!test.context.paths.linux_manifest.exists());
+        assert_eq!(
+            second_runner.invocations[1].arguments,
+            os_args(&["daemon-reload"])
+        );
+    }
+
+    #[test]
+    fn linux_remove_retries_a_manifest_parent_sync_after_manifest_unlink() {
+        let test = TestContext::new(Platform::Linux, 0);
+        write_managed_fixtures(&test.context);
+        let manifest_parent = test
+            .context
+            .paths
+            .linux_manifest
+            .parent()
+            .expect("manifest parent")
+            .to_path_buf();
+        test.context
+            .directory_sync_test
+            .failure
+            .replace(Some(manifest_parent.clone()));
+        let mut first_runner = FakeRunner::default();
+        first_runner.respond(3, "inactive\n", "");
+        first_runner.respond(0, "", "");
+        first_runner.respond(0, "", "");
+
+        let error = execute_with(&test.context, &mut first_runner, ServiceCommand::Remove)
+            .expect_err("manifest parent sync failure must be returned");
+
+        assert!(
+            error
+                .to_string()
+                .contains("injected directory sync failure")
+        );
+        assert!(!test.context.paths.linux_manifest.exists());
+        assert_eq!(
+            test.context.directory_sync_test.events.borrow().last(),
+            Some(&manifest_parent)
+        );
+
+        test.context.directory_sync_test.failure.replace(None);
+        let mut second_runner = FakeRunner::default();
+        second_runner.respond(3, "inactive\n", "");
+        execute_with(&test.context, &mut second_runner, ServiceCommand::Remove)
+            .expect("manifest directory sync retry");
+        assert_eq!(
+            test.context.directory_sync_test.events.borrow().last(),
+            Some(&manifest_parent)
+        );
+    }
+
+    #[test]
+    fn macos_remove_syncs_managed_parents_before_the_manifest_parent() {
+        let test = TestContext::new(Platform::MacOs, 501);
+        write_managed_fixtures(&test.context);
+        let binary_parent = test
+            .context
+            .paths
+            .mac_binary
+            .parent()
+            .expect("binary parent")
+            .to_path_buf();
+        let manifest_parent = test
+            .context
+            .paths
+            .mac_manifest
+            .parent()
+            .expect("manifest parent")
+            .to_path_buf();
+        let mut runner = FakeRunner::default();
+        runner.respond(113, "", "Could not find service");
+
+        execute_with(&test.context, &mut runner, ServiceCommand::Remove)
+            .expect("macOS service removal");
+
+        let events = test.context.directory_sync_test.events.borrow();
+        assert_eq!(events.first(), Some(&binary_parent));
+        assert_eq!(events.last(), Some(&manifest_parent));
+        assert!(events.len() >= 2);
+        assert!(!test.context.paths.mac_manifest.exists());
+        assert!(test.context.paths.mac_config.exists());
+    }
+
+    #[test]
+    fn macos_remove_keeps_the_manifest_when_a_managed_parent_sync_fails() {
+        let test = TestContext::new(Platform::MacOs, 501);
+        write_managed_fixtures(&test.context);
+        let binary_parent = test
+            .context
+            .paths
+            .mac_binary
+            .parent()
+            .expect("binary parent")
+            .to_path_buf();
+        test.context
+            .directory_sync_test
+            .failure
+            .replace(Some(binary_parent));
+        let mut first_runner = FakeRunner::default();
+        first_runner.respond(113, "", "Could not find service");
+
+        execute_with(&test.context, &mut first_runner, ServiceCommand::Remove)
+            .expect_err("macOS managed parent sync failure must stop removal");
+        assert!(test.context.paths.mac_manifest.exists());
+        assert!(test.context.paths.mac_config.exists());
+
+        test.context.directory_sync_test.failure.replace(None);
+        let mut second_runner = FakeRunner::default();
+        second_runner.respond(113, "", "Could not find service");
+        execute_with(&test.context, &mut second_runner, ServiceCommand::Remove)
+            .expect("macOS removal retry");
+        assert!(!test.context.paths.mac_manifest.exists());
+        assert!(test.context.paths.mac_config.exists());
+    }
+
+    #[test]
+    fn remove_rejects_managed_symlinks_without_touching_the_target() {
+        let test = TestContext::new(Platform::Linux, 0);
+        fs::create_dir_all(test.context.paths.linux_unit.parent().expect("unit parent"))
+            .expect("unit parent");
+        let victim = test._directory.path().join("victim-unit");
+        fs::write(&victim, b"keep me").expect("victim file");
+        std::os::unix::fs::symlink(&victim, &test.context.paths.linux_unit).expect("unit symlink");
+        let mut runner = FakeRunner::default();
+
+        let error = execute_with(&test.context, &mut runner, ServiceCommand::Remove)
+            .expect_err("managed symlink must fail");
+        assert!(error.to_string().contains("must be a regular file"));
+        assert_eq!(fs::read(victim).expect("victim contents"), b"keep me");
+        assert!(runner.invocations.is_empty());
+    }
+
+    #[test]
+    fn remove_rejects_replaced_managed_files_and_preserves_the_sentinel() {
+        let test = TestContext::new(Platform::Linux, 0);
+        write_managed_fixtures(&test.context);
+        fs::write(&test.context.paths.linux_binary, b"unmanaged sentinel")
+            .expect("replacement sentinel");
+        set_mode(&test.context.paths.linux_binary, 0o755).expect("sentinel mode");
+        let mut runner = FakeRunner::default();
+
+        let error = execute_with(&test.context, &mut runner, ServiceCommand::Remove)
+            .expect_err("replaced managed binary must fail closed");
+
+        assert!(error.to_string().contains("contents do not match"));
+        assert_eq!(
+            fs::read(&test.context.paths.linux_binary).expect("sentinel contents"),
+            b"unmanaged sentinel"
+        );
+        assert!(test.context.paths.linux_unit.exists());
+        assert!(test.context.paths.linux_manifest.exists());
+        assert!(runner.invocations.is_empty());
+    }
+
+    #[test]
+    fn unsupported_platform_is_rejected_without_commands() {
+        let test = TestContext::new(Platform::Unsupported, 1000);
+        let mut runner = FakeRunner::default();
+        let error = execute_with(&test.context, &mut runner, ServiceCommand::Status)
+            .expect_err("unsupported platform");
+        assert!(error.to_string().contains("only on Linux and macOS"));
+        assert!(runner.invocations.is_empty());
+    }
+
+    #[test]
+    fn systemd_unit_allows_the_environment_to_select_an_external_master_key() {
+        let unit = std::str::from_utf8(SYSTEMD_UNIT).expect("UTF-8 systemd unit");
+        let environment = std::str::from_utf8(SYSTEMD_ENV).expect("UTF-8 environment template");
+
+        assert!(unit.contains("EnvironmentFile=-/etc/executor/executor.env"));
+        assert!(!unit.contains("--master-key-file"));
+        assert!(environment.contains("EXECUTOR_MASTER_KEY_FILE="));
+    }
+
+    #[test]
+    fn systemd_external_master_key_rejects_service_managed_paths_without_mutation() {
+        let test = TestContext::new(Platform::Linux, 0);
+        write_managed_fixtures(&test.context);
+        let key_check_data = test._directory.path().join("external-key-check-data");
+        for path in [
+            &test.context.paths.linux_binary,
+            &test.context.paths.linux_unit,
+            &test.context.paths.linux_manifest,
+        ] {
+            let before = fs::read(path).expect("managed file before key validation");
+            crate::crypto::load_or_create_master_key(&key_check_data, true, Some(path))
+                .expect_err("managed service file must not be accepted as an external key");
+            assert_eq!(
+                fs::read(path).expect("managed file after key validation"),
+                before
+            );
+        }
+        crate::crypto::load_or_create_master_key(
+            &key_check_data,
+            true,
+            Some(&test.context.paths.linux_recovery),
+        )
+        .expect_err("an absent managed recovery path must not be created as an external key");
+        assert!(!test.context.paths.linux_recovery.exists());
+    }
+
+    #[test]
+    fn installers_publish_the_ownership_manifest_before_starting_services() {
+        let systemd = std::str::from_utf8(SYSTEMD_INSTALLER).expect("UTF-8 systemd installer");
+        let launchd = std::str::from_utf8(LAUNCHD_INSTALLER).expect("UTF-8 launchd installer");
+
+        let systemd_hash = systemd
+            .find("binary_hash=$(sha256sum")
+            .expect("systemd binary hash");
+        let systemd_manifest = systemd
+            .find("mv -f -- \"${manifest_temporary}\" \"${MANIFEST_TARGET}\"")
+            .expect("systemd manifest publication");
+        let systemd_recovery_removal = systemd
+            .find("rm -f -- \"${RECOVERY_TARGET}\"")
+            .expect("systemd recovery marker removal");
+        let systemd_start = systemd
+            .find("systemctl start executor.service")
+            .expect("systemd start");
+        for description in [
+            "the installed Executor binary",
+            "the Executor binary directory",
+            "the installed systemd unit",
+            "the systemd unit directory",
+        ] {
+            let systemd_sync = systemd
+                .find(description)
+                .unwrap_or_else(|| panic!("missing systemd sync for {description}"));
+            assert!(systemd_sync < systemd_hash);
+        }
+        assert!(systemd_hash < systemd_manifest);
+        assert!(systemd_manifest < systemd_recovery_removal);
+        assert!(systemd_recovery_removal < systemd_start);
+
+        let launchd_manifest = launchd
+            .find("mv -f \"$temporary_manifest\" \"$MANIFEST\"")
+            .expect("launchd manifest publication");
+        let launchd_start = launchd
+            .find("launchctl bootstrap \"$domain\" \"$PLIST\"")
+            .expect("launchd start");
+        assert!(launchd_manifest < launchd_start);
+        assert!(launchd.contains(
+            "chmod 0600 \"$temporary_templates\"\n    sync\n    if ! ln \"$temporary_templates\" \"$TEMPLATES_FILE\""
+        ));
+        assert!(launchd.contains(
+            "fi\n    sync\n    if [[ ${EXECUTOR_INSTALL_TEST_CRASH_AFTER_TEMPLATE_LINK:-} == 1 ]]"
+        ));
+        assert!(launchd.contains(
+            "rm -f \"$temporary_templates\"\n    if [[ ${EXECUTOR_INSTALL_TEST_CRASH_AFTER_TEMPLATE_UNLINK:-} == 1 ]]"
+        ));
+        assert!(launchd.contains("kill -KILL \"${BASHPID}\"\n    fi\n    sync\n    trap - EXIT"));
+    }
+
+    #[test]
+    fn embedded_installer_shell_regressions_pass() {
+        let mut relative_paths = vec![
+            "scripts/test-install-launchd-safety.sh",
+            "scripts/test-bounded-log.sh",
+        ];
+        if cfg!(target_os = "linux") {
+            relative_paths.push("scripts/test-install-systemd-master-key.sh");
+        }
+        for relative_path in relative_paths {
+            let output = std::process::Command::new("bash")
+                .arg(Path::new(env!("CARGO_MANIFEST_DIR")).join(relative_path))
+                .output()
+                .expect("shell regression should run");
+            assert!(
+                output.status.success(),
+                "{relative_path} failed:\n{}{}",
+                String::from_utf8_lossy(&output.stdout),
+                String::from_utf8_lossy(&output.stderr)
+            );
+        }
+    }
+}
diff --git a/src/tasks.rs b/src/tasks.rs
new file mode 100644
index 000000000..bbbd5995c
--- /dev/null
+++ b/src/tasks.rs
@@ -0,0 +1,187 @@
+use std::{
+    future::Future,
+    sync::{Arc, Mutex},
+};
+
+use tokio::{sync::oneshot, task::AbortHandle};
+
+#[derive(Clone, Default)]
+pub(crate) struct TaskTracker {
+    state: Arc<Mutex<TaskState>>,
+}
+
+#[derive(Default)]
+struct TaskState {
+    shutting_down: bool,
+    tasks: Vec<TrackedTask>,
+}
+
+struct TrackedTask {
+    abort: AbortHandle,
+    completed: oneshot::Receiver<()>,
+    abort_on_shutdown: bool,
+    shutdown: Option<oneshot::Sender<()>>,
+}
+
+struct CompletionSignal(Option<oneshot::Sender<()>>);
+
+impl Drop for CompletionSignal {
+    fn drop(&mut self) {
+        if let Some(completed) = self.0.take() {
+            let _ = completed.send(());
+        }
+    }
+}
+
+impl TaskTracker {
+    pub(crate) fn spawn<F>(&self, future: F) -> bool
+    where
+        F: Future<Output = ()> + Send + 'static,
+    {
+        let mut state = self
+            .state
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        if state.shutting_down {
+            return false;
+        }
+        state.tasks.retain(|task| !task.abort.is_finished());
+        state.tasks.push(spawn_tracked(future, true, None));
+        true
+    }
+
+    pub(crate) fn spawn_supervised<F, Fut>(&self, task: F) -> bool
+    where
+        F: FnOnce(oneshot::Receiver<()>) -> Fut,
+        Fut: Future<Output = ()> + Send + 'static,
+    {
+        let mut state = self
+            .state
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        if state.shutting_down {
+            return false;
+        }
+        state.tasks.retain(|task| !task.abort.is_finished());
+        let (shutdown, shutdown_signal) = oneshot::channel();
+        state
+            .tasks
+            .push(spawn_tracked(task(shutdown_signal), false, Some(shutdown)));
+        true
+    }
+
+    pub(crate) fn spawn_pair<F, G>(&self, first: F, second: G) -> bool
+    where
+        F: Future<Output = ()> + Send + 'static,
+        G: Future<Output = ()> + Send + 'static,
+    {
+        let mut state = self
+            .state
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        if state.shutting_down {
+            return false;
+        }
+        state.tasks.retain(|task| !task.abort.is_finished());
+        state.tasks.push(spawn_tracked(first, true, None));
+        state.tasks.push(spawn_tracked(second, true, None));
+        true
+    }
+
+    pub(crate) fn abort_all(&self) {
+        let mut state = self
+            .state
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        state.shutting_down = true;
+        for task in &mut state.tasks {
+            if task.abort_on_shutdown {
+                task.abort.abort();
+            } else if let Some(shutdown) = task.shutdown.take() {
+                let _ = shutdown.send(());
+            }
+        }
+    }
+
+    pub(crate) async fn shutdown(&self) {
+        let mut tasks = {
+            let mut state = self
+                .state
+                .lock()
+                .unwrap_or_else(std::sync::PoisonError::into_inner);
+            state.shutting_down = true;
+            std::mem::take(&mut state.tasks)
+        };
+        for task in &mut tasks {
+            if task.abort_on_shutdown {
+                task.abort.abort();
+            } else if let Some(shutdown) = task.shutdown.take() {
+                let _ = shutdown.send(());
+            }
+        }
+        for task in tasks {
+            let _ = task.completed.await;
+        }
+    }
+}
+
+fn spawn_tracked<F>(
+    future: F,
+    abort_on_shutdown: bool,
+    shutdown: Option<oneshot::Sender<()>>,
+) -> TrackedTask
+where
+    F: Future<Output = ()> + Send + 'static,
+{
+    let (completed, completion) = oneshot::channel();
+    let handle = tokio::spawn(async move {
+        let _completion = CompletionSignal(Some(completed));
+        future.await;
+    });
+    TrackedTask {
+        abort: handle.abort_handle(),
+        completed: completion,
+        abort_on_shutdown,
+        shutdown,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::sync::{
+        Arc,
+        atomic::{AtomicBool, Ordering},
+    };
+
+    use tokio::sync::oneshot;
+
+    use super::TaskTracker;
+
+    #[tokio::test]
+    async fn supervised_tasks_receive_shutdown_and_are_awaited() {
+        let tracker = TaskTracker::default();
+        let completed = Arc::new(AtomicBool::new(false));
+        let task_completed = completed.clone();
+        let (started_sender, started_receiver) = oneshot::channel();
+        let (stopping_sender, stopping_receiver) = oneshot::channel();
+        let (release_sender, release_receiver) = oneshot::channel();
+        assert!(tracker.spawn_supervised(|shutdown| async move {
+            let _ = started_sender.send(());
+            let _ = shutdown.await;
+            let _ = stopping_sender.send(());
+            let _ = release_receiver.await;
+            task_completed.store(true, Ordering::SeqCst);
+        }));
+        started_receiver.await.expect("supervised task starts");
+
+        tracker.abort_all();
+        stopping_receiver
+            .await
+            .expect("supervised task receives shutdown");
+        assert!(!completed.load(Ordering::SeqCst));
+
+        release_sender.send(()).expect("supervised task releases");
+        tracker.shutdown().await;
+        assert!(completed.load(Ordering::SeqCst));
+    }
+}
diff --git a/src/web_assets.rs b/src/web_assets.rs
new file mode 100644
index 000000000..6749b3813
--- /dev/null
+++ b/src/web_assets.rs
@@ -0,0 +1,416 @@
+use axum::{
+    body::{Body, Bytes},
+    http::{HeaderMap, HeaderValue, Method, StatusCode, Uri, header},
+    response::Response,
+};
+use percent_encoding::percent_decode_str;
+
+struct EmbeddedAsset {
+    path: &'static str,
+    content: &'static [u8],
+    etag: &'static str,
+}
+
+include!(concat!(env!("OUT_DIR"), "/embedded_web_assets.rs"));
+
+pub(crate) fn response(
+    method: &Method,
+    uri: &Uri,
+    request_headers: &HeaderMap,
+) -> Option<Response> {
+    if !matches!(*method, Method::GET | Method::HEAD) {
+        return None;
+    }
+
+    let path = normalized_path(uri.path())?;
+    if is_reserved_path(&path) {
+        return None;
+    }
+
+    let exact_asset = find_asset(&path);
+    let (asset, spa_fallback) = match exact_asset {
+        Some(asset) => (asset, false),
+        None if can_use_spa_fallback(&path) => (find_asset("index.html")?, true),
+        None => return None,
+    };
+    let etag = asset.etag;
+    let not_modified = request_headers
+        .get(header::IF_NONE_MATCH)
+        .and_then(|value| value.to_str().ok())
+        .is_some_and(|values| {
+            values
+                .split(',')
+                .map(str::trim)
+                .any(|candidate| candidate == "*" || candidate == etag)
+        });
+
+    let mut response = if not_modified {
+        Response::builder()
+            .status(StatusCode::NOT_MODIFIED)
+            .body(Body::empty())
+            .expect("static response is valid")
+    } else {
+        let body = if *method == Method::HEAD {
+            Body::empty()
+        } else {
+            Body::from(Bytes::from_static(asset.content))
+        };
+        let mut response = Response::new(body);
+        response.headers_mut().insert(
+            header::CONTENT_LENGTH,
+            HeaderValue::from_str(&asset.content.len().to_string())
+                .expect("asset lengths are valid headers"),
+        );
+        response
+    };
+
+    let headers = response.headers_mut();
+    headers.insert(
+        header::CONTENT_TYPE,
+        HeaderValue::from_static(content_type(asset.path)),
+    );
+    headers.insert(
+        header::CACHE_CONTROL,
+        HeaderValue::from_static(cache_control(asset.path, spa_fallback)),
+    );
+    headers.insert(
+        header::ETAG,
+        HeaderValue::from_str(etag).expect("SHA-256 ETags are valid headers"),
+    );
+    add_security_headers(headers);
+    Some(response)
+}
+
+fn normalized_path(path: &str) -> Option<String> {
+    let raw_path = path.strip_prefix('/').unwrap_or(path);
+    let lowercase = raw_path.to_ascii_lowercase();
+    if lowercase.contains("%2f") || lowercase.contains("%5c") {
+        return None;
+    }
+    let decoded = percent_decode_str(raw_path).decode_utf8().ok()?;
+    if decoded.contains('\\') || decoded.contains('\0') || decoded.contains('%') {
+        return None;
+    }
+    if decoded.is_empty() {
+        return Some("index.html".to_owned());
+    }
+
+    let segments = decoded.split('/').collect::<Vec<_>>();
+    if segments.iter().enumerate().any(|(index, segment)| {
+        *segment == "." || *segment == ".." || (segment.is_empty() && index + 1 != segments.len())
+    }) {
+        return None;
+    }
+    Some(decoded.into_owned())
+}
+
+fn is_reserved_path(path: &str) -> bool {
+    ["api", "mcp", "healthz"].iter().any(|prefix| {
+        path == *prefix
+            || path
+                .strip_prefix(prefix)
+                .is_some_and(|rest| rest.starts_with('/'))
+    })
+}
+
+fn can_use_spa_fallback(path: &str) -> bool {
+    path.rsplit('/')
+        .next()
+        .is_some_and(|segment| segment.is_empty() || !segment.contains('.'))
+}
+
+fn find_asset(path: &str) -> Option<&'static EmbeddedAsset> {
+    EMBEDDED_WEB_ASSETS
+        .binary_search_by_key(&path, |asset| asset.path)
+        .ok()
+        .map(|index| &EMBEDDED_WEB_ASSETS[index])
+}
+
+fn content_type(path: &str) -> &'static str {
+    match path.rsplit_once('.').map(|(_, extension)| extension) {
+        Some("html") => "text/html; charset=utf-8",
+        Some("css") => "text/css; charset=utf-8",
+        Some("js" | "mjs") => "text/javascript; charset=utf-8",
+        Some("json" | "map") => "application/json; charset=utf-8",
+        Some("svg") => "image/svg+xml",
+        Some("png") => "image/png",
+        Some("jpg" | "jpeg") => "image/jpeg",
+        Some("gif") => "image/gif",
+        Some("webp") => "image/webp",
+        Some("avif") => "image/avif",
+        Some("ico") => "image/x-icon",
+        Some("woff") => "font/woff",
+        Some("woff2") => "font/woff2",
+        Some("ttf") => "font/ttf",
+        Some("otf") => "font/otf",
+        Some("txt") => "text/plain; charset=utf-8",
+        Some("xml") => "application/xml; charset=utf-8",
+        Some("webmanifest") => "application/manifest+json; charset=utf-8",
+        Some("wasm") => "application/wasm",
+        _ => "application/octet-stream",
+    }
+}
+
+fn cache_control(path: &str, spa_fallback: bool) -> &'static str {
+    if !spa_fallback && path.starts_with("_app/immutable/") {
+        "public, max-age=31536000, immutable"
+    } else {
+        "no-cache"
+    }
+}
+
+fn add_security_headers(headers: &mut HeaderMap) {
+    headers.insert(
+        "content-security-policy",
+        HeaderValue::from_static(EMBEDDED_WEB_CSP),
+    );
+    headers.insert(
+        "cross-origin-opener-policy",
+        HeaderValue::from_static("same-origin"),
+    );
+    headers.insert(
+        "cross-origin-resource-policy",
+        HeaderValue::from_static("same-origin"),
+    );
+    headers.insert(
+        "permissions-policy",
+        HeaderValue::from_static("camera=(), geolocation=(), microphone=()"),
+    );
+    headers.insert("referrer-policy", HeaderValue::from_static("same-origin"));
+    headers.insert(
+        "x-content-type-options",
+        HeaderValue::from_static("nosniff"),
+    );
+    headers.insert("x-frame-options", HeaderValue::from_static("DENY"));
+}
+
+#[cfg(test)]
+mod tests {
+    use std::collections::BTreeSet;
+
+    use axum::http::{HeaderMap, HeaderValue, Method, StatusCode, Uri, header};
+    use base64::{Engine as _, engine::general_purpose::STANDARD};
+    use http_body_util::BodyExt;
+    use sha2::{Digest, Sha256};
+
+    use super::response;
+
+    const FIXTURE_INDEX: &[u8] = include_bytes!("../tests/fixtures/web-assets/index.html");
+
+    #[tokio::test]
+    async fn serves_exact_assets_with_queries_and_immutable_cache_headers() {
+        let response = response(
+            &Method::GET,
+            &"/_app/immutable/entry/start.fixture.js?v=1"
+                .parse::<Uri>()
+                .expect("valid URI"),
+            &HeaderMap::new(),
+        )
+        .expect("fixture asset response");
+
+        assert_eq!(response.status(), StatusCode::OK);
+        assert_eq!(
+            response.headers().get(header::CONTENT_TYPE),
+            Some(&HeaderValue::from_static("text/javascript; charset=utf-8"))
+        );
+        assert_eq!(
+            response.headers().get(header::CACHE_CONTROL),
+            Some(&HeaderValue::from_static(
+                "public, max-age=31536000, immutable"
+            ))
+        );
+        assert_eq!(
+            response.headers().get("x-content-type-options"),
+            Some(&HeaderValue::from_static("nosniff"))
+        );
+        let body = response
+            .into_body()
+            .collect()
+            .await
+            .expect("asset body")
+            .to_bytes();
+        assert!(body.starts_with(b"document.documentElement"));
+    }
+
+    #[tokio::test]
+    async fn head_reports_the_get_length_without_a_body() {
+        let response = response(&Method::HEAD, &Uri::from_static("/"), &HeaderMap::new())
+            .expect("fixture index response");
+        let length = response
+            .headers()
+            .get(header::CONTENT_LENGTH)
+            .expect("content length")
+            .clone();
+        assert_ne!(length, HeaderValue::from_static("0"));
+        assert!(
+            response
+                .into_body()
+                .collect()
+                .await
+                .expect("HEAD body")
+                .to_bytes()
+                .is_empty()
+        );
+    }
+
+    #[tokio::test]
+    async fn client_routes_use_the_index_fallback_and_ignore_queries() {
+        let response = response(
+            &Method::GET,
+            &"/tools/example?view=detail"
+                .parse::<Uri>()
+                .expect("valid URI"),
+            &HeaderMap::new(),
+        )
+        .expect("SPA response");
+        assert_eq!(
+            response.headers().get(header::CACHE_CONTROL),
+            Some(&HeaderValue::from_static("no-cache"))
+        );
+        let body = response
+            .into_body()
+            .collect()
+            .await
+            .expect("SPA body")
+            .to_bytes();
+        assert!(body.windows(16).any(|window| window == b"Executor fixture"));
+    }
+
+    #[test]
+    fn leaves_reserved_paths_methods_missing_files_and_unsafe_paths_to_the_api_fallback() {
+        for (method, path) in [
+            (Method::GET, "/api/v1/missing"),
+            (Method::GET, "/mcp/missing"),
+            (Method::GET, "/healthz/missing"),
+            (Method::POST, "/tools"),
+            (Method::GET, "/missing.js"),
+            (Method::GET, "/.env"),
+            (Method::GET, "/_app/immutable/entry/start.fixture.js.map"),
+            (Method::GET, "/%2e%2e/index.html"),
+            (Method::GET, "/safe%2f..%2findex.html"),
+            (Method::GET, "/%252e%252e/index.html"),
+            (Method::GET, "/%252e%252e%252fsecret"),
+        ] {
+            assert!(
+                response(
+                    &method,
+                    &path.parse::<Uri>().expect("valid test URI"),
+                    &HeaderMap::new(),
+                )
+                .is_none(),
+                "{method} {path} must not receive the SPA shell"
+            );
+        }
+    }
+
+    #[test]
+    fn static_responses_include_browser_security_headers() {
+        let response = response(&Method::GET, &Uri::from_static("/"), &HeaderMap::new())
+            .expect("fixture index response");
+        let headers = response.headers();
+
+        assert_eq!(
+            headers.get("x-content-type-options"),
+            Some(&HeaderValue::from_static("nosniff"))
+        );
+        assert_eq!(
+            headers.get("x-frame-options"),
+            Some(&HeaderValue::from_static("DENY"))
+        );
+        assert_eq!(
+            headers.get("cross-origin-opener-policy"),
+            Some(&HeaderValue::from_static("same-origin"))
+        );
+        assert_eq!(
+            headers.get("cross-origin-resource-policy"),
+            Some(&HeaderValue::from_static("same-origin"))
+        );
+        assert!(headers.contains_key("permissions-policy"));
+        assert!(headers.contains_key("referrer-policy"));
+        let csp = headers
+            .get("content-security-policy")
+            .expect("content security policy")
+            .to_str()
+            .expect("CSP is text");
+        for directive in [
+            "default-src 'none'",
+            "base-uri 'none'",
+            "connect-src 'self'",
+            "font-src 'self'",
+            "form-action 'self'",
+            "frame-ancestors 'none'",
+            "img-src 'self' data:",
+            "manifest-src 'self'",
+            "object-src 'none'",
+            "style-src 'self' 'unsafe-inline'",
+            "worker-src 'self'",
+        ] {
+            assert!(
+                csp.split("; ").any(|value| value == directive),
+                "{directive}"
+            );
+        }
+        let script_source = csp
+            .split("; ")
+            .find(|directive| directive.starts_with("script-src "))
+            .expect("script source directive");
+        let actual_hashes = script_source
+            .split_ascii_whitespace()
+            .skip(2)
+            .map(str::to_owned)
+            .collect::<BTreeSet<_>>();
+        assert_eq!(actual_hashes, fixture_script_hashes());
+        assert!(!csp.contains("script-src 'self' 'unsafe-inline'"));
+        assert!(!csp.contains("'unsafe-eval'"));
+    }
+
+    #[test]
+    fn matching_etag_returns_not_modified() {
+        let first = response(&Method::GET, &Uri::from_static("/"), &HeaderMap::new())
+            .expect("initial response");
+        let etag = first.headers().get(header::ETAG).expect("ETag").clone();
+        let mut headers = HeaderMap::new();
+        headers.insert(header::IF_NONE_MATCH, etag);
+
+        let response =
+            response(&Method::GET, &Uri::from_static("/"), &headers).expect("conditional response");
+        assert_eq!(response.status(), StatusCode::NOT_MODIFIED);
+        assert!(response.headers().get(header::CONTENT_LENGTH).is_none());
+    }
+
+    #[test]
+    fn etag_is_the_stable_build_time_digest_of_the_fixture() {
+        let expected = HeaderValue::from_str(&format!("\"{:x}\"", Sha256::digest(FIXTURE_INDEX)))
+            .expect("fixture digest is a valid ETag");
+        for _ in 0..2 {
+            let response = response(&Method::GET, &Uri::from_static("/"), &HeaderMap::new())
+                .expect("fixture index response");
+            assert_eq!(response.headers().get(header::ETAG), Some(&expected));
+        }
+    }
+
+    fn fixture_script_hashes() -> BTreeSet<String> {
+        let html = std::str::from_utf8(FIXTURE_INDEX).expect("fixture index is UTF-8");
+        let mut remainder = html;
+        let mut hashes = BTreeSet::new();
+        while let Some(open) = remainder.find("<script") {
+            let after_open = &remainder[open..];
+            let body_start = after_open
+                .find('>')
+                .map(|position| position + 1)
+                .expect("fixture script opener closes");
+            let after_open = &after_open[body_start..];
+            let body_end = after_open
+                .find("</script>")
+                .expect("fixture script body closes");
+            let digest = STANDARD.encode(Sha256::digest(&after_open.as_bytes()[..body_end]));
+            hashes.insert(format!("'sha256-{digest}'"));
+            remainder = &after_open[body_end + "</script>".len()..];
+        }
+        assert!(
+            !hashes.is_empty(),
+            "fixture must exercise CSP script hashes"
+        );
+        hashes
+    }
+}
diff --git a/tests/active-product-docs.test.ts b/tests/active-product-docs.test.ts
new file mode 100644
index 000000000..6192e85ea
--- /dev/null
+++ b/tests/active-product-docs.test.ts
@@ -0,0 +1,142 @@
+import { describe, expect, it } from "@effect/vitest";
+import { existsSync, readFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+const repoRoot = resolve(import.meta.dirname, "..");
+const readRepoFile = (path: string) => readFileSync(resolve(repoRoot, path), "utf8");
+
+const docsConfig = readRepoFile("apps/docs/docs.json");
+const docsIndex = readRepoFile("apps/docs/index.mdx");
+const installGuide = readRepoFile("docs/install.md");
+const selfHosting = readRepoFile("apps/docs/self-hosting.mdx");
+const docker = readRepoFile("apps/docs/hosted/docker.mdx");
+const cli = readRepoFile("apps/docs/cli.mdx");
+const mcpEndpoint = readRepoFile("apps/docs/mcp-proxy.mdx");
+const sources = readRepoFile("apps/docs/concepts/sources.mdx");
+const credentials = readRepoFile("apps/docs/concepts/credentials.mdx");
+const toolModes = readRepoFile("apps/docs/concepts/tool-modes.mdx");
+const marketing = readRepoFile("apps/marketing/src/pages/index.astro");
+const activeProductSurfaces = [
+  docsIndex,
+  selfHosting,
+  docker,
+  cli,
+  mcpEndpoint,
+  sources,
+  credentials,
+  toolModes,
+  marketing,
+];
+const legacyConcepts = [
+  "apps/docs/concepts/integrations.mdx",
+  "apps/docs/concepts/connections.mdx",
+  "apps/docs/concepts/policies.mdx",
+].map(readRepoFile);
+
+const extract = (contents: string, pattern: RegExp, label: string) => {
+  const match = contents.match(pattern);
+  expect(match, label).not.toBeNull();
+  return match?.[1] ?? "";
+};
+const normalizeWhitespace = (contents: string) => contents.replace(/\s+/gu, " ").trim();
+
+describe("active product terminology", () => {
+  it("navigates by sources, credentials, and tool modes", () => {
+    expect(docsConfig).toContain('"concepts/sources"');
+    expect(docsConfig).toContain('"concepts/credentials"');
+    expect(docsConfig).toContain('"concepts/tool-modes"');
+    expect(docsConfig).not.toContain('"concepts/integrations"');
+    expect(docsConfig).not.toContain('"concepts/connections"');
+    expect(docsConfig).not.toContain('"concepts/policies"');
+
+    for (const page of [
+      "apps/docs/concepts/sources.mdx",
+      "apps/docs/concepts/credentials.mdx",
+      "apps/docs/concepts/tool-modes.mdx",
+    ]) {
+      expect(existsSync(resolve(repoRoot, page)), page).toBe(true);
+    }
+
+    for (const legacyConcept of legacyConcepts) {
+      expect(legacyConcept).toContain("Legacy concept:");
+      expect(legacyConcept).toContain("<Warning>");
+    }
+  });
+
+  it("teaches the supported source and credential model", () => {
+    for (const surface of activeProductSurfaces) {
+      expect(surface).not.toMatch(
+        /\b(?:integration|integrations|connection|connections|policy|policies)\b/iu,
+      );
+      expect(surface).not.toMatch(/one integration can have many connections/iu);
+      expect(surface).not.toMatch(/custom integration/iu);
+      expect(surface).not.toMatch(/configured instance of an integration/iu);
+      expect(surface).not.toMatch(/\bAllow\b.*\bBlock\b/isu);
+    }
+
+    expect(docsIndex).toContain("sources");
+    expect(sources).toContain("MCP server over Streamable HTTP");
+    expect(sources).toContain("MCP stdio template");
+    expect(sources).toContain("OpenAPI");
+    expect(sources).toContain("GraphQL");
+    expect(credentials).toContain("at most one active static credential");
+    expect(credentials).toContain("Managed OAuth");
+    expect(marketing).toContain("at most one encrypted static credential profile");
+    expect(marketing).not.toContain("from any protocol");
+  });
+
+  it("uses the current global tool-mode vocabulary", () => {
+    for (const surface of [docsIndex, toolModes, marketing]) {
+      expect(surface).toContain("Inherit");
+      expect(surface).toContain("Enabled");
+      expect(surface).toContain("Ask");
+      expect(surface).toContain("Disabled");
+      expect(surface).not.toMatch(/Require approval/iu);
+      expect(surface).not.toMatch(/\bAllow\b.*\bBlock\b/isu);
+    }
+
+    expect(toolModes).toContain("same global tool set");
+  });
+
+  it("keeps the docs and marketing setup prompt synchronized", () => {
+    const docsPrompt = extract(
+      docsIndex,
+      /```text Setup prompt\n([\s\S]*?)\n```/u,
+      "docs setup prompt",
+    );
+    const marketingPrompt = extract(
+      marketing,
+      /const setupPrompt = `([\s\S]*?)`;/u,
+      "marketing setup prompt",
+    ).replaceAll("\\`", "`");
+
+    expect(marketingPrompt).toBe(docsPrompt);
+    expect(docsPrompt).toContain("one-time setup URL");
+    expect(docsPrompt).toContain("create the administrator");
+    expect(docsPrompt).toContain("create an API token in the dashboard");
+  });
+
+  it("keeps first boot and dashboard-issued API tokens on every setup surface", () => {
+    for (const setupPage of [selfHosting, docker]) {
+      expect(setupPage).toMatch(/one-time setup URL/iu);
+      expect(setupPage).toMatch(/create the administrator/iu);
+      expect(setupPage).toMatch(/create an API token/iu);
+    }
+
+    expect(normalizeWhitespace(mcpEndpoint)).toContain("Create an API token in the dashboard");
+    expect(normalizeWhitespace(cli)).toContain("Create an API token in the dashboard");
+    expect(marketing).toContain("dashboard-issued API token");
+  });
+
+  it("verifies native archives through checksums and immutable GitHub Releases", () => {
+    expect(installGuide).toContain("sha256sum --check SHA256SUMS");
+    expect(installGuide).toContain("shasum -a 256 --check SHA256SUMS");
+    expect(installGuide).toContain('gh release verify "$tag" --repo "$repository"');
+    expect(installGuide).toContain(
+      'gh release verify-asset "$tag" "$archive" --repo "$repository"',
+    );
+    expect(installGuide).not.toContain("gh attestation verify");
+    expect(installGuide).not.toMatch(/build[- ]provenance/iu);
+    expect(installGuide).not.toContain("archives, attestations");
+  });
+});
diff --git a/tests/approval_api_strictness.rs b/tests/approval_api_strictness.rs
new file mode 100644
index 000000000..ce9edf375
--- /dev/null
+++ b/tests/approval_api_strictness.rs
@@ -0,0 +1,184 @@
+use axum::{
+    Router,
+    body::Body,
+    http::{Method, Request, StatusCode, header},
+};
+use executor::{AppConfig, ExecutorApp};
+use http_body_util::BodyExt;
+use serde_json::{Value, json};
+use tower::ServiceExt;
+
+const ORIGIN: &str = "http://127.0.0.1:4788";
+
+struct Admin {
+    cookie: String,
+    csrf: String,
+}
+
+async fn send(
+    router: Router,
+    method: Method,
+    uri: &str,
+    body: Value,
+    headers: &[(&str, &str)],
+) -> axum::response::Response {
+    let mut request = Request::builder()
+        .method(method)
+        .uri(uri)
+        .header(header::CONTENT_TYPE, "application/json");
+    for (name, value) in headers {
+        request = request.header(*name, *value);
+    }
+    router
+        .oneshot(
+            request
+                .body(Body::from(body.to_string()))
+                .expect("request should build"),
+        )
+        .await
+        .expect("router should answer")
+}
+
+async fn json_body(response: axum::response::Response) -> Value {
+    let bytes = response
+        .into_body()
+        .collect()
+        .await
+        .expect("response should collect")
+        .to_bytes();
+    serde_json::from_slice(&bytes).expect("response should contain JSON")
+}
+
+fn cookies(response: &axum::response::Response) -> String {
+    response
+        .headers()
+        .get_all(header::SET_COOKIE)
+        .iter()
+        .map(|value| {
+            value
+                .to_str()
+                .expect("cookie should be text")
+                .split(';')
+                .next()
+                .expect("cookie should contain a value")
+        })
+        .collect::<Vec<_>>()
+        .join("; ")
+}
+
+async fn setup(app: &ExecutorApp) -> Admin {
+    let setup_token = app
+        .setup_token()
+        .expect("fresh app should expose a setup token");
+    let response = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/setup",
+        json!({
+            "setupToken": setup_token,
+            "username": "admin",
+            "password": "correct horse battery staple"
+        }),
+        &[(header::ORIGIN.as_str(), ORIGIN)],
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::CREATED);
+
+    let response = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/session",
+        json!({
+            "username": "admin",
+            "password": "correct horse battery staple"
+        }),
+        &[(header::ORIGIN.as_str(), ORIGIN)],
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::OK);
+    let cookie = cookies(&response);
+    let csrf = json_body(response).await["csrfToken"]
+        .as_str()
+        .expect("login should return a CSRF token")
+        .to_owned();
+    Admin { cookie, csrf }
+}
+
+fn admin_headers(admin: &Admin) -> [(&str, &str); 3] {
+    [
+        (header::COOKIE.as_str(), admin.cookie.as_str()),
+        (header::ORIGIN.as_str(), ORIGIN),
+        ("x-executor-csrf", admin.csrf.as_str()),
+    ]
+}
+
+async fn create_gateway_token(app: &ExecutorApp, admin: &Admin) -> String {
+    let response = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/tokens",
+        json!({ "name": "approval strictness" }),
+        &[
+            (header::COOKIE.as_str(), admin.cookie.as_str()),
+            (header::ORIGIN.as_str(), ORIGIN),
+            ("x-executor-csrf", admin.csrf.as_str()),
+            ("idempotency-key", "approval-strictness-token"),
+        ],
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::CREATED);
+    json_body(response).await["token"]
+        .as_str()
+        .expect("token should be returned")
+        .to_owned()
+}
+
+#[tokio::test]
+async fn approval_endpoints_reject_unknown_body_fields_and_query_parameters() {
+    let directory = tempfile::tempdir().expect("temporary directory should be created");
+    let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+        .await
+        .expect("Executor should open");
+    let admin = setup(&app).await;
+
+    let response = send(
+        app.router(),
+        Method::GET,
+        "/api/v1/approvals?limit=10&unexpected=true",
+        json!(null),
+        &[(header::COOKIE.as_str(), admin.cookie.as_str())],
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
+    assert_eq!(json_body(response).await["error"]["code"], "invalid_query");
+
+    let response = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/approvals/missing/decision",
+        json!({
+            "decision": "approve",
+            "expectedRevision": 0,
+            "unexpected": true
+        }),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
+    assert_eq!(json_body(response).await["error"]["code"], "invalid_json");
+
+    let token = create_gateway_token(&app, &admin).await;
+    let authorization = format!("Bearer {token}");
+    let response = send(
+        app.router(),
+        Method::DELETE,
+        "/api/v1/gateway/approvals/missing?expectedRevision=0&unexpected=true",
+        json!(null),
+        &[(header::AUTHORIZATION.as_str(), authorization.as_str())],
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
+    assert_eq!(json_body(response).await["error"]["code"], "invalid_query");
+
+    app.shutdown().await;
+}
diff --git a/tests/approval_service.rs b/tests/approval_service.rs
new file mode 100644
index 000000000..fceeca575
--- /dev/null
+++ b/tests/approval_service.rs
@@ -0,0 +1,441 @@
+use std::collections::BTreeMap;
+
+use executor::{
+    AppConfig, ExecutorApp,
+    actor::ToolActor,
+    approval::{ApprovalDecision, ApprovalStatus},
+    catalog::{
+        ArtifactKind, AuditContext, CreateSource, CredentialPayload, InitialCatalogSnapshot,
+        RequestSurface, SourceKind, StagedArtifact, StagedTool, StagedToolBinding, ToolBinding,
+        ToolMode,
+    },
+    invocation::{ApprovalWaitError, ToolCall, ToolCallSubmission},
+    openapi::{OpenApiBinding, OpenApiSecurityAlternative},
+};
+use serde_json::{Map, json};
+
+async fn app_with_ask_tool() -> (tempfile::TempDir, ExecutorApp) {
+    let directory = tempfile::tempdir().expect("temporary directory should be created");
+    let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+        .await
+        .expect("Executor should open");
+    sqlx::query(
+        "INSERT INTO api_tokens \
+         (id, name, token_digest, token_prefix, token_suffix, created_at) \
+         VALUES ('owner-token', 'Owner', x'010203', 'exr_test', 'test', 1)",
+    )
+    .execute(app.pool())
+    .await
+    .expect("owner token should insert");
+    sqlx::query(
+        "INSERT INTO admins (id, username, password_hash, created_at) \
+         VALUES (1, 'admin', 'unused', 1)",
+    )
+    .execute(app.pool())
+    .await
+    .expect("admin should insert");
+    app.catalog()
+        .create_source_with_catalog(
+            CreateSource {
+                kind: SourceKind::Openapi,
+                preferred_slug: "approval".to_owned(),
+                display_name: "Approval source".to_owned(),
+                description: None,
+                configuration: Map::new(),
+            },
+            &CredentialPayload {
+                schema_version: 1,
+                payload: json!({
+                    "locator": { "type": "inline" },
+                    "credentials": { "schemes": {} }
+                }),
+            },
+            InitialCatalogSnapshot {
+                artifacts: vec![StagedArtifact {
+                    kind: ArtifactKind::OpenapiDocument,
+                    stable_key: "document".to_owned(),
+                    content: json!({ "openapi": "3.1.0" }),
+                }],
+                tools: vec![StagedTool {
+                    stable_key: "write".to_owned(),
+                    preferred_name: "write".to_owned(),
+                    display_name: "Write".to_owned(),
+                    description: None,
+                    input_schema: json!({
+                        "type": "object",
+                        "additionalProperties": false,
+                        "required": ["password"],
+                        "properties": {
+                            "password": { "type": "string", "format": "password" }
+                        }
+                    }),
+                    output_schema: None,
+                    input_typescript: None,
+                    output_typescript: None,
+                    typescript_definitions: BTreeMap::new(),
+                    intrinsic_mode: ToolMode::Ask,
+                }],
+            },
+            vec![StagedToolBinding {
+                stable_key: "write".to_owned(),
+                binding: ToolBinding::OpenapiV1(OpenApiBinding {
+                    version: 1,
+                    method: "POST".to_owned(),
+                    path_template: "/write".to_owned(),
+                    server_url: "http://127.0.0.1:9".to_owned(),
+                    parameters: Vec::new(),
+                    request_body: None,
+                    security: vec![OpenApiSecurityAlternative {
+                        requirements: Vec::new(),
+                    }],
+                }),
+            }],
+            AuditContext::system(Some("approval-test")),
+        )
+        .await
+        .expect("ask tool should import");
+    (directory, app)
+}
+
+fn call(arguments: serde_json::Value) -> ToolCall {
+    call_for("execution-1", "call-1", arguments)
+}
+
+fn call_for(execution_id: &str, call_id: &str, arguments: serde_json::Value) -> ToolCall {
+    ToolCall {
+        request_id: uuid::Uuid::new_v4().to_string(),
+        actor: ToolActor::api_token("owner-token", Some("Owner".to_owned())),
+        surface: RequestSurface::Gateway,
+        execution_id: execution_id.to_owned(),
+        call_id: call_id.to_owned(),
+        worker_generation: 0,
+        path: "approval.write".to_owned(),
+        arguments,
+    }
+}
+
+async fn wait_for_terminal_log(app: &ExecutorApp, approval_id: &str, error_code: &str) {
+    tokio::time::timeout(std::time::Duration::from_secs(2), async {
+        loop {
+            let (found, pending) = sqlx::query_as::<_, (i64, i64)>(
+                "SELECT \
+                 EXISTS(SELECT 1 FROM request_logs WHERE approval_id = ? AND error_code = ?), \
+                 EXISTS(SELECT 1 FROM approval_log_outbox WHERE approval_id = ?)",
+            )
+            .bind(approval_id)
+            .bind(error_code)
+            .bind(approval_id)
+            .fetch_one(app.pool())
+            .await
+            .expect("request log should read");
+            if found != 0 && pending == 0 {
+                break;
+            }
+            tokio::task::yield_now().await;
+        }
+    })
+    .await
+    .unwrap_or_else(|_| panic!("terminal approval log {error_code} should be stored"));
+}
+
+#[tokio::test]
+async fn wait_is_correlated_cancelable_and_wakes_for_a_denial_without_plaintext_storage() {
+    let (directory, app) = app_with_ask_tool().await;
+    let secret = "unique-approval-secret-92f781";
+    let submission = app
+        .tool_calls()
+        .submit(call(json!({ "password": secret })))
+        .await
+        .expect("valid Ask call should become pending");
+    let approval = match submission {
+        ToolCallSubmission::ApprovalRequired(approval) => approval,
+        ToolCallSubmission::Completed(_) => panic!("Ask call must not execute immediately"),
+    };
+
+    let admin = app
+        .tool_calls()
+        .approvals()
+        .get_admin(&approval.id)
+        .await
+        .expect("approval should read")
+        .expect("approval should exist");
+    assert_eq!(admin.redacted_arguments["password"], "[redacted]");
+
+    let canceled_submission = app
+        .tool_calls()
+        .submit(call_for(
+            "execution-canceled-wait",
+            "call-canceled-wait",
+            json!({ "password": "cancel-wait-secret" }),
+        ))
+        .await
+        .expect("cancelable Ask call should become pending");
+    let canceled_approval = match canceled_submission {
+        ToolCallSubmission::ApprovalRequired(approval) => approval,
+        ToolCallSubmission::Completed(_) => panic!("Ask call must not execute immediately"),
+    };
+    let canceled = app
+        .tool_calls()
+        .wait_for_approval(
+            canceled_approval,
+            &ToolActor::api_token("owner-token", Some("Owner".to_owned())),
+            "execution-canceled-wait",
+            "call-canceled-wait",
+            async {},
+        )
+        .await;
+    assert!(matches!(canceled, Err(ApprovalWaitError::Canceled)));
+
+    let service = app.tool_calls().clone();
+    let approval_id = approval.id.clone();
+    let approval_revision = approval.revision;
+    let waiter = tokio::spawn(async move {
+        service
+            .wait_for_approval(
+                approval,
+                &ToolActor::api_token("owner-token", Some("Owner".to_owned())),
+                "execution-1",
+                "call-1",
+                std::future::pending(),
+            )
+            .await
+    });
+    app.tool_calls()
+        .decide(
+            &approval_id,
+            "deny-request",
+            approval_revision,
+            ApprovalDecision::Deny,
+            1,
+        )
+        .await
+        .expect("admin denial should succeed");
+    let denied = tokio::time::timeout(std::time::Duration::from_secs(2), waiter)
+        .await
+        .expect("waiter should wake")
+        .expect("wait task should not panic")
+        .expect("wait should return the terminal approval");
+    assert_eq!(denied.record.status, ApprovalStatus::Denied);
+    assert!(denied.result.is_none());
+
+    for entry in std::fs::read_dir(directory.path()).expect("data directory should read") {
+        let path = entry.expect("data entry should read").path();
+        if path.is_file() {
+            let bytes = std::fs::read(&path).expect("data file should read");
+            assert!(
+                !bytes
+                    .windows(secret.len())
+                    .any(|window| window == secret.as_bytes()),
+                "plaintext approval argument leaked into {}",
+                path.display()
+            );
+        }
+    }
+
+    let audit_count = sqlx::query_scalar::<_, i64>(
+        "SELECT COUNT(*) FROM audit_events WHERE action = 'approval.deny' \
+         AND json_extract(metadata_json, '$.approvalId') = ?",
+    )
+    .bind(&approval_id)
+    .fetch_one(app.pool())
+    .await
+    .expect("approval audit should read");
+    assert_eq!(audit_count, 1);
+}
+
+#[tokio::test]
+async fn invalid_arguments_create_no_approval() {
+    let (_directory, app) = app_with_ask_tool().await;
+    let result = app
+        .tool_calls()
+        .submit(call(json!({ "unknown": true })))
+        .await;
+    assert!(matches!(
+        result,
+        Err(executor::invocation::ToolCallError::InvalidArguments)
+    ));
+    let count = sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM approvals")
+        .fetch_one(app.pool())
+        .await
+        .expect("approval count should read");
+    assert_eq!(count, 0);
+}
+
+#[tokio::test]
+async fn bulk_cancellation_and_expiry_attempt_correlated_metadata_logs() {
+    let (_directory, app) = app_with_ask_tool().await;
+
+    let canceled = app
+        .tool_calls()
+        .submit(call_for(
+            "execution-cancel",
+            "call-cancel",
+            json!({ "password": "cancel-secret" }),
+        ))
+        .await
+        .expect("cancel approval should persist");
+    let canceled = match canceled {
+        ToolCallSubmission::ApprovalRequired(approval) => approval,
+        ToolCallSubmission::Completed(_) => panic!("Ask call must become pending"),
+    };
+    assert_eq!(
+        app.tool_calls()
+            .cancel_execution("execution-cancel")
+            .await
+            .expect("execution cancellation should run"),
+        1
+    );
+    wait_for_terminal_log(&app, &canceled.id, "approval_canceled").await;
+
+    let expiring = app
+        .tool_calls()
+        .submit(call_for(
+            "execution-expire",
+            "call-expire",
+            json!({ "password": "expire-secret" }),
+        ))
+        .await
+        .expect("expiring approval should persist");
+    let expiring = match expiring {
+        ToolCallSubmission::ApprovalRequired(approval) => approval,
+        ToolCallSubmission::Completed(_) => panic!("Ask call must become pending"),
+    };
+    sqlx::query("UPDATE approval_clock SET effective_now = ? WHERE id = 1")
+        .bind(expiring.expires_at)
+        .execute(app.pool())
+        .await
+        .expect("approval clock should advance");
+    assert!(
+        app.tool_calls()
+            .expire_approvals()
+            .await
+            .expect("expiry should run")
+            >= 1
+    );
+    wait_for_terminal_log(&app, &expiring.id, "approval_expired").await;
+}
+
+#[tokio::test]
+async fn token_revocation_logs_every_canceled_approval() {
+    let (_directory, app) = app_with_ask_tool().await;
+    let pending = app
+        .tool_calls()
+        .submit(call_for(
+            "execution-revoke",
+            "call-revoke",
+            json!({ "password": "revoke-secret" }),
+        ))
+        .await
+        .expect("revoked approval should persist");
+    let pending = match pending {
+        ToolCallSubmission::ApprovalRequired(approval) => approval,
+        ToolCallSubmission::Completed(_) => panic!("Ask call must become pending"),
+    };
+    assert!(
+        app.tool_calls()
+            .revoke_owner_token("owner-token")
+            .await
+            .expect("token revocation should run")
+    );
+    wait_for_terminal_log(&app, &pending.id, "approval_canceled").await;
+}
+
+#[tokio::test]
+async fn shutdown_releases_background_approval_activity_before_immediate_reopen() {
+    let (directory, app) = app_with_ask_tool().await;
+
+    let pending = app
+        .tool_calls()
+        .submit(call_for(
+            "execution-shutdown-pending",
+            "call-shutdown-pending",
+            json!({ "password": "pending-secret" }),
+        ))
+        .await
+        .expect("pending approval should persist");
+    let pending = match pending {
+        ToolCallSubmission::ApprovalRequired(approval) => approval,
+        ToolCallSubmission::Completed(_) => panic!("Ask call must become pending"),
+    };
+
+    let approved = app
+        .tool_calls()
+        .submit(call_for(
+            "execution-shutdown-approved",
+            "call-shutdown-approved",
+            json!({ "password": "approved-secret" }),
+        ))
+        .await
+        .expect("approved candidate should persist");
+    let approved = match approved {
+        ToolCallSubmission::ApprovalRequired(approval) => approval,
+        ToolCallSubmission::Completed(_) => panic!("Ask call must become pending"),
+    };
+    app.tool_calls()
+        .decide(
+            &approved.id,
+            "shutdown-approve",
+            approved.revision,
+            ApprovalDecision::Approve,
+            1,
+        )
+        .await
+        .expect("approval should persist before shutdown");
+
+    let denied = app
+        .tool_calls()
+        .submit(call_for(
+            "execution-shutdown-outbox",
+            "call-shutdown-outbox",
+            json!({ "password": "outbox-secret" }),
+        ))
+        .await
+        .expect("denied candidate should persist");
+    let denied = match denied {
+        ToolCallSubmission::ApprovalRequired(approval) => approval,
+        ToolCallSubmission::Completed(_) => panic!("Ask call must become pending"),
+    };
+    app.tool_calls()
+        .decide(
+            &denied.id,
+            "shutdown-deny",
+            denied.revision,
+            ApprovalDecision::Deny,
+            1,
+        )
+        .await
+        .expect("terminal outbox event should persist before shutdown");
+    let config = AppConfig::new(directory.path().to_path_buf());
+    app.shutdown().await;
+
+    let reopened = ExecutorApp::open(config)
+        .await
+        .expect("shutdown should release the instance lock before returning");
+    let pending_after_restart = reopened
+        .tool_calls()
+        .approvals()
+        .get_admin(&pending.id)
+        .await
+        .expect("pending approval should read after restart")
+        .expect("pending approval should remain stored after restart");
+    assert_eq!(pending_after_restart.record.status, ApprovalStatus::Pending);
+    wait_for_terminal_log(&reopened, &denied.id, "approval_denied").await;
+    tokio::time::timeout(std::time::Duration::from_secs(2), async {
+        loop {
+            let recovered = reopened
+                .tool_calls()
+                .approvals()
+                .get_admin(&approved.id)
+                .await
+                .expect("approved recovery state should read")
+                .expect("approved recovery state should remain stored");
+            if recovered.record.status.is_terminal() {
+                break;
+            }
+            tokio::task::yield_now().await;
+        }
+    })
+    .await
+    .expect("approved work should reach a recovery-safe terminal state");
+    reopened.shutdown().await;
+}
diff --git a/tests/archive-product-boundaries.test.ts b/tests/archive-product-boundaries.test.ts
new file mode 100644
index 000000000..5cb132e23
--- /dev/null
+++ b/tests/archive-product-boundaries.test.ts
@@ -0,0 +1,136 @@
+import { describe, expect, it } from "@effect/vitest";
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+const repoRoot = resolve(import.meta.dirname, "..");
+const readRepoFile = (path: string) => readFileSync(resolve(repoRoot, path), "utf8");
+const normalizeWhitespace = (contents: string) => contents.replace(/\s+/gu, " ").trim();
+
+const rootPackage = readRepoFile("package.json");
+const cloudflarePackage = readRepoFile("legacy/host-cloudflare/package.json");
+const selfhostPackage = readRepoFile("legacy/host-selfhost/package.json");
+const cloudTsconfig = readRepoFile("legacy/cloud/tsconfig.json");
+const openCode = readRepoFile("opencode.json");
+const releaseRunbook = readRepoFile(".skills/cli-release/SKILL.md");
+const warden = readRepoFile("warden.toml");
+const wardenRunbook = readRepoFile(".skills/warden-security-review/SKILL.md");
+const docsReadme = readRepoFile("apps/docs/README.md");
+const docsConfig = readRepoFile("apps/docs/docs.json");
+const docsIndex = readRepoFile("apps/docs/index.mdx");
+const dockerDocs = readRepoFile("apps/docs/hosted/docker.mdx");
+const legacyCliDocs = readRepoFile("apps/docs/local/cli.mdx");
+const normalizedLegacyCliDocs = normalizeWhitespace(legacyCliDocs);
+const marketing = readRepoFile("apps/marketing/src/pages/index.astro");
+const marketingLayout = readRepoFile("apps/marketing/src/layouts/Layout.astro");
+
+const legacyDocs = [
+  "apps/docs/local/desktop.mdx",
+  "apps/docs/hosted/cloud.mdx",
+  "apps/docs/hosted/cloudflare.mdx",
+]
+  .map(readRepoFile)
+  .concat(legacyCliDocs);
+
+describe("archived product boundaries", () => {
+  it("keeps every runnable legacy entrypoint explicitly named", () => {
+    expect(rootPackage).not.toMatch(/^\s+"dev:cli":/mu);
+    expect(rootPackage).toContain('"legacy:dev:cli"');
+
+    const aggregateDev = rootPackage.split("\n").find((line) => line.includes('"legacy:dev":'));
+    expect(aggregateDev).not.toContain("--filter='executor'");
+
+    expect(cloudflarePackage).toContain('"typecheck:slow": "tsc --noEmit"');
+    expect(selfhostPackage).toContain('"typecheck:slow": "tsc --noEmit"');
+    expect(rootPackage).toContain(
+      '"legacy:typecheck:slow": "bun run --filter=\'./legacy/*\' typecheck:slow"',
+    );
+    expect(cloudTsconfig).not.toContain('"rootDir": "."');
+  });
+
+  it("does not launch the archived local MCP from the default OpenCode config", () => {
+    expect(openCode).toContain('"mcp": {}');
+    expect(openCode).not.toContain("legacy:dev:cli");
+    expect(openCode).not.toContain("legacy/local");
+  });
+
+  it("documents only the supported native release path", () => {
+    expect(releaseRunbook).toContain(".github/workflows/release.yml");
+    expect(releaseRunbook).toContain("This fork does not publish them to npm");
+    expect(releaseRunbook).toContain("old npm workflows, publisher scripts");
+    expect(releaseRunbook).not.toContain("confirm_publish=true");
+    expect(releaseRunbook).not.toContain("compat-<version>");
+    expect(releaseRunbook).not.toContain("legacy/cli");
+    expect(releaseRunbook).not.toContain("pkg.pr.new");
+  });
+
+  it("keeps the supported product in active docs navigation", () => {
+    const legacyGroup = docsConfig.indexOf('"group": "Legacy archive"');
+    expect(legacyGroup).toBeGreaterThan(0);
+
+    const activeNavigation = docsConfig.slice(0, legacyGroup);
+    expect(activeNavigation).toContain('"self-hosting"');
+    expect(activeNavigation).toContain('"hosted/docker"');
+    expect(activeNavigation).toContain('"cli"');
+    expect(activeNavigation).not.toContain('"local/cli"');
+    expect(activeNavigation).not.toContain('"local/desktop"');
+    expect(activeNavigation).not.toContain('"hosted/cloud"');
+    expect(activeNavigation).not.toContain('"hosted/cloudflare"');
+
+    expect(legacyDocs.every((legacyDoc) => legacyDoc.includes('title: "Legacy:'))).toBe(true);
+    expect(legacyDocs.every((legacyDoc) => legacyDoc.includes("<Warning>"))).toBe(true);
+  });
+
+  it("describes only the Rust, Svelte, native, and Docker product as supported", () => {
+    expect(docsIndex).toContain("binary serves the Svelte dashboard");
+    expect(docsIndex).toContain("Native Linux or macOS");
+    expect(dockerDocs).toContain("supported Docker image");
+    expect(dockerDocs).toContain("ghcr.io/davis7dotsh/executor:");
+    expect(dockerDocs).not.toContain("legacy/host-selfhost");
+    expect(dockerDocs).not.toContain("executor-selfhost");
+
+    expect(marketing).toContain("single-user, self-hosted tool gateway");
+    expect(marketing).toContain("Linux and macOS archives");
+    expect(marketing).not.toContain("Executor Cloud");
+    expect(marketing).not.toContain('href="/cloud"');
+    expect(marketing).not.toContain("npm i -g executor");
+    expect(marketing).not.toContain("executor-desktop-");
+    expect(marketing).not.toContain('id="pricing"');
+    expect(marketing).not.toContain("ContextBloatDemo");
+    expect(marketing).not.toContain("single tool");
+    expect(marketingLayout).toContain("self-hosted tool gateway");
+    expect(docsReadme).toContain("independent of archived code");
+    expect(docsReadme).not.toContain("legacy/cloud");
+  });
+
+  it("retires actionable npm CLI installation guidance", () => {
+    expect(normalizedLegacyCliDocs).toContain("TypeScript npm CLI is retired and unsupported");
+    expect(normalizedLegacyCliDocs).toContain("Historical registry artifacts may still resolve");
+    expect(normalizedLegacyCliDocs).toContain("they are no longer updated");
+    expect(normalizedLegacyCliDocs).toContain("Do not use them for a new installation");
+    expect(normalizedLegacyCliDocs).not.toContain("installation channels are unavailable");
+    expect(normalizedLegacyCliDocs).toContain("[native self-hosting](/self-hosting)");
+    expect(normalizedLegacyCliDocs).toContain("[Rust CLI](/cli)");
+    expect(legacyCliDocs).not.toMatch(
+      /(?:npm install|npm i|pnpm add|bun add|yarn global add)\s+-g\s+executor/iu,
+    );
+    expect(legacyCliDocs).not.toContain("executor install");
+    expect(legacyCliDocs).not.toContain("executor web");
+    expect(legacyCliDocs).not.toContain("npx add-mcp");
+  });
+
+  it("scans active Rust and retained compatibility surfaces that exist", () => {
+    expect(warden).toContain('"src/database.rs"');
+    expect(warden).toContain('"src/outbound.rs"');
+    expect(warden).toContain('"src/mcp/**/*.rs"');
+    expect(warden).toContain('"legacy/local/src/**/*.ts"');
+    expect(warden).not.toContain("packages/core/storage-");
+    expect(warden).not.toContain('"legacy/local/src/**/*.tsx"');
+    expect(warden).not.toContain("legacy/local/src/server");
+    expect(wardenRunbook).toContain("src legacy/local/src legacy/cli/src");
+    expect(wardenRunbook).toContain("legacy/cloud/src/routes legacy/local/src");
+    expect(wardenRunbook).not.toContain("packages/core/storage-");
+    expect(wardenRunbook).not.toContain("packages/plugins/google-discovery");
+    expect(wardenRunbook).not.toContain("packages/plugins/oauth2");
+    expect(wardenRunbook).not.toContain("legacy/local/src/server");
+  });
+});
diff --git a/tests/bootstrap-script.test.ts b/tests/bootstrap-script.test.ts
new file mode 100644
index 000000000..70797bb5b
--- /dev/null
+++ b/tests/bootstrap-script.test.ts
@@ -0,0 +1,15 @@
+import { describe, expect, it } from "@effect/vitest";
+
+import { runBootstrap, type BootstrapExecutor } from "../scripts/bootstrap";
+
+describe("fresh checkout bootstrap", () => {
+  it("executes only the locked dependency and browser installs, in order", () => {
+    const commands: Parameters<BootstrapExecutor>[] = [];
+    runBootstrap((label, command, args) => commands.push([label, command, args]));
+
+    expect(commands.map(([, command, args]) => [command, ...args])).toEqual([
+      ["bun", "install", "--frozen-lockfile"],
+      ["bun", "run", "--cwd", "e2e", "playwright", "install", "--with-deps", "chromium"],
+    ]);
+  });
+});
diff --git a/tests/catalog.rs b/tests/catalog.rs
new file mode 100644
index 000000000..427beb4f6
--- /dev/null
+++ b/tests/catalog.rs
@@ -0,0 +1,3844 @@
+use std::{
+    collections::BTreeMap,
+    fs,
+    sync::{
+        Arc,
+        atomic::{AtomicU64, Ordering},
+    },
+};
+
+use axum::{
+    Router,
+    body::Body,
+    http::{Method, Request, Response, StatusCode, header},
+};
+use executor::{
+    AppConfig, DatabaseError, ExecutorApp,
+    catalog::{
+        ArtifactKind, AuditContext, CatalogError, CatalogSnapshot, CreateSource, CredentialPayload,
+        InitialCatalogSnapshot, ListToolsFilter, ModeProvenance, NewRequestLog, RequestOutcome,
+        RequestSurface, SourceHealth, SourceKind, StagedArtifact, StagedTool, StagedToolBinding,
+        ToolBinding, ToolMode, UpdateSource,
+    },
+    openapi::{OpenApiBinding, OpenApiSecurityAlternative},
+};
+use http_body_util::BodyExt;
+use serde_json::{Map, Value, json};
+use tempfile::TempDir;
+use tower::ServiceExt;
+
+const ORIGIN: &str = "http://127.0.0.1:4788";
+const PASSWORD: &str = "correct-horse-battery-staple";
+static TOKEN_IDEMPOTENCY_SEQUENCE: AtomicU64 = AtomicU64::new(1);
+
+struct TestExecutor {
+    directory: TempDir,
+    app: Arc<ExecutorApp>,
+}
+
+struct AdminSession {
+    cookie: String,
+    csrf: String,
+}
+
+impl TestExecutor {
+    async fn new() -> Self {
+        let directory = tempfile::tempdir().expect("temporary directory should be created");
+        let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+            .await
+            .expect("test Executor should open");
+        Self {
+            directory,
+            app: Arc::new(app),
+        }
+    }
+
+    fn router(&self) -> Router {
+        self.app.router()
+    }
+
+    async fn source(&self, preferred_slug: &str) -> executor::catalog::SourceRecord {
+        self.source_with_kind(preferred_slug, SourceKind::Openapi)
+            .await
+    }
+
+    async fn source_with_kind(
+        &self,
+        preferred_slug: &str,
+        kind: SourceKind,
+    ) -> executor::catalog::SourceRecord {
+        self.app
+            .catalog()
+            .create_source(
+                CreateSource {
+                    kind,
+                    preferred_slug: preferred_slug.to_owned(),
+                    display_name: preferred_slug.to_owned(),
+                    description: None,
+                    configuration: Map::new(),
+                },
+                AuditContext::system(None),
+            )
+            .await
+            .expect("source should be created")
+    }
+
+    async fn sync(
+        &self,
+        source_id: &str,
+        tools: Vec<StagedTool>,
+    ) -> executor::catalog::CatalogSyncResult {
+        let source = self
+            .app
+            .catalog()
+            .source(source_id)
+            .await
+            .expect("source should exist");
+        let credential_revision = self
+            .app
+            .catalog()
+            .credential(source_id)
+            .await
+            .expect("credential read should succeed")
+            .map(|credential| credential.revision);
+        let bindings = openapi_bindings(&tools);
+        self.app
+            .catalog()
+            .sync_catalog_with_bindings(
+                source_id,
+                CatalogSnapshot {
+                    expected_source_revision: source.revision,
+                    expected_credential_revision: credential_revision,
+                    artifacts: Vec::new(),
+                    tools,
+                },
+                bindings,
+                AuditContext::system(None),
+            )
+            .await
+            .expect("catalog sync should succeed")
+    }
+
+    async fn setup_admin(&self) {
+        let response = send_json(
+            self.router(),
+            Method::POST,
+            "/api/v1/setup",
+            json!({
+                "setupToken": self.app.setup_token().expect("setup token should exist"),
+                "username": "admin",
+                "password": PASSWORD
+            }),
+            &[(header::ORIGIN.as_str(), ORIGIN)],
+        )
+        .await;
+        assert_eq!(response.status(), StatusCode::CREATED);
+    }
+
+    async fn login(&self) -> AdminSession {
+        let response = send_json(
+            self.router(),
+            Method::POST,
+            "/api/v1/session",
+            json!({ "username": "admin", "password": PASSWORD }),
+            &[(header::ORIGIN.as_str(), ORIGIN)],
+        )
+        .await;
+        assert_eq!(response.status(), StatusCode::OK);
+        let cookie = response_cookie_header(&response);
+        let body = response_json(response).await;
+        let csrf = body["csrfToken"]
+            .as_str()
+            .expect("login should reveal CSRF")
+            .to_owned();
+        AdminSession { cookie, csrf }
+    }
+
+    async fn create_api_token(&self, admin: &AdminSession, name: &str) -> String {
+        let idempotency_key = format!(
+            "catalog-api-token-{}",
+            TOKEN_IDEMPOTENCY_SEQUENCE.fetch_add(1, Ordering::Relaxed)
+        );
+        let response = send_json(
+            self.router(),
+            Method::POST,
+            "/api/v1/tokens",
+            json!({ "name": name }),
+            &[
+                (header::COOKIE.as_str(), &admin.cookie),
+                (header::ORIGIN.as_str(), ORIGIN),
+                ("x-executor-csrf", &admin.csrf),
+                ("idempotency-key", idempotency_key.as_str()),
+            ],
+        )
+        .await;
+        assert_eq!(response.status(), StatusCode::CREATED);
+        response_json(response).await["token"]
+            .as_str()
+            .expect("token should be revealed")
+            .to_owned()
+    }
+}
+
+fn staged(stable_key: &str, preferred_name: &str, mode: ToolMode) -> StagedTool {
+    StagedTool {
+        stable_key: stable_key.to_owned(),
+        preferred_name: preferred_name.to_owned(),
+        display_name: preferred_name.to_owned(),
+        description: Some(format!("Operate on {preferred_name}")),
+        input_schema: json!({ "type": "object" }),
+        output_schema: Some(json!({ "type": "object" })),
+        input_typescript: Some("{ id: string }".to_owned()),
+        output_typescript: Some("{ ok: boolean }".to_owned()),
+        typescript_definitions: BTreeMap::new(),
+        intrinsic_mode: mode,
+    }
+}
+
+fn openapi_binding(stable_key: &str, method: &str) -> StagedToolBinding {
+    StagedToolBinding {
+        stable_key: stable_key.to_owned(),
+        binding: ToolBinding::OpenapiV1(OpenApiBinding {
+            version: 1,
+            method: method.to_owned(),
+            path_template: format!("/{stable_key}"),
+            server_url: "https://catalog.example.test".to_owned(),
+            parameters: Vec::new(),
+            request_body: None,
+            security: vec![OpenApiSecurityAlternative {
+                requirements: Vec::new(),
+            }],
+        }),
+    }
+}
+
+fn openapi_bindings(tools: &[StagedTool]) -> Vec<StagedToolBinding> {
+    tools
+        .iter()
+        .map(|tool| openapi_binding(&tool.stable_key, "GET"))
+        .collect()
+}
+
+#[tokio::test]
+async fn every_imported_source_kind_requires_bindings_for_active_tools() {
+    let executor = TestExecutor::new().await;
+    for kind in [
+        SourceKind::Openapi,
+        SourceKind::Graphql,
+        SourceKind::McpHttp,
+        SourceKind::McpStdio,
+    ] {
+        let source = executor
+            .source_with_kind(&format!("binding-required-{}", kind.as_str()), kind)
+            .await;
+        let error = executor
+            .app
+            .catalog()
+            .sync_catalog(
+                &source.id,
+                CatalogSnapshot {
+                    expected_source_revision: source.revision,
+                    expected_credential_revision: None,
+                    artifacts: Vec::new(),
+                    tools: vec![staged("tool", "Tool", ToolMode::Enabled)],
+                },
+                AuditContext::system(None),
+            )
+            .await
+            .expect_err("active imported tools without bindings must fail closed");
+        assert!(matches!(
+            error,
+            CatalogError::Validation {
+                code: "incomplete_tool_bindings",
+                ..
+            }
+        ));
+        assert_eq!(
+            sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM tools WHERE source_id = ?")
+                .bind(&source.id)
+                .fetch_one(executor.app.pool())
+                .await
+                .expect("failed sync leaves no tools"),
+            0
+        );
+    }
+}
+
+#[tokio::test]
+async fn catalog_migration_is_strict_and_enforces_foreign_keys_and_constraints() {
+    let executor = TestExecutor::new().await;
+    let strict_tables =
+        sqlx::query_as::<_, (String, String, String, i64, i64, i64)>("PRAGMA table_list")
+            .fetch_all(executor.app.pool())
+            .await
+            .expect("table list should be readable")
+            .into_iter()
+            .filter(|(_, name, _, _, _, _)| {
+                matches!(
+                    name.as_str(),
+                    "catalog_state"
+                        | "sources"
+                        | "source_credentials"
+                        | "source_artifacts"
+                        | "tools"
+                        | "request_logs"
+                        | "audit_events"
+                )
+            })
+            .collect::<Vec<_>>();
+    assert_eq!(strict_tables.len(), 7);
+    assert!(strict_tables.iter().all(|row| row.5 == 1));
+
+    let foreign_key_error = sqlx::query(
+        "INSERT INTO source_credentials \
+         (source_id, schema_version, payload_ciphertext, revision, created_at, updated_at) \
+         VALUES ('missing', 1, X'01', 0, 1, 1)",
+    )
+    .execute(executor.app.pool())
+    .await
+    .expect_err("credential without source must fail");
+    assert!(foreign_key_error.as_database_error().is_some());
+
+    let invalid_kind = sqlx::query(
+        "INSERT INTO sources \
+         (id, kind, slug, display_name, configuration_json, created_at, updated_at) \
+         VALUES ('bad', 'unknown', 'bad', 'Bad', '{}', 1, 1)",
+    )
+    .execute(executor.app.pool())
+    .await
+    .expect_err("closed source kind must reject unknown values");
+    assert!(invalid_kind.as_database_error().is_some());
+
+    for reserved in ["tools", "search", "describe", "executor"] {
+        let reserved_slug = sqlx::query(
+            "INSERT INTO sources \
+             (id, kind, slug, display_name, configuration_json, created_at, updated_at) \
+             VALUES (?, 'openapi', ?, 'Reserved', '{}', 1, 1)",
+        )
+        .bind(format!("reserved-{reserved}"))
+        .bind(reserved)
+        .execute(executor.app.pool())
+        .await
+        .expect_err("reserved source roots must be rejected by SQLite");
+        assert!(reserved_slug.as_database_error().is_some());
+    }
+
+    let source = executor.source("strict").await;
+    let strict_error = sqlx::query("UPDATE sources SET display_name = ? WHERE id = ?")
+        .bind(vec![0_u8, 1_u8])
+        .bind(source.id)
+        .execute(executor.app.pool())
+        .await
+        .expect_err("STRICT text column must reject blobs");
+    assert!(strict_error.as_database_error().is_some());
+
+    let foreign_key_check =
+        sqlx::query_as::<_, (String, i64, String, i64)>("PRAGMA foreign_key_check")
+            .fetch_all(executor.app.pool())
+            .await
+            .expect("foreign key check should run");
+    assert!(foreign_key_check.is_empty());
+}
+
+#[tokio::test]
+async fn source_and_tool_names_are_collision_safe_and_order_independent() {
+    let executor = TestExecutor::new().await;
+    let first = executor.source("Git Hub").await;
+    let second = executor.source("Git-Hub").await;
+    assert_eq!(first.slug, "git_hub");
+    assert_eq!(second.slug, "git_hub_2");
+    for reserved in ["tools", "search", "describe", "sources", "executor"] {
+        let source = executor.source(reserved).await;
+        assert_eq!(source.slug, format!("{reserved}_2"));
+    }
+    let graphql = executor.source("graphql").await;
+    assert_eq!(graphql.slug, "graphql");
+
+    let updated = executor
+        .app
+        .catalog()
+        .update_source(
+            &first.id,
+            UpdateSource {
+                display_name: "GitHub API".to_owned(),
+                description: Some("Repository operations".to_owned()),
+                configuration: Map::from_iter([(
+                    "baseUrl".to_owned(),
+                    json!("https://api.example.invalid"),
+                )]),
+                expected_revision: first.revision,
+            },
+            AuditContext::system(None),
+        )
+        .await
+        .expect("source should update optimistically");
+    assert_eq!(updated.slug, first.slug);
+    assert_eq!(updated.display_name, "GitHub API");
+    assert!(matches!(
+        executor
+            .app
+            .catalog()
+            .update_source(
+                &first.id,
+                UpdateSource {
+                    display_name: "Stale".to_owned(),
+                    description: None,
+                    configuration: Map::new(),
+                    expected_revision: first.revision,
+                },
+                AuditContext::system(None),
+            )
+            .await,
+        Err(CatalogError::RevisionConflict {
+            scope: "source",
+            ..
+        })
+    ));
+
+    executor
+        .sync(
+            &first.id,
+            vec![
+                staged("z-key", "Get Repo", ToolMode::Enabled),
+                staged("a-key", "Get-Repo", ToolMode::Enabled),
+            ],
+        )
+        .await;
+    let first_tools = executor
+        .app
+        .catalog()
+        .list_tools(ListToolsFilter {
+            source_id: Some(first.id.clone()),
+            limit: 100,
+            ..Default::default()
+        })
+        .await
+        .expect("tools should list")
+        .items;
+    let names_by_key = first_tools
+        .iter()
+        .map(|tool| (tool.stable_key.as_str(), tool.local_name.as_str()))
+        .collect::<BTreeMap<_, _>>();
+    assert_eq!(names_by_key["a-key"], "get_repo");
+    assert_eq!(names_by_key["z-key"], "get_repo_2");
+    assert!(first_tools.iter().all(|tool| {
+        tool.callable_path == format!("tools.{}.{}", first.slug, tool.local_name)
+            && tool.sandbox_path == format!("{}.{}", first.slug, tool.local_name)
+    }));
+}
+
+#[tokio::test]
+async fn refresh_is_atomic_and_preserves_overrides_through_tombstones() {
+    let executor = TestExecutor::new().await;
+    let source = executor.source("catalog").await;
+    executor
+        .sync(
+            &source.id,
+            vec![
+                staged("alpha", "Run", ToolMode::Enabled),
+                staged("beta", "Run", ToolMode::Ask),
+            ],
+        )
+        .await;
+    let tools = executor
+        .app
+        .catalog()
+        .list_tools(ListToolsFilter {
+            source_id: Some(source.id.clone()),
+            limit: 100,
+            ..Default::default()
+        })
+        .await
+        .expect("tools should list")
+        .items;
+    let beta = tools
+        .iter()
+        .find(|tool| tool.stable_key == "beta")
+        .expect("beta should exist")
+        .clone();
+    let beta = executor
+        .app
+        .catalog()
+        .set_tool_mode(
+            &beta.id,
+            Some(ToolMode::Disabled),
+            beta.revision,
+            AuditContext::system(None),
+        )
+        .await
+        .expect("override should update");
+    let before_failure = executor
+        .app
+        .catalog()
+        .source(&source.id)
+        .await
+        .expect("source should exist");
+    let duplicate = executor
+        .app
+        .catalog()
+        .sync_catalog(
+            &source.id,
+            CatalogSnapshot {
+                expected_source_revision: before_failure.revision,
+                expected_credential_revision: None,
+                artifacts: Vec::new(),
+                tools: vec![
+                    staged("same", "One", ToolMode::Enabled),
+                    staged("same", "Two", ToolMode::Enabled),
+                ],
+            },
+            AuditContext::system(None),
+        )
+        .await
+        .expect_err("duplicate staging must fail before the transaction");
+    assert!(matches!(
+        duplicate,
+        CatalogError::Validation {
+            code: "duplicate_stable_key",
+            ..
+        }
+    ));
+    let after_failure = executor
+        .app
+        .catalog()
+        .source(&source.id)
+        .await
+        .expect("source should exist");
+    assert_eq!(
+        after_failure.catalog_revision,
+        before_failure.catalog_revision
+    );
+
+    executor
+        .sync(&source.id, vec![staged("alpha", "Run", ToolMode::Enabled)])
+        .await;
+    let tombstoned = executor
+        .app
+        .catalog()
+        .tool(&beta.id)
+        .await
+        .expect("tombstoned tool should remain in admin catalog");
+    assert!(!tombstoned.present);
+    assert_eq!(tombstoned.mode_override, Some(ToolMode::Disabled));
+
+    executor
+        .sync(
+            &source.id,
+            vec![
+                staged("beta", "Different Display Name", ToolMode::Ask),
+                staged("alpha", "Run", ToolMode::Enabled),
+            ],
+        )
+        .await;
+    let restored = executor
+        .app
+        .catalog()
+        .tool(&beta.id)
+        .await
+        .expect("restored tool should retain identity");
+    assert!(restored.present);
+    assert_eq!(restored.id, beta.id);
+    assert_eq!(restored.local_name, beta.local_name);
+    assert_eq!(restored.mode_override, Some(ToolMode::Disabled));
+}
+
+#[tokio::test]
+async fn source_health_failures_preserve_the_last_good_catalog_and_sync_restores_health() {
+    let executor = TestExecutor::new().await;
+    let source = executor.source("health-state").await;
+    let healthy = executor
+        .app
+        .catalog()
+        .sync_catalog_with_bindings(
+            &source.id,
+            CatalogSnapshot {
+                expected_source_revision: source.revision,
+                expected_credential_revision: None,
+                artifacts: vec![StagedArtifact {
+                    kind: ArtifactKind::Metadata,
+                    stable_key: "last-good".to_owned(),
+                    content: json!({ "version": 1 }),
+                }],
+                tools: vec![staged("alpha", "Alpha", ToolMode::Enabled)],
+            },
+            vec![openapi_binding("alpha", "GET")],
+            AuditContext::system(None),
+        )
+        .await
+        .expect("initial catalog should sync");
+    let before_failure = executor
+        .app
+        .catalog()
+        .source(&source.id)
+        .await
+        .expect("source should exist");
+    let global_before_failure = executor
+        .app
+        .catalog()
+        .global_revision()
+        .await
+        .expect("global revision should read");
+    let tool_before_failure = executor
+        .app
+        .catalog()
+        .list_tools(ListToolsFilter {
+            source_id: Some(source.id.clone()),
+            limit: 10,
+            ..Default::default()
+        })
+        .await
+        .expect("last-good tool should list")
+        .items
+        .remove(0);
+
+    let failed = executor
+        .app
+        .catalog()
+        .mark_source_error(
+            &source.id,
+            "mcp_discovery_failed",
+            before_failure.revision,
+            AuditContext::system(Some("health-failure")),
+        )
+        .await
+        .expect("source health failure should persist");
+    assert_eq!(failed.health_status, SourceHealth::Error);
+    assert_eq!(
+        failed.health_error_code.as_deref(),
+        Some("mcp_discovery_failed")
+    );
+    assert_eq!(failed.revision, before_failure.revision + 1);
+    assert_eq!(failed.catalog_revision, before_failure.catalog_revision);
+    assert_eq!(failed.last_refreshed_at, before_failure.last_refreshed_at);
+    assert_eq!(
+        executor
+            .app
+            .catalog()
+            .global_revision()
+            .await
+            .expect("global revision should read"),
+        global_before_failure + 1
+    );
+    let retried_failure = executor
+        .app
+        .catalog()
+        .mark_source_error(
+            &source.id,
+            "mcp_discovery_failed",
+            before_failure.revision,
+            AuditContext::system(Some("health-failure-retry")),
+        )
+        .await
+        .expect("an identical stale error retry should be idempotent");
+    assert_eq!(retried_failure.revision, failed.revision);
+    assert_eq!(retried_failure.catalog_revision, failed.catalog_revision);
+    assert_eq!(
+        executor
+            .app
+            .catalog()
+            .global_revision()
+            .await
+            .expect("global revision should read"),
+        global_before_failure + 1
+    );
+    assert_eq!(
+        sqlx::query_scalar::<_, i64>(
+            "SELECT COUNT(*) FROM audit_events WHERE request_id = 'health-failure-retry'",
+        )
+        .fetch_one(executor.app.pool())
+        .await
+        .expect("retry audit count should read"),
+        0
+    );
+    let tool_after_failure = executor
+        .app
+        .catalog()
+        .list_tools(ListToolsFilter {
+            source_id: Some(source.id.clone()),
+            limit: 10,
+            ..Default::default()
+        })
+        .await
+        .expect("last-good tool should remain")
+        .items
+        .remove(0);
+    assert_eq!(tool_after_failure.id, tool_before_failure.id);
+    assert_eq!(tool_after_failure.revision, tool_before_failure.revision);
+    assert!(tool_after_failure.present);
+    assert_eq!(
+        sqlx::query_scalar::<_, i64>(
+            "SELECT COUNT(*) FROM source_artifacts WHERE source_id = ? AND stable_key = 'last-good'",
+        )
+        .bind(&source.id)
+        .fetch_one(executor.app.pool())
+        .await
+        .expect("last-good artifact should remain"),
+        1
+    );
+    let audit_metadata = sqlx::query_scalar::<_, String>(
+        "SELECT metadata_json FROM audit_events WHERE request_id = 'health-failure'",
+    )
+    .fetch_one(executor.app.pool())
+    .await
+    .expect("health audit should exist");
+    assert_eq!(
+        serde_json::from_str::<Value>(&audit_metadata).expect("audit metadata should be JSON"),
+        json!({
+            "healthStatus": "error",
+            "errorCode": "mcp_discovery_failed",
+            "reasonCode": "mcp_discovery_failed",
+            "globalRevision": global_before_failure + 1,
+        })
+    );
+
+    let restored = executor
+        .app
+        .catalog()
+        .sync_catalog_with_bindings(
+            &source.id,
+            CatalogSnapshot {
+                expected_source_revision: failed.revision,
+                expected_credential_revision: None,
+                artifacts: vec![StagedArtifact {
+                    kind: ArtifactKind::Metadata,
+                    stable_key: "last-good".to_owned(),
+                    content: json!({ "version": 2 }),
+                }],
+                tools: vec![staged("alpha", "Alpha", ToolMode::Enabled)],
+            },
+            vec![openapi_binding("alpha", "GET")],
+            AuditContext::system(None),
+        )
+        .await
+        .expect("successful sync should restore healthy state");
+    assert_eq!(restored.source_id, source.id);
+    let source_after_restore = executor
+        .app
+        .catalog()
+        .source(&source.id)
+        .await
+        .expect("source should remain");
+    assert_eq!(source_after_restore.health_status, SourceHealth::Healthy);
+    assert_eq!(source_after_restore.health_error_code, None);
+    assert_eq!(
+        source_after_restore.catalog_revision,
+        healthy.catalog_revision + 1
+    );
+    let tool_after_restore = executor
+        .app
+        .catalog()
+        .list_tools(ListToolsFilter {
+            source_id: Some(source.id),
+            limit: 10,
+            ..Default::default()
+        })
+        .await
+        .expect("restored tool should list")
+        .items
+        .remove(0);
+    assert_eq!(tool_after_restore.id, tool_before_failure.id);
+}
+
+#[tokio::test]
+async fn deferred_source_creation_atomically_persists_an_unknown_empty_catalog() {
+    let executor = TestExecutor::new().await;
+    let (source, catalog) = executor
+        .app
+        .catalog()
+        .create_source_with_catalog_health(
+            CreateSource {
+                kind: SourceKind::McpStdio,
+                preferred_slug: "deferred-stdio".to_owned(),
+                display_name: "Deferred stdio".to_owned(),
+                description: None,
+                configuration: Map::new(),
+            },
+            &CredentialPayload {
+                schema_version: 1,
+                payload: json!({}),
+            },
+            InitialCatalogSnapshot {
+                artifacts: Vec::new(),
+                tools: Vec::new(),
+            },
+            Vec::new(),
+            SourceHealth::Unknown,
+            AuditContext::system(Some("deferred-source-create")),
+        )
+        .await
+        .expect("deferred source and its empty catalog should commit atomically");
+    assert_eq!(source.health_status, SourceHealth::Unknown);
+    assert_eq!(source.health_error_code, None);
+    assert_eq!(source.last_refreshed_at, None);
+    assert_eq!(source.tool_count, 0);
+    assert_eq!(source.tombstoned_tool_count, 0);
+    assert_eq!(catalog.active_tool_count, 0);
+    assert_eq!(catalog.tombstoned_tool_count, 0);
+    assert_eq!(catalog.source_revision, source.revision);
+    assert_eq!(catalog.catalog_revision, source.catalog_revision);
+    assert_eq!(
+        sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM sources WHERE id = ?")
+            .bind(&source.id)
+            .fetch_one(executor.app.pool())
+            .await
+            .expect("created source should exist"),
+        1
+    );
+
+    let source_count = sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM sources")
+        .fetch_one(executor.app.pool())
+        .await
+        .expect("source count should read");
+    let error = executor
+        .app
+        .catalog()
+        .create_source_with_catalog_health(
+            CreateSource {
+                kind: SourceKind::McpStdio,
+                preferred_slug: "invalid-error-source".to_owned(),
+                display_name: "Invalid error source".to_owned(),
+                description: None,
+                configuration: Map::new(),
+            },
+            &CredentialPayload {
+                schema_version: 1,
+                payload: json!({}),
+            },
+            InitialCatalogSnapshot {
+                artifacts: Vec::new(),
+                tools: Vec::new(),
+            },
+            Vec::new(),
+            SourceHealth::Error,
+            AuditContext::system(None),
+        )
+        .await
+        .expect_err("error health without a stable code must be rejected before insertion");
+    assert!(matches!(
+        error,
+        CatalogError::Validation {
+            code: "invalid_initial_source_health",
+            ..
+        }
+    ));
+    assert_eq!(
+        sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM sources")
+            .fetch_one(executor.app.pool())
+            .await
+            .expect("source count should read"),
+        source_count
+    );
+}
+
+#[tokio::test]
+async fn authorization_required_source_creation_is_atomic_and_has_a_fixed_error_code() {
+    let executor = TestExecutor::new().await;
+    let (source, catalog) = executor
+        .app
+        .catalog()
+        .create_authorization_required_source_with_catalog(
+            CreateSource {
+                kind: SourceKind::McpHttp,
+                preferred_slug: "protected-mcp".to_owned(),
+                display_name: "Protected MCP".to_owned(),
+                description: None,
+                configuration: Map::new(),
+            },
+            &CredentialPayload {
+                schema_version: 1,
+                payload: json!({}),
+            },
+            InitialCatalogSnapshot {
+                artifacts: Vec::new(),
+                tools: Vec::new(),
+            },
+            Vec::new(),
+            AuditContext::system(Some("authorization-required-create")),
+        )
+        .await
+        .expect("authorization-required source should commit in its final initial state");
+    assert_eq!(source.health_status, SourceHealth::Error);
+    assert_eq!(
+        source.health_error_code.as_deref(),
+        Some("authorization_required")
+    );
+    assert_eq!(source.last_refreshed_at, None);
+    assert_eq!(source.tool_count, 0);
+    assert_eq!(catalog.active_tool_count, 0);
+    assert_eq!(catalog.source_revision, source.revision);
+    assert_eq!(catalog.catalog_revision, source.catalog_revision);
+
+    let source_count = sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM sources")
+        .fetch_one(executor.app.pool())
+        .await
+        .expect("source count should read");
+    sqlx::query(
+        "CREATE TRIGGER reject_source_credentials BEFORE INSERT ON source_credentials \
+         BEGIN SELECT RAISE(ABORT, 'injected credential failure'); END",
+    )
+    .execute(executor.app.pool())
+    .await
+    .expect("failure injection trigger should install");
+
+    executor
+        .app
+        .catalog()
+        .create_authorization_required_source_with_catalog(
+            CreateSource {
+                kind: SourceKind::McpHttp,
+                preferred_slug: "must-not-leak".to_owned(),
+                display_name: "Must not leak".to_owned(),
+                description: None,
+                configuration: Map::new(),
+            },
+            &CredentialPayload {
+                schema_version: 1,
+                payload: json!({}),
+            },
+            InitialCatalogSnapshot {
+                artifacts: Vec::new(),
+                tools: Vec::new(),
+            },
+            Vec::new(),
+            AuditContext::system(Some("authorization-required-rollback")),
+        )
+        .await
+        .expect_err("a later write failure should roll back the source insertion");
+    assert_eq!(
+        sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM sources")
+            .fetch_one(executor.app.pool())
+            .await
+            .expect("source count should read after rollback"),
+        source_count
+    );
+    assert_eq!(
+        sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM sources WHERE slug = 'must_not_leak'")
+            .fetch_one(executor.app.pool())
+            .await
+            .expect("rolled-back source should not exist"),
+        0
+    );
+}
+
+#[tokio::test]
+async fn credential_required_health_is_fixed_bounded_and_revision_guarded() {
+    let executor = TestExecutor::new().await;
+    let source = executor
+        .source_with_kind("stdio-needs-credential", SourceKind::McpStdio)
+        .await;
+    let global_before = executor
+        .app
+        .catalog()
+        .global_revision()
+        .await
+        .expect("global revision should read");
+    let already_unknown = executor
+        .app
+        .catalog()
+        .mark_source_credential_required(
+            &source.id,
+            source.revision,
+            AuditContext::system(Some("credential-required-existing")),
+        )
+        .await
+        .expect("an already unknown incomplete source should be an idempotent success");
+    assert_eq!(already_unknown.revision, source.revision);
+    assert_eq!(already_unknown.health_status, SourceHealth::Unknown);
+    assert_eq!(already_unknown.health_error_code, None);
+    assert_eq!(
+        executor
+            .app
+            .catalog()
+            .global_revision()
+            .await
+            .expect("global revision should read"),
+        global_before
+    );
+
+    let errored = executor
+        .app
+        .catalog()
+        .mark_source_error(
+            &source.id,
+            "mcp_start_failed",
+            source.revision,
+            AuditContext::system(None),
+        )
+        .await
+        .expect("source should enter error state");
+    let marked = executor
+        .app
+        .catalog()
+        .mark_source_credential_required(
+            &source.id,
+            errored.revision,
+            AuditContext::system(Some("credential-required")),
+        )
+        .await
+        .expect("credential requirement should restore unknown state without violating schema");
+    assert_eq!(marked.health_status, SourceHealth::Unknown);
+    assert_eq!(marked.health_error_code, None);
+    assert_eq!(marked.revision, errored.revision + 1);
+    assert_eq!(marked.catalog_revision, source.catalog_revision);
+    let global_after_mark = executor
+        .app
+        .catalog()
+        .global_revision()
+        .await
+        .expect("global revision should read");
+    assert_eq!(global_after_mark, global_before + 2);
+    let transition_metadata = sqlx::query_scalar::<_, String>(
+        "SELECT metadata_json FROM audit_events WHERE request_id = 'credential-required'",
+    )
+    .fetch_one(executor.app.pool())
+    .await
+    .expect("credential-required audit should exist");
+    assert_eq!(
+        serde_json::from_str::<Value>(&transition_metadata)
+            .expect("credential-required audit should be JSON"),
+        json!({
+            "healthStatus": "unknown",
+            "errorCode": null,
+            "reasonCode": "credential_required",
+            "globalRevision": global_after_mark,
+        })
+    );
+
+    let retried = executor
+        .app
+        .catalog()
+        .mark_source_credential_required(
+            &source.id,
+            errored.revision,
+            AuditContext::system(Some("credential-required-retry")),
+        )
+        .await
+        .expect("an identical stale retry should be idempotent");
+    assert_eq!(retried.revision, marked.revision);
+    assert_eq!(retried.catalog_revision, marked.catalog_revision);
+    assert_eq!(retried.health_status, marked.health_status);
+    assert_eq!(retried.health_error_code, marked.health_error_code);
+    assert_eq!(
+        executor
+            .app
+            .catalog()
+            .global_revision()
+            .await
+            .expect("global revision should read"),
+        global_after_mark
+    );
+    assert_eq!(
+        sqlx::query_scalar::<_, i64>(
+            "SELECT COUNT(*) FROM audit_events WHERE request_id = 'credential-required-retry'",
+        )
+        .fetch_one(executor.app.pool())
+        .await
+        .expect("retry audit count should read"),
+        0
+    );
+
+    let stale = executor
+        .app
+        .catalog()
+        .mark_source_error(
+            &source.id,
+            "mcp_discovery_failed",
+            source.revision,
+            AuditContext::system(None),
+        )
+        .await
+        .expect_err("stale health transition should fail");
+    assert!(matches!(
+        stale,
+        CatalogError::RevisionConflict {
+            scope: "source",
+            expected,
+            actual,
+        } if expected == source.revision && actual == marked.revision
+    ));
+    let after_stale = executor
+        .app
+        .catalog()
+        .source(&source.id)
+        .await
+        .expect("source should remain");
+    assert_eq!(after_stale.revision, marked.revision);
+    assert_eq!(after_stale.health_status, SourceHealth::Unknown);
+    assert_eq!(after_stale.health_error_code, None);
+}
+
+#[tokio::test]
+async fn source_health_error_codes_reject_unbounded_or_nonstable_values_without_mutation() {
+    let executor = TestExecutor::new().await;
+    let source = executor.source("invalid-health-codes").await;
+    let global_revision = executor
+        .app
+        .catalog()
+        .global_revision()
+        .await
+        .expect("global revision should read");
+    for invalid in [
+        "",
+        "UPSTREAM_FAILED",
+        "upstream-failed",
+        "upstream__failed",
+        "upstream_failed_",
+        "1_upstream_failed",
+        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    ] {
+        let error = executor
+            .app
+            .catalog()
+            .mark_source_error(
+                &source.id,
+                invalid,
+                source.revision,
+                AuditContext::system(None),
+            )
+            .await
+            .expect_err("invalid health code should be rejected");
+        assert!(matches!(
+            error,
+            CatalogError::Validation {
+                code: "invalid_source_health_error_code",
+                ..
+            }
+        ));
+    }
+    let after = executor
+        .app
+        .catalog()
+        .source(&source.id)
+        .await
+        .expect("source should remain");
+    assert_eq!(after.revision, source.revision);
+    assert_eq!(after.health_status, SourceHealth::Unknown);
+    assert_eq!(after.health_error_code, None);
+    assert_eq!(
+        executor
+            .app
+            .catalog()
+            .global_revision()
+            .await
+            .expect("global revision should read"),
+        global_revision
+    );
+}
+
+#[tokio::test]
+async fn credential_replacement_and_catalog_sync_commit_as_one_revision() {
+    let executor = TestExecutor::new().await;
+    let source = executor
+        .source_with_kind("atomic-credential-sync", SourceKind::Openapi)
+        .await;
+    executor
+        .app
+        .catalog()
+        .put_credential(
+            &source.id,
+            &CredentialPayload {
+                schema_version: 1,
+                payload: json!({ "token": "old-secret" }),
+            },
+            None,
+            AuditContext::system(None),
+        )
+        .await
+        .expect("initial credential should persist");
+    let basis = executor
+        .app
+        .catalog()
+        .source(&source.id)
+        .await
+        .expect("source should exist");
+    let credential = executor
+        .app
+        .catalog()
+        .credential(&source.id)
+        .await
+        .expect("credential should read")
+        .expect("credential should exist");
+    executor
+        .app
+        .catalog()
+        .sync_catalog_with_bindings(
+            &source.id,
+            CatalogSnapshot {
+                expected_source_revision: basis.revision,
+                expected_credential_revision: Some(credential.revision),
+                artifacts: Vec::new(),
+                tools: vec![staged("alpha", "Alpha", ToolMode::Enabled)],
+            },
+            vec![openapi_binding("alpha", "GET")],
+            AuditContext::system(None),
+        )
+        .await
+        .expect("initial catalog should sync");
+    let before = executor
+        .app
+        .catalog()
+        .source(&source.id)
+        .await
+        .expect("source should exist");
+    let credential_before = executor
+        .app
+        .catalog()
+        .credential(&source.id)
+        .await
+        .expect("credential should read")
+        .expect("credential should exist");
+    let global_before = executor
+        .app
+        .catalog()
+        .global_revision()
+        .await
+        .expect("global revision should read");
+    let replacement = CredentialPayload {
+        schema_version: 1,
+        payload: json!({ "token": "new-secret" }),
+    };
+    let (stored, sync, current) = executor
+        .app
+        .catalog()
+        .replace_credential_and_sync_catalog(
+            &source.id,
+            &replacement,
+            CatalogSnapshot {
+                expected_source_revision: before.revision,
+                expected_credential_revision: Some(credential_before.revision),
+                artifacts: vec![StagedArtifact {
+                    kind: ArtifactKind::Metadata,
+                    stable_key: "discovery".to_owned(),
+                    content: json!({ "version": 2 }),
+                }],
+                tools: vec![
+                    staged("alpha", "Updated Alpha", ToolMode::Ask),
+                    staged("beta", "Beta", ToolMode::Enabled),
+                ],
+            },
+            vec![
+                openapi_binding("alpha", "POST"),
+                openapi_binding("beta", "GET"),
+            ],
+            AuditContext::system(Some("atomic-credential-sync")),
+        )
+        .await
+        .expect("credential and discovered catalog should commit together");
+    assert_eq!(stored.revision, credential_before.revision + 1);
+    assert_eq!(stored.credential.payload, replacement.payload);
+    assert_eq!(current.revision, before.revision + 1);
+    assert_eq!(current.catalog_revision, before.catalog_revision + 1);
+    assert_eq!(sync.source_revision, current.revision);
+    assert_eq!(sync.catalog_revision, current.catalog_revision);
+    assert_eq!(sync.global_revision, global_before + 1);
+    assert_eq!(current.health_status, SourceHealth::Healthy);
+    assert_eq!(current.health_error_code, None);
+    assert_eq!(sync.active_tool_count, 2);
+    assert_eq!(
+        executor
+            .app
+            .catalog()
+            .credential(&source.id)
+            .await
+            .expect("credential should read")
+            .expect("credential should exist")
+            .credential
+            .payload,
+        replacement.payload
+    );
+    let audit = sqlx::query_scalar::<_, String>(
+        "SELECT group_concat(metadata_json, ' ') FROM audit_events \
+         WHERE request_id = 'atomic-credential-sync'",
+    )
+    .fetch_one(executor.app.pool())
+    .await
+    .expect("atomic audit metadata should read");
+    assert!(!audit.contains("new-secret"));
+}
+
+#[tokio::test]
+async fn atomic_credential_sync_rolls_back_credential_on_late_catalog_failure() {
+    let executor = TestExecutor::new().await;
+    let source = executor.source("atomic-rollback").await;
+    executor
+        .app
+        .catalog()
+        .put_credential(
+            &source.id,
+            &CredentialPayload {
+                schema_version: 1,
+                payload: json!({ "token": "retained" }),
+            },
+            None,
+            AuditContext::system(None),
+        )
+        .await
+        .expect("initial credential should persist");
+    let basis = executor
+        .app
+        .catalog()
+        .source(&source.id)
+        .await
+        .expect("source should exist");
+    executor
+        .sync(
+            &source.id,
+            vec![staged("current", "Current", ToolMode::Enabled)],
+        )
+        .await;
+    sqlx::query(
+        "WITH RECURSIVE sequence(value) AS ( \
+         SELECT 1 UNION ALL SELECT value + 1 FROM sequence WHERE value < 25000) \
+         INSERT INTO tools \
+         (id, source_id, stable_key, local_name, display_name, description, input_schema_json, \
+          typescript_definitions_json, intrinsic_mode, present, revision, created_at, updated_at, \
+          last_seen_at, tombstoned_at) \
+         SELECT printf('atomic-history-%05d', value), ?, printf('atomic-key-%05d', value), \
+                printf('atomic_%05d', value), 'Retained', NULL, '{}', '{}', 'enabled', \
+                0, 0, 1, 1, 1, 1 FROM sequence",
+    )
+    .bind(&source.id)
+    .execute(executor.app.pool())
+    .await
+    .expect("tombstone ceiling fixture should seed");
+    let before = executor
+        .app
+        .catalog()
+        .source(&source.id)
+        .await
+        .expect("source should exist");
+    assert!(before.revision > basis.revision);
+    let credential_before = executor
+        .app
+        .catalog()
+        .credential(&source.id)
+        .await
+        .expect("credential should read")
+        .expect("credential should exist");
+    let global_before = executor
+        .app
+        .catalog()
+        .global_revision()
+        .await
+        .expect("global revision should read");
+    let error = executor
+        .app
+        .catalog()
+        .replace_credential_and_sync_catalog(
+            &source.id,
+            &CredentialPayload {
+                schema_version: 1,
+                payload: json!({ "token": "must-roll-back" }),
+            },
+            CatalogSnapshot {
+                expected_source_revision: before.revision,
+                expected_credential_revision: Some(credential_before.revision),
+                artifacts: vec![StagedArtifact {
+                    kind: ArtifactKind::Metadata,
+                    stable_key: "must-not-commit".to_owned(),
+                    content: json!({ "atomic": true }),
+                }],
+                tools: vec![staged("replacement", "Replacement", ToolMode::Enabled)],
+            },
+            vec![openapi_binding("replacement", "GET")],
+            AuditContext::system(Some("atomic-rollback")),
+        )
+        .await
+        .expect_err("late catalog failure must roll back the credential replacement");
+    assert!(matches!(
+        error,
+        CatalogError::Validation {
+            code: "catalog_too_large",
+            ..
+        }
+    ));
+    let credential_after = executor
+        .app
+        .catalog()
+        .credential(&source.id)
+        .await
+        .expect("credential should read")
+        .expect("credential should exist");
+    assert_eq!(credential_after.revision, credential_before.revision);
+    assert_eq!(
+        credential_after.credential.payload,
+        json!({ "token": "retained" })
+    );
+    let after = executor
+        .app
+        .catalog()
+        .source(&source.id)
+        .await
+        .expect("source should remain");
+    assert_eq!(after.revision, before.revision);
+    assert_eq!(after.catalog_revision, before.catalog_revision);
+    assert_eq!(
+        executor
+            .app
+            .catalog()
+            .global_revision()
+            .await
+            .expect("global revision should read"),
+        global_before
+    );
+    assert_eq!(
+        sqlx::query_scalar::<_, i64>(
+            "SELECT COUNT(*) FROM source_artifacts WHERE source_id = ? AND stable_key = 'must-not-commit'",
+        )
+        .bind(&source.id)
+        .fetch_one(executor.app.pool())
+        .await
+        .expect("artifact count should read"),
+        0
+    );
+    assert_eq!(
+        sqlx::query_scalar::<_, i64>(
+            "SELECT COUNT(*) FROM audit_events WHERE request_id = 'atomic-rollback'",
+        )
+        .fetch_one(executor.app.pool())
+        .await
+        .expect("audit count should read"),
+        0
+    );
+}
+
+#[tokio::test]
+async fn atomic_credential_mutations_are_cas_guarded_and_set_unknown_together() {
+    let executor = TestExecutor::new().await;
+    let source = executor.source("atomic-unknown").await;
+    executor
+        .app
+        .catalog()
+        .put_credential(
+            &source.id,
+            &CredentialPayload {
+                schema_version: 1,
+                payload: json!({ "secrets": ["old"] }),
+            },
+            None,
+            AuditContext::system(None),
+        )
+        .await
+        .expect("initial credential should persist");
+    let healthy = executor
+        .app
+        .catalog()
+        .source(&source.id)
+        .await
+        .expect("source should exist");
+    let credential = executor
+        .app
+        .catalog()
+        .credential(&source.id)
+        .await
+        .expect("credential should read")
+        .expect("credential should exist");
+    let cleared = CredentialPayload {
+        schema_version: 1,
+        payload: json!({ "secrets": [] }),
+    };
+    let first_store = executor.app.catalog().clone();
+    let second_store = executor.app.catalog().clone();
+    let first = first_store.replace_credential_and_mark_unknown(
+        &source.id,
+        &cleared,
+        healthy.revision,
+        credential.revision,
+        AuditContext::system(Some("atomic-unknown-1")),
+    );
+    let second = second_store.replace_credential_and_mark_unknown(
+        &source.id,
+        &cleared,
+        healthy.revision,
+        credential.revision,
+        AuditContext::system(Some("atomic-unknown-2")),
+    );
+    let (first, second) = tokio::join!(first, second);
+    let outcomes = [first, second];
+    assert_eq!(outcomes.iter().filter(|outcome| outcome.is_ok()).count(), 1);
+    assert_eq!(
+        outcomes.iter().filter(|outcome| outcome.is_err()).count(),
+        1
+    );
+    let (stored, unknown) = outcomes
+        .into_iter()
+        .find_map(Result::ok)
+        .expect("one atomic mutation should win");
+    assert_eq!(stored.revision, credential.revision + 1);
+    assert_eq!(stored.credential.payload, cleared.payload);
+    assert_eq!(unknown.revision, healthy.revision + 1);
+    assert_eq!(unknown.health_status, SourceHealth::Unknown);
+    assert_eq!(unknown.health_error_code, None);
+    let persisted = executor
+        .app
+        .catalog()
+        .credential(&source.id)
+        .await
+        .expect("credential should read")
+        .expect("credential should exist");
+    assert_eq!(persisted.revision, stored.revision);
+    assert_eq!(persisted.credential.payload, cleared.payload);
+
+    let deleted = executor
+        .app
+        .catalog()
+        .delete_credential_and_mark_unknown(
+            &source.id,
+            unknown.revision,
+            persisted.revision,
+            AuditContext::system(None),
+        )
+        .await
+        .expect("credential deletion and unknown health should commit together");
+    assert_eq!(deleted.revision, unknown.revision + 1);
+    assert_eq!(deleted.health_status, SourceHealth::Unknown);
+    assert_eq!(deleted.health_error_code, None);
+    assert!(
+        executor
+            .app
+            .catalog()
+            .credential(&source.id)
+            .await
+            .expect("credential read should succeed")
+            .is_none()
+    );
+}
+
+#[tokio::test]
+async fn generic_sync_rejects_unbound_openapi_tools_without_changing_catalog_state() {
+    let executor = TestExecutor::new().await;
+    let source = executor
+        .source_with_kind("bound-openapi", SourceKind::Openapi)
+        .await;
+    executor
+        .app
+        .catalog()
+        .sync_catalog_with_bindings(
+            &source.id,
+            CatalogSnapshot {
+                expected_source_revision: source.revision,
+                expected_credential_revision: None,
+                artifacts: Vec::new(),
+                tools: vec![staged("alpha", "Alpha", ToolMode::Enabled)],
+            },
+            vec![openapi_binding("alpha", "GET")],
+            AuditContext::system(None),
+        )
+        .await
+        .expect("bound OpenAPI catalog should sync");
+
+    let source_before = executor
+        .app
+        .catalog()
+        .source(&source.id)
+        .await
+        .expect("source should exist");
+    let global_revision_before = executor
+        .app
+        .catalog()
+        .global_revision()
+        .await
+        .expect("global revision should read");
+    let tool_before = executor
+        .app
+        .catalog()
+        .list_tools(ListToolsFilter {
+            source_id: Some(source.id.clone()),
+            limit: 10,
+            ..Default::default()
+        })
+        .await
+        .expect("tool should list")
+        .items
+        .remove(0);
+    let binding_before = executor
+        .app
+        .catalog()
+        .tool_binding(&tool_before.id)
+        .await
+        .expect("binding should exist");
+
+    let error = executor
+        .app
+        .catalog()
+        .sync_catalog(
+            &source.id,
+            CatalogSnapshot {
+                expected_source_revision: source_before.revision,
+                expected_credential_revision: None,
+                artifacts: vec![StagedArtifact {
+                    kind: ArtifactKind::OpenapiDocument,
+                    stable_key: "replacement".to_owned(),
+                    content: json!({ "openapi": "3.1.0" }),
+                }],
+                tools: vec![
+                    staged("alpha", "Changed Alpha", ToolMode::Ask),
+                    staged("beta", "Beta", ToolMode::Enabled),
+                ],
+            },
+            AuditContext::system(None),
+        )
+        .await
+        .expect_err("generic sync must not leave active OpenAPI tools unbound");
+    assert!(matches!(
+        error,
+        CatalogError::Validation {
+            code: "incomplete_tool_bindings",
+            ..
+        }
+    ));
+
+    let source_after = executor
+        .app
+        .catalog()
+        .source(&source.id)
+        .await
+        .expect("source should remain");
+    assert_eq!(source_after.revision, source_before.revision);
+    assert_eq!(
+        source_after.catalog_revision,
+        source_before.catalog_revision
+    );
+    assert_eq!(
+        executor
+            .app
+            .catalog()
+            .global_revision()
+            .await
+            .expect("global revision should read"),
+        global_revision_before
+    );
+    let tools_after = executor
+        .app
+        .catalog()
+        .list_tools(ListToolsFilter {
+            source_id: Some(source.id.clone()),
+            limit: 10,
+            ..Default::default()
+        })
+        .await
+        .expect("original tool should list")
+        .items;
+    assert_eq!(tools_after.len(), 1);
+    assert_eq!(tools_after[0].id, tool_before.id);
+    assert_eq!(tools_after[0].revision, tool_before.revision);
+    assert_eq!(tools_after[0].display_name, tool_before.display_name);
+    let binding_after = executor
+        .app
+        .catalog()
+        .tool_binding(&tool_before.id)
+        .await
+        .expect("original binding should remain");
+    assert_eq!(binding_after.binding, binding_before.binding);
+    assert_eq!(
+        sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM source_artifacts WHERE source_id = ?",)
+            .bind(&source.id)
+            .fetch_one(executor.app.pool())
+            .await
+            .expect("artifact count should read"),
+        0
+    );
+}
+
+#[tokio::test]
+async fn non_openapi_sources_reject_openapi_bindings() {
+    let executor = TestExecutor::new().await;
+    let source = executor
+        .source_with_kind("graphql-bindings", SourceKind::Graphql)
+        .await;
+    let current = executor
+        .app
+        .catalog()
+        .source(&source.id)
+        .await
+        .expect("source should exist");
+    let sync_error = executor
+        .app
+        .catalog()
+        .sync_catalog_with_bindings(
+            &source.id,
+            CatalogSnapshot {
+                expected_source_revision: current.revision,
+                expected_credential_revision: None,
+                artifacts: Vec::new(),
+                tools: vec![staged("query", "Query", ToolMode::Enabled)],
+            },
+            vec![openapi_binding("query", "POST")],
+            AuditContext::system(None),
+        )
+        .await
+        .expect_err("GraphQL refresh must reject OpenAPI bindings");
+    assert!(matches!(
+        sync_error,
+        CatalogError::Validation {
+            code: "invalid_source_kind",
+            ..
+        }
+    ));
+
+    let source_after = executor
+        .app
+        .catalog()
+        .source(&source.id)
+        .await
+        .expect("source should remain");
+    assert_eq!(source_after.revision, current.revision);
+    assert_eq!(source_after.catalog_revision, current.catalog_revision);
+    assert_eq!(
+        sqlx::query_scalar::<_, i64>(
+            "SELECT COUNT(*) FROM tool_bindings JOIN tools ON tools.id = tool_bindings.tool_id \
+             WHERE tools.source_id = ?",
+        )
+        .bind(&source.id)
+        .fetch_one(executor.app.pool())
+        .await
+        .expect("binding count should read"),
+        0
+    );
+}
+
+#[tokio::test]
+async fn refresh_rejects_oversized_serialized_schema_payloads_before_writing() {
+    let executor = TestExecutor::new().await;
+    let source = executor.source("payload-limit").await;
+    let mut oversized = staged("large", "Large", ToolMode::Enabled);
+    oversized.input_schema = json!({ "value": "x".repeat(2 * 1024 * 1024) });
+    let error = executor
+        .app
+        .catalog()
+        .sync_catalog(
+            &source.id,
+            CatalogSnapshot {
+                expected_source_revision: source.revision,
+                expected_credential_revision: None,
+                artifacts: Vec::new(),
+                tools: vec![oversized],
+            },
+            AuditContext::system(None),
+        )
+        .await
+        .expect_err("oversized schema must be rejected before refresh");
+    assert!(matches!(
+        error,
+        CatalogError::Validation {
+            code: "schema_too_large",
+            ..
+        }
+    ));
+    assert_eq!(
+        sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM tools WHERE source_id = ?")
+            .bind(&source.id)
+            .fetch_one(executor.app.pool())
+            .await
+            .expect("tool count should read"),
+        0
+    );
+}
+
+#[tokio::test]
+async fn refresh_cas_and_writer_lock_prevent_stale_or_partial_catalogs() {
+    let executor = TestExecutor::new().await;
+    let source = executor.source("refresh-basis").await;
+    executor
+        .app
+        .catalog()
+        .put_credential(
+            &source.id,
+            &CredentialPayload {
+                schema_version: 1,
+                payload: json!({ "token": "first" }),
+            },
+            None,
+            AuditContext::system(None),
+        )
+        .await
+        .expect("credential should store");
+    let first_credential = executor
+        .app
+        .catalog()
+        .credential(&source.id)
+        .await
+        .expect("credential should read")
+        .expect("credential should exist");
+    let basis = executor
+        .app
+        .catalog()
+        .source(&source.id)
+        .await
+        .expect("source should exist");
+    executor
+        .app
+        .catalog()
+        .put_credential(
+            &source.id,
+            &CredentialPayload {
+                schema_version: 1,
+                payload: json!({ "token": "second" }),
+            },
+            Some(first_credential.revision),
+            AuditContext::system(None),
+        )
+        .await
+        .expect("credential should rotate");
+    let current = executor
+        .app
+        .catalog()
+        .source(&source.id)
+        .await
+        .expect("source should exist");
+    let credential = executor
+        .app
+        .catalog()
+        .credential(&source.id)
+        .await
+        .expect("credential should read")
+        .expect("credential should exist");
+    let stale_credential = executor
+        .app
+        .catalog()
+        .sync_catalog_with_bindings(
+            &source.id,
+            CatalogSnapshot {
+                expected_source_revision: current.revision,
+                expected_credential_revision: Some(credential.revision - 1),
+                artifacts: vec![StagedArtifact {
+                    kind: ArtifactKind::OpenapiDocument,
+                    stable_key: "root".to_owned(),
+                    content: json!({ "openapi": "3.1.0" }),
+                }],
+                tools: vec![staged("new", "New", ToolMode::Enabled)],
+            },
+            vec![openapi_binding("new", "GET")],
+            AuditContext::system(None),
+        )
+        .await;
+    assert!(matches!(
+        stale_credential,
+        Err(CatalogError::RevisionConflict {
+            scope: "credential",
+            ..
+        })
+    ));
+    assert_eq!(
+        executor
+            .app
+            .catalog()
+            .source(&source.id)
+            .await
+            .expect("source should exist")
+            .catalog_revision,
+        basis.catalog_revision
+    );
+    assert_eq!(
+        sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM source_artifacts")
+            .fetch_one(executor.app.pool())
+            .await
+            .expect("artifact count should read"),
+        0
+    );
+
+    let current = executor
+        .app
+        .catalog()
+        .source(&source.id)
+        .await
+        .expect("source should exist");
+    let snapshot = CatalogSnapshot {
+        expected_source_revision: current.revision,
+        expected_credential_revision: Some(credential.revision),
+        artifacts: vec![StagedArtifact {
+            kind: ArtifactKind::OpenapiDocument,
+            stable_key: "root".to_owned(),
+            content: json!({ "openapi": "3.1.0" }),
+        }],
+        tools: vec![staged("new", "New", ToolMode::Enabled)],
+    };
+    let first_store = executor.app.catalog().clone();
+    let second_store = executor.app.catalog().clone();
+    let first = first_store.sync_catalog_with_bindings(
+        &source.id,
+        snapshot.clone(),
+        vec![openapi_binding("new", "GET")],
+        AuditContext::system(Some("refresh-race-1")),
+    );
+    let second = second_store.sync_catalog_with_bindings(
+        &source.id,
+        snapshot,
+        vec![openapi_binding("new", "GET")],
+        AuditContext::system(Some("refresh-race-2")),
+    );
+    let (first, second) = tokio::join!(first, second);
+    let outcomes = [first, second];
+    assert_eq!(outcomes.iter().filter(|outcome| outcome.is_ok()).count(), 1);
+    assert_eq!(
+        outcomes
+            .iter()
+            .filter(|outcome| matches!(
+                outcome,
+                Err(CatalogError::RevisionConflict {
+                    scope: "source",
+                    ..
+                })
+            ))
+            .count(),
+        1
+    );
+    assert_eq!(
+        sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM source_artifacts")
+            .fetch_one(executor.app.pool())
+            .await
+            .expect("artifact count should read"),
+        1
+    );
+}
+
+#[tokio::test]
+async fn credential_writes_require_absence_or_the_current_revision() {
+    let executor = TestExecutor::new().await;
+    let source = executor.source("credential-cas").await;
+    executor
+        .app
+        .catalog()
+        .put_credential(
+            &source.id,
+            &CredentialPayload {
+                schema_version: 1,
+                payload: json!({ "token": "first" }),
+            },
+            None,
+            AuditContext::system(Some("credential-create")),
+        )
+        .await
+        .expect("an absent credential should be created");
+    let first = executor
+        .app
+        .catalog()
+        .credential(&source.id)
+        .await
+        .expect("credential should read")
+        .expect("credential should exist");
+    assert_eq!(first.revision, 0);
+
+    let source_after_create = executor
+        .app
+        .catalog()
+        .source(&source.id)
+        .await
+        .expect("source should exist");
+    let global_after_create = executor
+        .app
+        .catalog()
+        .global_revision()
+        .await
+        .expect("global revision should read");
+    let duplicate_create = executor
+        .app
+        .catalog()
+        .put_credential(
+            &source.id,
+            &CredentialPayload {
+                schema_version: 1,
+                payload: json!({ "token": "duplicate" }),
+            },
+            None,
+            AuditContext::system(Some("credential-duplicate")),
+        )
+        .await;
+    assert!(matches!(
+        duplicate_create,
+        Err(CatalogError::RevisionConflict {
+            scope: "credential",
+            expected: -1,
+            actual: 0,
+        })
+    ));
+    assert_eq!(
+        executor
+            .app
+            .catalog()
+            .source(&source.id)
+            .await
+            .expect("source should exist")
+            .revision,
+        source_after_create.revision
+    );
+    assert_eq!(
+        executor
+            .app
+            .catalog()
+            .global_revision()
+            .await
+            .expect("global revision should read"),
+        global_after_create
+    );
+
+    executor
+        .app
+        .catalog()
+        .put_credential(
+            &source.id,
+            &CredentialPayload {
+                schema_version: 1,
+                payload: json!({ "token": "newer" }),
+            },
+            Some(first.revision),
+            AuditContext::system(Some("credential-rotate")),
+        )
+        .await
+        .expect("the current credential revision should rotate");
+    let source_after_rotate = executor
+        .app
+        .catalog()
+        .source(&source.id)
+        .await
+        .expect("source should exist");
+    let global_after_rotate = executor
+        .app
+        .catalog()
+        .global_revision()
+        .await
+        .expect("global revision should read");
+    let audit_after_rotate = sqlx::query_scalar::<_, i64>(
+        "SELECT COUNT(*) FROM audit_events \
+         WHERE action = 'source.credential_changed' AND source_id = ?",
+    )
+    .bind(&source.id)
+    .fetch_one(executor.app.pool())
+    .await
+    .expect("credential audit count should read");
+    assert_eq!(audit_after_rotate, 2);
+
+    let stale_rotate = executor
+        .app
+        .catalog()
+        .put_credential(
+            &source.id,
+            &CredentialPayload {
+                schema_version: 1,
+                payload: json!({ "token": "stale" }),
+            },
+            Some(first.revision),
+            AuditContext::system(Some("credential-stale")),
+        )
+        .await;
+    assert!(matches!(
+        stale_rotate,
+        Err(CatalogError::RevisionConflict {
+            scope: "credential",
+            expected: 0,
+            actual: 1,
+        })
+    ));
+    let stored = executor
+        .app
+        .catalog()
+        .credential(&source.id)
+        .await
+        .expect("credential should read")
+        .expect("credential should exist");
+    assert_eq!(stored.revision, 1);
+    assert_eq!(stored.credential.payload["token"], "newer");
+    assert_eq!(
+        executor
+            .app
+            .catalog()
+            .source(&source.id)
+            .await
+            .expect("source should exist")
+            .revision,
+        source_after_rotate.revision
+    );
+    assert_eq!(
+        executor
+            .app
+            .catalog()
+            .global_revision()
+            .await
+            .expect("global revision should read"),
+        global_after_rotate
+    );
+    assert_eq!(
+        sqlx::query_scalar::<_, i64>(
+            "SELECT COUNT(*) FROM audit_events \
+             WHERE action = 'source.credential_changed' AND source_id = ?",
+        )
+        .bind(&source.id)
+        .fetch_one(executor.app.pool())
+        .await
+        .expect("credential audit count should read"),
+        audit_after_rotate
+    );
+}
+
+#[tokio::test]
+async fn refresh_audits_preserve_correlation_and_explicit_actor() {
+    let executor = TestExecutor::new().await;
+    executor.setup_admin().await;
+    let source = executor.source("refresh-audit").await;
+    executor
+        .app
+        .catalog()
+        .sync_catalog_with_bindings(
+            &source.id,
+            CatalogSnapshot {
+                expected_source_revision: source.revision,
+                expected_credential_revision: None,
+                artifacts: Vec::new(),
+                tools: vec![staged("run", "Run", ToolMode::Enabled)],
+            },
+            vec![openapi_binding("run", "GET")],
+            AuditContext::system(Some("refresh-job-1")),
+        )
+        .await
+        .expect("background refresh should commit");
+    let system_audit = sqlx::query_as::<_, (Option<String>, Option<i64>)>(
+        "SELECT request_id, actor_admin_id FROM audit_events \
+         WHERE action = 'source.catalog_refreshed' AND request_id = 'refresh-job-1'",
+    )
+    .fetch_one(executor.app.pool())
+    .await
+    .expect("system refresh audit should exist");
+    assert_eq!(system_audit, (Some("refresh-job-1".to_owned()), None));
+
+    let current = executor
+        .app
+        .catalog()
+        .source(&source.id)
+        .await
+        .expect("source should exist");
+    executor
+        .app
+        .catalog()
+        .sync_catalog_with_bindings(
+            &source.id,
+            CatalogSnapshot {
+                expected_source_revision: current.revision,
+                expected_credential_revision: None,
+                artifacts: Vec::new(),
+                tools: vec![staged("run", "Run", ToolMode::Enabled)],
+            },
+            vec![openapi_binding("run", "GET")],
+            AuditContext::admin("admin-request-1", 1),
+        )
+        .await
+        .expect("administrator refresh should commit");
+    let admin_audit = sqlx::query_as::<_, (Option<String>, Option<i64>)>(
+        "SELECT request_id, actor_admin_id FROM audit_events \
+         WHERE action = 'source.catalog_refreshed' AND request_id = 'admin-request-1'",
+    )
+    .fetch_one(executor.app.pool())
+    .await
+    .expect("administrator refresh audit should exist");
+    assert_eq!(admin_audit, (Some("admin-request-1".to_owned()), Some(1)));
+}
+
+#[tokio::test]
+async fn effective_modes_follow_precedence_and_gateway_visibility_rules() {
+    let executor = TestExecutor::new().await;
+    let source = executor.source("modes").await;
+    executor
+        .sync(&source.id, vec![staged("review", "Review", ToolMode::Ask)])
+        .await;
+    let tool = executor
+        .app
+        .catalog()
+        .list_tools(ListToolsFilter {
+            source_id: Some(source.id.clone()),
+            limit: 10,
+            ..Default::default()
+        })
+        .await
+        .expect("tool should list")
+        .items
+        .remove(0);
+    assert_eq!(tool.effective_mode.mode, ToolMode::Ask);
+    assert_eq!(tool.effective_mode.provenance, ModeProvenance::Intrinsic);
+    let discovery = executor
+        .app
+        .catalog()
+        .search_tools("review", None, 10, 0)
+        .await
+        .expect("search should work");
+    assert_eq!(discovery.total, 1);
+    assert!(discovery.items[0].requires_approval);
+    assert_eq!(discovery.items[0].effective_mode, ToolMode::Ask);
+    let ask_lookup = executor
+        .app
+        .catalog()
+        .guard_invocation(&tool.callable_path)
+        .await
+        .expect("Ask tool should remain callable through approval");
+    assert!(ask_lookup.requires_approval);
+
+    let source = executor
+        .app
+        .catalog()
+        .source(&source.id)
+        .await
+        .expect("source should exist");
+    executor
+        .app
+        .catalog()
+        .set_source_mode(
+            &source.id,
+            Some(ToolMode::Disabled),
+            source.revision,
+            AuditContext::system(None),
+        )
+        .await
+        .expect("source override should update");
+    let disabled = executor
+        .app
+        .catalog()
+        .tool(&tool.id)
+        .await
+        .expect("admin catalog should retain disabled tool");
+    assert_eq!(disabled.effective_mode.mode, ToolMode::Disabled);
+    assert_eq!(
+        disabled.effective_mode.provenance,
+        ModeProvenance::SourceOverride
+    );
+    assert_eq!(
+        executor
+            .app
+            .catalog()
+            .search_tools("review", None, 10, 0)
+            .await
+            .expect("search should work")
+            .total,
+        0
+    );
+    assert!(matches!(
+        executor
+            .app
+            .catalog()
+            .describe_tool(&tool.sandbox_path)
+            .await,
+        Err(CatalogError::ToolNotFound { .. })
+    ));
+    assert!(matches!(
+        executor
+            .app
+            .catalog()
+            .guard_invocation(&tool.sandbox_path)
+            .await,
+        Err(CatalogError::ToolDisabled { .. })
+    ));
+
+    let override_enabled = executor
+        .app
+        .catalog()
+        .set_tool_mode(
+            &tool.id,
+            Some(ToolMode::Enabled),
+            disabled.revision,
+            AuditContext::system(None),
+        )
+        .await
+        .expect("tool override should update");
+    assert_eq!(override_enabled.effective_mode.mode, ToolMode::Enabled);
+    assert_eq!(
+        override_enabled.effective_mode.provenance,
+        ModeProvenance::ToolOverride
+    );
+    let reset = executor
+        .app
+        .catalog()
+        .set_tool_mode(
+            &tool.id,
+            None,
+            override_enabled.revision,
+            AuditContext::system(None),
+        )
+        .await
+        .expect("tool override should reset");
+    assert_eq!(reset.effective_mode.mode, ToolMode::Disabled);
+}
+
+#[tokio::test]
+async fn lexical_search_ranks_filters_and_paginates_like_the_typescript_runtime() {
+    let executor = TestExecutor::new().await;
+    let github = executor.source("github").await;
+    let stripe = executor.source("stripe").await;
+    let go = executor.source("go").await;
+    executor
+        .sync(
+            &github.id,
+            vec![
+                staged("create-issue", "createIssue", ToolMode::Ask),
+                staged("list-issues", "listIssues", ToolMode::Enabled),
+            ],
+        )
+        .await;
+    executor
+        .sync(&go.id, vec![staged("ping", "ping", ToolMode::Enabled)])
+        .await;
+    let mut camel_description = staged("customer-ledger", "archive", ToolMode::Enabled);
+    camel_description.description = Some("CustomerLedger workflow".to_owned());
+    executor
+        .sync(
+            &stripe.id,
+            vec![
+                staged("create-invoice", "createInvoice", ToolMode::Enabled),
+                camel_description,
+            ],
+        )
+        .await;
+
+    let exact = executor
+        .app
+        .catalog()
+        .search_tools("create issue", None, 10, 0)
+        .await
+        .expect("search should work");
+    assert_eq!(exact.total, 1);
+    assert_eq!(exact.items[0].path, "github.create_issue");
+
+    let first_page = executor
+        .app
+        .catalog()
+        .search_tools("create", None, 1, 0)
+        .await
+        .expect("search should work");
+    assert_eq!(first_page.total, 2);
+    assert!(first_page.has_more);
+    assert_eq!(first_page.next_offset, Some(1));
+    let second_page = executor
+        .app
+        .catalog()
+        .search_tools("create", None, 1, 1)
+        .await
+        .expect("search should work");
+    assert_eq!(second_page.items.len(), 1);
+    assert!(!second_page.has_more);
+    assert_ne!(first_page.items[0].path, second_page.items[0].path);
+
+    let github_only = executor
+        .app
+        .catalog()
+        .search_tools("create", Some("github"), 10, 0)
+        .await
+        .expect("namespace search should work");
+    assert_eq!(github_only.total, 1);
+    assert_eq!(github_only.items[0].integration, "github");
+    let camel_description = executor
+        .app
+        .catalog()
+        .search_tools("ledger", None, 10, 0)
+        .await
+        .expect("normalized description search should work");
+    assert_eq!(camel_description.total, 1);
+    assert_eq!(camel_description.items[0].path, "stripe.archive");
+    for query in ["hub", "githubs", "it"] {
+        let legacy_match = executor
+            .app
+            .catalog()
+            .search_tools(query, None, 10, 0)
+            .await
+            .expect("legacy substring and reverse-prefix search should work");
+        assert!(
+            legacy_match
+                .items
+                .iter()
+                .any(|item| item.integration == "github"),
+            "{query} should reach the indexed github candidate"
+        );
+    }
+    let short_reverse_prefix = executor
+        .app
+        .catalog()
+        .search_tools("google", None, 10, 0)
+        .await
+        .expect("short reverse-prefix search should work");
+    assert!(
+        short_reverse_prefix
+            .items
+            .iter()
+            .any(|item| item.integration == "go")
+    );
+    let empty = executor
+        .app
+        .catalog()
+        .search_tools("---", None, 10, 0)
+        .await
+        .expect("punctuation search should be empty");
+    assert_eq!(empty.total, 0);
+}
+
+#[tokio::test]
+async fn gateway_search_rejects_unbounded_direct_store_queries_before_index_work() {
+    let executor = TestExecutor::new().await;
+    let excessive_bytes = "token ".repeat(100_000);
+    for (query, namespace) in [
+        (excessive_bytes.as_str(), None),
+        (&"x".repeat(257), None),
+        (&"x ".repeat(65), None),
+        ("safe", Some(excessive_bytes.as_str())),
+    ] {
+        assert!(matches!(
+            executor
+                .app
+                .catalog()
+                .search_tools(query, namespace, 10, 0)
+                .await,
+            Err(CatalogError::Validation {
+                code: "invalid_search_query",
+                ..
+            })
+        ));
+    }
+}
+
+#[tokio::test]
+async fn gateway_search_bounds_candidates_and_filters_historical_rows_before_ranking() {
+    let executor = TestExecutor::new().await;
+    let source = executor.source("search-scale").await;
+    executor
+        .sync(
+            &source.id,
+            vec![staged("active", "Needle", ToolMode::Enabled)],
+        )
+        .await;
+
+    sqlx::query(
+        "WITH RECURSIVE sequence(value) AS ( \
+         SELECT 1 UNION ALL SELECT value + 1 FROM sequence WHERE value < 10000) \
+         INSERT INTO tools \
+         (id, source_id, stable_key, local_name, display_name, description, input_schema_json, \
+          typescript_definitions_json, intrinsic_mode, present, revision, created_at, updated_at, \
+          last_seen_at, tombstoned_at) \
+         SELECT printf('historical-%05d', value), ?, printf('historical-key-%05d', value), \
+                printf('needle_historical_%05d', value), 'Historical Needle', \
+                'needle historical entry', '{}', '{}', \
+                CASE WHEN value <= 5000 THEN 'enabled' ELSE 'disabled' END, \
+                CASE WHEN value <= 5000 THEN 0 ELSE 1 END, 0, 1, 1, 1, \
+                CASE WHEN value <= 5000 THEN 1 ELSE NULL END \
+         FROM sequence",
+    )
+    .bind(&source.id)
+    .execute(executor.app.pool())
+    .await
+    .expect("large tombstone history should seed");
+    sqlx::query(
+        "INSERT INTO tool_search \
+         (source_id, tool_id, source_slug, local_name, description, sandbox_path) \
+         SELECT tools.source_id, tools.id, replace(sources.slug, '_', ' '), \
+                replace(tools.local_name, '_', ' '), tools.description, \
+                replace(sources.slug, '_', ' ') || ' ' || replace(tools.local_name, '_', ' ') \
+         FROM tools JOIN sources ON sources.id = tools.source_id \
+         WHERE tools.source_id = ? AND tools.id LIKE 'historical-%'",
+    )
+    .bind(&source.id)
+    .execute(executor.app.pool())
+    .await
+    .expect("historical search entries should seed");
+
+    let historical = executor
+        .app
+        .catalog()
+        .search_tools("needle", None, 10, 0)
+        .await
+        .expect("search should ignore historical candidates in SQL");
+    assert_eq!(historical.total, 1);
+    assert_eq!(historical.items[0].path, "search_scale.needle");
+
+    sqlx::query(
+        "WITH RECURSIVE sequence(value) AS ( \
+         SELECT 1 UNION ALL SELECT value + 1 FROM sequence WHERE value < 5000) \
+         INSERT INTO tools \
+         (id, source_id, stable_key, local_name, display_name, description, input_schema_json, \
+          typescript_definitions_json, intrinsic_mode, present, revision, created_at, updated_at, \
+          last_seen_at, tombstoned_at) \
+         SELECT printf('bounded-%05d', value), ?, printf('bounded-key-%05d', value), \
+                printf('common_%05d', value), 'Common', 'common candidate', '{}', '{}', \
+                'enabled', 1, 0, 1, 1, 1, NULL FROM sequence",
+    )
+    .bind(&source.id)
+    .execute(executor.app.pool())
+    .await
+    .expect("large active catalog should seed");
+    sqlx::query(
+        "INSERT INTO tool_search \
+         (source_id, tool_id, source_slug, local_name, description, sandbox_path) \
+         SELECT tools.source_id, tools.id, replace(sources.slug, '_', ' '), \
+                replace(tools.local_name, '_', ' '), tools.description, \
+                replace(sources.slug, '_', ' ') || ' ' || replace(tools.local_name, '_', ' ') \
+         FROM tools JOIN sources ON sources.id = tools.source_id \
+         WHERE tools.source_id = ? AND tools.id LIKE 'bounded-%'",
+    )
+    .bind(&source.id)
+    .execute(executor.app.pool())
+    .await
+    .expect("active search entries should seed");
+    let bounded = executor
+        .app
+        .catalog()
+        .search_tools("common", None, 10, 0)
+        .await
+        .expect("large search should remain bounded");
+    assert_eq!(bounded.items.len(), 10);
+    assert_eq!(bounded.total, 4096);
+    assert!(bounded.has_more);
+    assert_eq!(
+        sqlx::query_scalar::<_, i64>(
+            "SELECT COUNT(*) FROM tools WHERE source_id = ? AND present = 1 \
+             AND description = 'common candidate'",
+        )
+        .bind(&source.id)
+        .fetch_one(executor.app.pool())
+        .await
+        .expect("active candidate count should read"),
+        5000
+    );
+}
+
+#[tokio::test]
+async fn admin_tool_listing_filters_counts_and_pages_in_sql() {
+    let executor = TestExecutor::new().await;
+    let alpha = executor.source("alpha-list").await;
+    let beta = executor.source("beta-list").await;
+    executor
+        .sync(
+            &alpha.id,
+            vec![
+                staged("keep", "Alpha Search", ToolMode::Enabled),
+                staged("gone", "Archived Match", ToolMode::Enabled),
+                staged("ask", "Review Match", ToolMode::Ask),
+            ],
+        )
+        .await;
+    executor
+        .sync(
+            &beta.id,
+            vec![staged("other", "Alpha Other", ToolMode::Enabled)],
+        )
+        .await;
+    executor
+        .sync(
+            &alpha.id,
+            vec![
+                staged("keep", "Alpha Search", ToolMode::Enabled),
+                staged("ask", "Review Match", ToolMode::Ask),
+            ],
+        )
+        .await;
+
+    let active = executor
+        .app
+        .catalog()
+        .list_tools(ListToolsFilter {
+            limit: 100,
+            ..Default::default()
+        })
+        .await
+        .expect("active tools should list");
+    assert_eq!(active.total, 3);
+    assert!(active.items.iter().all(|tool| tool.present));
+
+    let source_query = executor
+        .app
+        .catalog()
+        .list_tools(ListToolsFilter {
+            query: Some("match".to_owned()),
+            source_id: Some(alpha.id.clone()),
+            limit: 100,
+            ..Default::default()
+        })
+        .await
+        .expect("source and query filters should compose");
+    assert_eq!(source_query.total, 1);
+    assert_eq!(source_query.items[0].stable_key, "ask");
+
+    let with_tombstones = executor
+        .app
+        .catalog()
+        .list_tools(ListToolsFilter {
+            query: Some("match".to_owned()),
+            source_id: Some(alpha.id.clone()),
+            include_tombstoned: true,
+            limit: 100,
+            ..Default::default()
+        })
+        .await
+        .expect("tombstones should be included on request");
+    assert_eq!(with_tombstones.total, 2);
+    assert_eq!(
+        with_tombstones
+            .items
+            .iter()
+            .filter(|tool| !tool.present)
+            .count(),
+        1
+    );
+
+    let ask_only = executor
+        .app
+        .catalog()
+        .list_tools(ListToolsFilter {
+            source_id: Some(alpha.id),
+            effective_mode: Some(ToolMode::Ask),
+            include_tombstoned: true,
+            limit: 100,
+            ..Default::default()
+        })
+        .await
+        .expect("effective mode should filter in SQL");
+    assert_eq!(ask_only.total, 1);
+    assert_eq!(ask_only.items[0].stable_key, "ask");
+
+    let first_page = executor
+        .app
+        .catalog()
+        .list_tools(ListToolsFilter {
+            include_tombstoned: true,
+            limit: 2,
+            offset: 0,
+            ..Default::default()
+        })
+        .await
+        .expect("first page should list");
+    let second_page = executor
+        .app
+        .catalog()
+        .list_tools(ListToolsFilter {
+            include_tombstoned: true,
+            limit: 2,
+            offset: 2,
+            ..Default::default()
+        })
+        .await
+        .expect("second page should list");
+    assert_eq!(first_page.total, 4);
+    assert_eq!(second_page.total, 4);
+    assert!(first_page.has_more);
+    assert_eq!(first_page.next_offset, Some(2));
+    assert!(!second_page.has_more);
+    let mut combined_paths = first_page
+        .items
+        .iter()
+        .chain(&second_page.items)
+        .map(|tool| tool.callable_path.clone())
+        .collect::<Vec<_>>();
+    let original_paths = combined_paths.clone();
+    combined_paths.sort();
+    assert_eq!(original_paths, combined_paths);
+    combined_paths.dedup();
+    assert_eq!(combined_paths.len(), 4);
+}
+
+#[tokio::test]
+async fn catalog_churn_rejects_tombstone_history_overflow_atomically() {
+    let executor = TestExecutor::new().await;
+    let source = executor.source("history-ceiling").await;
+    executor
+        .sync(
+            &source.id,
+            vec![staged("current", "Current", ToolMode::Enabled)],
+        )
+        .await;
+    sqlx::query(
+        "WITH RECURSIVE sequence(value) AS ( \
+         SELECT 1 UNION ALL SELECT value + 1 FROM sequence WHERE value < 25000) \
+         INSERT INTO tools \
+         (id, source_id, stable_key, local_name, display_name, description, input_schema_json, \
+          typescript_definitions_json, intrinsic_mode, present, revision, created_at, updated_at, \
+          last_seen_at, tombstoned_at) \
+         SELECT printf('retained-history-%05d', value), ?, printf('retained-key-%05d', value), \
+                printf('retained_%05d', value), 'Retained', NULL, '{}', '{}', 'enabled', \
+                0, 0, 1, 1, 1, 1 FROM sequence",
+    )
+    .bind(&source.id)
+    .execute(executor.app.pool())
+    .await
+    .expect("tombstone ceiling fixture should seed");
+    let before = executor
+        .app
+        .catalog()
+        .source(&source.id)
+        .await
+        .expect("source should exist");
+    let error = executor
+        .app
+        .catalog()
+        .sync_catalog_with_bindings(
+            &source.id,
+            CatalogSnapshot {
+                expected_source_revision: before.revision,
+                expected_credential_revision: None,
+                artifacts: vec![StagedArtifact {
+                    kind: ArtifactKind::Metadata,
+                    stable_key: "must-not-write".to_owned(),
+                    content: json!({ "atomic": true }),
+                }],
+                tools: vec![staged("new-key", "New Tool", ToolMode::Enabled)],
+            },
+            vec![openapi_binding("new-key", "GET")],
+            AuditContext::system(None),
+        )
+        .await
+        .expect_err("churn beyond retained tombstone ceiling must fail");
+    assert!(matches!(
+        error,
+        CatalogError::Validation {
+            code: "catalog_too_large",
+            ..
+        }
+    ));
+    let after = executor
+        .app
+        .catalog()
+        .source(&source.id)
+        .await
+        .expect("source should remain");
+    assert_eq!(after.revision, before.revision);
+    assert_eq!(after.catalog_revision, before.catalog_revision);
+    assert_eq!(
+        sqlx::query_scalar::<_, i64>(
+            "SELECT COUNT(*) FROM tools WHERE source_id = ? AND stable_key = 'current' \
+             AND present = 1",
+        )
+        .bind(&source.id)
+        .fetch_one(executor.app.pool())
+        .await
+        .expect("current tool state should read"),
+        1
+    );
+    assert_eq!(
+        sqlx::query_scalar::<_, i64>(
+            "SELECT COUNT(*) FROM tools WHERE source_id = ? AND stable_key = 'new-key'",
+        )
+        .bind(&source.id)
+        .fetch_one(executor.app.pool())
+        .await
+        .expect("new tool state should read"),
+        0
+    );
+    assert_eq!(
+        sqlx::query_scalar::<_, i64>(
+            "SELECT COUNT(*) FROM source_artifacts WHERE source_id = ? \
+             AND stable_key = 'must-not-write'",
+        )
+        .bind(&source.id)
+        .fetch_one(executor.app.pool())
+        .await
+        .expect("artifact state should read"),
+        0
+    );
+}
+
+#[tokio::test]
+async fn optimistic_and_bulk_mode_changes_are_atomic() {
+    let executor = TestExecutor::new().await;
+    let source = executor.source("bulk").await;
+    executor
+        .sync(
+            &source.id,
+            vec![
+                staged("one", "One", ToolMode::Enabled),
+                staged("two", "Two", ToolMode::Enabled),
+            ],
+        )
+        .await;
+    let tools = executor
+        .app
+        .catalog()
+        .list_tools(ListToolsFilter {
+            source_id: Some(source.id.clone()),
+            limit: 10,
+            ..Default::default()
+        })
+        .await
+        .expect("tools should list")
+        .items;
+    let first = &tools[0];
+    executor
+        .app
+        .catalog()
+        .set_tool_mode(
+            &first.id,
+            Some(ToolMode::Ask),
+            first.revision,
+            AuditContext::system(None),
+        )
+        .await
+        .expect("first optimistic update should work");
+    assert!(matches!(
+        executor
+            .app
+            .catalog()
+            .set_tool_mode(
+                &first.id,
+                Some(ToolMode::Disabled),
+                first.revision,
+                AuditContext::system(None),
+            )
+            .await,
+        Err(CatalogError::RevisionConflict { scope: "tool", .. })
+    ));
+
+    let global_revision = executor
+        .app
+        .catalog()
+        .global_revision()
+        .await
+        .expect("revision should read");
+    let invalid_bulk = executor
+        .app
+        .catalog()
+        .bulk_set_tool_modes(
+            &[tools[1].id.clone(), "missing".to_owned()],
+            Some(ToolMode::Disabled),
+            global_revision,
+            AuditContext::system(None),
+        )
+        .await;
+    assert!(matches!(
+        invalid_bulk,
+        Err(CatalogError::NotFound { entity: "tool" })
+    ));
+    assert_eq!(
+        executor
+            .app
+            .catalog()
+            .tool(&tools[1].id)
+            .await
+            .expect("tool should remain")
+            .mode_override,
+        None
+    );
+
+    let result = executor
+        .app
+        .catalog()
+        .bulk_set_tool_modes(
+            &tools.iter().map(|tool| tool.id.clone()).collect::<Vec<_>>(),
+            Some(ToolMode::Disabled),
+            global_revision,
+            AuditContext::system(Some("explicit-bulk-audit")),
+        )
+        .await
+        .expect("valid bulk update should commit");
+    assert_eq!(result.updated_count, 2);
+    let audit_metadata = sqlx::query_scalar::<_, String>(
+        "SELECT metadata_json FROM audit_events \
+         WHERE request_id = 'explicit-bulk-audit' AND action = 'tool.mode_bulk_changed'",
+    )
+    .fetch_one(executor.app.pool())
+    .await
+    .expect("explicit bulk audit metadata should exist");
+    let audit_metadata: Value =
+        serde_json::from_str(&audit_metadata).expect("audit metadata should be valid JSON");
+    let mut expected_selection = tools
+        .iter()
+        .map(|tool| {
+            json!({
+                "toolId": tool.id,
+                "path": tool.callable_path
+            })
+        })
+        .collect::<Vec<_>>();
+    expected_selection
+        .sort_by(|left, right| left["toolId"].as_str().cmp(&right["toolId"].as_str()));
+    assert_eq!(
+        audit_metadata["selectedTools"],
+        Value::Array(expected_selection)
+    );
+    for tool in &tools {
+        assert_eq!(
+            executor
+                .app
+                .catalog()
+                .tool(&tool.id)
+                .await
+                .expect("tool should exist")
+                .mode_override,
+            Some(ToolMode::Disabled)
+        );
+    }
+
+    let stale_source = executor
+        .app
+        .catalog()
+        .source(&source.id)
+        .await
+        .expect("source should exist");
+    assert!(matches!(
+        executor
+            .app
+            .catalog()
+            .bulk_set_source_tool_modes(
+                &source.id,
+                Some(ToolMode::Enabled),
+                stale_source.revision - 1,
+                AuditContext::system(None),
+            )
+            .await,
+        Err(CatalogError::RevisionConflict {
+            scope: "source",
+            ..
+        })
+    ));
+}
+
+#[tokio::test]
+async fn catalog_writes_wait_for_non_catalog_writers_without_busy_snapshots() {
+    let executor = TestExecutor::new().await;
+    let source = executor.source("writer-race").await;
+    let mut outside_write = executor
+        .app
+        .pool()
+        .begin_with("BEGIN IMMEDIATE")
+        .await
+        .expect("outside writer should reserve SQLite");
+    sqlx::query(
+        "INSERT INTO request_logs \
+         (request_id, surface, path_snapshot, outcome, duration_ms, created_at) \
+         VALUES ('blocking-write', 'gateway', 'tools.search', 'succeeded', 1, 1)",
+    )
+    .execute(&mut *outside_write)
+    .await
+    .expect("outside writer should hold an uncommitted write");
+
+    let catalog = executor.app.catalog().clone();
+    let source_id = source.id.clone();
+    let update = tokio::spawn(async move {
+        catalog
+            .set_source_mode(
+                &source_id,
+                Some(ToolMode::Ask),
+                source.revision,
+                AuditContext::system(None),
+            )
+            .await
+    });
+    tokio::task::yield_now().await;
+    assert!(!update.is_finished());
+    outside_write
+        .commit()
+        .await
+        .expect("outside writer should commit");
+    let updated = tokio::time::timeout(std::time::Duration::from_secs(2), update)
+        .await
+        .expect("catalog writer should resume before the busy timeout")
+        .expect("catalog writer task should not panic")
+        .expect("catalog writer should succeed");
+    assert_eq!(updated.mode_override, Some(ToolMode::Ask));
+}
+
+#[tokio::test]
+async fn credentials_are_encrypted_bound_to_the_source_and_never_logged() {
+    let executor = TestExecutor::new().await;
+    let first = executor.source("credential-one").await;
+    let second = executor.source("credential-two").await;
+    let secret = "catalog-super-secret-value";
+    executor
+        .app
+        .catalog()
+        .put_credential(
+            &first.id,
+            &CredentialPayload {
+                schema_version: 1,
+                payload: json!({ "token": secret, "header": "Authorization" }),
+            },
+            None,
+            AuditContext::system(None),
+        )
+        .await
+        .expect("credential should be stored");
+    let stored = executor
+        .app
+        .catalog()
+        .credential(&first.id)
+        .await
+        .expect("credential should decrypt")
+        .expect("credential should exist");
+    assert_eq!(stored.credential.payload["token"], secret);
+
+    let ciphertext = sqlx::query_scalar::<_, Vec<u8>>(
+        "SELECT payload_ciphertext FROM source_credentials WHERE source_id = ?",
+    )
+    .bind(&first.id)
+    .fetch_one(executor.app.pool())
+    .await
+    .expect("ciphertext should exist");
+    assert!(!String::from_utf8_lossy(&ciphertext).contains(secret));
+    sqlx::query(
+        "INSERT INTO source_credentials \
+         (source_id, schema_version, payload_ciphertext, revision, created_at, updated_at) \
+         VALUES (?, 1, ?, 0, 1, 1)",
+    )
+    .bind(&second.id)
+    .bind(ciphertext)
+    .execute(executor.app.pool())
+    .await
+    .expect("test should copy ciphertext to another record");
+    assert!(matches!(
+        executor.app.catalog().credential(&second.id).await,
+        Err(CatalogError::Crypto(_))
+    ));
+
+    let database_bytes = fs::read(executor.directory.path().join("executor.db"))
+        .expect("database should be readable");
+    assert!(!String::from_utf8_lossy(&database_bytes).contains(secret));
+    let leaked_logs = sqlx::query_scalar::<_, i64>(
+        "SELECT COUNT(*) FROM request_logs WHERE path_snapshot LIKE '%' || ? || '%' \
+         OR error_code LIKE '%' || ? || '%'",
+    )
+    .bind(secret)
+    .bind(secret)
+    .fetch_one(executor.app.pool())
+    .await
+    .expect("logs should be queryable");
+    assert_eq!(leaked_logs, 0);
+}
+
+#[tokio::test]
+async fn request_logs_are_redacted_paginated_and_survive_catalog_deletion() {
+    let executor = TestExecutor::new().await;
+    let source = executor.source("history").await;
+    executor
+        .sync(&source.id, vec![staged("run", "Run", ToolMode::Enabled)])
+        .await;
+    let tool = executor
+        .app
+        .catalog()
+        .list_tools(ListToolsFilter {
+            source_id: Some(source.id.clone()),
+            limit: 10,
+            ..Default::default()
+        })
+        .await
+        .expect("tools should list")
+        .items
+        .remove(0);
+    executor
+        .app
+        .catalog()
+        .record_request(NewRequestLog {
+            request_id: "request-2".to_owned(),
+            actor_api_token_id: None,
+            surface: RequestSurface::Gateway,
+            source_id: Some(source.id.clone()),
+            tool_id: Some(tool.id.clone()),
+            path_snapshot: Some(tool.callable_path.clone()),
+            outcome: RequestOutcome::Failed,
+            error_code: Some("upstream_unavailable".to_owned()),
+            duration_ms: 12,
+            approval_id: None,
+            created_at: 2,
+        })
+        .await
+        .expect("log should store");
+    executor
+        .app
+        .catalog()
+        .record_request(NewRequestLog {
+            request_id: "request-1".to_owned(),
+            actor_api_token_id: None,
+            surface: RequestSurface::Gateway,
+            source_id: None,
+            tool_id: None,
+            path_snapshot: Some("tools.search".to_owned()),
+            outcome: RequestOutcome::Succeeded,
+            error_code: None,
+            duration_ms: 1,
+            approval_id: None,
+            created_at: 1,
+        })
+        .await
+        .expect("second log should store");
+    let first_page = executor
+        .app
+        .catalog()
+        .list_request_logs(None, 1)
+        .await
+        .expect("logs should list");
+    assert_eq!(first_page.items[0].request_id, "request-2");
+    let second_page = executor
+        .app
+        .catalog()
+        .list_request_logs(first_page.next_cursor.as_deref(), 1)
+        .await
+        .expect("cursor should continue");
+    assert_eq!(second_page.items[0].request_id, "request-1");
+
+    let columns = sqlx::query_as::<_, (i64, String, String, i64, Option<String>, i64)>(
+        "PRAGMA table_info(request_logs)",
+    )
+    .fetch_all(executor.app.pool())
+    .await
+    .expect("log columns should be readable")
+    .into_iter()
+    .map(|row| row.1)
+    .collect::<Vec<_>>();
+    for forbidden in ["headers", "credentials", "arguments", "results", "body"] {
+        assert!(!columns.iter().any(|column| column.contains(forbidden)));
+    }
+
+    executor
+        .app
+        .catalog()
+        .delete_source(&source.id, AuditContext::system(None))
+        .await
+        .expect("source should delete");
+    let retained = executor
+        .app
+        .catalog()
+        .request_log("request-2")
+        .await
+        .expect("history should survive");
+    assert_eq!(retained.source_id, None);
+    assert_eq!(retained.tool_id, None);
+    assert_eq!(
+        retained.path_snapshot.as_deref(),
+        Some(tool.callable_path.as_str())
+    );
+    let audit_count = sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM audit_events")
+        .fetch_one(executor.app.pool())
+        .await
+        .expect("audit count should read");
+    assert!(audit_count > 0);
+    let audit_without_snapshot = sqlx::query_scalar::<_, i64>(
+        "SELECT COUNT(*) FROM audit_events \
+         WHERE action LIKE 'source.%' AND target_path_snapshot IS NULL",
+    )
+    .fetch_one(executor.app.pool())
+    .await
+    .expect("source audit snapshots should be queryable");
+    assert_eq!(audit_without_snapshot, 0);
+
+    executor
+        .app
+        .catalog()
+        .record_request(NewRequestLog {
+            request_id: "late-request".to_owned(),
+            actor_api_token_id: None,
+            surface: RequestSurface::Gateway,
+            source_id: Some(source.id),
+            tool_id: Some(tool.id),
+            path_snapshot: Some(tool.callable_path),
+            outcome: RequestOutcome::Succeeded,
+            error_code: None,
+            duration_ms: 2,
+            approval_id: None,
+            created_at: 3,
+        })
+        .await
+        .expect("late logs should null stale foreign keys");
+    let late = executor
+        .app
+        .catalog()
+        .request_log("late-request")
+        .await
+        .expect("late log should exist");
+    assert_eq!(late.source_id, None);
+    assert_eq!(late.tool_id, None);
+}
+
+#[tokio::test]
+async fn request_logs_prune_atomically_and_apply_bounded_writer_backpressure() {
+    let executor = TestExecutor::new().await;
+    sqlx::query(
+        "WITH RECURSIVE sequence(value) AS ( \
+         SELECT 1 UNION ALL SELECT value + 1 FROM sequence WHERE value < 10000) \
+         INSERT INTO request_logs \
+         (request_id, surface, path_snapshot, outcome, duration_ms, created_at) \
+         SELECT printf('retained-%05d', value), 'gateway', 'tools.search', \
+                'succeeded', 1, value FROM sequence",
+    )
+    .execute(executor.app.pool())
+    .await
+    .expect("retention boundary should seed");
+    executor
+        .app
+        .catalog()
+        .record_request(NewRequestLog {
+            request_id: "newest-retained".to_owned(),
+            actor_api_token_id: None,
+            surface: RequestSurface::Gateway,
+            source_id: None,
+            tool_id: None,
+            path_snapshot: Some("tools.search".to_owned()),
+            outcome: RequestOutcome::Succeeded,
+            error_code: None,
+            duration_ms: 1,
+            approval_id: None,
+            created_at: 10001,
+        })
+        .await
+        .expect("insert and retention prune should commit together");
+    assert_eq!(
+        sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM request_logs")
+            .fetch_one(executor.app.pool())
+            .await
+            .expect("retained count should read"),
+        10000
+    );
+    assert_eq!(
+        sqlx::query_scalar::<_, i64>(
+            "SELECT COUNT(*) FROM request_logs WHERE request_id = 'retained-00001'",
+        )
+        .fetch_one(executor.app.pool())
+        .await
+        .expect("oldest retention state should read"),
+        0
+    );
+    executor
+        .app
+        .catalog()
+        .request_log("newest-retained")
+        .await
+        .expect("new log should survive pruning");
+
+    let outside_writer = executor
+        .app
+        .pool()
+        .begin_with("BEGIN IMMEDIATE")
+        .await
+        .expect("outside writer should reserve SQLite");
+    let blocked_catalog = executor.app.catalog().clone();
+    let blocked = tokio::spawn(async move {
+        blocked_catalog
+            .record_request(NewRequestLog {
+                request_id: "blocked-log".to_owned(),
+                actor_api_token_id: None,
+                surface: RequestSurface::Gateway,
+                source_id: None,
+                tool_id: None,
+                path_snapshot: Some("tools.search".to_owned()),
+                outcome: RequestOutcome::Succeeded,
+                error_code: None,
+                duration_ms: 1,
+                approval_id: None,
+                created_at: 10002,
+            })
+            .await
+    });
+    tokio::time::sleep(std::time::Duration::from_millis(20)).await;
+    let overloaded = executor
+        .app
+        .catalog()
+        .record_request(NewRequestLog {
+            request_id: "overloaded-log".to_owned(),
+            actor_api_token_id: None,
+            surface: RequestSurface::Gateway,
+            source_id: None,
+            tool_id: None,
+            path_snapshot: Some("tools.search".to_owned()),
+            outcome: RequestOutcome::Succeeded,
+            error_code: None,
+            duration_ms: 1,
+            approval_id: None,
+            created_at: 10003,
+        })
+        .await;
+    assert!(matches!(
+        overloaded,
+        Err(CatalogError::Validation {
+            code: "request_log_backpressure",
+            ..
+        })
+    ));
+    assert!(!blocked.is_finished());
+    outside_writer
+        .commit()
+        .await
+        .expect("outside writer should commit");
+    tokio::time::timeout(std::time::Duration::from_secs(2), blocked)
+        .await
+        .expect("the single logger should resume after contention clears")
+        .expect("blocked logger task should not panic")
+        .expect("blocked log should persist after contention clears");
+    executor
+        .app
+        .catalog()
+        .record_request(NewRequestLog {
+            request_id: "after-backpressure".to_owned(),
+            actor_api_token_id: None,
+            surface: RequestSurface::Gateway,
+            source_id: None,
+            tool_id: None,
+            path_snapshot: Some("tools.search".to_owned()),
+            outcome: RequestOutcome::Succeeded,
+            error_code: None,
+            duration_ms: 1,
+            approval_id: None,
+            created_at: 10004,
+        })
+        .await
+        .expect("logger should recover after database contention");
+}
+
+#[tokio::test]
+async fn catalog_state_keeps_missing_boot_sentinels_fail_closed() {
+    let directory = tempfile::tempdir().expect("temporary directory should be created");
+    let config = AppConfig::new(directory.path().to_path_buf());
+    let app = ExecutorApp::open(config.clone())
+        .await
+        .expect("initial open should succeed");
+    app.catalog()
+        .create_source(
+            CreateSource {
+                kind: SourceKind::Graphql,
+                preferred_slug: "state".to_owned(),
+                display_name: "State".to_owned(),
+                description: None,
+                configuration: Map::new(),
+            },
+            AuditContext::system(None),
+        )
+        .await
+        .expect("source should create");
+    sqlx::query("DELETE FROM setup_state")
+        .execute(app.pool())
+        .await
+        .expect("setup state should delete");
+    sqlx::query("DELETE FROM instance_metadata WHERE key = 'boot_sentinel'")
+        .execute(app.pool())
+        .await
+        .expect("sentinel should delete");
+    app.pool().close().await;
+    drop(app);
+    let Err(error) = ExecutorApp::open(config).await else {
+        panic!("catalog state without sentinel must fail closed");
+    };
+    assert!(matches!(error, DatabaseError::MissingBootSentinel));
+}
+
+#[tokio::test]
+async fn catalog_api_preserves_auth_planes_csrf_and_global_token_equivalence() {
+    let executor = TestExecutor::new().await;
+    let source = executor.source("tools").await;
+    assert_eq!(source.slug, "tools_2");
+    executor
+        .sync(&source.id, vec![staged("run", "Run", ToolMode::Enabled)])
+        .await;
+    let tool = executor
+        .app
+        .catalog()
+        .list_tools(ListToolsFilter {
+            source_id: Some(source.id.clone()),
+            limit: 10,
+            ..Default::default()
+        })
+        .await
+        .expect("tool should list")
+        .items
+        .remove(0);
+    executor.setup_admin().await;
+    let admin = executor.login().await;
+    let first_token = executor.create_api_token(&admin, "First").await;
+    let second_token = executor.create_api_token(&admin, "Second").await;
+
+    let admin_list = send_empty(
+        executor.router(),
+        Method::GET,
+        "/api/v1/tools",
+        &[(header::COOKIE.as_str(), &admin.cookie)],
+    )
+    .await;
+    assert_eq!(admin_list.status(), StatusCode::OK);
+    let admin_body = response_json(admin_list).await;
+    assert_eq!(admin_body["total"], 1);
+    assert!(admin_body["items"][0].get("inputSchema").is_none());
+    assert!(admin_body["items"][0].get("inputTypescript").is_none());
+
+    let admin_detail = send_empty(
+        executor.router(),
+        Method::GET,
+        &format!("/api/v1/tools/{}", tool.id),
+        &[(header::COOKIE.as_str(), &admin.cookie)],
+    )
+    .await;
+    assert_eq!(admin_detail.status(), StatusCode::OK);
+    assert_eq!(
+        response_json(admin_detail).await["inputSchema"]["type"],
+        "object"
+    );
+
+    let bearer_control = send_empty(
+        executor.router(),
+        Method::GET,
+        "/api/v1/tools",
+        &[(
+            header::AUTHORIZATION.as_str(),
+            &format!("Bearer {first_token}"),
+        )],
+    )
+    .await;
+    assert_error(bearer_control, StatusCode::UNAUTHORIZED, "unauthorized").await;
+
+    let session_gateway = send_json(
+        executor.router(),
+        Method::POST,
+        "/api/v1/gateway/tools/search",
+        json!({ "query": "run" }),
+        &[(header::COOKIE.as_str(), &admin.cookie)],
+    )
+    .await;
+    assert_error(session_gateway, StatusCode::UNAUTHORIZED, "unauthorized").await;
+
+    let first_search = gateway_search_request(&executor, &first_token, "run").await;
+    let second_search = gateway_search_request(&executor, &second_token, "run").await;
+    assert_eq!(first_search, second_search);
+    assert_eq!(first_search["total"], 1);
+    let discovered_path = first_search["items"][0]["path"]
+        .as_str()
+        .expect("search should return a sandbox path")
+        .to_owned();
+    assert_eq!(discovered_path, "tools_2.run");
+    let described = send_json(
+        executor.router(),
+        Method::POST,
+        "/api/v1/gateway/tools/describe",
+        json!({ "path": discovered_path }),
+        &[(
+            header::AUTHORIZATION.as_str(),
+            &format!("Bearer {first_token}"),
+        )],
+    )
+    .await;
+    assert_eq!(described.status(), StatusCode::OK);
+    assert!(
+        response_json(described).await["outputTypescript"]
+            .as_str()
+            .is_some_and(|output| output.contains("ToolError"))
+    );
+
+    let missing_csrf = send_json(
+        executor.router(),
+        Method::PATCH,
+        &format!("/api/v1/tools/{}/mode", tool.id),
+        json!({ "mode": "disabled", "expectedRevision": tool.revision }),
+        &[
+            (header::COOKIE.as_str(), &admin.cookie),
+            (header::ORIGIN.as_str(), ORIGIN),
+        ],
+    )
+    .await;
+    assert_error(missing_csrf, StatusCode::FORBIDDEN, "invalid_csrf").await;
+
+    let disabled = send_json(
+        executor.router(),
+        Method::PATCH,
+        &format!("/api/v1/tools/{}/mode", tool.id),
+        json!({ "mode": "disabled", "expectedRevision": tool.revision }),
+        &[
+            (header::COOKIE.as_str(), &admin.cookie),
+            (header::ORIGIN.as_str(), ORIGIN),
+            ("x-executor-csrf", &admin.csrf),
+        ],
+    )
+    .await;
+    assert_eq!(disabled.status(), StatusCode::OK);
+    let disabled_request_id = disabled
+        .headers()
+        .get("x-request-id")
+        .expect("mutation should have a request ID")
+        .to_str()
+        .expect("request ID should be text")
+        .to_owned();
+    let disabled_body = response_json(disabled).await;
+    assert_eq!(disabled_body["effectiveMode"]["mode"], "disabled");
+    assert_eq!(
+        sqlx::query_scalar::<_, Option<i64>>(
+            "SELECT actor_admin_id FROM audit_events \
+             WHERE request_id = ? AND action = 'tool.mode_changed'",
+        )
+        .bind(disabled_request_id)
+        .fetch_one(executor.app.pool())
+        .await
+        .expect("administrator audit actor should read"),
+        Some(1)
+    );
+    let disabled_revision = disabled_body["revision"]
+        .as_i64()
+        .expect("updated revision should be an integer");
+
+    let missing_mode = send_json(
+        executor.router(),
+        Method::PATCH,
+        &format!("/api/v1/tools/{}/mode", tool.id),
+        json!({ "expectedRevision": disabled_revision }),
+        &[
+            (header::COOKIE.as_str(), &admin.cookie),
+            (header::ORIGIN.as_str(), ORIGIN),
+            ("x-executor-csrf", &admin.csrf),
+        ],
+    )
+    .await;
+    assert_error(missing_mode, StatusCode::BAD_REQUEST, "invalid_json").await;
+    assert_eq!(
+        executor
+            .app
+            .catalog()
+            .tool(&tool.id)
+            .await
+            .expect("tool should remain disabled")
+            .mode_override,
+        Some(ToolMode::Disabled)
+    );
+
+    assert_eq!(
+        gateway_search_request(&executor, &first_token, "run").await["total"],
+        0
+    );
+    assert_eq!(
+        gateway_search_request(&executor, &second_token, "run").await["total"],
+        0
+    );
+    let guarded = send_json(
+        executor.router(),
+        Method::POST,
+        "/api/v1/gateway/tools/lookup",
+        json!({ "path": tool.callable_path }),
+        &[(
+            header::AUTHORIZATION.as_str(),
+            &format!("Bearer {first_token}"),
+        )],
+    )
+    .await;
+    assert_error(guarded, StatusCode::FORBIDDEN, "tool_disabled").await;
+
+    let logs = tokio::time::timeout(std::time::Duration::from_secs(2), async {
+        loop {
+            let logs = executor
+                .app
+                .catalog()
+                .list_request_logs(None, 20)
+                .await
+                .expect("gateway calls should be readable");
+            let disabled_call_recorded = logs.items.iter().any(|log| {
+                log.path_snapshot.as_deref() == Some(tool.callable_path.as_str())
+                    && log.error_code.as_deref() == Some("tool_disabled")
+            });
+            let actor_count = logs
+                .items
+                .iter()
+                .filter_map(|log| log.actor_api_token_id.as_deref())
+                .collect::<std::collections::HashSet<_>>()
+                .len();
+            if disabled_call_recorded && actor_count == 2 {
+                break logs;
+            }
+            tokio::time::sleep(std::time::Duration::from_millis(10)).await;
+        }
+    })
+    .await
+    .expect("queued gateway logs should be stored");
+    assert!(logs.items.iter().any(|log| {
+        log.path_snapshot.as_deref() == Some(tool.callable_path.as_str())
+            && log.error_code.as_deref() == Some("tool_disabled")
+    }));
+    assert_eq!(
+        logs.items
+            .iter()
+            .filter_map(|log| log.actor_api_token_id.as_deref())
+            .collect::<std::collections::HashSet<_>>()
+            .len(),
+        2
+    );
+
+    let log_list = send_empty(
+        executor.router(),
+        Method::GET,
+        "/api/v1/request-logs?limit=1",
+        &[(header::COOKIE.as_str(), &admin.cookie)],
+    )
+    .await;
+    assert_eq!(log_list.status(), StatusCode::OK);
+    let log_body = response_json(log_list).await;
+    let log_id = log_body["items"][0]["requestId"]
+        .as_str()
+        .expect("log list should return request ID");
+    let log_detail = send_empty(
+        executor.router(),
+        Method::GET,
+        &format!("/api/v1/request-logs/{log_id}"),
+        &[(header::COOKIE.as_str(), &admin.cookie)],
+    )
+    .await;
+    assert_eq!(log_detail.status(), StatusCode::OK);
+
+    let catalog_revision = executor
+        .app
+        .catalog()
+        .global_revision()
+        .await
+        .expect("catalog revision should read");
+    let explicit_bulk = send_json(
+        executor.router(),
+        Method::PATCH,
+        "/api/v1/tools/modes",
+        json!({
+            "selection": {
+                "type": "tool_ids",
+                "toolIds": [tool.id],
+                "expectedCatalogRevision": catalog_revision
+            },
+            "mode": "enabled"
+        }),
+        &[
+            (header::COOKIE.as_str(), &admin.cookie),
+            (header::ORIGIN.as_str(), ORIGIN),
+            ("x-executor-csrf", &admin.csrf),
+        ],
+    )
+    .await;
+    assert_eq!(explicit_bulk.status(), StatusCode::OK);
+    assert_eq!(response_json(explicit_bulk).await["updatedCount"], 1);
+
+    let source_revision = executor
+        .app
+        .catalog()
+        .source(&source.id)
+        .await
+        .expect("source should exist")
+        .revision;
+    let source_bulk = send_json(
+        executor.router(),
+        Method::PATCH,
+        "/api/v1/tools/modes",
+        json!({
+            "selection": {
+                "type": "source",
+                "sourceId": source.id,
+                "expectedSourceRevision": source_revision
+            },
+            "mode": "ask"
+        }),
+        &[
+            (header::COOKIE.as_str(), &admin.cookie),
+            (header::ORIGIN.as_str(), ORIGIN),
+            ("x-executor-csrf", &admin.csrf),
+        ],
+    )
+    .await;
+    assert_eq!(source_bulk.status(), StatusCode::OK);
+    assert_eq!(response_json(source_bulk).await["updatedCount"], 1);
+
+    let ask_lookup = send_json(
+        executor.router(),
+        Method::POST,
+        "/api/v1/gateway/tools/lookup",
+        json!({ "path": discovered_path }),
+        &[(
+            header::AUTHORIZATION.as_str(),
+            &format!("Bearer {second_token}"),
+        )],
+    )
+    .await;
+    assert_eq!(ask_lookup.status(), StatusCode::OK);
+    assert_eq!(response_json(ask_lookup).await["requiresApproval"], true);
+
+    let sources = send_empty(
+        executor.router(),
+        Method::GET,
+        "/api/v1/sources",
+        &[(header::COOKIE.as_str(), &admin.cookie)],
+    )
+    .await;
+    assert_eq!(sources.status(), StatusCode::OK);
+    assert_eq!(
+        response_json(sources).await["sources"]
+            .as_array()
+            .map(Vec::len),
+        Some(1)
+    );
+    let source_detail = send_empty(
+        executor.router(),
+        Method::GET,
+        &format!("/api/v1/sources/{}", source.id),
+        &[(header::COOKIE.as_str(), &admin.cookie)],
+    )
+    .await;
+    assert_eq!(source_detail.status(), StatusCode::OK);
+    let source_body = response_json(source_detail).await;
+    let source_revision = source_body["revision"]
+        .as_i64()
+        .expect("source revision should be an integer");
+    let source_mode = send_json(
+        executor.router(),
+        Method::PATCH,
+        &format!("/api/v1/sources/{}/mode", source.id),
+        json!({ "mode": "disabled", "expectedRevision": source_revision }),
+        &[
+            (header::COOKIE.as_str(), &admin.cookie),
+            (header::ORIGIN.as_str(), ORIGIN),
+            ("x-executor-csrf", &admin.csrf),
+        ],
+    )
+    .await;
+    assert_eq!(source_mode.status(), StatusCode::OK);
+    let deleted = send_empty(
+        executor.router(),
+        Method::DELETE,
+        &format!("/api/v1/sources/{}", source.id),
+        &[
+            (header::COOKIE.as_str(), &admin.cookie),
+            (header::ORIGIN.as_str(), ORIGIN),
+            ("x-executor-csrf", &admin.csrf),
+        ],
+    )
+    .await;
+    assert_eq!(deleted.status(), StatusCode::NO_CONTENT);
+}
+
+#[tokio::test]
+async fn gateway_auth_stays_responsive_during_token_timestamp_contention() {
+    let executor = TestExecutor::new().await;
+    executor.setup_admin().await;
+    let admin = executor.login().await;
+    let token = executor.create_api_token(&admin, "Contention").await;
+    let outside_writer = executor
+        .app
+        .pool()
+        .begin_with("BEGIN IMMEDIATE")
+        .await
+        .expect("outside writer should reserve SQLite");
+
+    for _ in 0..2 {
+        tokio::time::timeout(
+            std::time::Duration::from_secs(1),
+            gateway_whoami_burst(&executor, &token, 24),
+        )
+        .await
+        .expect("authentication reads should not wait for the timestamp writer");
+    }
+
+    outside_writer
+        .commit()
+        .await
+        .expect("outside writer should commit");
+    for _ in 0..100 {
+        let last_used = sqlx::query_scalar::<_, Option<i64>>(
+            "SELECT last_used_at FROM api_tokens WHERE name = 'Contention'",
+        )
+        .fetch_one(executor.app.pool())
+        .await
+        .expect("last-used timestamp should be readable");
+        if last_used.is_some() {
+            return;
+        }
+        tokio::time::sleep(std::time::Duration::from_millis(10)).await;
+    }
+    panic!("the coalesced last-used update should settle after contention clears");
+}
+
+async fn gateway_whoami_burst(executor: &TestExecutor, token: &str, requests: usize) {
+    let mut requests_in_flight = tokio::task::JoinSet::new();
+    for _ in 0..requests {
+        let router = executor.router();
+        let authorization = format!("Bearer {token}");
+        requests_in_flight.spawn(async move {
+            send_empty(
+                router,
+                Method::GET,
+                "/api/v1/gateway/whoami",
+                &[(header::AUTHORIZATION.as_str(), &authorization)],
+            )
+            .await
+            .status()
+        });
+    }
+    while let Some(response) = requests_in_flight.join_next().await {
+        assert_eq!(
+            response.expect("gateway authentication task should not panic"),
+            StatusCode::OK
+        );
+    }
+}
+
+async fn gateway_search_request(executor: &TestExecutor, token: &str, query: &str) -> Value {
+    let response = send_json(
+        executor.router(),
+        Method::POST,
+        "/api/v1/gateway/tools/search",
+        json!({ "query": query, "limit": 10, "offset": 0 }),
+        &[(header::AUTHORIZATION.as_str(), &format!("Bearer {token}"))],
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::OK);
+    response_json(response).await
+}
+
+async fn send_json(
+    router: Router,
+    method: Method,
+    uri: &str,
+    body: Value,
+    headers: &[(&str, &str)],
+) -> Response<Body> {
+    let mut request = Request::builder()
+        .method(method)
+        .uri(uri)
+        .header(header::CONTENT_TYPE, "application/json");
+    for (name, value) in headers {
+        request = request.header(*name, *value);
+    }
+    router
+        .oneshot(
+            request
+                .body(Body::from(body.to_string()))
+                .expect("request should build"),
+        )
+        .await
+        .expect("router should answer")
+}
+
+async fn send_empty(
+    router: Router,
+    method: Method,
+    uri: &str,
+    headers: &[(&str, &str)],
+) -> Response<Body> {
+    let mut request = Request::builder().method(method).uri(uri);
+    for (name, value) in headers {
+        request = request.header(*name, *value);
+    }
+    router
+        .oneshot(request.body(Body::empty()).expect("request should build"))
+        .await
+        .expect("router should answer")
+}
+
+fn response_cookie_header(response: &Response<Body>) -> String {
+    response
+        .headers()
+        .get_all(header::SET_COOKIE)
+        .iter()
+        .map(|value| {
+            value
+                .to_str()
+                .expect("set-cookie should be text")
+                .split(';')
+                .next()
+                .expect("cookie should contain a value")
+        })
+        .collect::<Vec<_>>()
+        .join("; ")
+}
+
+async fn response_json(response: Response<Body>) -> Value {
+    let bytes = response
+        .into_body()
+        .collect()
+        .await
+        .expect("response body should collect")
+        .to_bytes();
+    serde_json::from_slice(&bytes).expect("response should contain JSON")
+}
+
+async fn assert_error(response: Response<Body>, status: StatusCode, code: &str) {
+    assert_eq!(response.status(), status);
+    let request_id = response
+        .headers()
+        .get("x-request-id")
+        .expect("error should have a request ID")
+        .to_str()
+        .expect("request ID should be text")
+        .to_owned();
+    let body = response_json(response).await;
+    assert_eq!(body["error"]["code"], code);
+    assert_eq!(body["error"]["requestId"], request_id);
+}
diff --git a/tests/config.rs b/tests/config.rs
new file mode 100644
index 000000000..5d158f453
--- /dev/null
+++ b/tests/config.rs
@@ -0,0 +1,68 @@
+use std::net::SocketAddr;
+
+use executor::{AppConfig, ConfigError};
+
+#[test]
+fn public_origins_are_canonicalized_and_reject_extra_components() {
+    let directory = tempfile::tempdir().expect("temporary directory should be created");
+    let config = AppConfig::new(directory.path().to_path_buf())
+        .with_origin("HTTPS://Example.COM:443/")
+        .expect("origin should be valid");
+    assert_eq!(config.public_origin(), "https://example.com");
+
+    for invalid in [
+        "https://user@example.com",
+        "https://example.com/path",
+        "https://example.com?query=1",
+        "https://example.com#fragment",
+    ] {
+        assert!(matches!(
+            AppConfig::new(directory.path().to_path_buf()).with_origin(invalid),
+            Err(ConfigError::PublicOriginHasExtraComponents)
+        ));
+    }
+    assert!(matches!(
+        AppConfig::new(directory.path().to_path_buf()).with_origin("ftp://example.com"),
+        Err(ConfigError::UnsupportedPublicOriginScheme)
+    ));
+}
+
+#[test]
+fn plaintext_http_requires_an_explicit_unsafe_non_loopback_override() {
+    let directory = tempfile::tempdir().expect("temporary directory should be created");
+    let http = AppConfig::new(directory.path().to_path_buf());
+    let loopback: SocketAddr = "127.0.0.1:4788".parse().expect("address should parse");
+    let public: SocketAddr = "0.0.0.0:4788".parse().expect("address should parse");
+    assert!(http.validate_bind(loopback, false).is_ok());
+    assert!(matches!(
+        http.validate_bind(public, false),
+        Err(ConfigError::UnsafePlaintextNonLoopbackBind(_))
+    ));
+    assert!(http.validate_bind(public, true).is_ok());
+
+    let https = AppConfig::new(directory.path().to_path_buf())
+        .with_origin("https://executor.example.com")
+        .expect("HTTPS origin should be valid");
+    assert!(https.validate_bind(public, false).is_ok());
+}
+
+#[test]
+fn default_public_origin_tracks_the_actual_bind_address() {
+    let directory = tempfile::tempdir().expect("temporary directory should be created");
+    let loopback: SocketAddr = "127.0.0.1:5888".parse().expect("address should parse");
+    let config = AppConfig::new(directory.path().to_path_buf())
+        .with_default_origin_for_bind(loopback)
+        .expect("loopback bind should produce an origin");
+    assert_eq!(config.public_origin(), "http://127.0.0.1:5888");
+
+    let unspecified: SocketAddr = "0.0.0.0:5888".parse().expect("address should parse");
+    assert!(matches!(
+        AppConfig::new(directory.path().to_path_buf()).with_default_origin_for_bind(unspecified),
+        Err(ConfigError::PublicOriginRequiredForUnspecifiedBind(_))
+    ));
+
+    let explicit = AppConfig::new(directory.path().to_path_buf())
+        .with_origin("https://executor.example.com")
+        .expect("explicit public origin should remain supported");
+    assert_eq!(explicit.public_origin(), "https://executor.example.com");
+}
diff --git a/tests/control_plane.rs b/tests/control_plane.rs
new file mode 100644
index 000000000..bfd7414f8
--- /dev/null
+++ b/tests/control_plane.rs
@@ -0,0 +1,1452 @@
+use std::{
+    fs,
+    net::SocketAddr,
+    sync::{
+        Arc,
+        atomic::{AtomicU64, Ordering},
+    },
+};
+
+use axum::{
+    Router,
+    body::Body,
+    extract::ConnectInfo,
+    http::{Method, Request, Response, StatusCode, header},
+};
+use executor::{
+    AppConfig, DatabaseError, ExecutorApp,
+    catalog::{RequestOutcome, RequestSurface},
+};
+use http_body_util::BodyExt;
+use ipnet::IpNet;
+use serde_json::{Value, json};
+use tempfile::TempDir;
+use tower::ServiceExt;
+
+const ORIGIN: &str = "http://127.0.0.1:4788";
+const PASSWORD: &str = "correct-horse-battery-staple";
+static TOKEN_IDEMPOTENCY_SEQUENCE: AtomicU64 = AtomicU64::new(1);
+
+struct TestExecutor {
+    _directory: TempDir,
+    app: Arc<ExecutorApp>,
+}
+
+struct AdminSession {
+    cookie: String,
+    csrf: String,
+}
+
+impl TestExecutor {
+    async fn new() -> Self {
+        let directory = tempfile::tempdir().expect("temporary directory should be created");
+        let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+            .await
+            .expect("test Executor should open");
+        Self {
+            _directory: directory,
+            app: Arc::new(app),
+        }
+    }
+
+    async fn with_trusted_proxies(networks: &[&str]) -> Self {
+        let directory = tempfile::tempdir().expect("temporary directory should be created");
+        let trusted_proxies = networks
+            .iter()
+            .map(|network| {
+                network
+                    .parse::<IpNet>()
+                    .expect("trusted proxy network should parse")
+            })
+            .collect();
+        let app = ExecutorApp::open(
+            AppConfig::new(directory.path().to_path_buf()).with_trusted_proxies(trusted_proxies),
+        )
+        .await
+        .expect("test Executor should open");
+        Self {
+            _directory: directory,
+            app: Arc::new(app),
+        }
+    }
+
+    fn router(&self) -> Router {
+        self.app.router()
+    }
+
+    fn setup_token(&self) -> String {
+        self.app
+            .setup_token()
+            .expect("fresh test app should issue a setup token")
+            .to_owned()
+    }
+
+    async fn setup_admin(&self) {
+        let response = send_json(
+            self.router(),
+            Method::POST,
+            "/api/v1/setup",
+            json!({
+                "setupToken": self.setup_token(),
+                "username": "admin",
+                "password": PASSWORD
+            }),
+            &[(header::ORIGIN.as_str(), ORIGIN)],
+        )
+        .await;
+        assert_eq!(response.status(), StatusCode::CREATED);
+    }
+
+    async fn login(&self) -> AdminSession {
+        let response = send_json(
+            self.router(),
+            Method::POST,
+            "/api/v1/session",
+            json!({ "username": "admin", "password": PASSWORD }),
+            &[(header::ORIGIN.as_str(), ORIGIN)],
+        )
+        .await;
+        assert_eq!(response.status(), StatusCode::OK);
+        let cookie = response_cookie_header(&response);
+        let body = response_json(response).await;
+        let csrf = body["csrfToken"]
+            .as_str()
+            .expect("login should reveal a CSRF token")
+            .to_owned();
+        AdminSession { cookie, csrf }
+    }
+}
+
+#[tokio::test]
+async fn migrations_and_sqlite_safety_pragmas_are_active() {
+    let executor = TestExecutor::new().await;
+    let table_count = sqlx::query_scalar::<_, i64>(
+        "SELECT COUNT(*) FROM sqlite_master WHERE type = 'table' AND name IN \
+         ('instance_metadata', 'setup_state', 'admins', 'admin_sessions', 'api_tokens')",
+    )
+    .fetch_one(executor.app.pool())
+    .await
+    .expect("schema query should succeed");
+    assert_eq!(table_count, 5);
+
+    let foreign_keys = sqlx::query_scalar::<_, i64>("PRAGMA foreign_keys")
+        .fetch_one(executor.app.pool())
+        .await
+        .expect("foreign_keys pragma should be readable");
+    let journal_mode = sqlx::query_scalar::<_, String>("PRAGMA journal_mode")
+        .fetch_one(executor.app.pool())
+        .await
+        .expect("journal mode should be readable");
+    let synchronous = sqlx::query_scalar::<_, i64>("PRAGMA synchronous")
+        .fetch_one(executor.app.pool())
+        .await
+        .expect("synchronous pragma should be readable");
+    assert_eq!(foreign_keys, 1);
+    assert_eq!(journal_mode, "wal");
+    assert_eq!(synchronous, 2);
+
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+
+        let directory_mode = fs::metadata(executor._directory.path())
+            .expect("data directory metadata should be readable")
+            .permissions()
+            .mode()
+            & 0o777;
+        let key_mode = fs::metadata(executor._directory.path().join("master.key"))
+            .expect("master key metadata should be readable")
+            .permissions()
+            .mode()
+            & 0o777;
+        let database_mode = fs::metadata(executor._directory.path().join("executor.db"))
+            .expect("database metadata should be readable")
+            .permissions()
+            .mode()
+            & 0o777;
+        let lock_mode = fs::metadata(executor._directory.path().join("executor.lock"))
+            .expect("lock metadata should be readable")
+            .permissions()
+            .mode()
+            & 0o777;
+        assert_eq!(directory_mode, 0o700);
+        assert_eq!(key_mode, 0o600);
+        assert_eq!(database_mode, 0o600);
+        assert_eq!(lock_mode, 0o600);
+    }
+}
+
+#[tokio::test]
+async fn one_process_holds_the_data_directory_lock_for_its_lifetime() {
+    let directory = tempfile::tempdir().expect("temporary directory should be created");
+    let config = AppConfig::new(directory.path().to_path_buf());
+    let first = ExecutorApp::open(config.clone())
+        .await
+        .expect("first process should acquire the lock");
+    let Err(error) = ExecutorApp::open(config.clone()).await else {
+        panic!("a second process must not acquire the same data directory");
+    };
+    assert!(matches!(error, DatabaseError::AlreadyRunning(_)));
+
+    first.pool().close().await;
+    drop(first);
+    let reopened = ExecutorApp::open(config)
+        .await
+        .expect("dropping the app should release the lock");
+    reopened.pool().close().await;
+}
+
+#[tokio::test]
+async fn initialized_database_fails_closed_for_missing_or_wrong_keys() {
+    let missing_key_directory = tempfile::tempdir().expect("temporary directory should be created");
+    let missing_config = AppConfig::new(missing_key_directory.path().to_path_buf());
+    let missing_app = ExecutorApp::open(missing_config.clone())
+        .await
+        .expect("initial open should succeed");
+    missing_app.pool().close().await;
+    drop(missing_app);
+    fs::remove_file(missing_key_directory.path().join("master.key"))
+        .expect("master key should be removable in the test");
+    let Err(missing_error) = ExecutorApp::open(missing_config).await else {
+        panic!("missing key must fail closed");
+    };
+    assert!(matches!(
+        missing_error,
+        DatabaseError::Crypto(executor::crypto::CryptoError::MissingMasterKey(_))
+    ));
+
+    let wrong_key_directory = tempfile::tempdir().expect("temporary directory should be created");
+    let wrong_config = AppConfig::new(wrong_key_directory.path().to_path_buf());
+    let wrong_app = ExecutorApp::open(wrong_config.clone())
+        .await
+        .expect("initial open should succeed");
+    wrong_app.pool().close().await;
+    drop(wrong_app);
+    fs::write(wrong_key_directory.path().join("master.key"), [9_u8; 32])
+        .expect("test should replace the key");
+    let Err(wrong_error) = ExecutorApp::open(wrong_config).await else {
+        panic!("wrong key must fail closed");
+    };
+    assert!(matches!(wrong_error, DatabaseError::InvalidBootSentinel));
+}
+
+#[tokio::test]
+async fn tampered_boot_sentinel_fails_closed() {
+    let directory = tempfile::tempdir().expect("temporary directory should be created");
+    let config = AppConfig::new(directory.path().to_path_buf());
+    let app = ExecutorApp::open(config.clone())
+        .await
+        .expect("initial open should succeed");
+    let mut sentinel = sqlx::query_scalar::<_, Vec<u8>>(
+        "SELECT value FROM instance_metadata WHERE key = 'boot_sentinel'",
+    )
+    .fetch_one(app.pool())
+    .await
+    .expect("sentinel should exist");
+    let last = sentinel.len() - 1;
+    sentinel[last] ^= 0x01;
+    sqlx::query("UPDATE instance_metadata SET value = ? WHERE key = 'boot_sentinel'")
+        .bind(sentinel)
+        .execute(app.pool())
+        .await
+        .expect("sentinel should be updateable in the test");
+    app.pool().close().await;
+    drop(app);
+
+    let Err(error) = ExecutorApp::open(config).await else {
+        panic!("tampered sentinel must fail closed");
+    };
+    assert!(matches!(error, DatabaseError::InvalidBootSentinel));
+}
+
+#[tokio::test]
+async fn interrupted_empty_initialization_recreates_the_boot_sentinel() {
+    let directory = tempfile::tempdir().expect("temporary directory should be created");
+    let config = AppConfig::new(directory.path().to_path_buf());
+    let app = ExecutorApp::open(config.clone())
+        .await
+        .expect("initial open should succeed");
+    sqlx::query("DELETE FROM setup_state")
+        .execute(app.pool())
+        .await
+        .expect("test should remove setup state");
+    sqlx::query("DELETE FROM instance_metadata WHERE key = 'boot_sentinel'")
+        .execute(app.pool())
+        .await
+        .expect("test should remove the sentinel");
+    app.pool().close().await;
+    drop(app);
+
+    let recovered = ExecutorApp::open(config)
+        .await
+        .expect("empty post-migration state should recover");
+    assert!(recovered.setup_token().is_some());
+    let sentinel_count = sqlx::query_scalar::<_, i64>(
+        "SELECT COUNT(*) FROM instance_metadata WHERE key = 'boot_sentinel'",
+    )
+    .fetch_one(recovered.pool())
+    .await
+    .expect("sentinel should be readable");
+    assert_eq!(sentinel_count, 1);
+}
+
+#[tokio::test]
+async fn missing_sentinel_with_application_state_still_fails_closed() {
+    let directory = tempfile::tempdir().expect("temporary directory should be created");
+    let config = AppConfig::new(directory.path().to_path_buf());
+    let app = ExecutorApp::open(config.clone())
+        .await
+        .expect("initial open should succeed");
+    sqlx::query("DELETE FROM instance_metadata WHERE key = 'boot_sentinel'")
+        .execute(app.pool())
+        .await
+        .expect("test should remove the sentinel");
+    app.pool().close().await;
+    drop(app);
+
+    let Err(error) = ExecutorApp::open(config).await else {
+        panic!("setup state without a sentinel must fail closed");
+    };
+    assert!(matches!(error, DatabaseError::MissingBootSentinel));
+}
+
+#[tokio::test]
+async fn expired_setup_tokens_are_rejected_before_password_work() {
+    let executor = TestExecutor::new().await;
+    sqlx::query("UPDATE setup_state SET created_at = 0 WHERE id = 1")
+        .execute(executor.app.pool())
+        .await
+        .expect("test should expire the setup token");
+    let response = send_json(
+        executor.router(),
+        Method::POST,
+        "/api/v1/setup",
+        json!({
+            "setupToken": executor.setup_token(),
+            "username": "admin",
+            "password": PASSWORD
+        }),
+        &[(header::ORIGIN.as_str(), ORIGIN)],
+    )
+    .await;
+
+    assert_error(response, StatusCode::UNAUTHORIZED, "unauthorized").await;
+}
+
+#[tokio::test]
+async fn concurrent_setup_claims_create_exactly_one_admin() {
+    let executor = TestExecutor::new().await;
+    let token = executor.setup_token();
+    let first_headers = [(header::ORIGIN.as_str(), ORIGIN)];
+    let second_headers = [(header::ORIGIN.as_str(), ORIGIN)];
+    let first = send_json(
+        executor.router(),
+        Method::POST,
+        "/api/v1/setup",
+        json!({ "setupToken": token, "username": "first", "password": PASSWORD }),
+        &first_headers,
+    );
+    let second = send_json(
+        executor.router(),
+        Method::POST,
+        "/api/v1/setup",
+        json!({ "setupToken": executor.setup_token(), "username": "second", "password": PASSWORD }),
+        &second_headers,
+    );
+    let (first_response, second_response) = tokio::join!(first, second);
+    let mut statuses = [first_response.status(), second_response.status()];
+    statuses.sort_by_key(|status| status.as_u16());
+    assert_eq!(statuses, [StatusCode::CREATED, StatusCode::CONFLICT]);
+
+    let admin_count = sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM admins")
+        .fetch_one(executor.app.pool())
+        .await
+        .expect("admin count should be readable");
+    assert_eq!(admin_count, 1);
+}
+
+#[tokio::test]
+async fn sessions_enforce_cookie_csrf_origin_and_logout() {
+    let executor = TestExecutor::new().await;
+    executor.setup_admin().await;
+    let admin = executor.login().await;
+
+    let session_response = send_empty(
+        executor.router(),
+        Method::GET,
+        "/api/v1/session",
+        &[(header::COOKIE.as_str(), &admin.cookie)],
+    )
+    .await;
+    assert_eq!(session_response.status(), StatusCode::OK);
+
+    let missing_origin = create_token_request(&executor, &admin, None, Some(&admin.csrf)).await;
+    assert_error(missing_origin, StatusCode::FORBIDDEN, "invalid_origin").await;
+
+    let wrong_origin = create_token_request(
+        &executor,
+        &admin,
+        Some("https://attacker.invalid"),
+        Some(&admin.csrf),
+    )
+    .await;
+    assert_error(wrong_origin, StatusCode::FORBIDDEN, "invalid_origin").await;
+
+    let missing_csrf = create_token_request(&executor, &admin, Some(ORIGIN), None).await;
+    assert_error(missing_csrf, StatusCode::FORBIDDEN, "invalid_csrf").await;
+
+    let wrong_csrf =
+        create_token_request(&executor, &admin, Some(ORIGIN), Some("csrf_wrong")).await;
+    assert_error(wrong_csrf, StatusCode::FORBIDDEN, "invalid_csrf").await;
+
+    let created = create_token_request(&executor, &admin, Some(ORIGIN), Some(&admin.csrf)).await;
+    assert_eq!(created.status(), StatusCode::CREATED);
+
+    let logout = send_empty(
+        executor.router(),
+        Method::DELETE,
+        "/api/v1/session",
+        &[
+            (header::COOKIE.as_str(), &admin.cookie),
+            (header::ORIGIN.as_str(), ORIGIN),
+            ("x-executor-csrf", &admin.csrf),
+        ],
+    )
+    .await;
+    assert_eq!(logout.status(), StatusCode::NO_CONTENT);
+
+    let after_logout = send_empty(
+        executor.router(),
+        Method::GET,
+        "/api/v1/session",
+        &[(header::COOKIE.as_str(), &admin.cookie)],
+    )
+    .await;
+    assert_error(after_logout, StatusCode::UNAUTHORIZED, "unauthorized").await;
+}
+
+#[tokio::test]
+async fn usernames_are_trimmed_and_credential_fields_are_bounded() {
+    let executor = TestExecutor::new().await;
+    let setup = send_json(
+        executor.router(),
+        Method::POST,
+        "/api/v1/setup",
+        json!({
+            "setupToken": executor.setup_token(),
+            "username": "  admin  ",
+            "password": PASSWORD
+        }),
+        &[(header::ORIGIN.as_str(), ORIGIN)],
+    )
+    .await;
+    assert_eq!(setup.status(), StatusCode::CREATED);
+    let stored_username =
+        sqlx::query_scalar::<_, String>("SELECT username FROM admins WHERE id = 1")
+            .fetch_one(executor.app.pool())
+            .await
+            .expect("admin should be stored");
+    assert_eq!(stored_username, "admin");
+
+    let login = send_json(
+        executor.router(),
+        Method::POST,
+        "/api/v1/session",
+        json!({ "username": " admin ", "password": PASSWORD }),
+        &[(header::ORIGIN.as_str(), ORIGIN)],
+    )
+    .await;
+    assert_eq!(login.status(), StatusCode::OK);
+
+    let oversized_password = send_json(
+        executor.router(),
+        Method::POST,
+        "/api/v1/session",
+        json!({ "username": "admin", "password": "x".repeat(1025) }),
+        &[(header::ORIGIN.as_str(), ORIGIN)],
+    )
+    .await;
+    assert_error(
+        oversized_password,
+        StatusCode::BAD_REQUEST,
+        "invalid_password",
+    )
+    .await;
+
+    let oversized_username = send_json(
+        executor.router(),
+        Method::POST,
+        "/api/v1/session",
+        json!({ "username": "x".repeat(65), "password": PASSWORD }),
+        &[(header::ORIGIN.as_str(), ORIGIN)],
+    )
+    .await;
+    assert_error(
+        oversized_username,
+        StatusCode::BAD_REQUEST,
+        "invalid_username",
+    )
+    .await;
+}
+
+#[tokio::test]
+async fn https_public_origins_produce_secure_session_cookies() {
+    let directory = tempfile::tempdir().expect("temporary directory should be created");
+    let app = ExecutorApp::open(
+        AppConfig::new(directory.path().to_path_buf())
+            .with_origin("https://executor.example.com")
+            .expect("HTTPS origin should be valid"),
+    )
+    .await
+    .expect("test Executor should open");
+    let setup = send_json(
+        app.router(),
+        Method::POST,
+        "/api/v1/setup",
+        json!({
+            "setupToken": app.setup_token().expect("setup token should exist"),
+            "username": "admin",
+            "password": PASSWORD
+        }),
+        &[(header::ORIGIN.as_str(), "https://executor.example.com")],
+    )
+    .await;
+    assert_eq!(setup.status(), StatusCode::CREATED);
+    let login = send_json(
+        app.router(),
+        Method::POST,
+        "/api/v1/session",
+        json!({ "username": "admin", "password": PASSWORD }),
+        &[(header::ORIGIN.as_str(), "https://executor.example.com")],
+    )
+    .await;
+    assert_eq!(login.status(), StatusCode::OK);
+    assert!(
+        login
+            .headers()
+            .get_all(header::SET_COOKIE)
+            .iter()
+            .all(|value| {
+                value
+                    .to_str()
+                    .expect("set-cookie should be text")
+                    .contains("Secure")
+            })
+    );
+}
+
+#[tokio::test]
+async fn password_work_is_non_waiting_and_bounded() {
+    let executor = TestExecutor::new().await;
+    executor.setup_admin().await;
+    let headers = [(header::ORIGIN.as_str(), ORIGIN)];
+    let login_body = json!({ "username": "missing", "password": PASSWORD });
+    let first = send_json(
+        executor.router(),
+        Method::POST,
+        "/api/v1/session",
+        login_body.clone(),
+        &headers,
+    );
+    let second = send_json(
+        executor.router(),
+        Method::POST,
+        "/api/v1/session",
+        login_body.clone(),
+        &headers,
+    );
+    let third = send_json(
+        executor.router(),
+        Method::POST,
+        "/api/v1/session",
+        login_body.clone(),
+        &headers,
+    );
+    let fourth = send_json(
+        executor.router(),
+        Method::POST,
+        "/api/v1/session",
+        login_body,
+        &headers,
+    );
+    let responses = tokio::join!(first, second, third, fourth);
+    let statuses = [
+        responses.0.status(),
+        responses.1.status(),
+        responses.2.status(),
+        responses.3.status(),
+    ];
+    assert!(statuses.contains(&StatusCode::TOO_MANY_REQUESTS));
+    assert!(statuses.iter().all(|status| {
+        matches!(
+            *status,
+            StatusCode::UNAUTHORIZED | StatusCode::TOO_MANY_REQUESTS
+        )
+    }));
+}
+
+#[tokio::test]
+async fn login_rate_limit_uses_peer_ip_and_ignores_forwarded_headers() {
+    let executor = TestExecutor::new().await;
+    executor.setup_admin().await;
+    let first_peer_ip = "192.0.2.10";
+
+    for attempt in 0..5 {
+        let peer: SocketAddr = format!("{first_peer_ip}:{}", 4100 + attempt)
+            .parse()
+            .expect("peer address should parse");
+        let forwarded = format!("203.0.113.{}", attempt + 1);
+        let response = send_json_from(
+            executor.router(),
+            peer,
+            Method::POST,
+            "/api/v1/session",
+            json!({ "username": format!("missing-{attempt}"), "password": PASSWORD }),
+            &[
+                (header::ORIGIN.as_str(), ORIGIN),
+                ("x-forwarded-for", &forwarded),
+            ],
+        )
+        .await;
+        assert_eq!(response.status(), StatusCode::UNAUTHORIZED);
+    }
+
+    let limited_peer: SocketAddr = format!("{first_peer_ip}:4200")
+        .parse()
+        .expect("peer address should parse");
+    let limited = send_json_from(
+        executor.router(),
+        limited_peer,
+        Method::POST,
+        "/api/v1/session",
+        json!({ "username": "another-missing-user", "password": PASSWORD }),
+        &[
+            (header::ORIGIN.as_str(), ORIGIN),
+            ("x-forwarded-for", "198.51.100.200"),
+        ],
+    )
+    .await;
+    let retry_after = limited
+        .headers()
+        .get(header::RETRY_AFTER)
+        .and_then(|value| value.to_str().ok())
+        .and_then(|value| value.parse::<u64>().ok());
+    assert!(retry_after.is_some_and(|seconds| seconds > 0));
+    assert_error(limited, StatusCode::TOO_MANY_REQUESTS, "login_rate_limited").await;
+
+    let second_peer: SocketAddr = "192.0.2.11:4100"
+        .parse()
+        .expect("peer address should parse");
+    let independent = send_json_from(
+        executor.router(),
+        second_peer,
+        Method::POST,
+        "/api/v1/session",
+        json!({ "username": "missing", "password": PASSWORD }),
+        &[
+            (header::ORIGIN.as_str(), ORIGIN),
+            ("x-forwarded-for", first_peer_ip),
+        ],
+    )
+    .await;
+    assert_eq!(independent.status(), StatusCode::UNAUTHORIZED);
+}
+
+#[tokio::test]
+async fn trusted_proxy_separates_clients_and_avoids_proxy_wide_lockout() {
+    let executor = TestExecutor::with_trusted_proxies(&["10.0.0.0/8"]).await;
+    executor.setup_admin().await;
+    let proxy: SocketAddr = "10.20.30.40:443"
+        .parse()
+        .expect("proxy address should parse");
+
+    for attempt in 0..5 {
+        let response = send_json_from(
+            executor.router(),
+            proxy,
+            Method::POST,
+            "/api/v1/session",
+            json!({ "username": format!("missing-{attempt}"), "password": PASSWORD }),
+            &[
+                (header::ORIGIN.as_str(), ORIGIN),
+                ("x-forwarded-for", "203.0.113.10"),
+            ],
+        )
+        .await;
+        assert_eq!(response.status(), StatusCode::UNAUTHORIZED);
+    }
+
+    let limited = send_json_from(
+        executor.router(),
+        proxy,
+        Method::POST,
+        "/api/v1/session",
+        json!({ "username": "still-missing", "password": PASSWORD }),
+        &[
+            (header::ORIGIN.as_str(), ORIGIN),
+            ("x-forwarded-for", "203.0.113.10"),
+        ],
+    )
+    .await;
+    assert_error(limited, StatusCode::TOO_MANY_REQUESTS, "login_rate_limited").await;
+
+    let independent_client = send_json_from(
+        executor.router(),
+        proxy,
+        Method::POST,
+        "/api/v1/session",
+        json!({ "username": "another-client", "password": PASSWORD }),
+        &[
+            (header::ORIGIN.as_str(), ORIGIN),
+            ("x-forwarded-for", "203.0.113.11"),
+        ],
+    )
+    .await;
+    assert_eq!(independent_client.status(), StatusCode::UNAUTHORIZED);
+}
+
+#[tokio::test]
+async fn trusted_proxy_chain_walks_right_to_left_and_stops_at_the_client() {
+    let executor = TestExecutor::with_trusted_proxies(&["10.0.0.0/8", "192.168.0.0/16"]).await;
+    executor.setup_admin().await;
+    let edge_proxy: SocketAddr = "10.0.0.5:443".parse().expect("proxy address should parse");
+
+    for attempt in 0..5 {
+        let forwarded = format!("not-an-ip-{}, 203.0.113.20, 192.168.1.10", attempt + 1);
+        let response = send_json_from(
+            executor.router(),
+            edge_proxy,
+            Method::POST,
+            "/api/v1/session",
+            json!({ "username": format!("missing-{attempt}"), "password": PASSWORD }),
+            &[
+                (header::ORIGIN.as_str(), ORIGIN),
+                ("x-forwarded-for", &forwarded),
+            ],
+        )
+        .await;
+        assert_eq!(response.status(), StatusCode::UNAUTHORIZED);
+    }
+
+    let limited = send_json_from(
+        executor.router(),
+        edge_proxy,
+        Method::POST,
+        "/api/v1/session",
+        json!({ "username": "still-missing", "password": PASSWORD }),
+        &[
+            (header::ORIGIN.as_str(), ORIGIN),
+            ("x-forwarded-for", "not-an-ip, 203.0.113.20, 192.168.1.10"),
+        ],
+    )
+    .await;
+    assert_error(limited, StatusCode::TOO_MANY_REQUESTS, "login_rate_limited").await;
+
+    let independent_client = send_json_from(
+        executor.router(),
+        edge_proxy,
+        Method::POST,
+        "/api/v1/session",
+        json!({ "username": "another-client", "password": PASSWORD }),
+        &[
+            (header::ORIGIN.as_str(), ORIGIN),
+            ("x-forwarded-for", "not-an-ip, 203.0.113.21, 192.168.1.10"),
+        ],
+    )
+    .await;
+    assert_eq!(independent_client.status(), StatusCode::UNAUTHORIZED);
+}
+
+#[tokio::test]
+async fn malformed_forwarded_chains_are_rejected_without_proxy_lockout() {
+    let executor = TestExecutor::with_trusted_proxies(&["10.0.0.0/8"]).await;
+    executor.setup_admin().await;
+    let proxy: SocketAddr = "10.0.0.8:443".parse().expect("proxy address should parse");
+
+    for attempt in 0..6 {
+        let malformed = format!("203.0.113.{}, not-an-ip", attempt + 1);
+        let response = send_json_from(
+            executor.router(),
+            proxy,
+            Method::POST,
+            "/api/v1/session",
+            json!({ "username": format!("missing-{attempt}"), "password": PASSWORD }),
+            &[
+                (header::ORIGIN.as_str(), ORIGIN),
+                ("x-forwarded-for", &malformed),
+            ],
+        )
+        .await;
+        assert_error(response, StatusCode::UNAUTHORIZED, "unauthorized").await;
+    }
+
+    let missing = send_json_from(
+        executor.router(),
+        proxy,
+        Method::POST,
+        "/api/v1/session",
+        json!({ "username": "missing-header", "password": PASSWORD }),
+        &[(header::ORIGIN.as_str(), ORIGIN)],
+    )
+    .await;
+    assert_error(missing, StatusCode::UNAUTHORIZED, "unauthorized").await;
+
+    let all_trusted = send_json_from(
+        executor.router(),
+        proxy,
+        Method::POST,
+        "/api/v1/session",
+        json!({ "username": "all-trusted", "password": PASSWORD }),
+        &[
+            (header::ORIGIN.as_str(), ORIGIN),
+            ("x-forwarded-for", "10.0.0.9"),
+        ],
+    )
+    .await;
+    assert_error(all_trusted, StatusCode::UNAUTHORIZED, "unauthorized").await;
+
+    let valid_client = send_json_from(
+        executor.router(),
+        proxy,
+        Method::POST,
+        "/api/v1/session",
+        json!({ "username": "valid-client", "password": PASSWORD }),
+        &[
+            (header::ORIGIN.as_str(), ORIGIN),
+            ("x-forwarded-for", "203.0.113.100"),
+        ],
+    )
+    .await;
+    assert_eq!(valid_client.status(), StatusCode::UNAUTHORIZED);
+}
+
+#[tokio::test]
+async fn successful_login_clears_the_in_process_rate_limit_window() {
+    let executor = TestExecutor::new().await;
+    executor.setup_admin().await;
+    let headers = [(header::ORIGIN.as_str(), ORIGIN)];
+
+    for attempt in 0..4 {
+        let response = send_json(
+            executor.router(),
+            Method::POST,
+            "/api/v1/session",
+            json!({ "username": format!("missing-{attempt}"), "password": PASSWORD }),
+            &headers,
+        )
+        .await;
+        assert_eq!(response.status(), StatusCode::UNAUTHORIZED);
+    }
+
+    let success = send_json(
+        executor.router(),
+        Method::POST,
+        "/api/v1/session",
+        json!({ "username": "admin", "password": PASSWORD }),
+        &headers,
+    )
+    .await;
+    assert_eq!(success.status(), StatusCode::OK);
+
+    let after_success = send_json(
+        executor.router(),
+        Method::POST,
+        "/api/v1/session",
+        json!({ "username": "missing-again", "password": PASSWORD }),
+        &headers,
+    )
+    .await;
+    assert_eq!(after_success.status(), StatusCode::UNAUTHORIZED);
+}
+
+#[tokio::test]
+async fn oversized_api_bodies_are_rejected_with_the_stable_envelope() {
+    let executor = TestExecutor::new().await;
+    let response = send_raw(
+        executor.router(),
+        Method::POST,
+        "/api/v1/setup",
+        format!("{{\"padding\":\"{}\"}}", "x".repeat(17 * 1024)),
+        &[(header::ORIGIN.as_str(), ORIGIN)],
+    )
+    .await;
+
+    assert_error(response, StatusCode::PAYLOAD_TOO_LARGE, "payload_too_large").await;
+}
+
+#[tokio::test]
+async fn session_database_failures_are_internal_errors_not_logged_out_states() {
+    let executor = TestExecutor::new().await;
+    executor.setup_admin().await;
+    let admin = executor.login().await;
+    executor.app.pool().close().await;
+
+    let response = send_empty(
+        executor.router(),
+        Method::GET,
+        "/api/v1/session",
+        &[(header::COOKIE.as_str(), &admin.cookie)],
+    )
+    .await;
+    assert_error(
+        response,
+        StatusCode::INTERNAL_SERVER_ERROR,
+        "internal_error",
+    )
+    .await;
+}
+
+#[tokio::test]
+async fn api_tokens_are_revealed_once_revocable_and_gateway_only() {
+    let executor = TestExecutor::new().await;
+    executor.setup_admin().await;
+    let admin = executor.login().await;
+    let created = create_token_request(&executor, &admin, Some(ORIGIN), Some(&admin.csrf)).await;
+    assert_eq!(created.status(), StatusCode::CREATED);
+    let created_body = response_json(created).await;
+    let token = created_body["token"]
+        .as_str()
+        .expect("create should reveal the token")
+        .to_owned();
+    let token_id = created_body["id"]
+        .as_str()
+        .expect("create should return the ID")
+        .to_owned();
+
+    let listed = send_empty(
+        executor.router(),
+        Method::GET,
+        "/api/v1/tokens",
+        &[(header::COOKIE.as_str(), &admin.cookie)],
+    )
+    .await;
+    assert_eq!(listed.status(), StatusCode::OK);
+    let listed_body = response_json(listed).await;
+    assert_eq!(listed_body["tokens"].as_array().map(Vec::len), Some(1));
+    assert!(listed_body.to_string().contains("maskedToken"));
+    assert!(!listed_body.to_string().contains(&token));
+
+    let gateway = send_empty(
+        executor.router(),
+        Method::GET,
+        "/api/v1/gateway/whoami",
+        &[(header::AUTHORIZATION.as_str(), &format!("bEaReR {token}"))],
+    )
+    .await;
+    assert_eq!(gateway.status(), StatusCode::OK);
+    let gateway_body = response_json(gateway).await;
+    assert_eq!(gateway_body["tokenId"], token_id);
+    let mut last_used = None;
+    for _ in 0..100 {
+        last_used = sqlx::query_scalar::<_, Option<i64>>(
+            "SELECT last_used_at FROM api_tokens WHERE id = ?",
+        )
+        .bind(&token_id)
+        .fetch_one(executor.app.pool())
+        .await
+        .expect("last-used timestamp should be readable");
+        if last_used.is_some() {
+            break;
+        }
+        tokio::time::sleep(std::time::Duration::from_millis(10)).await;
+    }
+    assert!(last_used.is_some());
+
+    let bearer_on_control_plane = send_empty(
+        executor.router(),
+        Method::GET,
+        "/api/v1/tokens",
+        &[(header::AUTHORIZATION.as_str(), &format!("Bearer {token}"))],
+    )
+    .await;
+    assert_error(
+        bearer_on_control_plane,
+        StatusCode::UNAUTHORIZED,
+        "unauthorized",
+    )
+    .await;
+
+    let revoke = send_empty(
+        executor.router(),
+        Method::DELETE,
+        &format!("/api/v1/tokens/{token_id}"),
+        &[
+            (header::COOKIE.as_str(), &admin.cookie),
+            (header::ORIGIN.as_str(), ORIGIN),
+            ("x-executor-csrf", &admin.csrf),
+        ],
+    )
+    .await;
+    assert_eq!(revoke.status(), StatusCode::NO_CONTENT);
+
+    let revoked_gateway = send_empty(
+        executor.router(),
+        Method::GET,
+        "/api/v1/gateway/whoami",
+        &[(header::AUTHORIZATION.as_str(), &format!("Bearer {token}"))],
+    )
+    .await;
+    assert_error(revoked_gateway, StatusCode::UNAUTHORIZED, "unauthorized").await;
+}
+
+#[tokio::test]
+async fn gateway_request_logging_does_not_wait_for_the_sqlite_writer() {
+    let executor = TestExecutor::new().await;
+    executor.setup_admin().await;
+    let admin = executor.login().await;
+    let created = create_token_request(&executor, &admin, Some(ORIGIN), Some(&admin.csrf)).await;
+    assert_eq!(created.status(), StatusCode::CREATED);
+    let created_body = response_json(created).await;
+    let token = created_body["token"]
+        .as_str()
+        .expect("create should reveal the token")
+        .to_owned();
+    let token_id = created_body["id"]
+        .as_str()
+        .expect("create should return the token ID")
+        .to_owned();
+
+    let mut writer = executor
+        .app
+        .pool()
+        .acquire()
+        .await
+        .expect("test writer connection should be acquired");
+    sqlx::query("BEGIN IMMEDIATE")
+        .execute(&mut *writer)
+        .await
+        .expect("test writer should hold the SQLite write lock");
+
+    let authorization = format!("Bearer {token}");
+    let response = tokio::time::timeout(
+        std::time::Duration::from_millis(200),
+        send_json(
+            executor.router(),
+            Method::POST,
+            "/api/v1/gateway/tools/search",
+            json!({ "query": "nothing" }),
+            &[(header::AUTHORIZATION.as_str(), &authorization)],
+        ),
+    )
+    .await
+    .expect("gateway reads must return without waiting for request-log persistence");
+    assert_eq!(response.status(), StatusCode::OK);
+    let request_id = response
+        .headers()
+        .get("x-request-id")
+        .expect("gateway response should have a request ID")
+        .to_str()
+        .expect("request ID should be text")
+        .to_owned();
+
+    sqlx::query("COMMIT")
+        .execute(&mut *writer)
+        .await
+        .expect("test writer should release the SQLite write lock");
+    drop(writer);
+
+    let stored = tokio::time::timeout(std::time::Duration::from_secs(2), async {
+        loop {
+            if let Ok(stored) = executor.app.catalog().request_log(&request_id).await {
+                break stored;
+            }
+            tokio::time::sleep(std::time::Duration::from_millis(10)).await;
+        }
+    })
+    .await
+    .expect("queued request log should persist after writer contention clears");
+    assert_eq!(
+        stored.actor_api_token_id.as_deref(),
+        Some(token_id.as_str())
+    );
+    assert_eq!(stored.surface, RequestSurface::Gateway);
+    assert_eq!(stored.path_snapshot.as_deref(), Some("tools.search"));
+    assert_eq!(stored.outcome, RequestOutcome::Succeeded);
+}
+
+#[tokio::test]
+async fn token_last_used_retries_after_write_slot_contention() {
+    let executor = TestExecutor::new().await;
+    executor.setup_admin().await;
+    let admin = executor.login().await;
+
+    let first_created =
+        create_token_request(&executor, &admin, Some(ORIGIN), Some(&admin.csrf)).await;
+    assert_eq!(first_created.status(), StatusCode::CREATED);
+    let first_body = response_json(first_created).await;
+    let first_token = first_body["token"]
+        .as_str()
+        .expect("first token should be revealed")
+        .to_owned();
+    let first_token_id = first_body["id"]
+        .as_str()
+        .expect("first token ID should be returned")
+        .to_owned();
+
+    let second_created =
+        create_token_request(&executor, &admin, Some(ORIGIN), Some(&admin.csrf)).await;
+    assert_eq!(second_created.status(), StatusCode::CREATED);
+    let second_body = response_json(second_created).await;
+    let second_token = second_body["token"]
+        .as_str()
+        .expect("second token should be revealed")
+        .to_owned();
+    let second_token_id = second_body["id"]
+        .as_str()
+        .expect("second token ID should be returned")
+        .to_owned();
+
+    let mut writer = executor
+        .app
+        .pool()
+        .acquire()
+        .await
+        .expect("test writer connection should be acquired");
+    sqlx::query("BEGIN IMMEDIATE")
+        .execute(&mut *writer)
+        .await
+        .expect("test writer should hold the SQLite write lock");
+
+    let first_gateway = send_empty(
+        executor.router(),
+        Method::GET,
+        "/api/v1/gateway/whoami",
+        &[(
+            header::AUTHORIZATION.as_str(),
+            &format!("Bearer {first_token}"),
+        )],
+    )
+    .await;
+    assert_eq!(first_gateway.status(), StatusCode::OK);
+
+    let mut telemetry_writer_started = false;
+    for _ in 0..100 {
+        let checked_out_connections =
+            executor.app.pool().size() as usize - executor.app.pool().num_idle();
+        if checked_out_connections >= 2 {
+            telemetry_writer_started = true;
+            break;
+        }
+        tokio::time::sleep(std::time::Duration::from_millis(10)).await;
+    }
+    assert!(telemetry_writer_started);
+
+    let contended_gateway = send_empty(
+        executor.router(),
+        Method::GET,
+        "/api/v1/gateway/whoami",
+        &[(
+            header::AUTHORIZATION.as_str(),
+            &format!("Bearer {second_token}"),
+        )],
+    )
+    .await;
+    assert_eq!(contended_gateway.status(), StatusCode::OK);
+
+    sqlx::query("COMMIT")
+        .execute(&mut *writer)
+        .await
+        .expect("test writer should release the SQLite write lock");
+    drop(writer);
+
+    let mut first_last_used = None;
+    for _ in 0..100 {
+        first_last_used = sqlx::query_scalar::<_, Option<i64>>(
+            "SELECT last_used_at FROM api_tokens WHERE id = ?",
+        )
+        .bind(&first_token_id)
+        .fetch_one(executor.app.pool())
+        .await
+        .expect("first token last-used timestamp should be readable");
+        if first_last_used.is_some() {
+            break;
+        }
+        tokio::time::sleep(std::time::Duration::from_millis(10)).await;
+    }
+    assert!(first_last_used.is_some());
+
+    let retry_gateway = send_empty(
+        executor.router(),
+        Method::GET,
+        "/api/v1/gateway/whoami",
+        &[(
+            header::AUTHORIZATION.as_str(),
+            &format!("Bearer {second_token}"),
+        )],
+    )
+    .await;
+    assert_eq!(retry_gateway.status(), StatusCode::OK);
+
+    let mut second_last_used = None;
+    for _ in 0..100 {
+        second_last_used = sqlx::query_scalar::<_, Option<i64>>(
+            "SELECT last_used_at FROM api_tokens WHERE id = ?",
+        )
+        .bind(&second_token_id)
+        .fetch_one(executor.app.pool())
+        .await
+        .expect("second token last-used timestamp should be readable");
+        if second_last_used.is_some() {
+            break;
+        }
+        tokio::time::sleep(std::time::Duration::from_millis(10)).await;
+    }
+    assert!(second_last_used.is_some());
+}
+
+#[tokio::test]
+async fn token_names_are_counted_by_characters_and_stored_trimmed() {
+    let executor = TestExecutor::new().await;
+    executor.setup_admin().await;
+    let admin = executor.login().await;
+    let unicode_name = "é".repeat(80);
+    let idempotency_key = next_token_idempotency_key();
+    let created = send_json(
+        executor.router(),
+        Method::POST,
+        "/api/v1/tokens",
+        json!({ "name": format!("  {unicode_name}  ") }),
+        &[
+            (header::COOKIE.as_str(), &admin.cookie),
+            (header::ORIGIN.as_str(), ORIGIN),
+            ("x-executor-csrf", &admin.csrf),
+            ("idempotency-key", idempotency_key.as_str()),
+        ],
+    )
+    .await;
+    assert_eq!(created.status(), StatusCode::CREATED);
+    let body = response_json(created).await;
+    assert_eq!(body["name"], unicode_name);
+}
+
+#[tokio::test]
+async fn health_bootstrap_and_errors_have_stable_shapes() {
+    let executor = TestExecutor::new().await;
+    let health = send_empty(executor.router(), Method::GET, "/healthz", &[]).await;
+    assert_eq!(health.status(), StatusCode::OK);
+    assert!(health.headers().contains_key("x-request-id"));
+    assert_eq!(response_json(health).await, json!({ "status": "ok" }));
+
+    let health_method_mismatch = send_empty(executor.router(), Method::POST, "/healthz", &[]).await;
+    assert_error(
+        health_method_mismatch,
+        StatusCode::METHOD_NOT_ALLOWED,
+        "method_not_allowed",
+    )
+    .await;
+
+    let before = send_empty(executor.router(), Method::GET, "/api/v1/bootstrap", &[]).await;
+    assert_eq!(
+        response_json(before).await,
+        json!({ "setupRequired": true, "authenticated": false })
+    );
+
+    executor.setup_admin().await;
+    let admin = executor.login().await;
+    let after = send_empty(
+        executor.router(),
+        Method::GET,
+        "/api/v1/bootstrap",
+        &[(header::COOKIE.as_str(), &admin.cookie)],
+    )
+    .await;
+    assert_eq!(
+        response_json(after).await,
+        json!({ "setupRequired": false, "authenticated": true })
+    );
+
+    let missing = send_empty(executor.router(), Method::GET, "/api/v1/missing", &[]).await;
+    assert_error(missing, StatusCode::NOT_FOUND, "not_found").await;
+}
+
+#[tokio::test]
+async fn catalog_route_rejections_have_stable_error_envelopes() {
+    let executor = TestExecutor::new().await;
+
+    let method_mismatch = send_empty(executor.router(), Method::POST, "/api/v1/tools", &[]).await;
+    assert_error(
+        method_mismatch,
+        StatusCode::METHOD_NOT_ALLOWED,
+        "method_not_allowed",
+    )
+    .await;
+
+    executor.setup_admin().await;
+    let admin = executor.login().await;
+    let headers = [(header::COOKIE.as_str(), admin.cookie.as_str())];
+
+    let invalid_query = send_empty(
+        executor.router(),
+        Method::GET,
+        "/api/v1/tools?limit=not-a-number",
+        &headers,
+    )
+    .await;
+    assert_error(invalid_query, StatusCode::BAD_REQUEST, "invalid_query").await;
+
+    let invalid_path = send_empty(
+        executor.router(),
+        Method::GET,
+        "/api/v1/tools/%FF",
+        &headers,
+    )
+    .await;
+    assert_error(invalid_path, StatusCode::BAD_REQUEST, "invalid_path").await;
+}
+
+async fn create_token_request(
+    executor: &TestExecutor,
+    admin: &AdminSession,
+    origin: Option<&str>,
+    csrf: Option<&str>,
+) -> Response<Body> {
+    let idempotency_key = next_token_idempotency_key();
+    let mut headers = vec![(header::COOKIE.as_str(), admin.cookie.as_str())];
+    if let Some(origin) = origin {
+        headers.push((header::ORIGIN.as_str(), origin));
+    }
+    if let Some(csrf) = csrf {
+        headers.push(("x-executor-csrf", csrf));
+    }
+    headers.push(("idempotency-key", idempotency_key.as_str()));
+    send_json(
+        executor.router(),
+        Method::POST,
+        "/api/v1/tokens",
+        json!({ "name": "Automation" }),
+        &headers,
+    )
+    .await
+}
+
+fn next_token_idempotency_key() -> String {
+    format!(
+        "control-plane-token-{}",
+        TOKEN_IDEMPOTENCY_SEQUENCE.fetch_add(1, Ordering::Relaxed)
+    )
+}
+
+async fn send_json(
+    router: Router,
+    method: Method,
+    uri: &str,
+    body: Value,
+    headers: &[(&str, &str)],
+) -> Response<Body> {
+    send_raw(router, method, uri, body.to_string(), headers).await
+}
+
+async fn send_json_from(
+    router: Router,
+    peer: SocketAddr,
+    method: Method,
+    uri: &str,
+    body: Value,
+    headers: &[(&str, &str)],
+) -> Response<Body> {
+    send_raw_with_peer(router, method, uri, body.to_string(), headers, Some(peer)).await
+}
+
+async fn send_raw(
+    router: Router,
+    method: Method,
+    uri: &str,
+    body: String,
+    headers: &[(&str, &str)],
+) -> Response<Body> {
+    send_raw_with_peer(router, method, uri, body, headers, None).await
+}
+
+async fn send_raw_with_peer(
+    router: Router,
+    method: Method,
+    uri: &str,
+    body: String,
+    headers: &[(&str, &str)],
+    peer: Option<SocketAddr>,
+) -> Response<Body> {
+    let mut request = Request::builder()
+        .method(method)
+        .uri(uri)
+        .header(header::CONTENT_TYPE, "application/json");
+    for (name, value) in headers {
+        request = request.header(*name, *value);
+    }
+    let mut request = request
+        .body(Body::from(body))
+        .expect("test request should be valid");
+    if let Some(peer) = peer {
+        request.extensions_mut().insert(ConnectInfo(peer));
+    }
+    router.oneshot(request).await.expect("router should answer")
+}
+
+async fn send_empty(
+    router: Router,
+    method: Method,
+    uri: &str,
+    headers: &[(&str, &str)],
+) -> Response<Body> {
+    let mut request = Request::builder().method(method).uri(uri);
+    for (name, value) in headers {
+        request = request.header(*name, *value);
+    }
+    router
+        .oneshot(
+            request
+                .body(Body::empty())
+                .expect("test request should be valid"),
+        )
+        .await
+        .expect("router should answer")
+}
+
+fn response_cookie_header(response: &Response<Body>) -> String {
+    response
+        .headers()
+        .get_all(header::SET_COOKIE)
+        .iter()
+        .map(|value| {
+            value
+                .to_str()
+                .expect("set-cookie should be text")
+                .split(';')
+                .next()
+                .expect("set-cookie should contain a value")
+        })
+        .collect::<Vec<_>>()
+        .join("; ")
+}
+
+async fn response_json(response: Response<Body>) -> Value {
+    let bytes = response
+        .into_body()
+        .collect()
+        .await
+        .expect("response body should collect")
+        .to_bytes();
+    serde_json::from_slice(&bytes).expect("response should contain JSON")
+}
+
+async fn assert_error(response: Response<Body>, status: StatusCode, code: &str) {
+    assert_eq!(response.status(), status);
+    assert_eq!(
+        response.headers().get(header::CACHE_CONTROL),
+        Some(&header::HeaderValue::from_static("no-store"))
+    );
+    let header_request_id = response
+        .headers()
+        .get("x-request-id")
+        .expect("error should have a request ID")
+        .to_str()
+        .expect("request ID should be text")
+        .to_owned();
+    let body = response_json(response).await;
+    assert_eq!(body["error"]["code"], code);
+    assert_eq!(body["error"]["requestId"], header_request_id);
+    assert!(
+        body["error"]["message"]
+            .as_str()
+            .is_some_and(|message| !message.is_empty())
+    );
+}
diff --git a/tests/crypto.rs b/tests/crypto.rs
new file mode 100644
index 000000000..233a98c0a
--- /dev/null
+++ b/tests/crypto.rs
@@ -0,0 +1,61 @@
+use executor::crypto::{CryptoError, Keyring};
+
+#[test]
+fn xchacha_ciphertext_rejects_tampering_and_wrong_aad() {
+    let keyring = Keyring::from_master_key([7_u8; 32]).expect("key derivation should succeed");
+    let sealed = keyring
+        .encrypt("oauth-token", "source-1", b"refresh-secret")
+        .expect("encryption should succeed");
+    assert_eq!(sealed.first(), Some(&1));
+
+    let plaintext = keyring
+        .decrypt("oauth-token", "source-1", &sealed)
+        .expect("matching AAD should decrypt");
+    assert_eq!(plaintext, b"refresh-secret");
+
+    let mut tampered = sealed.clone();
+    let last = tampered.len() - 1;
+    tampered[last] ^= 0x01;
+    assert!(
+        keyring
+            .decrypt("oauth-token", "source-1", &tampered)
+            .is_err()
+    );
+    assert!(keyring.decrypt("oauth-token", "source-2", &sealed).is_err());
+    assert!(keyring.decrypt("api-key", "source-1", &sealed).is_err());
+}
+
+#[test]
+fn envelope_rejects_unsupported_versions() {
+    let keyring = Keyring::from_master_key([7_u8; 32]).expect("key derivation should succeed");
+    let mut sealed = keyring
+        .encrypt("credential", "record-1", b"secret")
+        .expect("encryption should succeed");
+    sealed[0] = 99;
+
+    assert!(matches!(
+        keyring.decrypt("credential", "record-1", &sealed),
+        Err(CryptoError::UnsupportedEnvelopeVersion(99))
+    ));
+}
+
+#[test]
+fn structured_aad_has_no_delimiter_collisions() {
+    let keyring = Keyring::from_master_key([7_u8; 32]).expect("key derivation should succeed");
+    let sealed = keyring
+        .encrypt("a:b", "c", b"secret")
+        .expect("encryption should succeed");
+
+    assert!(keyring.decrypt("a", "b:c", &sealed).is_err());
+}
+
+#[test]
+fn a_different_master_key_cannot_decrypt_ciphertext() {
+    let first = Keyring::from_master_key([1_u8; 32]).expect("key derivation should succeed");
+    let second = Keyring::from_master_key([2_u8; 32]).expect("key derivation should succeed");
+    let sealed = first
+        .encrypt("credential", "record-1", b"secret")
+        .expect("encryption should succeed");
+
+    assert!(second.decrypt("credential", "record-1", &sealed).is_err());
+}
diff --git a/tests/daemon-bootstrap.test.ts b/tests/daemon-bootstrap.test.ts
index 949cb45f4..b94e781e7 100644
--- a/tests/daemon-bootstrap.test.ts
+++ b/tests/daemon-bootstrap.test.ts
@@ -8,7 +8,7 @@ import {
   chooseDaemonPort,
   isDevCliEntrypoint,
   parseDaemonBaseUrl,
-} from "../apps/cli/src/daemon";
+} from "../legacy/cli/src/daemon";
 
 describe("daemon bootstrap helpers", () => {
   it("parses default port when none is provided", () => {
@@ -35,8 +35,8 @@ describe("daemon bootstrap helpers", () => {
   });
 
   it("treats source entrypoints as dev mode but excludes bun embedded paths", () => {
-    expect(isDevCliEntrypoint("/repo/apps/cli/src/main.ts")).toBe(true);
-    expect(isDevCliEntrypoint("/repo/apps/cli/src/main.js")).toBe(true);
+    expect(isDevCliEntrypoint("/repo/legacy/cli/src/main.ts")).toBe(true);
+    expect(isDevCliEntrypoint("/repo/legacy/cli/src/main.js")).toBe(true);
     expect(isDevCliEntrypoint("/$bunfs/root/main.js")).toBe(false);
     expect(isDevCliEntrypoint("/usr/local/bin/executor")).toBe(false);
     expect(isDevCliEntrypoint(undefined)).toBe(false);
@@ -47,14 +47,14 @@ describe("daemon bootstrap helpers", () => {
       port: 4788,
       hostname: "localhost",
       isDevMode: true,
-      scriptPath: "/repo/apps/cli/src/main.ts",
+      scriptPath: "/repo/legacy/cli/src/main.ts",
       executablePath: "/ignored",
     });
 
     expect(spec.command).toBe("bun");
     expect(spec.args).toEqual([
       "run",
-      "/repo/apps/cli/src/main.ts",
+      "/repo/legacy/cli/src/main.ts",
       "daemon",
       "run",
       "--port",
diff --git a/tests/daemon-state.test.ts b/tests/daemon-state.test.ts
index 5d0584362..c49c952f1 100644
--- a/tests/daemon-state.test.ts
+++ b/tests/daemon-state.test.ts
@@ -17,7 +17,7 @@ import {
   removeDaemonRecord,
   writeDaemonPointer,
   writeDaemonRecord,
-} from "../apps/cli/src/daemon-state";
+} from "../legacy/cli/src/daemon-state";
 
 const fileSystemError = (method: string, cause: unknown) =>
   PlatformError.systemError({
@@ -79,7 +79,7 @@ describe("daemon state", () => {
     expect(canonicalDaemonHost("localhost")).toBe("localhost");
     expect(canonicalDaemonHost("127.0.0.1")).toBe("localhost");
     expect(canonicalDaemonHost("::1")).toBe("localhost");
-    expect(canonicalDaemonHost("0.0.0.0")).toBe("localhost");
+    expect(canonicalDaemonHost("0.0.0.0")).toBe("0.0.0.0");
     expect(canonicalDaemonHost("api.example.com")).toBe("api.example.com");
   });
 
diff --git a/tests/fixtures/warden-zero-match.toml b/tests/fixtures/warden-zero-match.toml
new file mode 100644
index 000000000..8df963b9f
--- /dev/null
+++ b/tests/fixtures/warden-zero-match.toml
@@ -0,0 +1,8 @@
+version = 1
+
+[defaults]
+ignorePaths = []
+
+[[skills]]
+name = "zero-match-fixture"
+paths = ["tests/fixtures/does-not-exist/**/*.ts"]
diff --git a/tests/fixtures/web-assets/_app/immutable/assets/app.fixture.css b/tests/fixtures/web-assets/_app/immutable/assets/app.fixture.css
new file mode 100644
index 000000000..da042281f
--- /dev/null
+++ b/tests/fixtures/web-assets/_app/immutable/assets/app.fixture.css
@@ -0,0 +1,3 @@
+body {
+  color: #111827;
+}
diff --git a/tests/fixtures/web-assets/_app/immutable/entry/start.fixture.js b/tests/fixtures/web-assets/_app/immutable/entry/start.fixture.js
new file mode 100644
index 000000000..fc985cbea
--- /dev/null
+++ b/tests/fixtures/web-assets/_app/immutable/entry/start.fixture.js
@@ -0,0 +1 @@
+document.documentElement.dataset.executorFixture = "ready";
diff --git a/tests/fixtures/web-assets/index.html b/tests/fixtures/web-assets/index.html
new file mode 100644
index 000000000..b014e42e1
--- /dev/null
+++ b/tests/fixtures/web-assets/index.html
@@ -0,0 +1,15 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <title>Executor fixture</title>
+    <link rel="stylesheet" href="/_app/immutable/assets/app.fixture.css" />
+  </head>
+  <body>
+    <main>Executor embedded web fixture</main>
+    <script>
+      globalThis.__executorBootstrap = "fixture";
+    </script>
+    <script type="module" src="/_app/immutable/entry/start.fixture.js"></script>
+  </body>
+</html>
diff --git a/tests/gateway_sources.rs b/tests/gateway_sources.rs
new file mode 100644
index 000000000..c813bd7b6
--- /dev/null
+++ b/tests/gateway_sources.rs
@@ -0,0 +1,309 @@
+use std::collections::BTreeMap;
+
+use axum::{
+    Router,
+    body::Body,
+    http::{Method, Request, StatusCode, header},
+    response::Response,
+};
+use executor::{
+    AppConfig, ExecutorApp,
+    catalog::{
+        AuditContext, CatalogSnapshot, CreateSource, SourceKind, StagedTool, StagedToolBinding,
+        ToolBinding, ToolMode,
+    },
+    graphql::{GraphqlBindingV1, GraphqlOperation},
+};
+use http_body_util::BodyExt;
+use serde_json::{Map, Value, json};
+use tower::ServiceExt;
+
+const ORIGIN: &str = "http://127.0.0.1:4788";
+const PASSWORD: &str = "correct horse battery staple";
+
+struct AdminSession {
+    cookie: String,
+    csrf: String,
+}
+
+async fn send(
+    router: Router,
+    method: Method,
+    uri: &str,
+    body: Body,
+    headers: &[(&str, &str)],
+) -> Response<Body> {
+    let mut request = Request::builder().method(method).uri(uri);
+    for (name, value) in headers {
+        request = request.header(*name, *value);
+    }
+    router
+        .oneshot(request.body(body).expect("request should build"))
+        .await
+        .expect("router should answer")
+}
+
+async fn send_json(
+    router: Router,
+    method: Method,
+    uri: &str,
+    body: Value,
+    headers: &[(&str, &str)],
+) -> Response<Body> {
+    let mut headers = headers.to_vec();
+    headers.push((header::CONTENT_TYPE.as_str(), "application/json"));
+    send(router, method, uri, Body::from(body.to_string()), &headers).await
+}
+
+async fn response_json(response: Response<Body>) -> Value {
+    let bytes = response
+        .into_body()
+        .collect()
+        .await
+        .expect("response should collect")
+        .to_bytes();
+    serde_json::from_slice(&bytes).expect("response should contain JSON")
+}
+
+fn response_cookies(response: &Response<Body>) -> String {
+    response
+        .headers()
+        .get_all(header::SET_COOKIE)
+        .iter()
+        .map(|value| {
+            value
+                .to_str()
+                .expect("cookie should be text")
+                .split(';')
+                .next()
+                .expect("cookie should contain a value")
+        })
+        .collect::<Vec<_>>()
+        .join("; ")
+}
+
+async fn setup_admin(app: &ExecutorApp) -> AdminSession {
+    let response = send_json(
+        app.router(),
+        Method::POST,
+        "/api/v1/setup",
+        json!({
+            "setupToken": app.setup_token().expect("fresh app should expose a setup token"),
+            "username": "admin",
+            "password": PASSWORD,
+        }),
+        &[(header::ORIGIN.as_str(), ORIGIN)],
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::CREATED);
+
+    let response = send_json(
+        app.router(),
+        Method::POST,
+        "/api/v1/session",
+        json!({ "username": "admin", "password": PASSWORD }),
+        &[(header::ORIGIN.as_str(), ORIGIN)],
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::OK);
+    let cookie = response_cookies(&response);
+    let csrf = response_json(response).await["csrfToken"]
+        .as_str()
+        .expect("login should return a CSRF token")
+        .to_owned();
+    AdminSession { cookie, csrf }
+}
+
+async fn create_gateway_token(app: &ExecutorApp, admin: &AdminSession) -> String {
+    let response = send_json(
+        app.router(),
+        Method::POST,
+        "/api/v1/tokens",
+        json!({ "name": "Gateway source discovery" }),
+        &[
+            (header::COOKIE.as_str(), admin.cookie.as_str()),
+            (header::ORIGIN.as_str(), ORIGIN),
+            ("x-executor-csrf", admin.csrf.as_str()),
+            ("idempotency-key", "gateway-sources-token"),
+        ],
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::CREATED);
+    response_json(response).await["token"]
+        .as_str()
+        .expect("token should be revealed once")
+        .to_owned()
+}
+
+fn staged_tool(stable_key: &str, mode: ToolMode) -> StagedTool {
+    StagedTool {
+        stable_key: format!("graphql:v1:query:{stable_key}"),
+        preferred_name: stable_key.to_owned(),
+        display_name: stable_key.to_owned(),
+        description: None,
+        input_schema: json!({ "type": "object" }),
+        output_schema: None,
+        input_typescript: None,
+        output_typescript: None,
+        typescript_definitions: BTreeMap::new(),
+        intrinsic_mode: mode,
+    }
+}
+
+async fn create_source(
+    app: &ExecutorApp,
+    slug: &str,
+    display_name: &str,
+    description: Option<&str>,
+    modes: &[ToolMode],
+) {
+    let source = app
+        .catalog()
+        .create_source(
+            CreateSource {
+                kind: SourceKind::Graphql,
+                preferred_slug: slug.to_owned(),
+                display_name: display_name.to_owned(),
+                description: description.map(str::to_owned),
+                configuration: Map::new(),
+            },
+            AuditContext::system(None),
+        )
+        .await
+        .expect("source should be created");
+    let tools = modes
+        .iter()
+        .enumerate()
+        .map(|(index, mode)| staged_tool(&format!("tool_{index}"), *mode))
+        .collect::<Vec<_>>();
+    let bindings = tools
+        .iter()
+        .map(|tool| StagedToolBinding {
+            stable_key: tool.stable_key.clone(),
+            binding: ToolBinding::GraphqlV1(GraphqlBindingV1 {
+                version: 1,
+                operation: GraphqlOperation::Query,
+                field_name: tool.preferred_name.clone(),
+                operation_name: "ExecutorOperation".to_owned(),
+                variables: Vec::new(),
+                selection: Vec::new(),
+                document: format!(
+                    "query ExecutorOperation {{ result: {} }}",
+                    tool.preferred_name
+                ),
+            }),
+        })
+        .collect();
+    app.catalog()
+        .sync_catalog_with_bindings(
+            &source.id,
+            CatalogSnapshot {
+                expected_source_revision: source.revision,
+                expected_credential_revision: None,
+                artifacts: Vec::new(),
+                tools,
+            },
+            bindings,
+            AuditContext::system(None),
+        )
+        .await
+        .expect("catalog should be synchronized");
+}
+
+#[tokio::test]
+async fn gateway_sources_returns_only_the_exact_public_dto_for_callable_sources() {
+    let directory = tempfile::tempdir().expect("temporary directory should be created");
+    let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+        .await
+        .expect("Executor should open");
+    let admin = setup_admin(&app).await;
+    let token = create_gateway_token(&app, &admin).await;
+
+    create_source(
+        &app,
+        "alpha",
+        "Alpha API",
+        Some("Enabled and approval-gated operations"),
+        &[ToolMode::Enabled, ToolMode::Ask, ToolMode::Disabled],
+    )
+    .await;
+    create_source(
+        &app,
+        "disabled_only",
+        "Disabled API",
+        Some("Must not be discoverable"),
+        &[ToolMode::Disabled, ToolMode::Disabled],
+    )
+    .await;
+    create_source(&app, "zulu", "Zulu API", None, &[ToolMode::Ask]).await;
+
+    let authorization = format!("Bearer {token}");
+    let response = send(
+        app.router(),
+        Method::GET,
+        "/api/v1/gateway/sources",
+        Body::empty(),
+        &[(header::AUTHORIZATION.as_str(), authorization.as_str())],
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::OK);
+    assert_eq!(
+        response_json(response).await,
+        json!({
+            "sources": [
+                {
+                    "slug": "alpha",
+                    "displayName": "Alpha API",
+                    "description": "Enabled and approval-gated operations",
+                    "kind": "graphql",
+                    "toolCount": 2,
+                },
+                {
+                    "slug": "zulu",
+                    "displayName": "Zulu API",
+                    "description": null,
+                    "kind": "graphql",
+                    "toolCount": 1,
+                },
+            ],
+        })
+    );
+
+    app.shutdown().await;
+}
+
+#[tokio::test]
+async fn gateway_sources_rejects_missing_authentication_before_catalog_work() {
+    let directory = tempfile::tempdir().expect("temporary directory should be created");
+    let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+        .await
+        .expect("Executor should open");
+    app.pool().close().await;
+
+    let response = send(
+        app.router(),
+        Method::GET,
+        "/api/v1/gateway/sources",
+        Body::empty(),
+        &[],
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::UNAUTHORIZED);
+    let request_id = response
+        .headers()
+        .get("x-request-id")
+        .expect("authentication error should have a request ID")
+        .to_str()
+        .expect("request ID should be text")
+        .to_owned();
+    assert_eq!(
+        response_json(response).await,
+        json!({
+            "error": {
+                "code": "unauthorized",
+                "message": "A valid Executor API token is required.",
+                "requestId": request_id,
+            },
+        })
+    );
+}
diff --git a/tests/graphql_api.rs b/tests/graphql_api.rs
new file mode 100644
index 000000000..03f5cea77
--- /dev/null
+++ b/tests/graphql_api.rs
@@ -0,0 +1,242 @@
+use axum::{
+    Json, Router,
+    body::Body,
+    http::{Method, Request, StatusCode, header},
+    routing::post,
+};
+use executor::{AppConfig, ExecutorApp};
+use http_body_util::BodyExt;
+use serde_json::{Value, json};
+use tokio::net::TcpListener;
+use tower::ServiceExt;
+
+const ORIGIN: &str = "http://127.0.0.1:4788";
+
+struct Admin {
+    cookie: String,
+    csrf: String,
+}
+
+#[tokio::test]
+async fn graphql_create_redacts_the_locator_and_query_tools_invoke() {
+    let upstream = TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("GraphQL upstream binds");
+    let address = upstream.local_addr().expect("upstream address reads");
+    let upstream_router = Router::new().route(
+        "/secret-path/graphql",
+        post(|Json(request): Json<Value>| async move {
+            if request["query"]
+                .as_str()
+                .is_some_and(|query| query.contains("__schema"))
+            {
+                Json(introspection())
+            } else {
+                Json(json!({ "data": { "result": "hello" } }))
+            }
+        }),
+    );
+    let upstream_task = tokio::spawn(async move {
+        axum::serve(upstream, upstream_router)
+            .await
+            .expect("GraphQL upstream serves");
+    });
+
+    let directory = tempfile::tempdir().expect("temporary directory is created");
+    let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+        .await
+        .expect("Executor opens");
+    let admin = setup(&app).await;
+    let endpoint = format!("http://{address}/secret-path/graphql?token=query-secret");
+    let response = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/sources",
+        json!({
+            "kind": "graphql",
+            "displayName": "GraphQL test",
+            "preferredSlug": "graphql-test",
+            "endpoint": endpoint,
+            "allowPrivateNetwork": true
+        }),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::CREATED);
+    let source = body(response).await;
+    assert_eq!(
+        source["configuration"]["endpoint"],
+        format!("http://{address}/")
+    );
+    let encoded_source = source.to_string();
+    assert!(!encoded_source.contains("secret-path"));
+    assert!(!encoded_source.contains("query-secret"));
+    let source_slug = source["slug"]
+        .as_str()
+        .expect("created source has a slug")
+        .to_owned();
+
+    let tools = app
+        .catalog()
+        .list_tools(Default::default())
+        .await
+        .expect("GraphQL tools list");
+    assert_eq!(tools.items.len(), 1);
+    assert_eq!(tools.items[0].stable_key, "graphql:v1:query:hello");
+
+    let token_response = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/tokens",
+        json!({ "name": "GraphQL test" }),
+        &[
+            (header::COOKIE.as_str(), admin.cookie.as_str()),
+            (header::ORIGIN.as_str(), ORIGIN),
+            ("x-executor-csrf", admin.csrf.as_str()),
+            ("idempotency-key", "graphql-api-token"),
+        ],
+    )
+    .await;
+    let token = body(token_response).await["token"]
+        .as_str()
+        .expect("API token is returned")
+        .to_owned();
+    let authorization = format!("Bearer {token}");
+    let invoked = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/gateway/tools/invoke",
+        json!({ "path": format!("{source_slug}.hello"), "arguments": {} }),
+        &[(header::AUTHORIZATION.as_str(), authorization.as_str())],
+    )
+    .await;
+    assert_eq!(invoked.status(), StatusCode::OK);
+    let invoked = body(invoked).await;
+    assert_eq!(invoked["ok"], true);
+    assert_eq!(invoked["data"], "hello");
+
+    app.shutdown().await;
+    upstream_task.abort();
+}
+
+fn introspection() -> Value {
+    json!({
+        "data": {
+            "__schema": {
+                "queryType": { "name": "Query" },
+                "mutationType": null,
+                "subscriptionType": null,
+                "types": [
+                    {
+                        "kind": "SCALAR",
+                        "name": "String",
+                        "description": null,
+                        "fields": null,
+                        "inputFields": null,
+                        "enumValues": null
+                    },
+                    {
+                        "kind": "OBJECT",
+                        "name": "Query",
+                        "description": null,
+                        "inputFields": null,
+                        "enumValues": null,
+                        "fields": [{
+                            "name": "hello",
+                            "description": "Say hello",
+                            "isDeprecated": false,
+                            "args": [],
+                            "type": { "kind": "SCALAR", "name": "String", "ofType": null }
+                        }]
+                    }
+                ]
+            }
+        }
+    })
+}
+
+async fn setup(app: &ExecutorApp) -> Admin {
+    let setup_token = app.setup_token().expect("fresh instance has a setup token");
+    let response = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/setup",
+        json!({
+            "setupToken": setup_token,
+            "username": "admin",
+            "password": "correct horse battery staple"
+        }),
+        &[(header::ORIGIN.as_str(), ORIGIN)],
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::CREATED);
+    let response = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/session",
+        json!({ "username": "admin", "password": "correct horse battery staple" }),
+        &[(header::ORIGIN.as_str(), ORIGIN)],
+    )
+    .await;
+    let cookie = response
+        .headers()
+        .get_all(header::SET_COOKIE)
+        .iter()
+        .map(|value| {
+            value
+                .to_str()
+                .expect("cookie is text")
+                .split(';')
+                .next()
+                .expect("cookie has a value")
+        })
+        .collect::<Vec<_>>()
+        .join("; ");
+    let csrf = body(response).await["csrfToken"]
+        .as_str()
+        .expect("login returns CSRF")
+        .to_owned();
+    Admin { cookie, csrf }
+}
+
+fn admin_headers(admin: &Admin) -> [(&str, &str); 3] {
+    [
+        (header::COOKIE.as_str(), admin.cookie.as_str()),
+        (header::ORIGIN.as_str(), ORIGIN),
+        ("x-executor-csrf", admin.csrf.as_str()),
+    ]
+}
+
+async fn send(
+    router: Router,
+    method: Method,
+    uri: &str,
+    body: Value,
+    headers: &[(&str, &str)],
+) -> axum::response::Response {
+    let mut request = Request::builder()
+        .method(method)
+        .uri(uri)
+        .header(header::CONTENT_TYPE, "application/json");
+    for (name, value) in headers {
+        request = request.header(*name, *value);
+    }
+    router
+        .oneshot(
+            request
+                .body(Body::from(body.to_string()))
+                .expect("request builds"),
+        )
+        .await
+        .expect("router answers")
+}
+
+async fn body(response: axum::response::Response) -> Value {
+    let bytes = response
+        .into_body()
+        .collect()
+        .await
+        .expect("response collects")
+        .to_bytes();
+    serde_json::from_slice(&bytes).expect("response contains JSON")
+}
diff --git a/tests/invocation_preparation.rs b/tests/invocation_preparation.rs
new file mode 100644
index 000000000..110f40d27
--- /dev/null
+++ b/tests/invocation_preparation.rs
@@ -0,0 +1,273 @@
+use std::collections::BTreeMap;
+
+use executor::{
+    AppConfig, ExecutorApp,
+    catalog::{
+        ArtifactKind, AuditContext, CreateSource, CredentialPayload, InitialCatalogSnapshot,
+        SourceKind, StagedArtifact, StagedTool, StagedToolBinding, ToolBinding, ToolMode,
+    },
+    openapi::{OpenApiBinding, OpenApiSecurityAlternative},
+};
+use serde_json::{Map, json};
+
+async fn imported_source() -> (tempfile::TempDir, ExecutorApp, String, String) {
+    let directory = tempfile::tempdir().expect("temporary directory should be created");
+    let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+        .await
+        .expect("Executor should open");
+    let (source, _) = app
+        .catalog()
+        .create_source_with_catalog(
+            CreateSource {
+                kind: SourceKind::Openapi,
+                preferred_slug: "weather".to_owned(),
+                display_name: "Weather".to_owned(),
+                description: None,
+                configuration: Map::from_iter([(
+                    "displayUrl".to_owned(),
+                    json!("https://weather.example.test/openapi.json"),
+                )]),
+            },
+            &CredentialPayload {
+                schema_version: 1,
+                payload: json!({ "credentials": { "schemes": {} } }),
+            },
+            InitialCatalogSnapshot {
+                artifacts: vec![StagedArtifact {
+                    kind: ArtifactKind::OpenapiDocument,
+                    stable_key: "document".to_owned(),
+                    content: json!({ "openapi": "3.1.0" }),
+                }],
+                tools: vec![StagedTool {
+                    stable_key: "get-weather".to_owned(),
+                    preferred_name: "getWeather".to_owned(),
+                    display_name: "Get weather".to_owned(),
+                    description: None,
+                    input_schema: json!({
+                        "type": "object",
+                        "additionalProperties": false,
+                        "properties": { "query": { "type": "object" } }
+                    }),
+                    output_schema: None,
+                    input_typescript: None,
+                    output_typescript: None,
+                    typescript_definitions: BTreeMap::new(),
+                    intrinsic_mode: ToolMode::Enabled,
+                }],
+            },
+            vec![StagedToolBinding {
+                stable_key: "get-weather".to_owned(),
+                binding: ToolBinding::OpenapiV1(OpenApiBinding {
+                    version: 1,
+                    method: "GET".to_owned(),
+                    path_template: "/weather".to_owned(),
+                    server_url: "https://weather.example.test".to_owned(),
+                    parameters: Vec::new(),
+                    request_body: None,
+                    security: vec![OpenApiSecurityAlternative {
+                        requirements: Vec::new(),
+                    }],
+                }),
+            }],
+            AuditContext::system(Some("initial-import")),
+        )
+        .await
+        .expect("source should import atomically");
+    let tool = app
+        .catalog()
+        .list_tools(Default::default())
+        .await
+        .expect("tool should list")
+        .items
+        .pop()
+        .expect("tool should exist");
+    (directory, app, source.id, tool.id)
+}
+
+#[tokio::test]
+async fn invocation_preparation_is_one_typed_catalog_snapshot() {
+    let (_directory, app, source_id, tool_id) = imported_source().await;
+    let lease = app
+        .catalog()
+        .prepare_invocation("weather.get_weather")
+        .await
+        .expect("invocation should prepare");
+
+    assert_eq!(lease.lookup().source_id, source_id);
+    assert_eq!(lease.lookup().tool_id, tool_id);
+    assert_eq!(lease.source_kind(), SourceKind::Openapi);
+    assert_eq!(lease.lookup().effective_mode, ToolMode::Enabled);
+    assert!(!lease.lookup().requires_approval);
+    assert_eq!(lease.revisions().source_revision, 1);
+    assert_eq!(lease.revisions().catalog_revision, 1);
+    assert_eq!(lease.revisions().tool_revision, 0);
+    assert_eq!(lease.revisions().binding_revision, 0);
+    assert_eq!(lease.revisions().credential_revision, Some(0));
+    assert_eq!(lease.input_schema()["additionalProperties"], false);
+    assert!(lease.arguments_are_valid(&json!({ "query": {} })));
+    assert!(!lease.arguments_are_valid(&json!({ "unknown": true })));
+    assert_eq!(
+        lease.source_configuration()["displayUrl"],
+        "https://weather.example.test/openapi.json"
+    );
+    assert_eq!(
+        lease
+            .credential()
+            .expect("credential snapshot should exist")
+            .credential
+            .payload["credentials"]["schemes"],
+        json!({})
+    );
+    assert_eq!(
+        lease
+            .binding()
+            .openapi()
+            .expect("binding should be OpenAPI")
+            .method,
+        "GET"
+    );
+}
+
+#[tokio::test]
+async fn invocation_source_kind_corruption_fails_closed_for_prepare_and_revalidation() {
+    let (_directory, app, source_id, _tool_id) = imported_source().await;
+    let lease = app
+        .catalog()
+        .prepare_invocation("weather.get_weather")
+        .await
+        .expect("invocation should prepare before corruption");
+    let token = lease.revisions().clone();
+    drop(lease);
+
+    let mut connection = app
+        .pool()
+        .acquire()
+        .await
+        .expect("database connection should be acquired");
+    sqlx::query("PRAGMA ignore_check_constraints = ON")
+        .execute(&mut *connection)
+        .await
+        .expect("test should temporarily permit corrupt data");
+    sqlx::query("UPDATE sources SET kind = 'corrupt' WHERE id = ?")
+        .bind(source_id)
+        .execute(&mut *connection)
+        .await
+        .expect("source kind should be corrupted for the test");
+    sqlx::query("PRAGMA ignore_check_constraints = OFF")
+        .execute(&mut *connection)
+        .await
+        .expect("source kind constraint should be restored");
+    drop(connection);
+
+    let prepare_error = match app
+        .catalog()
+        .prepare_invocation("weather.get_weather")
+        .await
+    {
+        Err(error) => error,
+        Ok(_) => panic!("fresh preparation must reject an unknown source kind"),
+    };
+    assert!(matches!(
+        prepare_error,
+        executor::catalog::CatalogError::CorruptData("unknown source kind")
+    ));
+
+    let revalidation_error = match app.catalog().revalidate_invocation(&token).await {
+        Err(error) => error,
+        Ok(_) => panic!("revalidation must reject an unknown source kind"),
+    };
+    assert!(matches!(
+        revalidation_error,
+        executor::catalog::CatalogError::CorruptData("unknown source kind")
+    ));
+}
+
+#[tokio::test]
+async fn invocation_lease_blocks_mutation_and_old_token_revalidation_fails_after_release() {
+    let (_directory, app, _source_id, tool_id) = imported_source().await;
+    let lease = app
+        .catalog()
+        .prepare_invocation("tools.weather.get_weather")
+        .await
+        .expect("invocation should prepare");
+    let token = lease.revisions().clone();
+    let catalog = app.catalog().clone();
+    let mutation = tokio::spawn(async move {
+        catalog
+            .set_tool_mode(
+                &tool_id,
+                Some(ToolMode::Ask),
+                token.tool_revision,
+                AuditContext::system(Some("mode-during-invocation")),
+            )
+            .await
+    });
+
+    tokio::task::yield_now().await;
+    assert!(!mutation.is_finished());
+    let token = lease.revisions().clone();
+    drop(lease);
+    let changed = tokio::time::timeout(std::time::Duration::from_secs(2), mutation)
+        .await
+        .expect("writer should resume after lease release")
+        .expect("writer task should not panic")
+        .expect("mode change should succeed");
+    assert_eq!(changed.effective_mode.mode, ToolMode::Ask);
+
+    assert!(
+        app.catalog()
+            .revalidate_invocation(&token)
+            .await
+            .expect("revalidation should read")
+            .is_none()
+    );
+    let fresh = app
+        .catalog()
+        .prepare_invocation("weather.get_weather")
+        .await
+        .expect("fresh invocation should prepare");
+    assert!(fresh.lookup().requires_approval);
+    assert!(fresh.revisions().tool_revision > token.tool_revision);
+    assert!(fresh.revisions().source_revision > token.source_revision);
+}
+
+#[tokio::test]
+async fn ask_preflight_does_not_decrypt_source_credentials() {
+    let (_directory, app, _source_id, tool_id) = imported_source().await;
+    let tool = app
+        .catalog()
+        .tool(&tool_id)
+        .await
+        .expect("tool should read");
+    app.catalog()
+        .set_tool_mode(
+            &tool_id,
+            Some(ToolMode::Ask),
+            tool.revision,
+            AuditContext::system(Some("ask-preflight")),
+        )
+        .await
+        .expect("tool should become ask mode");
+    sqlx::query("UPDATE source_credentials SET payload_ciphertext = x'01020304'")
+        .execute(app.pool())
+        .await
+        .expect("credential ciphertext should be corrupted for the test");
+
+    let preflight = app
+        .catalog()
+        .preflight_invocation("weather.get_weather")
+        .await
+        .expect("ask preflight must not decrypt credentials");
+    assert!(preflight.lookup().requires_approval);
+    assert!(preflight.arguments_are_valid(&json!({ "query": {} })));
+
+    let result = app
+        .catalog()
+        .revalidate_invocation(preflight.revisions())
+        .await;
+    let error = match result {
+        Err(error) => error,
+        Ok(_) => panic!("credential decryption is deferred until approved execution"),
+    };
+    assert!(matches!(error, executor::catalog::CatalogError::Crypto(_)));
+}
diff --git a/tests/oauth_api.rs b/tests/oauth_api.rs
new file mode 100644
index 000000000..f09e4ff14
--- /dev/null
+++ b/tests/oauth_api.rs
@@ -0,0 +1,895 @@
+use std::{
+    process::Stdio,
+    sync::{
+        Arc,
+        atomic::{AtomicUsize, Ordering},
+    },
+    time::Duration,
+};
+
+use axum::{
+    Json, Router,
+    body::Body,
+    http::{Method, Request, Response, StatusCode, header},
+    routing::{get, post},
+};
+use executor::{AppConfig, ExecutorApp};
+use http_body_util::BodyExt as _;
+use reqwest::{Client, redirect::Policy};
+use serde_json::{Value, json};
+use tokio::{net::TcpListener, process::Command, time::sleep};
+use tower::ServiceExt as _;
+use url::Url;
+
+const ORIGIN: &str = "http://127.0.0.1:4788";
+
+struct TestExecutor {
+    app: ExecutorApp,
+    setup_token: String,
+}
+
+struct AdminSession {
+    cookie: String,
+    csrf: String,
+}
+
+struct OAuthTestProvider {
+    issuer: String,
+    client: Client,
+    child: tokio::process::Child,
+}
+
+struct MalformedTokenProvider {
+    issuer: String,
+    token_requests: Arc<AtomicUsize>,
+    task: tokio::task::JoinHandle<()>,
+}
+
+impl OAuthTestProvider {
+    async fn start() -> Self {
+        let listener = TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("test port reserves");
+        let port = listener.local_addr().expect("test port resolves").port();
+        drop(listener);
+
+        let executable = format!(
+            "{}/e2e/node_modules/.bin/emulate",
+            env!("CARGO_MANIFEST_DIR")
+        );
+        let mut child = Command::new(executable)
+            .args(["start", "--service", "mcp", "--port", &port.to_string()])
+            .stdin(Stdio::null())
+            .stdout(Stdio::null())
+            .stderr(Stdio::null())
+            .kill_on_drop(true)
+            .spawn()
+            .expect("OAuth emulator starts");
+        let client = Client::builder()
+            .redirect(Policy::none())
+            .build()
+            .expect("test HTTP client builds");
+        let metadata_url =
+            format!("http://127.0.0.1:{port}/.well-known/oauth-authorization-server");
+        for _ in 0..200 {
+            if let Some(status) = child.try_wait().expect("OAuth emulator status reads") {
+                panic!("OAuth emulator exited before readiness with {status}");
+            }
+            if let Ok(response) = client.get(&metadata_url).send().await
+                && response.status().is_success()
+                && let Ok(metadata) = response.json::<Value>().await
+                && let Some(issuer) = metadata["issuer"].as_str()
+            {
+                return Self {
+                    issuer: issuer.to_owned(),
+                    client,
+                    child,
+                };
+            }
+            sleep(Duration::from_millis(25)).await;
+        }
+        let _ = child.start_kill();
+        panic!("OAuth emulator did not become ready");
+    }
+
+    async fn register_client(&self, callback_url: &str) -> String {
+        let response = self
+            .client
+            .post(format!("{}/register", self.issuer))
+            .json(&json!({
+                "client_name": "Executor OAuth API test",
+                "redirect_uris": [callback_url],
+                "grant_types": ["authorization_code"],
+                "response_types": ["code"],
+                "token_endpoint_auth_method": "none"
+            }))
+            .send()
+            .await
+            .expect("OAuth client registration responds");
+        assert_eq!(response.status(), reqwest::StatusCode::CREATED);
+        response
+            .json::<Value>()
+            .await
+            .expect("OAuth registration is JSON")["client_id"]
+            .as_str()
+            .expect("OAuth registration returns client ID")
+            .to_owned()
+    }
+
+    async fn approve(&self, authorization_url: &str) -> Url {
+        let authorization_url = Url::parse(authorization_url).expect("authorization URL parses");
+        assert_eq!(authorization_url.path(), "/authorize");
+        let mut form = authorization_url
+            .query_pairs()
+            .into_owned()
+            .collect::<Vec<_>>();
+        form.push(("login".to_owned(), "admin".to_owned()));
+        let response = self
+            .client
+            .post(format!("{}/authorize/approve", self.issuer))
+            .form(&form)
+            .send()
+            .await
+            .expect("OAuth approval responds");
+        assert_eq!(response.status(), reqwest::StatusCode::FOUND);
+        Url::parse(
+            response
+                .headers()
+                .get(reqwest::header::LOCATION)
+                .expect("OAuth approval redirects")
+                .to_str()
+                .expect("OAuth redirect is text"),
+        )
+        .expect("OAuth callback URL parses")
+    }
+}
+
+impl Drop for OAuthTestProvider {
+    fn drop(&mut self) {
+        let _ = self.child.start_kill();
+    }
+}
+
+impl MalformedTokenProvider {
+    async fn start() -> Self {
+        let listener = TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("test OAuth provider binds");
+        let issuer = format!(
+            "http://{}",
+            listener.local_addr().expect("test provider address reads")
+        );
+        let metadata_issuer = issuer.clone();
+        let token_requests = Arc::new(AtomicUsize::new(0));
+        let token_request_counter = token_requests.clone();
+        let app = Router::new()
+            .route(
+                "/.well-known/oauth-authorization-server",
+                get(move || {
+                    let issuer = metadata_issuer.clone();
+                    async move {
+                        Json(json!({
+                            "issuer": issuer.clone(),
+                            "authorization_endpoint": format!("{issuer}/authorize"),
+                            "token_endpoint": format!("{issuer}/token"),
+                            "scopes_supported": ["read"],
+                            "response_types_supported": ["code"],
+                            "grant_types_supported": ["authorization_code"],
+                            "code_challenge_methods_supported": ["S256"],
+                            "token_endpoint_auth_methods_supported": ["none"]
+                        }))
+                    }
+                }),
+            )
+            .route(
+                "/token",
+                post(move || {
+                    let attempt = token_request_counter.fetch_add(1, Ordering::SeqCst);
+                    async move {
+                        if attempt == 0 {
+                            Json(json!({
+                                "access_token": "malformed-access-token-marker",
+                                "token_type": "Bearer",
+                                "expires_in": 3600,
+                                "scope": "read unrequested"
+                            }))
+                        } else {
+                            Json(json!({
+                                "access_token": "valid-access-token-marker",
+                                "refresh_token": "valid-refresh-token-marker",
+                                "token_type": "Bearer",
+                                "expires_in": 3600,
+                                "scope": "read"
+                            }))
+                        }
+                    }
+                }),
+            );
+        let task = tokio::spawn(async move {
+            axum::serve(listener, app)
+                .await
+                .expect("test OAuth provider serves");
+        });
+        Self {
+            issuer,
+            token_requests,
+            task,
+        }
+    }
+}
+
+impl Drop for MalformedTokenProvider {
+    fn drop(&mut self) {
+        self.task.abort();
+    }
+}
+
+impl TestExecutor {
+    async fn new() -> Self {
+        let directory = tempfile::tempdir().expect("temporary data directory");
+        let path = directory.keep();
+        let app = ExecutorApp::open(AppConfig::new(path))
+            .await
+            .expect("Executor opens");
+        let setup_token = app
+            .setup_token()
+            .expect("fresh Executor has a setup token")
+            .to_owned();
+        Self { app, setup_token }
+    }
+
+    async fn setup_and_login(&self) -> AdminSession {
+        let setup = send_json(
+            self.app.router(),
+            Method::POST,
+            "/api/v1/setup",
+            json!({
+                "setupToken": self.setup_token,
+                "username": "admin",
+                "password": "correct horse battery staple"
+            }),
+            &[(header::ORIGIN.as_str(), ORIGIN)],
+        )
+        .await;
+        assert_eq!(setup.status(), StatusCode::CREATED);
+
+        let login = send_json(
+            self.app.router(),
+            Method::POST,
+            "/api/v1/session",
+            json!({
+                "username": "admin",
+                "password": "correct horse battery staple"
+            }),
+            &[(header::ORIGIN.as_str(), ORIGIN)],
+        )
+        .await;
+        assert_eq!(login.status(), StatusCode::OK);
+        let cookie = response_cookie_header(&login);
+        let body = response_json(login).await;
+        let csrf = body["csrfToken"]
+            .as_str()
+            .expect("login returns CSRF token")
+            .to_owned();
+        AdminSession { cookie, csrf }
+    }
+
+    async fn insert_source(&self) {
+        self.insert_source_at("https://api.example.test/mcp", false)
+            .await;
+    }
+
+    async fn insert_source_at(&self, endpoint: &str, allow_private_network: bool) {
+        sqlx::query(
+            "INSERT INTO sources (
+                id, kind, slug, display_name, configuration_json,
+                revision, catalog_revision, created_at, updated_at
+             ) VALUES (?, 'mcp_http', 'oauth_test', 'OAuth test', ?, 0, 0, 1, 1)",
+        )
+        .bind("source-oauth-test")
+        .bind(
+            json!({
+                "endpoint": endpoint,
+                "allowPrivateNetwork": allow_private_network,
+                "negotiatedProtocolVersion": "2025-11-25"
+            })
+            .to_string(),
+        )
+        .execute(self.app.pool())
+        .await
+        .expect("test source inserts");
+    }
+
+    async fn insert_oauth_connection(&self) {
+        let mut transaction = self.app.pool().begin().await.expect("transaction begins");
+        sqlx::query(
+            "INSERT INTO oauth_connections (
+                id, source_id, credential_key, revision, current_config_revision,
+                current_secret_revision, status, granted_scopes_json,
+                has_client_secret, has_refresh_token, created_at, updated_at
+             ) VALUES (?, ?, 'default', 1, 1, NULL, 'pending_authorization',
+                       '[]', 0, 0, 1, 1)",
+        )
+        .bind("oauth-connection-test")
+        .bind("source-oauth-test")
+        .execute(&mut *transaction)
+        .await
+        .expect("OAuth connection inserts");
+        sqlx::query(
+            "INSERT INTO oauth_connection_config_revisions (
+                connection_id, revision, config_json, created_at
+             ) VALUES (?, 1, ?, 1)",
+        )
+        .bind("oauth-connection-test")
+        .bind(
+            json!({
+                "issuer": "https://issuer.example.test",
+                "authorization_endpoint": "https://issuer.example.test/authorize",
+                "token_endpoint": "https://issuer.example.test/token",
+                "client_id": "public-client",
+                "client_authentication": "none",
+                "token_endpoint_auth_methods_supported": ["none"],
+                "scopes": ["read"],
+                "allow_private_network": false
+            })
+            .to_string(),
+        )
+        .execute(&mut *transaction)
+        .await
+        .expect("OAuth config inserts");
+        transaction.commit().await.expect("transaction commits");
+    }
+}
+
+#[tokio::test]
+async fn oauth_routes_use_admin_and_csrf_boundaries() {
+    let executor = TestExecutor::new().await;
+    let admin = executor.setup_and_login().await;
+    executor.insert_source().await;
+
+    let unauthorized = send_empty(
+        executor.app.router(),
+        Method::GET,
+        "/api/v1/sources/source-oauth-test/oauth",
+        &[],
+    )
+    .await;
+    assert_eq!(unauthorized.status(), StatusCode::UNAUTHORIZED);
+
+    let listed = send_empty(
+        executor.app.router(),
+        Method::GET,
+        "/api/v1/sources/source-oauth-test/oauth",
+        &[(header::COOKIE.as_str(), &admin.cookie)],
+    )
+    .await;
+    assert_eq!(listed.status(), StatusCode::OK);
+    assert_eq!(
+        response_json(listed).await,
+        json!({
+            "connections": [],
+            "availableCredentials": [{
+                "credentialKey": "default",
+                "protocol": "mcp_http",
+                "requestedScopes": [],
+                "managedOAuthEligible": true
+            }]
+        })
+    );
+
+    let input = json!({
+        "expectedRevision": 0,
+        "discovery": { "type": "issuer", "issuer": "https://issuer.example.test" },
+        "client": { "clientId": "public-client", "authentication": "none" },
+        "scopes": ["openid"]
+    });
+    let missing_csrf = send_json(
+        executor.app.router(),
+        Method::PUT,
+        "/api/v1/sources/source-oauth-test/oauth/default",
+        input.clone(),
+        &[(header::COOKIE.as_str(), &admin.cookie)],
+    )
+    .await;
+    assert_eq!(missing_csrf.status(), StatusCode::FORBIDDEN);
+
+    let malformed_issuer = send_json(
+        executor.app.router(),
+        Method::PUT,
+        "/api/v1/sources/source-oauth-test/oauth/default",
+        json!({
+            "expectedRevision": 0,
+            "discovery": { "type": "issuer", "issuer": "not a valid issuer" },
+            "client": { "clientId": "public-client", "authentication": "none" },
+            "scopes": []
+        }),
+        &[
+            (header::COOKIE.as_str(), &admin.cookie),
+            (header::ORIGIN.as_str(), ORIGIN),
+            ("x-executor-csrf", &admin.csrf),
+        ],
+    )
+    .await;
+    assert_eq!(malformed_issuer.status(), StatusCode::BAD_REQUEST);
+    assert_eq!(
+        response_json(malformed_issuer).await["error"]["code"],
+        "invalid_oauth_url"
+    );
+
+    let ineligible = send_json(
+        executor.app.router(),
+        Method::PUT,
+        "/api/v1/sources/source-oauth-test/oauth/not-a-protocol-credential",
+        input.clone(),
+        &[
+            (header::COOKIE.as_str(), &admin.cookie),
+            (header::ORIGIN.as_str(), ORIGIN),
+            ("x-executor-csrf", &admin.csrf),
+        ],
+    )
+    .await;
+    assert_eq!(ineligible.status(), StatusCode::BAD_REQUEST);
+    assert_eq!(
+        response_json(ineligible).await["error"]["code"],
+        "oauth_credential_ineligible"
+    );
+
+    let ineligible_authorization = send_json(
+        executor.app.router(),
+        Method::POST,
+        "/api/v1/sources/source-oauth-test/oauth/not-a-protocol-credential/authorize",
+        json!({ "expectedRevision": 0 }),
+        &[
+            (header::COOKIE.as_str(), &admin.cookie),
+            (header::ORIGIN.as_str(), ORIGIN),
+            ("x-executor-csrf", &admin.csrf),
+        ],
+    )
+    .await;
+    assert_eq!(ineligible_authorization.status(), StatusCode::BAD_REQUEST);
+    assert_eq!(
+        response_json(ineligible_authorization).await["error"]["code"],
+        "oauth_credential_ineligible"
+    );
+
+    let rejected_scope = send_json(
+        executor.app.router(),
+        Method::PUT,
+        "/api/v1/sources/source-oauth-test/oauth/default",
+        input,
+        &[
+            (header::COOKIE.as_str(), &admin.cookie),
+            (header::ORIGIN.as_str(), ORIGIN),
+            ("x-executor-csrf", &admin.csrf),
+        ],
+    )
+    .await;
+    assert_eq!(rejected_scope.status(), StatusCode::BAD_REQUEST);
+    assert_eq!(
+        response_json(rejected_scope).await["error"]["code"],
+        "oauth_openid_unsupported"
+    );
+
+    executor.insert_oauth_connection().await;
+    let disconnected = send_json(
+        executor.app.router(),
+        Method::POST,
+        "/api/v1/sources/source-oauth-test/oauth/default/disconnect",
+        json!({ "expectedRevision": 1 }),
+        &[
+            (header::COOKIE.as_str(), &admin.cookie),
+            (header::ORIGIN.as_str(), ORIGIN),
+            ("x-executor-csrf", &admin.csrf),
+        ],
+    )
+    .await;
+    assert_eq!(disconnected.status(), StatusCode::OK);
+    let disconnected = response_json(disconnected).await;
+    assert_eq!(disconnected["credentialKey"], "default");
+    assert_eq!(disconnected["managedOAuthEligible"], true);
+}
+
+#[tokio::test]
+async fn callback_failures_redirect_without_reflecting_callback_secrets() {
+    let executor = TestExecutor::new().await;
+    let response = send_empty(
+        executor.app.router(),
+        Method::GET,
+        "/api/v1/oauth/callback/opaque-connection?state=state-secret&code=code-secret",
+        &[],
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::SEE_OTHER);
+    let location = response
+        .headers()
+        .get(header::LOCATION)
+        .expect("callback redirects")
+        .to_str()
+        .expect("redirect is text");
+    assert_eq!(
+        location,
+        "http://127.0.0.1:4788/sources?oauth=opaque%2Dconnection&result=failed"
+    );
+    assert!(!location.contains("state-secret"));
+    assert!(!location.contains("code-secret"));
+    assert_eq!(
+        response.headers().get(header::REFERRER_POLICY),
+        Some(&header::HeaderValue::from_static("no-referrer"))
+    );
+    assert_eq!(
+        response.headers().get(header::CACHE_CONTROL),
+        Some(&header::HeaderValue::from_static("no-store"))
+    );
+}
+
+#[tokio::test]
+async fn malformed_successful_token_response_terminalizes_the_claim_and_allows_retry() {
+    let provider = MalformedTokenProvider::start().await;
+    let executor = TestExecutor::new().await;
+    let admin = executor.setup_and_login().await;
+    executor
+        .insert_source_at(&format!("{}/mcp", provider.issuer), true)
+        .await;
+    let mutation_headers = [
+        (header::COOKIE.as_str(), admin.cookie.as_str()),
+        (header::ORIGIN.as_str(), ORIGIN),
+        ("x-executor-csrf", admin.csrf.as_str()),
+    ];
+    let configured = send_json(
+        executor.app.router(),
+        Method::PUT,
+        "/api/v1/sources/source-oauth-test/oauth/default",
+        json!({
+            "expectedRevision": 0,
+            "discovery": { "type": "issuer", "issuer": provider.issuer.clone() },
+            "client": { "clientId": "public-client", "authentication": "none" },
+            "scopes": ["read"]
+        }),
+        &mutation_headers,
+    )
+    .await;
+    assert_eq!(configured.status(), StatusCode::OK);
+    let configured = response_json(configured).await;
+    let connection_id = configured["id"]
+        .as_str()
+        .expect("configured connection has ID")
+        .to_owned();
+
+    let malformed = begin_and_complete_authorization(
+        &executor,
+        &admin,
+        &connection_id,
+        configured["revision"]
+            .as_i64()
+            .expect("configured connection has revision"),
+        "first-code",
+    )
+    .await;
+    assert_eq!(malformed.status(), StatusCode::SEE_OTHER);
+    let malformed_location = malformed
+        .headers()
+        .get(header::LOCATION)
+        .expect("failed callback redirects")
+        .to_str()
+        .expect("failed callback location is text");
+    assert!(malformed_location.ends_with("&result=failed"));
+    assert!(!malformed_location.contains("malformed-access-token-marker"));
+
+    let failed = sqlx::query_as::<_, (i64, String, Option<i64>, Option<String>)>(
+        "SELECT revision, status, current_secret_revision, error_code
+         FROM oauth_connections WHERE id = ?",
+    )
+    .bind(&connection_id)
+    .fetch_one(executor.app.pool())
+    .await
+    .expect("failed connection state reads");
+    assert_eq!(failed.1, "pending_authorization");
+    assert_eq!(failed.2, None);
+    assert_eq!(failed.3.as_deref(), Some("oauth_scope_escalation"));
+    assert_eq!(
+        sqlx::query_scalar::<_, String>(
+            "SELECT status FROM oauth_authorization_transactions
+             WHERE connection_id = ? ORDER BY created_at DESC LIMIT 1",
+        )
+        .bind(&connection_id)
+        .fetch_one(executor.app.pool())
+        .await
+        .expect("failed authorization transaction reads"),
+        "failed"
+    );
+
+    let retried = begin_and_complete_authorization(
+        &executor,
+        &admin,
+        &connection_id,
+        failed.0,
+        "second-code",
+    )
+    .await;
+    assert_eq!(retried.status(), StatusCode::SEE_OTHER);
+    let retry_location = retried
+        .headers()
+        .get(header::LOCATION)
+        .expect("successful callback redirects")
+        .to_str()
+        .expect("successful callback location is text");
+    assert!(retry_location.ends_with("&result=success_refresh_failed"));
+
+    let active = sqlx::query_as::<_, (String, Option<i64>, Option<String>)>(
+        "SELECT status, current_secret_revision, error_code
+         FROM oauth_connections WHERE id = ?",
+    )
+    .bind(&connection_id)
+    .fetch_one(executor.app.pool())
+    .await
+    .expect("retried connection state reads");
+    assert_eq!(active.0, "active");
+    assert!(active.1.is_some());
+    assert_eq!(active.2, None);
+    assert_eq!(provider.token_requests.load(Ordering::SeqCst), 2);
+}
+
+#[tokio::test]
+async fn callback_catalog_refresh_failure_preserves_the_authorized_connection() {
+    let provider = OAuthTestProvider::start().await;
+    let executor = TestExecutor::new().await;
+    let admin = executor.setup_and_login().await;
+    executor
+        .insert_source_at(&format!("{}/missing", provider.issuer), true)
+        .await;
+    let mutation_headers = [
+        (header::COOKIE.as_str(), admin.cookie.as_str()),
+        (header::ORIGIN.as_str(), ORIGIN),
+        ("x-executor-csrf", admin.csrf.as_str()),
+    ];
+    let connection_input = |expected_revision, client_id: &str| {
+        json!({
+            "expectedRevision": expected_revision,
+            "discovery": { "type": "issuer", "issuer": provider.issuer },
+            "client": { "clientId": client_id, "authentication": "none" },
+            "scopes": ["repo", "read:user"]
+        })
+    };
+
+    let placeholder = send_json(
+        executor.app.router(),
+        Method::PUT,
+        "/api/v1/sources/source-oauth-test/oauth/default",
+        connection_input(0, "pending-dynamic-registration"),
+        &mutation_headers,
+    )
+    .await;
+    assert_eq!(placeholder.status(), StatusCode::OK);
+    let placeholder = response_json(placeholder).await;
+    let connection_id = placeholder["id"]
+        .as_str()
+        .expect("placeholder connection has ID")
+        .to_owned();
+    let callback_url = placeholder["callbackUrl"]
+        .as_str()
+        .expect("placeholder connection has callback URL");
+    let client_id = provider.register_client(callback_url).await;
+
+    let configured = send_json(
+        executor.app.router(),
+        Method::PUT,
+        "/api/v1/sources/source-oauth-test/oauth/default",
+        connection_input(
+            placeholder["revision"]
+                .as_i64()
+                .expect("placeholder has revision"),
+            &client_id,
+        ),
+        &mutation_headers,
+    )
+    .await;
+    assert_eq!(configured.status(), StatusCode::OK);
+    let configured = response_json(configured).await;
+    let authorization = send_json(
+        executor.app.router(),
+        Method::POST,
+        "/api/v1/sources/source-oauth-test/oauth/default/authorize",
+        json!({
+            "expectedRevision": configured["revision"]
+                .as_i64()
+                .expect("configured connection has revision")
+        }),
+        &mutation_headers,
+    )
+    .await;
+    assert_eq!(authorization.status(), StatusCode::OK);
+    let authorization = response_json(authorization).await;
+    let provider_callback = provider
+        .approve(
+            authorization["authorizationUrl"]
+                .as_str()
+                .expect("authorization URL returns"),
+        )
+        .await;
+    assert_eq!(provider_callback.origin().ascii_serialization(), ORIGIN);
+    let callback_uri = provider_callback.query().map_or_else(
+        || provider_callback.path().to_owned(),
+        |query| format!("{}?{query}", provider_callback.path()),
+    );
+
+    let callback = send_empty(
+        executor.app.router(),
+        Method::GET,
+        &callback_uri,
+        &[(header::COOKIE.as_str(), &admin.cookie)],
+    )
+    .await;
+    assert_eq!(callback.status(), StatusCode::SEE_OTHER);
+    assert_eq!(
+        callback.headers().get(header::REFERRER_POLICY),
+        Some(&header::HeaderValue::from_static("no-referrer"))
+    );
+    assert_eq!(
+        callback.headers().get(header::CACHE_CONTROL),
+        Some(&header::HeaderValue::from_static("no-store"))
+    );
+    let redirect = Url::parse(
+        callback
+            .headers()
+            .get(header::LOCATION)
+            .expect("callback redirects")
+            .to_str()
+            .expect("callback redirect is text"),
+    )
+    .expect("callback redirect parses");
+    assert_eq!(redirect.query_pairs().count(), 2);
+    assert_eq!(
+        redirect
+            .query_pairs()
+            .find(|(key, _)| key == "oauth")
+            .unwrap()
+            .1,
+        connection_id
+    );
+    assert_eq!(
+        redirect
+            .query_pairs()
+            .find(|(key, _)| key == "result")
+            .unwrap()
+            .1,
+        "success_refresh_failed"
+    );
+    assert!(!redirect.as_str().contains("code="));
+    assert!(!redirect.as_str().contains("state="));
+
+    let listed = send_empty(
+        executor.app.router(),
+        Method::GET,
+        "/api/v1/sources/source-oauth-test/oauth",
+        &[(header::COOKIE.as_str(), &admin.cookie)],
+    )
+    .await;
+    assert_eq!(listed.status(), StatusCode::OK);
+    let listed = response_json(listed).await;
+    assert_eq!(listed["connections"][0]["id"], connection_id);
+    assert_eq!(listed["connections"][0]["status"], "connected");
+    assert!(listed["connections"][0]["authorizedAt"].is_i64());
+    assert_eq!(listed["connections"][0]["errorCode"], Value::Null);
+
+    let persisted = sqlx::query_as::<_, (String, Option<i64>, Option<String>)>(
+        "SELECT status, authorized_at, error_code FROM oauth_connections WHERE id = ?",
+    )
+    .bind(&connection_id)
+    .fetch_one(executor.app.pool())
+    .await
+    .expect("authorized connection persists");
+    assert_eq!(persisted.0, "active");
+    assert!(persisted.1.is_some());
+    assert_eq!(persisted.2, None);
+}
+
+async fn begin_and_complete_authorization(
+    executor: &TestExecutor,
+    admin: &AdminSession,
+    connection_id: &str,
+    expected_revision: i64,
+    code: &str,
+) -> Response<Body> {
+    let authorization = send_json(
+        executor.app.router(),
+        Method::POST,
+        "/api/v1/sources/source-oauth-test/oauth/default/authorize",
+        json!({ "expectedRevision": expected_revision }),
+        &[
+            (header::COOKIE.as_str(), admin.cookie.as_str()),
+            (header::ORIGIN.as_str(), ORIGIN),
+            ("x-executor-csrf", admin.csrf.as_str()),
+        ],
+    )
+    .await;
+    assert_eq!(authorization.status(), StatusCode::OK);
+    let authorization = response_json(authorization).await;
+    let authorization_url = Url::parse(
+        authorization["authorizationUrl"]
+            .as_str()
+            .expect("authorization URL returns"),
+    )
+    .expect("authorization URL parses");
+    let state = authorization_url
+        .query_pairs()
+        .find(|(key, _)| key == "state")
+        .expect("authorization URL has state")
+        .1
+        .into_owned();
+    let mut query = url::form_urlencoded::Serializer::new(String::new());
+    query.append_pair("state", &state).append_pair("code", code);
+    let query = query.finish();
+    send_empty(
+        executor.app.router(),
+        Method::GET,
+        &format!("/api/v1/oauth/callback/{connection_id}?{query}"),
+        &[(header::COOKIE.as_str(), admin.cookie.as_str())],
+    )
+    .await
+}
+
+async fn send_json(
+    router: axum::Router,
+    method: Method,
+    uri: &str,
+    body: Value,
+    headers: &[(&str, &str)],
+) -> Response<Body> {
+    send_raw(router, method, uri, Body::from(body.to_string()), headers).await
+}
+
+async fn send_empty(
+    router: axum::Router,
+    method: Method,
+    uri: &str,
+    headers: &[(&str, &str)],
+) -> Response<Body> {
+    send_raw(router, method, uri, Body::empty(), headers).await
+}
+
+async fn send_raw(
+    router: axum::Router,
+    method: Method,
+    uri: &str,
+    body: Body,
+    headers: &[(&str, &str)],
+) -> Response<Body> {
+    let mut request = Request::builder()
+        .method(method)
+        .uri(uri)
+        .header(header::CONTENT_TYPE, "application/json");
+    for (name, value) in headers {
+        request = request.header(*name, *value);
+    }
+    router
+        .oneshot(request.body(body).expect("request is valid"))
+        .await
+        .expect("router responds")
+}
+
+fn response_cookie_header(response: &Response<Body>) -> String {
+    response
+        .headers()
+        .get_all(header::SET_COOKIE)
+        .iter()
+        .map(|value| {
+            value
+                .to_str()
+                .expect("cookie is text")
+                .split(';')
+                .next()
+                .expect("cookie has value")
+        })
+        .collect::<Vec<_>>()
+        .join("; ")
+}
+
+async fn response_json(response: Response<Body>) -> Value {
+    let bytes = response
+        .into_body()
+        .collect()
+        .await
+        .expect("body collects")
+        .to_bytes();
+    serde_json::from_slice(&bytes).expect("response is JSON")
+}
diff --git a/tests/openapi_api.rs b/tests/openapi_api.rs
new file mode 100644
index 000000000..6a22b1acc
--- /dev/null
+++ b/tests/openapi_api.rs
@@ -0,0 +1,1156 @@
+use std::net::SocketAddr;
+
+use axum::{
+    Json, Router,
+    body::Body,
+    http::{Method, Request, StatusCode, header},
+    routing::get,
+};
+use executor::catalog::{AuditContext, ToolMode};
+use executor::{AppConfig, ExecutorApp};
+use http_body_util::BodyExt;
+use serde_json::{Value, json};
+use tokio::net::TcpListener;
+use tower::ServiceExt;
+
+const ORIGIN: &str = "http://127.0.0.1:4788";
+
+struct Admin {
+    cookie: String,
+    csrf: String,
+}
+
+#[tokio::test]
+async fn source_import_rejects_an_unsupported_openapi_31_schema_dialect_without_writes() {
+    let directory = tempfile::tempdir().expect("temporary directory should be created");
+    let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+        .await
+        .expect("Executor should open");
+    let admin = setup(&app).await;
+    let specification = json!({
+        "openapi": "3.1.0",
+        "jsonSchemaDialect": "https://example.test/custom-dialect",
+        "info": { "title": "Unsupported dialect", "version": "1" },
+        "paths": {
+            "/items": {
+                "get": {
+                    "operationId": "listItems",
+                    "responses": { "200": { "description": "ok" } }
+                }
+            }
+        }
+    });
+    let response = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/sources",
+        json!({
+            "kind": "openapi",
+            "displayName": "Unsupported dialect",
+            "preferredSlug": "unsupported-dialect",
+            "spec": { "type": "inline", "content": specification.to_string() }
+        }),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
+    assert_eq!(
+        body(response).await["error"]["code"],
+        "invalid_openapi_document"
+    );
+    assert!(
+        app.catalog()
+            .list_sources()
+            .await
+            .expect("sources should list")
+            .is_empty()
+    );
+}
+
+async fn send(
+    router: Router,
+    method: Method,
+    uri: &str,
+    body: Value,
+    headers: &[(&str, &str)],
+) -> axum::response::Response {
+    let mut request = Request::builder()
+        .method(method)
+        .uri(uri)
+        .header(header::CONTENT_TYPE, "application/json");
+    for (name, value) in headers {
+        request = request.header(*name, *value);
+    }
+    router
+        .oneshot(
+            request
+                .body(Body::from(body.to_string()))
+                .expect("request should build"),
+        )
+        .await
+        .expect("router should answer")
+}
+
+async fn send_raw(
+    router: Router,
+    method: Method,
+    uri: &str,
+    raw_body: String,
+    headers: &[(&str, &str)],
+) -> axum::response::Response {
+    let mut request = Request::builder()
+        .method(method)
+        .uri(uri)
+        .header(header::CONTENT_TYPE, "application/json");
+    for (name, value) in headers {
+        request = request.header(*name, *value);
+    }
+    router
+        .oneshot(
+            request
+                .body(Body::from(raw_body))
+                .expect("request should build"),
+        )
+        .await
+        .expect("router should answer")
+}
+
+async fn body(response: axum::response::Response) -> Value {
+    let bytes = response
+        .into_body()
+        .collect()
+        .await
+        .expect("response should collect")
+        .to_bytes();
+    serde_json::from_slice(&bytes).expect("response should contain JSON")
+}
+
+fn cookies(response: &axum::response::Response) -> String {
+    response
+        .headers()
+        .get_all(header::SET_COOKIE)
+        .iter()
+        .map(|value| {
+            value
+                .to_str()
+                .expect("cookie should be text")
+                .split(';')
+                .next()
+                .expect("cookie should have a value")
+        })
+        .collect::<Vec<_>>()
+        .join("; ")
+}
+
+fn assert_json_content_type(response: &axum::response::Response) {
+    assert_eq!(
+        response
+            .headers()
+            .get(header::CONTENT_TYPE)
+            .and_then(|value| value.to_str().ok()),
+        Some("application/json")
+    );
+}
+
+async fn setup(app: &ExecutorApp) -> Admin {
+    let setup_token = app
+        .setup_token()
+        .expect("fresh instance should have a setup token");
+    let response = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/setup",
+        json!({
+            "setupToken": setup_token,
+            "username": "admin",
+            "password": "correct horse battery staple"
+        }),
+        &[(header::ORIGIN.as_str(), ORIGIN)],
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::CREATED);
+
+    let response = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/session",
+        json!({ "username": "admin", "password": "correct horse battery staple" }),
+        &[(header::ORIGIN.as_str(), ORIGIN)],
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::OK);
+    let cookie = cookies(&response);
+    let csrf = body(response).await["csrfToken"]
+        .as_str()
+        .expect("login should return a CSRF token")
+        .to_owned();
+    Admin { cookie, csrf }
+}
+
+fn admin_headers(admin: &Admin) -> [(&str, &str); 3] {
+    [
+        (header::COOKIE.as_str(), admin.cookie.as_str()),
+        (header::ORIGIN.as_str(), ORIGIN),
+        ("x-executor-csrf", admin.csrf.as_str()),
+    ]
+}
+
+#[tokio::test]
+async fn preview_import_and_invoke_enforce_planes_modes_and_body_limits() {
+    let upstream = TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("upstream listener should bind");
+    let address = upstream.local_addr().expect("upstream address should read");
+    let upstream_router = Router::new().route(
+        "/api/hello",
+        get(|| async { Json(json!({ "message": "hello" })) }),
+    );
+    let upstream_task = tokio::spawn(async move {
+        axum::serve(upstream, upstream_router)
+            .await
+            .expect("upstream should serve");
+    });
+
+    let directory = tempfile::tempdir().expect("temporary directory should be created");
+    let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+        .await
+        .expect("Executor should open");
+    let admin = setup(&app).await;
+    let padding = "x".repeat(20_000);
+    let specification = json!({
+        "openapi": "3.1.0",
+        "info": { "title": "Local API", "description": padding },
+        "servers": [{ "url": format!("http://{address}/api") }],
+        "security": [{ "ApiKey": [] }, {}],
+        "components": {
+            "securitySchemes": {
+                "ApiKey": { "type": "apiKey", "in": "header", "name": "X-API-Key" }
+            }
+        },
+        "paths": {
+            "/hello": {
+                "get": {
+                    "operationId": "hello",
+                    "parameters": [{
+                        "name": "X-Padding",
+                        "in": "header",
+                        "schema": { "type": "string" }
+                    }],
+                    "responses": { "200": { "description": "ok", "content": { "application/json": { "schema": { "type": "object" } } } } }
+                }
+            },
+            "/write": {
+                "post": {
+                    "operationId": "write",
+                    "responses": { "204": { "description": "ok" } }
+                }
+            }
+        }
+    })
+    .to_string();
+
+    let unauthenticated = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/sources/openapi/preview",
+        json!({ "spec": { "type": "inline", "content": specification } }),
+        &[],
+    )
+    .await;
+    assert_eq!(unauthenticated.status(), StatusCode::FORBIDDEN);
+
+    let preview = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/sources/openapi/preview",
+        json!({
+            "spec": { "type": "inline", "content": specification },
+            "allowPrivateNetwork": true
+        }),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(preview.status(), StatusCode::OK);
+    let preview = body(preview).await;
+    assert_eq!(preview["toolCount"], 2);
+    assert_eq!(preview["securitySchemes"][0]["name"], "ApiKey");
+    assert_eq!(preview["securitySchemes"][0]["credentialType"], "api_key");
+    assert_eq!(preview["tools"][0]["security"][0], json!(["ApiKey"]));
+
+    let missing_inline_server = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/sources/openapi/preview",
+        json!({
+            "spec": {
+                "type": "inline",
+                "content": json!({
+                    "openapi": "3.1.0",
+                    "info": { "title": "No server" },
+                    "paths": { "/x": { "get": { "responses": {} } } }
+                }).to_string()
+            }
+        }),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(missing_inline_server.status(), StatusCode::BAD_REQUEST);
+    assert_eq!(
+        body(missing_inline_server).await["error"]["code"],
+        "inline_openapi_server_required"
+    );
+    let missing_server_create = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/sources",
+        json!({
+            "kind": "openapi",
+            "displayName": "No server",
+            "spec": {
+                "type": "inline",
+                "content": json!({
+                    "openapi": "3.1.0",
+                    "info": { "title": "No server" },
+                    "paths": { "/x": { "get": { "responses": {} } } }
+                }).to_string()
+            }
+        }),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(missing_server_create.status(), StatusCode::BAD_REQUEST);
+    assert_eq!(
+        sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM sources")
+            .fetch_one(app.pool())
+            .await
+            .expect("source count should read"),
+        0
+    );
+
+    let created = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/sources",
+        json!({
+            "kind": "openapi",
+            "displayName": "Local API",
+            "preferredSlug": "local",
+            "spec": { "type": "inline", "content": specification },
+            "allowPrivateNetwork": true
+        }),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(created.status(), StatusCode::CREATED);
+
+    let before_refresh = app
+        .catalog()
+        .list_tools(Default::default())
+        .await
+        .expect("tools should list");
+    let write_tool = before_refresh
+        .items
+        .iter()
+        .find(|tool| tool.local_name == "write")
+        .expect("write tool should exist");
+    let stable_write_id = write_tool.id.clone();
+    app.catalog()
+        .set_tool_mode(
+            &stable_write_id,
+            Some(ToolMode::Ask),
+            write_tool.revision,
+            AuditContext::system(Some("test-mode-override")),
+        )
+        .await
+        .expect("tool override should store");
+    let source_id = app
+        .catalog()
+        .list_sources()
+        .await
+        .expect("sources should list")[0]
+        .id
+        .clone();
+    let refreshed = send(
+        app.router(),
+        Method::POST,
+        &format!("/api/v1/sources/{source_id}/refresh"),
+        json!({}),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(refreshed.status(), StatusCode::OK);
+    let after_refresh = app
+        .catalog()
+        .list_tools(Default::default())
+        .await
+        .expect("refreshed tools should list");
+    let write_tool = after_refresh
+        .items
+        .iter()
+        .find(|tool| tool.local_name == "write")
+        .expect("write tool should survive refresh");
+    assert_eq!(write_tool.id, stable_write_id);
+    assert_eq!(write_tool.mode_override, Some(ToolMode::Ask));
+
+    let token_response = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/tokens",
+        json!({ "name": "test" }),
+        &[
+            (header::COOKIE.as_str(), admin.cookie.as_str()),
+            (header::ORIGIN.as_str(), ORIGIN),
+            ("x-executor-csrf", admin.csrf.as_str()),
+            ("idempotency-key", "openapi-preview-token"),
+        ],
+    )
+    .await;
+    assert_eq!(token_response.status(), StatusCode::CREATED);
+    let token = body(token_response).await["token"]
+        .as_str()
+        .expect("token should be returned")
+        .to_owned();
+    let authorization = format!("Bearer {token}");
+
+    let invoked = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/gateway/tools/invoke",
+        json!({ "path": "local.hello", "arguments": {} }),
+        &[(header::AUTHORIZATION.as_str(), &authorization)],
+    )
+    .await;
+    assert_eq!(invoked.status(), StatusCode::OK);
+    let invoked = body(invoked).await;
+    assert_eq!(invoked["ok"], true);
+    assert_eq!(invoked["data"]["message"], "hello");
+
+    let large_but_allowed = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/gateway/tools/invoke",
+        json!({
+            "path": "local.hello",
+            "arguments": { "headers": { "X-Padding": "x".repeat(20_000) } }
+        }),
+        &[(header::AUTHORIZATION.as_str(), &authorization)],
+    )
+    .await;
+    assert_eq!(large_but_allowed.status(), StatusCode::OK);
+
+    let over_invoke_cap = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/gateway/tools/invoke",
+        json!({
+            "path": "local.hello",
+            "arguments": { "padding": "x".repeat(8 * 1024 * 1024 + 128 * 1024) }
+        }),
+        &[(header::AUTHORIZATION.as_str(), &authorization)],
+    )
+    .await;
+    assert_eq!(over_invoke_cap.status(), StatusCode::PAYLOAD_TOO_LARGE);
+
+    let over_import_cap = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/sources/openapi/preview",
+        json!({
+            "spec": { "type": "inline", "content": "x".repeat(16 * 1024 * 1024 + 128 * 1024) }
+        }),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(over_import_cap.status(), StatusCode::PAYLOAD_TOO_LARGE);
+
+    let over_create_cap = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/sources",
+        json!({
+            "kind": "openapi",
+            "displayName": "Too large",
+            "spec": { "type": "inline", "content": "x".repeat(16 * 1024 * 1024 + 128 * 1024) }
+        }),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(over_create_cap.status(), StatusCode::PAYLOAD_TOO_LARGE);
+
+    let invalid = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/gateway/tools/invoke",
+        json!({ "path": "local.hello", "arguments": [] }),
+        &[(header::AUTHORIZATION.as_str(), &authorization)],
+    )
+    .await;
+    assert_eq!(invalid.status(), StatusCode::BAD_REQUEST);
+    assert_eq!(
+        body(invalid).await["error"]["code"],
+        "invalid_tool_arguments"
+    );
+    tokio::time::timeout(std::time::Duration::from_secs(2), async {
+        loop {
+            let logged = sqlx::query_scalar::<_, i64>(
+                "SELECT COUNT(*) FROM request_logs WHERE error_code = 'invalid_tool_arguments'",
+            )
+            .fetch_one(app.pool())
+            .await
+            .expect("request logs should read");
+            if logged == 1 {
+                break;
+            }
+            tokio::task::yield_now().await;
+        }
+    })
+    .await
+    .expect("failed invocation should be logged");
+
+    let ask = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/gateway/tools/invoke",
+        json!({ "path": "local.write", "arguments": {} }),
+        &[(header::AUTHORIZATION.as_str(), &authorization)],
+    )
+    .await;
+    assert_eq!(ask.status(), StatusCode::ACCEPTED);
+    let ask = body(ask).await;
+    assert_eq!(ask["status"], "approval_required");
+    assert_eq!(ask["approval"]["status"], "pending");
+
+    upstream_task.abort();
+}
+
+#[tokio::test]
+async fn source_configuration_never_exposes_a_query_bearing_spec_url() {
+    let spec_listener = TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("spec listener should bind");
+    let address: SocketAddr = spec_listener
+        .local_addr()
+        .expect("spec address should read");
+    let server_url = format!("http://{address}");
+    let spec = json!({
+        "openapi": "3.0.3",
+        "info": { "title": "URL API" },
+        "servers": [{ "url": server_url }],
+        "paths": {}
+    });
+    let spec_router = Router::new().route(
+        "/openapi.json",
+        get(move || {
+            let spec = spec.clone();
+            async move { Json(spec) }
+        }),
+    );
+    let spec_task = tokio::spawn(async move {
+        axum::serve(spec_listener, spec_router)
+            .await
+            .expect("spec server should serve");
+    });
+
+    let directory = tempfile::tempdir().expect("temporary directory should be created");
+    let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+        .await
+        .expect("Executor should open");
+    let admin = setup(&app).await;
+    let secret_url = format!("http://{address}/openapi.json?api_key=plaintext-secret");
+    let created = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/sources",
+        json!({
+            "kind": "openapi",
+            "displayName": "URL API",
+            "spec": { "type": "url", "url": secret_url },
+            "allowPrivateNetwork": true
+        }),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(created.status(), StatusCode::CREATED);
+    let created = body(created).await;
+    assert!(!created.to_string().contains("plaintext-secret"));
+    let source_id = created["id"]
+        .as_str()
+        .expect("created source should have an ID");
+    let metadata = send(
+        app.router(),
+        Method::GET,
+        &format!("/api/v1/sources/{source_id}/credentials"),
+        json!(null),
+        &[(header::COOKIE.as_str(), admin.cookie.as_str())],
+    )
+    .await;
+    assert_eq!(metadata.status(), StatusCode::OK);
+    let metadata = body(metadata).await;
+    assert_eq!(metadata["revision"], 0);
+    assert_eq!(metadata["configuredSchemes"], json!([]));
+
+    let static_secret = "static-secret-never-returned";
+    let updated = send(
+        app.router(),
+        Method::PUT,
+        &format!("/api/v1/sources/{source_id}/credentials"),
+        json!({
+            "expectedRevision": 0,
+            "credential": {
+                "schemes": {
+                    "ApiKey": { "type": "api_key", "value": static_secret }
+                }
+            }
+        }),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(updated.status(), StatusCode::OK);
+    let updated = body(updated).await;
+    assert_eq!(updated["revision"], 1);
+    assert_eq!(
+        updated["configuredSchemes"],
+        json!([{ "name": "ApiKey", "credentialType": "api_key" }])
+    );
+    assert!(!updated.to_string().contains(static_secret));
+
+    let configuration = sqlx::query_scalar::<_, String>("SELECT configuration_json FROM sources")
+        .fetch_one(app.pool())
+        .await
+        .expect("source config should read");
+    assert!(!configuration.contains("plaintext-secret"));
+    let ciphertext =
+        sqlx::query_scalar::<_, Vec<u8>>("SELECT payload_ciphertext FROM source_credentials")
+            .fetch_one(app.pool())
+            .await
+            .expect("credential ciphertext should read");
+    assert!(!String::from_utf8_lossy(&ciphertext).contains("plaintext-secret"));
+    assert!(!String::from_utf8_lossy(&ciphertext).contains(static_secret));
+
+    spec_task.abort();
+}
+
+#[tokio::test]
+async fn large_body_routes_authenticate_before_parsing_json() {
+    let directory = tempfile::tempdir().expect("temporary directory should be created");
+    let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+        .await
+        .expect("Executor should open");
+    let malformed = format!("{{{}", "x".repeat(64 * 1024));
+
+    for uri in ["/api/v1/sources", "/api/v1/sources/openapi/preview"] {
+        let response = send_raw(app.router(), Method::POST, uri, malformed.clone(), &[]).await;
+        assert_eq!(response.status(), StatusCode::FORBIDDEN);
+        assert_eq!(body(response).await["error"]["code"], "invalid_origin");
+    }
+    let response = send_raw(
+        app.router(),
+        Method::PUT,
+        "/api/v1/sources/not-a-source/credentials",
+        malformed.clone(),
+        &[],
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::FORBIDDEN);
+    assert_eq!(body(response).await["error"]["code"], "invalid_origin");
+
+    let response = send_raw(
+        app.router(),
+        Method::POST,
+        "/api/v1/sources/not-a-source/refresh",
+        malformed.clone(),
+        &[],
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::FORBIDDEN);
+    assert_eq!(body(response).await["error"]["code"], "invalid_origin");
+
+    let response = send_raw(
+        app.router(),
+        Method::POST,
+        "/api/v1/gateway/tools/invoke",
+        malformed,
+        &[],
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::UNAUTHORIZED);
+    assert_eq!(body(response).await["error"]["code"], "unauthorized");
+}
+
+#[tokio::test]
+async fn openapi_credentials_reject_unknown_schema_versions() {
+    let directory = tempfile::tempdir().expect("temporary directory should be created");
+    let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+        .await
+        .expect("Executor should open");
+    let admin = setup(&app).await;
+    let specification = json!({
+        "openapi": "3.1.0",
+        "info": { "title": "Credential schema" },
+        "servers": [{ "url": "https://example.com" }],
+        "paths": {
+            "/hello": {
+                "get": {
+                    "operationId": "hello",
+                    "responses": { "200": { "description": "ok" } }
+                }
+            }
+        }
+    });
+    let response = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/sources",
+        json!({
+            "kind": "openapi",
+            "displayName": "Credential schema",
+            "preferredSlug": "schema",
+            "spec": { "type": "inline", "content": specification.to_string() }
+        }),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::CREATED);
+    let source_id = body(response).await["id"]
+        .as_str()
+        .expect("source should have an ID")
+        .to_owned();
+    let mut credential = app
+        .catalog()
+        .credential(&source_id)
+        .await
+        .expect("credential should read")
+        .expect("credential should exist");
+    credential.credential.schema_version = 2;
+    app.catalog()
+        .put_credential(
+            &source_id,
+            &credential.credential,
+            Some(credential.revision),
+            AuditContext::system(Some("unsupported-credential-schema")),
+        )
+        .await
+        .expect("future credential schema should store opaquely");
+
+    let response = send(
+        app.router(),
+        Method::GET,
+        &format!("/api/v1/sources/{source_id}/credentials"),
+        json!(null),
+        &[(header::COOKIE.as_str(), admin.cookie.as_str())],
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::CONFLICT);
+    assert_eq!(
+        body(response).await["error"]["code"],
+        "unsupported_credential_schema"
+    );
+
+    let replace = send(
+        app.router(),
+        Method::PUT,
+        &format!("/api/v1/sources/{source_id}/credentials"),
+        json!({
+            "expectedRevision": 1,
+            "credential": { "schemes": {
+                "ApiKey": { "type": "api_key", "value": "must-not-store" }
+            }}
+        }),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(replace.status(), StatusCode::CONFLICT);
+    assert_eq!(
+        body(replace).await["error"]["code"],
+        "unsupported_credential_schema"
+    );
+
+    let clear = send(
+        app.router(),
+        Method::DELETE,
+        &format!("/api/v1/sources/{source_id}/credentials?expectedRevision=1"),
+        json!(null),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(clear.status(), StatusCode::CONFLICT);
+    assert_eq!(
+        body(clear).await["error"]["code"],
+        "unsupported_credential_schema"
+    );
+    let unchanged = app
+        .catalog()
+        .credential(&source_id)
+        .await
+        .expect("credential should remain readable")
+        .expect("credential should remain stored");
+    assert_eq!(unchanged.revision, 1);
+    assert_eq!(unchanged.credential.schema_version, 2);
+
+    let token_response = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/tokens",
+        json!({ "name": "credential-schema" }),
+        &[
+            (header::COOKIE.as_str(), admin.cookie.as_str()),
+            (header::ORIGIN.as_str(), ORIGIN),
+            ("x-executor-csrf", admin.csrf.as_str()),
+            ("idempotency-key", "openapi-credential-schema-token"),
+        ],
+    )
+    .await;
+    let token = body(token_response).await["token"]
+        .as_str()
+        .expect("token should be returned")
+        .to_owned();
+    let authorization = format!("Bearer {token}");
+    let response = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/gateway/tools/invoke",
+        json!({ "path": "schema.hello", "arguments": {} }),
+        &[(header::AUTHORIZATION.as_str(), &authorization)],
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
+    assert_eq!(
+        body(response).await["error"]["code"],
+        "unsupported_credential_schema"
+    );
+}
+
+#[tokio::test]
+async fn source_requests_reject_typos_before_mutating_catalog_or_credentials() {
+    let directory = tempfile::tempdir().expect("temporary directory should be created");
+    let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+        .await
+        .expect("Executor should open");
+    let admin = setup(&app).await;
+    let specification = json!({
+        "openapi": "3.1.0",
+        "info": { "title": "Strict requests" },
+        "servers": [{ "url": "https://example.com" }],
+        "paths": {}
+    })
+    .to_string();
+
+    let preview_typo = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/sources/openapi/preview",
+        json!({
+            "spec": { "type": "inline", "content": specification },
+            "allowPrivateNetwrok": false
+        }),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(preview_typo.status(), StatusCode::BAD_REQUEST);
+    assert_eq!(body(preview_typo).await["error"]["code"], "invalid_json");
+
+    let spec_typo = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/sources/openapi/preview",
+        json!({
+            "spec": {
+                "type": "inline",
+                "content": specification,
+                "contnet": specification
+            }
+        }),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(spec_typo.status(), StatusCode::BAD_REQUEST);
+    assert_eq!(body(spec_typo).await["error"]["code"], "invalid_json");
+
+    let create_typo = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/sources",
+        json!({
+            "kind": "openapi",
+            "displayNmae": "Strict requests",
+            "spec": { "type": "inline", "content": specification }
+        }),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(create_typo.status(), StatusCode::BAD_REQUEST);
+    assert_eq!(body(create_typo).await["error"]["code"], "invalid_json");
+    assert!(
+        app.catalog()
+            .list_sources()
+            .await
+            .expect("sources should list")
+            .is_empty()
+    );
+
+    let malformed_credential = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/sources",
+        json!({
+            "kind": "openapi",
+            "displayName": "Strict requests",
+            "spec": { "type": "inline", "content": specification },
+            "credential": {}
+        }),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(malformed_credential.status(), StatusCode::BAD_REQUEST);
+    assert_eq!(
+        body(malformed_credential).await["error"]["code"],
+        "invalid_json"
+    );
+    assert!(
+        app.catalog()
+            .list_sources()
+            .await
+            .expect("sources should list")
+            .is_empty()
+    );
+
+    let created = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/sources",
+        json!({
+            "kind": "openapi",
+            "displayName": "Strict requests",
+            "preferredSlug": "strict",
+            "spec": { "type": "inline", "content": specification }
+        }),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(created.status(), StatusCode::CREATED);
+    let source_id = body(created).await["id"]
+        .as_str()
+        .expect("created source should have an ID")
+        .to_owned();
+
+    let put_typo = send(
+        app.router(),
+        Method::PUT,
+        &format!("/api/v1/sources/{source_id}/credentials"),
+        json!({
+            "expectedRevison": 0,
+            "credential": {
+                "schemes": {
+                    "ApiKey": { "type": "api_key", "value": "must-not-store" }
+                }
+            }
+        }),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(put_typo.status(), StatusCode::BAD_REQUEST);
+    assert_eq!(body(put_typo).await["error"]["code"], "invalid_json");
+
+    let put_missing_revision = send(
+        app.router(),
+        Method::PUT,
+        &format!("/api/v1/sources/{source_id}/credentials"),
+        json!({
+            "credential": {
+                "schemes": {
+                    "ApiKey": { "type": "api_key", "value": "must-not-store" }
+                }
+            }
+        }),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(put_missing_revision.status(), StatusCode::BAD_REQUEST);
+    assert_eq!(
+        body(put_missing_revision).await["error"]["code"],
+        "invalid_json"
+    );
+
+    let delete_typo = send(
+        app.router(),
+        Method::DELETE,
+        &format!("/api/v1/sources/{source_id}/credentials?expectedRevison=0"),
+        json!(null),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(delete_typo.status(), StatusCode::BAD_REQUEST);
+    assert_json_content_type(&delete_typo);
+    assert_eq!(body(delete_typo).await["error"]["code"], "invalid_query");
+
+    let metadata = send(
+        app.router(),
+        Method::GET,
+        &format!("/api/v1/sources/{source_id}/credentials"),
+        json!(null),
+        &[(header::COOKIE.as_str(), admin.cookie.as_str())],
+    )
+    .await;
+    assert_eq!(metadata.status(), StatusCode::OK);
+    let metadata = body(metadata).await;
+    assert_eq!(metadata["revision"], 0);
+    assert_eq!(metadata["configuredSchemes"], json!([]));
+}
+
+#[tokio::test]
+async fn credential_delete_queries_use_sanitized_json_errors_and_strict_revisions() {
+    let directory = tempfile::tempdir().expect("temporary directory should be created");
+    let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+        .await
+        .expect("Executor should open");
+    let admin = setup(&app).await;
+    let specification = json!({
+        "openapi": "3.1.0",
+        "info": { "title": "Credential delete", "version": "1" },
+        "servers": [{ "url": "https://example.com" }],
+        "components": {
+            "securitySchemes": {
+                "ApiKey": { "type": "apiKey", "in": "header", "name": "X-API-Key" }
+            }
+        },
+        "paths": {}
+    });
+    let created = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/sources",
+        json!({
+            "kind": "openapi",
+            "displayName": "Credential delete",
+            "preferredSlug": "credential-delete",
+            "spec": { "type": "inline", "content": specification.to_string() }
+        }),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(created.status(), StatusCode::CREATED);
+    let source_id = body(created).await["id"]
+        .as_str()
+        .expect("created source should have an ID")
+        .to_owned();
+
+    let configured = send(
+        app.router(),
+        Method::PUT,
+        &format!("/api/v1/sources/{source_id}/credentials"),
+        json!({
+            "expectedRevision": 0,
+            "credential": {
+                "schemes": {
+                    "ApiKey": { "type": "api_key", "value": "delete-query-secret" }
+                }
+            }
+        }),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(configured.status(), StatusCode::OK);
+    assert_eq!(body(configured).await["revision"], 1);
+
+    let invalid_queries = [
+        (
+            "malformed percent encoding",
+            "expectedRevision=%E0%A4%A",
+            "%E0%A4%A",
+        ),
+        (
+            "duplicate source parameter",
+            "sourceId=duplicate-source-secret&sourceId=other&expectedRevision=1",
+            "duplicate-source-secret",
+        ),
+        (
+            "duplicate revision parameter",
+            "expectedRevision=1&expectedRevision=1",
+            "expectedRevision",
+        ),
+        (
+            "unknown parameter",
+            "expectedRevision=1&unexpected=unknown-query-secret",
+            "unknown-query-secret",
+        ),
+        (
+            "missing revision value",
+            "expectedRevision=",
+            "expectedRevision",
+        ),
+        ("missing revision parameter", "", "expectedRevision"),
+    ];
+    for (case, query, forbidden_fragment) in invalid_queries {
+        let separator = if query.is_empty() { "" } else { "?" };
+        let response = send(
+            app.router(),
+            Method::DELETE,
+            &format!("/api/v1/sources/{source_id}/credentials{separator}{query}"),
+            json!(null),
+            &admin_headers(&admin),
+        )
+        .await;
+        assert_eq!(response.status(), StatusCode::BAD_REQUEST, "{case}");
+        assert_json_content_type(&response);
+        let response = body(response).await;
+        assert_eq!(response["error"]["code"], "invalid_query", "{case}");
+        assert_eq!(
+            response["error"]["message"], "The query parameters are invalid.",
+            "{case}"
+        );
+        assert!(
+            response["error"]["requestId"]
+                .as_str()
+                .is_some_and(|request_id| !request_id.is_empty()),
+            "{case}"
+        );
+        assert!(
+            !response.to_string().contains(forbidden_fragment),
+            "{case} must not echo query input"
+        );
+    }
+
+    let unchanged = send(
+        app.router(),
+        Method::GET,
+        &format!("/api/v1/sources/{source_id}/credentials"),
+        json!(null),
+        &[(header::COOKIE.as_str(), admin.cookie.as_str())],
+    )
+    .await;
+    assert_eq!(unchanged.status(), StatusCode::OK);
+    let unchanged = body(unchanged).await;
+    assert_eq!(unchanged["revision"], 1);
+    assert_eq!(
+        unchanged["configuredSchemes"],
+        json!([{ "name": "ApiKey", "credentialType": "api_key" }])
+    );
+
+    let conflict = send(
+        app.router(),
+        Method::DELETE,
+        &format!("/api/v1/sources/{source_id}/credentials?expectedRevision=0"),
+        json!(null),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(conflict.status(), StatusCode::CONFLICT);
+    assert_json_content_type(&conflict);
+    assert_eq!(body(conflict).await["error"]["code"], "revision_conflict");
+
+    let cleared = send(
+        app.router(),
+        Method::DELETE,
+        &format!("/api/v1/sources/{source_id}/credentials?expectedRevision=1"),
+        json!(null),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(cleared.status(), StatusCode::OK);
+    assert_json_content_type(&cleared);
+    let cleared = body(cleared).await;
+    assert_eq!(cleared["revision"], 2);
+    assert_eq!(cleared["configuredSchemes"], json!([]));
+    assert!(!cleared.to_string().contains("delete-query-secret"));
+    app.shutdown().await;
+}
diff --git a/tests/openapi_atomic_create.rs b/tests/openapi_atomic_create.rs
new file mode 100644
index 000000000..76feebfd7
--- /dev/null
+++ b/tests/openapi_atomic_create.rs
@@ -0,0 +1,220 @@
+use std::collections::BTreeMap;
+
+use executor::{
+    AppConfig, ExecutorApp,
+    catalog::{
+        ArtifactKind, AuditContext, CatalogError, CreateSource, CredentialPayload,
+        InitialCatalogSnapshot, SourceKind, StagedArtifact, StagedTool, StagedToolBinding,
+        ToolBinding, ToolMode,
+    },
+    openapi::{OpenApiBinding, OpenApiSecurityAlternative},
+};
+use serde_json::{Map, json};
+
+fn source_input() -> CreateSource {
+    CreateSource {
+        kind: SourceKind::Openapi,
+        preferred_slug: "Weather API".to_owned(),
+        display_name: "Weather API".to_owned(),
+        description: Some("Forecast operations".to_owned()),
+        configuration: Map::from_iter([(
+            "displayUrl".to_owned(),
+            json!("https://weather.example.test/openapi.json"),
+        )]),
+    }
+}
+
+fn credential() -> CredentialPayload {
+    CredentialPayload {
+        schema_version: 1,
+        payload: json!({
+            "schemes": {
+                "weatherKey": {
+                    "type": "api_key",
+                    "value": "atomic-secret"
+                }
+            }
+        }),
+    }
+}
+
+fn snapshot() -> InitialCatalogSnapshot {
+    InitialCatalogSnapshot {
+        artifacts: vec![StagedArtifact {
+            kind: ArtifactKind::OpenapiDocument,
+            stable_key: "document".to_owned(),
+            content: json!({ "openapi": "3.1.0" }),
+        }],
+        tools: vec![StagedTool {
+            stable_key: "get:/weather".to_owned(),
+            preferred_name: "getWeather".to_owned(),
+            display_name: "Get weather".to_owned(),
+            description: Some("Read a forecast".to_owned()),
+            input_schema: json!({ "type": "object" }),
+            output_schema: Some(json!({ "type": "object" })),
+            input_typescript: None,
+            output_typescript: None,
+            typescript_definitions: BTreeMap::new(),
+            intrinsic_mode: ToolMode::Enabled,
+        }],
+    }
+}
+
+fn bindings() -> Vec<StagedToolBinding> {
+    vec![StagedToolBinding {
+        stable_key: "get:/weather".to_owned(),
+        binding: ToolBinding::OpenapiV1(OpenApiBinding {
+            version: 1,
+            method: "GET".to_owned(),
+            path_template: "/weather".to_owned(),
+            server_url: "https://weather.example.test".to_owned(),
+            parameters: Vec::new(),
+            request_body: None,
+            security: vec![OpenApiSecurityAlternative {
+                requirements: Vec::new(),
+            }],
+        }),
+    }]
+}
+
+async fn row_count(app: &ExecutorApp, table: &str) -> i64 {
+    sqlx::query_scalar(&format!("SELECT COUNT(*) FROM {table}"))
+        .fetch_one(app.pool())
+        .await
+        .expect("row count should read")
+}
+
+#[tokio::test]
+async fn imported_source_creation_commits_every_catalog_record_or_nothing() {
+    let directory = tempfile::tempdir().expect("temporary directory should be created");
+    let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+        .await
+        .expect("Executor should open");
+    sqlx::query(
+        "CREATE TRIGGER reject_atomic_binding BEFORE INSERT ON tool_bindings \
+         BEGIN SELECT RAISE(ABORT, 'reject atomic binding'); END",
+    )
+    .execute(app.pool())
+    .await
+    .expect("failure trigger should install");
+
+    app.catalog()
+        .create_source_with_catalog(
+            source_input(),
+            &credential(),
+            snapshot(),
+            bindings(),
+            AuditContext::system(Some("atomic-failure")),
+        )
+        .await
+        .expect_err("a binding write failure should abort creation");
+
+    for table in [
+        "sources",
+        "source_credentials",
+        "source_artifacts",
+        "tools",
+        "tool_bindings",
+        "tool_search",
+        "tool_search_trigram",
+        "tool_search_short",
+        "audit_events",
+    ] {
+        assert_eq!(row_count(&app, table).await, 0, "{table} must roll back");
+    }
+    assert_eq!(app.catalog().global_revision().await.unwrap(), 0);
+
+    sqlx::query("DROP TRIGGER reject_atomic_binding")
+        .execute(app.pool())
+        .await
+        .expect("failure trigger should drop");
+    let (source, sync) = app
+        .catalog()
+        .create_source_with_catalog(
+            source_input(),
+            &credential(),
+            snapshot(),
+            bindings(),
+            AuditContext::system(Some("atomic-success")),
+        )
+        .await
+        .expect("atomic creation should succeed");
+
+    assert_eq!(source.slug, "weather_api");
+    assert_eq!(source.revision, 1);
+    assert_eq!(source.catalog_revision, 1);
+    assert_eq!(source.tool_count, 1);
+    assert_eq!(sync.source_id, source.id);
+    assert_eq!(sync.global_revision, 1);
+    assert_eq!(sync.active_tool_count, 1);
+    assert_eq!(
+        app.catalog()
+            .credential(&source.id)
+            .await
+            .expect("credential should read")
+            .expect("credential should exist")
+            .credential
+            .payload["schemes"]["weatherKey"]["value"],
+        "atomic-secret"
+    );
+    assert_eq!(row_count(&app, "source_artifacts").await, 1);
+    assert_eq!(row_count(&app, "tool_bindings").await, 1);
+    assert_eq!(row_count(&app, "tool_search").await, 1);
+    assert_eq!(row_count(&app, "tool_search_trigram").await, 1);
+    assert_eq!(row_count(&app, "tool_search_short").await, 1);
+    assert_eq!(row_count(&app, "audit_events").await, 3);
+}
+
+#[tokio::test]
+async fn malformed_input_schema_is_rejected_before_atomic_creation_writes() {
+    let directory = tempfile::tempdir().expect("temporary directory should be created");
+    let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+        .await
+        .expect("Executor should open");
+    let mut invalid_snapshot = snapshot();
+    invalid_snapshot.tools[0].input_schema = json!({ "type": "not-a-json-schema-type" });
+
+    let error = app
+        .catalog()
+        .create_source_with_catalog(
+            source_input(),
+            &credential(),
+            invalid_snapshot,
+            bindings(),
+            AuditContext::system(Some("invalid-schema")),
+        )
+        .await
+        .expect_err("invalid schema should fail before catalog creation");
+    assert!(matches!(
+        error,
+        CatalogError::Validation {
+            code: "invalid_tool_input_schema",
+            ..
+        }
+    ));
+    assert_eq!(row_count(&app, "sources").await, 0);
+    assert_eq!(row_count(&app, "tools").await, 0);
+    assert_eq!(app.catalog().global_revision().await.unwrap(), 0);
+}
+
+#[tokio::test]
+async fn atomic_import_cannot_shadow_the_sources_builtin() {
+    let directory = tempfile::tempdir().expect("temporary directory should be created");
+    let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+        .await
+        .expect("Executor should open");
+    let mut source = source_input();
+    source.preferred_slug = "sources".to_owned();
+    let (source, _) = app
+        .catalog()
+        .create_source_with_catalog(
+            source,
+            &credential(),
+            snapshot(),
+            bindings(),
+            AuditContext::system(Some("reserved-sources-import")),
+        )
+        .await
+        .expect("reserved source import should allocate a safe suffix");
+    assert_eq!(source.slug, "sources_2");
+}
diff --git a/tests/openapi_gateway_contract.rs b/tests/openapi_gateway_contract.rs
new file mode 100644
index 000000000..b10b89644
--- /dev/null
+++ b/tests/openapi_gateway_contract.rs
@@ -0,0 +1,1472 @@
+use std::{
+    collections::BTreeMap,
+    sync::{
+        Arc,
+        atomic::{AtomicUsize, Ordering},
+    },
+    time::Duration,
+};
+
+use axum::{
+    Json, Router,
+    body::Body,
+    extract::State,
+    http::{Method, Request, StatusCode, header},
+};
+use executor::{
+    AppConfig, ExecutorApp,
+    catalog::{AuditContext, ToolMode},
+};
+use http_body_util::BodyExt;
+use serde_json::{Map, Value, json};
+use tokio::{
+    net::TcpListener,
+    sync::{Mutex, Notify},
+};
+use tower::ServiceExt;
+
+const ORIGIN: &str = "http://127.0.0.1:4788";
+static TOKEN_IDEMPOTENCY_SEQUENCE: AtomicUsize = AtomicUsize::new(1);
+
+struct Admin {
+    cookie: String,
+    csrf: String,
+}
+
+#[derive(Clone, Default)]
+struct Recorder {
+    count: Arc<AtomicUsize>,
+    requests: Arc<Mutex<Vec<Value>>>,
+}
+
+impl Recorder {
+    fn count(&self) -> usize {
+        self.count.load(Ordering::SeqCst)
+    }
+
+    async fn take_last(&self) -> Value {
+        self.requests
+            .lock()
+            .await
+            .last()
+            .cloned()
+            .expect("the upstream should have recorded a request")
+    }
+}
+
+async fn record_upstream(State(recorder): State<Recorder>, request: Request<Body>) -> Json<Value> {
+    recorder.count.fetch_add(1, Ordering::SeqCst);
+    let method = request.method().to_string();
+    let path = request.uri().path().to_owned();
+    let query = request.uri().query().unwrap_or_default().to_owned();
+    let headers = request
+        .headers()
+        .iter()
+        .filter_map(|(name, value)| {
+            value
+                .to_str()
+                .ok()
+                .map(|value| (name.as_str().to_owned(), Value::String(value.to_owned())))
+        })
+        .collect::<Map<_, _>>();
+    let body = request
+        .into_body()
+        .collect()
+        .await
+        .expect("upstream request body should collect")
+        .to_bytes();
+    let observed = json!({
+        "method": method,
+        "path": path,
+        "query": query,
+        "headers": headers,
+        "body": String::from_utf8_lossy(&body),
+    });
+    recorder.requests.lock().await.push(observed.clone());
+    Json(observed)
+}
+
+#[derive(Clone, Default)]
+struct BlockingUpstream {
+    entered: Arc<Notify>,
+    release: Arc<Notify>,
+}
+
+async fn block_upstream(State(state): State<BlockingUpstream>) -> Json<Value> {
+    state.entered.notify_one();
+    state.release.notified().await;
+    Json(json!({ "completed": true }))
+}
+
+async fn send(
+    router: Router,
+    method: Method,
+    uri: &str,
+    body: Value,
+    headers: &[(&str, &str)],
+) -> axum::response::Response {
+    let mut request = Request::builder()
+        .method(method)
+        .uri(uri)
+        .header(header::CONTENT_TYPE, "application/json");
+    for (name, value) in headers {
+        request = request.header(*name, *value);
+    }
+    router
+        .oneshot(
+            request
+                .body(Body::from(body.to_string()))
+                .expect("request should build"),
+        )
+        .await
+        .expect("router should answer")
+}
+
+async fn response_body(response: axum::response::Response) -> Value {
+    let bytes = response
+        .into_body()
+        .collect()
+        .await
+        .expect("response should collect")
+        .to_bytes();
+    serde_json::from_slice(&bytes).expect("response should contain JSON")
+}
+
+fn cookies(response: &axum::response::Response) -> String {
+    response
+        .headers()
+        .get_all(header::SET_COOKIE)
+        .iter()
+        .map(|value| {
+            value
+                .to_str()
+                .expect("cookie should be text")
+                .split(';')
+                .next()
+                .expect("cookie should have a value")
+        })
+        .collect::<Vec<_>>()
+        .join("; ")
+}
+
+async fn setup(app: &ExecutorApp) -> Admin {
+    let setup_token = app
+        .setup_token()
+        .expect("fresh instance should have a setup token");
+    let response = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/setup",
+        json!({
+            "setupToken": setup_token,
+            "username": "admin",
+            "password": "correct horse battery staple"
+        }),
+        &[(header::ORIGIN.as_str(), ORIGIN)],
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::CREATED);
+
+    let response = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/session",
+        json!({ "username": "admin", "password": "correct horse battery staple" }),
+        &[(header::ORIGIN.as_str(), ORIGIN)],
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::OK);
+    let cookie = cookies(&response);
+    let csrf = response_body(response).await["csrfToken"]
+        .as_str()
+        .expect("login should return a CSRF token")
+        .to_owned();
+    Admin { cookie, csrf }
+}
+
+fn admin_headers(admin: &Admin) -> [(&str, &str); 3] {
+    [
+        (header::COOKIE.as_str(), admin.cookie.as_str()),
+        (header::ORIGIN.as_str(), ORIGIN),
+        ("x-executor-csrf", admin.csrf.as_str()),
+    ]
+}
+
+async fn create_gateway_token(app: &ExecutorApp, admin: &Admin) -> String {
+    let idempotency_key = format!(
+        "openapi-contract-token-{}",
+        TOKEN_IDEMPOTENCY_SEQUENCE.fetch_add(1, Ordering::Relaxed)
+    );
+    let mut headers = admin_headers(admin).to_vec();
+    headers.push(("idempotency-key", idempotency_key.as_str()));
+    let response = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/tokens",
+        json!({ "name": "OpenAPI contract" }),
+        &headers,
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::CREATED);
+    response_body(response).await["token"]
+        .as_str()
+        .expect("token should be returned")
+        .to_owned()
+}
+
+async fn invoke(
+    app: &ExecutorApp,
+    token: &str,
+    path: &str,
+    arguments: Value,
+) -> (StatusCode, Value) {
+    let authorization = format!("Bearer {token}");
+    let response = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/gateway/tools/invoke",
+        json!({ "path": path, "arguments": arguments }),
+        &[(header::AUTHORIZATION.as_str(), &authorization)],
+    )
+    .await;
+    let status = response.status();
+    (status, response_body(response).await)
+}
+
+async fn invoke_idempotent(
+    app: &ExecutorApp,
+    token: &str,
+    key: &str,
+    path: &str,
+    arguments: Value,
+) -> (StatusCode, Value, bool) {
+    let authorization = format!("Bearer {token}");
+    let response = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/gateway/tools/invoke",
+        json!({ "path": path, "arguments": arguments }),
+        &[
+            (header::AUTHORIZATION.as_str(), &authorization),
+            ("idempotency-key", key),
+        ],
+    )
+    .await;
+    let status = response.status();
+    let replayed = response
+        .headers()
+        .get("idempotency-replayed")
+        .is_some_and(|value| value == "true");
+    (status, response_body(response).await, replayed)
+}
+
+fn operation(method: &str, operation_id: &str, security: Value) -> Value {
+    json!({
+        method: {
+            "operationId": operation_id,
+            "security": security,
+            "responses": {
+                "200": {
+                    "description": "recorded",
+                    "content": {
+                        "application/json": { "schema": { "type": "object" } }
+                    }
+                }
+            }
+        }
+    })
+}
+
+async fn set_mode(app: &ExecutorApp, local_name: &str, mode: ToolMode) {
+    let tool = app
+        .catalog()
+        .list_tools(Default::default())
+        .await
+        .expect("tools should list")
+        .items
+        .into_iter()
+        .find(|tool| tool.local_name == local_name)
+        .unwrap_or_else(|| panic!("tool {local_name} should exist"));
+    app.catalog()
+        .set_tool_mode(
+            &tool.id,
+            Some(mode),
+            tool.revision,
+            AuditContext::system(Some("openapi-gateway-contract")),
+        )
+        .await
+        .expect("tool mode should update");
+}
+
+async fn wait_for_log(app: &ExecutorApp, path: &str, outcome: &str, error_code: &str) {
+    tokio::time::timeout(Duration::from_secs(2), async {
+        loop {
+            let count = sqlx::query_scalar::<_, i64>(
+                "SELECT COUNT(*) FROM request_logs \
+                 WHERE path_snapshot = ? AND outcome = ? AND error_code = ?",
+            )
+            .bind(path)
+            .bind(outcome)
+            .bind(error_code)
+            .fetch_one(app.pool())
+            .await
+            .expect("request logs should read");
+            if count > 0 {
+                break;
+            }
+            tokio::task::yield_now().await;
+        }
+    })
+    .await
+    .unwrap_or_else(|_| panic!("request log {path} {outcome} {error_code} should be written"));
+}
+
+#[tokio::test]
+async fn production_gateway_honors_openapi_security_arguments_bodies_and_modes() {
+    let recorder = Recorder::default();
+    let listener = TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("upstream listener should bind");
+    let address = listener.local_addr().expect("upstream address should read");
+    let upstream = Router::new()
+        .fallback(record_upstream)
+        .with_state(recorder.clone());
+    let upstream_task = tokio::spawn(async move {
+        axum::serve(listener, upstream)
+            .await
+            .expect("upstream should serve");
+    });
+
+    let directory = tempfile::tempdir().expect("temporary directory should be created");
+    let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+        .await
+        .expect("Executor should open");
+    let admin = setup(&app).await;
+
+    let mut paths = Map::new();
+    for (path, operation_id, security) in [
+        ("/anonymous", "anonymous", json!([{}])),
+        (
+            "/or-fallback",
+            "or_fallback",
+            json!([{ "MissingKey": [] }, {}]),
+        ),
+        ("/header", "header_key", json!([{ "HeaderKey": [] }])),
+        ("/query", "query_key", json!([{ "QueryKey": [] }])),
+        ("/cookie", "cookie_key", json!([{ "CookieKey": [] }])),
+        ("/bearer", "bearer", json!([{ "BearerAuth": [] }])),
+        ("/basic", "basic", json!([{ "BasicAuth": [] }])),
+        ("/oauth", "oauth", json!([{ "OAuth": ["read"] }])),
+        ("/no-body", "no_body", json!([{}])),
+        ("/disabled", "disabled", json!([{}])),
+    ] {
+        paths.insert(path.to_owned(), operation("get", operation_id, security));
+    }
+    paths.insert(
+        "/combined/{id}".to_owned(),
+        json!({
+            "get": {
+                "operationId": "combined",
+                "security": [{ "HeaderKey": [], "QueryKey": [] }],
+                "parameters": [
+                    { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } },
+                    { "name": "q", "in": "query", "schema": { "type": "string" } },
+                    { "name": "X-Input", "in": "header", "schema": { "type": "string" } },
+                    { "name": "flavor", "in": "cookie", "schema": { "type": "string" } }
+                ],
+                "responses": { "200": { "description": "recorded" } }
+            }
+        }),
+    );
+    for (path, operation_id, content) in [
+        ("/json", "json_body", "application/json"),
+        ("/text", "text_body", "text/plain"),
+        ("/form", "form_body", "application/x-www-form-urlencoded"),
+        ("/ask", "ask", "application/json"),
+    ] {
+        let schema = match content {
+            "application/x-www-form-urlencoded" => json!({
+                "type": "object",
+                "additionalProperties": false,
+                "properties": {
+                    "a": { "type": "string" },
+                    "b": { "type": "integer" }
+                }
+            }),
+            "text/plain" => json!({ "type": "string" }),
+            _ => json!({
+                "type": "object",
+                "additionalProperties": false,
+                "required": ["hello", "mode", "nested"],
+                "properties": {
+                    "hello": { "type": "string", "pattern": "^[a-z]+$" },
+                    "count": { "type": "integer", "minimum": 1 },
+                    "mode": { "enum": ["safe", "fast"] },
+                    "tags": { "type": "array", "items": { "type": "string" }, "uniqueItems": true },
+                    "nested": {
+                        "type": "object",
+                        "additionalProperties": false,
+                        "required": ["id"],
+                        "properties": { "id": { "type": "integer" } }
+                    },
+                    "choice": {
+                        "oneOf": [
+                            { "type": "string", "pattern": "^choice-" },
+                            { "type": "integer", "minimum": 1 }
+                        ]
+                    },
+                    "maybe": { "type": ["string", "null"] }
+                }
+            }),
+        };
+        paths.insert(
+            path.to_owned(),
+            json!({
+                "post": {
+                    "operationId": operation_id,
+                    "security": [{}],
+                    "requestBody": {
+                        "required": true,
+                        "content": { content: { "schema": schema } }
+                    },
+                    "responses": { "200": { "description": "recorded" } }
+                }
+            }),
+        );
+    }
+    paths.insert(
+        "/multi".to_owned(),
+        json!({
+            "post": {
+                "operationId": "multi_body",
+                "security": [{}],
+                "requestBody": {
+                    "required": true,
+                    "content": {
+                        "application/json": {
+                            "schema": {
+                                "type": "object",
+                                "additionalProperties": false,
+                                "required": ["json"],
+                                "properties": { "json": { "type": "boolean" } }
+                            }
+                        },
+                        "text/plain": { "schema": { "type": "string" } }
+                    }
+                },
+                "responses": { "200": { "description": "recorded" } }
+            }
+        }),
+    );
+    for (path, operation_id, header_name) in [
+        (
+            "/method-override",
+            "method_override",
+            "X-HTTP-Method-Override",
+        ),
+        ("/http-method", "http_method", "X-HTTP-Method"),
+        ("/original-method", "original_method", "X-Original-Method"),
+        ("/forwarded", "forwarded", "X-Forwarded-For"),
+    ] {
+        paths.insert(
+            path.to_owned(),
+            json!({
+                "get": {
+                    "operationId": operation_id,
+                    "security": [{}],
+                    "parameters": [{
+                        "name": header_name,
+                        "in": "header",
+                        "schema": { "type": "string" }
+                    }],
+                    "responses": { "200": { "description": "recorded" } }
+                }
+            }),
+        );
+    }
+
+    let specification = json!({
+        "openapi": "3.1.0",
+        "info": { "title": "Gateway Contract" },
+        "servers": [{ "url": format!("http://{address}") }],
+        "components": {
+            "securitySchemes": {
+                "MissingKey": { "type": "apiKey", "in": "header", "name": "X-Missing" },
+                "HeaderKey": { "type": "apiKey", "in": "header", "name": "X-Header-Key" },
+                "QueryKey": { "type": "apiKey", "in": "query", "name": "query_key" },
+                "CookieKey": { "type": "apiKey", "in": "cookie", "name": "cookie_key" },
+                "BearerAuth": { "type": "http", "scheme": "bearer" },
+                "BasicAuth": { "type": "http", "scheme": "basic" },
+                "OAuth": {
+                    "type": "oauth2",
+                    "flows": {
+                        "clientCredentials": {
+                            "tokenUrl": "https://identity.example.test/token",
+                            "scopes": { "read": "Read access" }
+                        }
+                    }
+                }
+            }
+        },
+        "paths": paths
+    });
+    let created = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/sources",
+        json!({
+            "kind": "openapi",
+            "displayName": "Gateway Contract",
+            "preferredSlug": "contract",
+            "spec": { "type": "inline", "content": specification.to_string() },
+            "allowPrivateNetwork": true,
+            "credential": {
+                "schemes": {
+                    "HeaderKey": { "type": "api_key", "value": "header-secret" },
+                    "QueryKey": { "type": "api_key", "value": "query-secret" },
+                    "CookieKey": { "type": "api_key", "value": "cookie-secret" },
+                    "BearerAuth": { "type": "bearer", "token": "bearer-secret" },
+                    "BasicAuth": { "type": "basic", "username": "aladdin", "password": "open-sesame" },
+                    "OAuth": { "type": "oauth_access_token", "access_token": "oauth-secret" }
+                }
+            }
+        }),
+        &admin_headers(&admin),
+    )
+    .await;
+    let created_status = created.status();
+    let created_body = response_body(created).await;
+    assert_eq!(created_status, StatusCode::CREATED, "{created_body}");
+    let token = create_gateway_token(&app, &admin).await;
+    for tool in ["json_body", "text_body", "form_body", "multi_body"] {
+        set_mode(&app, tool, ToolMode::Enabled).await;
+    }
+    set_mode(&app, "disabled", ToolMode::Disabled).await;
+
+    for path in ["anonymous", "or_fallback"] {
+        let (status, response) = invoke(&app, &token, &format!("contract.{path}"), json!({})).await;
+        assert_eq!(status, StatusCode::OK);
+        assert_eq!(response["ok"], true);
+    }
+
+    let (status, response) = invoke(
+        &app,
+        &token,
+        "contract.combined",
+        json!({
+            "path": { "id": "a/b" },
+            "query": { "q": "hello world" },
+            "headers": { "X-Input": "header input" },
+            "cookies": { "flavor": "mint chip" }
+        }),
+    )
+    .await;
+    assert_eq!(status, StatusCode::OK);
+    let observed = &response["data"];
+    assert_eq!(observed["path"], "/combined/a%2Fb");
+    let query = observed["query"].as_str().expect("query should be text");
+    assert!(query.contains("q=hello+world"));
+    assert!(query.contains("query_key=query-secret"));
+    assert_eq!(observed["headers"]["x-header-key"], "header-secret");
+    assert_eq!(observed["headers"]["x-input"], "header input");
+    let cookie = observed["headers"]["cookie"]
+        .as_str()
+        .expect("cookie should be text");
+    assert!(cookie.contains("flavor=mint%20chip"));
+
+    let expected_auth = BTreeMap::from([
+        ("header_key", ("x-header-key", "header-secret")),
+        ("bearer", ("authorization", "Bearer bearer-secret")),
+        (
+            "basic",
+            ("authorization", "Basic YWxhZGRpbjpvcGVuLXNlc2FtZQ=="),
+        ),
+        ("oauth", ("authorization", "Bearer oauth-secret")),
+    ]);
+    for (tool, (name, value)) in expected_auth {
+        let (status, response) = invoke(&app, &token, &format!("contract.{tool}"), json!({})).await;
+        assert_eq!(status, StatusCode::OK);
+        assert_eq!(response["data"]["headers"][name], value);
+    }
+    let (status, response) = invoke(&app, &token, "contract.query_key", json!({})).await;
+    assert_eq!(status, StatusCode::OK);
+    assert_eq!(response["data"]["query"], "query_key=query-secret");
+    let (status, response) = invoke(&app, &token, "contract.cookie_key", json!({})).await;
+    assert_eq!(status, StatusCode::OK);
+    assert_eq!(
+        response["data"]["headers"]["cookie"],
+        "cookie_key=cookie-secret"
+    );
+
+    for (tool, content_type, body, expected_body) in [
+        (
+            "json_body",
+            "application/json",
+            json!({ "hello": "world", "mode": "safe", "nested": { "id": 1 } }),
+            r#"{"hello":"world","mode":"safe","nested":{"id":1}}"#,
+        ),
+        (
+            "text_body",
+            "text/plain",
+            json!("plain words"),
+            "plain words",
+        ),
+        (
+            "form_body",
+            "application/x-www-form-urlencoded",
+            json!({ "a": "one two", "b": 2 }),
+            "a=one+two&b=2",
+        ),
+    ] {
+        let (status, response) = invoke(
+            &app,
+            &token,
+            &format!("contract.{tool}"),
+            json!({ "contentType": content_type, "body": body }),
+        )
+        .await;
+        assert_eq!(status, StatusCode::OK);
+        assert_eq!(response["data"]["method"], "POST");
+        assert_eq!(response["data"]["headers"]["content-type"], content_type);
+        assert_eq!(response["data"]["body"], expected_body);
+    }
+    let (status, response) = invoke(
+        &app,
+        &token,
+        "contract.multi_body",
+        json!({ "contentType": "text/plain", "body": "plain multi" }),
+    )
+    .await;
+    assert_eq!(status, StatusCode::OK);
+    assert_eq!(response["data"]["body"], "plain multi");
+
+    for (tool, arguments) in [
+        ("anonymous", json!({ "surprise": true })),
+        ("no_body", json!({ "body": { "no": "body" } })),
+        ("no_body", json!({ "contentType": "application/json" })),
+        (
+            "combined",
+            json!({ "path": { "id": "ok" }, "query": { "q": 42 } }),
+        ),
+        (
+            "combined",
+            json!({ "path": { "id": "ok" }, "query": { "unknown": "value" } }),
+        ),
+        (
+            "json_body",
+            json!({
+                "contentType": "application/json",
+                "body": {
+                    "hello": "world", "mode": "safe", "nested": { "id": 1 }, "unknown": true
+                }
+            }),
+        ),
+        (
+            "json_body",
+            json!({ "body": { "hello": "WORLD", "mode": "safe", "nested": { "id": 1 } } }),
+        ),
+        (
+            "json_body",
+            json!({ "body": { "hello": "world", "count": 1.5, "mode": "safe", "nested": { "id": 1 } } }),
+        ),
+        (
+            "json_body",
+            json!({ "body": { "hello": "world", "mode": "other", "nested": { "id": 1 } } }),
+        ),
+        (
+            "json_body",
+            json!({ "body": { "mode": "safe", "nested": { "id": 1 } } }),
+        ),
+        (
+            "json_body",
+            json!({ "body": { "hello": "world", "mode": "safe", "nested": {} } }),
+        ),
+        (
+            "json_body",
+            json!({ "body": { "hello": "world", "mode": "safe", "nested": { "id": 1 }, "choice": true } }),
+        ),
+        (
+            "json_body",
+            json!({ "body": { "hello": "world", "mode": "safe", "nested": { "id": 1 }, "tags": ["same", "same"] } }),
+        ),
+        (
+            "multi_body",
+            json!({ "contentType": "application/json", "body": "valid text, invalid JSON body" }),
+        ),
+    ] {
+        let before = recorder.count();
+        let (status, response) = invoke(&app, &token, &format!("contract.{tool}"), arguments).await;
+        assert_eq!(status, StatusCode::BAD_REQUEST);
+        assert_eq!(response["error"]["code"], "invalid_tool_arguments");
+        assert_eq!(recorder.count(), before);
+    }
+    wait_for_log(
+        &app,
+        "tools.contract.json_body",
+        "failed",
+        "invalid_tool_arguments",
+    )
+    .await;
+    for (tool, header_name) in [
+        ("method_override", "X-HTTP-Method-Override"),
+        ("http_method", "X-HTTP-Method"),
+        ("original_method", "X-Original-Method"),
+        ("forwarded", "X-Forwarded-For"),
+    ] {
+        let before = recorder.count();
+        let (status, response) = invoke(
+            &app,
+            &token,
+            &format!("contract.{tool}"),
+            json!({ "headers": { header_name: "DELETE" } }),
+        )
+        .await;
+        assert_eq!(status, StatusCode::BAD_REQUEST);
+        assert_eq!(response["error"]["code"], "forbidden_tool_header");
+        assert_eq!(recorder.count(), before);
+    }
+
+    let before = recorder.count();
+    let (status, response) = invoke(
+        &app,
+        &token,
+        "contract.ask",
+        json!({ "body": { "hello": "write", "mode": "safe", "nested": { "id": 1 } } }),
+    )
+    .await;
+    assert_eq!(status, StatusCode::ACCEPTED);
+    assert_eq!(response["status"], "approval_required");
+    assert_eq!(response["approval"]["status"], "pending");
+    assert_eq!(response["approval"]["path"], "tools.contract.ask");
+    assert!(response["approval"]["id"].as_str().is_some());
+    assert!(response["approval"]["statusUrl"].as_str().is_some());
+    let approval_id = response["approval"]["id"]
+        .as_str()
+        .expect("approval ID should be text")
+        .to_owned();
+    assert_eq!(recorder.count(), before);
+    wait_for_log(
+        &app,
+        "tools.contract.ask",
+        "pending_approval",
+        "approval_required",
+    )
+    .await;
+
+    let detail_uri = format!("/api/v1/approvals/{approval_id}");
+    let response = send(
+        app.router(),
+        Method::GET,
+        &detail_uri,
+        json!({}),
+        &[(header::COOKIE.as_str(), admin.cookie.as_str())],
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::OK);
+    let detail = response_body(response).await;
+    assert_eq!(detail["status"], "pending");
+    assert_eq!(detail["redactedArguments"]["body"]["hello"], "[redacted]");
+    assert!(detail.get("result").is_none());
+
+    let second_token = create_gateway_token(&app, &admin).await;
+    let second_authorization = format!("Bearer {second_token}");
+    let gateway_uri = format!("/api/v1/gateway/approvals/{approval_id}");
+    let response = send(
+        app.router(),
+        Method::GET,
+        &gateway_uri,
+        json!({}),
+        &[(header::AUTHORIZATION.as_str(), &second_authorization)],
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::NOT_FOUND);
+
+    let response = send(
+        app.router(),
+        Method::POST,
+        &format!("/api/v1/approvals/{approval_id}/decision"),
+        json!({ "decision": "approve", "expectedRevision": 0 }),
+        &[(header::COOKIE.as_str(), admin.cookie.as_str())],
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::FORBIDDEN);
+
+    let response = send(
+        app.router(),
+        Method::POST,
+        &format!("/api/v1/approvals/{approval_id}/decision"),
+        json!({ "decision": "approve", "expectedRevision": 0 }),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::ACCEPTED);
+    let replay = send(
+        app.router(),
+        Method::POST,
+        &format!("/api/v1/approvals/{approval_id}/decision"),
+        json!({ "decision": "approve", "expectedRevision": 0 }),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert!(matches!(
+        replay.status(),
+        StatusCode::OK | StatusCode::ACCEPTED
+    ));
+
+    let authorization = format!("Bearer {token}");
+    let mut terminal = None;
+    for _ in 0..100 {
+        let response = send(
+            app.router(),
+            Method::GET,
+            &gateway_uri,
+            json!({}),
+            &[(header::AUTHORIZATION.as_str(), &authorization)],
+        )
+        .await;
+        assert_eq!(response.status(), StatusCode::OK);
+        let body = response_body(response).await;
+        if body["status"] == "succeeded" {
+            terminal = Some(body);
+            break;
+        }
+        tokio::time::sleep(Duration::from_millis(10)).await;
+    }
+    let terminal = terminal.expect("approved call should complete in the background");
+    assert_eq!(terminal["result"]["ok"], true);
+    assert_eq!(recorder.count(), before + 1);
+
+    let (status, response) = invoke(&app, &token, "contract.disabled", json!({})).await;
+    assert_eq!(status, StatusCode::FORBIDDEN);
+    assert_eq!(response["error"]["code"], "tool_disabled");
+    assert_eq!(recorder.count(), before + 1);
+    wait_for_log(&app, "tools.contract.disabled", "denied", "tool_disabled").await;
+
+    let last = recorder.take_last().await;
+    assert_eq!(last["path"], "/ask");
+    upstream_task.abort();
+}
+
+#[tokio::test]
+async fn invocation_holds_its_catalog_lease_until_the_upstream_request_finishes() {
+    let blocker = BlockingUpstream::default();
+    let listener = TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("upstream listener should bind");
+    let address = listener.local_addr().expect("upstream address should read");
+    let upstream = Router::new()
+        .fallback(block_upstream)
+        .with_state(blocker.clone());
+    let upstream_task = tokio::spawn(async move {
+        axum::serve(listener, upstream)
+            .await
+            .expect("upstream should serve");
+    });
+
+    let directory = tempfile::tempdir().expect("temporary directory should be created");
+    let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+        .await
+        .expect("Executor should open");
+    let admin = setup(&app).await;
+    let specification = json!({
+        "openapi": "3.1.0",
+        "info": { "title": "Lease Contract" },
+        "servers": [{ "url": format!("http://{address}") }],
+        "paths": {
+            "/wait": {
+                "get": {
+                    "operationId": "wait",
+                    "security": [{}],
+                    "responses": { "200": { "description": "completed" } }
+                }
+            }
+        }
+    });
+    let created = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/sources",
+        json!({
+            "kind": "openapi",
+            "displayName": "Lease Contract",
+            "preferredSlug": "lease",
+            "spec": { "type": "inline", "content": specification.to_string() },
+            "allowPrivateNetwork": true
+        }),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(created.status(), StatusCode::CREATED);
+    let token = create_gateway_token(&app, &admin).await;
+    let tool = app
+        .catalog()
+        .list_tools(Default::default())
+        .await
+        .expect("tools should list")
+        .items
+        .into_iter()
+        .find(|tool| tool.local_name == "wait")
+        .expect("wait tool should exist");
+
+    let invoke_router = app.router();
+    let invoke_token = token.clone();
+    let invocation = tokio::spawn(async move {
+        let authorization = format!("Bearer {invoke_token}");
+        let response = send(
+            invoke_router,
+            Method::POST,
+            "/api/v1/gateway/tools/invoke",
+            json!({ "path": "lease.wait", "arguments": {} }),
+            &[(header::AUTHORIZATION.as_str(), &authorization)],
+        )
+        .await;
+        let status = response.status();
+        (status, response_body(response).await)
+    });
+    blocker.entered.notified().await;
+
+    let catalog = app.catalog().clone();
+    let tool_id = tool.id.clone();
+    let mut mutation = tokio::spawn(async move {
+        catalog
+            .set_tool_mode(
+                &tool_id,
+                Some(ToolMode::Disabled),
+                tool.revision,
+                AuditContext::system(Some("lease-concurrency-regression")),
+            )
+            .await
+    });
+    assert!(
+        tokio::time::timeout(Duration::from_millis(100), &mut mutation)
+            .await
+            .is_err(),
+        "catalog mutation must wait while outbound invocation owns its lease"
+    );
+
+    blocker.release.notify_one();
+    let (status, response) = invocation.await.expect("invocation task should complete");
+    assert_eq!(status, StatusCode::OK);
+    assert_eq!(response["data"]["completed"], true);
+    tokio::time::timeout(Duration::from_secs(2), mutation)
+        .await
+        .expect("catalog mutation should resume after invocation")
+        .expect("catalog mutation task should complete")
+        .expect("catalog mutation should succeed");
+    upstream_task.abort();
+}
+
+#[tokio::test]
+async fn gateway_idempotency_validates_scopes_and_replays_exact_responses() {
+    let recorder = Recorder::default();
+    let listener = TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("upstream listener should bind");
+    let address = listener.local_addr().expect("upstream address should read");
+    let upstream = Router::new()
+        .fallback(record_upstream)
+        .with_state(recorder.clone());
+    let upstream_task = tokio::spawn(async move {
+        axum::serve(listener, upstream)
+            .await
+            .expect("upstream should serve");
+    });
+
+    let directory = tempfile::tempdir().expect("temporary directory should be created");
+    let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+        .await
+        .expect("Executor should open");
+    let admin = setup(&app).await;
+    let token = create_gateway_token(&app, &admin).await;
+    let authorization = format!("Bearer {token}");
+
+    let response = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/gateway/tools/invoke",
+        json!({ "path": "missing.tool", "arguments": {}, "unexpected": true }),
+        &[
+            (header::AUTHORIZATION.as_str(), &authorization),
+            ("idempotency-key", "unknown-field"),
+        ],
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
+    assert_eq!(recorder.count(), 0);
+    let reserved =
+        sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM gateway_invocation_idempotency")
+            .fetch_one(app.pool())
+            .await
+            .expect("idempotency records should count");
+    assert_eq!(
+        reserved, 0,
+        "invalid JSON must not reserve an idempotency key"
+    );
+
+    for key in ["", "contains space"] {
+        let response = send(
+            app.router(),
+            Method::POST,
+            "/api/v1/gateway/tools/invoke",
+            json!({ "path": "missing.tool", "arguments": {} }),
+            &[
+                (header::AUTHORIZATION.as_str(), &authorization),
+                ("idempotency-key", key),
+            ],
+        )
+        .await;
+        assert_eq!(response.status(), StatusCode::BAD_REQUEST);
+        assert_eq!(
+            response_body(response).await["error"]["code"],
+            "invalid_idempotency_key"
+        );
+    }
+    let oversized_key = "a".repeat(256);
+    let response = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/gateway/tools/invoke",
+        json!({ "path": "missing.tool", "arguments": {} }),
+        &[
+            (header::AUTHORIZATION.as_str(), &authorization),
+            ("idempotency-key", oversized_key.as_str()),
+        ],
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
+    assert_eq!(
+        response_body(response).await["error"]["code"],
+        "invalid_idempotency_key"
+    );
+    let response = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/gateway/tools/invoke",
+        json!({ "path": "missing.tool", "arguments": {} }),
+        &[
+            (header::AUTHORIZATION.as_str(), &authorization),
+            ("idempotency-key", "duplicate-one"),
+            ("idempotency-key", "duplicate-two"),
+        ],
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
+    assert_eq!(
+        response_body(response).await["error"]["code"],
+        "invalid_idempotency_key"
+    );
+    let response = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/gateway/execute",
+        json!({ "code": "export default 1" }),
+        &[
+            (header::AUTHORIZATION.as_str(), &authorization),
+            ("idempotency-key", "execute-key"),
+        ],
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
+    assert_eq!(
+        response_body(response).await["error"]["code"],
+        "idempotency_not_supported"
+    );
+    assert_eq!(recorder.count(), 0);
+
+    let body_schema = json!({
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["value"],
+        "properties": { "value": { "type": "string" } }
+    });
+    let specification = json!({
+        "openapi": "3.1.0",
+        "info": { "title": "Idempotency Contract" },
+        "servers": [{ "url": format!("http://{address}") }],
+        "paths": {
+            "/enabled": {
+                "post": {
+                    "operationId": "enabled",
+                    "security": [{}],
+                    "requestBody": {
+                        "required": true,
+                        "content": { "application/json": { "schema": body_schema.clone() } }
+                    },
+                    "responses": { "200": { "description": "recorded" } }
+                }
+            },
+            "/ask": {
+                "post": {
+                    "operationId": "ask",
+                    "security": [{}],
+                    "requestBody": {
+                        "required": true,
+                        "content": { "application/json": { "schema": body_schema.clone() } }
+                    },
+                    "responses": { "200": { "description": "recorded" } }
+                }
+            },
+            "/other": {
+                "post": {
+                    "operationId": "other",
+                    "security": [{}],
+                    "requestBody": {
+                        "required": true,
+                        "content": { "application/json": { "schema": body_schema } }
+                    },
+                    "responses": { "200": { "description": "recorded" } }
+                }
+            },
+            "/forbidden-prepare": {
+                "get": {
+                    "operationId": "forbidden_prepare",
+                    "security": [{}],
+                    "parameters": [{
+                        "name": "X-HTTP-Method-Override",
+                        "in": "header",
+                        "schema": { "type": "string" }
+                    }],
+                    "responses": { "200": { "description": "recorded" } }
+                }
+            }
+        }
+    });
+    let response = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/sources",
+        json!({
+            "kind": "openapi",
+            "displayName": "Idempotency Contract",
+            "preferredSlug": "idempotency",
+            "spec": { "type": "inline", "content": specification.to_string() },
+            "allowPrivateNetwork": true
+        }),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::CREATED);
+    set_mode(&app, "enabled", ToolMode::Enabled).await;
+    set_mode(&app, "forbidden_prepare", ToolMode::Enabled).await;
+
+    let ask_arguments = json!({
+        "contentType": "application/json",
+        "body": { "value": "same" }
+    });
+    let (first_status, first_body, first_replayed) = invoke_idempotent(
+        &app,
+        &token,
+        "ask-replay",
+        "idempotency.ask",
+        ask_arguments.clone(),
+    )
+    .await;
+    assert_eq!(first_status, StatusCode::ACCEPTED);
+    assert!(!first_replayed);
+    let (second_status, second_body, second_replayed) = invoke_idempotent(
+        &app,
+        &token,
+        "ask-replay",
+        "idempotency.ask",
+        ask_arguments.clone(),
+    )
+    .await;
+    assert_eq!(second_status, StatusCode::ACCEPTED);
+    assert!(second_replayed);
+    assert_eq!(
+        second_body, first_body,
+        "Ask replay must be byte-equivalent JSON"
+    );
+    let approval_count = sqlx::query_scalar::<_, i64>(
+        "SELECT COUNT(*) FROM approvals WHERE callable_path_snapshot = 'tools.idempotency.ask'",
+    )
+    .fetch_one(app.pool())
+    .await
+    .expect("approvals should count");
+    assert_eq!(approval_count, 1);
+    assert_eq!(recorder.count(), 0);
+
+    let pruned_approval_id = first_body["approval"]["id"]
+        .as_str()
+        .expect("Ask response should include an approval ID");
+    let pruned_idempotency_id = sqlx::query_scalar::<_, String>(
+        "SELECT id FROM gateway_invocation_idempotency WHERE approval_id = ?",
+    )
+    .bind(pruned_approval_id)
+    .fetch_one(app.pool())
+    .await
+    .expect("Ask approval should be linked to its idempotency result");
+    let mut prune_connection = app
+        .pool()
+        .acquire()
+        .await
+        .expect("approval retention connection should open");
+    sqlx::query("PRAGMA foreign_keys = ON")
+        .execute(&mut *prune_connection)
+        .await
+        .expect("approval retention should enforce foreign keys");
+    let deleted = sqlx::query("DELETE FROM approvals WHERE id = ?")
+        .bind(pruned_approval_id)
+        .execute(&mut *prune_connection)
+        .await
+        .expect("approval retention should be reproducible")
+        .rows_affected();
+    drop(prune_connection);
+    assert_eq!(deleted, 1);
+    let retained_idempotency = sqlx::query_as::<_, (String, Option<String>)>(
+        "SELECT state, approval_id FROM gateway_invocation_idempotency WHERE id = ?",
+    )
+    .bind(pruned_idempotency_id)
+    .fetch_one(app.pool())
+    .await
+    .expect("completed idempotency result should outlive its pruned approval");
+    assert_eq!(retained_idempotency.0, "completed");
+    assert_eq!(retained_idempotency.1, None);
+
+    let (pruned_status, pruned_body, pruned_replayed) = invoke_idempotent(
+        &app,
+        &token,
+        "ask-replay",
+        "idempotency.ask",
+        ask_arguments.clone(),
+    )
+    .await;
+    assert_eq!(pruned_status, StatusCode::CONFLICT);
+    assert_eq!(pruned_body["error"]["code"], "idempotency_outcome_unknown");
+    assert!(!pruned_replayed, "a dead Ask response must not be replayed");
+    let approval_count = sqlx::query_scalar::<_, i64>(
+        "SELECT COUNT(*) FROM approvals WHERE callable_path_snapshot = 'tools.idempotency.ask'",
+    )
+    .fetch_one(app.pool())
+    .await
+    .expect("approvals should count after the retry");
+    assert_eq!(approval_count, 0, "the retry must not create an approval");
+    assert_eq!(recorder.count(), 0, "the retry must not call upstream");
+
+    sqlx::query(
+        "CREATE TRIGGER reject_ask_idempotency_completion \
+         BEFORE UPDATE OF state ON gateway_invocation_idempotency \
+         WHEN OLD.state = 'reserved' AND NEW.state = 'completed' AND NEW.approval_id IS NOT NULL \
+         BEGIN SELECT RAISE(ABORT, 'forced Ask completion failure'); END",
+    )
+    .execute(app.pool())
+    .await
+    .expect("completion failure trigger should install");
+    let (failed_status, _, failed_replayed) = invoke_idempotent(
+        &app,
+        &token,
+        "ask-completion-failure",
+        "idempotency.ask",
+        ask_arguments.clone(),
+    )
+    .await;
+    assert_eq!(failed_status, StatusCode::INTERNAL_SERVER_ERROR);
+    assert!(!failed_replayed);
+    sqlx::query("DROP TRIGGER reject_ask_idempotency_completion")
+        .execute(app.pool())
+        .await
+        .expect("completion failure trigger should be removed");
+    let stranded = sqlx::query_as::<_, (String, i64)>(
+        "SELECT state, (SELECT COUNT(*) FROM approvals \
+         WHERE execution_id = 'gateway-idempotency:' || gateway_invocation_idempotency.id) \
+         FROM gateway_invocation_idempotency WHERE state = 'indeterminate' \
+         ORDER BY sequence DESC LIMIT 1",
+    )
+    .fetch_one(app.pool())
+    .await
+    .expect("failed completion should fail closed with its correlated approval");
+    assert_eq!(stranded, ("indeterminate".to_owned(), 1));
+
+    let (failed_retry_status, failed_retry_body, failed_retry_replayed) = invoke_idempotent(
+        &app,
+        &token,
+        "ask-completion-failure",
+        "idempotency.ask",
+        ask_arguments.clone(),
+    )
+    .await;
+    assert_eq!(failed_retry_status, StatusCode::CONFLICT);
+    assert_eq!(
+        failed_retry_body["error"]["code"],
+        "idempotency_outcome_unknown"
+    );
+    assert!(!failed_retry_replayed);
+    let matching_approvals = sqlx::query_scalar::<_, i64>(
+        "SELECT COUNT(*) FROM approvals WHERE callable_path_snapshot = 'tools.idempotency.ask'",
+    )
+    .fetch_one(app.pool())
+    .await
+    .expect("failed completion approval should count");
+    assert_eq!(
+        matching_approvals, 1,
+        "failed-closed retry must not duplicate the approval"
+    );
+    assert_eq!(
+        recorder.count(),
+        0,
+        "failed-closed retry must not call upstream"
+    );
+
+    let (status, body, _) = invoke_idempotent(
+        &app,
+        &token,
+        "ask-replay",
+        "idempotency.other",
+        ask_arguments.clone(),
+    )
+    .await;
+    assert_eq!(status, StatusCode::CONFLICT);
+    assert_eq!(body["error"]["code"], "idempotency_key_mismatch");
+    let (status, body, _) = invoke_idempotent(
+        &app,
+        &token,
+        "ask-replay",
+        "idempotency.ask",
+        json!({
+            "contentType": "application/json",
+            "body": { "value": "different" }
+        }),
+    )
+    .await;
+    assert_eq!(status, StatusCode::CONFLICT);
+    assert_eq!(body["error"]["code"], "idempotency_key_mismatch");
+
+    let second_token = create_gateway_token(&app, &admin).await;
+    let (first_owner_status, first_owner, first_owner_replayed) = invoke_idempotent(
+        &app,
+        &token,
+        "shared-across-tokens",
+        "idempotency.ask",
+        ask_arguments.clone(),
+    )
+    .await;
+    assert_eq!(first_owner_status, StatusCode::ACCEPTED);
+    assert!(!first_owner_replayed);
+    let (second_owner_status, second_owner, second_owner_replayed) = invoke_idempotent(
+        &app,
+        &second_token,
+        "shared-across-tokens",
+        "idempotency.ask",
+        ask_arguments.clone(),
+    )
+    .await;
+    assert_eq!(second_owner_status, StatusCode::ACCEPTED);
+    assert!(!second_owner_replayed);
+    assert_ne!(
+        first_owner["approval"]["id"],
+        second_owner["approval"]["id"]
+    );
+
+    let enabled_arguments = json!({
+        "contentType": "application/json",
+        "body": { "value": "enabled" }
+    });
+    let before_prepare_failure = recorder.count();
+    let reserved_before_failure = sqlx::query_scalar::<_, i64>(
+        "SELECT COUNT(*) FROM gateway_invocation_idempotency WHERE state = 'reserved'",
+    )
+    .fetch_one(app.pool())
+    .await
+    .expect("reserved idempotency records should count");
+    let (status, body, replayed) = invoke_idempotent(
+        &app,
+        &token,
+        "released-prepare-failure",
+        "idempotency.forbidden_prepare",
+        json!({ "headers": { "X-HTTP-Method-Override": "DELETE" } }),
+    )
+    .await;
+    assert_eq!(status, StatusCode::BAD_REQUEST);
+    assert_eq!(body["error"]["code"], "forbidden_tool_header");
+    assert!(!replayed);
+    assert_eq!(recorder.count(), before_prepare_failure);
+    let reserved_after_failure = sqlx::query_scalar::<_, i64>(
+        "SELECT COUNT(*) FROM gateway_invocation_idempotency WHERE state = 'reserved'",
+    )
+    .fetch_one(app.pool())
+    .await
+    .expect("reserved idempotency records should count");
+    assert_eq!(reserved_after_failure, reserved_before_failure);
+    let (status, _, replayed) = invoke_idempotent(
+        &app,
+        &token,
+        "released-prepare-failure",
+        "idempotency.enabled",
+        enabled_arguments.clone(),
+    )
+    .await;
+    assert_eq!(status, StatusCode::OK);
+    assert!(!replayed);
+    assert_eq!(recorder.count(), before_prepare_failure + 1);
+
+    let before_enabled = recorder.count();
+    let (status, first_enabled, replayed) = invoke_idempotent(
+        &app,
+        &token,
+        "enabled-replay",
+        "idempotency.enabled",
+        enabled_arguments.clone(),
+    )
+    .await;
+    assert_eq!(status, StatusCode::OK);
+    assert!(!replayed);
+    let (status, second_enabled, replayed) = invoke_idempotent(
+        &app,
+        &token,
+        "enabled-replay",
+        "idempotency.enabled",
+        enabled_arguments.clone(),
+    )
+    .await;
+    assert_eq!(status, StatusCode::OK);
+    assert!(replayed);
+    assert_eq!(second_enabled, first_enabled);
+    assert_eq!(recorder.count(), before_enabled + 1);
+
+    let concurrent_before = recorder.count();
+    let mut invocations = Vec::new();
+    for _ in 0..12 {
+        let router = app.router();
+        let token = token.clone();
+        let arguments = enabled_arguments.clone();
+        invocations.push(tokio::spawn(async move {
+            let authorization = format!("Bearer {token}");
+            let response = send(
+                router,
+                Method::POST,
+                "/api/v1/gateway/tools/invoke",
+                json!({ "path": "idempotency.enabled", "arguments": arguments }),
+                &[
+                    (header::AUTHORIZATION.as_str(), &authorization),
+                    ("idempotency-key", "enabled-concurrent"),
+                ],
+            )
+            .await;
+            (response.status(), response_body(response).await)
+        }));
+    }
+    for invocation in invocations {
+        let (status, body) = invocation.await.expect("invocation task should join");
+        assert!(
+            matches!(status, StatusCode::OK | StatusCode::CONFLICT),
+            "unexpected concurrent response {status}: {body}"
+        );
+        if status == StatusCode::CONFLICT {
+            assert_eq!(body["error"]["code"], "idempotency_in_progress");
+        }
+    }
+    assert_eq!(recorder.count(), concurrent_before + 1);
+    let (status, _, replayed) = invoke_idempotent(
+        &app,
+        &token,
+        "enabled-concurrent",
+        "idempotency.enabled",
+        enabled_arguments,
+    )
+    .await;
+    assert_eq!(status, StatusCode::OK);
+    assert!(replayed);
+    assert_eq!(recorder.count(), concurrent_before + 1);
+
+    upstream_task.abort();
+}
diff --git a/tests/openapi_lifecycle.rs b/tests/openapi_lifecycle.rs
new file mode 100644
index 000000000..5b927610b
--- /dev/null
+++ b/tests/openapi_lifecycle.rs
@@ -0,0 +1,2509 @@
+use std::{
+    collections::BTreeMap,
+    path::Path,
+    process::Stdio,
+    sync::{
+        Arc, Mutex,
+        atomic::{AtomicUsize, Ordering},
+    },
+    time::Duration,
+};
+
+use axum::{
+    Json, Router,
+    body::Body,
+    extract::State,
+    http::{Method, Request, StatusCode, header},
+    response::Redirect,
+    routing::{any, get},
+};
+use base64::{Engine as _, engine::general_purpose::STANDARD};
+use executor::{
+    AppConfig, ExecutorApp,
+    catalog::{AuditContext, ListToolsFilter, SourceHealth, ToolMode},
+};
+use http_body_util::BodyExt;
+use reqwest::{Client, redirect::Policy};
+use serde_json::{Value, json};
+use tokio::{net::TcpListener, process::Command, sync::RwLock, time::sleep};
+use tower::ServiceExt;
+use url::Url;
+
+const ORIGIN: &str = "http://127.0.0.1:4788";
+static TOKEN_IDEMPOTENCY_SEQUENCE: AtomicUsize = AtomicUsize::new(1);
+
+struct Admin {
+    cookie: String,
+    csrf: String,
+}
+
+struct Upstream {
+    address: std::net::SocketAddr,
+    specification: Arc<RwLock<Value>>,
+    spec_requests: Arc<AtomicUsize>,
+    task: tokio::task::JoinHandle<()>,
+}
+
+struct CredentialTarget {
+    address: std::net::SocketAddr,
+    requests: Arc<Mutex<Vec<CapturedRequest>>>,
+    task: tokio::task::JoinHandle<()>,
+}
+
+struct OAuthTestProvider {
+    issuer: String,
+    client: Client,
+    child: tokio::process::Child,
+}
+
+struct SpecRedirect {
+    address: std::net::SocketAddr,
+    target: Arc<RwLock<String>>,
+    task: tokio::task::JoinHandle<()>,
+}
+
+#[derive(Clone, Debug)]
+struct CapturedRequest {
+    path_and_query: String,
+    headers: BTreeMap<String, String>,
+}
+
+#[derive(Clone)]
+struct CredentialTargetState {
+    requests: Arc<Mutex<Vec<CapturedRequest>>>,
+}
+
+#[derive(Clone)]
+struct UpstreamState {
+    specification: Arc<RwLock<Value>>,
+    spec_requests: Arc<AtomicUsize>,
+}
+
+impl Upstream {
+    async fn start() -> Self {
+        Self::start_bound("127.0.0.1:0").await
+    }
+
+    async fn start_non_loopback() -> Self {
+        Self::start_bound("0.0.0.0:0").await
+    }
+
+    async fn start_bound(bind_address: &str) -> Self {
+        async fn serve_specification(State(state): State<UpstreamState>) -> Json<Value> {
+            state.spec_requests.fetch_add(1, Ordering::SeqCst);
+            Json(state.specification.read().await.clone())
+        }
+
+        let specification = Arc::new(RwLock::new(json!({})));
+        let spec_requests = Arc::new(AtomicUsize::new(0));
+        let listener = TcpListener::bind(bind_address)
+            .await
+            .expect("upstream listener should bind");
+        let address = listener.local_addr().expect("upstream address should read");
+        let router = Router::new()
+            .route("/openapi.json", get(serve_specification))
+            .route(
+                "/api/hello",
+                get(|| async { Json(json!({ "message": "still callable" })) }),
+            )
+            .with_state(UpstreamState {
+                specification: Arc::clone(&specification),
+                spec_requests: Arc::clone(&spec_requests),
+            });
+        let task = tokio::spawn(async move {
+            axum::serve(listener, router)
+                .await
+                .expect("upstream should serve");
+        });
+        Self {
+            address,
+            specification,
+            spec_requests,
+            task,
+        }
+    }
+
+    async fn set_paths(&self, paths: Value, description: &str) {
+        *self.specification.write().await = json!({
+            "openapi": "3.1.0",
+            "info": { "title": "Lifecycle API", "description": description },
+            "servers": [{ "url": format!("http://{}/api", self.address) }],
+            "paths": paths
+        });
+    }
+
+    fn spec_url(&self, query: Option<&str>) -> String {
+        match query {
+            Some(query) => format!("http://{}/openapi.json?{query}", self.address),
+            None => format!("http://{}/openapi.json", self.address),
+        }
+    }
+
+    fn spec_request_count(&self) -> usize {
+        self.spec_requests.load(Ordering::SeqCst)
+    }
+}
+
+impl Drop for Upstream {
+    fn drop(&mut self) {
+        self.task.abort();
+    }
+}
+
+impl CredentialTarget {
+    async fn start() -> Self {
+        Self::start_bound("127.0.0.1:0").await
+    }
+
+    async fn start_non_loopback() -> Self {
+        Self::start_bound("0.0.0.0:0").await
+    }
+
+    async fn start_bound(bind_address: &str) -> Self {
+        async fn capture(
+            State(state): State<CredentialTargetState>,
+            request: Request<Body>,
+        ) -> Json<Value> {
+            let captured = CapturedRequest {
+                path_and_query: request
+                    .uri()
+                    .path_and_query()
+                    .map(ToString::to_string)
+                    .unwrap_or_else(|| request.uri().path().to_owned()),
+                headers: request
+                    .headers()
+                    .iter()
+                    .filter_map(|(name, value)| {
+                        value
+                            .to_str()
+                            .ok()
+                            .map(|value| (name.as_str().to_owned(), value.to_owned()))
+                    })
+                    .collect(),
+            };
+            state
+                .requests
+                .lock()
+                .expect("credential target ledger locks")
+                .push(captured);
+            Json(json!({ "ok": true }))
+        }
+
+        let requests = Arc::new(Mutex::new(Vec::new()));
+        let listener = TcpListener::bind(bind_address)
+            .await
+            .expect("credential target listener should bind");
+        let address = listener
+            .local_addr()
+            .expect("credential target address should read");
+        let router = Router::new()
+            .route("/api/credential", any(capture))
+            .with_state(CredentialTargetState {
+                requests: Arc::clone(&requests),
+            });
+        let task = tokio::spawn(async move {
+            axum::serve(listener, router)
+                .await
+                .expect("credential target should serve");
+        });
+        Self {
+            address,
+            requests,
+            task,
+        }
+    }
+
+    fn origin(&self) -> String {
+        format!("http://{}", self.address)
+    }
+
+    fn requests(&self) -> Vec<CapturedRequest> {
+        self.requests
+            .lock()
+            .expect("credential target ledger locks")
+            .clone()
+    }
+}
+
+impl Drop for CredentialTarget {
+    fn drop(&mut self) {
+        self.task.abort();
+    }
+}
+
+impl OAuthTestProvider {
+    async fn start() -> Self {
+        let listener = TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("test port reserves");
+        let port = listener.local_addr().expect("test port resolves").port();
+        drop(listener);
+        let executable = format!(
+            "{}/e2e/node_modules/.bin/emulate",
+            env!("CARGO_MANIFEST_DIR")
+        );
+        let mut child = Command::new(executable)
+            .args(["start", "--service", "mcp", "--port", &port.to_string()])
+            .stdin(Stdio::null())
+            .stdout(Stdio::null())
+            .stderr(Stdio::null())
+            .kill_on_drop(true)
+            .spawn()
+            .expect("OAuth emulator starts");
+        let client = Client::builder()
+            .redirect(Policy::none())
+            .build()
+            .expect("test HTTP client builds");
+        let metadata_url =
+            format!("http://127.0.0.1:{port}/.well-known/oauth-authorization-server");
+        for _ in 0..200 {
+            if let Some(status) = child.try_wait().expect("OAuth emulator status reads") {
+                panic!("OAuth emulator exited before readiness with {status}");
+            }
+            if let Ok(response) = client.get(&metadata_url).send().await
+                && response.status().is_success()
+                && let Ok(metadata) = response.json::<Value>().await
+                && let Some(issuer) = metadata["issuer"].as_str()
+            {
+                return Self {
+                    issuer: issuer.to_owned(),
+                    client,
+                    child,
+                };
+            }
+            sleep(Duration::from_millis(25)).await;
+        }
+        let _ = child.start_kill();
+        panic!("OAuth emulator did not become ready");
+    }
+
+    async fn register_client(&self, callback_url: &str) -> String {
+        let response = self
+            .client
+            .post(format!("{}/register", self.issuer))
+            .json(&json!({
+                "client_name": "Executor OpenAPI origin test",
+                "redirect_uris": [callback_url],
+                "grant_types": ["authorization_code"],
+                "response_types": ["code"],
+                "token_endpoint_auth_method": "none"
+            }))
+            .send()
+            .await
+            .expect("OAuth client registration responds");
+        assert_eq!(response.status(), reqwest::StatusCode::CREATED);
+        response
+            .json::<Value>()
+            .await
+            .expect("OAuth registration is JSON")["client_id"]
+            .as_str()
+            .expect("OAuth registration returns client ID")
+            .to_owned()
+    }
+
+    async fn approve(&self, authorization_url: &str) -> Url {
+        let authorization_url = Url::parse(authorization_url).expect("authorization URL parses");
+        let mut form = authorization_url
+            .query_pairs()
+            .into_owned()
+            .collect::<Vec<_>>();
+        form.push(("login".to_owned(), "admin".to_owned()));
+        let response = self
+            .client
+            .post(format!("{}/authorize/approve", self.issuer))
+            .form(&form)
+            .send()
+            .await
+            .expect("OAuth approval responds");
+        assert_eq!(response.status(), reqwest::StatusCode::FOUND);
+        Url::parse(
+            response
+                .headers()
+                .get(reqwest::header::LOCATION)
+                .expect("OAuth approval redirects")
+                .to_str()
+                .expect("OAuth redirect is text"),
+        )
+        .expect("OAuth callback URL parses")
+    }
+}
+
+impl Drop for OAuthTestProvider {
+    fn drop(&mut self) {
+        let _ = self.child.start_kill();
+    }
+}
+
+impl SpecRedirect {
+    async fn start(target_url: String) -> Self {
+        async fn redirect(State(target): State<Arc<RwLock<String>>>) -> Redirect {
+            let target = target.read().await.clone();
+            Redirect::temporary(&target)
+        }
+
+        let target = Arc::new(RwLock::new(target_url));
+        let listener = TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("redirect listener should bind");
+        let address = listener.local_addr().expect("redirect address should read");
+        let router = Router::new()
+            .route("/openapi.json", get(redirect))
+            .with_state(Arc::clone(&target));
+        let task = tokio::spawn(async move {
+            axum::serve(listener, router)
+                .await
+                .expect("redirect source should serve");
+        });
+        Self {
+            address,
+            target,
+            task,
+        }
+    }
+
+    fn url(&self) -> String {
+        format!("http://{}/openapi.json", self.address)
+    }
+
+    async fn set_target(&self, target_url: String) {
+        *self.target.write().await = target_url;
+    }
+}
+
+impl Drop for SpecRedirect {
+    fn drop(&mut self) {
+        self.task.abort();
+    }
+}
+
+async fn send(
+    router: Router,
+    method: Method,
+    uri: &str,
+    body: Value,
+    headers: &[(&str, &str)],
+) -> axum::response::Response {
+    let mut request = Request::builder()
+        .method(method)
+        .uri(uri)
+        .header(header::CONTENT_TYPE, "application/json");
+    for (name, value) in headers {
+        request = request.header(*name, *value);
+    }
+    router
+        .oneshot(
+            request
+                .body(Body::from(body.to_string()))
+                .expect("request should build"),
+        )
+        .await
+        .expect("router should answer")
+}
+
+async fn json_body(response: axum::response::Response) -> Value {
+    let bytes = response
+        .into_body()
+        .collect()
+        .await
+        .expect("response should collect")
+        .to_bytes();
+    serde_json::from_slice(&bytes).expect("response should contain JSON")
+}
+
+fn cookies(response: &axum::response::Response) -> String {
+    response
+        .headers()
+        .get_all(header::SET_COOKIE)
+        .iter()
+        .map(|value| {
+            value
+                .to_str()
+                .expect("cookie should be text")
+                .split(';')
+                .next()
+                .expect("cookie should contain a value")
+        })
+        .collect::<Vec<_>>()
+        .join("; ")
+}
+
+async fn setup(app: &ExecutorApp) -> Admin {
+    let setup_token = app
+        .setup_token()
+        .expect("fresh app should expose a setup token");
+    let response = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/setup",
+        json!({
+            "setupToken": setup_token,
+            "username": "admin",
+            "password": "correct horse battery staple"
+        }),
+        &[(header::ORIGIN.as_str(), ORIGIN)],
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::CREATED);
+
+    let response = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/session",
+        json!({
+            "username": "admin",
+            "password": "correct horse battery staple"
+        }),
+        &[(header::ORIGIN.as_str(), ORIGIN)],
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::OK);
+    let cookie = cookies(&response);
+    let csrf = json_body(response).await["csrfToken"]
+        .as_str()
+        .expect("login should return a CSRF token")
+        .to_owned();
+    Admin { cookie, csrf }
+}
+
+fn admin_headers(admin: &Admin) -> [(&str, &str); 3] {
+    [
+        (header::COOKIE.as_str(), admin.cookie.as_str()),
+        (header::ORIGIN.as_str(), ORIGIN),
+        ("x-executor-csrf", admin.csrf.as_str()),
+    ]
+}
+
+async fn import_source(
+    app: &ExecutorApp,
+    admin: &Admin,
+    spec_url: &str,
+    preferred_slug: &str,
+    credential: Value,
+) -> Value {
+    let response = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/sources",
+        json!({
+            "kind": "openapi",
+            "displayName": "Lifecycle API",
+            "preferredSlug": preferred_slug,
+            "spec": { "type": "url", "url": spec_url },
+            "allowPrivateNetwork": true,
+            "credential": credential
+        }),
+        &admin_headers(admin),
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::CREATED);
+    json_body(response).await
+}
+
+async fn gateway_token(app: &ExecutorApp, admin: &Admin) -> String {
+    let idempotency_key = format!(
+        "openapi-lifecycle-token-{}",
+        TOKEN_IDEMPOTENCY_SEQUENCE.fetch_add(1, Ordering::Relaxed)
+    );
+    let mut headers = admin_headers(admin).to_vec();
+    headers.push(("idempotency-key", idempotency_key.as_str()));
+    let response = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/tokens",
+        json!({ "name": "lifecycle-test" }),
+        &headers,
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::CREATED);
+    json_body(response).await["token"]
+        .as_str()
+        .expect("token should be returned once")
+        .to_owned()
+}
+
+async fn refresh(app: &ExecutorApp, admin: &Admin, source_id: &str) -> StatusCode {
+    send(
+        app.router(),
+        Method::POST,
+        &format!("/api/v1/sources/{source_id}/refresh"),
+        json!({}),
+        &admin_headers(admin),
+    )
+    .await
+    .status()
+}
+
+fn hello_paths() -> Value {
+    json!({
+        "/hello": {
+            "get": {
+                "operationId": "sayHello",
+                "responses": {
+                    "200": {
+                        "description": "ok",
+                        "content": {
+                            "application/json": { "schema": { "type": "object" } }
+                        }
+                    }
+                }
+            }
+        }
+    })
+}
+
+async fn set_secured_specification(
+    upstream: &Upstream,
+    server_origin: &str,
+    scheme_name: &str,
+    scheme: Value,
+    operation_id: &str,
+) {
+    *upstream.specification.write().await = json!({
+        "openapi": "3.1.0",
+        "info": { "title": "Credential origin API" },
+        "servers": [{ "url": format!("{server_origin}/api") }],
+        "components": { "securitySchemes": { (scheme_name): scheme } },
+        "paths": { "/credential": { "get": {
+            "operationId": operation_id,
+            "security": [{ (scheme_name): [] }],
+            "responses": {
+                "200": {
+                    "description": "ok",
+                    "content": {
+                        "application/json": { "schema": { "type": "object" } }
+                    }
+                }
+            }
+        }}}
+    });
+}
+
+async fn source_tool_path(app: &ExecutorApp, source_id: &str) -> String {
+    app.catalog()
+        .list_tools(ListToolsFilter {
+            source_id: Some(source_id.to_owned()),
+            limit: 10,
+            ..Default::default()
+        })
+        .await
+        .expect("source tools should list")
+        .items
+        .into_iter()
+        .next()
+        .expect("source should expose a tool")
+        .sandbox_path
+}
+
+async fn invoke_path(app: &ExecutorApp, token: &str, path: &str) -> axum::response::Response {
+    let authorization = format!("Bearer {token}");
+    send(
+        app.router(),
+        Method::POST,
+        "/api/v1/gateway/tools/invoke",
+        json!({ "path": path, "arguments": {} }),
+        &[(header::AUTHORIZATION.as_str(), &authorization)],
+    )
+    .await
+}
+
+#[tokio::test]
+async fn non_loopback_http_rejects_every_static_credential_before_catalog_or_dispatch() {
+    let upstream = Upstream::start().await;
+    let insecure_target = CredentialTarget::start_non_loopback().await;
+    let directory = tempfile::tempdir().expect("temporary directory should be created");
+    let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+        .await
+        .expect("Executor should open");
+    let admin = setup(&app).await;
+    let cases = [
+        (
+            "insecure-header",
+            json!({ "type": "apiKey", "in": "header", "name": "X-API-Key" }),
+            json!({ "type": "api_key", "value": "header-secret" }),
+        ),
+        (
+            "insecure-query",
+            json!({ "type": "apiKey", "in": "query", "name": "api_key" }),
+            json!({ "type": "api_key", "value": "query-secret" }),
+        ),
+        (
+            "insecure-cookie",
+            json!({ "type": "apiKey", "in": "cookie", "name": "session" }),
+            json!({ "type": "api_key", "value": "cookie-secret" }),
+        ),
+        (
+            "insecure-basic",
+            json!({ "type": "http", "scheme": "basic" }),
+            json!({ "type": "basic", "username": "user", "password": "pass" }),
+        ),
+        (
+            "insecure-bearer",
+            json!({ "type": "http", "scheme": "bearer" }),
+            json!({ "type": "bearer", "token": "bearer-secret" }),
+        ),
+        (
+            "insecure-manual-oauth",
+            json!({ "type": "oauth2", "flows": {} }),
+            json!({ "type": "oauth_access_token", "access_token": "oauth-secret" }),
+        ),
+    ];
+
+    for (slug, scheme, credential) in cases {
+        set_secured_specification(&upstream, &insecure_target.origin(), "Auth", scheme, slug).await;
+        let rejected = send(
+            app.router(),
+            Method::POST,
+            "/api/v1/sources",
+            json!({
+                "kind": "openapi",
+                "displayName": "Insecure transport",
+                "preferredSlug": slug,
+                "spec": { "type": "url", "url": upstream.spec_url(None) },
+                "allowPrivateNetwork": true,
+                "credential": { "schemes": { "Auth": credential } }
+            }),
+            &admin_headers(&admin),
+        )
+        .await;
+        assert_eq!(rejected.status(), StatusCode::BAD_REQUEST, "{slug}");
+        assert_eq!(
+            json_body(rejected).await["error"]["code"],
+            "insecure_openapi_transport",
+            "{slug}"
+        );
+        assert!(insecure_target.requests().is_empty(), "{slug}");
+    }
+
+    set_secured_specification(
+        &upstream,
+        "http://198.51.100.10",
+        "Auth",
+        json!({ "type": "http", "scheme": "bearer" }),
+        "insecurePublicAnonymous",
+    )
+    .await;
+    let anonymous = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/sources",
+        json!({
+            "kind": "openapi",
+            "displayName": "Public plaintext transport",
+            "preferredSlug": "insecure-public-anonymous",
+            "spec": { "type": "url", "url": upstream.spec_url(None) },
+            "allowPrivateNetwork": true,
+            "credential": { "schemes": {} }
+        }),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(anonymous.status(), StatusCode::BAD_REQUEST);
+    assert_eq!(
+        json_body(anonymous).await["error"]["code"],
+        "insecure_openapi_transport"
+    );
+    let preview = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/sources/openapi/preview",
+        json!({
+            "spec": {
+                "type": "inline",
+                "content": upstream.specification.read().await.to_string()
+            },
+            "allowPrivateNetwork": true
+        }),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(preview.status(), StatusCode::BAD_REQUEST);
+    assert_eq!(
+        json_body(preview).await["error"]["code"],
+        "insecure_openapi_transport"
+    );
+    set_secured_specification(
+        &upstream,
+        "https://api.example.test",
+        "Auth",
+        json!({ "type": "http", "scheme": "bearer" }),
+        "secureHttpsPreview",
+    )
+    .await;
+    let https_preview = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/sources/openapi/preview",
+        json!({
+            "spec": {
+                "type": "inline",
+                "content": upstream.specification.read().await.to_string()
+            },
+            "allowPrivateNetwork": false
+        }),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(https_preview.status(), StatusCode::OK);
+    assert!(
+        app.catalog()
+            .list_tools(ListToolsFilter {
+                include_tombstoned: true,
+                ..Default::default()
+            })
+            .await
+            .expect("catalog should remain readable")
+            .items
+            .is_empty()
+    );
+    assert!(insecure_target.requests().is_empty());
+}
+
+#[tokio::test]
+async fn spec_locators_and_redirect_hops_enforce_confidential_transport_before_request() {
+    let insecure_spec = Upstream::start_non_loopback().await;
+    insecure_spec
+        .set_paths(hello_paths(), "must not fetch")
+        .await;
+    let safe_spec = Upstream::start().await;
+    safe_spec.set_paths(hello_paths(), "safe loopback").await;
+    let second_redirect = SpecRedirect::start(insecure_spec.spec_url(None)).await;
+    let first_redirect = SpecRedirect::start(second_redirect.url()).await;
+    let directory = tempfile::tempdir().expect("temporary directory should be created");
+    let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+        .await
+        .expect("Executor should open");
+    let admin = setup(&app).await;
+
+    for (slug, spec_url) in [
+        ("private-plaintext-spec", insecure_spec.spec_url(None)),
+        (
+            "public-plaintext-spec",
+            "http://198.51.100.10/openapi.json".to_owned(),
+        ),
+        ("redirect-downgrade-spec", first_redirect.url()),
+    ] {
+        let rejected = send(
+            app.router(),
+            Method::POST,
+            "/api/v1/sources",
+            json!({
+                "kind": "openapi",
+                "displayName": "Insecure specification",
+                "preferredSlug": slug,
+                "spec": { "type": "url", "url": spec_url },
+                "allowPrivateNetwork": true,
+                "credential": { "schemes": {} }
+            }),
+            &admin_headers(&admin),
+        )
+        .await;
+        assert_eq!(rejected.status(), StatusCode::BAD_REQUEST, "{slug}");
+        assert_eq!(
+            json_body(rejected).await["error"]["code"],
+            "insecure_openapi_transport",
+            "{slug}"
+        );
+    }
+    assert_eq!(
+        insecure_spec.spec_request_count(),
+        0,
+        "the private HTTP locator and redirect target must receive no request"
+    );
+
+    first_redirect.set_target(safe_spec.spec_url(None)).await;
+    let created = import_source(
+        &app,
+        &admin,
+        &first_redirect.url(),
+        "loopback-redirect-spec",
+        json!({ "schemes": {} }),
+    )
+    .await;
+    assert!(created["id"].is_string());
+    assert_eq!(safe_spec.spec_request_count(), 1);
+}
+
+#[tokio::test]
+async fn refresh_rejects_per_scheme_origin_changes_for_every_static_credential_carrier() {
+    let upstream = Upstream::start().await;
+    let directory = tempfile::tempdir().expect("temporary directory should be created");
+    let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+        .await
+        .expect("Executor should open");
+    let admin = setup(&app).await;
+    let token = gateway_token(&app, &admin).await;
+    let insecure_target = CredentialTarget::start_non_loopback().await;
+    let cases = [
+        (
+            "origin-header",
+            json!({ "type": "apiKey", "in": "header", "name": "X-API-Key" }),
+            json!({ "type": "api_key", "value": "header-secret" }),
+            "header-secret",
+        ),
+        (
+            "origin-query",
+            json!({ "type": "apiKey", "in": "query", "name": "api_key" }),
+            json!({ "type": "api_key", "value": "query-secret" }),
+            "api_key=query-secret",
+        ),
+        (
+            "origin-cookie",
+            json!({ "type": "apiKey", "in": "cookie", "name": "session" }),
+            json!({ "type": "api_key", "value": "cookie-secret" }),
+            "session=cookie-secret",
+        ),
+        (
+            "origin-basic",
+            json!({ "type": "http", "scheme": "basic" }),
+            json!({ "type": "basic", "username": "user", "password": "pass" }),
+            "Basic dXNlcjpwYXNz",
+        ),
+        (
+            "origin-bearer",
+            json!({ "type": "http", "scheme": "bearer" }),
+            json!({ "type": "bearer", "token": "bearer-secret" }),
+            "Bearer bearer-secret",
+        ),
+        (
+            "origin-manual-oauth",
+            json!({ "type": "oauth2", "flows": {} }),
+            json!({ "type": "oauth_access_token", "access_token": "oauth-secret" }),
+            "Bearer oauth-secret",
+        ),
+    ];
+
+    for (slug, scheme, credential, expected_carrier) in cases {
+        let origin_a = CredentialTarget::start().await;
+        let origin_b = CredentialTarget::start().await;
+        set_secured_specification(&upstream, &origin_a.origin(), "Auth", scheme.clone(), slug)
+            .await;
+        let created = import_source(
+            &app,
+            &admin,
+            &upstream.spec_url(None),
+            slug,
+            json!({ "schemes": { "Auth": credential } }),
+        )
+        .await;
+        let source_id = created["id"]
+            .as_str()
+            .expect("source should have an ID")
+            .to_owned();
+        let path = source_tool_path(&app, &source_id).await;
+        let invoked = invoke_path(&app, &token, &path).await;
+        assert_eq!(invoked.status(), StatusCode::OK, "{slug} should invoke");
+        let first = origin_a.requests();
+        assert_eq!(first.len(), 1, "{slug} should reach origin A once");
+        let captured = format!("{} {:?}", first[0].path_and_query, first[0].headers);
+        assert!(
+            captured.contains(expected_carrier),
+            "{slug} should send its expected credential carrier"
+        );
+
+        let before_source = app
+            .catalog()
+            .source(&source_id)
+            .await
+            .expect("source should read");
+        let before_binding = app
+            .catalog()
+            .tool_binding(
+                &app.catalog()
+                    .list_tools(ListToolsFilter {
+                        source_id: Some(source_id.clone()),
+                        limit: 10,
+                        ..Default::default()
+                    })
+                    .await
+                    .expect("source tools should list")
+                    .items[0]
+                    .id,
+            )
+            .await
+            .expect("binding should read");
+        let before_global_revision = app
+            .catalog()
+            .global_revision()
+            .await
+            .expect("global revision should read");
+
+        set_secured_specification(&upstream, &origin_b.origin(), "Auth", scheme, slug).await;
+        let rejected = send(
+            app.router(),
+            Method::POST,
+            &format!("/api/v1/sources/{source_id}/refresh"),
+            json!({}),
+            &admin_headers(&admin),
+        )
+        .await;
+        assert_eq!(rejected.status(), StatusCode::CONFLICT, "{slug}");
+        assert_eq!(
+            json_body(rejected).await["error"]["code"],
+            "openapi_credential_origin_changed"
+        );
+
+        let after_source = app
+            .catalog()
+            .source(&source_id)
+            .await
+            .expect("source should remain readable");
+        assert_eq!(after_source.revision, before_source.revision, "{slug}");
+        assert_eq!(
+            after_source.catalog_revision, before_source.catalog_revision,
+            "{slug}"
+        );
+        assert_eq!(
+            app.catalog()
+                .global_revision()
+                .await
+                .expect("global revision should remain readable"),
+            before_global_revision,
+            "{slug}"
+        );
+        assert_eq!(
+            app.catalog()
+                .tool_binding(&before_binding.tool_id)
+                .await
+                .expect("last-good binding should remain")
+                .binding,
+            before_binding.binding,
+            "{slug}"
+        );
+
+        let invoked = invoke_path(&app, &token, &path).await;
+        assert_eq!(
+            invoked.status(),
+            StatusCode::OK,
+            "{slug} last-good binding should remain callable"
+        );
+        assert_eq!(origin_a.requests().len(), 2, "{slug}");
+        assert!(
+            origin_b.requests().is_empty(),
+            "{slug} must not reach origin B"
+        );
+
+        sqlx::query(
+            "UPDATE tool_bindings SET definition_json = json_set(definition_json, '$.serverUrl', ?) \
+             WHERE tool_id = ?",
+        )
+        .bind(format!("{}/api", insecure_target.origin()))
+        .bind(&before_binding.tool_id)
+        .execute(app.pool())
+        .await
+        .expect("stored binding should tamper");
+        let blocked = invoke_path(&app, &token, &path).await;
+        assert_eq!(blocked.status(), StatusCode::CONFLICT, "{slug}");
+        assert_eq!(
+            json_body(blocked).await["error"]["code"],
+            "insecure_openapi_transport",
+            "{slug}"
+        );
+        assert!(insecure_target.requests().is_empty(), "{slug}");
+        assert_eq!(origin_a.requests().len(), 2, "{slug}");
+    }
+}
+
+#[tokio::test]
+async fn oauth_callback_refresh_cannot_move_managed_bearer_to_a_new_origin() {
+    let provider = OAuthTestProvider::start().await;
+    let upstream = Upstream::start().await;
+    let origin_a = CredentialTarget::start().await;
+    let origin_b = CredentialTarget::start().await;
+    let oauth_scheme = json!({
+        "type": "oauth2",
+        "flows": { "authorizationCode": {
+            "authorizationUrl": format!("{}/authorize", provider.issuer),
+            "tokenUrl": format!("{}/token", provider.issuer),
+            "scopes": { "repo": "Read repositories" }
+        }}
+    });
+    set_secured_specification(
+        &upstream,
+        &origin_a.origin(),
+        "oauth",
+        oauth_scheme.clone(),
+        "managedOAuthCall",
+    )
+    .await;
+    let directory = tempfile::tempdir().expect("temporary directory should be created");
+    let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+        .await
+        .expect("Executor should open");
+    let admin = setup(&app).await;
+    let created = import_source(
+        &app,
+        &admin,
+        &upstream.spec_url(None),
+        "managed_oauth_origin",
+        json!({ "schemes": {} }),
+    )
+    .await;
+    let source_id = created["id"]
+        .as_str()
+        .expect("source should have an ID")
+        .to_owned();
+    let mutation_headers = admin_headers(&admin);
+    let connection_input = |expected_revision, client_id: &str| {
+        json!({
+            "expectedRevision": expected_revision,
+            "discovery": { "type": "issuer", "issuer": provider.issuer },
+            "client": { "clientId": client_id, "authentication": "none" },
+            "scopes": ["repo"]
+        })
+    };
+    let placeholder = send(
+        app.router(),
+        Method::PUT,
+        &format!("/api/v1/sources/{source_id}/oauth/oauth"),
+        connection_input(0, "pending-dynamic-registration"),
+        &mutation_headers,
+    )
+    .await;
+    assert_eq!(placeholder.status(), StatusCode::OK);
+    let placeholder = json_body(placeholder).await;
+    let connection_id = placeholder["id"]
+        .as_str()
+        .expect("placeholder connection has an ID")
+        .to_owned();
+    let client_id = provider
+        .register_client(
+            placeholder["callbackUrl"]
+                .as_str()
+                .expect("placeholder has a callback URL"),
+        )
+        .await;
+    let configured = send(
+        app.router(),
+        Method::PUT,
+        &format!("/api/v1/sources/{source_id}/oauth/oauth"),
+        connection_input(
+            placeholder["revision"]
+                .as_i64()
+                .expect("placeholder has a revision"),
+            &client_id,
+        ),
+        &mutation_headers,
+    )
+    .await;
+    assert_eq!(configured.status(), StatusCode::OK);
+    let configured = json_body(configured).await;
+    let authorization = send(
+        app.router(),
+        Method::POST,
+        &format!("/api/v1/sources/{source_id}/oauth/oauth/authorize"),
+        json!({
+            "expectedRevision": configured["revision"]
+                .as_i64()
+                .expect("configured connection has a revision")
+        }),
+        &mutation_headers,
+    )
+    .await;
+    assert_eq!(authorization.status(), StatusCode::OK);
+    let authorization = json_body(authorization).await;
+    let provider_callback = provider
+        .approve(
+            authorization["authorizationUrl"]
+                .as_str()
+                .expect("authorization URL returns"),
+        )
+        .await;
+    let before_callback_source = app
+        .catalog()
+        .source(&source_id)
+        .await
+        .expect("source should read");
+    let before_callback_binding = app
+        .catalog()
+        .tool_binding(
+            &app.catalog()
+                .list_tools(ListToolsFilter {
+                    source_id: Some(source_id.clone()),
+                    limit: 10,
+                    ..Default::default()
+                })
+                .await
+                .expect("source tools should list")
+                .items[0]
+                .id,
+        )
+        .await
+        .expect("binding should read");
+
+    set_secured_specification(
+        &upstream,
+        &origin_b.origin(),
+        "oauth",
+        oauth_scheme,
+        "managedOAuthCall",
+    )
+    .await;
+    let callback_uri = provider_callback.query().map_or_else(
+        || provider_callback.path().to_owned(),
+        |query| format!("{}?{query}", provider_callback.path()),
+    );
+    let callback = send(
+        app.router(),
+        Method::GET,
+        &callback_uri,
+        json!(null),
+        &[(header::COOKIE.as_str(), &admin.cookie)],
+    )
+    .await;
+    assert_eq!(callback.status(), StatusCode::SEE_OTHER);
+    let redirect = Url::parse(
+        callback
+            .headers()
+            .get(header::LOCATION)
+            .expect("callback redirects")
+            .to_str()
+            .expect("callback redirect is text"),
+    )
+    .expect("callback redirect parses");
+    assert_eq!(
+        redirect
+            .query_pairs()
+            .find(|(key, _)| key == "result")
+            .expect("callback includes a result")
+            .1,
+        "success_refresh_failed"
+    );
+    assert_eq!(
+        redirect
+            .query_pairs()
+            .find(|(key, _)| key == "oauth")
+            .expect("callback includes a connection")
+            .1,
+        connection_id
+    );
+
+    let after_callback_source = app
+        .catalog()
+        .source(&source_id)
+        .await
+        .expect("source should remain readable");
+    assert_eq!(
+        after_callback_source.revision,
+        before_callback_source.revision
+    );
+    assert_eq!(
+        after_callback_source.catalog_revision,
+        before_callback_source.catalog_revision
+    );
+    assert_eq!(
+        app.catalog()
+            .tool_binding(&before_callback_binding.tool_id)
+            .await
+            .expect("last-good binding should remain")
+            .binding,
+        before_callback_binding.binding
+    );
+    let stored = app
+        .catalog()
+        .credential(&source_id)
+        .await
+        .expect("credential should decrypt")
+        .expect("credential envelope should exist");
+    assert_eq!(
+        stored.credential.payload["credentialOrigins"]["oauth"],
+        json!([origin_a.origin()])
+    );
+
+    let manual_refresh = send(
+        app.router(),
+        Method::POST,
+        &format!("/api/v1/sources/{source_id}/refresh"),
+        json!({}),
+        &mutation_headers,
+    )
+    .await;
+    assert_eq!(manual_refresh.status(), StatusCode::CONFLICT);
+    assert_eq!(
+        json_body(manual_refresh).await["error"]["code"],
+        "openapi_credential_origin_changed"
+    );
+
+    let token = gateway_token(&app, &admin).await;
+    let path = source_tool_path(&app, &source_id).await;
+    let invoked = invoke_path(&app, &token, &path).await;
+    assert_eq!(invoked.status(), StatusCode::OK);
+    let requests = origin_a.requests();
+    assert_eq!(requests.len(), 1);
+    assert!(
+        requests[0]
+            .headers
+            .get("authorization")
+            .is_some_and(|value| value.starts_with("Bearer "))
+    );
+    assert!(origin_b.requests().is_empty());
+
+    let listed = send(
+        app.router(),
+        Method::GET,
+        &format!("/api/v1/sources/{source_id}/oauth"),
+        json!(null),
+        &[(header::COOKIE.as_str(), &admin.cookie)],
+    )
+    .await;
+    assert_eq!(listed.status(), StatusCode::OK);
+    let listed = json_body(listed).await;
+    let connection_revision = listed["connections"][0]["revision"]
+        .as_i64()
+        .expect("managed OAuth connection has a revision");
+    sqlx::query(
+        "CREATE TRIGGER reject_oauth_origin_retire BEFORE UPDATE ON source_credentials \
+         BEGIN SELECT RAISE(ABORT, 'reject OAuth origin retirement'); END",
+    )
+    .execute(app.pool())
+    .await
+    .expect("origin retirement failure trigger should install");
+    let delete_uri =
+        format!("/api/v1/sources/{source_id}/oauth/oauth?expectedRevision={connection_revision}");
+    let failed_delete = send(
+        app.router(),
+        Method::DELETE,
+        &delete_uri,
+        json!(null),
+        &mutation_headers,
+    )
+    .await;
+    assert_eq!(failed_delete.status(), StatusCode::INTERNAL_SERVER_ERROR);
+    assert_eq!(
+        json_body(failed_delete).await["error"]["code"],
+        "internal_error"
+    );
+    assert_eq!(
+        sqlx::query_scalar::<_, i64>(
+            "SELECT COUNT(*) FROM oauth_connections WHERE source_id = ? AND credential_key = ?",
+        )
+        .bind(&source_id)
+        .bind("oauth")
+        .fetch_one(app.pool())
+        .await
+        .expect("OAuth connection count should read"),
+        0
+    );
+    let stranded = app
+        .catalog()
+        .credential(&source_id)
+        .await
+        .expect("credential should decrypt")
+        .expect("credential envelope should remain");
+    assert_eq!(
+        stranded.credential.payload["credentialOrigins"]["oauth"],
+        json!([origin_a.origin()])
+    );
+    sqlx::query("DROP TRIGGER reject_oauth_origin_retire")
+        .execute(app.pool())
+        .await
+        .expect("origin retirement failure trigger should drop");
+    let retried_delete = send(
+        app.router(),
+        Method::DELETE,
+        &delete_uri,
+        json!(null),
+        &mutation_headers,
+    )
+    .await;
+    assert_eq!(retried_delete.status(), StatusCode::NO_CONTENT);
+    let retired = app
+        .catalog()
+        .credential(&source_id)
+        .await
+        .expect("credential should decrypt")
+        .expect("credential envelope should remain");
+    assert!(
+        retired
+            .credential
+            .payload
+            .get("credentialOrigins")
+            .is_none(),
+        "deleting the last owner must retire its origin pin"
+    );
+    assert_eq!(refresh(&app, &admin, &source_id).await, StatusCode::OK);
+    assert_eq!(
+        app.catalog()
+            .tool_binding(&before_callback_binding.tool_id)
+            .await
+            .expect("refreshed binding should read")
+            .binding
+            .openapi()
+            .expect("binding should remain OpenAPI")
+            .server_url,
+        format!("{}/api", origin_b.origin())
+    );
+}
+
+#[tokio::test]
+async fn redirected_spec_final_origin_fences_relative_credential_destinations() {
+    let spec_a = Upstream::start().await;
+    let spec_b = Upstream::start().await;
+    let relative_document = json!({
+        "openapi": "3.1.0",
+        "info": { "title": "Redirected relative API" },
+        "servers": [{ "url": "./api" }],
+        "components": { "securitySchemes": {
+            "ApiKey": { "type": "apiKey", "in": "header", "name": "X-API-Key" }
+        }},
+        "paths": { "/credential": { "get": {
+            "operationId": "redirectedCredential",
+            "security": [{ "ApiKey": [] }],
+            "responses": { "200": { "description": "ok" } }
+        }}}
+    });
+    *spec_a.specification.write().await = relative_document.clone();
+    *spec_b.specification.write().await = relative_document;
+    let redirect = SpecRedirect::start(spec_a.spec_url(None)).await;
+    let directory = tempfile::tempdir().expect("temporary directory should be created");
+    let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+        .await
+        .expect("Executor should open");
+    let admin = setup(&app).await;
+    let created = import_source(
+        &app,
+        &admin,
+        &redirect.url(),
+        "redirected_origin",
+        json!({ "schemes": {
+            "ApiKey": { "type": "api_key", "value": "secret" }
+        }}),
+    )
+    .await;
+    let source_id = created["id"]
+        .as_str()
+        .expect("source should have an ID")
+        .to_owned();
+    let before = app
+        .catalog()
+        .source(&source_id)
+        .await
+        .expect("source should read");
+    let stored = app
+        .catalog()
+        .credential(&source_id)
+        .await
+        .expect("credential should decrypt")
+        .expect("credential should exist");
+    assert_eq!(
+        stored.credential.payload["credentialOrigins"]["ApiKey"],
+        json!([format!("http://{}", spec_a.address)])
+    );
+
+    redirect.set_target(spec_b.spec_url(None)).await;
+    let rejected = send(
+        app.router(),
+        Method::POST,
+        &format!("/api/v1/sources/{source_id}/refresh"),
+        json!({}),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(rejected.status(), StatusCode::CONFLICT);
+    assert_eq!(
+        json_body(rejected).await["error"]["code"],
+        "openapi_credential_origin_changed"
+    );
+    let after = app
+        .catalog()
+        .source(&source_id)
+        .await
+        .expect("source should remain readable");
+    assert_eq!(after.revision, before.revision);
+    assert_eq!(after.catalog_revision, before.catalog_revision);
+}
+
+#[tokio::test]
+async fn query_bearing_document_urls_never_reach_persisted_tool_bindings() {
+    let upstream = Upstream::start().await;
+    *upstream.specification.write().await = json!({
+        "openapi": "3.1.0",
+        "info": { "title": "Query-safe document base" },
+        "servers": [{ "url": "" }],
+        "paths": { "/api/hello": { "get": {
+            "operationId": "querySafeHello",
+            "responses": {
+                "200": {
+                    "description": "ok",
+                    "content": {
+                        "application/json": { "schema": { "type": "object" } }
+                    }
+                }
+            }
+        }}}
+    });
+    let direct_secret = "direct-document-secret-4a2dc144";
+    let redirect_secret = "redirect-document-secret-a576c879";
+    let redirect =
+        SpecRedirect::start(upstream.spec_url(Some(&format!("token={redirect_secret}")))).await;
+    let directory = tempfile::tempdir().expect("temporary directory should be created");
+    let data_dir = directory.path().to_path_buf();
+    let app = ExecutorApp::open(AppConfig::new(data_dir.clone()))
+        .await
+        .expect("Executor should open");
+    let admin = setup(&app).await;
+    let token = gateway_token(&app, &admin).await;
+
+    let direct = import_source(
+        &app,
+        &admin,
+        &upstream.spec_url(Some(&format!("token={direct_secret}"))),
+        "direct-query-base",
+        json!({ "schemes": {} }),
+    )
+    .await;
+    let redirected = import_source(
+        &app,
+        &admin,
+        &redirect.url(),
+        "redirect-query-base",
+        json!({ "schemes": {} }),
+    )
+    .await;
+
+    for created in [&direct, &redirected] {
+        let source_id = created["id"].as_str().expect("source should have an ID");
+        let path = source_tool_path(&app, source_id).await;
+        assert_eq!(
+            invoke_path(&app, &token, &path).await.status(),
+            StatusCode::OK
+        );
+    }
+    let definitions = sqlx::query_scalar::<_, String>(
+        "SELECT definition_json FROM tool_bindings ORDER BY tool_id",
+    )
+    .fetch_all(app.pool())
+    .await
+    .expect("tool bindings should read");
+    assert_eq!(definitions.len(), 2);
+    for definition in definitions {
+        assert!(!definition.contains(direct_secret));
+        assert!(!definition.contains(redirect_secret));
+        let binding: Value = serde_json::from_str(&definition).expect("binding should be JSON");
+        assert!(
+            Url::parse(
+                binding["serverUrl"]
+                    .as_str()
+                    .expect("binding should contain a server URL")
+            )
+            .expect("server URL should parse")
+            .query()
+            .is_none()
+        );
+    }
+
+    sqlx::query("PRAGMA wal_checkpoint(TRUNCATE)")
+        .fetch_all(app.pool())
+        .await
+        .expect("WAL should checkpoint");
+    app.pool().close().await;
+    drop(app);
+    for file_name in ["executor.db", "executor.db-wal", "executor.db-shm"] {
+        let path = data_dir.join(file_name);
+        if path.exists() {
+            assert_file_excludes(&path, direct_secret);
+            assert_file_excludes(&path, redirect_secret);
+        }
+    }
+}
+
+#[tokio::test]
+async fn credentialless_refresh_can_move_then_later_credential_binding_pins_current_origin() {
+    let upstream = Upstream::start().await;
+    let origin_a = CredentialTarget::start().await;
+    let origin_b = CredentialTarget::start().await;
+    let insecure_origin = CredentialTarget::start_non_loopback().await;
+    let scheme = json!({ "type": "http", "scheme": "bearer" });
+    set_secured_specification(
+        &upstream,
+        &origin_a.origin(),
+        "BearerAuth",
+        scheme.clone(),
+        "anonymousMove",
+    )
+    .await;
+    let directory = tempfile::tempdir().expect("temporary directory should be created");
+    let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+        .await
+        .expect("Executor should open");
+    let admin = setup(&app).await;
+    let created = import_source(
+        &app,
+        &admin,
+        &upstream.spec_url(None),
+        "credentialless_move",
+        json!({ "schemes": {} }),
+    )
+    .await;
+    let source_id = created["id"]
+        .as_str()
+        .expect("source should have an ID")
+        .to_owned();
+
+    let tool_id = app
+        .catalog()
+        .list_tools(ListToolsFilter {
+            source_id: Some(source_id.clone()),
+            limit: 10,
+            ..Default::default()
+        })
+        .await
+        .expect("source tools should list")
+        .items[0]
+        .id
+        .clone();
+    let original_binding = sqlx::query_scalar::<_, String>(
+        "SELECT definition_json FROM tool_bindings WHERE tool_id = ?",
+    )
+    .bind(&tool_id)
+    .fetch_one(app.pool())
+    .await
+    .expect("tool binding should read");
+    sqlx::query(
+        "UPDATE tool_bindings SET definition_json = json_set(definition_json, '$.serverUrl', ?) \
+         WHERE tool_id = ?",
+    )
+    .bind(format!("{}/api", insecure_origin.origin()))
+    .bind(&tool_id)
+    .execute(app.pool())
+    .await
+    .expect("tool binding should tamper");
+    let insecure_rebind = send(
+        app.router(),
+        Method::PUT,
+        &format!("/api/v1/sources/{source_id}/credentials"),
+        json!({
+            "expectedRevision": 0,
+            "credential": { "schemes": {
+                "BearerAuth": { "type": "bearer", "token": "must-not-bind" }
+            }}
+        }),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(insecure_rebind.status(), StatusCode::BAD_REQUEST);
+    assert_eq!(
+        json_body(insecure_rebind).await["error"]["code"],
+        "insecure_openapi_transport"
+    );
+    assert_eq!(
+        app.catalog()
+            .credential(&source_id)
+            .await
+            .expect("credential should decrypt")
+            .expect("credential envelope should exist")
+            .revision,
+        0
+    );
+    assert!(insecure_origin.requests().is_empty());
+    sqlx::query("UPDATE tool_bindings SET definition_json = ? WHERE tool_id = ?")
+        .bind(original_binding)
+        .bind(&tool_id)
+        .execute(app.pool())
+        .await
+        .expect("tool binding should restore");
+
+    set_secured_specification(
+        &upstream,
+        &origin_b.origin(),
+        "BearerAuth",
+        scheme.clone(),
+        "anonymousMove",
+    )
+    .await;
+    assert_eq!(refresh(&app, &admin, &source_id).await, StatusCode::OK);
+    let saved = send(
+        app.router(),
+        Method::PUT,
+        &format!("/api/v1/sources/{source_id}/credentials"),
+        json!({
+            "expectedRevision": 0,
+            "credential": { "schemes": {
+                "BearerAuth": { "type": "bearer", "token": "later-secret" }
+            }}
+        }),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(saved.status(), StatusCode::OK);
+    let stored = app
+        .catalog()
+        .credential(&source_id)
+        .await
+        .expect("credential should decrypt")
+        .expect("credential should exist");
+    assert_eq!(
+        stored.credential.payload["credentialOrigins"]["BearerAuth"],
+        json!([origin_b.origin()])
+    );
+
+    set_secured_specification(
+        &upstream,
+        &origin_a.origin(),
+        "BearerAuth",
+        scheme.clone(),
+        "anonymousMove",
+    )
+    .await;
+    let rejected = send(
+        app.router(),
+        Method::POST,
+        &format!("/api/v1/sources/{source_id}/refresh"),
+        json!({}),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(rejected.status(), StatusCode::CONFLICT);
+    assert_eq!(
+        json_body(rejected).await["error"]["code"],
+        "openapi_credential_origin_changed"
+    );
+    assert!(origin_a.requests().is_empty());
+    assert!(origin_b.requests().is_empty());
+
+    let cleared = send(
+        app.router(),
+        Method::DELETE,
+        &format!("/api/v1/sources/{source_id}/credentials?expectedRevision=1"),
+        json!(null),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(cleared.status(), StatusCode::OK);
+    assert_eq!(json_body(cleared).await["revision"], 2);
+    let unbound = app
+        .catalog()
+        .credential(&source_id)
+        .await
+        .expect("credential should decrypt")
+        .expect("credential locator should remain");
+    assert!(
+        unbound
+            .credential
+            .payload
+            .get("credentialOrigins")
+            .is_none(),
+        "clearing the final credential must explicitly release its origin pin"
+    );
+    set_secured_specification(
+        &upstream,
+        &insecure_origin.origin(),
+        "BearerAuth",
+        scheme.clone(),
+        "anonymousMove",
+    )
+    .await;
+    let before_insecure_refresh = app
+        .catalog()
+        .source(&source_id)
+        .await
+        .expect("source should read");
+    let insecure_refresh = send(
+        app.router(),
+        Method::POST,
+        &format!("/api/v1/sources/{source_id}/refresh"),
+        json!({}),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(insecure_refresh.status(), StatusCode::BAD_REQUEST);
+    assert_eq!(
+        json_body(insecure_refresh).await["error"]["code"],
+        "insecure_openapi_transport"
+    );
+    assert_eq!(
+        app.catalog()
+            .source(&source_id)
+            .await
+            .expect("source should remain readable")
+            .revision,
+        before_insecure_refresh.revision
+    );
+    assert!(insecure_origin.requests().is_empty());
+
+    set_secured_specification(
+        &upstream,
+        &origin_a.origin(),
+        "BearerAuth",
+        scheme,
+        "anonymousMove",
+    )
+    .await;
+    assert_eq!(refresh(&app, &admin, &source_id).await, StatusCode::OK);
+    let rebound = send(
+        app.router(),
+        Method::PUT,
+        &format!("/api/v1/sources/{source_id}/credentials"),
+        json!({
+            "expectedRevision": 2,
+            "credential": { "schemes": {
+                "BearerAuth": { "type": "bearer", "token": "rebound-secret" }
+            }}
+        }),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(rebound.status(), StatusCode::OK);
+    let rebound_stored = app
+        .catalog()
+        .credential(&source_id)
+        .await
+        .expect("credential should decrypt")
+        .expect("credential should exist");
+    assert_eq!(
+        rebound_stored.credential.payload["credentialOrigins"]["BearerAuth"],
+        json!([origin_a.origin()])
+    );
+    let token = gateway_token(&app, &admin).await;
+    let path = source_tool_path(&app, &source_id).await;
+    assert_eq!(
+        invoke_path(&app, &token, &path).await.status(),
+        StatusCode::OK
+    );
+    let captured = origin_a.requests();
+    assert_eq!(captured.len(), 1);
+    assert_eq!(
+        captured[0].headers.get("authorization").map(String::as_str),
+        Some("Bearer rebound-secret")
+    );
+}
+
+#[tokio::test]
+async fn basic_credentials_reject_ambiguous_identity_before_persistence_or_dispatch() {
+    let upstream = Upstream::start().await;
+    let target = CredentialTarget::start().await;
+    set_secured_specification(
+        &upstream,
+        &target.origin(),
+        "BasicAuth",
+        json!({ "type": "http", "scheme": "basic" }),
+        "basicIdentity",
+    )
+    .await;
+    let directory = tempfile::tempdir().expect("temporary directory should be created");
+    let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+        .await
+        .expect("Executor should open");
+    let admin = setup(&app).await;
+
+    let spec_requests = upstream.spec_request_count();
+    let invalid_scheme_create = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/sources",
+        json!({
+            "kind": "openapi",
+            "displayName": "Invalid scheme name",
+            "preferredSlug": "invalid-scheme-name",
+            "spec": { "type": "url", "url": upstream.spec_url(None) },
+            "allowPrivateNetwork": true,
+            "credential": { "schemes": {
+                "Basic\nAuth": { "type": "basic", "username": "user", "password": "secret" }
+            }}
+        }),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(invalid_scheme_create.status(), StatusCode::BAD_REQUEST);
+    assert_eq!(
+        json_body(invalid_scheme_create).await["error"]["code"],
+        "invalid_credentials"
+    );
+    assert_eq!(upstream.spec_request_count(), spec_requests);
+    let spec_requests = upstream.spec_request_count();
+
+    for (slug, username, password, code) in [
+        (
+            "invalid-basic-colon",
+            "admin:other",
+            "secret",
+            "invalid_basic_username",
+        ),
+        (
+            "invalid-basic-user-control",
+            "admin\nother",
+            "secret",
+            "invalid_basic_credentials",
+        ),
+        (
+            "invalid-basic-password-control",
+            "admin",
+            "secret\u{7f}",
+            "invalid_basic_credentials",
+        ),
+    ] {
+        let rejected = send(
+            app.router(),
+            Method::POST,
+            "/api/v1/sources",
+            json!({
+                "kind": "openapi",
+                "displayName": "Invalid Basic",
+                "preferredSlug": slug,
+                "spec": { "type": "url", "url": upstream.spec_url(None) },
+                "allowPrivateNetwork": true,
+                "credential": { "schemes": {
+                    "BasicAuth": { "type": "basic", "username": username, "password": password }
+                }}
+            }),
+            &admin_headers(&admin),
+        )
+        .await;
+        assert_eq!(rejected.status(), StatusCode::BAD_REQUEST);
+        assert_eq!(json_body(rejected).await["error"]["code"], code);
+    }
+    assert_eq!(upstream.spec_request_count(), spec_requests);
+    assert!(target.requests().is_empty());
+
+    let unicode_username = "δοκιμή";
+    let unicode_password = "päss:word";
+    let created = import_source(
+        &app,
+        &admin,
+        &upstream.spec_url(None),
+        "valid-basic-identity",
+        json!({ "schemes": {
+            "BasicAuth": {
+                "type": "basic",
+                "username": unicode_username,
+                "password": unicode_password
+            }
+        }}),
+    )
+    .await;
+    let source_id = created["id"]
+        .as_str()
+        .expect("source should have an ID")
+        .to_owned();
+    let path = source_tool_path(&app, &source_id).await;
+    let token = gateway_token(&app, &admin).await;
+    assert_eq!(
+        invoke_path(&app, &token, &path).await.status(),
+        StatusCode::OK
+    );
+    let expected_unicode = format!(
+        "Basic {}",
+        STANDARD.encode(format!("{unicode_username}:{unicode_password}"))
+    );
+    assert_eq!(
+        target.requests()[0].headers.get("authorization"),
+        Some(&expected_unicode)
+    );
+
+    for (username, password, code) in [
+        ("admin:other", "secret", "invalid_basic_username"),
+        ("admin\nother", "secret", "invalid_basic_credentials"),
+        ("admin", "secret\u{7f}", "invalid_basic_credentials"),
+    ] {
+        let rejected = send(
+            app.router(),
+            Method::PUT,
+            &format!("/api/v1/sources/{source_id}/credentials"),
+            json!({
+                "expectedRevision": 0,
+                "credential": { "schemes": {
+                    "BasicAuth": { "type": "basic", "username": username, "password": password }
+                }}
+            }),
+            &admin_headers(&admin),
+        )
+        .await;
+        assert_eq!(rejected.status(), StatusCode::BAD_REQUEST);
+        assert_eq!(json_body(rejected).await["error"]["code"], code);
+    }
+    let preserved = app
+        .catalog()
+        .credential(&source_id)
+        .await
+        .expect("credential should decrypt")
+        .expect("credential should exist");
+    assert_eq!(preserved.revision, 0);
+    assert_eq!(
+        preserved.credential.payload["credentials"]["schemes"]["BasicAuth"]["username"],
+        unicode_username
+    );
+    assert_eq!(
+        preserved.credential.payload["credentials"]["schemes"]["BasicAuth"]["password"],
+        unicode_password
+    );
+    assert_eq!(target.requests().len(), 1);
+
+    let invalid_scheme_replace = send(
+        app.router(),
+        Method::PUT,
+        &format!("/api/v1/sources/{source_id}/credentials"),
+        json!({
+            "expectedRevision": 0,
+            "credential": { "schemes": {
+                "Basic\nAuth": { "type": "basic", "username": "user", "password": "secret" }
+            }}
+        }),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(invalid_scheme_replace.status(), StatusCode::BAD_REQUEST);
+    assert_eq!(
+        json_body(invalid_scheme_replace).await["error"]["code"],
+        "invalid_credentials"
+    );
+    let preserved = app
+        .catalog()
+        .credential(&source_id)
+        .await
+        .expect("credential should decrypt")
+        .expect("credential should exist");
+    assert_eq!(preserved.revision, 0);
+    assert_eq!(
+        preserved.credential.payload["credentials"]["schemes"]["BasicAuth"]["username"],
+        unicode_username
+    );
+
+    let empty_username = send(
+        app.router(),
+        Method::PUT,
+        &format!("/api/v1/sources/{source_id}/credentials"),
+        json!({
+            "expectedRevision": 0,
+            "credential": { "schemes": {
+                "BasicAuth": {
+                    "type": "basic",
+                    "username": "",
+                    "password": "password:with:colons"
+                }
+            }}
+        }),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(empty_username.status(), StatusCode::OK);
+    assert_eq!(json_body(empty_username).await["revision"], 1);
+    assert_eq!(
+        invoke_path(&app, &token, &path).await.status(),
+        StatusCode::OK
+    );
+    assert_eq!(
+        target.requests()[1].headers.get("authorization"),
+        Some(&format!(
+            "Basic {}",
+            STANDARD.encode(":password:with:colons")
+        ))
+    );
+}
+
+#[tokio::test]
+async fn trace_operations_never_enter_the_catalog_or_become_mode_overridable() {
+    let upstream = Upstream::start().await;
+    *upstream.specification.write().await = json!({
+        "openapi": "3.1.0",
+        "info": { "title": "Unsupported TRACE" },
+        "servers": [{ "url": format!("http://{}/api", upstream.address) }],
+        "paths": { "/trace": { "trace": {
+            "operationId": "traceRequest",
+            "responses": { "200": { "description": "ok" } }
+        }}}
+    });
+    let directory = tempfile::tempdir().expect("temporary directory should be created");
+    let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+        .await
+        .expect("Executor should open");
+    let admin = setup(&app).await;
+    let before_global_revision = app
+        .catalog()
+        .global_revision()
+        .await
+        .expect("global revision should read");
+    let rejected = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/sources",
+        json!({
+            "kind": "openapi",
+            "displayName": "Unsupported TRACE",
+            "preferredSlug": "unsupported_trace",
+            "spec": { "type": "url", "url": upstream.spec_url(None) },
+            "allowPrivateNetwork": true,
+            "credential": { "schemes": {} }
+        }),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(rejected.status(), StatusCode::BAD_REQUEST);
+    assert_eq!(
+        json_body(rejected).await["error"]["code"],
+        "invalid_openapi_document"
+    );
+    assert!(
+        app.catalog()
+            .list_tools(ListToolsFilter {
+                include_tombstoned: true,
+                ..Default::default()
+            })
+            .await
+            .expect("catalog should remain readable")
+            .items
+            .is_empty(),
+        "there must be no TRACE tool whose mode can be overridden"
+    );
+    assert_eq!(
+        app.catalog()
+            .global_revision()
+            .await
+            .expect("global revision should remain readable"),
+        before_global_revision
+    );
+}
+
+#[tokio::test]
+async fn refresh_rejects_unknown_fields_before_fetching_or_mutating() {
+    let upstream = Upstream::start().await;
+    upstream.set_paths(hello_paths(), "initial").await;
+    let directory = tempfile::tempdir().expect("temporary directory should be created");
+    let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+        .await
+        .expect("Executor should open");
+    let admin = setup(&app).await;
+    let created = import_source(
+        &app,
+        &admin,
+        &upstream.spec_url(None),
+        "strict-refresh",
+        json!({ "schemes": {} }),
+    )
+    .await;
+    let source_id = created["id"]
+        .as_str()
+        .expect("source should have an ID")
+        .to_owned();
+    let before_source = app
+        .catalog()
+        .source(&source_id)
+        .await
+        .expect("source should read");
+    let before_global_revision = app
+        .catalog()
+        .global_revision()
+        .await
+        .expect("global revision should read");
+    let before_spec_requests = upstream.spec_request_count();
+
+    let response = send(
+        app.router(),
+        Method::POST,
+        &format!("/api/v1/sources/{source_id}/refresh"),
+        json!({ "expectedRevison": before_source.revision }),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
+    assert_eq!(json_body(response).await["error"]["code"], "invalid_json");
+    assert_eq!(upstream.spec_request_count(), before_spec_requests);
+
+    let after_source = app
+        .catalog()
+        .source(&source_id)
+        .await
+        .expect("source should still read");
+    assert_eq!(after_source.revision, before_source.revision);
+    assert_eq!(
+        after_source.catalog_revision,
+        before_source.catalog_revision
+    );
+    assert_eq!(after_source.tool_count, before_source.tool_count);
+    assert_eq!(
+        app.catalog()
+            .global_revision()
+            .await
+            .expect("global revision should still read"),
+        before_global_revision
+    );
+}
+
+#[tokio::test]
+async fn removed_then_restored_openapi_tool_keeps_identity_override_and_callable_binding() {
+    let upstream = Upstream::start().await;
+    upstream.set_paths(hello_paths(), "initial").await;
+    let directory = tempfile::tempdir().expect("temporary directory should be created");
+    let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+        .await
+        .expect("Executor should open");
+    let admin = setup(&app).await;
+    let created = import_source(
+        &app,
+        &admin,
+        &upstream.spec_url(None),
+        "lifecycle",
+        json!({ "schemes": {} }),
+    )
+    .await;
+    let source_id = created["id"]
+        .as_str()
+        .expect("source should have an ID")
+        .to_owned();
+    let original = app
+        .catalog()
+        .list_tools(Default::default())
+        .await
+        .expect("tools should list")
+        .items
+        .pop()
+        .expect("imported tool should exist");
+    let original_binding = app
+        .catalog()
+        .tool_binding(&original.id)
+        .await
+        .expect("imported tool should have a binding");
+    app.catalog()
+        .set_tool_mode(
+            &original.id,
+            Some(ToolMode::Enabled),
+            original.revision,
+            AuditContext::system(Some("lifecycle-mode")),
+        )
+        .await
+        .expect("explicit tool mode should store");
+
+    upstream.set_paths(json!({}), "temporarily removed").await;
+    assert_eq!(refresh(&app, &admin, &source_id).await, StatusCode::OK);
+    let tombstone = app
+        .catalog()
+        .list_tools(ListToolsFilter {
+            include_tombstoned: true,
+            ..Default::default()
+        })
+        .await
+        .expect("tool history should list")
+        .items
+        .pop()
+        .expect("removed tool should remain in history");
+    assert_eq!(tombstone.id, original.id);
+    assert_eq!(tombstone.local_name, original.local_name);
+    assert_eq!(tombstone.mode_override, Some(ToolMode::Enabled));
+    assert!(!tombstone.present);
+    assert!(app.catalog().tool_binding(&original.id).await.is_err());
+
+    upstream.set_paths(hello_paths(), "restored").await;
+    assert_eq!(refresh(&app, &admin, &source_id).await, StatusCode::OK);
+    let restored = app
+        .catalog()
+        .list_tools(Default::default())
+        .await
+        .expect("restored tools should list")
+        .items
+        .pop()
+        .expect("tool should be restored");
+    assert_eq!(restored.id, original.id);
+    assert_eq!(restored.local_name, original.local_name);
+    assert_eq!(restored.callable_path, original.callable_path);
+    assert_eq!(restored.mode_override, Some(ToolMode::Enabled));
+    assert!(restored.present);
+    let restored_binding = app
+        .catalog()
+        .tool_binding(&restored.id)
+        .await
+        .expect("restored tool should regain a binding");
+    assert_eq!(restored_binding.binding, original_binding.binding);
+
+    let token = gateway_token(&app, &admin).await;
+    let authorization = format!("Bearer {token}");
+    let invoked = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/gateway/tools/invoke",
+        json!({ "path": restored.sandbox_path, "arguments": {} }),
+        &[(header::AUTHORIZATION.as_str(), &authorization)],
+    )
+    .await;
+    assert_eq!(invoked.status(), StatusCode::OK);
+    assert_eq!(
+        json_body(invoked).await["data"]["message"],
+        "still callable"
+    );
+}
+
+#[tokio::test]
+async fn refresh_binding_failure_rolls_back_catalog_data_while_recording_health() {
+    let upstream = Upstream::start().await;
+    upstream
+        .set_paths(hello_paths(), "before failed refresh")
+        .await;
+    let directory = tempfile::tempdir().expect("temporary directory should be created");
+    let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+        .await
+        .expect("Executor should open");
+    let admin = setup(&app).await;
+    let created = import_source(
+        &app,
+        &admin,
+        &upstream.spec_url(None),
+        "rollback",
+        json!({ "schemes": {} }),
+    )
+    .await;
+    let source_id = created["id"]
+        .as_str()
+        .expect("source should have an ID")
+        .to_owned();
+    let before_source = app
+        .catalog()
+        .source(&source_id)
+        .await
+        .expect("source should read");
+    let before_global_revision = app
+        .catalog()
+        .global_revision()
+        .await
+        .expect("global revision should read");
+    let before_tool = app
+        .catalog()
+        .list_tools(Default::default())
+        .await
+        .expect("tools should list")
+        .items
+        .pop()
+        .expect("tool should exist");
+    let before_binding = app
+        .catalog()
+        .tool_binding(&before_tool.id)
+        .await
+        .expect("binding should exist");
+    let before_artifact = sqlx::query_scalar::<_, String>(
+        "SELECT content_json FROM source_artifacts WHERE source_id = ?",
+    )
+    .bind(&source_id)
+    .fetch_one(app.pool())
+    .await
+    .expect("artifact should read");
+    let before_audits = sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM audit_events")
+        .fetch_one(app.pool())
+        .await
+        .expect("audit count should read");
+
+    upstream
+        .set_paths(
+            json!({
+                "/hello": hello_paths()["/hello"].clone(),
+                "/new": {
+                    "get": {
+                        "operationId": "newOperation",
+                        "responses": { "204": { "description": "ok" } }
+                    }
+                }
+            }),
+            "must roll back",
+        )
+        .await;
+    sqlx::query(
+        "CREATE TRIGGER reject_refresh_binding BEFORE INSERT ON tool_bindings \
+         BEGIN SELECT RAISE(ABORT, 'reject refresh binding'); END",
+    )
+    .execute(app.pool())
+    .await
+    .expect("binding failure trigger should install");
+    assert_eq!(
+        refresh(&app, &admin, &source_id).await,
+        StatusCode::INTERNAL_SERVER_ERROR
+    );
+
+    let after_source = app
+        .catalog()
+        .source(&source_id)
+        .await
+        .expect("source should still read");
+    assert_eq!(after_source.revision, before_source.revision + 1);
+    assert_eq!(after_source.health_status, SourceHealth::Error);
+    assert_eq!(
+        after_source.health_error_code.as_deref(),
+        Some("openapi_refresh_failed")
+    );
+    assert_eq!(
+        after_source.last_refreshed_at,
+        before_source.last_refreshed_at
+    );
+    assert_eq!(
+        after_source.catalog_revision,
+        before_source.catalog_revision
+    );
+    assert_eq!(after_source.tool_count, before_source.tool_count);
+    assert_eq!(
+        app.catalog()
+            .global_revision()
+            .await
+            .expect("global revision should still read"),
+        before_global_revision + 1
+    );
+    let after_tools = app
+        .catalog()
+        .list_tools(ListToolsFilter {
+            include_tombstoned: true,
+            ..Default::default()
+        })
+        .await
+        .expect("tool history should still list");
+    assert_eq!(after_tools.items.len(), 1);
+    assert_eq!(after_tools.items[0].id, before_tool.id);
+    assert_eq!(after_tools.items[0].revision, before_tool.revision);
+    assert_eq!(
+        app.catalog()
+            .tool_binding(&before_tool.id)
+            .await
+            .expect("old binding should survive")
+            .binding,
+        before_binding.binding
+    );
+    assert_eq!(
+        sqlx::query_scalar::<_, String>(
+            "SELECT content_json FROM source_artifacts WHERE source_id = ?",
+        )
+        .bind(&source_id)
+        .fetch_one(app.pool())
+        .await
+        .expect("artifact should survive"),
+        before_artifact
+    );
+    assert_eq!(
+        sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM audit_events")
+            .fetch_one(app.pool())
+            .await
+            .expect("audit count should still read"),
+        before_audits + 1
+    );
+
+    let token = gateway_token(&app, &admin).await;
+    let authorization = format!("Bearer {token}");
+    let invoked = send(
+        app.router(),
+        Method::POST,
+        "/api/v1/gateway/tools/invoke",
+        json!({ "path": before_tool.sandbox_path, "arguments": {} }),
+        &[(header::AUTHORIZATION.as_str(), &authorization)],
+    )
+    .await;
+    assert_eq!(invoked.status(), StatusCode::OK);
+    assert_eq!(
+        json_body(invoked).await["data"]["message"],
+        "still callable"
+    );
+}
+
+#[tokio::test]
+async fn credentials_delete_uses_cas_preserves_locator_and_leaves_no_plaintext_on_disk() {
+    let upstream = Upstream::start().await;
+    upstream
+        .set_paths(
+            json!({
+                "/hello": {
+                    "get": {
+                        "operationId": "sayHello",
+                        "security": [{ "ApiKey": [] }],
+                        "responses": { "200": { "description": "ok" } }
+                    }
+                }
+            }),
+            "secret persistence test",
+        )
+        .await;
+    {
+        let mut specification = upstream.specification.write().await;
+        specification["components"] = json!({
+            "securitySchemes": {
+                "ApiKey": { "type": "apiKey", "in": "header", "name": "X-API-Key" }
+            }
+        });
+    }
+    let locator_secret = "locator-secret-4f08dd75512a47a6";
+    let auth_secret = "auth-secret-a5477b04afe2405d";
+    let directory = tempfile::tempdir().expect("temporary directory should be created");
+    let data_dir = directory.path().to_path_buf();
+    let app = ExecutorApp::open(AppConfig::new(data_dir.clone()))
+        .await
+        .expect("Executor should open");
+    let admin = setup(&app).await;
+    let secret_spec_url = upstream.spec_url(Some(&format!("api_key={locator_secret}")));
+    let created = import_source(
+        &app,
+        &admin,
+        &secret_spec_url,
+        "secrets",
+        json!({
+            "schemes": {
+                "ApiKey": { "type": "api_key", "value": auth_secret }
+            }
+        }),
+    )
+    .await;
+    assert!(!created.to_string().contains(locator_secret));
+    assert!(!created.to_string().contains(auth_secret));
+    let source_id = created["id"]
+        .as_str()
+        .expect("source should have an ID")
+        .to_owned();
+
+    let stale = send(
+        app.router(),
+        Method::DELETE,
+        &format!("/api/v1/sources/{source_id}/credentials?expectedRevision=7"),
+        json!(null),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(stale.status(), StatusCode::CONFLICT);
+    let stale_body = json_body(stale).await;
+    assert_eq!(stale_body["error"]["code"], "revision_conflict");
+    assert!(!stale_body.to_string().contains(locator_secret));
+    assert!(!stale_body.to_string().contains(auth_secret));
+
+    let deleted = send(
+        app.router(),
+        Method::DELETE,
+        &format!("/api/v1/sources/{source_id}/credentials?expectedRevision=0"),
+        json!(null),
+        &admin_headers(&admin),
+    )
+    .await;
+    assert_eq!(deleted.status(), StatusCode::OK);
+    let deleted_body = json_body(deleted).await;
+    assert_eq!(deleted_body["revision"], 1);
+    assert_eq!(deleted_body["configuredSchemes"], json!([]));
+    assert!(!deleted_body.to_string().contains(locator_secret));
+    assert!(!deleted_body.to_string().contains(auth_secret));
+
+    let stored = app
+        .catalog()
+        .credential(&source_id)
+        .await
+        .expect("credential should decrypt")
+        .expect("locator envelope should remain");
+    assert_eq!(stored.revision, 1);
+    assert_eq!(stored.credential.payload["locator"]["url"], secret_spec_url);
+    assert_eq!(
+        stored.credential.payload["credentials"]["schemes"],
+        json!({})
+    );
+    assert!(!stored.credential.payload.to_string().contains(auth_secret));
+    assert_eq!(refresh(&app, &admin, &source_id).await, StatusCode::OK);
+
+    sqlx::query("PRAGMA wal_checkpoint(TRUNCATE)")
+        .fetch_all(app.pool())
+        .await
+        .expect("WAL should checkpoint");
+    app.pool().close().await;
+    drop(app);
+
+    for file_name in ["executor.db", "executor.db-wal", "executor.db-shm"] {
+        let path = data_dir.join(file_name);
+        if path.exists() {
+            assert_file_excludes(&path, locator_secret);
+            assert_file_excludes(&path, auth_secret);
+        }
+    }
+}
+
+fn assert_file_excludes(path: &Path, secret: &str) {
+    let bytes = std::fs::read(path).expect("database sidecar should read");
+    assert!(
+        !bytes
+            .windows(secret.len())
+            .any(|window| window == secret.as_bytes()),
+        "{} contains plaintext secret",
+        path.display()
+    );
+}
diff --git a/tests/openapi_parser.rs b/tests/openapi_parser.rs
new file mode 100644
index 000000000..babe95925
--- /dev/null
+++ b/tests/openapi_parser.rs
@@ -0,0 +1,1644 @@
+use executor::{
+    catalog::ToolMode,
+    openapi::{
+        OpenApiBinding, OpenApiCredential, OpenApiCredentialError, OpenApiCredentialSet,
+        OpenApiError, OpenApiInvocationError, OpenApiParameterLocation, OpenApiSecurityScheme,
+        build_protocol_request, build_protocol_request_with_base, compile_document,
+    },
+};
+use serde_json::json;
+use url::Url;
+
+type StaticCredentialSet = OpenApiCredentialSet;
+type StaticCredentialScheme = OpenApiCredential;
+
+#[test]
+fn compiles_yaml_with_parameter_server_media_and_security_precedence() {
+    let document = br#"
+openapi: 3.1.0
+info:
+  title: Pet Service
+  description: Pet operations
+servers:
+  - url: https://root.example.test/{version}
+    variables:
+      version:
+        default: v1
+security:
+  - rootKey: []
+paths:
+  /pets/{pet_id}:
+    servers:
+      - url: https://path.example.test
+    parameters:
+      - $ref: '#/components/parameters/PetId'
+      - name: view
+        in: query
+        schema:
+          type: string
+    get:
+      operationId: getPet
+      summary: Get a pet
+      servers:
+        - url: https://operation.example.test
+      parameters:
+        - name: view
+          in: query
+          required: true
+          schema:
+            enum: [summary, full]
+      security:
+        - bearerAuth: []
+          rootKey: []
+        - {}
+      responses:
+        '200':
+          description: ok
+          content:
+            application/problem+json:
+              schema:
+                type: object
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Pet'
+  /pets:
+    post:
+      operationId: createPet
+      requestBody:
+        required: true
+        content:
+          text/plain:
+            schema: { type: string }
+          application/json:
+            schema:
+              $ref: '#/components/schemas/PetInput'
+      responses:
+        default:
+          description: response
+components:
+  parameters:
+    PetId:
+      name: pet_id
+      in: path
+      required: true
+      schema: { type: string }
+  schemas:
+    Pet:
+      type: object
+      properties:
+        id: { type: string }
+    PetInput:
+      type: object
+      properties:
+        name: { type: string }
+      required: [name]
+  securitySchemes:
+    rootKey:
+      type: apiKey
+      in: header
+      name: X-Root-Key
+    bearerAuth:
+      type: http
+      scheme: bearer
+    oauth:
+      type: oauth2
+      flows: {}
+"#;
+    let compiled = compile_document(document).expect("valid YAML should compile");
+    assert_eq!(compiled.title, "Pet Service");
+    assert_eq!(compiled.tools.len(), 2);
+
+    let get = compiled
+        .tools
+        .iter()
+        .find(|tool| tool.preferred_name == "getPet")
+        .expect("GET operation should exist");
+    assert_eq!(get.intrinsic_mode, ToolMode::Enabled);
+    assert_eq!(get.binding.server_url, "https://operation.example.test");
+    assert_eq!(get.binding.parameters.len(), 2);
+    let view = get
+        .binding
+        .parameters
+        .iter()
+        .find(|parameter| parameter.name == "view")
+        .expect("operation query parameter should replace the path parameter");
+    assert!(view.required);
+    assert_eq!(view.location, OpenApiParameterLocation::Query);
+    assert_eq!(get.binding.security.len(), 2);
+    assert_eq!(get.binding.security[0].requirements.len(), 2);
+    assert!(get.binding.security[1].requirements.is_empty());
+    assert!(matches!(
+        get.binding.security[0].requirements[0].scheme,
+        OpenApiSecurityScheme::Http { .. }
+    ));
+    assert_eq!(
+        get.output_schema,
+        Some(json!({
+            "type": "object",
+            "properties": { "id": { "type": "string" } }
+        }))
+    );
+
+    let post = compiled
+        .tools
+        .iter()
+        .find(|tool| tool.preferred_name == "createPet")
+        .expect("POST operation should exist");
+    assert_eq!(post.intrinsic_mode, ToolMode::Ask);
+    let body = post
+        .binding
+        .request_body
+        .as_ref()
+        .expect("request body should compile");
+    assert_eq!(body.default_media_type, "application/json");
+    assert_eq!(
+        body.media_types,
+        vec!["application/json".to_owned(), "text/plain".to_owned()]
+    );
+    assert_eq!(
+        post.binding.security[0].requirements[0].scheme_name,
+        "rootKey"
+    );
+}
+
+#[test]
+fn openapi_30_input_schemas_normalize_nullable_and_exclusive_bounds_to_2020_12() {
+    let compiled = compile_document(
+        serde_json::to_string(&json!({
+            "openapi": "3.0.3",
+            "info": { "title": "OpenAPI 3.0 schema normalization", "version": "1" },
+            "servers": [{ "url": "https://api.example.test" }],
+            "paths": {
+                "/items": {
+                    "get": {
+                        "operationId": "listItems",
+                        "parameters": [{
+                            "name": "limit",
+                            "in": "query",
+                            "schema": {
+                                "type": "integer",
+                                "nullable": true,
+                                "minimum": 5,
+                                "exclusiveMinimum": true
+                            }
+                        }],
+                        "responses": { "200": { "description": "ok" } }
+                    }
+                }
+            }
+        }))
+        .expect("specification should serialize")
+        .as_bytes(),
+    )
+    .expect("OpenAPI 3.0 specification should compile");
+    let schema = &compiled.tools[0].input_schema;
+    assert_eq!(
+        schema["$schema"],
+        "https://json-schema.org/draft/2020-12/schema"
+    );
+    let limit = &schema["properties"]["query"]["properties"]["limit"];
+    let types = limit["type"]
+        .as_array()
+        .expect("nullable schema should become a type union");
+    assert_eq!(types, &[json!("integer"), json!("null")]);
+    assert_eq!(limit["exclusiveMinimum"], 5);
+    assert!(limit.get("minimum").is_none());
+}
+
+#[test]
+fn openapi_30_rejects_reference_siblings_instead_of_overriding_constraints() {
+    let error = compile_document(
+        serde_json::to_string(&json!({
+            "openapi": "3.0.3",
+            "info": { "title": "Reference sibling", "version": "1" },
+            "paths": {
+                "/items": {
+                    "post": {
+                        "requestBody": {
+                            "content": {
+                                "application/json": {
+                                    "schema": {
+                                        "$ref": "#/components/schemas/Input",
+                                        "additionalProperties": true
+                                    }
+                                }
+                            }
+                        },
+                        "responses": { "200": { "description": "ok" } }
+                    }
+                }
+            },
+            "components": {
+                "schemas": {
+                    "Input": {
+                        "type": "object",
+                        "additionalProperties": false,
+                        "properties": { "name": { "type": "string" } }
+                    }
+                }
+            }
+        }))
+        .expect("specification should serialize")
+        .as_bytes(),
+    )
+    .expect_err("OpenAPI 3.0 reference siblings should be rejected");
+    assert!(matches!(error, OpenApiError::InvalidDocument(_)));
+}
+
+#[test]
+fn request_projection_does_not_require_read_only_properties() {
+    let compiled = compile_document(
+        serde_json::to_string(&json!({
+            "openapi": "3.1.0",
+            "info": { "title": "Read-only request projection", "version": "1" },
+            "paths": {
+                "/items": {
+                    "post": {
+                        "operationId": "createItem",
+                        "requestBody": {
+                            "required": true,
+                            "content": {
+                                "application/json": {
+                                    "schema": {
+                                        "type": "object",
+                                        "required": ["id", "name"],
+                                        "properties": {
+                                            "id": { "type": "string", "readOnly": true },
+                                            "name": { "type": "string" }
+                                        }
+                                    }
+                                }
+                            }
+                        },
+                        "responses": { "200": { "description": "ok" } }
+                    }
+                }
+            }
+        }))
+        .expect("specification should serialize")
+        .as_bytes(),
+    )
+    .expect("OpenAPI specification should compile");
+    assert_eq!(
+        compiled.tools[0].input_schema["properties"]["body"]["required"],
+        json!(["name"])
+    );
+}
+
+#[test]
+fn openapi_31_accepts_only_implemented_json_schema_dialects() {
+    let make_document = |dialect: Option<&str>| {
+        let mut document = json!({
+            "openapi": "3.1.0",
+            "info": { "title": "Dialect", "version": "1" },
+            "paths": {
+                "/items": {
+                    "get": {
+                        "responses": { "200": { "description": "ok" } }
+                    }
+                }
+            }
+        });
+        if let Some(dialect) = dialect {
+            document["jsonSchemaDialect"] = json!(dialect);
+        }
+        document
+    };
+
+    for dialect in [
+        None,
+        Some("https://spec.openapis.org/oas/3.1/dialect/base"),
+        Some("https://json-schema.org/draft/2020-12/schema"),
+        Some("https://json-schema.org/draft/2020-12/schema#"),
+    ] {
+        let document = make_document(dialect);
+        compile_document(&serde_json::to_vec(&document).unwrap_or_default()).unwrap_or_else(
+            |error| panic!("supported dialect {dialect:?} should compile: {error}"),
+        );
+    }
+
+    for dialect in [
+        "https://example.test/custom-dialect",
+        "https://json-schema.org/draft/2019-09/schema",
+    ] {
+        let document = make_document(Some(dialect));
+        assert!(matches!(
+            compile_document(&serde_json::to_vec(&document).unwrap_or_default()),
+            Err(OpenApiError::InvalidDocument(
+                "the OpenAPI 3.1 JSON Schema dialect is not supported"
+            ))
+        ));
+    }
+
+    let mut non_string = make_document(None);
+    non_string["jsonSchemaDialect"] = json!({ "uri": "not a string" });
+    assert!(matches!(
+        compile_document(&serde_json::to_vec(&non_string).unwrap_or_default()),
+        Err(OpenApiError::InvalidDocument(
+            "jsonSchemaDialect must be a URI string"
+        ))
+    ));
+
+    let mut schema_override = make_document(None);
+    schema_override["paths"]["/items"]["get"]["parameters"] = json!([{
+        "name": "query",
+        "in": "query",
+        "schema": {
+            "$schema": "https://example.test/custom-dialect",
+            "type": "string",
+            "x-custom-assertion": true
+        }
+    }]);
+    assert!(matches!(
+        compile_document(&serde_json::to_vec(&schema_override).unwrap_or_default()),
+        Err(OpenApiError::InvalidDocument(
+            "a Schema Object uses an unsupported JSON Schema dialect"
+        ))
+    ));
+
+    let mut nested_override = make_document(None);
+    nested_override["paths"]["/items"]["get"]["parameters"] = json!([{
+        "name": "query",
+        "in": "query",
+        "schema": {
+            "type": "array",
+            "unevaluatedItems": {
+                "$schema": "https://example.test/custom-dialect",
+                "x-custom-assertion": true
+            }
+        }
+    }]);
+    assert!(matches!(
+        compile_document(&serde_json::to_vec(&nested_override).unwrap_or_default()),
+        Err(OpenApiError::InvalidDocument(
+            "a Schema Object uses an unsupported JSON Schema dialect"
+        ))
+    ));
+}
+
+#[test]
+fn local_pointer_decoding_and_ref_siblings_are_supported() {
+    let document = json!({
+        "openapi": "3.1.0",
+        "info": { "title": "Refs" },
+        "paths": {
+            "/things": {
+                "get": {
+                    "parameters": [{
+                        "name": "filter",
+                        "in": "query",
+                        "schema": {
+                            "$ref": "#/components/schemas/Encoded%20Name",
+                            "description": "override"
+                        }
+                    }],
+                    "responses": { "204": { "description": "none" } }
+                }
+            }
+        },
+        "components": {
+            "schemas": {
+                "Encoded Name": { "type": "string" }
+            }
+        }
+    });
+    let compiled = compile_document(&serde_json::to_vec(&document).unwrap()).unwrap();
+    assert_eq!(
+        compiled.tools[0].input_schema["properties"]["query"]["properties"]["filter"],
+        json!({ "type": "string", "description": "override" })
+    );
+}
+
+#[test]
+fn rejects_swagger_external_refs_missing_refs_and_cycles() {
+    let swagger = br#"{"swagger":"2.0","info":{"title":"old"},"paths":{}}"#;
+    assert!(matches!(
+        compile_document(swagger),
+        Err(OpenApiError::UnsupportedVersion)
+    ));
+
+    let external = br#"{
+      "openapi":"3.0.3","info":{"title":"external"},
+      "paths":{"/x":{"get":{"responses":{"200":{"$ref":"https://example.test/r"}}}}}
+    }"#;
+    assert!(matches!(
+        compile_document(external),
+        Err(OpenApiError::ExternalReference(_))
+    ));
+
+    let missing = br##"{
+      "openapi":"3.0.3","info":{"title":"missing"},
+      "paths":{"/x":{"get":{"parameters":[{"$ref":"#/components/parameters/nope"}],"responses":{}}}}
+    }"##;
+    assert!(matches!(
+        compile_document(missing),
+        Err(OpenApiError::ReferenceNotFound(_))
+    ));
+
+    let cycle = br##"{
+      "openapi":"3.0.3","info":{"title":"cycle"},
+      "paths":{"/x":{"get":{"parameters":[{"$ref":"#/components/parameters/a"}],"responses":{}}}},
+      "components":{"parameters":{
+        "a":{"$ref":"#/components/parameters/b"},
+        "b":{"$ref":"#/components/parameters/a"}
+      }}
+    }"##;
+    assert!(matches!(
+        compile_document(cycle),
+        Err(OpenApiError::ReferenceCycle(_))
+    ));
+
+    let duplicate_yaml = br#"
+openapi: 3.0.3
+info: { title: Duplicate }
+paths: {}
+paths: {}
+"#;
+    assert!(matches!(
+        compile_document(duplicate_yaml),
+        Err(OpenApiError::Parse)
+    ));
+}
+
+#[test]
+fn rejects_path_parameters_that_do_not_match_the_template() {
+    let document = br#"{
+      "openapi":"3.0.3","info":{"title":"paths"},
+      "paths":{"/items/{id}":{"get":{"responses":{"200":{"description":"ok"}}}}}
+    }"#;
+    assert!(matches!(
+        compile_document(document),
+        Err(OpenApiError::InvalidOperation { .. })
+    ));
+}
+
+#[test]
+fn trace_operations_are_rejected_before_they_can_enter_the_catalog() {
+    let document = json!({
+        "openapi": "3.0.3",
+        "info": { "title": "Unsupported TRACE" },
+        "paths": {
+            "/items/{id}": {
+                "parameters": [{
+                    "name": "id",
+                    "in": "path",
+                    "required": true,
+                    "schema": { "type": "string" }
+                }],
+                "trace": {
+                    "operationId": "traceItem",
+                    "responses": { "200": { "description": "ok" } }
+                }
+            }
+        }
+    });
+    assert!(matches!(
+        compile_document(&serde_json::to_vec(&document).unwrap()),
+        Err(OpenApiError::InvalidOperation { method, message, .. })
+            if method == "TRACE" && message == "TRACE operations are not supported"
+    ));
+}
+
+#[test]
+fn request_credentials_override_user_carriers() {
+    let document = json!({
+        "openapi": "3.0.3",
+        "info": { "title": "Invoke" },
+        "servers": [{ "url": "https://api.example.test/v1" }],
+        "components": { "securitySchemes": {
+            "key": { "type": "apiKey", "in": "query", "name": "api_key" },
+            "bearer": { "type": "http", "scheme": "bearer" }
+        }},
+        "paths": { "/items/{id}": { "post": {
+            "parameters": [
+                { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } },
+                { "name": "api_key", "in": "query", "schema": { "type": "string" } },
+                { "name": "Api_Key", "in": "query", "schema": { "type": "string" } },
+                { "name": "tags", "in": "query", "explode": true, "schema": { "type": "array" } },
+                { "name": "X-Trace", "in": "header", "schema": { "type": "string" } }
+            ],
+            "security": [{ "key": [], "bearer": [] }],
+            "requestBody": { "required": true, "content": {
+                "application/json": { "schema": { "type": "object" } }
+            }},
+            "responses": { "200": { "description": "ok" } }
+        }}}
+    });
+    let compiled = compile_document(&serde_json::to_vec(&document).unwrap()).unwrap();
+    let credentials = StaticCredentialSet {
+        schemes: [
+            (
+                "key".to_owned(),
+                StaticCredentialScheme::ApiKey {
+                    value: "secret-key".to_owned(),
+                },
+            ),
+            (
+                "bearer".to_owned(),
+                StaticCredentialScheme::Bearer {
+                    token: "secret-token".to_owned(),
+                },
+            ),
+        ]
+        .into_iter()
+        .collect(),
+    };
+    let request = build_protocol_request(
+        &compiled.tools[0].binding,
+        &json!({
+            "path": { "id": "a/b" },
+            "query": { "api_key": "attacker", "Api_Key": "case-sensitive", "tags": ["one", "two"] },
+            "headers": { "X-Trace": "trace-1" },
+            "body": { "name": "item" }
+        }),
+        &credentials,
+    )
+    .unwrap();
+    assert_eq!(request.method, "POST");
+    assert_eq!(request.url.path(), "/v1/items/a%2Fb");
+    let query = request.url.query_pairs().collect::<Vec<_>>();
+    assert_eq!(
+        query
+            .iter()
+            .filter(|(name, _)| name == "api_key")
+            .map(|(_, value)| value.as_ref())
+            .collect::<Vec<_>>(),
+        vec!["secret-key"]
+    );
+    assert_eq!(
+        query
+            .iter()
+            .filter(|(name, _)| name == "Api_Key")
+            .map(|(_, value)| value.as_ref())
+            .collect::<Vec<_>>(),
+        vec!["case-sensitive"]
+    );
+    assert_eq!(
+        query
+            .iter()
+            .filter(|(name, _)| name == "tags")
+            .map(|(_, value)| value.as_ref())
+            .collect::<Vec<_>>(),
+        vec!["one", "two"]
+    );
+    assert_eq!(
+        request.headers.get("authorization").map(String::as_str),
+        Some("Bearer secret-token")
+    );
+    assert_eq!(
+        request.headers.get("x-trace").map(String::as_str),
+        Some("trace-1")
+    );
+    assert_eq!(
+        request.headers.get("content-type").map(String::as_str),
+        Some("application/json")
+    );
+    assert_eq!(request.body, br#"{"name":"item"}"#);
+}
+
+#[test]
+fn request_construction_rejects_protected_headers_and_crlf_credentials() {
+    let document = json!({
+        "openapi": "3.0.3",
+        "info": { "title": "Safety" },
+        "servers": [{ "url": "https://api.example.test" }],
+        "components": { "securitySchemes": {
+            "key": { "type": "apiKey", "in": "header", "name": "X-Api-Key" }
+        }},
+        "paths": { "/safe": { "get": {
+            "parameters": [{ "name": "Authorization", "in": "header", "schema": { "type": "string" } }],
+            "security": [{ "key": [] }],
+            "responses": { "200": { "description": "ok" } }
+        }}}
+    });
+    let compiled = compile_document(&serde_json::to_vec(&document).unwrap()).unwrap();
+    let credentials = |value: &str| StaticCredentialSet {
+        schemes: [(
+            "key".to_owned(),
+            StaticCredentialScheme::ApiKey {
+                value: value.to_owned(),
+            },
+        )]
+        .into_iter()
+        .collect(),
+    };
+    assert!(matches!(
+        build_protocol_request(
+            &compiled.tools[0].binding,
+            &json!({ "headers": { "Authorization": "user" } }),
+            &credentials("secret")
+        ),
+        Err(OpenApiInvocationError::InvalidHeader(_))
+    ));
+    assert!(
+        build_protocol_request(
+            &compiled.tools[0].binding,
+            &json!({}),
+            &credentials("secret\r\nX-Evil: yes")
+        )
+        .is_err()
+    );
+}
+
+#[test]
+fn tiny_exponential_reference_dag_hits_the_global_resolution_budget() {
+    let mut schemas = serde_json::Map::new();
+    schemas.insert("Node0".to_owned(), json!({ "type": "string" }));
+    for index in 1..=18 {
+        let reference = format!("#/components/schemas/Node{}", index - 1);
+        schemas.insert(
+            format!("Node{index}"),
+            json!([{ "$ref": reference }, { "$ref": reference }]),
+        );
+    }
+    let document = json!({
+        "openapi": "3.1.0",
+        "info": { "title": "Expansion budget" },
+        "components": { "schemas": schemas },
+        "paths": { "/expand": { "get": {
+            "parameters": [{
+                "name": "value", "in": "query",
+                "schema": { "$ref": "#/components/schemas/Node18" }
+            }],
+            "responses": { "200": { "description": "ok" } }
+        }}}
+    });
+    let result = compile_document(&serde_json::to_vec(&document).unwrap());
+    assert!(
+        matches!(
+            &result,
+            Err(OpenApiError::LimitExceeded {
+                code: "resolved_nodes"
+            })
+        ),
+        "unexpected expansion result: {result:?}"
+    );
+}
+
+#[test]
+fn rejects_parameter_serializations_the_invoker_cannot_execute() {
+    let cases = [
+        ("path", "label", false),
+        ("header", "form", false),
+        ("query", "matrix", false),
+        ("cookie", "simple", false),
+        ("query", "form", true),
+    ];
+    for (location, style, allow_reserved) in cases {
+        let path = if location == "path" {
+            "/items/{value}"
+        } else {
+            "/items"
+        };
+        let document = json!({
+            "openapi": "3.0.3",
+            "info": { "title": "Unsupported parameter" },
+            "paths": { path: { "get": {
+                "parameters": [{
+                    "name": "value", "in": location,
+                    "required": location == "path", "style": style,
+                    "allowReserved": allow_reserved,
+                    "schema": { "type": "string" }
+                }],
+                "responses": { "200": { "description": "ok" } }
+            }}}
+        });
+        assert!(matches!(
+            compile_document(&serde_json::to_vec(&document).unwrap()),
+            Err(OpenApiError::InvalidOperation { .. })
+        ));
+    }
+}
+
+#[test]
+fn rejects_content_based_parameters_the_invoker_cannot_serialize() {
+    let document = json!({
+        "openapi": "3.0.3",
+        "info": { "title": "Content parameter" },
+        "paths": { "/items": { "get": {
+            "parameters": [{
+                "name": "filter",
+                "in": "query",
+                "content": {
+                    "application/json": {
+                        "schema": { "type": "object" }
+                    }
+                }
+            }],
+            "responses": { "200": { "description": "ok" } }
+        }}}
+    });
+    assert!(matches!(
+        compile_document(&serde_json::to_vec(&document).unwrap()),
+        Err(OpenApiError::InvalidOperation { .. })
+    ));
+}
+
+#[test]
+fn rejects_request_body_media_the_invoker_cannot_encode() {
+    for media_type in ["multipart/form-data", "application/octet-stream"] {
+        let document = json!({
+            "openapi": "3.0.3",
+            "info": { "title": "Unsupported body" },
+            "paths": { "/upload": { "post": {
+                "requestBody": { "content": {
+                    media_type: { "schema": { "type": "object" } }
+                }},
+                "responses": { "200": { "description": "ok" } }
+            }}}
+        });
+        assert!(matches!(
+            compile_document(&serde_json::to_vec(&document).unwrap()),
+            Err(OpenApiError::InvalidOperation { .. })
+        ));
+    }
+}
+
+#[test]
+fn request_body_schemas_match_the_production_encoders() {
+    let cases = [
+        ("text/plain", json!({ "type": "object", "properties": {} })),
+        (
+            "application/x-www-form-urlencoded",
+            json!({
+                "type": "object",
+                "properties": { "tags": { "type": "array" } },
+                "additionalProperties": false
+            }),
+        ),
+        (
+            "application/x-www-form-urlencoded",
+            json!({ "type": "object", "additionalProperties": true }),
+        ),
+        (
+            "application/x-www-form-urlencoded",
+            json!({
+                "type": "object",
+                "properties": { "name": { "type": "string" } }
+            }),
+        ),
+    ];
+    for (media_type, schema) in cases {
+        let document = json!({
+            "openapi": "3.0.3",
+            "info": { "title": "Body schema" },
+            "paths": { "/submit": { "post": {
+                "requestBody": { "content": { media_type: { "schema": schema } } },
+                "responses": { "200": { "description": "ok" } }
+            }}}
+        });
+        assert!(matches!(
+            compile_document(&serde_json::to_vec(&document).unwrap()),
+            Err(OpenApiError::InvalidOperation { .. })
+        ));
+    }
+
+    let valid_form = json!({
+        "openapi": "3.0.3",
+        "info": { "title": "Form body" },
+        "servers": [{ "url": "https://api.example.test" }],
+        "paths": { "/submit": { "post": {
+            "requestBody": { "content": {
+                "application/x-www-form-urlencoded": { "schema": {
+                    "type": "object",
+                    "properties": { "name": { "type": "string" } },
+                    "additionalProperties": false
+                }}
+            }},
+            "responses": { "200": { "description": "ok" } }
+        }}}
+    });
+    let compiled = compile_document(&serde_json::to_vec(&valid_form).unwrap()).unwrap();
+    assert!(matches!(
+        build_protocol_request(
+            &compiled.tools[0].binding,
+            &json!({ "body": { "name": { "nested": true } } }),
+            &StaticCredentialSet::default()
+        ),
+        Err(OpenApiInvocationError::InvalidArgument(_))
+    ));
+}
+
+#[test]
+fn parameterized_json_is_preferred_over_text_request_media() {
+    let document = json!({
+        "openapi": "3.0.3",
+        "info": { "title": "Media preference" },
+        "paths": { "/submit": { "post": {
+            "requestBody": { "content": {
+                "text/plain": { "schema": { "type": "string" } },
+                "application/json; charset=utf-8": { "schema": { "type": "object" } }
+            }},
+            "responses": { "200": { "description": "ok" } }
+        }}}
+    });
+    let compiled = compile_document(&serde_json::to_vec(&document).unwrap()).unwrap();
+    assert_eq!(
+        compiled.tools[0]
+            .binding
+            .request_body
+            .as_ref()
+            .map(|body| body.default_media_type.as_str()),
+        Some("application/json; charset=utf-8")
+    );
+}
+
+#[test]
+fn rejects_server_urls_with_plaintext_secret_or_ambient_components() {
+    for server_url in [
+        "https://user:password@api.example.test/v1",
+        "https://api.example.test/v1?api_key=secret",
+        "https://api.example.test/v1#fragment",
+        "ftp://api.example.test/v1",
+        "//user:password@api.example.test/v1",
+    ] {
+        let document = json!({
+            "openapi": "3.0.3",
+            "info": { "title": "Unsafe server" },
+            "servers": [{ "url": server_url }],
+            "paths": { "/items": { "get": {
+                "responses": { "200": { "description": "ok" } }
+            }}}
+        });
+        assert!(matches!(
+            compile_document(&serde_json::to_vec(&document).unwrap()),
+            Err(OpenApiError::InvalidOperation { .. })
+        ));
+    }
+
+    for server_url in ["https://api.example.test/v1", "/relative/v1"] {
+        let document = json!({
+            "openapi": "3.0.3",
+            "info": { "title": "Safe server" },
+            "servers": [{ "url": server_url }],
+            "paths": { "/items": { "get": {
+                "responses": { "200": { "description": "ok" } }
+            }}}
+        });
+        assert!(compile_document(&serde_json::to_vec(&document).unwrap()).is_ok());
+    }
+
+    let hidden_in_fallback = json!({
+        "openapi": "3.0.3",
+        "info": { "title": "Unsafe fallback" },
+        "servers": [
+            { "url": "https://api.example.test" },
+            { "url": "https://api.example.test?secret=value" }
+        ],
+        "paths": {}
+    });
+    assert!(matches!(
+        compile_document(&serde_json::to_vec(&hidden_in_fallback).unwrap()),
+        Err(OpenApiError::InvalidOperation { .. })
+    ));
+}
+
+#[test]
+fn rejects_and_security_requirements_that_overwrite_the_same_carrier() {
+    let document = |security: serde_json::Value| {
+        json!({
+            "openapi": "3.0.3",
+            "info": { "title": "Carrier conflict" },
+            "servers": [{ "url": "https://api.example.test" }],
+            "components": { "securitySchemes": {
+                "basic": { "type": "http", "scheme": "basic" },
+                "bearer": { "type": "http", "scheme": "bearer" }
+            }},
+            "paths": { "/items": { "get": {
+                "security": security,
+                "responses": { "200": { "description": "ok" } }
+            }}}
+        })
+    };
+    let conflicting = document(json!([{ "basic": [], "bearer": [] }]));
+    assert!(matches!(
+        compile_document(&serde_json::to_vec(&conflicting).unwrap()),
+        Err(OpenApiError::InvalidOperation { .. })
+    ));
+
+    let alternatives = document(json!([{ "basic": [] }, { "bearer": [] }]));
+    let compiled = compile_document(&serde_json::to_vec(&alternatives).unwrap()).unwrap();
+    let mut binding = compiled.tools[0].binding.clone();
+    let bearer = binding.security[1].requirements[0].clone();
+    binding.security[0].requirements.push(bearer);
+    binding.security.truncate(1);
+    let credentials = StaticCredentialSet {
+        schemes: [
+            (
+                "basic".to_owned(),
+                StaticCredentialScheme::Basic {
+                    username: "user".to_owned(),
+                    password: "password".to_owned(),
+                },
+            ),
+            (
+                "bearer".to_owned(),
+                StaticCredentialScheme::Bearer {
+                    token: "token".to_owned(),
+                },
+            ),
+        ]
+        .into_iter()
+        .collect(),
+    };
+    assert!(matches!(
+        build_protocol_request(&binding, &json!({}), &credentials),
+        Err(OpenApiInvocationError::UnsatisfiedSecurity)
+    ));
+}
+
+#[test]
+fn public_request_builder_rejects_cookie_name_injection() {
+    let document = json!({
+        "openapi": "3.0.3",
+        "info": { "title": "Cookie safety" },
+        "servers": [{ "url": "https://api.example.test" }],
+        "components": { "securitySchemes": {
+            "cookie": { "type": "apiKey", "in": "cookie", "name": "session\r\nX-Evil" }
+        }},
+        "paths": { "/items": { "get": {
+            "parameters": [{
+                "name": "user;admin=true", "in": "cookie", "schema": { "type": "string" }
+            }],
+            "security": [{ "cookie": [] }],
+            "responses": { "200": { "description": "ok" } }
+        }}}
+    });
+    let compiled = compile_document(&serde_json::to_vec(&document).unwrap()).unwrap();
+    let credentials = StaticCredentialSet {
+        schemes: [(
+            "cookie".to_owned(),
+            StaticCredentialScheme::ApiKey {
+                value: "secret".to_owned(),
+            },
+        )]
+        .into_iter()
+        .collect(),
+    };
+    assert!(matches!(
+        build_protocol_request(
+            &compiled.tools[0].binding,
+            &json!({ "cookies": { "user;admin=true": "yes" } }),
+            &credentials
+        ),
+        Err(OpenApiInvocationError::InvalidHeader(_))
+    ));
+
+    let without_parameter = json!({
+        "openapi": "3.0.3",
+        "info": { "title": "Credential cookie safety" },
+        "servers": [{ "url": "https://api.example.test" }],
+        "components": { "securitySchemes": {
+            "cookie": { "type": "apiKey", "in": "cookie", "name": "session\r\nX-Evil" }
+        }},
+        "paths": { "/items": { "get": {
+            "security": [{ "cookie": [] }],
+            "responses": { "200": { "description": "ok" } }
+        }}}
+    });
+    let compiled = compile_document(&serde_json::to_vec(&without_parameter).unwrap()).unwrap();
+    assert!(matches!(
+        build_protocol_request(&compiled.tools[0].binding, &json!({}), &credentials),
+        Err(OpenApiInvocationError::InvalidHeader(_))
+    ));
+}
+
+#[test]
+fn rejects_authentication_schemes_the_invoker_cannot_apply() {
+    for scheme in [
+        json!({ "type": "http", "scheme": "digest" }),
+        json!({ "type": "mutualTLS" }),
+    ] {
+        let document = json!({
+            "openapi": "3.1.0",
+            "info": { "title": "Unsupported authentication" },
+            "components": { "securitySchemes": { "unsupported": scheme } },
+            "paths": { "/items": { "get": {
+                "security": [{ "unsupported": [] }],
+                "responses": { "200": { "description": "ok" } }
+            }}}
+        });
+        assert!(matches!(
+            compile_document(&serde_json::to_vec(&document).unwrap()),
+            Err(OpenApiError::InvalidOperation { .. })
+        ));
+    }
+}
+
+#[test]
+fn public_request_builder_rejects_unknown_argument_members() {
+    let document = json!({
+        "openapi": "3.0.3",
+        "info": { "title": "Strict arguments" },
+        "servers": [{ "url": "https://api.example.test" }],
+        "paths": { "/items": { "get": {
+            "parameters": [{
+                "name": "known", "in": "query", "schema": { "type": "string" }
+            }],
+            "responses": { "200": { "description": "ok" } }
+        }}}
+    });
+    let compiled = compile_document(&serde_json::to_vec(&document).unwrap()).unwrap();
+    for arguments in [
+        json!({ "unknown": true }),
+        json!({ "query": { "unknown": "value" } }),
+        json!({ "query": "not-an-object" }),
+        json!({ "body": { "unexpected": true } }),
+        json!({ "contentType": "application/json" }),
+    ] {
+        assert!(matches!(
+            build_protocol_request(
+                &compiled.tools[0].binding,
+                &arguments,
+                &StaticCredentialSet::default()
+            ),
+            Err(OpenApiInvocationError::InvalidArgument(_))
+        ));
+    }
+}
+
+#[test]
+fn public_request_builder_rejects_identity_and_rewrite_headers() {
+    let names = [
+        "X-HTTP-Method-Override",
+        "X-HTTP-Method",
+        "X-Method-Override",
+        "X-Original-Method",
+        "X-Real-IP",
+        "X-Original-URL",
+        "X-Rewrite-URL",
+        "X-Original-Host",
+        "X-Forwarded-Custom",
+    ];
+    let parameters = names
+        .iter()
+        .map(|name| json!({ "name": name, "in": "header", "schema": { "type": "string" } }))
+        .collect::<Vec<_>>();
+    let document = json!({
+        "openapi": "3.0.3",
+        "info": { "title": "Protected headers" },
+        "servers": [{ "url": "https://api.example.test" }],
+        "paths": { "/items": { "post": {
+            "parameters": parameters,
+            "responses": { "200": { "description": "ok" } }
+        }}}
+    });
+    let compiled = compile_document(&serde_json::to_vec(&document).unwrap()).unwrap();
+    for name in names {
+        assert!(matches!(
+            build_protocol_request(
+                &compiled.tools[0].binding,
+                &json!({ "headers": { (name): "spoofed" } }),
+                &StaticCredentialSet::default()
+            ),
+            Err(OpenApiInvocationError::InvalidHeader(_))
+        ));
+    }
+}
+
+#[test]
+fn canonical_credentials_validate_and_round_trip_every_supported_type() {
+    assert!(serde_json::from_value::<OpenApiCredentialSet>(json!({})).is_err());
+    let credentials: OpenApiCredentialSet = serde_json::from_value(json!({
+        "schemes": {
+            "headerKey": { "type": "api_key", "value": "key" },
+            "bearer": { "type": "bearer", "token": "bearer-token" },
+            "basic": { "type": "basic", "username": "user", "password": "password" },
+            "oauth": { "type": "oauth_access_token", "access_token": "oauth-token" }
+        }
+    }))
+    .expect("the canonical credential vocabulary should deserialize");
+    credentials.validate().expect("credentials should validate");
+    assert_eq!(
+        credentials
+            .schemes
+            .values()
+            .map(OpenApiCredential::credential_type)
+            .collect::<Vec<_>>(),
+        vec!["basic", "bearer", "api_key", "manual_oauth_access_token"]
+    );
+    assert_eq!(
+        serde_json::to_value(&credentials).unwrap(),
+        json!({
+            "schemes": {
+                "basic": { "type": "basic", "username": "user", "password": "password" },
+                "bearer": { "type": "bearer", "token": "bearer-token" },
+                "headerKey": { "type": "api_key", "value": "key" },
+                "oauth": { "type": "oauth_access_token", "access_token": "oauth-token" }
+            }
+        })
+    );
+
+    let invalid = OpenApiCredentialSet {
+        schemes: [(
+            String::new(),
+            OpenApiCredential::Bearer {
+                token: String::new(),
+            },
+        )]
+        .into_iter()
+        .collect(),
+    };
+    assert_eq!(
+        invalid.validate(),
+        Err(OpenApiCredentialError::InvalidSchemeName)
+    );
+    for name in ["Auth\n", "Auth\r", "Auth\u{7f}"] {
+        let invalid = OpenApiCredentialSet {
+            schemes: [(
+                name.to_owned(),
+                OpenApiCredential::Bearer {
+                    token: "token".to_owned(),
+                },
+            )]
+            .into_iter()
+            .collect(),
+        };
+        assert_eq!(
+            invalid.validate(),
+            Err(OpenApiCredentialError::InvalidSchemeName)
+        );
+    }
+}
+
+#[test]
+fn public_openapi_dtos_reject_unknown_or_legacy_credential_fields() {
+    for value in [
+        json!({ "scheme": {} }),
+        json!({ "schemes": {}, "unexpected": true }),
+        json!({ "schemes": { "key": { "type": "api_key", "value": "key", "typo": true } } }),
+        json!({ "schemes": { "bearer": { "type": "bearer", "token": "token", "typo": true } } }),
+        json!({ "schemes": { "basic": {
+            "type": "basic", "username": "user", "password": "password", "typo": true
+        } } }),
+        json!({ "schemes": { "oauth": {
+            "type": "oauth_access_token", "access_token": "token", "typo": true
+        } } }),
+        json!({ "schemes": { "oauth": {
+            "type": "oauth_access_token", "accessToken": "legacy-token"
+        } } }),
+    ] {
+        assert!(
+            serde_json::from_value::<OpenApiCredentialSet>(value).is_err(),
+            "unknown and legacy fields must be rejected"
+        );
+    }
+
+    let document = json!({
+        "openapi": "3.0.3",
+        "info": { "title": "Strict binding DTO" },
+        "servers": [{ "url": "https://api.example.test" }],
+        "components": { "securitySchemes": {
+            "key": { "type": "apiKey", "in": "header", "name": "X-Api-Key" }
+        }},
+        "paths": { "/items": { "post": {
+            "parameters": [{ "name": "limit", "in": "query", "schema": { "type": "integer" } }],
+            "requestBody": { "content": {
+                "application/json": { "schema": { "type": "object" } }
+            }},
+            "security": [{ "key": [] }],
+            "responses": {}
+        }}}
+    });
+    let compiled = compile_document(&serde_json::to_vec(&document).unwrap()).unwrap();
+    let binding = &compiled.tools[0].binding;
+    let serialized = serde_json::to_value(binding).unwrap();
+    assert_eq!(
+        serde_json::from_value::<OpenApiBinding>(serialized.clone()).unwrap(),
+        *binding
+    );
+
+    for pointer in [
+        "",
+        "/parameters/0",
+        "/requestBody",
+        "/security/0",
+        "/security/0/requirements/0",
+        "/security/0/requirements/0/scheme",
+    ] {
+        let mut invalid = serialized.clone();
+        invalid
+            .pointer_mut(pointer)
+            .and_then(serde_json::Value::as_object_mut)
+            .expect("test pointer should select an object")
+            .insert("unexpected".to_owned(), json!(true));
+        assert!(
+            serde_json::from_value::<OpenApiBinding>(invalid).is_err(),
+            "unknown field at {pointer} must be rejected"
+        );
+    }
+}
+
+#[test]
+fn canonical_builder_applies_api_key_basic_bearer_and_oauth_credentials() {
+    let document = json!({
+        "openapi": "3.0.3",
+        "info": { "title": "Authentication" },
+        "servers": [{ "url": "https://api.example.test" }],
+        "components": { "securitySchemes": {
+            "headerKey": { "type": "apiKey", "in": "header", "name": "X-Api-Key" },
+            "queryKey": { "type": "apiKey", "in": "query", "name": "api_key" },
+            "cookieKey": { "type": "apiKey", "in": "cookie", "name": "session" },
+            "basic": { "type": "http", "scheme": "basic" },
+            "bearer": { "type": "http", "scheme": "bearer" },
+            "oauth": { "type": "oauth2", "flows": {} }
+        }},
+        "paths": {
+            "/keys": { "get": {
+                "security": [{ "headerKey": [], "queryKey": [], "cookieKey": [] }],
+                "responses": { "200": { "description": "ok" } }
+            }},
+            "/basic": { "get": {
+                "security": [{ "basic": [] }],
+                "responses": { "200": { "description": "ok" } }
+            }},
+            "/bearer": { "get": {
+                "security": [{ "bearer": [] }],
+                "responses": { "200": { "description": "ok" } }
+            }},
+            "/oauth": { "get": {
+                "security": [{ "oauth": [] }],
+                "responses": { "200": { "description": "ok" } }
+            }}
+        }
+    });
+    let compiled = compile_document(&serde_json::to_vec(&document).unwrap()).unwrap();
+    let credentials = OpenApiCredentialSet {
+        schemes: [
+            (
+                "headerKey",
+                OpenApiCredential::ApiKey {
+                    value: "header-secret".to_owned(),
+                },
+            ),
+            (
+                "queryKey",
+                OpenApiCredential::ApiKey {
+                    value: "query-secret".to_owned(),
+                },
+            ),
+            (
+                "cookieKey",
+                OpenApiCredential::ApiKey {
+                    value: "cookie-secret".to_owned(),
+                },
+            ),
+            (
+                "basic",
+                OpenApiCredential::Basic {
+                    username: "user".to_owned(),
+                    password: "pass".to_owned(),
+                },
+            ),
+            (
+                "bearer",
+                OpenApiCredential::Bearer {
+                    token: "bearer-secret".to_owned(),
+                },
+            ),
+            (
+                "oauth",
+                OpenApiCredential::OAuthAccessToken {
+                    access_token: "oauth-secret".to_owned(),
+                },
+            ),
+        ]
+        .into_iter()
+        .map(|(name, credential)| (name.to_owned(), credential))
+        .collect(),
+    };
+    let request = |path: &str| {
+        let binding = &compiled
+            .tools
+            .iter()
+            .find(|tool| tool.binding.path_template == path)
+            .unwrap()
+            .binding;
+        build_protocol_request(binding, &json!({}), &credentials).unwrap()
+    };
+
+    let keys = request("/keys");
+    assert_eq!(
+        keys.headers.get("x-api-key").map(String::as_str),
+        Some("header-secret")
+    );
+    assert_eq!(
+        keys.headers.get("cookie").map(String::as_str),
+        Some("session=cookie-secret")
+    );
+    assert!(
+        keys.url
+            .query_pairs()
+            .any(|pair| pair == ("api_key".into(), "query-secret".into()))
+    );
+    assert_eq!(
+        request("/basic").headers["authorization"],
+        "Basic dXNlcjpwYXNz"
+    );
+    assert_eq!(
+        request("/bearer").headers["authorization"],
+        "Bearer bearer-secret"
+    );
+    assert_eq!(
+        request("/oauth").headers["authorization"],
+        "Bearer oauth-secret"
+    );
+}
+
+#[test]
+fn basic_credentials_reject_ambiguous_usernames_and_encode_valid_utf8_identities() {
+    let invalid = OpenApiCredentialSet {
+        schemes: [(
+            "basic".to_owned(),
+            OpenApiCredential::Basic {
+                username: "admin:other".to_owned(),
+                password: "secret".to_owned(),
+            },
+        )]
+        .into_iter()
+        .collect(),
+    };
+    assert_eq!(
+        invalid.validate(),
+        Err(OpenApiCredentialError::InvalidBasicUsername)
+    );
+
+    let document = json!({
+        "openapi": "3.1.0",
+        "info": { "title": "Basic identity encoding" },
+        "servers": [{ "url": "https://api.example.test" }],
+        "components": { "securitySchemes": {
+            "basic": { "type": "http", "scheme": "basic" }
+        }},
+        "paths": { "/identity": { "get": {
+            "security": [{ "basic": [] }],
+            "responses": { "200": { "description": "ok" } }
+        }}}
+    });
+    let compiled = compile_document(&serde_json::to_vec(&document).unwrap()).unwrap();
+    let request = |username: &str, password: &str| {
+        build_protocol_request(
+            &compiled.tools[0].binding,
+            &json!({}),
+            &OpenApiCredentialSet {
+                schemes: [(
+                    "basic".to_owned(),
+                    OpenApiCredential::Basic {
+                        username: username.to_owned(),
+                        password: password.to_owned(),
+                    },
+                )]
+                .into_iter()
+                .collect(),
+            },
+        )
+        .expect("valid Basic credentials should encode")
+    };
+
+    assert_eq!(
+        request("", "password:with:colons").headers["authorization"],
+        "Basic OnBhc3N3b3JkOndpdGg6Y29sb25z"
+    );
+    assert_eq!(
+        request("δοκιμή", "pässword").headers["authorization"],
+        format!(
+            "Basic {}",
+            base64::Engine::encode(
+                &base64::engine::general_purpose::STANDARD,
+                "δοκιμή:pässword".as_bytes()
+            )
+        )
+    );
+}
+
+#[test]
+fn canonical_builder_honors_or_and_anonymous_security_semantics() {
+    let document = json!({
+        "openapi": "3.0.3",
+        "info": { "title": "Security semantics" },
+        "servers": [{ "url": "https://api.example.test" }],
+        "components": { "securitySchemes": {
+            "first": { "type": "apiKey", "in": "header", "name": "X-First" },
+            "second": { "type": "apiKey", "in": "query", "name": "second" }
+        }},
+        "paths": {
+            "/or": { "get": { "security": [{ "first": [] }, { "second": [] }], "responses": {} } },
+            "/and": { "get": { "security": [{ "first": [], "second": [] }], "responses": {} } },
+            "/anonymous": { "get": { "security": [{ "first": [] }, {}], "responses": {} } }
+        }
+    });
+    let compiled = compile_document(&serde_json::to_vec(&document).unwrap()).unwrap();
+    let second_only = OpenApiCredentialSet {
+        schemes: [(
+            "second".to_owned(),
+            OpenApiCredential::ApiKey {
+                value: "two".to_owned(),
+            },
+        )]
+        .into_iter()
+        .collect(),
+    };
+    let binding = |path: &str| {
+        &compiled
+            .tools
+            .iter()
+            .find(|tool| tool.binding.path_template == path)
+            .unwrap()
+            .binding
+    };
+    assert!(build_protocol_request(binding("/or"), &json!({}), &second_only).is_ok());
+    assert!(matches!(
+        build_protocol_request(binding("/and"), &json!({}), &second_only),
+        Err(OpenApiInvocationError::UnsatisfiedSecurity)
+    ));
+    assert!(
+        build_protocol_request(
+            binding("/anonymous"),
+            &json!({}),
+            &OpenApiCredentialSet::default()
+        )
+        .is_ok()
+    );
+}
+
+#[test]
+fn canonical_builder_falls_through_an_unusable_or_security_alternative() {
+    let document = json!({
+        "openapi": "3.0.3",
+        "info": { "title": "Security fallback" },
+        "servers": [{ "url": "https://api.example.test" }],
+        "components": { "securitySchemes": {
+            "badHeader": { "type": "apiKey", "in": "header", "name": "Host" },
+            "bearer": { "type": "http", "scheme": "bearer" }
+        }},
+        "paths": { "/items": { "get": {
+            "security": [{ "badHeader": [] }, { "bearer": [] }],
+            "responses": {}
+        }}}
+    });
+    let compiled = compile_document(&serde_json::to_vec(&document).unwrap()).unwrap();
+    let credentials = OpenApiCredentialSet {
+        schemes: [
+            (
+                "badHeader".to_owned(),
+                OpenApiCredential::ApiKey {
+                    value: "bad".to_owned(),
+                },
+            ),
+            (
+                "bearer".to_owned(),
+                OpenApiCredential::Bearer {
+                    token: "good".to_owned(),
+                },
+            ),
+        ]
+        .into_iter()
+        .collect(),
+    };
+    let request = build_protocol_request(&compiled.tools[0].binding, &json!({}), &credentials)
+        .expect("the valid second OR alternative should be selected");
+    assert_eq!(request.headers["authorization"], "Bearer good");
+    assert!(!request.headers.contains_key("host"));
+}
+
+#[test]
+fn canonical_builder_serializes_cookie_form_explode_variants() {
+    let document = json!({
+        "openapi": "3.0.3",
+        "info": { "title": "Cookies" },
+        "servers": [{ "url": "https://api.example.test" }],
+        "paths": { "/cookies": { "get": {
+            "parameters": [
+                { "name": "arrFalse", "in": "cookie", "explode": false, "schema": { "type": "array" } },
+                { "name": "arrTrue", "in": "cookie", "explode": true, "schema": { "type": "array" } },
+                { "name": "objectFalse", "in": "cookie", "explode": false, "schema": { "type": "object" } },
+                { "name": "objectTrue", "in": "cookie", "explode": true, "schema": { "type": "object" } }
+            ],
+            "responses": {}
+        }}}
+    });
+    let compiled = compile_document(&serde_json::to_vec(&document).unwrap()).unwrap();
+    let request = build_protocol_request(
+        &compiled.tools[0].binding,
+        &json!({ "cookies": {
+            "arrFalse": ["one", "two"],
+            "arrTrue": ["one", "two"],
+            "objectFalse": { "a": 1, "b": 2 },
+            "objectTrue": { "a": 1, "b": 2 }
+        }}),
+        &OpenApiCredentialSet::default(),
+    )
+    .unwrap();
+    assert_eq!(
+        request.headers["cookie"],
+        "arrFalse=one%2Ctwo; arrTrue=one&arrTrue=two; objectFalse=a%2C1%2Cb%2C2; a=1&b=2"
+    );
+}
+
+#[test]
+fn canonical_builder_encodes_bodies_resolves_relative_servers_and_validates_methods() {
+    let document = json!({
+        "openapi": "3.0.3",
+        "info": { "title": "Transport" },
+        "servers": [{ "url": "../v2" }],
+        "paths": { "/submit": { "post": {
+            "requestBody": { "content": {
+                "application/json": { "schema": { "type": "object" } },
+                "application/x-www-form-urlencoded": { "schema": {
+                    "type": "object",
+                    "properties": { "name": { "type": "string" } },
+                    "additionalProperties": false
+                }},
+                "text/plain": { "schema": { "type": "string" } }
+            }},
+            "responses": {}
+        }}}
+    });
+    let compiled = compile_document(&serde_json::to_vec(&document).unwrap()).unwrap();
+    let binding = &compiled.tools[0].binding;
+    let base = Url::parse("https://api.example.test/specs/openapi.json").unwrap();
+    let request = build_protocol_request_with_base(
+        binding,
+        &json!({ "body": { "name": "Ada" } }),
+        &OpenApiCredentialSet::default(),
+        Some(&base),
+    )
+    .unwrap();
+    assert_eq!(request.method, "POST");
+    assert_eq!(request.url.as_str(), "https://api.example.test/v2/submit");
+    assert_eq!(request.body, br#"{"name":"Ada"}"#);
+
+    let form = build_protocol_request_with_base(
+        binding,
+        &json!({ "body": { "name": "Ada Lovelace" }, "contentType": "application/x-www-form-urlencoded" }),
+        &OpenApiCredentialSet::default(),
+        Some(&base),
+    )
+    .unwrap();
+    assert_eq!(form.body, b"name=Ada+Lovelace");
+    let text = build_protocol_request_with_base(
+        binding,
+        &json!({ "body": "hello", "contentType": "text/plain" }),
+        &OpenApiCredentialSet::default(),
+        Some(&base),
+    )
+    .unwrap();
+    assert_eq!(text.body, b"hello");
+
+    let mut invalid = binding.clone();
+    invalid.method = "POST\r\nX-Rewrite: yes".to_owned();
+    assert!(matches!(
+        build_protocol_request_with_base(
+            &invalid,
+            &json!({}),
+            &OpenApiCredentialSet::default(),
+            Some(&base)
+        ),
+        Err(OpenApiInvocationError::InvalidArgument(argument)) if argument == "method"
+    ));
+}
+
+#[test]
+fn exact_success_response_precedes_2xx_wildcard_then_default() {
+    let compile = |include_exact: bool| {
+        let mut responses = serde_json::Map::from_iter([
+            (
+                "2XX".to_owned(),
+                json!({
+                    "description": "wildcard",
+                    "content": { "application/json": { "schema": { "const": "wildcard" } } }
+                }),
+            ),
+            (
+                "default".to_owned(),
+                json!({
+                    "description": "default",
+                    "content": { "application/json": { "schema": { "const": "default" } } }
+                }),
+            ),
+        ]);
+        if include_exact {
+            responses.insert(
+                "201".to_owned(),
+                json!({
+                    "description": "exact",
+                    "content": { "application/json": { "schema": { "const": "exact" } } }
+                }),
+            );
+        }
+        let document = json!({
+            "openapi": "3.0.3",
+            "info": { "title": "Response precedence" },
+            "paths": { "/items": { "post": { "responses": responses } } }
+        });
+        compile_document(&serde_json::to_vec(&document).unwrap()).unwrap()
+    };
+    assert_eq!(
+        compile(false).tools[0].output_schema,
+        Some(json!({ "const": "wildcard" }))
+    );
+    assert_eq!(
+        compile(true).tools[0].output_schema,
+        Some(json!({ "const": "exact" }))
+    );
+}
diff --git a/tests/openapi_storage.rs b/tests/openapi_storage.rs
new file mode 100644
index 000000000..3e9a34d35
--- /dev/null
+++ b/tests/openapi_storage.rs
@@ -0,0 +1,337 @@
+use std::collections::BTreeMap;
+
+use executor::{
+    AppConfig, ExecutorApp,
+    catalog::{
+        ArtifactKind, AuditContext, CatalogError, CatalogSnapshot, CreateSource, CredentialPayload,
+        ListToolsFilter, SourceKind, StagedArtifact, StagedTool, StagedToolBinding, ToolBinding,
+        ToolMode,
+    },
+    openapi::{OpenApiBinding, OpenApiSecurityAlternative},
+};
+use serde_json::{Map, json};
+
+async fn app() -> (tempfile::TempDir, ExecutorApp) {
+    let directory = tempfile::tempdir().expect("temporary directory should be created");
+    let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+        .await
+        .expect("Executor should open");
+    (directory, app)
+}
+
+fn staged_binding(method: &str) -> StagedToolBinding {
+    StagedToolBinding {
+        stable_key: "stable-get-weather".to_owned(),
+        binding: ToolBinding::OpenapiV1(OpenApiBinding {
+            version: 1,
+            method: method.to_owned(),
+            path_template: "/weather".to_owned(),
+            server_url: "https://weather.example.test".to_owned(),
+            parameters: Vec::new(),
+            request_body: None,
+            security: vec![OpenApiSecurityAlternative {
+                requirements: Vec::new(),
+            }],
+        }),
+    }
+}
+
+async fn source(app: &ExecutorApp) -> executor::catalog::SourceRecord {
+    app.catalog()
+        .create_source(
+            CreateSource {
+                kind: SourceKind::Openapi,
+                preferred_slug: "weather".to_owned(),
+                display_name: "Weather".to_owned(),
+                description: None,
+                configuration: Map::new(),
+            },
+            AuditContext::system(Some("test-create")),
+        )
+        .await
+        .expect("source should be created")
+}
+
+fn snapshot(source_revision: i64, credential_revision: Option<i64>) -> CatalogSnapshot {
+    CatalogSnapshot {
+        expected_source_revision: source_revision,
+        expected_credential_revision: credential_revision,
+        artifacts: vec![StagedArtifact {
+            kind: ArtifactKind::OpenapiDocument,
+            stable_key: "document".to_owned(),
+            content: json!({ "openapi": "3.1.0" }),
+        }],
+        tools: vec![StagedTool {
+            stable_key: "stable-get-weather".to_owned(),
+            preferred_name: "get_weather".to_owned(),
+            display_name: "Get weather".to_owned(),
+            description: None,
+            input_schema: json!({ "type": "object" }),
+            output_schema: None,
+            input_typescript: None,
+            output_typescript: None,
+            typescript_definitions: BTreeMap::new(),
+            intrinsic_mode: ToolMode::Enabled,
+        }],
+    }
+}
+
+#[tokio::test]
+async fn openapi_bindings_are_typed_complete_and_removed_with_the_source() {
+    let (_directory, app) = app().await;
+    let source = source(&app).await;
+    app.catalog()
+        .sync_catalog_with_bindings(
+            &source.id,
+            snapshot(source.revision, None),
+            vec![staged_binding("GET")],
+            AuditContext::system(Some("test-sync")),
+        )
+        .await
+        .expect("catalog should sync");
+    let tool = app
+        .catalog()
+        .list_tools(Default::default())
+        .await
+        .expect("tools should list")
+        .items
+        .pop()
+        .expect("tool should exist");
+
+    let binding = app
+        .catalog()
+        .tool_binding(&tool.id)
+        .await
+        .expect("binding should read");
+    assert_eq!(
+        binding.binding.openapi().expect("OpenAPI binding").method,
+        "GET"
+    );
+
+    let binding_before = sqlx::query_as::<_, (i64, i64, i64)>(
+        "SELECT revision, created_at, updated_at FROM tool_bindings WHERE tool_id = ?",
+    )
+    .bind(&tool.id)
+    .fetch_one(app.pool())
+    .await
+    .expect("binding metadata should read");
+    let refreshed_source = app
+        .catalog()
+        .source(&source.id)
+        .await
+        .expect("source should read");
+    app.catalog()
+        .sync_catalog_with_bindings(
+            &source.id,
+            snapshot(refreshed_source.revision, None),
+            vec![staged_binding("POST")],
+            AuditContext::system(Some("test-refresh")),
+        )
+        .await
+        .expect("catalog binding should refresh in place");
+    let binding_after = sqlx::query_as::<_, (i64, i64, i64, String)>(
+        "SELECT revision, created_at, updated_at, definition_json FROM tool_bindings WHERE tool_id = ?",
+    )
+    .bind(&tool.id)
+    .fetch_one(app.pool())
+    .await
+    .expect("refreshed binding metadata should read");
+    assert_eq!(binding_after.0, binding_before.0 + 1);
+    assert_eq!(binding_after.1, binding_before.1);
+    assert!(binding_after.2 >= binding_before.2);
+    assert_eq!(
+        serde_json::from_str::<serde_json::Value>(&binding_after.3)
+            .expect("binding should remain valid JSON")["method"],
+        "POST"
+    );
+
+    app.catalog()
+        .delete_source(&source.id, AuditContext::system(Some("test-delete")))
+        .await
+        .expect("source should delete");
+    let count = sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM tool_bindings")
+        .fetch_one(app.pool())
+        .await
+        .expect("binding count should read");
+    assert_eq!(count, 0);
+}
+
+#[tokio::test]
+async fn binding_write_failure_rolls_back_the_entire_catalog_refresh() {
+    let (_directory, app) = app().await;
+    let source = source(&app).await;
+    app.catalog()
+        .sync_catalog_with_bindings(
+            &source.id,
+            snapshot(source.revision, None),
+            vec![staged_binding("GET")],
+            AuditContext::system(Some("initial-sync")),
+        )
+        .await
+        .expect("initial catalog should sync");
+    let source_before = app
+        .catalog()
+        .source(&source.id)
+        .await
+        .expect("source should read");
+    let global_revision_before = app
+        .catalog()
+        .global_revision()
+        .await
+        .expect("global revision should read");
+    let tool_before = app
+        .catalog()
+        .list_tools(ListToolsFilter {
+            source_id: Some(source.id.clone()),
+            limit: 10,
+            ..Default::default()
+        })
+        .await
+        .expect("tool should list")
+        .items
+        .remove(0);
+    let binding_before = sqlx::query_as::<_, (i64, i64, String)>(
+        "SELECT revision, created_at, definition_json FROM tool_bindings WHERE tool_id = ?",
+    )
+    .bind(&tool_before.id)
+    .fetch_one(app.pool())
+    .await
+    .expect("binding should read");
+    let artifact_before = sqlx::query_scalar::<_, String>(
+        "SELECT content_json FROM source_artifacts WHERE source_id = ?",
+    )
+    .bind(&source.id)
+    .fetch_one(app.pool())
+    .await
+    .expect("artifact should read");
+    sqlx::query(
+        "CREATE TRIGGER reject_binding_refresh BEFORE UPDATE ON tool_bindings \
+         BEGIN SELECT RAISE(ABORT, 'binding write rejected'); END",
+    )
+    .execute(app.pool())
+    .await
+    .expect("failure trigger should install");
+
+    let mut replacement = snapshot(source_before.revision, None);
+    replacement.artifacts[0].content = json!({ "openapi": "3.1.1" });
+    replacement.tools[0].display_name = "Changed weather".to_owned();
+    let error = app
+        .catalog()
+        .sync_catalog_with_bindings(
+            &source.id,
+            replacement,
+            vec![staged_binding("POST")],
+            AuditContext::system(Some("failed-refresh")),
+        )
+        .await
+        .expect_err("binding failure should abort refresh");
+    assert!(matches!(error, CatalogError::Database(_)));
+
+    let source_after = app
+        .catalog()
+        .source(&source.id)
+        .await
+        .expect("source should remain readable");
+    assert_eq!(source_after.revision, source_before.revision);
+    assert_eq!(
+        source_after.catalog_revision,
+        source_before.catalog_revision
+    );
+    assert_eq!(
+        app.catalog()
+            .global_revision()
+            .await
+            .expect("global revision should read"),
+        global_revision_before
+    );
+    let tool_after = app
+        .catalog()
+        .tool(&tool_before.id)
+        .await
+        .expect("tool should remain readable");
+    assert_eq!(tool_after.revision, tool_before.revision);
+    assert_eq!(tool_after.display_name, tool_before.display_name);
+    let binding_after = sqlx::query_as::<_, (i64, i64, String)>(
+        "SELECT revision, created_at, definition_json FROM tool_bindings WHERE tool_id = ?",
+    )
+    .bind(&tool_before.id)
+    .fetch_one(app.pool())
+    .await
+    .expect("binding should remain readable");
+    assert_eq!(binding_after, binding_before);
+    assert_eq!(
+        sqlx::query_scalar::<_, String>(
+            "SELECT content_json FROM source_artifacts WHERE source_id = ?",
+        )
+        .bind(&source.id)
+        .fetch_one(app.pool())
+        .await
+        .expect("artifact should remain readable"),
+        artifact_before
+    );
+}
+
+#[tokio::test]
+async fn credentials_delete_with_compare_and_swap_and_never_store_plaintext() {
+    let (_directory, app) = app().await;
+    let source = source(&app).await;
+    let secret = "never-store-this-api-key";
+    app.catalog()
+        .put_credential(
+            &source.id,
+            &CredentialPayload {
+                schema_version: 1,
+                payload: json!({ "schemes": { "ApiKey": { "type": "api_key", "value": secret } } }),
+            },
+            None,
+            AuditContext::system(Some("test-put-credential")),
+        )
+        .await
+        .expect("credential should store");
+    let stored = app
+        .catalog()
+        .credential(&source.id)
+        .await
+        .expect("credential should read")
+        .expect("credential should exist");
+    assert_eq!(
+        stored.credential.payload["schemes"]["ApiKey"]["value"],
+        secret
+    );
+    let raw = sqlx::query_scalar::<_, Vec<u8>>(
+        "SELECT payload_ciphertext FROM source_credentials WHERE source_id = ?",
+    )
+    .bind(&source.id)
+    .fetch_one(app.pool())
+    .await
+    .expect("ciphertext should read");
+    assert!(!String::from_utf8_lossy(&raw).contains(secret));
+
+    let conflict = app
+        .catalog()
+        .delete_credential(
+            &source.id,
+            stored.revision + 1,
+            AuditContext::system(Some("test-delete-conflict")),
+        )
+        .await;
+    assert!(matches!(
+        conflict,
+        Err(executor::catalog::CatalogError::RevisionConflict { .. })
+    ));
+    app.catalog()
+        .delete_credential(
+            &source.id,
+            stored.revision,
+            AuditContext::system(Some("test-delete-credential")),
+        )
+        .await
+        .expect("matching revision should delete");
+    assert!(
+        app.catalog()
+            .credential(&source.id)
+            .await
+            .expect("credential state should read")
+            .is_none()
+    );
+}
diff --git a/tests/outbound.rs b/tests/outbound.rs
new file mode 100644
index 000000000..7bfacc0ba
--- /dev/null
+++ b/tests/outbound.rs
@@ -0,0 +1,483 @@
+use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};
+
+use executor::outbound::{
+    AddressClass, HardenedHttpClient, OutboundError, OutboundPolicy, OutboundRequest, classify_ip,
+    parse_url, redirect_target, validate_url,
+};
+use reqwest::{Method, header::HeaderValue};
+use tokio::{
+    io::{AsyncReadExt, AsyncWriteExt},
+    net::{TcpListener, TcpStream},
+};
+use url::Url;
+
+async fn read_request(stream: &mut TcpStream) -> String {
+    let mut request = Vec::new();
+    let mut buffer = [0_u8; 1024];
+    while !request.windows(4).any(|window| window == b"\r\n\r\n") {
+        let read = stream
+            .read(&mut buffer)
+            .await
+            .expect("test request is readable");
+        assert!(read > 0, "test request ended before its headers");
+        request.extend_from_slice(&buffer[..read]);
+    }
+    String::from_utf8(request).expect("test request headers are UTF-8")
+}
+
+#[test]
+fn private_network_opt_in_never_allows_link_local_or_metadata_addresses() {
+    let denied = OutboundPolicy::default();
+    let allowed = OutboundPolicy {
+        allow_private_networks: true,
+        ..OutboundPolicy::default()
+    };
+
+    let private = Url::parse("http://10.20.30.40/spec.json").expect("private URL parses");
+    assert!(matches!(
+        validate_url(&private, &denied),
+        Err(OutboundError::PrivateAddress)
+    ));
+    assert!(validate_url(&private, &allowed).is_ok());
+    let tailscale = Url::parse("http://100.64.1.2/openapi.json").expect("tailnet URL parses");
+    assert!(validate_url(&tailscale, &allowed).is_ok());
+
+    for target in [
+        "http://169.254.169.254/latest/meta-data/",
+        "http://169.254.170.2/credentials",
+        "http://100.100.100.200/latest/meta-data/",
+        "http://[fe80::1]/metadata",
+        "http://[fd00:ec2::254]/latest/meta-data/",
+        "http://[fd20:ce::254]/computeMetadata/v1/",
+        "http://[fd00:c1::a9fe:a9fe]/opc/v2/",
+    ] {
+        let target = Url::parse(target).expect("forbidden URL parses");
+        assert!(matches!(
+            validate_url(&target, &allowed),
+            Err(OutboundError::ForbiddenAddress)
+        ));
+    }
+}
+
+#[test]
+fn ipv4_mapped_ipv6_cannot_bypass_private_address_rules() {
+    let mapped = IpAddr::V6(Ipv6Addr::from_bits(
+        (0xffff_u128 << 32) | u32::from(Ipv4Addr::new(127, 0, 0, 1)) as u128,
+    ));
+    assert_eq!(classify_ip(mapped), AddressClass::Private);
+}
+
+#[test]
+fn special_use_and_encapsulated_addresses_are_not_public() {
+    let cases = [
+        ("100.64.0.1", AddressClass::Private),
+        ("100.100.100.200", AddressClass::Forbidden),
+        ("192.0.2.1", AddressClass::Forbidden),
+        ("198.18.0.1", AddressClass::Forbidden),
+        ("203.0.113.1", AddressClass::Forbidden),
+        ("224.0.0.1", AddressClass::Forbidden),
+        ("2001:db8::1", AddressClass::Forbidden),
+        ("2001:5::1", AddressClass::Forbidden),
+        ("3fff:0fff:ffff::1", AddressClass::Forbidden),
+        ("3fff:1000::1", AddressClass::Public),
+        ("fc00::1", AddressClass::Private),
+        ("fd00:ec2::254", AddressClass::Forbidden),
+        ("fd20:ce::254", AddressClass::Forbidden),
+        ("fd00:c1::a9fe:a9fe", AddressClass::Forbidden),
+        ("2002:7f00:0001::", AddressClass::Private),
+        ("2606:4700:4700::1111", AddressClass::Public),
+        ("8.8.8.8", AddressClass::Public),
+    ];
+    for (address, expected) in cases {
+        assert_eq!(
+            classify_ip(address.parse().expect("test address parses")),
+            expected,
+            "unexpected class for {address}"
+        );
+    }
+}
+
+#[test]
+fn urls_reject_credential_fragments_and_non_http_schemes() {
+    let policy = OutboundPolicy::default();
+    let cases = [
+        (
+            "https://user:secret@example.com/spec",
+            "outbound_credentials_not_allowed",
+        ),
+        (
+            "https://example.com/spec#secret",
+            "outbound_fragment_not_allowed",
+        ),
+        ("file:///etc/passwd", "unsupported_outbound_scheme"),
+    ];
+    for (url, expected_code) in cases {
+        let error = validate_url(&Url::parse(url).expect("test URL parses"), &policy)
+            .expect_err("unsafe URL is denied");
+        assert_eq!(error.code(), expected_code);
+    }
+}
+
+#[test]
+fn malformed_url_returns_a_stable_public_error() {
+    let error =
+        parse_url("not a URL", &OutboundPolicy::default()).expect_err("malformed URL is rejected");
+    assert_eq!(error.code(), "invalid_outbound_url");
+    assert_eq!(error.to_string(), "the outbound URL is invalid");
+}
+
+#[test]
+fn redirects_resolve_relative_locations_and_deny_downgrades() {
+    let policy = OutboundPolicy::default();
+    let current = Url::parse("https://example.com/apis/openapi.json").expect("URL parses");
+    let relative = HeaderValue::from_static("../v2/openapi.json?revision=2");
+    let next = redirect_target(&current, Some(&relative), &policy).expect("redirect is valid");
+    assert_eq!(
+        next.as_str(),
+        "https://example.com/v2/openapi.json?revision=2"
+    );
+
+    let downgrade = HeaderValue::from_static("http://example.com/openapi.json");
+    assert!(matches!(
+        redirect_target(&current, Some(&downgrade), &policy),
+        Err(OutboundError::RedirectDowngrade)
+    ));
+
+    let secure_cross_origin = HeaderValue::from_static("https://cdn.example.net/openapi.json");
+    assert_eq!(
+        redirect_target(&current, Some(&secure_cross_origin), &policy)
+            .expect("HTTPS redirects remain allowed")
+            .as_str(),
+        "https://cdn.example.net/openapi.json"
+    );
+}
+
+#[test]
+fn redirects_revalidate_literal_targets_at_every_hop() {
+    let policy = OutboundPolicy::default();
+    let current = Url::parse("https://example.com/openapi.json").expect("URL parses");
+    let metadata = HeaderValue::from_static("https://169.254.169.254/latest/meta-data/");
+    assert!(matches!(
+        redirect_target(&current, Some(&metadata), &policy),
+        Err(OutboundError::ForbiddenAddress)
+    ));
+}
+
+#[tokio::test]
+async fn cross_origin_redirects_drop_custom_credentials() {
+    let destination = TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("destination binds");
+    let destination_address = destination
+        .local_addr()
+        .expect("destination has an address");
+    let destination_task = tokio::spawn(async move {
+        let (mut stream, _) = destination.accept().await.expect("destination accepts");
+        let request = read_request(&mut stream).await;
+        stream
+            .write_all(b"HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\n{}")
+            .await
+            .expect("destination responds");
+        request
+    });
+
+    let redirector = TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("redirector binds");
+    let redirector_address = redirector.local_addr().expect("redirector has an address");
+    let redirector_task = tokio::spawn(async move {
+        let (mut stream, _) = redirector.accept().await.expect("redirector accepts");
+        let _request = read_request(&mut stream).await;
+        let response = format!(
+            "HTTP/1.1 302 Found\r\nLocation: http://{destination_address}/final\r\nContent-Length: 0\r\n\r\n"
+        );
+        stream
+            .write_all(response.as_bytes())
+            .await
+            .expect("redirector responds");
+    });
+
+    let policy = OutboundPolicy {
+        allow_private_networks: true,
+        ..OutboundPolicy::default()
+    };
+    let client = HardenedHttpClient::new(policy);
+    let mut headers = reqwest::header::HeaderMap::new();
+    headers.insert("x-api-key", HeaderValue::from_static("super-secret"));
+    let response = client
+        .fetch_spec(
+            Url::parse(&format!("http://{redirector_address}/spec")).expect("redirect URL parses"),
+            headers,
+        )
+        .await
+        .expect("redirected fetch succeeds");
+    assert_eq!(response.body, b"{}");
+    assert_eq!(response.final_url.path(), "/final");
+    redirector_task.await.expect("redirector task completes");
+    let destination_request = destination_task
+        .await
+        .expect("destination task completes")
+        .to_ascii_lowercase();
+    assert!(!destination_request.contains("x-api-key"));
+    assert!(!destination_request.contains("super-secret"));
+}
+
+#[tokio::test]
+async fn custom_url_policy_rejects_a_multi_hop_target_before_request() {
+    let blocked = TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("blocked target binds");
+    let blocked_address = blocked.local_addr().expect("blocked target has an address");
+
+    let second = TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("second redirector binds");
+    let second_address = second
+        .local_addr()
+        .expect("second redirector has an address");
+    let second_task = tokio::spawn(async move {
+        let (mut stream, _) = second.accept().await.expect("second redirector accepts");
+        let _request = read_request(&mut stream).await;
+        let response = format!(
+            "HTTP/1.1 302 Found\r\nLocation: http://{blocked_address}/blocked\r\nContent-Length: 0\r\n\r\n"
+        );
+        stream
+            .write_all(response.as_bytes())
+            .await
+            .expect("second redirector responds");
+    });
+
+    let first = TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("first redirector binds");
+    let first_address = first.local_addr().expect("first redirector has an address");
+    let first_task = tokio::spawn(async move {
+        let (mut stream, _) = first.accept().await.expect("first redirector accepts");
+        let _request = read_request(&mut stream).await;
+        let response = format!(
+            "HTTP/1.1 302 Found\r\nLocation: http://{second_address}/next\r\nContent-Length: 0\r\n\r\n"
+        );
+        stream
+            .write_all(response.as_bytes())
+            .await
+            .expect("first redirector responds");
+    });
+
+    let client = HardenedHttpClient::new(OutboundPolicy {
+        allow_private_networks: true,
+        ..OutboundPolicy::default()
+    });
+    let error = match client
+        .fetch_spec_with_url_policy(
+            Url::parse(&format!("http://{first_address}/spec")).expect("spec URL parses"),
+            reqwest::header::HeaderMap::new(),
+            |candidate| {
+                if candidate.port_or_known_default() == Some(blocked_address.port()) {
+                    Err(OutboundError::RedirectDowngrade)
+                } else {
+                    Ok(())
+                }
+            },
+        )
+        .await
+    {
+        Err(error) => error,
+        Ok(_) => panic!("the custom policy must reject the final redirect target"),
+    };
+    assert!(matches!(error, OutboundError::RedirectDowngrade));
+    first_task.await.expect("first redirector completes");
+    second_task.await.expect("second redirector completes");
+    assert!(
+        tokio::time::timeout(std::time::Duration::from_millis(100), blocked.accept())
+            .await
+            .is_err(),
+        "the rejected redirect target must receive no request"
+    );
+}
+
+#[tokio::test]
+async fn ordinary_execution_never_follows_a_credential_bearing_redirect() {
+    let destination = TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("redirect destination binds");
+    let destination_address = destination
+        .local_addr()
+        .expect("redirect destination has an address");
+    let redirector = TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("redirector binds");
+    let redirector_address = redirector.local_addr().expect("redirector has an address");
+    let redirector_task = tokio::spawn(async move {
+        let (mut stream, _) = redirector.accept().await.expect("redirector accepts");
+        let request = read_request(&mut stream).await;
+        assert!(request.to_ascii_lowercase().contains("x-api-key: secret"));
+        let response = format!(
+            "HTTP/1.1 302 Found\r\nLocation: http://{destination_address}/leak\r\nContent-Length: 0\r\n\r\n"
+        );
+        stream
+            .write_all(response.as_bytes())
+            .await
+            .expect("redirector responds");
+    });
+    let client = HardenedHttpClient::new(OutboundPolicy {
+        allow_private_networks: true,
+        ..OutboundPolicy::default()
+    });
+    let mut request = OutboundRequest::new(
+        Method::GET,
+        Url::parse(&format!("http://{redirector_address}/start")).expect("redirector URL parses"),
+    );
+    request
+        .headers
+        .insert("x-api-key", HeaderValue::from_static("secret"));
+    let response = client
+        .execute(request)
+        .await
+        .expect("redirect response is returned without following it");
+    assert_eq!(response.status, reqwest::StatusCode::FOUND);
+    redirector_task.await.expect("redirector completes");
+    assert!(
+        tokio::time::timeout(std::time::Duration::from_millis(100), destination.accept(),)
+            .await
+            .is_err(),
+        "the credential-bearing redirect target must receive no request"
+    );
+}
+
+#[tokio::test]
+async fn response_size_cap_rejects_declared_oversize_before_returning_body() {
+    let server = TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("server binds");
+    let address = server.local_addr().expect("server has an address");
+    let server_task = tokio::spawn(async move {
+        let (mut stream, _) = server.accept().await.expect("server accepts");
+        let _request = read_request(&mut stream).await;
+        stream
+            .write_all(b"HTTP/1.1 200 OK\r\nContent-Length: 5\r\n\r\n12345")
+            .await
+            .expect("server responds");
+    });
+    let policy = OutboundPolicy {
+        allow_private_networks: true,
+        max_response_bytes: 4,
+        ..OutboundPolicy::default()
+    };
+    let client = HardenedHttpClient::new(policy);
+    let request = OutboundRequest::new(
+        Method::GET,
+        Url::parse(&format!("http://{address}/oversize")).expect("request URL parses"),
+    );
+    assert!(matches!(
+        client.execute(request).await,
+        Err(OutboundError::ResponseBodyTooLarge)
+    ));
+    server_task.await.expect("server task completes");
+}
+
+#[tokio::test]
+async fn streaming_response_yields_before_connection_eof_and_keeps_byte_cap() {
+    let server = TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("server binds");
+    let address = server.local_addr().expect("server has an address");
+    let server_task = tokio::spawn(async move {
+        let (mut stream, _) = server.accept().await.expect("server accepts");
+        let _request = read_request(&mut stream).await;
+        stream
+            .write_all(b"HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\n\r\nfirst")
+            .await
+            .expect("first chunk writes");
+        stream.flush().await.expect("first chunk flushes");
+        tokio::time::sleep(std::time::Duration::from_secs(2)).await;
+    });
+    let policy = OutboundPolicy {
+        allow_private_networks: true,
+        max_response_bytes: 5,
+        ..OutboundPolicy::default()
+    };
+    let client = HardenedHttpClient::new(policy);
+    let request = OutboundRequest::new(
+        Method::GET,
+        Url::parse(&format!("http://{address}/stream")).expect("request URL parses"),
+    );
+    let mut response = client
+        .execute_streaming(request)
+        .await
+        .expect("stream headers arrive");
+    let first = tokio::time::timeout(std::time::Duration::from_millis(500), response.next_chunk())
+        .await
+        .expect("chunk arrives before EOF")
+        .expect("chunk is valid")
+        .expect("chunk exists");
+    assert_eq!(first, b"first");
+    server_task.abort();
+}
+
+#[tokio::test]
+async fn long_lived_stream_uses_idle_timeout_instead_of_request_deadline() {
+    let server = TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("server binds");
+    let address = server.local_addr().expect("server has an address");
+    let server_task = tokio::spawn(async move {
+        let (mut stream, _) = server.accept().await.expect("server accepts");
+        let _request = read_request(&mut stream).await;
+        stream
+            .write_all(b"HTTP/1.1 200 OK\r\nContent-Type: text/event-stream\r\n\r\nfirst")
+            .await
+            .expect("headers write");
+        stream.flush().await.expect("headers flush");
+        tokio::time::sleep(std::time::Duration::from_millis(100)).await;
+        stream.write_all(b"again").await.expect("event writes");
+        stream.flush().await.expect("event flushes");
+    });
+    let policy = OutboundPolicy {
+        allow_private_networks: true,
+        request_timeout: std::time::Duration::from_millis(50),
+        max_response_bytes: 5,
+        ..OutboundPolicy::default()
+    };
+    let client = HardenedHttpClient::new(policy);
+    let request = OutboundRequest::new(
+        Method::GET,
+        Url::parse(&format!("http://{address}/events")).expect("request URL parses"),
+    );
+    let mut response = client
+        .execute_long_lived_streaming(request, std::time::Duration::from_millis(500))
+        .await
+        .expect("long-lived headers arrive");
+    let first = response
+        .next_chunk()
+        .await
+        .expect("idle deadline permits delayed event")
+        .expect("event chunk exists");
+    let second = response
+        .next_chunk()
+        .await
+        .expect("cumulative lifetime bytes do not exhaust the per-chunk cap")
+        .expect("second chunk exists");
+    assert_eq!(first, b"first");
+    assert_eq!(second, b"again");
+    server_task.await.expect("server task completes");
+}
+
+#[tokio::test]
+async fn trace_and_connect_are_rejected_before_network_work() {
+    let policy = OutboundPolicy {
+        allow_private_networks: true,
+        ..OutboundPolicy::default()
+    };
+    let client = HardenedHttpClient::new(policy);
+    let url = Url::parse("http://127.0.0.1:9/").expect("request URL parses");
+    for method in [Method::TRACE, Method::CONNECT] {
+        let error = match client
+            .execute(OutboundRequest::new(method, url.clone()))
+            .await
+        {
+            Err(error) => error,
+            Ok(_) => panic!("unsafe method is rejected"),
+        };
+        assert_eq!(error.code(), "forbidden_outbound_method");
+    }
+}
diff --git a/tests/presets-reachable.test.ts b/tests/presets-reachable.test.ts
index aeca000f6..a8c720630 100644
--- a/tests/presets-reachable.test.ts
+++ b/tests/presets-reachable.test.ts
@@ -176,7 +176,7 @@ describe("public preset URLs are detected by the correct plugin", () => {
       () =>
         Effect.gen(function* () {
           const executor = yield* makeExecutor();
-          const results = yield* executor.sources.detect(preset.url);
+          const results = yield* executor.integrations.detect(preset.url);
 
           expect(
             results.length,
diff --git a/tests/release-bootstrap-smoke.test.ts b/tests/release-bootstrap-smoke.test.ts
index 7ddb6f9cc..b199189a0 100644
--- a/tests/release-bootstrap-smoke.test.ts
+++ b/tests/release-bootstrap-smoke.test.ts
@@ -14,7 +14,7 @@ type CommandResult = {
 };
 
 const repoRoot = resolve(dirnameOf(import.meta.url), "..");
-const cliRoot = join(repoRoot, "apps/cli");
+const cliRoot = join(repoRoot, "legacy/cli");
 const distDir = join(cliRoot, "dist");
 
 function dirnameOf(url: string): string {
diff --git a/tests/release-dockerfile.test.ts b/tests/release-dockerfile.test.ts
new file mode 100644
index 000000000..3692d1d7e
--- /dev/null
+++ b/tests/release-dockerfile.test.ts
@@ -0,0 +1,238 @@
+import { describe, expect, it } from "@effect/vitest";
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+const repoRoot = resolve(import.meta.dirname, "..");
+const dockerfile = readFileSync(resolve(repoRoot, "Dockerfile"), "utf8");
+const nativeDockerfile = readFileSync(resolve(repoRoot, "Dockerfile.release-native"), "utf8");
+const packageDockerfile = readFileSync(resolve(repoRoot, "Dockerfile.release-package"), "utf8");
+const dockerignore = readFileSync(resolve(repoRoot, "Dockerfile.dockerignore"), "utf8");
+const serviceSource = readFileSync(resolve(repoRoot, "src/service.rs"), "utf8");
+const release = readFileSync(resolve(repoRoot, ".github/workflows/release.yml"), "utf8");
+const compose = readFileSync(resolve(repoRoot, "compose.yaml"), "utf8");
+const dockerDocs = readFileSync(resolve(repoRoot, "docs/docker.md"), "utf8");
+const installDocs = readFileSync(resolve(repoRoot, "docs/install.md"), "utf8");
+
+const workflowJob = (name: string, nextName: string) =>
+  release.slice(release.indexOf(`  ${name}:`), release.indexOf(`  ${nextName}:`));
+
+describe("native release artifact reuse", () => {
+  it("builds the web payload once and downloads it into every native leg", () => {
+    expect(release.match(/bun run --cwd web build/gu)).toHaveLength(1);
+
+    const web = workflowJob("web", "notices");
+    const native = workflowJob("build-native", "package-native");
+    expect(web).toContain("name: executor-web-build");
+    expect(web).toContain("path: web/build/");
+    expect(native).toContain("name: executor-web-build");
+    expect(native).toContain("path: web/build");
+    expect(native).not.toContain("bun run --cwd web build");
+    expect(native).not.toContain("oven-sh/setup-bun");
+  });
+
+  it("boots every packaged native archive against the canonical web payload", () => {
+    const smoke = workflowJob("smoke-native", "checksums");
+
+    for (const target of [
+      "aarch64-apple-darwin",
+      "aarch64-unknown-linux-gnu",
+      "x86_64-apple-darwin",
+      "x86_64-unknown-linux-gnu",
+    ]) {
+      expect(smoke).toContain(`target: ${target}`);
+    }
+    expect(smoke).toContain("name: executor-release-archives");
+    expect(smoke).toContain("name: executor-web-build");
+    expect(smoke).toContain("shasum -a 256 --check");
+    expect(smoke).toContain("Complete first-boot setup at:");
+    expect(smoke).toContain("scripts/smoke-release-server.sh");
+    expect(release).toContain("checksums:\n    name: Assemble checksum manifest\n    needs:");
+    expect(release).toContain("      - smoke-native");
+  });
+
+  it("keeps the default Docker target self-contained and adds a prebuilt release target", () => {
+    const stageNames = [...dockerfile.matchAll(/^FROM .+ AS (\S+)$/gmu)].map((match) => match[1]);
+    expect(stageNames).toEqual([
+      "web-builder",
+      "rust-builder",
+      "runtime-base",
+      "runtime-prebuilt",
+      "runtime",
+    ]);
+
+    const prebuilt = dockerfile.slice(
+      dockerfile.indexOf("FROM runtime-base AS runtime-prebuilt"),
+      dockerfile.indexOf("FROM runtime-base AS runtime\n"),
+    );
+    const runtime = dockerfile.slice(dockerfile.indexOf("FROM runtime-base AS runtime\n"));
+    expect(prebuilt).toContain("COPY --from=prebuilt-executor");
+    expect(prebuilt).not.toContain("cargo build");
+    expect(prebuilt).not.toContain("bun run");
+    expect(runtime).toContain("COPY --from=rust-builder /usr/local/bin/executor");
+    expect(dockerfile).toContain(
+      "FROM oven/bun:1.3.11@sha256:0733e50325078969732ebe3b15ce4c4be5082f18c4ac1a0f0ca4839c2e4e42a7 AS web-builder",
+    );
+    expect(dockerfile).toContain(
+      "FROM rust:1.96-bookworm@sha256:6d19f49541d185805745b8baa781b1fd482118c81a3154510ee18dcce985d005 AS rust-builder",
+    );
+  });
+
+  it("enables cargo-about's CLI binary everywhere it is installed", () => {
+    const installs = [dockerfile, release].flatMap(
+      (source) => source.match(/cargo install cargo-about[^\n]*/gu) ?? [],
+    );
+
+    expect(installs.length).toBeGreaterThan(0);
+    for (const install of installs) {
+      expect(install).toContain("--features cli");
+    }
+  });
+
+  it("builds each release image from its matching Linux archive and assembles a manifest", () => {
+    const containers = release.slice(release.indexOf("  build-container-dry-run:"));
+    expect(containers).toContain("name: executor-release-artifacts");
+    expect(containers).toContain("target: runtime-prebuilt");
+    expect(containers).toContain("prebuilt-executor=${{ runner.temp }}/prebuilt-executor");
+    expect(containers).toContain("platform: linux/amd64");
+    expect(containers).toContain("platform: linux/arm64");
+    expect(containers).toContain("push-by-digest=true");
+    expect(containers).toContain('--tag "$staging"');
+    expect(containers).not.toContain("cargo build");
+    expect(containers).not.toContain("bun run --cwd web build");
+  });
+
+  it("smokes the release-only image path before promotion", () => {
+    const dryRun = workflowJob("build-container-dry-run", "publish-container-arch");
+    const published = workflowJob("smoke-container", "promote");
+    const promote = release.slice(release.indexOf("  promote:"));
+
+    expect(dryRun).toContain("load: true");
+    expect(dryRun).toContain("scripts/smoke-release-container.sh");
+    expect(published).toContain('reference="$IMAGE@$IMAGE_DIGEST"');
+    expect(published).toContain('docker pull "$reference"');
+    expect(published).toContain("scripts/smoke-release-container.sh");
+    expect(published).toContain("name: executor-web-build");
+    expect(published).toContain("name: Verify exact digest is anonymously pullable");
+    expect(published).toContain('DOCKER_CONFIG="$anonymous_config" docker pull');
+    expect(promote).toContain("      - smoke-container");
+  });
+
+  it("documents and configures a published prebuilt Compose start flow", () => {
+    expect(compose).toContain('image: "${EXECUTOR_IMAGE:-executor:local}"');
+    expect(dockerDocs).toContain("export EXECUTOR_IMAGE=ghcr.io/davis7dotsh/executor:v0.1.0");
+    expect(dockerDocs).toContain("docker compose up --detach --no-build executor");
+    expect(dockerDocs).toContain("curl --fail --silent --show-error");
+    expect(installDocs).toContain("shasum -a 256 --check SHA256SUMS");
+  });
+
+  it("pins runtime inputs and normalizes image timestamps for retry-safe digests", () => {
+    const containers = release.slice(release.indexOf("  build-container-dry-run:"));
+    const native = workflowJob("build-native", "smoke-native");
+    const promote = release.slice(release.indexOf("  promote:"));
+
+    expect(dockerfile).toContain(
+      "FROM debian:bookworm-20260623-slim@sha256:60eac759739651111db372c07be67863818726f754804b8707c90979bda511df AS runtime-base",
+    );
+    expect(dockerfile).toContain(
+      "# syntax=docker/dockerfile:1.7@sha256:a57df69d0ea827fb7266491f2813635de6f17269be881f696fbfdf2d83dda33e",
+    );
+    expect(dockerfile).toContain("ARG DEBIAN_SNAPSHOT=20260623T000000Z");
+    expect(dockerfile).toContain("snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT}");
+    expect(release).toContain('source_date_epoch="$(git show -s --format=%ct HEAD)"');
+    expect(release).toContain(
+      "BUILDKIT_IMAGE: moby/buildkit:v0.30.0@sha256:0168606be2315b7c807a03b3d8aa79beefdb31c98740cebdffdfeebf31190c9f",
+    );
+    expect(release).toContain("BUILDX_VERSION: v0.34.1");
+    expect(release.match(/uses: docker\/setup-buildx-action@/gu)).toHaveLength(
+      release.match(/driver-opts: image=\$\{\{ env\.BUILDKIT_IMAGE \}\}/gu)?.length ?? 0,
+    );
+    expect(release.match(/uses: docker\/setup-buildx-action@/gu)).toHaveLength(
+      release.match(/version: \$\{\{ env\.BUILDX_VERSION \}\}/gu)?.length ?? 0,
+    );
+    expect(nativeDockerfile).toContain(
+      "FROM ubuntu:22.04@sha256:4f838adc7181d9039ac795a7d0aba05a9bd9ecd480d294483169c5def983b64d AS builder",
+    );
+    expect(nativeDockerfile).toContain("ARG UBUNTU_SNAPSHOT=20260623T000000Z");
+    expect(nativeDockerfile).toContain(
+      "checksum=c295047583a56238ea06b43f849f4b877fa12bfd4c7103f8d9a74c94c9c4e108",
+    );
+    expect(nativeDockerfile).toContain(
+      "checksum=371eadcca97062219cbd8593628eb5d2802bc370515d085fedce1b56b2baed57",
+    );
+    expect(native).toContain("SOURCE_DATE_EPOCH: ${{ needs.validate.outputs.source_date_epoch }}");
+    expect(native).toContain("file: Dockerfile.release-native");
+    expect(native).toContain("driver-opts: image=${{ env.BUILDKIT_IMAGE }}");
+    expect(native).toContain("Verify Linux glibc 2.35 compatibility ceiling");
+    expect(native).not.toContain("python3 scripts/package-release-archive.py");
+    expect(native).not.toContain('tar -C "$stage" -czf');
+    expect(release).toContain("name: Package native archives in pinned compressor environment");
+    expect(release).toContain("file: Dockerfile.release-package");
+    expect(release).toContain("name: Repeat pinned archive build");
+    expect(release).toContain("REPRODUCIBILITY_RUN=first");
+    expect(release).toContain("REPRODUCIBILITY_RUN=second");
+    expect(release).toContain('cmp "$first/$archive" "$second/$archive"');
+    expect(packageDockerfile).toContain(
+      "# syntax=docker/dockerfile:1.7@sha256:a57df69d0ea827fb7266491f2813635de6f17269be881f696fbfdf2d83dda33e",
+    );
+    expect(packageDockerfile).toContain(
+      "FROM ubuntu:22.04@sha256:4f838adc7181d9039ac795a7d0aba05a9bd9ecd480d294483169c5def983b64d AS packager",
+    );
+    expect(packageDockerfile).toContain("ARG UBUNTU_SNAPSHOT=20260623T000000Z");
+    expect(packageDockerfile).toContain("python3-minimal");
+    expect(packageDockerfile).toContain("python3 /usr/local/bin/package-release-archive.py");
+    expect(packageDockerfile).toContain("> /output/BUILD-TOOLCHAINS.txt");
+    expect(release).toContain('cmp "$first/BUILD-TOOLCHAINS.txt"');
+    expect(release).toContain("sha256sum BUILD-TOOLCHAINS.txt >> SHA256SUMS");
+    expect(release).not.toContain("actions/attest-build-provenance@");
+    expect(containers.match(/SOURCE_DATE_EPOCH:/gu)).toHaveLength(2);
+    expect(containers.match(/provenance: false/gu)).toHaveLength(2);
+    expect(containers.match(/sbom: false/gu)).toHaveLength(2);
+    expect(containers).toContain("push=true,rewrite-timestamp=true");
+    expect(dockerfile).toContain(
+      "FROM debian:bookworm-20260623-slim@sha256:60eac759739651111db372c07be67863818726f754804b8707c90979bda511df AS runtime-base\n\nARG SOURCE_DATE_EPOCH",
+    );
+    expect(dockerfile).toContain('date --utc --date="@${SOURCE_DATE_EPOCH:-0}"');
+    expect(promote).toContain("name: Verify published GitHub release is immutable");
+    expect(promote).toContain('gh release verify "$RELEASE_TAG"');
+  });
+
+  it("stages every embedded service asset in both Rust Docker build contexts", () => {
+    const embeddedPaths = [...serviceSource.matchAll(/include_bytes!\("\.\.\/([^"\n]+)"\)/gu)].map(
+      (match) => match[1],
+    );
+
+    expect(embeddedPaths.length).toBeGreaterThan(0);
+    for (const path of embeddedPaths) {
+      expect(dockerfile).toContain(`COPY ${path} ./${path}`);
+      expect(nativeDockerfile).toContain(`COPY ${path} ./${path}`);
+      expect(dockerignore).toContain(`!${path}`);
+    }
+  });
+
+  it("preflights immutable version tags and allows only the channel tag to move", () => {
+    const promote = release.slice(release.indexOf("  promote:"));
+    const preflight = promote.indexOf(
+      'immutable_tags=("$RELEASE_TAG" "$VERSION" "sha-$RELEASE_SHA")',
+    );
+    const assignment = promote.indexOf('for tag in "${missing_tags[@]}"');
+    const publish = promote.indexOf("name: Publish GitHub release");
+    const verifyImmutable = promote.indexOf("name: Verify published GitHub release is immutable");
+    const verifyAttestation = promote.indexOf('gh release verify "$RELEASE_TAG"');
+    const channelStep = promote.indexOf(
+      "name: Move mutable channel after GitHub release publication",
+    );
+    const channelMove = promote.indexOf('--tag "$channel_reference"');
+
+    expect(promote).toContain('existing="$(inspect_digest "$reference")"');
+    expect(promote).toContain('if [ "$existing" != "$IMAGE_DIGEST" ]');
+    expect(promote).toContain("already points to the expected digest");
+    expect(release).toContain('staging="$IMAGE:staging-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"');
+    expect(preflight).toBeGreaterThan(-1);
+    expect(assignment).toBeGreaterThan(preflight);
+    expect(publish).toBeGreaterThan(assignment);
+    expect(verifyImmutable).toBeGreaterThan(publish);
+    expect(verifyAttestation).toBeGreaterThan(verifyImmutable);
+    expect(channelStep).toBeGreaterThan(verifyAttestation);
+    expect(channelMove).toBeGreaterThan(channelStep);
+  });
+});
diff --git a/tests/release-workflows.test.ts b/tests/release-workflows.test.ts
index 310bbe73c..b059ceb39 100644
--- a/tests/release-workflows.test.ts
+++ b/tests/release-workflows.test.ts
@@ -1,11 +1,39 @@
 import { describe, expect, it } from "@effect/vitest";
-import { readFileSync } from "node:fs";
+import { Schema } from "effect";
+import { spawnSync } from "node:child_process";
+import { existsSync, globSync, readFileSync, readdirSync } from "node:fs";
 import { resolve } from "node:path";
 
 import { validateReleaseTag, validateReleaseVersion } from "../scripts/validate-release-ref";
 
-const workflow = (name: string): string =>
-  readFileSync(resolve(import.meta.dirname, "..", ".github/workflows", name), "utf8");
+const repoRoot = resolve(import.meta.dirname, "..");
+const workflowsRoot = resolve(repoRoot, ".github/workflows");
+const workflow = (name: string) => readFileSync(resolve(workflowsRoot, name), "utf8");
+const repositoryFile = (name: string) => readFileSync(resolve(repoRoot, name), "utf8");
+const privatePackageManifest = Schema.fromJsonString(
+  Schema.Struct({ private: Schema.Literal(true) }),
+);
+const decodePrivatePackageManifest = Schema.decodeUnknownSync(privatePackageManifest);
+const workspaceRootManifest = Schema.fromJsonString(
+  Schema.Struct({
+    private: Schema.Literal(true),
+    workspaces: Schema.Array(Schema.String),
+  }),
+);
+const decodeWorkspaceRootManifest = Schema.decodeUnknownSync(workspaceRootManifest);
+
+const ownedWorkflows = readdirSync(workflowsRoot)
+  .filter((name) => /\.ya?ml$/u.test(name))
+  .sort();
+
+const workflowJob = (contents: string, name: string) => {
+  const marker = `\n  ${name}:\n`;
+  const start = contents.indexOf(marker);
+  const bodyStart = start + marker.length;
+  const remaining = contents.slice(bodyStart);
+  const nextJob = remaining.search(/\n  [a-z][a-z0-9-]*:\n/u);
+  return contents.slice(start, nextJob === -1 ? contents.length : bodyStart + nextJob);
+};
 
 describe("release workflow hardening", () => {
   it("accepts only semver release versions and v-prefixed semver tags", () => {
@@ -21,35 +49,661 @@ describe("release workflow hardening", () => {
     expect(() => validateReleaseTag("v01.2.3")).toThrow();
   });
 
-  it("validates release values through environment variables before shell use", () => {
-    const publishExecutor = workflow("publish-executor-package.yml");
+  it("has one explicit native product release entrypoint", () => {
     const release = workflow("release.yml");
-    const publishDesktop = workflow("publish-desktop.yml");
+    const triggerBlock = release.slice(release.indexOf("on:"), release.indexOf("\npermissions:"));
+
+    expect(triggerBlock).toContain("workflow_dispatch:");
+    expect(triggerBlock).toContain("dry-run");
+    expect(triggerBlock).toContain("publish");
+    expect(triggerBlock).toContain("commit_sha:");
+    expect(triggerBlock).toContain("tag:");
+    expect(triggerBlock).not.toContain("push:");
+
+    expect(existsSync(resolve(workflowsRoot, "build-release-artifacts.yml"))).toBe(false);
+    expect(existsSync(resolve(workflowsRoot, "publish-selfhost-docker.yml"))).toBe(false);
+    expect(existsSync(resolve(workflowsRoot, "publish-executor-package.yml"))).toBe(false);
+    expect(existsSync(resolve(workflowsRoot, "pkg-pr-new.yml"))).toBe(false);
+  });
+
+  it("runs the static release and installer contracts in CI", () => {
+    const ci = workflow("ci.yml");
+
+    expect(ci).toContain("run: bun run test:release:static");
+    expect(ci).toContain("run: bun run test:release:installer");
+    expect(ci).toContain("run: bun run test:release:systemd");
+    expect(ci).toContain("run: bun run test:release:shell");
+  });
 
-    expect(publishExecutor).toContain(
-      "bun run scripts/validate-release-ref.ts --tag-env RAW_RELEASE_TAG --write-env RELEASE_TAG",
+  it("installs the locked OAuth emulator before Rust integration tests", () => {
+    const rust = workflowJob(workflow("ci.yml"), "rust");
+    const setup = rust.indexOf("uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76");
+    const install = rust.indexOf("run: bun install --frozen-lockfile --ignore-scripts");
+    const verify = rust.indexOf("run: test -x e2e/node_modules/.bin/emulate");
+    const test = rust.indexOf("run: cargo test --locked --all-targets --all-features");
+
+    expect(setup).toBeGreaterThanOrEqual(0);
+    expect(rust).toContain("bun-version: 1.3.11");
+    expect(install).toBeGreaterThan(setup);
+    expect(verify).toBeGreaterThan(install);
+    expect(test).toBeGreaterThan(verify);
+    expect(repositoryFile("e2e/package.json")).toContain('"@executor-js/emulate": "^0.7.5"');
+  });
+
+  it("serializes installer mutations and preserves crash-durability ordering", () => {
+    const installer = repositoryFile("scripts/install.sh");
+    const beginTransaction = installer.slice(
+      installer.indexOf("begin_install_transaction()"),
+      installer.indexOf("recover_install_transaction()"),
     );
-    expect(release).toContain(
-      "bun run scripts/validate-release-ref.ts --version-env RELEASE_VERSION --output tag",
+    const rollback = installer.slice(
+      installer.indexOf("recover_install_transaction()"),
+      installer.indexOf("commit_install_transaction()"),
     );
-    expect(publishDesktop).toContain(
-      "bun run scripts/validate-release-ref.ts --tag-env RAW_RELEASE_TAG --write-env RELEASE_TAG",
+    const commit = installer.slice(
+      installer.indexOf("commit_install_transaction()"),
+      installer.indexOf("remove_owned_file()"),
+    );
+    const uninstall = installer.slice(
+      installer.indexOf("uninstall_executor()"),
+      installer.indexOf("\nprepare_install_root\n"),
+    );
+    const entrypoint = installer.slice(
+      installer.indexOf("\nprepare_install_root\n"),
+      installer.indexOf('\ncase "$REPOSITORY" in'),
+    );
+
+    const beginOrder = [
+      'durability_barrier "recovery-tree-durable:$transaction_label"',
+      'mv "$temporary" "$recovery"',
+      'durability_barrier "recovery-durable:$transaction_label"',
+    ];
+    const rollbackOrder = [
+      'durability_barrier "rollback-managed-durable:$name"',
+      'durability_barrier "rollback-manifest-durable"',
+      "retire_install_recovery rollback",
+    ];
+    const commitOrder = [
+      '"managed-file-durable:$name"',
+      '"manifest-durable:$transaction_label"',
+      'retire_install_recovery "$transaction_label"',
+    ];
+    const uninstallOrder = [
+      'remove_owned_file "$name" "$hash"',
+      'rm -f -- "$manifest"',
+      'durability_barrier "uninstall-manifest-durable"',
+    ];
+
+    for (const [section, fragments] of [
+      [beginTransaction, beginOrder],
+      [rollback, rollbackOrder],
+      [commit, commitOrder],
+      [uninstall, uninstallOrder],
+    ] as const) {
+      for (let index = 1; index < fragments.length; index += 1) {
+        expect(section.indexOf(fragments[index - 1])).toBeGreaterThanOrEqual(0);
+        expect(section.indexOf(fragments[index])).toBeGreaterThan(
+          section.indexOf(fragments[index - 1]),
+        );
+      }
+    }
+
+    expect(entrypoint).toContain(
+      "prepare_install_root\ntrap installer_exit_cleanup EXIT\ntest_pause_if_requested after-install-root\nacquire_install_lock\nrecover_install_transaction",
     );
+    expect(installer).toContain("validate_install_path_component /");
+    expect(installer).toContain("install_root_parent_identity");
+    expect(installer).toContain("could not verify live install-lock owner pid");
+    expect(installer).toContain("executor-path-edit-lock-v1");
+    expect(installer).toContain("acquire_path_edit_lock");
+    expect(installer).toContain("command -v sync");
+    expect(installer).not.toContain("python3");
+  });
 
-    expect(release).not.toContain('tag="v${{ steps.detect_release.outputs.version }}"');
-    expect(publishDesktop).not.toContain("ref: refs/tags/${{ inputs.tag }}");
-    expect(publishDesktop).not.toContain('gh release download "${{ inputs.tag }}"');
-    expect(publishExecutor).not.toMatch(/\n\s+RELEASE_TAG: \$\{\{ github\.event_name/u);
+  it("binds the release tag to Cargo.toml and an exact commit", () => {
+    const release = workflow("release.yml");
+    const cargoManifest = repositoryFile("Cargo.toml");
+    const releasing = repositoryFile("RELEASING.md");
+
+    expect(release).toContain("version=\"$(python3 - <<'PY'");
+    expect(release).toContain('if [ "$RELEASE_TAG" != "v$version" ]');
+    expect(release).toContain('[[ ! "$INPUT_COMMIT_SHA" =~ ^[0-9a-f]{40}$ ]]');
+    expect(release).toContain('if [ "$WORKFLOW_SHA" != "$INPUT_COMMIT_SHA" ]');
+    expect(release).toContain("RUN_ATTEMPT: ${{ github.run_attempt }}");
+    expect(release).toContain('if [ "$RUN_ATTEMPT" = 1 ] \\');
+    expect(release).toContain("The first release attempt must use the current origin/main commit");
+    expect(release).toContain('actual_sha="$(git rev-parse HEAD)"');
+    expect(release).toContain('git rev-parse "$RELEASE_TAG^{commit}"');
+    expect(release).toContain('if [ "$RELEASE_MODE" = "publish" ] \\');
+    expect(release).toContain('[ "$WORKFLOW_REF" != refs/heads/main ]');
+    expect(release).toContain('echo "commit_sha=$actual_sha"');
+    expect(release).toContain("ref: ${{ needs.validate.outputs.commit_sha }}");
+    expect(release.match(/inputs\.commit_sha/gu)).toHaveLength(2);
+    expect(release).toContain("is not on origin/main");
+    expect(release).toContain('[[ "$version" == *+* ]]');
+    expect(release).not.toContain("legacy/cli/package.json");
+    expect(cargoManifest).toContain('rust-version = "1.96"');
+    expect(releasing).toContain("gh workflow run release.yml --ref main");
+    expect(releasing).toContain('gh run rerun "$run_id"');
+    expect(releasing).not.toContain('gh run rerun "$run_id" --failed');
+    expect(releasing).toContain("workflow source revision");
   });
 
-  it("does not persist checkout credentials in release workflows", () => {
+  it("gates every native publisher with the exact reviewed environment and token", () => {
+    const release = workflow("release.yml");
+    const validate = workflowJob(release, "validate");
+    const releasing = repositoryFile("RELEASING.md");
+
+    expect(validate).toContain("Verify exact native release environment policy");
+    expect(validate).toContain('"repos/$EXECUTOR_REPOSITORY/environments/native-release"');
+    expect(validate).toContain(
+      '"repos/$EXECUTOR_REPOSITORY/environments/native-release/deployment-branch-policies?per_page=100"',
+    );
+    expect(validate).toContain('rule_types != ["branch_policy", "required_reviewers"]');
+    expect(validate).toContain('environment.get("can_admins_bypass") is not False');
+    expect(validate).toContain('identity.get("login") != "bmdavis419"');
+    expect(validate).toContain('identity.get("id") != 45952064');
+    expect(validate).toContain('branch_policies[0].get("name") != "main"');
+    expect(validate).toContain('branch_policies[0].get("type") != "branch"');
+
+    const protectedJobs = [
+      "authorize-publish",
+      "stage-release",
+      "publish-container-arch",
+      "assemble-container",
+      "smoke-container",
+      "promote",
+    ];
+    for (const name of protectedJobs) {
+      const job = workflowJob(release, name);
+      expect(job, name).toContain("if: inputs.mode == 'publish'");
+      expect(job, name).toContain("environment: native-release");
+      expect(job, name).not.toContain("contents: write");
+      expect(job, name).not.toContain("packages: write");
+      expect(job, name).not.toContain("attestations: write");
+      expect(job, name).not.toContain("${{ github.token }}");
+    }
+
     for (const name of [
-      "publish-executor-package.yml",
-      "release.yml",
-      "publish-desktop.yml",
-      "pkg-pr-new.yml",
+      "stage-release",
+      "publish-container-arch",
+      "assemble-container",
+      "smoke-container",
+      "promote",
     ]) {
-      expect(workflow(name)).toContain("persist-credentials: false");
+      expect(workflowJob(release, name), name).toContain("- authorize-publish");
+    }
+
+    const authorization = workflowJob(release, "authorize-publish");
+    expect(authorization).toContain("GH_TOKEN: ${{ secrets.NATIVE_RELEASE_TOKEN }}");
+    expect(authorization).toContain('expected_scopes = {"public_repo", "write:packages"}');
+    expect(authorization).toContain("if actual_scopes != expected_scopes:");
+    expect(authorization).toContain(
+      "NATIVE_RELEASE_TOKEN must have exactly public_repo and write:packages scopes",
+    );
+    expect(authorization).not.toContain("for required_scope in");
+    expect(authorization).toContain('"repos/$EXECUTOR_REPOSITORY/immutable-releases"');
+    expect(authorization).toContain("docker login ghcr.io");
+    expect(authorization.indexOf("Verify exact immutable release tag ruleset")).toBeGreaterThan(
+      authorization.indexOf("Require the environment-scoped release token and capabilities"),
+    );
+    expect(release).not.toContain("actions/attest-build-provenance@");
+    expect(release).not.toContain("id-token: write");
+    expect(release).not.toContain("attestations: write");
+    expect(releasing).toContain("reviewer the GitHub user `bmdavis419`");
+    expect(releasing).toContain("classic personal access token owned by `bmdavis419`");
+    expect(releasing).toContain("exact scopes `public_repo` and `write:packages`, and no others");
+    expect(releasing).toContain(
+      "https://github.com/settings/tokens/new?scopes=public_repo,write:packages",
+    );
+    expect(releasing).toContain("`GITHUB_TOKEN` remains read-only");
+  });
+
+  it("requires immutable v tags and rechecks the tag at both mutation boundaries", () => {
+    const release = workflow("release.yml");
+    const validate = workflowJob(release, "validate");
+    const authorization = workflowJob(release, "authorize-publish");
+    const stage = workflowJob(release, "stage-release");
+    const promote = workflowJob(release, "promote");
+    const releasing = repositoryFile("RELEASING.md");
+
+    expect(validate).not.toContain("bypass_actors");
+    expect(validate).not.toContain("release-tag-rulesets");
+    expect(authorization).toContain("Verify exact immutable release tag ruleset");
+    expect(authorization).toContain('ref_name.get("include") == ["refs/tags/v*"]');
+    expect(authorization).toContain('ruleset.get("bypass_actors") == []');
+    expect(authorization).toContain('rule_types == ["deletion", "update"]');
+    expect(authorization).toContain('== {"update_allows_fetch_and_merge": False}');
+
+    const stageFetch = stage.indexOf("git fetch --force --no-tags origin");
+    const stageMutation = stage.indexOf('gh release view "$RELEASE_TAG"');
+    expect(stageFetch).toBeGreaterThanOrEqual(0);
+    expect(stageMutation).toBeGreaterThan(stageFetch);
+    expect(stage).toContain('if [ "$tag_sha" != "$RELEASE_SHA" ]');
+
+    const promotionCheck = promote.indexOf("Revalidate remote release tag before promotion");
+    const firstPromotionMutation = promote.indexOf(
+      "Assign immutable tags and verify channel eligibility",
+    );
+    expect(promotionCheck).toBeGreaterThanOrEqual(0);
+    expect(firstPromotionMutation).toBeGreaterThan(promotionCheck);
+    expect(promote).toContain('if [ "$tag_sha" != "$RELEASE_SHA" ]');
+    expect(release.match(/git fetch --force --no-tags origin/gu)).toHaveLength(2);
+    expect(releasing).toContain("active tag ruleset for exactly `refs/tags/v*`");
+  });
+
+  it("uses the validated source and checksums throughout the release graph", () => {
+    const release = workflow("release.yml");
+    const stage = workflowJob(release, "stage-release");
+    const checkoutCount = release.match(/uses: actions\/checkout@/gu)?.length ?? 0;
+    const workflowCheckoutCount = release.match(/ref: \$\{\{ github\.sha \}\}/gu)?.length ?? 0;
+    const validatedCheckoutCount =
+      release.match(/ref: \$\{\{ needs\.validate\.outputs\.commit_sha \}\}/gu)?.length ?? 0;
+
+    expect(workflowCheckoutCount).toBe(1);
+    expect(validatedCheckoutCount).toBe(checkoutCount - 1);
+    expect(release).not.toContain("ref: ${{ inputs.commit_sha }}");
+    expect(
+      release.match(
+        /org\.opencontainers\.image\.revision=\$\{\{ needs\.validate\.outputs\.commit_sha \}\}/gu,
+      ),
+    ).toHaveLength(2);
+    expect(release).not.toContain("org.opencontainers.image.revision=${{ inputs.commit_sha }}");
+    expect(stage).toContain("RELEASE_SHA: ${{ needs.validate.outputs.commit_sha }}");
+    expect(stage).toContain('--target "$RELEASE_SHA"');
+    expect(stage).toContain("release-artifacts/SHA256SUMS");
+    expect(release).toContain("sha256sum --check SHA256SUMS");
+    expect(release).not.toContain("subject-path:");
+    expect(release).not.toContain("subject-digest:");
+  });
+
+  it("publishes GitHub before moving the mutable container channel", () => {
+    const promote = workflowJob(workflow("release.yml"), "promote");
+    const immutableStep = promote.slice(
+      promote.indexOf("Assign immutable tags and verify channel eligibility"),
+      promote.indexOf("Publish GitHub release"),
+    );
+    const verifyBindings = promote.indexOf(
+      "Verify release ownership and image binding before publication",
+    );
+    const publish = promote.indexOf("Publish GitHub release");
+    const verifyImmutable = promote.indexOf("Verify published GitHub release is immutable");
+    const moveChannel = promote.indexOf("Move mutable channel after GitHub release publication");
+
+    expect(verifyBindings).toBeGreaterThanOrEqual(0);
+    expect(publish).toBeGreaterThan(verifyBindings);
+    expect(publish).toBeGreaterThanOrEqual(0);
+    expect(verifyImmutable).toBeGreaterThan(publish);
+    expect(moveChannel).toBeGreaterThan(verifyImmutable);
+    expect(immutableStep).not.toContain('--tag "$IMAGE:$CHANNEL"');
+    expect(promote.slice(moveChannel)).toContain('--tag "$channel_reference"');
+    expect(promote.slice(moveChannel)).toContain("--json isDraft");
+    expect(promote.slice(verifyImmutable, moveChannel)).toContain(
+      'release.get("immutable") is not True',
+    );
+    expect(promote.slice(verifyImmutable, moveChannel)).toContain(
+      'gh release verify "$RELEASE_TAG"',
+    );
+    expect(promote.slice(verifyImmutable, moveChannel)).toContain("for attempt in {1..24}");
+    expect(promote.slice(publish, verifyImmutable)).not.toContain('--tag "$channel_reference"');
+    expect(promote.slice(verifyImmutable, moveChannel)).not.toContain('--tag "$channel_reference"');
+  });
+
+  it("binds retry convergence and release assets to the original workflow run", () => {
+    const release = workflow("release.yml");
+    const validate = workflowJob(release, "validate");
+    const publishContainer = workflowJob(release, "publish-container-arch");
+    const stage = workflowJob(release, "stage-release");
+    const promote = workflowJob(release, "promote");
+    const releasing = repositoryFile("RELEASING.md");
+
+    expect(validate).toContain('if [ "$RUN_ATTEMPT" = 1 ]');
+    expect(validate).toContain("RUN_ID: ${{ github.run_id }}");
+    expect(validate).toContain('release_title="$RELEASE_TAG [executor-run:$RUN_ID]"');
+    expect(validate).toContain('release.get("immutable") is not True');
+    expect(validate).toContain('select(.name == "RELEASE-RUN.json")');
+    expect(validate).toContain(
+      "Same-run draft is missing RELEASE-RUN.json; staging will repair it",
+    );
+    expect(validate).toContain("Same-run retry will reuse immutable published release");
+
+    expect(stage).toContain("- assemble-container");
+    expect(stage).toContain("RELEASE-RUN.json");
+    expect(stage).toContain("RELEASE-IMAGE.json");
+    expect(stage).toContain('"run_id": sys.argv[6]');
+    expect(stage).toContain('"digest": sys.argv[8]');
+    expect(stage).toContain('"image": sys.argv[7]');
+    expect(stage).toContain('--title "$release_title"');
+    expect(stage).not.toContain('--title "$RELEASE_TAG"');
+    expect(stage).toContain("Recovering same-run draft created before its binding asset uploaded");
+    expect(stage).toContain('if [ "$published_release" = false ]; then');
+    expect(stage).toContain('gh release upload "$RELEASE_TAG"');
+    expect(stage).toContain("--clobber");
+    expect(stage).toContain('cmp "$run_binding" "$ownership/RELEASE-RUN.json"');
+    expect(stage).toContain('cmp "$asset" "$verified_assets/$(basename "$asset")"');
+    expect(publishContainer).toContain("name: executor-container-digest-${{ matrix.artifact }}");
+    expect(
+      publishContainer.slice(publishContainer.indexOf("- name: Upload architecture digest")),
+    ).toContain("overwrite: true");
+
+    const validateTitle = validate.indexOf('actual_title="$(jq -r');
+    const validateBinding = validate.indexOf("--pattern RELEASE-RUN.json");
+    const stageTitle = stage.indexOf('actual_title="$(jq -r');
+    const stageUpload = stage.indexOf('gh release upload "$RELEASE_TAG"');
+    expect(validateBinding).toBeGreaterThan(validateTitle);
+    expect(stageUpload).toBeGreaterThan(stageTitle);
+
+    expect(promote).toContain('release.get("name") != sys.argv[4]');
+    expect(promote).toContain('cmp "$asset" "$verified_assets/$(basename "$asset")"');
+    expect(promote).toContain('release.get("name") != sys.argv[5]');
+    expect(validate).toContain('release.get("immutable") is not True');
+    expect(promote).toContain("GitHub release $RELEASE_TAG is already published");
+    expect(releasing).toContain("exact current\nworkflow run ID");
+    expect(releasing).toContain('gh run rerun "$run_id"');
+    expect(releasing).not.toContain("--failed");
+  });
+
+  it("keeps the release and installer repository identity coherent", () => {
+    const canonicalRepository = "davis7dotsh/executor-fork-testing";
+    const installer = repositoryFile("scripts/install.sh");
+    const installDocs = repositoryFile("docs/install.md");
+    const hostedDocs = repositoryFile("apps/docs/self-hosting.mdx");
+    const docsIndex = repositoryFile("apps/docs/index.mdx");
+    const docsConfig = repositoryFile("apps/docs/docs.json");
+    const legacyCloudflareDocs = repositoryFile("apps/docs/hosted/cloudflare.mdx");
+    const marketingIndex = repositoryFile("apps/marketing/src/pages/index.astro");
+    const marketingLegal = repositoryFile("apps/marketing/src/components/LegalLayout.astro");
+    const marketingPrivacy = repositoryFile("apps/marketing/src/pages/privacy.astro");
+    const marketingTerms = repositoryFile("apps/marketing/src/pages/terms.astro");
+    const rootPackage = repositoryFile("package.json");
+    const release = workflow("release.yml");
+
+    expect(installer).toContain(`REPOSITORY="\${EXECUTOR_REPOSITORY:-${canonicalRepository}}"`);
+    expect(installer).toContain("EXECUTOR_REPOSITORY     GitHub owner/repository");
+    expect(installDocs).toContain(
+      `raw.githubusercontent.com/${canonicalRepository}/main/scripts/install.sh`,
+    );
+    expect(hostedDocs).toContain(
+      `raw.githubusercontent.com/${canonicalRepository}/main/scripts/install.sh`,
+    );
+    expect(installDocs).toContain("export EXECUTOR_REPOSITORY=owner/repository");
+    expect(installDocs).toContain("bash -s -- --uninstall");
+    expect(installDocs).toContain("It preserves all databases, master keys");
+    expect(hostedDocs).toContain("export EXECUTOR_REPOSITORY=owner/repository");
+    expect(docsIndex).toContain(`https://github.com/${canonicalRepository}`);
+    expect(docsConfig).toContain(`https://github.com/${canonicalRepository}`);
+    expect(legacyCloudflareDocs).toContain(`https://github.com/${canonicalRepository}`);
+    for (const activeSurface of [
+      docsIndex,
+      docsConfig,
+      legacyCloudflareDocs,
+      marketingIndex,
+      marketingLegal,
+      marketingPrivacy,
+      marketingTerms,
+      rootPackage,
+    ]) {
+      expect(activeSurface).toContain(`github.com/${canonicalRepository}`);
+      expect(activeSurface).not.toContain("github.com/RhysSullivan/executor");
+    }
+    expect(installDocs).toContain("not Developer ID signed or notarized");
+    expect(release).toContain("EXECUTOR_REPOSITORY: ${{ github.repository }}");
+    expect(release).toContain('--repo "$EXECUTOR_REPOSITORY"');
+  });
+
+  it("packages four native targets and promotes only after assets and Docker succeed", () => {
+    const release = workflow("release.yml");
+
+    for (const target of [
+      "aarch64-apple-darwin",
+      "aarch64-unknown-linux-gnu",
+      "x86_64-apple-darwin",
+      "x86_64-unknown-linux-gnu",
+    ]) {
+      expect(release).toContain(`executor-${target}.tar.gz`);
+    }
+
+    expect(release).toContain("SHA256SUMS");
+    expect(release).not.toContain("actions/attest-build-provenance@");
+    expect(release).toContain("file: Dockerfile");
+    expect(release).toContain("platform: linux/amd64");
+    expect(release).toContain("platform: linux/arm64");
+    expect(release).toContain("target: runtime-prebuilt");
+    const promote = workflowJob(release, "promote");
+    expect(promote).toContain("- assemble-container");
+    expect(promote).toContain("- authorize-publish");
+    expect(promote).toContain("- smoke-container");
+    expect(promote).toContain("- stage-release");
+    expect(promote).toContain('args=(release edit "$RELEASE_TAG"');
+  });
+
+  it("serializes releases and rejects a v0.1 channel rollback after v0.2", () => {
+    const release = workflow("release.yml");
+    const rollback = spawnSync(
+      "python3",
+      [
+        resolve(repoRoot, "scripts/check-release-channel-order.py"),
+        "--channel",
+        "latest",
+        "--current",
+        "0.2.0",
+        "--candidate",
+        "0.1.0",
+      ],
+      { encoding: "utf8" },
+    );
+    const historicalRollback = spawnSync(
+      "python3",
+      [
+        resolve(repoRoot, "scripts/check-release-channel-order.py"),
+        "--channel",
+        "latest",
+        "--history-file",
+        "-",
+        "--candidate",
+        "0.1.0",
+      ],
+      {
+        encoding: "utf8",
+        input: JSON.stringify([[{ draft: false, tag_name: "v0.2.0" }]]),
+      },
+    );
+    const betaUpgrade = spawnSync(
+      "python3",
+      [
+        resolve(repoRoot, "scripts/check-release-channel-order.py"),
+        "--channel",
+        "beta",
+        "--current",
+        "1.0.0-beta.2",
+        "--candidate",
+        "1.0.0-beta.10",
+      ],
+      { encoding: "utf8" },
+    );
+
+    expect(release).toContain("group: native-release\n");
+    expect(release).not.toContain("group: native-release-${{ inputs.tag }}");
+    expect(release).toContain("index:org.opencontainers.image.version=$VERSION");
+    expect(release).toContain("scripts/check-release-channel-order.py");
+    expect(release).toContain('--history-file "$release_history"');
+    expect(rollback.status).toBe(1);
+    expect(rollback.stderr).toContain("would move latest backward from 0.2.0 to 0.1.0");
+    expect(historicalRollback.status).toBe(1);
+    expect(historicalRollback.stderr).toContain("would move latest backward from 0.2.0 to 0.1.0");
+    expect(betaUpgrade.status).toBe(0);
+    expect(betaUpgrade.stdout.trim()).toBe("newer");
+  });
+
+  it("verifies the version annotation on a synthetic raw release index", () => {
+    const release = workflow("release.yml");
+    const verifier = resolve(repoRoot, "scripts/verify-release-index.py");
+    const index = {
+      annotations: { "org.opencontainers.image.version": "0.2.0" },
+      manifests: [
+        { platform: { architecture: "amd64", os: "linux" } },
+        { platform: { architecture: "arm64", os: "linux" } },
+      ],
+      schemaVersion: 2,
+    };
+    const valid = spawnSync("python3", [verifier, "--version", "0.2.0"], {
+      encoding: "utf8",
+      input: JSON.stringify(index),
+    });
+    const missingAnnotation = spawnSync("python3", [verifier, "--version", "0.2.0"], {
+      encoding: "utf8",
+      input: JSON.stringify({ ...index, annotations: {} }),
+    });
+
+    expect(release).toContain('--annotation "index:org.opencontainers.image.version=$VERSION"');
+    expect(release).toContain("python3 scripts/verify-release-index.py");
+    expect(valid.status).toBe(0);
+    expect(valid.stdout.trim()).toBe("verified release index for 0.2.0");
+    expect(missingAnnotation.status).toBe(1);
+    expect(missingAnnotation.stderr).toContain("version annotation does not equal 0.2.0");
+  });
+
+  it("declares and enforces the macOS 14 compatibility floor", () => {
+    const release = workflow("release.yml");
+    const nativeSmoke = release.slice(
+      release.indexOf("  smoke-native:"),
+      release.indexOf("  checksums:"),
+    );
+    const installDocs = repositoryFile("docs/install.md");
+    const appleVerifier = repositoryFile("scripts/verify-apple-toolchain.sh");
+
+    expect(release).toContain('MACOSX_DEPLOYMENT_TARGET: "14.0"');
+    expect(release).toContain(
+      "MACOS_BUILD_DEVELOPER_DIR: /Applications/Xcode_16.4.app/Contents/Developer",
+    );
+    expect(release).toContain('MACOS_BUILD_XCODE_VERSION: "16.4"');
+    expect(release).toContain("MACOS_BUILD_XCODE_BUILD: 16F6");
+    expect(release).toContain('MACOS_BUILD_SDK_VERSION: "15.5"');
+    expect(release).toContain(
+      "MACOS_BUILD_CLANG_VERSION: Apple clang version 17.0.0 (clang-1700.0.13.5)",
+    );
+    expect(release).toContain('MACOS_BUILD_LD_VERSION: "1167.5"');
+    expect(release).toContain(
+      "MACOS_FLOOR_DEVELOPER_DIR: /Applications/Xcode_15.4.app/Contents/Developer",
+    );
+    expect(release).toContain('MACOS_FLOOR_XCODE_VERSION: "15.4"');
+    expect(release).toContain("MACOS_FLOOR_XCODE_BUILD: 15F31d");
+    expect(release).toContain('MACOS_FLOOR_SDK_VERSION: "14.5"');
+    expect(release).toContain(
+      "MACOS_FLOOR_CLANG_VERSION: Apple clang version 15.0.0 (clang-1500.3.9.4)",
+    );
+    expect(release).toContain('MACOS_FLOOR_LD_VERSION: "1053.12"');
+    expect(release.match(/bash scripts\/verify-apple-toolchain\.sh/gu)).toHaveLength(2);
+    expect(release).toContain("DEVELOPER_DIR: ${{ env.MACOS_BUILD_DEVELOPER_DIR }}");
+    expect(release).toContain("DEVELOPER_DIR: ${{ env.MACOS_FLOOR_DEVELOPER_DIR }}");
+    expect(appleVerifier).toContain('xcode_info="$(xcodebuild -version)"');
+    expect(appleVerifier).toContain('sdk_version="$(xcrun --sdk macosx --show-sdk-version)"');
+    expect(appleVerifier).toContain('clang_info="$(xcrun clang --version)"');
+    expect(appleVerifier).toContain('ld_info="$(xcrun ld -v 2>&1)"');
+    expect(appleVerifier).toContain('[[ "$(xcrun --find clang)" == "${toolchain_bin}/clang" ]]');
+    expect(release).toContain('xcrun vtool -show-build "$binary"');
+    expect(release).toContain('if [ "$minos" != "$MACOSX_DEPLOYMENT_TARGET" ]');
+    expect(release).toContain("name: Test macOS service lifecycle on compatibility floor");
+    expect(release).toContain("run: cargo test --locked --lib service::tests");
+    expect(release).toContain("run: bash scripts/test-install-launchd-safety.sh");
+    expect(release).toContain("run: bash scripts/test-bounded-log.sh");
+    expect(release).toContain("run: bash scripts/test-install-release-archive.sh");
+    expect(nativeSmoke).toContain("- runner: macos-14\n            target: aarch64-apple-darwin");
+    expect(installDocs).toContain("macOS 14 Sonoma or newer");
+  });
+
+  it("retires npm and Changesets publication surfaces", () => {
+    const rootPackage = repositoryFile("package.json");
+
+    for (const path of [
+      ".github/workflows/publish-typescript-packages.yml",
+      ".changeset/config.json",
+      "scripts/lib/npm-tarball-equivalence.ts",
+      "scripts/publish-packages.ts",
+      "scripts/smoke-docs-install.ts",
+      "scripts/smoke-test-packed.ts",
+    ]) {
+      expect(existsSync(resolve(repoRoot, path)), path).toBe(false);
+    }
+
+    expect(rootPackage).not.toContain("@changesets/");
+    expect(rootPackage).not.toContain("changeset");
+    expect(rootPackage).not.toContain("release:publish");
+    expect(rootPackage).not.toContain("release:smoke:packages");
+    expect(rootPackage).not.toContain("compatibility");
+    expect(repositoryFile("RELEASING.md")).not.toContain("TypeScript compatibility packages");
+    expect(existsSync(resolve(workflowsRoot, "publish-desktop.yml"))).toBe(false);
+    expect(existsSync(resolve(import.meta.dirname, "..", "legacy/cli/src/release.ts"))).toBe(false);
+  });
+
+  it("marks the root and every configured workspace package as private", () => {
+    const rootManifest = decodeWorkspaceRootManifest(repositoryFile("package.json"));
+    const manifests = new Set(["package.json"]);
+
+    for (const workspace of rootManifest.workspaces) {
+      const matches = globSync(`${workspace}/package.json`, { cwd: repoRoot });
+      expect(matches.length, workspace).toBeGreaterThan(0);
+      for (const manifest of matches) {
+        manifests.add(manifest);
+      }
+    }
+
+    expect(manifests.size).toBeGreaterThan(rootManifest.workspaces.length);
+    for (const manifest of manifests) {
+      expect(decodePrivatePackageManifest(repositoryFile(manifest)), manifest).toEqual({
+        private: true,
+      });
+    }
+  });
+
+  it("requires explicit opt-in for Cloudflare previews and removes mutable package previews", () => {
+    expect(workflow("preview.yml")).toContain("vars.ENABLE_CLOUDFLARE_PREVIEWS == 'true'");
+    expect(workflow("preview-sweep.yml")).toContain("vars.ENABLE_CLOUDFLARE_PREVIEWS == 'true'");
+    expect(existsSync(resolve(workflowsRoot, "pkg-pr-new.yml"))).toBe(false);
+    expect(existsSync(resolve(workflowsRoot, "publish-typescript-packages.yml"))).toBe(false);
+  });
+
+  it("checks out and reports the exact pull request head commit for previews", () => {
+    const preview = workflow("preview.yml");
+    const checkoutCount = preview.match(/uses: actions\/checkout@/gu)?.length ?? 0;
+    const headRefCount =
+      preview.match(/ref: \$\{\{ github\.event\.pull_request\.head\.sha \}\}/gu)?.length ?? 0;
+
+    expect(headRefCount).toBe(checkoutCount);
+    expect(preview).toContain("PREVIEW_SHA: ${{ steps.checkout.outputs.commit }}");
+    expect(preview).toContain("${process.env.PREVIEW_SHA}");
+    expect(preview).not.toContain("github.sha");
+  });
+
+  it("does not grant publishing permissions to dry-run jobs", () => {
+    const release = workflow("release.yml");
+    const nativeDryRun = release.slice(
+      release.indexOf("  build-container-dry-run:"),
+      release.indexOf("  publish-container-arch:"),
+    );
+
+    expect(nativeDryRun).not.toContain("packages: write");
+    expect(nativeDryRun).not.toContain("id-token: write");
+    expect(nativeDryRun).not.toContain("NATIVE_RELEASE_TOKEN");
+  });
+
+  it("pins every external action in owned workflows to an immutable SHA", () => {
+    for (const name of ownedWorkflows) {
+      const contents = workflow(name);
+      const actionReferences = [...contents.matchAll(/^\s*-?\s*uses:\s+\S+@([^\s#]+)/gmu)];
+      expect(actionReferences.length, name).toBeGreaterThan(0);
+      for (const reference of actionReferences) {
+        expect(reference[1], `${name}: ${reference[0]}`).toMatch(/^[0-9a-f]{40}$/u);
+      }
+    }
+  });
+
+  it("does not persist checkout credentials in owned workflows", () => {
+    for (const name of ownedWorkflows) {
+      const contents = workflow(name);
+      const checkoutCount = contents.match(/uses: actions\/checkout@/gu)?.length ?? 0;
+      const credentialCount = contents.match(/persist-credentials: false/gu)?.length ?? 0;
+      expect(credentialCount, name).toBe(checkoutCount);
     }
   });
 });
diff --git a/tests/runtime.rs b/tests/runtime.rs
new file mode 100644
index 000000000..978a5b67a
--- /dev/null
+++ b/tests/runtime.rs
@@ -0,0 +1,516 @@
+use std::{
+    collections::HashMap,
+    sync::{
+        Arc, OnceLock,
+        atomic::{AtomicUsize, Ordering},
+    },
+    time::Duration,
+};
+
+use async_trait::async_trait;
+use executor::runtime::{
+    ExecutionCancellation, ExecutionRequest, HostToolDispatcher, RuntimeManager, ToolCall,
+    ToolResult,
+};
+use serde_json::{Value, json};
+use tokio::sync::{Barrier, Mutex};
+
+fn manager() -> RuntimeManager {
+    RuntimeManager::new(env!("CARGO_BIN_EXE_executor"))
+}
+
+fn request(code: &str) -> ExecutionRequest {
+    ExecutionRequest {
+        execution_id: uuid::Uuid::new_v4().to_string(),
+        code: code.into(),
+        timeout: Duration::from_secs(5),
+    }
+}
+
+async fn test_guard() -> tokio::sync::MutexGuard<'static, ()> {
+    static TEST_LOCK: OnceLock<Mutex<()>> = OnceLock::new();
+    TEST_LOCK.get_or_init(|| Mutex::new(())).lock().await
+}
+
+struct EchoDispatcher;
+
+#[async_trait]
+impl HostToolDispatcher for EchoDispatcher {
+    async fn dispatch(&self, call: ToolCall, _: ExecutionCancellation) -> ToolResult {
+        ToolResult::Success {
+            value: json!({ "path": call.path, "arguments": call.arguments }),
+        }
+    }
+}
+
+#[tokio::test]
+async fn executes_typescript_with_proxy_console_and_emit() {
+    let _guard = test_guard().await;
+    let output = manager()
+        .execute(
+            request(
+                r#"
+                const count: number = 2;
+                console.info("calling", count);
+                emit({ phase: "ready" });
+                const response = await tools.weather["forecast"]({ city: "Paris", count });
+                return { response, missingThen: tools.weather.then === undefined };
+                "#,
+            ),
+            Arc::new(EchoDispatcher),
+            ExecutionCancellation::default(),
+        )
+        .await
+        .expect("execution should succeed");
+    assert_eq!(output.result["response"]["path"], "weather.forecast");
+    assert_eq!(output.result["response"]["arguments"]["count"], 2);
+    assert_eq!(output.result["missingThen"], true);
+    assert_eq!(output.emits, vec![json!({ "phase": "ready" })]);
+    assert_eq!(output.console[0].message, "calling 2");
+    assert_eq!(output.tool_calls.len(), 1);
+}
+
+struct DependencyDispatcher;
+
+#[async_trait]
+impl HostToolDispatcher for DependencyDispatcher {
+    async fn dispatch(&self, call: ToolCall, _: ExecutionCancellation) -> ToolResult {
+        let value = match call.path.as_str() {
+            "sequence.first" => json!(7),
+            "sequence.second" => json!(call.arguments["value"].as_i64().unwrap_or_default() * 2),
+            _ => Value::Null,
+        };
+        ToolResult::Success { value }
+    }
+}
+
+#[tokio::test]
+async fn sequential_calls_can_depend_on_prior_results() {
+    let _guard = test_guard().await;
+    let output = manager()
+        .execute(
+            request(
+                "const first = await tools.sequence.first(); return await tools.sequence.second({ value: first });",
+            ),
+            Arc::new(DependencyDispatcher),
+            ExecutionCancellation::default(),
+        )
+        .await
+        .expect("execution should succeed");
+    assert_eq!(output.result, 14);
+    assert_eq!(
+        output
+            .tool_calls
+            .iter()
+            .map(|call| call.call_id)
+            .collect::<Vec<_>>(),
+        vec![1, 2]
+    );
+}
+
+struct ConcurrentDispatcher {
+    barrier: Barrier,
+    active: AtomicUsize,
+    peak: AtomicUsize,
+    releases: Mutex<HashMap<String, u64>>,
+}
+
+#[async_trait]
+impl HostToolDispatcher for ConcurrentDispatcher {
+    async fn dispatch(&self, call: ToolCall, _: ExecutionCancellation) -> ToolResult {
+        let active = self.active.fetch_add(1, Ordering::SeqCst) + 1;
+        self.peak.fetch_max(active, Ordering::SeqCst);
+        self.barrier.wait().await;
+        let delay = self.releases.lock().await[&call.path];
+        tokio::time::sleep(Duration::from_millis(delay)).await;
+        self.active.fetch_sub(1, Ordering::SeqCst);
+        ToolResult::Success {
+            value: json!(call.path),
+        }
+    }
+}
+
+#[tokio::test]
+async fn promise_all_overlaps_and_preserves_input_order() {
+    let _guard = test_guard().await;
+    let dispatcher = Arc::new(ConcurrentDispatcher {
+        barrier: Barrier::new(2),
+        active: AtomicUsize::new(0),
+        peak: AtomicUsize::new(0),
+        releases: Mutex::new(HashMap::from([
+            ("parallel.slow".into(), 50),
+            ("parallel.fast".into(), 0),
+        ])),
+    });
+    let output = manager()
+        .execute(
+            request("return await Promise.all([tools.parallel.slow(), tools.parallel.fast()]);"),
+            dispatcher.clone(),
+            ExecutionCancellation::default(),
+        )
+        .await
+        .expect("execution should succeed");
+    assert_eq!(dispatcher.peak.load(Ordering::SeqCst), 2);
+    assert_eq!(output.result, json!(["parallel.slow", "parallel.fast"]));
+}
+
+#[tokio::test]
+async fn unawaited_started_calls_settle_before_completion() {
+    let _guard = test_guard().await;
+    let output = manager()
+        .execute(
+            request(
+                "tools.background.started({ value: 1 }); await Promise.resolve(); return 'done';",
+            ),
+            Arc::new(EchoDispatcher),
+            ExecutionCancellation::default(),
+        )
+        .await
+        .expect("started call should settle before completion");
+    assert_eq!(output.result, "done");
+    assert_eq!(output.tool_calls.len(), 1);
+    assert_eq!(output.tool_calls[0].path, "background.started");
+}
+
+#[tokio::test]
+async fn expected_tool_failures_are_values_not_rejections() {
+    let _guard = test_guard().await;
+    struct FailureDispatcher;
+    #[async_trait]
+    impl HostToolDispatcher for FailureDispatcher {
+        async fn dispatch(&self, _: ToolCall, _: ExecutionCancellation) -> ToolResult {
+            ToolResult::Failure {
+                code: "upstream_denied".into(),
+                message: "denied".into(),
+            }
+        }
+    }
+    let output = manager()
+        .execute(
+            request("return await tools.example.fail();"),
+            Arc::new(FailureDispatcher),
+            ExecutionCancellation::default(),
+        )
+        .await
+        .expect("expected failure should remain a value");
+    assert_eq!(output.result["error"]["code"], "upstream_denied");
+}
+
+#[tokio::test]
+async fn cpu_loops_and_unresolved_promises_time_out_without_poisoning_next_execution() {
+    let _guard = test_guard().await;
+    let mut timed = request("while (true) {};");
+    timed.timeout = Duration::from_millis(150);
+    assert_eq!(
+        manager()
+            .execute(
+                timed,
+                Arc::new(EchoDispatcher),
+                ExecutionCancellation::default()
+            )
+            .await
+            .expect_err("loop must time out")
+            .code,
+        "execution_timeout"
+    );
+
+    let output = manager()
+        .execute(
+            request("return 42;"),
+            Arc::new(EchoDispatcher),
+            ExecutionCancellation::default(),
+        )
+        .await
+        .expect("next worker must be isolated");
+    assert_eq!(output.result, 42);
+
+    let mut unresolved = request("return await new Promise(() => {});");
+    unresolved.timeout = Duration::from_millis(100);
+    assert_eq!(
+        manager()
+            .execute(
+                unresolved,
+                Arc::new(EchoDispatcher),
+                ExecutionCancellation::default()
+            )
+            .await
+            .expect_err("unresolved promise must time out")
+            .code,
+        "execution_timeout"
+    );
+}
+
+#[tokio::test]
+async fn cancellation_terminates_pending_dispatch() {
+    let _guard = test_guard().await;
+    struct PendingDispatcher;
+    #[async_trait]
+    impl HostToolDispatcher for PendingDispatcher {
+        async fn dispatch(&self, _: ToolCall, cancellation: ExecutionCancellation) -> ToolResult {
+            cancellation.cancelled().await;
+            ToolResult::Failure {
+                code: "cancelled".into(),
+                message: "cancelled".into(),
+            }
+        }
+    }
+    let cancellation = ExecutionCancellation::default();
+    let cancel_from_task = cancellation.clone();
+    tokio::spawn(async move {
+        tokio::time::sleep(Duration::from_millis(50)).await;
+        cancel_from_task.cancel();
+    });
+    let failure = manager()
+        .execute(
+            request("return await tools.wait.forever();"),
+            Arc::new(PendingDispatcher),
+            cancellation,
+        )
+        .await
+        .expect_err("execution must cancel");
+    assert_eq!(failure.code, "execution_cancelled");
+}
+
+#[tokio::test]
+async fn dispatcher_failure_stops_execution_without_waiting_for_wall_timeout() {
+    let _guard = test_guard().await;
+    struct PanicDispatcher;
+    #[async_trait]
+    impl HostToolDispatcher for PanicDispatcher {
+        async fn dispatch(&self, _: ToolCall, _: ExecutionCancellation) -> ToolResult {
+            panic!("intentional dispatcher failure")
+        }
+    }
+    let started = std::time::Instant::now();
+    let failure = manager()
+        .execute(
+            request("return await tools.failure.panic();"),
+            Arc::new(PanicDispatcher),
+            ExecutionCancellation::default(),
+        )
+        .await
+        .expect_err("dispatcher panic should fail the execution");
+    assert_eq!(failure.code, "tool_bridge_failed");
+    assert!(started.elapsed() < Duration::from_secs(2));
+}
+
+#[tokio::test]
+async fn unavailable_host_globals_stay_unavailable() {
+    let _guard = test_guard().await;
+    let output = manager()
+        .execute(
+            request(
+                "return [typeof fetch, typeof process, typeof require, typeof Deno, typeof Bun];",
+            ),
+            Arc::new(EchoDispatcher),
+            ExecutionCancellation::default(),
+        )
+        .await
+        .expect("execution should succeed");
+    assert_eq!(
+        output.result,
+        json!([
+            "undefined",
+            "undefined",
+            "undefined",
+            "undefined",
+            "undefined"
+        ])
+    );
+}
+
+#[tokio::test]
+async fn stack_memory_and_output_limits_fail_inside_one_worker() {
+    let _guard = test_guard().await;
+    for (code, forbidden_failure) in [
+        (
+            "function recurse() { return recurse(); }",
+            "execution_timeout",
+        ),
+        (
+            "const values = []; while (true) { values.push('x'.repeat(1024 * 1024)); }",
+            "execution_timeout",
+        ),
+        ("return 'x'.repeat(9 * 1024 * 1024);", "execution_timeout"),
+    ] {
+        let mut bounded = request(code);
+        bounded.timeout = Duration::from_secs(2);
+        let failure = manager()
+            .execute(
+                bounded,
+                Arc::new(EchoDispatcher),
+                ExecutionCancellation::default(),
+            )
+            .await
+            .expect_err("hostile execution must fail");
+        assert_ne!(
+            failure.code, forbidden_failure,
+            "engine limit must fire: {code}"
+        );
+    }
+}
+
+#[tokio::test]
+async fn console_emit_and_call_caps_are_enforced() {
+    let _guard = test_guard().await;
+    let output = manager()
+        .execute(
+            request("for (let i = 0; i < 1100; i++) console.log(i); return true;"),
+            Arc::new(EchoDispatcher),
+            ExecutionCancellation::default(),
+        )
+        .await
+        .expect("console capture should truncate safely");
+    assert_eq!(output.console.len(), 1000);
+
+    let unicode = manager()
+        .execute(
+            request("console.log('😀'.repeat(70000)); return true;"),
+            Arc::new(EchoDispatcher),
+            ExecutionCancellation::default(),
+        )
+        .await
+        .expect("oversized unicode console entry should truncate safely");
+    assert!(unicode.console.is_empty());
+
+    let emit_failure = manager()
+        .execute(
+            request("for (let i = 0; i < 101; i++) emit(i); return true;"),
+            Arc::new(EchoDispatcher),
+            ExecutionCancellation::default(),
+        )
+        .await
+        .expect_err("emit cap must fail");
+    assert_eq!(emit_failure.code, "execution_failed");
+
+    let unicode_emit_failure = manager()
+        .execute(
+            request("emit('😀'.repeat(2100000)); return true;"),
+            Arc::new(EchoDispatcher),
+            ExecutionCancellation::default(),
+        )
+        .await
+        .expect_err("UTF-8 emit cap must fail");
+    assert_eq!(unicode_emit_failure.code, "execution_failed");
+
+    let call_failure = manager()
+        .execute(
+            request("return await Promise.all(Array.from({length: 129}, (_, i) => tools.cap.call({i})));"),
+            Arc::new(EchoDispatcher),
+            ExecutionCancellation::default(),
+        )
+        .await
+        .expect_err("call cap must fail");
+    assert_eq!(call_failure.code, "tool_call_limit_exceeded");
+}
+
+#[tokio::test]
+async fn proxy_ignores_symbols_and_hostile_json_does_not_mutate_prototypes() {
+    let _guard = test_guard().await;
+    let output = manager()
+        .execute(
+            request(
+                "const result = await tools.prototype.check(JSON.parse('{\"__proto__\":{\"polluted\":true}}')); return { symbol: tools[Symbol.iterator] === undefined, polluted: ({}).polluted ?? null, result };",
+            ),
+            Arc::new(EchoDispatcher),
+            ExecutionCancellation::default(),
+        )
+        .await
+        .expect("hostile JSON should remain data");
+    assert_eq!(output.result["symbol"], true);
+    assert_eq!(output.result["polluted"], Value::Null);
+    assert_eq!(
+        output.result["result"]["arguments"]["__proto__"]["polluted"],
+        true
+    );
+}
+
+#[tokio::test]
+async fn parallel_executions_have_fresh_globals() {
+    let _guard = test_guard().await;
+    let manager = manager();
+    let first = manager.execute(
+        request("globalThis.secret = 99; return secret;"),
+        Arc::new(EchoDispatcher),
+        ExecutionCancellation::default(),
+    );
+    let second = manager.execute(
+        request("return typeof secret;"),
+        Arc::new(EchoDispatcher),
+        ExecutionCancellation::default(),
+    );
+    let (first, second) = tokio::join!(first, second);
+    assert_eq!(first.expect("first execution should succeed").result, 99);
+    assert_eq!(
+        second.expect("second execution should succeed").result,
+        "undefined"
+    );
+}
+
+#[tokio::test]
+async fn worker_crash_isolated_from_following_execution() {
+    let _guard = test_guard().await;
+    let failure = RuntimeManager::new("/bin/true")
+        .execute(
+            request("return 1;"),
+            Arc::new(EchoDispatcher),
+            ExecutionCancellation::default(),
+        )
+        .await
+        .expect_err("exited worker must fail");
+    assert!(failure.internal);
+
+    let output = manager()
+        .execute(
+            request("return 2;"),
+            Arc::new(EchoDispatcher),
+            ExecutionCancellation::default(),
+        )
+        .await
+        .expect("next worker must remain healthy");
+    assert_eq!(output.result, 2);
+}
+
+#[tokio::test]
+async fn dropping_waiters_cleans_workers_before_releasing_slots() {
+    let _guard = test_guard().await;
+    let mut waiters = Vec::new();
+    for _ in 0..8 {
+        waiters.push(tokio::spawn(async move {
+            manager()
+                .execute(
+                    request("while (true) {}"),
+                    Arc::new(EchoDispatcher),
+                    ExecutionCancellation::default(),
+                )
+                .await
+        }));
+    }
+    tokio::time::sleep(Duration::from_millis(50)).await;
+    let busy = manager()
+        .execute(
+            request("return 'no slot';"),
+            Arc::new(EchoDispatcher),
+            ExecutionCancellation::default(),
+        )
+        .await
+        .expect_err("ninth worker must fail without queueing");
+    assert_eq!(busy.code, "runtime_busy");
+    for waiter in waiters {
+        waiter.abort();
+    }
+    tokio::time::sleep(Duration::from_millis(100)).await;
+
+    let output = tokio::time::timeout(
+        Duration::from_secs(2),
+        manager().execute(
+            request("return 'reaped';"),
+            Arc::new(EchoDispatcher),
+            ExecutionCancellation::default(),
+        ),
+    )
+    .await
+    .expect("worker slot should be released")
+    .expect("replacement execution should succeed");
+    assert_eq!(output.result, "reaped");
+}
diff --git a/tests/runtime_invocation.rs b/tests/runtime_invocation.rs
new file mode 100644
index 000000000..066782cdf
--- /dev/null
+++ b/tests/runtime_invocation.rs
@@ -0,0 +1,1383 @@
+use std::{
+    collections::BTreeMap,
+    sync::{
+        Arc,
+        atomic::{AtomicBool, Ordering},
+    },
+    time::Duration,
+};
+
+use axum::{
+    Json, Router,
+    body::Body,
+    extract::{OriginalUri, State},
+    http::{Method, Request, StatusCode, header},
+};
+use executor::{
+    AppConfig, ExecutorApp,
+    actor::ToolActor,
+    approval::{ApprovalDecision, ApprovalListQuery, ApprovalStatus},
+    catalog::{
+        ArtifactKind, AuditContext, CreateSource, CredentialPayload, InitialCatalogSnapshot,
+        RequestSurface, SourceKind, StagedArtifact, StagedTool, StagedToolBinding, ToolBinding,
+        ToolMode,
+    },
+    invocation::{ToolCall, ToolCallSubmission},
+    openapi::{OpenApiBinding, OpenApiSecurityAlternative},
+    runtime::{
+        ExecutionCancellation, ExecutionRequest, HostToolDispatcher, InvocationContext,
+        InvocationToolDispatcher, RuntimeManager, ToolCall as RuntimeToolCall,
+        ToolResult as RuntimeToolResult,
+    },
+};
+use http_body_util::BodyExt;
+use serde_json::{Map, Value, json};
+use tokio::{net::TcpListener, sync::Notify};
+use tower::ServiceExt;
+
+#[derive(Clone, Default)]
+struct UpstreamState {
+    block_ask: Arc<AtomicBool>,
+    entered: Arc<Notify>,
+    release: Arc<Notify>,
+}
+
+async fn upstream(
+    State(state): State<UpstreamState>,
+    OriginalUri(uri): OriginalUri,
+) -> Json<Value> {
+    if state.block_ask.load(Ordering::Acquire) {
+        state.entered.notify_one();
+        state.release.notified().await;
+    }
+    Json(json!({ "path": uri.path() }))
+}
+
+async fn api_request(
+    router: Router,
+    method: Method,
+    uri: &str,
+    body: String,
+    headers: &[(&str, &str)],
+) -> axum::response::Response {
+    let mut request = Request::builder()
+        .method(method)
+        .uri(uri)
+        .header(header::CONTENT_TYPE, "application/json");
+    for (name, value) in headers {
+        request = request.header(*name, *value);
+    }
+    router
+        .oneshot(
+            request
+                .body(Body::from(body))
+                .expect("request should build"),
+        )
+        .await
+        .expect("router should answer")
+}
+
+async fn api_body(response: axum::response::Response) -> Value {
+    let bytes = response
+        .into_body()
+        .collect()
+        .await
+        .expect("response should collect")
+        .to_bytes();
+    serde_json::from_slice(&bytes).expect("response should contain JSON")
+}
+
+fn response_cookies(response: &axum::response::Response) -> String {
+    response
+        .headers()
+        .get_all(header::SET_COOKIE)
+        .iter()
+        .map(|value| {
+            value
+                .to_str()
+                .expect("cookie should be text")
+                .split(';')
+                .next()
+                .expect("cookie should contain a value")
+        })
+        .collect::<Vec<_>>()
+        .join("; ")
+}
+
+async fn fixture() -> (
+    tempfile::TempDir,
+    ExecutorApp,
+    UpstreamState,
+    tokio::task::JoinHandle<()>,
+) {
+    let listener = TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("upstream should bind");
+    let address = listener.local_addr().expect("upstream address should read");
+    let upstream_state = UpstreamState::default();
+    let server_state = upstream_state.clone();
+    let upstream_task = tokio::spawn(async move {
+        axum::serve(
+            listener,
+            Router::new().fallback(upstream).with_state(server_state),
+        )
+        .await
+        .expect("upstream should serve");
+    });
+    let directory = tempfile::tempdir().expect("temporary directory should be created");
+    let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+        .await
+        .expect("Executor should open");
+    sqlx::query(
+        "INSERT INTO api_tokens (id, name, token_digest, token_prefix, token_suffix, created_at) \
+         VALUES ('runtime-owner', 'Runtime owner', x'010203', 'exr_test', 'test', 1)",
+    )
+    .execute(app.pool())
+    .await
+    .expect("owner token should insert");
+    sqlx::query(
+        "INSERT INTO admins (id, username, password_hash, created_at) \
+         VALUES (1, 'admin', 'unused', 1)",
+    )
+    .execute(app.pool())
+    .await
+    .expect("admin should insert");
+
+    let definitions = [
+        ("enabled", ToolMode::Enabled),
+        ("first", ToolMode::Ask),
+        ("second", ToolMode::Ask),
+        ("third", ToolMode::Ask),
+        ("deny", ToolMode::Ask),
+        ("cancel", ToolMode::Ask),
+        ("revoke", ToolMode::Ask),
+    ];
+    let tools = definitions
+        .iter()
+        .map(|(name, mode)| StagedTool {
+            stable_key: (*name).to_owned(),
+            preferred_name: (*name).to_owned(),
+            display_name: (*name).to_owned(),
+            description: None,
+            input_schema: json!({
+                "type": "object",
+                "additionalProperties": false
+            }),
+            output_schema: None,
+            input_typescript: None,
+            output_typescript: None,
+            typescript_definitions: BTreeMap::new(),
+            intrinsic_mode: *mode,
+        })
+        .collect();
+    let bindings = definitions
+        .iter()
+        .map(|(name, _)| StagedToolBinding {
+            stable_key: (*name).to_owned(),
+            binding: ToolBinding::OpenapiV1(OpenApiBinding {
+                version: 1,
+                method: "GET".to_owned(),
+                path_template: format!("/{name}"),
+                server_url: format!("http://{address}"),
+                parameters: Vec::new(),
+                request_body: None,
+                security: vec![OpenApiSecurityAlternative {
+                    requirements: Vec::new(),
+                }],
+            }),
+        })
+        .collect();
+    app.catalog()
+        .create_source_with_catalog(
+            CreateSource {
+                kind: SourceKind::Openapi,
+                preferred_slug: "runtime".to_owned(),
+                display_name: "Runtime".to_owned(),
+                description: None,
+                configuration: Map::from_iter([
+                    ("spec".to_owned(), json!({ "type": "inline" })),
+                    ("allowPrivateNetwork".to_owned(), Value::Bool(true)),
+                ]),
+            },
+            &CredentialPayload {
+                schema_version: 1,
+                payload: json!({
+                    "locator": { "type": "inline" },
+                    "credentials": { "schemes": {} }
+                }),
+            },
+            InitialCatalogSnapshot {
+                artifacts: vec![StagedArtifact {
+                    kind: ArtifactKind::OpenapiDocument,
+                    stable_key: "document".to_owned(),
+                    content: json!({ "openapi": "3.1.0" }),
+                }],
+                tools,
+            },
+            bindings,
+            AuditContext::system(Some("runtime-invocation-test")),
+        )
+        .await
+        .expect("runtime fixture should import");
+    (directory, app, upstream_state, upstream_task)
+}
+
+fn execution(
+    app: &ExecutorApp,
+    execution_id: &str,
+) -> (RuntimeManager, Arc<InvocationToolDispatcher>) {
+    let dispatcher = Arc::new(InvocationToolDispatcher::new(
+        app.tool_calls().clone(),
+        InvocationContext {
+            request_id: uuid::Uuid::new_v4().to_string(),
+            actor: ToolActor::api_token("runtime-owner", Some("Runtime owner".to_owned())),
+            surface: RequestSurface::Gateway,
+            execution_id: execution_id.to_owned(),
+        },
+    ));
+    (
+        RuntimeManager::new(env!("CARGO_BIN_EXE_executor")),
+        dispatcher,
+    )
+}
+
+async fn pending(
+    app: &ExecutorApp,
+    execution_id: &str,
+    count: usize,
+) -> Vec<executor::approval::ApprovalRecord> {
+    tokio::time::timeout(Duration::from_secs(3), async {
+        loop {
+            let approvals = app
+                .tool_calls()
+                .approvals()
+                .list_admin(ApprovalListQuery {
+                    limit: 100,
+                    status: Some(ApprovalStatus::Pending),
+                    ..Default::default()
+                })
+                .await
+                .expect("approvals should list")
+                .items
+                .into_iter()
+                .filter(|approval| approval.execution_id == execution_id)
+                .collect::<Vec<_>>();
+            if approvals.len() == count {
+                break approvals;
+            }
+            tokio::task::yield_now().await;
+        }
+    })
+    .await
+    .expect("pending approvals should appear")
+}
+
+#[tokio::test]
+async fn real_worker_dispatches_enabled_openapi_and_builtin_discovery() {
+    let (_directory, app, _upstream_state, upstream_task) = fixture().await;
+    let execution_id = "runtime-enabled";
+    let (manager, dispatcher) = execution(&app, execution_id);
+    let output = manager
+        .execute(
+            ExecutionRequest {
+                execution_id: execution_id.to_owned(),
+                code: "const found = await tools.search({query: 'enabled'}); const described = await tools.describe({path: 'runtime.enabled'}); const sources = await tools.sources(); const result = await tools.runtime.enabled(); return {found: found.total, described: described.path, sources: sources.length, result};".to_owned(),
+                timeout: Duration::from_secs(5),
+            },
+            dispatcher.clone(),
+            ExecutionCancellation::default(),
+        )
+        .await
+        .expect("enabled execution should succeed");
+    dispatcher.finish().await;
+    assert_eq!(output.result["described"], "runtime.enabled");
+    assert_eq!(output.result["sources"], 1);
+    assert_eq!(output.result["result"]["path"], "/enabled");
+    assert!(
+        output.result["found"]
+            .as_u64()
+            .is_some_and(|count| count >= 1)
+    );
+    upstream_task.abort();
+}
+
+#[tokio::test]
+async fn concurrent_ask_calls_settle_independently_in_javascript_order() {
+    let (_directory, app, _upstream_state, upstream_task) = fixture().await;
+    let execution_id = "runtime-concurrent-ask";
+    let (manager, dispatcher) = execution(&app, execution_id);
+    let runtime_dispatcher = dispatcher.clone();
+    let execution = tokio::spawn(async move {
+        manager
+            .execute(
+                ExecutionRequest {
+                    execution_id: execution_id.to_owned(),
+                    code: "return await Promise.all([tools.runtime.first(), tools.runtime.second(), tools.runtime.third()]);"
+                        .to_owned(),
+                    timeout: Duration::from_secs(5),
+                },
+                runtime_dispatcher,
+                ExecutionCancellation::default(),
+            )
+            .await
+    });
+    let approvals = pending(&app, execution_id, 3).await;
+    let first = approvals
+        .iter()
+        .find(|approval| approval.callable_path_snapshot.ends_with(".first"))
+        .expect("first approval should exist");
+    let second = approvals
+        .iter()
+        .find(|approval| approval.callable_path_snapshot.ends_with(".second"))
+        .expect("second approval should exist");
+    let third = approvals
+        .iter()
+        .find(|approval| approval.callable_path_snapshot.ends_with(".third"))
+        .expect("third approval should exist");
+    assert!(first.worker_generation > 0 && first.worker_generation <= i64::MAX as u64);
+    assert_eq!(first.worker_generation, second.worker_generation);
+    app.tool_calls()
+        .decide(
+            &second.id,
+            "approve-second",
+            second.revision,
+            ApprovalDecision::Approve,
+            1,
+        )
+        .await
+        .expect("second approval should succeed");
+    app.tool_calls()
+        .decide(
+            &third.id,
+            "deny-third",
+            third.revision,
+            ApprovalDecision::Deny,
+            1,
+        )
+        .await
+        .expect("third denial should succeed");
+    app.tool_calls()
+        .decide(
+            &first.id,
+            "approve-first",
+            first.revision,
+            ApprovalDecision::Approve,
+            1,
+        )
+        .await
+        .expect("first approval should succeed");
+    let output = execution
+        .await
+        .expect("execution task should not panic")
+        .expect("approved execution should succeed");
+    dispatcher.finish().await;
+    assert_eq!(output.result[0]["path"], "/first", "{}", output.result);
+    assert_eq!(output.result[1]["path"], "/second");
+    assert_eq!(output.result[2]["error"]["code"], "approval_denied");
+    tokio::time::timeout(Duration::from_secs(2), async {
+        loop {
+            let distinct = sqlx::query_scalar::<_, i64>(
+                "SELECT COUNT(DISTINCT request_id) FROM request_logs \
+                 WHERE approval_id IN (?, ?, ?)",
+            )
+            .bind(&first.id)
+            .bind(&second.id)
+            .bind(&third.id)
+            .fetch_one(app.pool())
+            .await
+            .expect("request logs should read");
+            if distinct >= 3 {
+                break;
+            }
+            tokio::task::yield_now().await;
+        }
+    })
+    .await
+    .expect("concurrent calls should have distinct request IDs");
+    upstream_task.abort();
+}
+
+#[tokio::test]
+async fn catalog_revision_change_marks_waiting_approval_stale() {
+    let (_directory, app, _upstream_state, upstream_task) = fixture().await;
+    let execution_id = "runtime-stale";
+    let (manager, dispatcher) = execution(&app, execution_id);
+    let runtime_dispatcher = dispatcher.clone();
+    let execution = tokio::spawn(async move {
+        manager
+            .execute(
+                ExecutionRequest {
+                    execution_id: execution_id.to_owned(),
+                    code: "return await tools.runtime.first();".to_owned(),
+                    timeout: Duration::from_secs(5),
+                },
+                runtime_dispatcher,
+                ExecutionCancellation::default(),
+            )
+            .await
+    });
+    let approval = pending(&app, execution_id, 1).await.remove(0);
+    let tool = app
+        .catalog()
+        .list_tools(Default::default())
+        .await
+        .expect("tools should list")
+        .items
+        .into_iter()
+        .find(|tool| tool.local_name == "first")
+        .expect("Ask tool should exist");
+    app.catalog()
+        .set_tool_mode(
+            &tool.id,
+            Some(ToolMode::Enabled),
+            tool.revision,
+            AuditContext::system(Some("runtime-stale-test")),
+        )
+        .await
+        .expect("tool revision should change");
+    app.tool_calls()
+        .decide(
+            &approval.id,
+            "approve-stale",
+            approval.revision,
+            ApprovalDecision::Approve,
+            1,
+        )
+        .await
+        .expect("approval decision should persist");
+    let output = execution
+        .await
+        .expect("execution task should not panic")
+        .expect("stale approval should settle as a value");
+    assert_eq!(output.result["error"]["code"], "approval_stale");
+    dispatcher.finish().await;
+    upstream_task.abort();
+}
+
+#[tokio::test]
+async fn dropped_runtime_waiter_still_cancels_pending_approval() {
+    let (_directory, app, _upstream_state, upstream_task) = fixture().await;
+    let execution_id = "runtime-dropped-waiter";
+    let (manager, dispatcher) = execution(&app, execution_id);
+    let execution = tokio::spawn(async move {
+        manager
+            .execute(
+                ExecutionRequest {
+                    execution_id: execution_id.to_owned(),
+                    code: "return await tools.runtime.cancel();".to_owned(),
+                    timeout: Duration::from_secs(5),
+                },
+                dispatcher,
+                ExecutionCancellation::default(),
+            )
+            .await
+    });
+    let approval = pending(&app, execution_id, 1).await.remove(0);
+    let held_delivery = app
+        .tool_calls()
+        .submit(ToolCall {
+            request_id: "held-dropped-waiter-delivery".to_owned(),
+            actor: ToolActor::api_token("runtime-owner", Some("Runtime owner".to_owned())),
+            surface: RequestSurface::Gateway,
+            execution_id: execution_id.to_owned(),
+            call_id: "1".to_owned(),
+            worker_generation: approval.worker_generation,
+            path: "runtime.cancel".to_owned(),
+            arguments: json!({}),
+        })
+        .await
+        .expect("the correlated delivery should be reusable");
+    let ToolCallSubmission::ApprovalRequired(held_delivery) = held_delivery else {
+        panic!("the correlated delivery should remain pending");
+    };
+    assert_eq!(held_delivery.id, approval.id);
+    let pin_refs = sqlx::query_scalar::<_, i64>(
+        "SELECT ref_count FROM approval_delivery_pins WHERE approval_id = ?",
+    )
+    .bind(&approval.id)
+    .fetch_one(app.pool())
+    .await
+    .expect("both pending deliveries should be pinned");
+    assert_eq!(pin_refs, 2);
+    execution.abort();
+    assert!(
+        execution
+            .await
+            .expect_err("request waiter should be aborted")
+            .is_cancelled()
+    );
+    tokio::time::timeout(Duration::from_secs(3), async {
+        loop {
+            let detail = app
+                .tool_calls()
+                .approvals()
+                .get_admin(&approval.id)
+                .await
+                .expect("approval should read")
+                .expect("approval should remain stored");
+            if detail.record.status == ApprovalStatus::Canceled {
+                assert_eq!(detail.record.revision, 1);
+                break;
+            }
+            tokio::task::yield_now().await;
+        }
+    })
+    .await
+    .expect("detached actor should complete approval cleanup");
+    let pins = sqlx::query_scalar::<_, i64>(
+        "SELECT COUNT(*) FROM approval_delivery_pins WHERE approval_id = ?",
+    )
+    .bind(&approval.id)
+    .fetch_one(app.pool())
+    .await
+    .expect("dropped waiter delivery pin should read");
+    assert_eq!(
+        pins, 0,
+        "lost-execution cancellation must release pins atomically while another ticket is alive"
+    );
+    tokio::time::timeout(Duration::from_secs(2), async {
+        loop {
+            let logged = sqlx::query_scalar::<_, i64>(
+                "SELECT EXISTS(SELECT 1 FROM request_logs \
+                 WHERE approval_id = ? AND error_code = 'approval_canceled')",
+            )
+            .bind(&approval.id)
+            .fetch_one(app.pool())
+            .await
+            .expect("canceled approval log should read");
+            if logged != 0 {
+                break;
+            }
+            tokio::task::yield_now().await;
+        }
+    })
+    .await
+    .expect("dropped waiter cancellation should remain durably logged");
+    drop(held_delivery);
+    upstream_task.abort();
+    let _ = upstream_task.await;
+    app.begin_shutdown();
+    drop(app);
+}
+
+#[tokio::test]
+async fn cancellation_during_blocked_submission_leaves_no_delivery_pin() {
+    let (_directory, app, _upstream_state, upstream_task) = fixture().await;
+    let execution_id = "runtime-cancel-during-submit";
+    let (_manager, dispatcher) = execution(&app, execution_id);
+    let writer = app
+        .pool()
+        .begin_with("BEGIN IMMEDIATE")
+        .await
+        .expect("submission blocker should acquire the SQLite writer");
+    let cancellation = ExecutionCancellation::default();
+    let dispatch_cancellation = cancellation.clone();
+    let dispatch = tokio::spawn({
+        let dispatcher = dispatcher.clone();
+        async move {
+            dispatcher
+                .dispatch(
+                    RuntimeToolCall {
+                        execution_id: execution_id.to_owned(),
+                        worker_generation: 11,
+                        call_id: 1,
+                        path: "runtime.cancel".to_owned(),
+                        arguments: json!({}),
+                    },
+                    dispatch_cancellation,
+                )
+                .await
+        }
+    });
+    for _ in 0..16 {
+        tokio::task::yield_now().await;
+    }
+    tokio::time::sleep(Duration::from_millis(100)).await;
+    cancellation.cancel();
+    writer
+        .commit()
+        .await
+        .expect("submission blocker should release the SQLite writer");
+
+    let result = tokio::time::timeout(Duration::from_secs(2), dispatch)
+        .await
+        .expect("canceled submission should finish")
+        .expect("dispatch task should join");
+    assert!(matches!(
+        result,
+        RuntimeToolResult::InternalFailure { ref code } if code == "execution_cancelled"
+    ));
+    tokio::time::timeout(Duration::from_secs(2), async {
+        loop {
+            let (approvals, pins) = sqlx::query_as::<_, (i64, i64)>(
+                "SELECT \
+                 (SELECT COUNT(*) FROM approvals WHERE execution_id = ?), \
+                 (SELECT COUNT(*) FROM approval_delivery_pins)",
+            )
+            .bind(execution_id)
+            .fetch_one(app.pool())
+            .await
+            .expect("canceled submission state should read");
+            if approvals == 1 && pins == 0 {
+                break;
+            }
+            tokio::task::yield_now().await;
+        }
+    })
+    .await
+    .expect("canceled submission ticket should release its delivery pin");
+    dispatcher.finish().await;
+    upstream_task.abort();
+}
+
+#[tokio::test]
+async fn cancellation_and_approval_claim_have_one_linearized_winner() {
+    let (_directory, app, upstream_state, upstream_task) = fixture().await;
+
+    let canceled_execution_id = "runtime-cancel-wins";
+    let (manager, dispatcher) = execution(&app, canceled_execution_id);
+    let cancellation = ExecutionCancellation::default();
+    let runtime_cancellation = cancellation.clone();
+    let runtime_dispatcher = dispatcher.clone();
+    let canceled_execution = tokio::spawn(async move {
+        manager
+            .execute(
+                ExecutionRequest {
+                    execution_id: canceled_execution_id.to_owned(),
+                    code: "return await tools.runtime.first();".to_owned(),
+                    timeout: Duration::from_secs(5),
+                },
+                runtime_dispatcher,
+                runtime_cancellation,
+            )
+            .await
+    });
+    let canceled_approval = pending(&app, canceled_execution_id, 1).await.remove(0);
+    sqlx::query(
+        "CREATE TRIGGER reject_cancel_winner_cleanup BEFORE UPDATE OF status ON approvals \
+         WHEN OLD.execution_id = 'runtime-cancel-wins' AND NEW.status = 'canceled' BEGIN \
+         SELECT RAISE(FAIL, 'hold cancellation cleanup'); END",
+    )
+    .execute(app.pool())
+    .await
+    .expect("cancellation cleanup blocker should install");
+    cancellation.cancel();
+    let canceled_decision = app
+        .tool_calls()
+        .decide(
+            &canceled_approval.id,
+            "approval-must-lose",
+            canceled_approval.revision,
+            ApprovalDecision::Approve,
+            1,
+        )
+        .await;
+    assert!(canceled_decision.is_err());
+    sqlx::query("DROP TRIGGER reject_cancel_winner_cleanup")
+        .execute(app.pool())
+        .await
+        .expect("cancellation cleanup blocker should be removed");
+    let canceled = canceled_execution
+        .await
+        .expect("canceled execution task should not panic")
+        .expect_err("cancellation winner should stop the runtime");
+    assert_eq!(canceled.code, "execution_cancelled");
+    dispatcher.finish().await;
+
+    upstream_state.block_ask.store(true, Ordering::Release);
+    let claimed_execution_id = "runtime-claim-wins";
+    let (manager, dispatcher) = execution(&app, claimed_execution_id);
+    let cancellation = ExecutionCancellation::default();
+    let runtime_cancellation = cancellation.clone();
+    let runtime_dispatcher = dispatcher.clone();
+    let claimed_execution = tokio::spawn(async move {
+        manager
+            .execute(
+                ExecutionRequest {
+                    execution_id: claimed_execution_id.to_owned(),
+                    code: "return await tools.runtime.second();".to_owned(),
+                    timeout: Duration::from_secs(5),
+                },
+                runtime_dispatcher,
+                runtime_cancellation,
+            )
+            .await
+    });
+    let claimed_approval = pending(&app, claimed_execution_id, 1).await.remove(0);
+    app.tool_calls()
+        .decide(
+            &claimed_approval.id,
+            "approval-must-win",
+            claimed_approval.revision,
+            ApprovalDecision::Approve,
+            1,
+        )
+        .await
+        .expect("approval should claim execution");
+    tokio::time::timeout(Duration::from_secs(2), upstream_state.entered.notified())
+        .await
+        .expect("approved request should reach upstream after claim");
+    cancellation.cancel();
+    upstream_state.release.notify_one();
+    let stopped = claimed_execution
+        .await
+        .expect("claimed execution task should not panic")
+        .expect_err("lost continuation should stop waiting for claimed work");
+    assert_eq!(stopped.code, "execution_cancelled");
+    tokio::time::timeout(Duration::from_secs(2), async {
+        loop {
+            let detail = app
+                .tool_calls()
+                .approvals()
+                .get_admin(&claimed_approval.id)
+                .await
+                .expect("claimed approval should read")
+                .expect("claimed approval should remain stored");
+            if detail.record.status == ApprovalStatus::Succeeded {
+                break;
+            }
+            tokio::task::yield_now().await;
+        }
+    })
+    .await
+    .expect("already executing approved work should finish truthfully");
+    dispatcher.finish().await;
+    upstream_task.abort();
+}
+
+#[tokio::test]
+async fn persistent_cleanup_failure_defers_safely_without_hanging_shutdown() {
+    let (_directory, app, _upstream_state, upstream_task) = fixture().await;
+    let execution_id = "runtime-persistent-cleanup-failure";
+    let (manager, dispatcher) = execution(&app, execution_id);
+    let cancellation = ExecutionCancellation::default();
+    let runtime_cancellation = cancellation.clone();
+    let execution = tokio::spawn(async move {
+        manager
+            .execute(
+                ExecutionRequest {
+                    execution_id: execution_id.to_owned(),
+                    code: "return await tools.runtime.cancel();".to_owned(),
+                    timeout: Duration::from_secs(5),
+                },
+                dispatcher,
+                runtime_cancellation,
+            )
+            .await
+    });
+    let approval = pending(&app, execution_id, 1).await.remove(0);
+    sqlx::query(
+        "CREATE TRIGGER reject_runtime_cleanup BEFORE UPDATE OF status ON approvals \
+         WHEN NEW.status = 'canceled' BEGIN \
+         SELECT RAISE(FAIL, 'forced persistent cleanup failure'); END",
+    )
+    .execute(app.pool())
+    .await
+    .expect("persistent cleanup failure trigger should install");
+    cancellation.cancel();
+    let failure = tokio::time::timeout(Duration::from_secs(2), execution)
+        .await
+        .expect("bounded cleanup should let the execution finish")
+        .expect("execution task should not panic")
+        .expect_err("canceled execution should fail");
+    assert_eq!(failure.code, "execution_cancelled");
+
+    let decision = app
+        .tool_calls()
+        .decide(
+            &approval.id,
+            "must-not-approve-lost-continuation",
+            approval.revision,
+            ApprovalDecision::Approve,
+            1,
+        )
+        .await;
+    assert!(
+        decision.is_err(),
+        "lost continuation must not become executable"
+    );
+    let stored = app
+        .tool_calls()
+        .approvals()
+        .get_admin(&approval.id)
+        .await
+        .expect("approval should remain readable")
+        .expect("approval should remain stored");
+    assert_eq!(stored.record.status, ApprovalStatus::Pending);
+
+    upstream_task.abort();
+    tokio::time::timeout(Duration::from_secs(2), app.shutdown())
+        .await
+        .expect("persistent cleanup failure must not hang shutdown");
+}
+
+#[tokio::test]
+async fn denial_revocation_cancellation_and_correlation_fail_closed() {
+    let (_directory, app, _upstream_state, upstream_task) = fixture().await;
+
+    let execution_id = "runtime-denied";
+    let (manager, dispatcher) = execution(&app, execution_id);
+    let runtime_dispatcher = dispatcher.clone();
+    let denied = tokio::spawn(async move {
+        manager
+            .execute(
+                ExecutionRequest {
+                    execution_id: execution_id.to_owned(),
+                    code: "return await tools.runtime.deny();".to_owned(),
+                    timeout: Duration::from_secs(5),
+                },
+                runtime_dispatcher,
+                ExecutionCancellation::default(),
+            )
+            .await
+    });
+    let approval = pending(&app, execution_id, 1).await.remove(0);
+    app.tool_calls()
+        .decide(
+            &approval.id,
+            "deny-runtime",
+            approval.revision,
+            ApprovalDecision::Deny,
+            1,
+        )
+        .await
+        .expect("denial should succeed");
+    let output = denied
+        .await
+        .expect("denied task should not panic")
+        .expect("denial should remain a tool value");
+    assert_eq!(output.result["error"]["code"], "approval_denied");
+    dispatcher.finish().await;
+
+    let correlation = Arc::new(InvocationToolDispatcher::new(
+        app.tool_calls().clone(),
+        InvocationContext {
+            request_id: "correlation-request".to_owned(),
+            actor: ToolActor::api_token("runtime-owner", None),
+            surface: RequestSurface::Gateway,
+            execution_id: "expected-execution".to_owned(),
+        },
+    ));
+    let result = correlation
+        .dispatch(
+            RuntimeToolCall {
+                execution_id: "wrong-execution".to_owned(),
+                worker_generation: 1,
+                call_id: 1,
+                path: "runtime.enabled".to_owned(),
+                arguments: json!({}),
+            },
+            ExecutionCancellation::default(),
+        )
+        .await;
+    assert!(matches!(
+        result,
+        RuntimeToolResult::InternalFailure { ref code } if code == "tool_correlation_failed"
+    ));
+    correlation.finish().await;
+
+    let execution_id = "runtime-canceled";
+    let (manager, dispatcher) = execution(&app, execution_id);
+    let cancellation = ExecutionCancellation::default();
+    let runtime_cancellation = cancellation.clone();
+    let runtime_dispatcher = dispatcher.clone();
+    let canceled = tokio::spawn(async move {
+        manager
+            .execute(
+                ExecutionRequest {
+                    execution_id: execution_id.to_owned(),
+                    code: "return await tools.runtime.cancel();".to_owned(),
+                    timeout: Duration::from_secs(5),
+                },
+                runtime_dispatcher,
+                runtime_cancellation,
+            )
+            .await
+    });
+    let approval = pending(&app, execution_id, 1).await.remove(0);
+    cancellation.cancel();
+    let failure = canceled
+        .await
+        .expect("canceled task should not panic")
+        .expect_err("canceled execution should fail");
+    assert_eq!(failure.code, "execution_cancelled");
+    dispatcher.finish().await;
+    let approval = app
+        .tool_calls()
+        .approvals()
+        .get_admin(&approval.id)
+        .await
+        .expect("approval should read")
+        .expect("approval should remain stored");
+    assert_eq!(approval.record.status, ApprovalStatus::Canceled);
+    assert_eq!(approval.record.revision, 1);
+
+    let execution_id = "runtime-revoked";
+    let (manager, dispatcher) = execution(&app, execution_id);
+    let runtime_dispatcher = dispatcher.clone();
+    let revoked = tokio::spawn(async move {
+        manager
+            .execute(
+                ExecutionRequest {
+                    execution_id: execution_id.to_owned(),
+                    code: "return await tools.runtime.revoke();".to_owned(),
+                    timeout: Duration::from_secs(5),
+                },
+                runtime_dispatcher,
+                ExecutionCancellation::default(),
+            )
+            .await
+    });
+    pending(&app, execution_id, 1).await;
+    assert!(
+        app.tool_calls()
+            .revoke_owner_token("runtime-owner")
+            .await
+            .expect("token revocation should succeed")
+    );
+    let output = revoked
+        .await
+        .expect("revoked task should not panic")
+        .expect("revocation should settle the tool promise");
+    assert_eq!(output.result["error"]["code"], "approval_canceled");
+    dispatcher.finish().await;
+    upstream_task.abort();
+}
+
+#[tokio::test]
+async fn execute_api_authenticates_before_body_and_enforces_source_and_time_limits() {
+    let listener = TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("API upstream should bind");
+    let upstream_address = listener.local_addr().expect("upstream address should read");
+    let upstream_task = tokio::spawn(async move {
+        axum::serve(
+            listener,
+            Router::new()
+                .fallback(upstream)
+                .with_state(UpstreamState::default()),
+        )
+        .await
+        .expect("API upstream should serve");
+    });
+    let directory = tempfile::tempdir().expect("temporary directory should be created");
+    let app = ExecutorApp::open(
+        AppConfig::new(directory.path().to_path_buf())
+            .with_runtime_executable(env!("CARGO_BIN_EXE_executor").into()),
+    )
+    .await
+    .expect("Executor should open");
+
+    let oversized = json!({ "code": "x".repeat(2 * 1024 * 1024) }).to_string();
+    let unauthenticated = api_request(
+        app.router(),
+        Method::POST,
+        "/api/v1/gateway/execute",
+        oversized,
+        &[],
+    )
+    .await;
+    assert_eq!(unauthenticated.status(), StatusCode::UNAUTHORIZED);
+
+    let setup = api_request(
+        app.router(),
+        Method::POST,
+        "/api/v1/setup",
+        json!({
+            "setupToken": app.setup_token().expect("setup token should exist"),
+            "username": "admin",
+            "password": "correct horse battery staple"
+        })
+        .to_string(),
+        &[(header::ORIGIN.as_str(), "http://127.0.0.1:4788")],
+    )
+    .await;
+    assert_eq!(setup.status(), StatusCode::CREATED);
+    let login = api_request(
+        app.router(),
+        Method::POST,
+        "/api/v1/session",
+        json!({
+            "username": "admin",
+            "password": "correct horse battery staple"
+        })
+        .to_string(),
+        &[(header::ORIGIN.as_str(), "http://127.0.0.1:4788")],
+    )
+    .await;
+    assert_eq!(login.status(), StatusCode::OK);
+    let cookies = response_cookies(&login);
+    let login_body = api_body(login).await;
+    let csrf = login_body["csrfToken"]
+        .as_str()
+        .expect("setup should return CSRF");
+    let token_response = api_request(
+        app.router(),
+        Method::POST,
+        "/api/v1/tokens",
+        json!({ "name": "Runtime API" }).to_string(),
+        &[
+            (header::COOKIE.as_str(), &cookies),
+            (header::ORIGIN.as_str(), "http://127.0.0.1:4788"),
+            ("x-executor-csrf", csrf),
+            ("idempotency-key", "runtime-api-token"),
+        ],
+    )
+    .await;
+    assert_eq!(token_response.status(), StatusCode::CREATED);
+    let token_body = api_body(token_response).await;
+    let token = token_body["token"]
+        .as_str()
+        .expect("token should be returned")
+        .to_owned();
+    let token_id = token_body["id"]
+        .as_str()
+        .expect("token ID should be returned")
+        .to_owned();
+    let authorization = format!("Bearer {token}");
+
+    let cookie_only = api_request(
+        app.router(),
+        Method::POST,
+        "/api/v1/gateway/execute",
+        json!({ "code": "return 1" }).to_string(),
+        &[(header::COOKIE.as_str(), &cookies)],
+    )
+    .await;
+    assert_eq!(cookie_only.status(), StatusCode::UNAUTHORIZED);
+
+    let invalid_timeout = api_request(
+        app.router(),
+        Method::POST,
+        "/api/v1/gateway/execute",
+        json!({ "code": "return 1", "timeoutMs": 300_001 }).to_string(),
+        &[(header::AUTHORIZATION.as_str(), &authorization)],
+    )
+    .await;
+    assert_eq!(invalid_timeout.status(), StatusCode::BAD_REQUEST);
+    assert_eq!(
+        api_body(invalid_timeout).await["error"]["code"],
+        "invalid_timeout"
+    );
+
+    let invalid_json = api_request(
+        app.router(),
+        Method::POST,
+        "/api/v1/gateway/execute",
+        "{".to_owned(),
+        &[(header::AUTHORIZATION.as_str(), &authorization)],
+    )
+    .await;
+    assert_eq!(invalid_json.status(), StatusCode::BAD_REQUEST);
+    let invalid_request_id = invalid_json
+        .headers()
+        .get("x-request-id")
+        .expect("invalid response should have a request ID")
+        .to_str()
+        .expect("request ID should be text")
+        .to_owned();
+    assert_eq!(
+        api_body(invalid_json).await["error"]["code"],
+        "invalid_json"
+    );
+    tokio::time::timeout(Duration::from_secs(2), async {
+        loop {
+            let recorded = sqlx::query_scalar::<_, i64>(
+                "SELECT EXISTS(SELECT 1 FROM request_logs WHERE request_id = ? \
+                 AND path_snapshot = 'executor.execute' AND error_code = 'invalid_json')",
+            )
+            .bind(&invalid_request_id)
+            .fetch_one(app.pool())
+            .await
+            .expect("invalid execution log should read");
+            if recorded != 0 {
+                break;
+            }
+            tokio::task::yield_now().await;
+        }
+    })
+    .await
+    .expect("authenticated invalid JSON should be logged");
+
+    let source_too_large = api_request(
+        app.router(),
+        Method::POST,
+        "/api/v1/gateway/execute",
+        json!({ "code": "x".repeat(1024 * 1024 + 1) }).to_string(),
+        &[(header::AUTHORIZATION.as_str(), &authorization)],
+    )
+    .await;
+    assert_eq!(source_too_large.status(), StatusCode::PAYLOAD_TOO_LARGE);
+    assert_eq!(
+        api_body(source_too_large).await["error"]["code"],
+        "source_too_large"
+    );
+
+    let valid = api_request(
+        app.router(),
+        Method::POST,
+        "/api/v1/gateway/execute",
+        json!({ "code": "emit({phase: 'ready'}); console.log('ok'); return 42" }).to_string(),
+        &[(header::AUTHORIZATION.as_str(), &authorization)],
+    )
+    .await;
+    assert_eq!(valid.status(), StatusCode::OK);
+    let valid = api_body(valid).await;
+    assert_eq!(valid["result"], 42);
+    assert_eq!(valid["emits"][0]["phase"], "ready");
+    assert_eq!(valid["console"][0]["message"], "ok");
+    assert!(valid["executionId"].as_str().is_some());
+    assert_eq!(valid["calls"], json!([]));
+
+    let source = api_request(
+        app.router(),
+        Method::POST,
+        "/api/v1/sources",
+        json!({
+            "kind": "openapi",
+            "displayName": "Runtime API source",
+            "preferredSlug": "api",
+            "spec": {
+                "type": "inline",
+                "content": json!({
+                    "openapi": "3.1.0",
+                    "info": { "title": "Runtime API" },
+                    "servers": [{ "url": format!("http://{upstream_address}") }],
+                    "paths": {
+                        "/enabled": {
+                            "get": {
+                                "operationId": "enabled",
+                                "security": [{}],
+                                "responses": { "200": { "description": "ok" } }
+                            }
+                        },
+                        "/ask": {
+                            "post": {
+                                "operationId": "ask",
+                                "security": [{}],
+                                "responses": { "200": { "description": "ok" } }
+                            }
+                        }
+                    }
+                }).to_string()
+            },
+            "allowPrivateNetwork": true
+        })
+        .to_string(),
+        &[
+            (header::COOKIE.as_str(), &cookies),
+            (header::ORIGIN.as_str(), "http://127.0.0.1:4788"),
+            ("x-executor-csrf", csrf),
+        ],
+    )
+    .await;
+    assert_eq!(
+        source.status(),
+        StatusCode::CREATED,
+        "{}",
+        api_body(source).await
+    );
+
+    let enabled = api_request(
+        app.router(),
+        Method::POST,
+        "/api/v1/gateway/execute",
+        json!({ "code": "return await tools.api.enabled()" }).to_string(),
+        &[(header::AUTHORIZATION.as_str(), &authorization)],
+    )
+    .await;
+    assert_eq!(enabled.status(), StatusCode::OK);
+    let enabled = api_body(enabled).await;
+    assert_eq!(enabled["result"]["path"], "/enabled");
+    assert_eq!(enabled["calls"].as_array().map(Vec::len), Some(1));
+
+    let ask_router = app.router();
+    let ask_authorization = authorization.clone();
+    let ask = tokio::spawn(async move {
+        api_request(
+            ask_router,
+            Method::POST,
+            "/api/v1/gateway/execute",
+            json!({ "code": "return await tools.api.ask()" }).to_string(),
+            &[(header::AUTHORIZATION.as_str(), &ask_authorization)],
+        )
+        .await
+    });
+    let approval = tokio::time::timeout(Duration::from_secs(3), async {
+        loop {
+            let mut pending = app
+                .tool_calls()
+                .approvals()
+                .list_admin(ApprovalListQuery {
+                    status: Some(ApprovalStatus::Pending),
+                    limit: 100,
+                    ..Default::default()
+                })
+                .await
+                .expect("API approvals should list")
+                .items;
+            if let Some(approval) = pending
+                .drain(..)
+                .find(|approval| approval.callable_path_snapshot.ends_with(".ask"))
+            {
+                break approval;
+            }
+            tokio::task::yield_now().await;
+        }
+    })
+    .await
+    .expect("API approval should appear");
+    let approved_id = approval.id.clone();
+    app.tool_calls()
+        .decide(
+            &approval.id,
+            "approve-api-runtime",
+            approval.revision,
+            ApprovalDecision::Approve,
+            1,
+        )
+        .await
+        .expect("API approval should succeed");
+    let ask = ask.await.expect("Ask HTTP task should not panic");
+    assert_eq!(ask.status(), StatusCode::OK);
+    assert_eq!(api_body(ask).await["result"]["path"], "/ask");
+
+    let dropped_router = app.router();
+    let dropped_authorization = authorization.clone();
+    let dropped = tokio::spawn(async move {
+        api_request(
+            dropped_router,
+            Method::POST,
+            "/api/v1/gateway/execute",
+            json!({ "code": "return await tools.api.ask()" }).to_string(),
+            &[(header::AUTHORIZATION.as_str(), &dropped_authorization)],
+        )
+        .await
+    });
+    let dropped_approval = tokio::time::timeout(Duration::from_secs(3), async {
+        loop {
+            let pending = app
+                .tool_calls()
+                .approvals()
+                .list_admin(ApprovalListQuery {
+                    status: Some(ApprovalStatus::Pending),
+                    limit: 100,
+                    ..Default::default()
+                })
+                .await
+                .expect("API approvals should list")
+                .items;
+            if let Some(approval) = pending
+                .into_iter()
+                .find(|approval| approval.id != approved_id)
+            {
+                break approval;
+            }
+            tokio::task::yield_now().await;
+        }
+    })
+    .await
+    .expect("dropped request approval should appear");
+    sqlx::query(&format!(
+        "CREATE TRIGGER reject_dropped_http_cleanup BEFORE UPDATE OF status ON approvals \
+         WHEN OLD.execution_id = '{}' AND NEW.status = 'canceled' BEGIN \
+         SELECT RAISE(FAIL, 'hold HTTP cancellation cleanup'); END",
+        dropped_approval.execution_id
+    ))
+    .execute(app.pool())
+    .await
+    .expect("HTTP cancellation cleanup blocker should install");
+    dropped.abort();
+    assert!(
+        dropped
+            .await
+            .expect_err("HTTP execution waiter should be aborted")
+            .is_cancelled()
+    );
+    let dropped_decision = app
+        .tool_calls()
+        .decide(
+            &dropped_approval.id,
+            "dropped-request-must-not-execute",
+            dropped_approval.revision,
+            ApprovalDecision::Approve,
+            1,
+        )
+        .await;
+    assert!(
+        dropped_decision.is_err(),
+        "a disconnected HTTP execution must close its approval gate synchronously"
+    );
+    sqlx::query("DROP TRIGGER reject_dropped_http_cleanup")
+        .execute(app.pool())
+        .await
+        .expect("HTTP cancellation cleanup blocker should be removed");
+
+    let revoke_router = app.router();
+    let revoke_authorization = authorization.clone();
+    let waiting = tokio::spawn(async move {
+        api_request(
+            revoke_router,
+            Method::POST,
+            "/api/v1/gateway/execute",
+            json!({ "code": "return await tools.api.ask()" }).to_string(),
+            &[(header::AUTHORIZATION.as_str(), &revoke_authorization)],
+        )
+        .await
+    });
+    let pending_revoke = tokio::time::timeout(Duration::from_secs(3), async {
+        loop {
+            let pending = app
+                .tool_calls()
+                .approvals()
+                .list_admin(ApprovalListQuery {
+                    status: Some(ApprovalStatus::Pending),
+                    limit: 100,
+                    ..Default::default()
+                })
+                .await
+                .expect("API approvals should list")
+                .items;
+            if let Some(approval) = pending
+                .into_iter()
+                .find(|approval| approval.id != approved_id && approval.id != dropped_approval.id)
+            {
+                break approval;
+            }
+            tokio::task::yield_now().await;
+        }
+    })
+    .await
+    .expect("revoked approval should appear");
+    let revoked = api_request(
+        app.router(),
+        Method::DELETE,
+        &format!("/api/v1/tokens/{token_id}"),
+        String::new(),
+        &[
+            (header::COOKIE.as_str(), &cookies),
+            (header::ORIGIN.as_str(), "http://127.0.0.1:4788"),
+            ("x-executor-csrf", csrf),
+        ],
+    )
+    .await;
+    assert_eq!(revoked.status(), StatusCode::NO_CONTENT);
+    let waiting = waiting
+        .await
+        .expect("revoked execution task should not panic");
+    assert_eq!(waiting.status(), StatusCode::CONFLICT);
+    assert_eq!(
+        api_body(waiting).await["error"]["code"],
+        "execution_cancelled"
+    );
+    let pending_revoke = app
+        .tool_calls()
+        .approvals()
+        .get_admin(&pending_revoke.id)
+        .await
+        .expect("revoked approval should read")
+        .expect("revoked approval should remain stored");
+    assert_eq!(pending_revoke.record.status, ApprovalStatus::Canceled);
+    upstream_task.abort();
+    app.shutdown().await;
+}
diff --git a/tests/source_creation_idempotency_api.rs b/tests/source_creation_idempotency_api.rs
new file mode 100644
index 000000000..44a8e3a4d
--- /dev/null
+++ b/tests/source_creation_idempotency_api.rs
@@ -0,0 +1,1093 @@
+use std::{
+    sync::{
+        Arc,
+        atomic::{AtomicUsize, Ordering},
+    },
+    time::Duration,
+};
+
+use axum::{
+    Json, Router,
+    body::Body,
+    http::{HeaderMap, HeaderValue, Method, Request, StatusCode, header},
+    routing::post,
+};
+use executor::{AppConfig, ExecutorApp};
+use http_body_util::BodyExt;
+use serde_json::{Value, json};
+use tokio::{net::TcpListener, sync::Semaphore};
+use tower::ServiceExt;
+
+const ORIGIN: &str = "http://127.0.0.1:4788";
+const IDEMPOTENCY_KEY: &str = "idempotency-key";
+const IDEMPOTENCY_REPLAYED: &str = "idempotency-replayed";
+
+struct Admin {
+    cookie: String,
+    csrf: String,
+}
+
+#[derive(Debug)]
+struct ResponseSnapshot {
+    status: StatusCode,
+    headers: HeaderMap,
+    body: Vec<u8>,
+}
+
+impl ResponseSnapshot {
+    fn json(&self) -> Value {
+        serde_json::from_slice(&self.body).expect("response contains JSON")
+    }
+}
+
+#[derive(Clone)]
+struct DiscoveryGate {
+    calls: Arc<AtomicUsize>,
+    reached: Arc<Semaphore>,
+    release: Arc<Semaphore>,
+}
+
+impl DiscoveryGate {
+    fn new() -> Self {
+        Self {
+            calls: Arc::new(AtomicUsize::new(0)),
+            reached: Arc::new(Semaphore::new(0)),
+            release: Arc::new(Semaphore::new(0)),
+        }
+    }
+
+    async fn wait_until_reached(&self) {
+        self.reached
+            .acquire()
+            .await
+            .expect("discovery gate remains open")
+            .forget();
+    }
+
+    fn release(&self) {
+        self.release.add_permits(1);
+    }
+
+    fn calls(&self) -> usize {
+        self.calls.load(Ordering::SeqCst)
+    }
+}
+
+#[tokio::test]
+async fn keyed_source_creation_replays_exact_bytes_without_repeating_side_effects() {
+    let mcp_calls = Arc::new(AtomicUsize::new(0));
+    let mcp_server_calls = mcp_calls.clone();
+    let mcp_listener = TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("MCP listener binds");
+    let mcp_address = mcp_listener.local_addr().expect("MCP address reads");
+    let mcp_task = tokio::spawn(async move {
+        axum::serve(
+            mcp_listener,
+            Router::new().route(
+                "/mcp",
+                post(move || {
+                    let calls = mcp_server_calls.clone();
+                    async move {
+                        calls.fetch_add(1, Ordering::SeqCst);
+                        StatusCode::UNAUTHORIZED
+                    }
+                }),
+            ),
+        )
+        .await
+        .expect("MCP server runs");
+    });
+
+    let directory = tempfile::tempdir().expect("temporary directory is created");
+    let templates_path = directory.path().join("mcp-templates.json");
+    std::fs::write(
+        &templates_path,
+        json!({
+            "templates": [{
+                "name": "deferred",
+                "executable": "/bin/sh",
+                "arguments": ["-c", "exit 1"],
+                "secretEnvironment": ["API_TOKEN"]
+            }]
+        })
+        .to_string(),
+    )
+    .expect("MCP templates write");
+    let app = ExecutorApp::open(
+        AppConfig::new(directory.path().to_path_buf())
+            .with_mcp_stdio_templates_file(Some(templates_path)),
+    )
+    .await
+    .expect("Executor opens");
+    let admin = setup(&app).await;
+
+    let openapi_spec = json!({
+        "openapi": "3.1.0",
+        "info": { "title": "Idempotent API", "version": "1" },
+        "servers": [{ "url": "https://example.com" }],
+        "paths": {}
+    });
+    let requests = [
+        (
+            "openapi-exact-replay",
+            json!({
+                "kind": "openapi",
+                "displayName": "Idempotent API",
+                "preferredSlug": "idempotent-api",
+                "spec": { "type": "inline", "content": openapi_spec.to_string() }
+            }),
+        ),
+        (
+            "mcp-http-exact-replay",
+            json!({
+                "kind": "mcp_http",
+                "displayName": "Deferred MCP HTTP",
+                "preferredSlug": "deferred-mcp-http",
+                "endpoint": format!("http://{mcp_address}/mcp"),
+                "allowPrivateNetwork": true
+            }),
+        ),
+        (
+            "mcp-stdio-exact-replay",
+            json!({
+                "kind": "mcp_stdio",
+                "displayName": "Deferred MCP stdio",
+                "preferredSlug": "deferred-mcp-stdio",
+                "templateName": "deferred",
+                "secretValues": {}
+            }),
+        ),
+    ];
+
+    for (key, request) in requests {
+        let first = send_snapshot(
+            app.router(),
+            Method::POST,
+            "/api/v1/sources",
+            request.clone(),
+            mutation_headers(&admin, Some(key)),
+        )
+        .await;
+        assert_eq!(
+            first.status,
+            StatusCode::CREATED,
+            "first response for {key}"
+        );
+        assert!(
+            !first.headers.contains_key(IDEMPOTENCY_REPLAYED),
+            "fresh response must not be marked replayed"
+        );
+        assert_single_no_store(&first);
+        let revision_after_first = app
+            .catalog()
+            .global_revision()
+            .await
+            .expect("catalog revision reads");
+        let audits_after_first = audit_count(&app).await;
+
+        let replay = send_snapshot(
+            app.router(),
+            Method::POST,
+            "/api/v1/sources",
+            request,
+            mutation_headers(&admin, Some(key)),
+        )
+        .await;
+        assert_eq!(replay.status, first.status, "replay status for {key}");
+        assert_eq!(replay.body, first.body, "replay body for {key}");
+        assert_single_no_store(&replay);
+        assert_eq!(
+            replay
+                .headers
+                .get(IDEMPOTENCY_REPLAYED)
+                .and_then(|value| value.to_str().ok()),
+            Some("true")
+        );
+        assert_eq!(
+            app.catalog()
+                .global_revision()
+                .await
+                .expect("catalog revision reads after replay"),
+            revision_after_first,
+            "replay must not bump the catalog revision"
+        );
+        assert_eq!(
+            audit_count(&app).await,
+            audits_after_first,
+            "replay must not append an audit event"
+        );
+
+        let completed_status = send_snapshot(
+            app.router(),
+            Method::GET,
+            "/api/v1/sources/idempotency",
+            Value::Null,
+            authentication_headers(&admin, Some(key)),
+        )
+        .await;
+        assert_eq!(completed_status.status, first.status);
+        assert_eq!(completed_status.body, first.body);
+        assert_single_no_store(&completed_status);
+        assert_eq!(
+            completed_status
+                .headers
+                .get(IDEMPOTENCY_REPLAYED)
+                .and_then(|value| value.to_str().ok()),
+            Some("true")
+        );
+
+        let sealed_completion = send_snapshot(
+            app.router(),
+            Method::POST,
+            "/api/v1/sources/idempotency/seal",
+            Value::Null,
+            mutation_headers(&admin, Some(key)),
+        )
+        .await;
+        assert_eq!(
+            sealed_completion.status, first.status,
+            "seal must return the completed response for {key}"
+        );
+        assert_eq!(sealed_completion.body, first.body);
+        assert_single_no_store(&sealed_completion);
+        assert_eq!(
+            sealed_completion
+                .headers
+                .get(IDEMPOTENCY_REPLAYED)
+                .and_then(|value| value.to_str().ok()),
+            Some("true")
+        );
+        assert_eq!(
+            app.catalog()
+                .global_revision()
+                .await
+                .expect("catalog revision reads after completed seal"),
+            revision_after_first
+        );
+        assert_eq!(audit_count(&app).await, audits_after_first);
+    }
+
+    assert_eq!(
+        app.catalog()
+            .list_sources()
+            .await
+            .expect("sources list")
+            .len(),
+        3
+    );
+    assert_eq!(mcp_calls.load(Ordering::SeqCst), 1);
+    app.shutdown().await;
+    mcp_task.abort();
+}
+
+#[tokio::test]
+async fn concurrent_requests_detect_in_progress_and_mismatch_before_discovery() {
+    let gate = DiscoveryGate::new();
+    let (address, upstream_task) = start_gated_graphql(gate.clone()).await;
+    let directory = tempfile::tempdir().expect("temporary directory is created");
+    let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+        .await
+        .expect("Executor opens");
+    let admin = setup(&app).await;
+    let key = "graphql-race";
+    let request = graphql_request(address, "secret-one");
+
+    let first_router = app.router();
+    let first_headers = mutation_headers(&admin, Some(key));
+    let first_request = request.clone();
+    let first = tokio::spawn(async move {
+        send_snapshot(
+            first_router,
+            Method::POST,
+            "/api/v1/sources",
+            first_request,
+            first_headers,
+        )
+        .await
+    });
+    gate.wait_until_reached().await;
+    assert_eq!(gate.calls(), 1);
+
+    let duplicate = send_snapshot(
+        app.router(),
+        Method::POST,
+        "/api/v1/sources",
+        request.clone(),
+        mutation_headers(&admin, Some(key)),
+    )
+    .await;
+    assert_eq!(duplicate.status, StatusCode::CONFLICT);
+    assert_eq!(duplicate.json()["error"]["code"], "idempotency_in_progress");
+    assert_eq!(
+        duplicate
+            .headers
+            .get(header::RETRY_AFTER)
+            .and_then(|value| value.to_str().ok()),
+        Some("1")
+    );
+
+    let seal_in_progress = send_snapshot(
+        app.router(),
+        Method::POST,
+        "/api/v1/sources/idempotency/seal",
+        Value::Null,
+        mutation_headers(&admin, Some(key)),
+    )
+    .await;
+    assert_eq!(seal_in_progress.status, StatusCode::CONFLICT);
+    assert_eq!(
+        seal_in_progress.json()["error"]["code"],
+        "idempotency_in_progress"
+    );
+    let in_progress_status = send_snapshot(
+        app.router(),
+        Method::GET,
+        "/api/v1/sources/idempotency",
+        Value::Null,
+        authentication_headers(&admin, Some(key)),
+    )
+    .await;
+    assert_eq!(in_progress_status.status, StatusCode::OK);
+    assert_eq!(
+        in_progress_status.json(),
+        json!({ "status": "in_progress" })
+    );
+    assert_single_no_store(&in_progress_status);
+
+    let mut changed_secret = request.clone();
+    changed_secret["credential"]["token"] = json!("secret-two");
+    assert_mismatch(&app, &admin, key, changed_secret).await;
+
+    let mut changed_unknown_field = request.clone();
+    changed_unknown_field["futureField"] = json!({ "nested": true });
+    assert_mismatch(&app, &admin, key, changed_unknown_field).await;
+
+    let mut changed_kind = request.clone();
+    changed_kind["kind"] = json!("openapi");
+    assert_mismatch(&app, &admin, key, changed_kind).await;
+    assert_eq!(gate.calls(), 1, "mismatches must not repeat discovery");
+
+    gate.release();
+    let first = first.await.expect("first request task joins");
+    assert_eq!(first.status, StatusCode::CREATED);
+    let replay = send_snapshot(
+        app.router(),
+        Method::POST,
+        "/api/v1/sources",
+        request,
+        mutation_headers(&admin, Some(key)),
+    )
+    .await;
+    assert_eq!(replay.status, first.status);
+    assert_eq!(replay.body, first.body);
+    assert_eq!(gate.calls(), 1);
+    app.shutdown().await;
+    upstream_task.abort();
+}
+
+#[tokio::test]
+async fn status_seal_and_key_validation_are_fail_closed() {
+    let directory = tempfile::tempdir().expect("temporary directory is created");
+    let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+        .await
+        .expect("Executor opens");
+    let admin = setup(&app).await;
+
+    let unauthenticated = send_snapshot(
+        app.router(),
+        Method::GET,
+        "/api/v1/sources/idempotency",
+        Value::Null,
+        idempotency_headers("status-key"),
+    )
+    .await;
+    assert_eq!(unauthenticated.status, StatusCode::UNAUTHORIZED);
+    assert_single_no_store(&unauthenticated);
+
+    let missing = send_snapshot(
+        app.router(),
+        Method::GET,
+        "/api/v1/sources/idempotency",
+        Value::Null,
+        authentication_headers(&admin, Some("missing-key")),
+    )
+    .await;
+    assert_eq!(missing.status, StatusCode::OK);
+    assert_eq!(missing.json(), json!({ "status": "missing" }));
+    assert_single_no_store(&missing);
+
+    let missing_header = send_snapshot(
+        app.router(),
+        Method::GET,
+        "/api/v1/sources/idempotency?key=query-values-are-ignored",
+        Value::Null,
+        authentication_headers(&admin, None),
+    )
+    .await;
+    assert_eq!(missing_header.status, StatusCode::BAD_REQUEST);
+    assert_eq!(
+        missing_header.json()["error"]["code"],
+        "idempotency_key_required"
+    );
+
+    let request = openapi_request("Key validation", "key-validation");
+    let mut invalid_headers = Vec::new();
+    invalid_headers.push(mutation_headers(&admin, Some("")));
+    invalid_headers.push(mutation_headers(&admin, Some("contains space")));
+    invalid_headers.push(mutation_headers(&admin, Some(&"x".repeat(256))));
+    let mut non_ascii = mutation_headers(&admin, None);
+    non_ascii.insert(
+        IDEMPOTENCY_KEY,
+        HeaderValue::from_bytes(&[0x80]).expect("opaque header value builds"),
+    );
+    invalid_headers.push(non_ascii);
+    let mut duplicate = mutation_headers(&admin, None);
+    duplicate.append(IDEMPOTENCY_KEY, HeaderValue::from_static("first"));
+    duplicate.append(IDEMPOTENCY_KEY, HeaderValue::from_static("second"));
+    invalid_headers.push(duplicate);
+
+    for headers in invalid_headers {
+        let response = send_snapshot(
+            app.router(),
+            Method::POST,
+            "/api/v1/sources",
+            request.clone(),
+            headers,
+        )
+        .await;
+        assert_eq!(response.status, StatusCode::BAD_REQUEST);
+        assert_eq!(response.json()["error"]["code"], "invalid_idempotency_key");
+    }
+
+    let seal_without_csrf = send_snapshot(
+        app.router(),
+        Method::POST,
+        "/api/v1/sources/idempotency/seal",
+        Value::Null,
+        authentication_headers(&admin, Some("sealed-before-create")),
+    )
+    .await;
+    assert_eq!(seal_without_csrf.status, StatusCode::FORBIDDEN);
+
+    let sealed = send_snapshot(
+        app.router(),
+        Method::POST,
+        "/api/v1/sources/idempotency/seal",
+        Value::Null,
+        mutation_headers(&admin, Some("sealed-before-create")),
+    )
+    .await;
+    assert_eq!(sealed.status, StatusCode::OK);
+    assert_eq!(sealed.json(), json!({ "status": "abandoned" }));
+    assert_single_no_store(&sealed);
+
+    let delayed_create = send_snapshot(
+        app.router(),
+        Method::POST,
+        "/api/v1/sources",
+        request,
+        mutation_headers(&admin, Some("sealed-before-create")),
+    )
+    .await;
+    assert_eq!(delayed_create.status, StatusCode::CONFLICT);
+    assert_eq!(
+        delayed_create.json()["error"]["code"],
+        "idempotency_abandoned"
+    );
+
+    let status = send_snapshot(
+        app.router(),
+        Method::GET,
+        "/api/v1/sources/idempotency",
+        Value::Null,
+        authentication_headers(&admin, Some("sealed-before-create")),
+    )
+    .await;
+    assert_eq!(status.json(), json!({ "status": "abandoned" }));
+    assert!(
+        app.catalog()
+            .list_sources()
+            .await
+            .expect("sources list")
+            .is_empty()
+    );
+    app.shutdown().await;
+}
+
+#[tokio::test]
+async fn failed_and_successful_replays_remain_exact_and_private_after_source_deletion() {
+    let directory = tempfile::tempdir().expect("temporary directory is created");
+    let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+        .await
+        .expect("Executor opens");
+    let admin = setup(&app).await;
+    let failed_key = "failed-key-must-not-be-stored";
+    let secret_marker = "request-secret-must-not-be-stored";
+    let failed_request = json!({
+        "kind": "openapi",
+        "displayName": "Invalid document",
+        "preferredSlug": "invalid-document",
+        "spec": { "type": "inline", "content": secret_marker }
+    });
+
+    let failed = send_snapshot(
+        app.router(),
+        Method::POST,
+        "/api/v1/sources",
+        failed_request.clone(),
+        mutation_headers(&admin, Some(failed_key)),
+    )
+    .await;
+    assert_eq!(failed.status, StatusCode::BAD_REQUEST);
+    assert_single_no_store(&failed);
+    let failed_replay = send_snapshot(
+        app.router(),
+        Method::POST,
+        "/api/v1/sources",
+        failed_request,
+        mutation_headers(&admin, Some(failed_key)),
+    )
+    .await;
+    assert_eq!(failed_replay.status, failed.status);
+    assert_eq!(failed_replay.body, failed.body);
+    assert_single_no_store(&failed_replay);
+    assert_eq!(
+        failed_replay
+            .headers
+            .get(IDEMPOTENCY_REPLAYED)
+            .and_then(|value| value.to_str().ok()),
+        Some("true")
+    );
+    let failed_status = send_snapshot(
+        app.router(),
+        Method::GET,
+        "/api/v1/sources/idempotency",
+        Value::Null,
+        authentication_headers(&admin, Some(failed_key)),
+    )
+    .await;
+    assert_eq!(failed_status.status, failed.status);
+    assert_eq!(failed_status.body, failed.body);
+    assert_single_no_store(&failed_status);
+    assert_eq!(
+        failed_status
+            .headers
+            .get(IDEMPOTENCY_REPLAYED)
+            .and_then(|value| value.to_str().ok()),
+        Some("true")
+    );
+    let failed_seal = send_snapshot(
+        app.router(),
+        Method::POST,
+        "/api/v1/sources/idempotency/seal",
+        Value::Null,
+        mutation_headers(&admin, Some(failed_key)),
+    )
+    .await;
+    assert_eq!(failed_seal.status, failed.status);
+    assert_eq!(failed_seal.body, failed.body);
+    assert_single_no_store(&failed_seal);
+    assert_eq!(
+        failed_seal
+            .headers
+            .get(IDEMPOTENCY_REPLAYED)
+            .and_then(|value| value.to_str().ok()),
+        Some("true")
+    );
+
+    let persisted = sqlx::query_as::<_, (Vec<u8>, Vec<u8>, Vec<u8>)>(
+        "SELECT key_digest, request_digest, response_ciphertext \
+         FROM source_creation_idempotency WHERE state = 'failed'",
+    )
+    .fetch_one(app.pool())
+    .await
+    .expect("failed idempotency row reads");
+    for value in [&persisted.0, &persisted.1, &persisted.2] {
+        let text = String::from_utf8_lossy(value);
+        assert!(!text.contains(failed_key));
+        assert!(!text.contains(secret_marker));
+    }
+
+    let success_key = "successful-replay-after-delete";
+    let successful = send_snapshot(
+        app.router(),
+        Method::POST,
+        "/api/v1/sources",
+        openapi_request("Delete after create", "delete-after-create"),
+        mutation_headers(&admin, Some(success_key)),
+    )
+    .await;
+    assert_eq!(successful.status, StatusCode::CREATED);
+    let source_id = successful.json()["id"]
+        .as_str()
+        .expect("created source has an ID")
+        .to_owned();
+    sqlx::query("DELETE FROM sources WHERE id = ?")
+        .bind(&source_id)
+        .execute(app.pool())
+        .await
+        .expect("source deletes directly for retention test");
+
+    let replay_after_delete = send_snapshot(
+        app.router(),
+        Method::POST,
+        "/api/v1/sources",
+        openapi_request("Delete after create", "delete-after-create"),
+        mutation_headers(&admin, Some(success_key)),
+    )
+    .await;
+    assert_eq!(replay_after_delete.status, successful.status);
+    assert_eq!(replay_after_delete.body, successful.body);
+    assert_single_no_store(&replay_after_delete);
+    assert!(
+        app.catalog()
+            .list_sources()
+            .await
+            .expect("sources list after replay")
+            .is_empty(),
+        "replay must not recreate a deleted source"
+    );
+    app.shutdown().await;
+}
+
+#[tokio::test]
+async fn disconnecting_the_http_handler_does_not_cancel_source_creation() {
+    let gate = DiscoveryGate::new();
+    let (address, upstream_task) = start_gated_graphql(gate.clone()).await;
+    let directory = tempfile::tempdir().expect("temporary directory is created");
+    let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+        .await
+        .expect("Executor opens");
+    let admin = setup(&app).await;
+    let key = "disconnected-handler";
+    let request = graphql_request(address, "disconnect-secret");
+    let request_for_task = request.clone();
+    let router = app.router();
+    let headers = mutation_headers(&admin, Some(key));
+    let handler = tokio::spawn(async move {
+        send_snapshot(
+            router,
+            Method::POST,
+            "/api/v1/sources",
+            request_for_task,
+            headers,
+        )
+        .await
+    });
+    gate.wait_until_reached().await;
+    handler.abort();
+    gate.release();
+
+    tokio::time::timeout(Duration::from_secs(5), async {
+        loop {
+            if app
+                .catalog()
+                .list_sources()
+                .await
+                .expect("sources list while waiting")
+                .len()
+                == 1
+            {
+                break;
+            }
+            tokio::time::sleep(Duration::from_millis(10)).await;
+        }
+    })
+    .await
+    .expect("detached source creation completes");
+
+    let replay = send_snapshot(
+        app.router(),
+        Method::POST,
+        "/api/v1/sources",
+        request,
+        mutation_headers(&admin, Some(key)),
+    )
+    .await;
+    assert_eq!(replay.status, StatusCode::CREATED);
+    assert_eq!(
+        replay
+            .headers
+            .get(IDEMPOTENCY_REPLAYED)
+            .and_then(|value| value.to_str().ok()),
+        Some("true")
+    );
+    assert_eq!(gate.calls(), 1);
+    app.shutdown().await;
+    upstream_task.abort();
+}
+
+#[tokio::test]
+async fn settlement_storage_failure_is_recovered_to_an_interrupted_tombstone() {
+    let directory = tempfile::tempdir().expect("temporary directory is created");
+    let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+        .await
+        .expect("Executor opens");
+    let admin = setup(&app).await;
+    sqlx::query(
+        "CREATE TRIGGER reject_source_creation_failed_response \
+         BEFORE UPDATE OF state ON source_creation_idempotency \
+         WHEN NEW.state = 'failed' \
+         BEGIN SELECT RAISE(FAIL, 'injected failed-response write error'); END",
+    )
+    .execute(app.pool())
+    .await
+    .expect("failure trigger installs");
+    let key = "failed-response-storage-error";
+    let response = send_snapshot(
+        app.router(),
+        Method::POST,
+        "/api/v1/sources",
+        json!({
+            "kind": "openapi",
+            "displayName": "Invalid document",
+            "preferredSlug": "invalid-storage-failure",
+            "spec": { "type": "inline", "content": "not an OpenAPI document" }
+        }),
+        mutation_headers(&admin, Some(key)),
+    )
+    .await;
+    assert_eq!(response.status, StatusCode::CONFLICT);
+    assert_eq!(response.json()["error"]["code"], "idempotency_interrupted");
+
+    let status = send_snapshot(
+        app.router(),
+        Method::GET,
+        "/api/v1/sources/idempotency",
+        Value::Null,
+        authentication_headers(&admin, Some(key)),
+    )
+    .await;
+    assert_eq!(status.status, StatusCode::OK);
+    assert_eq!(status.json(), json!({ "status": "interrupted" }));
+    assert!(
+        app.catalog()
+            .list_sources()
+            .await
+            .expect("sources list")
+            .is_empty()
+    );
+    app.shutdown().await;
+}
+
+#[tokio::test]
+async fn app_shutdown_cancels_discovery_and_spawn_rejection_terminalizes_reservations() {
+    let gate = DiscoveryGate::new();
+    let (address, upstream_task) = start_gated_graphql(gate.clone()).await;
+    let directory = tempfile::tempdir().expect("temporary directory is created");
+    let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+        .await
+        .expect("Executor opens");
+    let admin = setup(&app).await;
+    let key = "shutdown-during-discovery";
+    let request = graphql_request(address, "shutdown-secret");
+    let router = app.router();
+    let headers = mutation_headers(&admin, Some(key));
+    let in_flight = tokio::spawn(async move {
+        send_snapshot(router, Method::POST, "/api/v1/sources", request, headers).await
+    });
+    gate.wait_until_reached().await;
+    app.begin_shutdown();
+    let interrupted = tokio::time::timeout(Duration::from_secs(5), in_flight)
+        .await
+        .expect("shutdown joins the supervised source creation")
+        .expect("request task joins");
+    assert_eq!(interrupted.status, StatusCode::CONFLICT);
+    assert_eq!(
+        interrupted.json()["error"]["code"],
+        "idempotency_interrupted"
+    );
+    assert!(
+        app.catalog()
+            .list_sources()
+            .await
+            .expect("sources list after cancellation")
+            .is_empty()
+    );
+
+    let rejected_key = "spawn-rejected-during-shutdown";
+    let rejected = send_snapshot(
+        app.router(),
+        Method::POST,
+        "/api/v1/sources",
+        openapi_request("Rejected during shutdown", "rejected-during-shutdown"),
+        mutation_headers(&admin, Some(rejected_key)),
+    )
+    .await;
+    assert_eq!(rejected.status, StatusCode::SERVICE_UNAVAILABLE);
+    assert_eq!(
+        rejected.json()["error"]["code"],
+        "source_creation_unavailable"
+    );
+    let rejected_status = send_snapshot(
+        app.router(),
+        Method::GET,
+        "/api/v1/sources/idempotency",
+        Value::Null,
+        authentication_headers(&admin, Some(rejected_key)),
+    )
+    .await;
+    assert_eq!(rejected_status.json(), json!({ "status": "interrupted" }));
+
+    gate.release();
+    app.shutdown().await;
+    upstream_task.abort();
+}
+
+async fn assert_mismatch(app: &ExecutorApp, admin: &Admin, key: &str, request: Value) {
+    let response = send_snapshot(
+        app.router(),
+        Method::POST,
+        "/api/v1/sources",
+        request,
+        mutation_headers(admin, Some(key)),
+    )
+    .await;
+    assert_eq!(response.status, StatusCode::CONFLICT);
+    assert_eq!(response.json()["error"]["code"], "idempotency_key_mismatch");
+}
+
+async fn start_gated_graphql(
+    gate: DiscoveryGate,
+) -> (std::net::SocketAddr, tokio::task::JoinHandle<()>) {
+    let listener = TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("GraphQL listener binds");
+    let address = listener.local_addr().expect("GraphQL address reads");
+    let task = tokio::spawn(async move {
+        axum::serve(
+            listener,
+            Router::new().route(
+                "/graphql",
+                post(move |Json(_request): Json<Value>| {
+                    let gate = gate.clone();
+                    async move {
+                        gate.calls.fetch_add(1, Ordering::SeqCst);
+                        gate.reached.add_permits(1);
+                        gate.release
+                            .acquire()
+                            .await
+                            .expect("discovery gate remains open")
+                            .forget();
+                        Json(graphql_introspection())
+                    }
+                }),
+            ),
+        )
+        .await
+        .expect("GraphQL server runs");
+    });
+    (address, task)
+}
+
+fn graphql_request(address: std::net::SocketAddr, token: &str) -> Value {
+    json!({
+        "kind": "graphql",
+        "displayName": "Idempotent GraphQL",
+        "preferredSlug": "idempotent-graphql",
+        "endpoint": format!("http://{address}/graphql"),
+        "allowPrivateNetwork": true,
+        "credential": { "type": "bearer", "token": token }
+    })
+}
+
+fn graphql_introspection() -> Value {
+    json!({
+        "data": {
+            "__schema": {
+                "queryType": { "name": "Query" },
+                "mutationType": null,
+                "subscriptionType": null,
+                "types": [
+                    {
+                        "kind": "SCALAR",
+                        "name": "String",
+                        "description": null,
+                        "fields": null,
+                        "inputFields": null,
+                        "enumValues": null
+                    },
+                    {
+                        "kind": "OBJECT",
+                        "name": "Query",
+                        "description": null,
+                        "inputFields": null,
+                        "enumValues": null,
+                        "fields": [{
+                            "name": "hello",
+                            "description": "Say hello",
+                            "isDeprecated": false,
+                            "args": [],
+                            "type": { "kind": "SCALAR", "name": "String", "ofType": null }
+                        }]
+                    }
+                ]
+            }
+        }
+    })
+}
+
+fn openapi_request(display_name: &str, slug: &str) -> Value {
+    let specification = json!({
+        "openapi": "3.1.0",
+        "info": { "title": display_name, "version": "1" },
+        "servers": [{ "url": "https://example.com" }],
+        "paths": {}
+    });
+    json!({
+        "kind": "openapi",
+        "displayName": display_name,
+        "preferredSlug": slug,
+        "spec": { "type": "inline", "content": specification.to_string() }
+    })
+}
+
+async fn setup(app: &ExecutorApp) -> Admin {
+    let setup_token = app.setup_token().expect("fresh instance has setup token");
+    let setup = send_snapshot(
+        app.router(),
+        Method::POST,
+        "/api/v1/setup",
+        json!({
+            "setupToken": setup_token,
+            "username": "admin",
+            "password": "correct horse battery staple"
+        }),
+        origin_headers(),
+    )
+    .await;
+    assert_eq!(setup.status, StatusCode::CREATED);
+
+    let login = send_snapshot(
+        app.router(),
+        Method::POST,
+        "/api/v1/session",
+        json!({
+            "username": "admin",
+            "password": "correct horse battery staple"
+        }),
+        origin_headers(),
+    )
+    .await;
+    assert_eq!(login.status, StatusCode::OK);
+    let cookie = login
+        .headers
+        .get_all(header::SET_COOKIE)
+        .iter()
+        .map(|value| {
+            value
+                .to_str()
+                .expect("cookie is text")
+                .split(';')
+                .next()
+                .expect("cookie has a value")
+        })
+        .collect::<Vec<_>>()
+        .join("; ");
+    let csrf = login.json()["csrfToken"]
+        .as_str()
+        .expect("login returns CSRF")
+        .to_owned();
+    Admin { cookie, csrf }
+}
+
+fn origin_headers() -> HeaderMap {
+    let mut headers = HeaderMap::new();
+    headers.insert(header::ORIGIN, HeaderValue::from_static(ORIGIN));
+    headers
+}
+
+fn authentication_headers(admin: &Admin, key: Option<&str>) -> HeaderMap {
+    let mut headers = HeaderMap::new();
+    headers.insert(
+        header::COOKIE,
+        HeaderValue::from_str(&admin.cookie).expect("cookie header is valid"),
+    );
+    if let Some(key) = key {
+        headers.insert(
+            IDEMPOTENCY_KEY,
+            HeaderValue::from_str(key).expect("idempotency header builds"),
+        );
+    }
+    headers
+}
+
+fn mutation_headers(admin: &Admin, key: Option<&str>) -> HeaderMap {
+    let mut headers = authentication_headers(admin, key);
+    headers.insert(header::ORIGIN, HeaderValue::from_static(ORIGIN));
+    headers.insert(
+        "x-executor-csrf",
+        HeaderValue::from_str(&admin.csrf).expect("CSRF header is valid"),
+    );
+    headers
+}
+
+fn idempotency_headers(key: &str) -> HeaderMap {
+    let mut headers = HeaderMap::new();
+    headers.insert(
+        IDEMPOTENCY_KEY,
+        HeaderValue::from_str(key).expect("idempotency header is valid"),
+    );
+    headers
+}
+
+fn assert_single_no_store(response: &ResponseSnapshot) {
+    assert_eq!(
+        response
+            .headers
+            .get_all(header::CACHE_CONTROL)
+            .iter()
+            .count(),
+        1,
+        "Cache-Control must be represented by exactly one header value"
+    );
+    assert_eq!(
+        response
+            .headers
+            .get(header::CACHE_CONTROL)
+            .and_then(|value| value.to_str().ok()),
+        Some("no-store")
+    );
+}
+
+async fn audit_count(app: &ExecutorApp) -> i64 {
+    sqlx::query_scalar("SELECT COUNT(*) FROM audit_events")
+        .fetch_one(app.pool())
+        .await
+        .expect("audit count reads")
+}
+
+async fn send_snapshot(
+    router: Router,
+    method: Method,
+    uri: &str,
+    body: Value,
+    mut headers: HeaderMap,
+) -> ResponseSnapshot {
+    headers.insert(
+        header::CONTENT_TYPE,
+        HeaderValue::from_static("application/json"),
+    );
+    let mut request = Request::builder()
+        .method(method)
+        .uri(uri)
+        .body(Body::from(body.to_string()))
+        .expect("request builds");
+    *request.headers_mut() = headers;
+    let response = router.oneshot(request).await.expect("router answers");
+    let status = response.status();
+    let headers = response.headers().clone();
+    let body = response
+        .into_body()
+        .collect()
+        .await
+        .expect("response collects")
+        .to_bytes()
+        .to_vec();
+    ResponseSnapshot {
+        status,
+        headers,
+        body,
+    }
+}
diff --git a/tests/token_delivery_api.rs b/tests/token_delivery_api.rs
new file mode 100644
index 000000000..98b5fa5a7
--- /dev/null
+++ b/tests/token_delivery_api.rs
@@ -0,0 +1,675 @@
+use std::{
+    path::Path,
+    sync::atomic::{AtomicU64, Ordering},
+    time::Duration,
+};
+
+use axum::{
+    Router,
+    body::Body,
+    http::{HeaderMap, HeaderValue, Method, Request, StatusCode, header},
+};
+use executor::{AppConfig, ExecutorApp};
+use http_body_util::BodyExt;
+use serde_json::{Value, json};
+use tokio::time::timeout;
+use tower::ServiceExt;
+
+const ORIGIN: &str = "http://127.0.0.1:4788";
+const IDEMPOTENCY_KEY: &str = "idempotency-key";
+const IDEMPOTENCY_REPLAYED: &str = "idempotency-replayed";
+const REVOKE_RECONCILED: &str = "revoke-reconciled";
+
+static TEST_SEQUENCE: AtomicU64 = AtomicU64::new(1);
+
+struct Admin {
+    cookie: String,
+    csrf: String,
+}
+
+#[derive(Debug)]
+struct ResponseSnapshot {
+    status: StatusCode,
+    headers: HeaderMap,
+    body: Vec<u8>,
+}
+
+impl ResponseSnapshot {
+    fn json(&self) -> Value {
+        serde_json::from_slice(&self.body).expect("response contains JSON")
+    }
+
+    fn text(&self) -> String {
+        String::from_utf8_lossy(&self.body).into_owned()
+    }
+}
+
+#[tokio::test]
+async fn token_creation_requires_one_valid_idempotency_key_without_echoing_it() {
+    let directory = tempfile::tempdir().expect("temporary directory is created");
+    let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+        .await
+        .expect("Executor opens");
+    let admin = setup(&app).await;
+    let name = "validation-name-must-not-be-echoed";
+
+    let missing = send_snapshot(
+        app.router(),
+        Method::POST,
+        "/api/v1/tokens",
+        json!({ "name": name }),
+        mutation_headers(&admin, None),
+    )
+    .await;
+    assert_error(
+        &missing,
+        StatusCode::BAD_REQUEST,
+        "idempotency_key_required",
+        &[name],
+    );
+
+    let oversized = "x".repeat(256);
+    let invalid_cases = ["", "contains space", oversized.as_str()];
+    for invalid_key in invalid_cases {
+        let response = send_snapshot(
+            app.router(),
+            Method::POST,
+            "/api/v1/tokens",
+            json!({ "name": name }),
+            mutation_headers(&admin, Some(invalid_key)),
+        )
+        .await;
+        assert_error(
+            &response,
+            StatusCode::BAD_REQUEST,
+            "invalid_idempotency_key",
+            &[invalid_key, name],
+        );
+    }
+
+    let mut non_ascii = mutation_headers(&admin, None);
+    non_ascii.insert(
+        IDEMPOTENCY_KEY,
+        HeaderValue::from_bytes(&[0x80]).expect("opaque header value builds"),
+    );
+    let response = send_snapshot(
+        app.router(),
+        Method::POST,
+        "/api/v1/tokens",
+        json!({ "name": name }),
+        non_ascii,
+    )
+    .await;
+    assert_error(
+        &response,
+        StatusCode::BAD_REQUEST,
+        "invalid_idempotency_key",
+        &[name],
+    );
+
+    let first_duplicate = "duplicate-first-must-not-be-echoed";
+    let second_duplicate = "duplicate-second-must-not-be-echoed";
+    let mut duplicate = mutation_headers(&admin, None);
+    duplicate.append(IDEMPOTENCY_KEY, HeaderValue::from_static(first_duplicate));
+    duplicate.append(IDEMPOTENCY_KEY, HeaderValue::from_static(second_duplicate));
+    let response = send_snapshot(
+        app.router(),
+        Method::POST,
+        "/api/v1/tokens",
+        json!({ "name": name }),
+        duplicate,
+    )
+    .await;
+    assert_error(
+        &response,
+        StatusCode::BAD_REQUEST,
+        "invalid_idempotency_key",
+        &[first_duplicate, second_duplicate, name],
+    );
+
+    let count = sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM api_tokens")
+        .fetch_one(app.pool())
+        .await
+        .expect("API token count reads");
+    assert_eq!(count, 0, "invalid requests must not create API tokens");
+    app.shutdown().await;
+}
+
+#[tokio::test]
+async fn token_creation_replays_exactly_rejects_mismatches_and_converges_concurrently() {
+    let directory = tempfile::tempdir().expect("temporary directory is created");
+    let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+        .await
+        .expect("Executor opens");
+    let admin = setup(&app).await;
+    let replay_key = unique_key("exact-replay");
+    let name = "Exact replay";
+
+    let first = create_token(&app, &admin, name, &replay_key).await;
+    assert_eq!(first.status, StatusCode::CREATED);
+    assert_json_content_type(&first);
+    assert_single_no_store(&first);
+    assert!(!first.headers.contains_key(IDEMPOTENCY_REPLAYED));
+    let first_json = first.json();
+    assert_eq!(
+        first_json
+            .as_object()
+            .expect("created token response is an object")
+            .len(),
+        4,
+        "idempotency must not change the successful response shape"
+    );
+    assert_eq!(first_json["name"], name);
+    assert!(
+        first_json["id"]
+            .as_str()
+            .is_some_and(|value| !value.is_empty()),
+        "created token has an ID"
+    );
+    let plaintext_token = first_json["token"]
+        .as_str()
+        .expect("created token is revealed")
+        .to_owned();
+    assert!(plaintext_token.starts_with("exr_"));
+    assert!(first_json["createdAt"].is_i64());
+
+    let replay = create_token(&app, &admin, name, &replay_key).await;
+    assert_eq!(replay.status, first.status);
+    assert_eq!(
+        replay.body, first.body,
+        "replay must return exact token bytes"
+    );
+    assert_json_content_type(&replay);
+    assert_single_no_store(&replay);
+    assert_eq!(
+        replay
+            .headers
+            .get(IDEMPOTENCY_REPLAYED)
+            .and_then(|value| value.to_str().ok()),
+        Some("true")
+    );
+
+    let mismatched_name = "different-name-must-not-be-echoed";
+    let mismatch = create_token(&app, &admin, mismatched_name, &replay_key).await;
+    assert_error(
+        &mismatch,
+        StatusCode::CONFLICT,
+        "idempotency_mismatch",
+        &[mismatched_name, &replay_key, &plaintext_token],
+    );
+
+    let concurrent_key = unique_key("concurrent");
+    let concurrent_name = "Concurrent token";
+    let first_request = create_token(&app, &admin, concurrent_name, &concurrent_key);
+    let second_request = create_token(&app, &admin, concurrent_name, &concurrent_key);
+    let (first_concurrent, second_concurrent) = tokio::join!(first_request, second_request);
+    assert_eq!(first_concurrent.status, StatusCode::CREATED);
+    assert_eq!(second_concurrent.status, StatusCode::CREATED);
+    assert_eq!(
+        first_concurrent.body, second_concurrent.body,
+        "concurrent callers must converge on one token"
+    );
+    let replay_markers = [&first_concurrent, &second_concurrent]
+        .into_iter()
+        .filter(|response| {
+            response
+                .headers
+                .get(IDEMPOTENCY_REPLAYED)
+                .is_some_and(|value| value == "true")
+        })
+        .count();
+    assert_eq!(
+        replay_markers, 1,
+        "exactly one concurrent response is replayed"
+    );
+    let count = sqlx::query_scalar::<_, i64>(
+        "SELECT COUNT(*) FROM api_tokens WHERE name = ? AND revoked_at IS NULL",
+    )
+    .bind(concurrent_name)
+    .fetch_one(app.pool())
+    .await
+    .expect("concurrent API token count reads");
+    assert_eq!(count, 1);
+
+    app.shutdown().await;
+}
+
+#[tokio::test]
+async fn token_replay_survives_restart_without_plaintext_and_revocation_is_reconciled() {
+    let directory = tempfile::tempdir().expect("temporary directory is created");
+    let config = AppConfig::new(directory.path().to_path_buf());
+    let app = ExecutorApp::open(config.clone())
+        .await
+        .expect("Executor opens");
+    let admin = setup(&app).await;
+    let replay_key = unique_key("restart-private");
+    let created = create_token(&app, &admin, "Restart replay", &replay_key).await;
+    assert_eq!(created.status, StatusCode::CREATED);
+    let created_json = created.json();
+    let token_id = created_json["id"]
+        .as_str()
+        .expect("created token has an ID")
+        .to_owned();
+    let plaintext_token = created_json["token"]
+        .as_str()
+        .expect("created token is revealed")
+        .to_owned();
+    assert_storage_omits(directory.path(), &[&replay_key, &plaintext_token]);
+
+    app.shutdown().await;
+    let app = ExecutorApp::open(config).await.expect("Executor reopens");
+    let replay = create_token(&app, &admin, "Restart replay", &replay_key).await;
+    assert_eq!(replay.status, created.status);
+    assert_eq!(
+        replay.body, created.body,
+        "restart replay returns exact bytes"
+    );
+    assert_eq!(
+        replay
+            .headers
+            .get(IDEMPOTENCY_REPLAYED)
+            .and_then(|value| value.to_str().ok()),
+        Some("true")
+    );
+    assert_json_content_type(&replay);
+    assert_single_no_store(&replay);
+    assert_storage_omits(directory.path(), &[&replay_key, &plaintext_token]);
+
+    let first_revoke = send_snapshot(
+        app.router(),
+        Method::DELETE,
+        &format!("/api/v1/tokens/{token_id}"),
+        Value::Null,
+        mutation_headers(&admin, None),
+    )
+    .await;
+    assert_eq!(first_revoke.status, StatusCode::NO_CONTENT);
+    assert!(first_revoke.body.is_empty());
+    assert!(!first_revoke.headers.contains_key(REVOKE_RECONCILED));
+
+    let repeated_revoke = send_snapshot(
+        app.router(),
+        Method::DELETE,
+        &format!("/api/v1/tokens/{token_id}"),
+        Value::Null,
+        mutation_headers(&admin, None),
+    )
+    .await;
+    assert_eq!(repeated_revoke.status, StatusCode::NO_CONTENT);
+    assert!(repeated_revoke.body.is_empty());
+    assert_eq!(
+        repeated_revoke
+            .headers
+            .get(REVOKE_RECONCILED)
+            .and_then(|value| value.to_str().ok()),
+        Some("true")
+    );
+
+    let revoked_replay = create_token(&app, &admin, "Restart replay", &replay_key).await;
+    assert_error(
+        &revoked_replay,
+        StatusCode::CONFLICT,
+        "idempotency_replay_revoked",
+        &[&replay_key, &plaintext_token],
+    );
+    assert_eq!(
+        revoked_replay
+            .headers
+            .get(IDEMPOTENCY_REPLAYED)
+            .and_then(|value| value.to_str().ok()),
+        Some("true")
+    );
+
+    let unknown_id = "unknown-token-id-secret-marker";
+    let unknown = send_snapshot(
+        app.router(),
+        Method::DELETE,
+        &format!("/api/v1/tokens/{unknown_id}"),
+        Value::Null,
+        mutation_headers(&admin, None),
+    )
+    .await;
+    assert_error(
+        &unknown,
+        StatusCode::NOT_FOUND,
+        "token_not_found",
+        &[unknown_id, &plaintext_token],
+    );
+    assert_storage_omits(directory.path(), &[&replay_key, &plaintext_token]);
+
+    app.shutdown().await;
+}
+
+#[tokio::test]
+async fn dropped_revoke_request_finishes_durably_and_reconciles() {
+    let directory = tempfile::tempdir().expect("temporary directory is created");
+    let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+        .await
+        .expect("Executor opens");
+    let admin = setup(&app).await;
+    let created = create_token(
+        &app,
+        &admin,
+        "Dropped revoke request",
+        &unique_key("dropped-revoke"),
+    )
+    .await;
+    let token_id = created.json()["id"]
+        .as_str()
+        .expect("created token has an ID")
+        .to_owned();
+
+    let mut writer = app
+        .pool()
+        .acquire()
+        .await
+        .expect("test writer connection is acquired");
+    sqlx::query("BEGIN IMMEDIATE")
+        .execute(&mut *writer)
+        .await
+        .expect("test writer holds the SQLite write lock");
+
+    let mut request = Request::builder()
+        .method(Method::DELETE)
+        .uri(format!("/api/v1/tokens/{token_id}"))
+        .body(Body::from(Value::Null.to_string()))
+        .expect("revoke request builds");
+    *request.headers_mut() = mutation_headers(&admin, None);
+    request.headers_mut().insert(
+        header::CONTENT_TYPE,
+        HeaderValue::from_static("application/json"),
+    );
+    let router = app.router();
+    let revoke_request = tokio::spawn(async move { router.oneshot(request).await });
+
+    timeout(Duration::from_secs(2), async {
+        loop {
+            let in_use = app.pool().size() as usize - app.pool().num_idle();
+            if in_use >= 2 && !revoke_request.is_finished() {
+                tokio::time::sleep(Duration::from_millis(50)).await;
+                if !revoke_request.is_finished() {
+                    return;
+                }
+            }
+            tokio::task::yield_now().await;
+        }
+    })
+    .await
+    .expect("revoke reaches the blocked durable operation");
+    revoke_request.abort();
+    assert!(
+        revoke_request
+            .await
+            .expect_err("dropped request task is canceled")
+            .is_cancelled()
+    );
+
+    sqlx::query("COMMIT")
+        .execute(&mut *writer)
+        .await
+        .expect("test writer releases the SQLite write lock");
+    drop(writer);
+
+    timeout(Duration::from_secs(2), async {
+        loop {
+            let revoked_at = sqlx::query_scalar::<_, Option<i64>>(
+                "SELECT revoked_at FROM api_tokens WHERE id = ?",
+            )
+            .bind(&token_id)
+            .fetch_one(app.pool())
+            .await
+            .expect("token revocation state reads");
+            if revoked_at.is_some() {
+                return;
+            }
+            tokio::time::sleep(Duration::from_millis(10)).await;
+        }
+    })
+    .await
+    .expect("supervised revoke completes after its request is dropped");
+
+    let reconciled = send_snapshot(
+        app.router(),
+        Method::DELETE,
+        &format!("/api/v1/tokens/{token_id}"),
+        Value::Null,
+        mutation_headers(&admin, None),
+    )
+    .await;
+    assert_eq!(reconciled.status, StatusCode::NO_CONTENT);
+    assert_eq!(
+        reconciled
+            .headers
+            .get(REVOKE_RECONCILED)
+            .and_then(|value| value.to_str().ok()),
+        Some("true")
+    );
+
+    app.shutdown().await;
+}
+
+async fn create_token(
+    app: &ExecutorApp,
+    admin: &Admin,
+    name: &str,
+    idempotency_key: &str,
+) -> ResponseSnapshot {
+    send_snapshot(
+        app.router(),
+        Method::POST,
+        "/api/v1/tokens",
+        json!({ "name": name }),
+        mutation_headers(admin, Some(idempotency_key)),
+    )
+    .await
+}
+
+async fn setup(app: &ExecutorApp) -> Admin {
+    let setup_token = app.setup_token().expect("fresh instance has setup token");
+    let setup = send_snapshot(
+        app.router(),
+        Method::POST,
+        "/api/v1/setup",
+        json!({
+            "setupToken": setup_token,
+            "username": "admin",
+            "password": "correct horse battery staple"
+        }),
+        origin_headers(),
+    )
+    .await;
+    assert_eq!(setup.status, StatusCode::CREATED);
+
+    let login = send_snapshot(
+        app.router(),
+        Method::POST,
+        "/api/v1/session",
+        json!({
+            "username": "admin",
+            "password": "correct horse battery staple"
+        }),
+        origin_headers(),
+    )
+    .await;
+    assert_eq!(login.status, StatusCode::OK);
+    let cookie = login
+        .headers
+        .get_all(header::SET_COOKIE)
+        .iter()
+        .map(|value| {
+            value
+                .to_str()
+                .expect("cookie is text")
+                .split(';')
+                .next()
+                .expect("cookie has a value")
+        })
+        .collect::<Vec<_>>()
+        .join("; ");
+    let csrf = login.json()["csrfToken"]
+        .as_str()
+        .expect("login returns CSRF")
+        .to_owned();
+    Admin { cookie, csrf }
+}
+
+fn unique_key(scope: &str) -> String {
+    format!(
+        "token-delivery-{scope}-{}",
+        TEST_SEQUENCE.fetch_add(1, Ordering::Relaxed)
+    )
+}
+
+fn origin_headers() -> HeaderMap {
+    let mut headers = HeaderMap::new();
+    headers.insert(header::ORIGIN, HeaderValue::from_static(ORIGIN));
+    headers
+}
+
+fn mutation_headers(admin: &Admin, idempotency_key: Option<&str>) -> HeaderMap {
+    let mut headers = HeaderMap::new();
+    headers.insert(
+        header::COOKIE,
+        HeaderValue::from_str(&admin.cookie).expect("cookie header is valid"),
+    );
+    headers.insert(header::ORIGIN, HeaderValue::from_static(ORIGIN));
+    headers.insert(
+        "x-executor-csrf",
+        HeaderValue::from_str(&admin.csrf).expect("CSRF header is valid"),
+    );
+    if let Some(idempotency_key) = idempotency_key {
+        headers.insert(
+            IDEMPOTENCY_KEY,
+            HeaderValue::from_str(idempotency_key).expect("idempotency header is valid"),
+        );
+    }
+    headers
+}
+
+fn assert_error(
+    response: &ResponseSnapshot,
+    expected_status: StatusCode,
+    expected_code: &str,
+    forbidden_values: &[&str],
+) {
+    assert_eq!(response.status, expected_status, "{}", response.text());
+    assert_json_content_type(response);
+    assert_single_no_store(response);
+    let body = response.json();
+    let envelope = body.as_object().expect("error response is an object");
+    assert_eq!(envelope.len(), 1);
+    let error = envelope["error"]
+        .as_object()
+        .expect("error envelope has an error object");
+    assert_eq!(error.len(), 3);
+    assert_eq!(error["code"], expected_code);
+    assert!(
+        error["message"]
+            .as_str()
+            .is_some_and(|message| !message.is_empty()),
+        "error has a stable public message"
+    );
+    assert!(
+        error["requestId"]
+            .as_str()
+            .is_some_and(|request_id| !request_id.is_empty()),
+        "error has a request ID"
+    );
+    let encoded = response.text();
+    for forbidden in forbidden_values {
+        assert!(
+            forbidden.is_empty() || !encoded.contains(forbidden),
+            "error response must not echo sensitive input {forbidden:?}: {encoded}"
+        );
+    }
+}
+
+fn assert_json_content_type(response: &ResponseSnapshot) {
+    assert_eq!(
+        response
+            .headers
+            .get(header::CONTENT_TYPE)
+            .and_then(|value| value.to_str().ok()),
+        Some("application/json")
+    );
+}
+
+fn assert_single_no_store(response: &ResponseSnapshot) {
+    assert_eq!(
+        response
+            .headers
+            .get_all(header::CACHE_CONTROL)
+            .iter()
+            .count(),
+        1
+    );
+    assert_eq!(
+        response
+            .headers
+            .get(header::CACHE_CONTROL)
+            .and_then(|value| value.to_str().ok()),
+        Some("no-store")
+    );
+}
+
+fn assert_storage_omits(data_dir: &Path, forbidden_values: &[&str]) {
+    let mut inspected = 0;
+    for entry in std::fs::read_dir(data_dir).expect("data directory reads") {
+        let entry = entry.expect("data directory entry reads");
+        let file_name = entry.file_name();
+        let file_name = file_name.to_string_lossy();
+        if !file_name.starts_with("executor.db") || !entry.path().is_file() {
+            continue;
+        }
+        inspected += 1;
+        let bytes = std::fs::read(entry.path()).expect("SQLite storage file reads");
+        for forbidden in forbidden_values {
+            assert!(
+                !contains_bytes(&bytes, forbidden.as_bytes()),
+                "SQLite storage {file_name} must not contain plaintext {forbidden:?}"
+            );
+        }
+    }
+    assert!(inspected > 0, "at least the SQLite database is inspected");
+}
+
+fn contains_bytes(haystack: &[u8], needle: &[u8]) -> bool {
+    !needle.is_empty()
+        && haystack
+            .windows(needle.len())
+            .any(|window| window == needle)
+}
+
+async fn send_snapshot(
+    router: Router,
+    method: Method,
+    uri: &str,
+    body: Value,
+    mut headers: HeaderMap,
+) -> ResponseSnapshot {
+    headers.insert(
+        header::CONTENT_TYPE,
+        HeaderValue::from_static("application/json"),
+    );
+    let mut request = Request::builder()
+        .method(method)
+        .uri(uri)
+        .body(Body::from(body.to_string()))
+        .expect("request builds");
+    *request.headers_mut() = headers;
+    let response = router.oneshot(request).await.expect("router answers");
+    let status = response.status();
+    let headers = response.headers().clone();
+    let body = response
+        .into_body()
+        .collect()
+        .await
+        .expect("response collects")
+        .to_bytes()
+        .to_vec();
+    ResponseSnapshot {
+        status,
+        headers,
+        body,
+    }
+}
diff --git a/tests/tools-cli.test.ts b/tests/tools-cli.test.ts
index f2f2d67ed..af09b9f0e 100644
--- a/tests/tools-cli.test.ts
+++ b/tests/tools-cli.test.ts
@@ -14,7 +14,7 @@ import {
   inspectToolPath,
   normalizeCliErrorText,
   parseJsonObjectInput,
-} from "../apps/cli/src/tooling";
+} from "../legacy/cli/src/tooling";
 
 describe("CLI tooling helpers", () => {
   it.effect("parses empty input as an empty args object", () =>
diff --git a/tests/warden-targets.test.ts b/tests/warden-targets.test.ts
new file mode 100644
index 000000000..296e023df
--- /dev/null
+++ b/tests/warden-targets.test.ts
@@ -0,0 +1,26 @@
+import { describe, expect, it } from "@effect/vitest";
+import { spawnSync } from "node:child_process";
+import { resolve } from "node:path";
+
+const repoRoot = resolve(import.meta.dirname, "..");
+const runGuard = (...args: ReadonlyArray<string>) =>
+  spawnSync("bun", ["run", "scripts/check-warden-targets.ts", ...args], {
+    cwd: repoRoot,
+    encoding: "utf8",
+  });
+
+describe("Warden target guard", () => {
+  it("accepts every configured repository target", () => {
+    const result = runGuard();
+
+    expect(result.status, result.stderr).toBe(0);
+    expect(result.stdout).toContain("Warden target guard checked");
+  });
+
+  it("rejects a target that resolves to zero non-ignored files", () => {
+    const result = runGuard("tests/fixtures/warden-zero-match.toml");
+
+    expect(result.status).toBe(1);
+    expect(result.stderr).toContain("zero-match-fixture: tests/fixtures/does-not-exist/**/*.ts");
+  });
+});
diff --git a/tests/web_assets.rs b/tests/web_assets.rs
new file mode 100644
index 000000000..043f09bc0
--- /dev/null
+++ b/tests/web_assets.rs
@@ -0,0 +1,141 @@
+use std::fs;
+
+use axum::{
+    Router,
+    body::{Body, Bytes},
+    http::{Method, Request, StatusCode, header},
+    response::Response,
+};
+use executor::{AppConfig, ExecutorApp};
+use http_body_util::BodyExt;
+use tower::ServiceExt;
+
+const PRIVATE_MARKER: &str = "executor-private-data-must-never-be-served-91d94a";
+
+#[tokio::test]
+async fn app_router_preserves_static_policy_and_keeps_protocol_paths_json() {
+    let directory = tempfile::tempdir().expect("temporary data directory");
+    let private_file = directory.path().join("private-marker");
+    fs::write(&private_file, PRIVATE_MARKER).expect("private marker fixture is written");
+    let app = ExecutorApp::open(AppConfig::new(directory.path().to_path_buf()))
+        .await
+        .expect("test Executor opens");
+    let router = app.router();
+
+    let asset = send(
+        router.clone(),
+        Method::GET,
+        "/_app/immutable/entry/start.fixture.js?v=1",
+    )
+    .await;
+    assert_eq!(asset.status(), StatusCode::OK);
+    assert_eq!(
+        asset.headers().get(header::CONTENT_TYPE),
+        Some(&header::HeaderValue::from_static(
+            "text/javascript; charset=utf-8"
+        ))
+    );
+    assert_eq!(
+        asset.headers().get(header::CACHE_CONTROL),
+        Some(&header::HeaderValue::from_static(
+            "public, max-age=31536000, immutable"
+        ))
+    );
+    assert!(asset.headers().contains_key("x-request-id"));
+    assert!(
+        !body(asset)
+            .await
+            .windows(PRIVATE_MARKER.len())
+            .any(|window| { window == PRIVATE_MARKER.as_bytes() })
+    );
+
+    let spa = send(router.clone(), Method::GET, "/tools/example?view=detail").await;
+    assert_eq!(spa.status(), StatusCode::OK);
+    assert_eq!(
+        spa.headers().get(header::CACHE_CONTROL),
+        Some(&header::HeaderValue::from_static("no-cache"))
+    );
+    assert!(spa.headers().contains_key("x-request-id"));
+    assert!(
+        body(spa)
+            .await
+            .windows(16)
+            .any(|window| window == b"Executor fixture")
+    );
+
+    for path in [
+        "/api/v1/definitely-missing",
+        "/mcp/definitely-missing",
+        "/healthz/definitely-missing",
+    ] {
+        let response = send(router.clone(), Method::GET, path).await;
+        assert_eq!(response.status(), StatusCode::NOT_FOUND, "{path}");
+        assert_eq!(
+            response.headers().get(header::CACHE_CONTROL),
+            Some(&header::HeaderValue::from_static("no-store")),
+            "{path}"
+        );
+        assert!(
+            response
+                .headers()
+                .get(header::CONTENT_TYPE)
+                .is_some_and(|value| value.as_bytes().starts_with(b"application/json")),
+            "{path}"
+        );
+        let bytes = body(response).await;
+        assert!(
+            !bytes
+                .windows(16)
+                .any(|window| window == b"Executor fixture"),
+            "{path}"
+        );
+        assert!(
+            !bytes
+                .windows(PRIVATE_MARKER.len())
+                .any(|window| window == PRIVATE_MARKER.as_bytes()),
+            "{path}"
+        );
+    }
+
+    for path in [
+        "/.env",
+        "/master.key",
+        "/executor.db",
+        "/%2e%2e/private-marker",
+        "/%252e%252e%252fprivate-marker",
+    ] {
+        let response = send(router.clone(), Method::GET, path).await;
+        assert_eq!(response.status(), StatusCode::NOT_FOUND, "{path}");
+        let bytes = body(response).await;
+        assert!(
+            !bytes
+                .windows(PRIVATE_MARKER.len())
+                .any(|window| window == PRIVATE_MARKER.as_bytes()),
+            "{path} leaked a data-directory file"
+        );
+    }
+
+    app.shutdown().await;
+}
+
+async fn send(router: Router, method: Method, uri: &str) -> Response<Body> {
+    router
+        .oneshot(
+            Request::builder()
+                .method(method)
+                .uri(uri)
+                .body(Body::empty())
+                .expect("test request is valid"),
+        )
+        .await
+        .expect("router answers")
+}
+
+async fn body(response: Response<Body>) -> Bytes {
+    response
+        .into_body()
+        .collect()
+        .await
+        .expect("response body collects")
+        .to_bytes()
+}
diff --git a/warden.toml b/warden.toml
index ae63dfeae..dea545b95 100644
--- a/warden.toml
+++ b/warden.toml
@@ -17,18 +17,28 @@ ignorePaths = [
 name = "wrdn-authz"
 remote = "getsentry/warden-skills"
 paths = [
-  "apps/cloud/src/auth/**/*.ts",
-  "apps/cloud/src/api/**/*.ts",
-  "apps/cloud/src/routes/**/*.tsx",
+  "src/api.rs",
+  "src/api/**/*.rs",
+  "src/oauth/**/*.rs",
+  "legacy/cloud/src/auth/**/*.ts",
+  "legacy/cloud/src/api/**/*.ts",
+  "legacy/cloud/src/routes/**/*.tsx",
   "packages/core/api/src/**/*.ts",
 ]
 
 [[skills]]
 name = "wrdn-code-execution"
 remote = "getsentry/warden-skills"
+# Explicit legacy development and test commands can still execute the archived
+# local runtime, so keep its actual source tree in security scan scope.
 paths = [
-  "apps/local/src/server/**/*.ts",
-  "apps/cli/src/**/*.ts",
+  "src/execution.rs",
+  "src/invocation/**/*.rs",
+  "src/mcp/**/*.rs",
+  "src/protocols/**/*.rs",
+  "src/runtime/**/*.rs",
+  "legacy/local/src/**/*.ts",
+  "legacy/cli/src/**/*.ts",
   "packages/core/execution/src/**/*.ts",
   "packages/core/sdk/src/**/*.ts",
   "packages/kernel/**/src/**/*.ts",
@@ -39,10 +49,22 @@ paths = [
 name = "wrdn-data-exfil"
 remote = "getsentry/warden-skills"
 paths = [
-  "apps/cloud/src/api/**/*.ts",
-  "apps/cloud/src/routes/**/*.tsx",
-  "apps/local/src/server/**/*.ts",
-  "packages/core/storage-*/src/**/*.ts",
+  "src/api.rs",
+  "src/api/**/*.rs",
+  "src/catalog/**/*.rs",
+  "src/database.rs",
+  "src/invocation/**/*.rs",
+  "src/mcp/**/*.rs",
+  "src/oauth/**/*.rs",
+  "src/outbound.rs",
+  "src/protocols/**/*.rs",
+  "src/request_logs.rs",
+  "src/runtime/**/*.rs",
+  "legacy/cloud/src/api/**/*.ts",
+  "legacy/cloud/src/auth/**/*.ts",
+  "legacy/cloud/src/routes/**/*.tsx",
+  "legacy/local/src/**/*.ts",
+  "packages/core/api/src/**/*.ts",
   "packages/plugins/**/src/**/*.ts",
   "packages/react/src/api/**/*.tsx",
 ]
@@ -51,19 +73,26 @@ paths = [
 name = "wrdn-pii"
 remote = "getsentry/warden-skills"
 paths = [
-  "apps/cloud/src/**/*.ts",
-  "apps/cloud/src/**/*.tsx",
-  "apps/local/src/**/*.ts",
-  "apps/local/src/**/*.tsx",
-  "packages/core/storage-*/src/**/*.ts",
+  "src/actor.rs",
+  "src/api.rs",
+  "src/api/**/*.rs",
+  "src/approval/**/*.rs",
+  "src/catalog/**/*.rs",
+  "src/crypto.rs",
+  "src/database.rs",
+  "src/oauth/**/*.rs",
+  "src/request_logs.rs",
+  "legacy/cloud/src/**/*.ts",
+  "legacy/cloud/src/**/*.tsx",
+  "legacy/local/src/**/*.ts",
 ]
 
 [[skills]]
 name = "wrdn-gha-workflows"
 remote = "getsentry/warden-skills"
-paths = [".github/workflows/**/*.yml", ".github/workflows/**/*.yaml"]
+paths = [".github/workflows/**/*.yml"]
 
-# Local skill — no `remote =`, resolved from `.agents/skills/<name>/SKILL.md`.
+# Local skill: no `remote =`, resolved from `.agents/skills/<name>/SKILL.md`.
 [[skills]]
 name = "wrdn-effect-atom-optimistic"
 paths = [
diff --git a/web/.gitignore b/web/.gitignore
new file mode 100644
index 000000000..3b462cb0c
--- /dev/null
+++ b/web/.gitignore
@@ -0,0 +1,23 @@
+node_modules
+
+# Output
+.output
+.vercel
+.netlify
+.wrangler
+/.svelte-kit
+/build
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Env
+.env
+.env.*
+!.env.example
+!.env.test
+
+# Vite
+vite.config.js.timestamp-*
+vite.config.ts.timestamp-*
diff --git a/web/.npmrc b/web/.npmrc
new file mode 100644
index 000000000..b6f27f135
--- /dev/null
+++ b/web/.npmrc
@@ -0,0 +1 @@
+engine-strict=true
diff --git a/web/.prettierignore b/web/.prettierignore
new file mode 100644
index 000000000..7d74fe246
--- /dev/null
+++ b/web/.prettierignore
@@ -0,0 +1,9 @@
+# Package Managers
+package-lock.json
+pnpm-lock.yaml
+yarn.lock
+bun.lock
+bun.lockb
+
+# Miscellaneous
+/static/
diff --git a/web/.prettierrc b/web/.prettierrc
new file mode 100644
index 000000000..d59ac024f
--- /dev/null
+++ b/web/.prettierrc
@@ -0,0 +1,7 @@
+{
+  "plugins": ["prettier-plugin-svelte"],
+  "printWidth": 100,
+  "tabWidth": 2,
+  "useTabs": false,
+  "trailingComma": "all"
+}
diff --git a/web/.vscode/extensions.json b/web/.vscode/extensions.json
new file mode 100644
index 000000000..a1f5c8a75
--- /dev/null
+++ b/web/.vscode/extensions.json
@@ -0,0 +1,3 @@
+{
+  "recommendations": ["svelte.svelte-vscode", "esbenp.prettier-vscode"]
+}
diff --git a/web/CHANGELOG.md b/web/CHANGELOG.md
new file mode 100644
index 000000000..ee3cb019f
--- /dev/null
+++ b/web/CHANGELOG.md
@@ -0,0 +1 @@
+# @executor-js/web
diff --git a/web/README.md b/web/README.md
new file mode 100644
index 000000000..9c10c1c59
--- /dev/null
+++ b/web/README.md
@@ -0,0 +1,44 @@
+# Executor web
+
+The Svelte 5 and SvelteKit dashboard is a client-only SPA served from the Rust binary. It talks to
+the Rust control API over the same origin. Release builds embed the generated static files, so the
+installed binary has no Node.js runtime dependency.
+
+## Local checks
+
+Install workspace dependencies from the repository root with `bun install`. From this directory:
+
+```sh
+bun run format:check
+bun run check
+bun run typecheck
+bun run lint
+bun run test
+```
+
+The static adapter writes the production SPA to `web/build`. Build the web output before compiling
+the release binary:
+
+```sh
+bun run --cwd web build
+cargo build --release --locked
+```
+
+The Cargo build fails with an actionable error if the production assets are missing or malformed.
+Normal checks and tests embed deterministic fixture assets instead, so they do not require a web
+build. At runtime, the binary serves exact files with immutable caching and uses `index.html` only
+for safe client-side navigation fallbacks.
+
+The Rust server sends a deny-by-default Content Security Policy. The packaging step derives exact
+SHA-256 hashes for every inline script in the generated HTML, so arbitrary inline scripts remain
+blocked. Inline styles stay allowed for generated attributes. Audit that style allowance against
+the first approved production web build and replace it with hashes or nonces where practical.
+
+## First boot
+
+Start the Rust server using the repository instructions. Open the `/setup#token=...` link printed
+to the terminal. The dashboard removes the one-time token from browser history immediately, creates
+the administrator, signs in, and opens `/sources`.
+
+After setup, sign in at `/login`. Create gateway credentials under `/tokens`. Plaintext API tokens
+are shown once and are never stored by the browser.
diff --git a/web/package.json b/web/package.json
new file mode 100644
index 000000000..7312c8954
--- /dev/null
+++ b/web/package.json
@@ -0,0 +1,33 @@
+{
+  "name": "@executor-js/web",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "build": "vite build",
+    "prepare": "svelte-kit sync",
+    "format": "prettier --write .",
+    "format:check": "prettier --check .",
+    "check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
+    "lint": "oxlint src && prettier --check .",
+    "test": "vitest run",
+    "typecheck": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json"
+  },
+  "devDependencies": {
+    "@effect/vitest": "4.0.0-beta.59",
+    "@sveltejs/adapter-static": "^3.0.10",
+    "@sveltejs/kit": "^2.67.0",
+    "@sveltejs/vite-plugin-svelte": "^7.1.2",
+    "@testing-library/svelte": "^5.4.2",
+    "effect": "4.0.0-beta.59",
+    "jsdom": "^29.1.1",
+    "oxlint": "^1.71.0",
+    "prettier": "^3.8.4",
+    "prettier-plugin-svelte": "^4.1.1",
+    "svelte": "^5.56.4",
+    "svelte-check": "^4.7.0",
+    "typescript": "^6.0.3",
+    "vite": "^8.1.0",
+    "vitest": "^4.1.9"
+  }
+}
diff --git a/web/src/app.d.ts b/web/src/app.d.ts
new file mode 100644
index 000000000..a6911e55f
--- /dev/null
+++ b/web/src/app.d.ts
@@ -0,0 +1,5 @@
+declare global {
+  namespace App {}
+}
+
+export {};
diff --git a/web/src/app.html b/web/src/app.html
new file mode 100644
index 000000000..13f0663a7
--- /dev/null
+++ b/web/src/app.html
@@ -0,0 +1,12 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <meta name="theme-color" content="#0c111d" />
+    %sveltekit.head%
+  </head>
+  <body data-sveltekit-preload-data="hover">
+    <div style="display: contents">%sveltekit.body%</div>
+  </body>
+</html>
diff --git a/web/src/lib/DashboardShell.svelte b/web/src/lib/DashboardShell.svelte
new file mode 100644
index 000000000..25f8a6033
--- /dev/null
+++ b/web/src/lib/DashboardShell.svelte
@@ -0,0 +1,111 @@
+<script lang="ts">
+  import { goto } from "$app/navigation";
+  import { page } from "$app/state";
+  import ErrorNotice from "$lib/ErrorNotice.svelte";
+  import { useAuthState } from "$lib/auth.svelte";
+  import type { ApiError } from "$lib/api";
+  import type { Snippet } from "svelte";
+
+  let {
+    title,
+    description,
+    children,
+    beforeSignOut,
+    onSignOutFailed,
+  }: {
+    title: string;
+    description: string;
+    children: Snippet;
+    beforeSignOut?: () => boolean;
+    onSignOutFailed?: (error: ApiError) => void;
+  } = $props();
+
+  const auth = useAuthState();
+  const navigation = [
+    { href: "/sources", label: "Sources", marker: "01" },
+    { href: "/tools", label: "Tools", marker: "02" },
+    { href: "/approvals", label: "Approvals", marker: "03" },
+    { href: "/logs", label: "Request logs", marker: "04" },
+    { href: "/tokens", label: "API tokens", marker: "05" },
+  ];
+  let logoutBusy = $state(false);
+  let logoutError = $state<ApiError | null>(null);
+  let adminLabel = $derived(auth.username ?? "Administrator");
+
+  function isActive(href: string) {
+    return page.url.pathname === href || page.url.pathname.startsWith(`${href}/`);
+  }
+
+  async function logout() {
+    if (beforeSignOut !== undefined && !beforeSignOut()) return;
+
+    logoutBusy = true;
+    logoutError = null;
+    const result = await auth.signOut();
+    if (!result.ok) {
+      logoutError = result.error;
+      onSignOutFailed?.(result.error);
+    } else {
+      void goto("/login", { replaceState: true });
+    }
+    logoutBusy = false;
+  }
+</script>
+
+<svelte:head>
+  <title>{title} | Executor</title>
+</svelte:head>
+
+<a class="skip-link" href="#main-content">Skip to main content</a>
+
+<div class="app-frame">
+  <aside class="sidebar">
+    <a class="brand" href="/sources" aria-label="Executor home">
+      <span class="brand-mark" aria-hidden="true">EX</span>
+      <span>
+        <strong>Executor</strong>
+        <small>Local gateway</small>
+      </span>
+    </a>
+
+    <nav aria-label="Dashboard">
+      {#each navigation as item}
+        <a
+          class:active={isActive(item.href)}
+          href={item.href}
+          aria-current={isActive(item.href) ? "page" : undefined}
+        >
+          <span class="nav-marker" aria-hidden="true">{item.marker}</span>
+          <span class="nav-label">{item.label}</span>
+        </a>
+      {/each}
+    </nav>
+
+    <div class="instance-card">
+      <div>
+        <strong>Local instance</strong>
+        <small>Self-hosted control plane</small>
+      </div>
+    </div>
+  </aside>
+
+  <main id="main-content" tabindex="-1">
+    <header class="page-header">
+      <div>
+        <p class="eyebrow">Control plane</p>
+        <h1>{title}</h1>
+        <p>{description}</p>
+      </div>
+      <div class="admin-actions">
+        <span>Signed in as <strong>{adminLabel}</strong></span>
+        <button type="button" onclick={logout} disabled={logoutBusy}>
+          {logoutBusy ? "Signing out..." : "Sign out"}
+        </button>
+      </div>
+    </header>
+    {#if logoutError !== null}
+      <div class="shell-notice"><ErrorNotice error={logoutError} /></div>
+    {/if}
+    <section class="page-content">{@render children()}</section>
+  </main>
+</div>
diff --git a/web/src/lib/DashboardShell.test.ts b/web/src/lib/DashboardShell.test.ts
new file mode 100644
index 000000000..5ac76097d
--- /dev/null
+++ b/web/src/lib/DashboardShell.test.ts
@@ -0,0 +1,70 @@
+import { afterEach, describe, expect, it, vi } from "@effect/vitest";
+import { cleanup, fireEvent, render, screen, waitFor, within } from "@testing-library/svelte";
+import { createRawSnippet } from "svelte";
+
+const mocks = {
+  goto: vi.fn(async () => {}),
+  signOut: vi.fn(async () => ({ ok: true as const, value: undefined })),
+};
+
+vi.doMock("$app/navigation", () => ({ goto: mocks.goto }));
+vi.doMock("$app/state", () => ({ page: { url: new URL("http://localhost/tokens") } }));
+vi.doMock("$lib/auth.svelte", () => ({
+  useAuthState: () => ({ username: "admin", signOut: mocks.signOut }),
+}));
+
+const { default: DashboardShell } = await import("./DashboardShell.svelte");
+const children = createRawSnippet(() => ({ render: () => "<p>Page content</p>" }));
+
+afterEach(() => {
+  cleanup();
+  vi.clearAllMocks();
+});
+
+describe("dashboard sign out", () => {
+  it("exposes navigation labels without their visual ordinals", () => {
+    render(DashboardShell, {
+      title: "Sources",
+      description: "Manage sources.",
+      children,
+    });
+
+    const navigation = within(screen.getByRole("navigation", { name: "Dashboard" }));
+    expect(navigation.getByRole("link", { name: /^Tools$/ })).toBeDefined();
+    expect(navigation.queryByRole("link", { name: /^02 Tools$/ })).toBeNull();
+  });
+
+  it("consults a page guard before destroying the session", async () => {
+    let allowSignOut = false;
+    const beforeSignOut = vi.fn(() => allowSignOut);
+    render(DashboardShell, {
+      title: "API tokens",
+      description: "Manage API tokens.",
+      children,
+      beforeSignOut,
+    });
+
+    await fireEvent.click(screen.getByRole("button", { name: "Sign out" }));
+    expect(beforeSignOut).toHaveBeenCalledOnce();
+    expect(mocks.signOut).not.toHaveBeenCalled();
+    expect(mocks.goto).not.toHaveBeenCalled();
+
+    allowSignOut = true;
+    await fireEvent.click(screen.getByRole("button", { name: "Sign out" }));
+    await waitFor(() => expect(mocks.signOut).toHaveBeenCalledOnce());
+    expect(beforeSignOut).toHaveBeenCalledTimes(2);
+    expect(mocks.goto).toHaveBeenCalledWith("/login", { replaceState: true });
+  });
+
+  it("signs out normally when a page does not provide a guard", async () => {
+    render(DashboardShell, {
+      title: "Sources",
+      description: "Manage sources.",
+      children,
+    });
+
+    await fireEvent.click(screen.getByRole("button", { name: "Sign out" }));
+    await waitFor(() => expect(mocks.signOut).toHaveBeenCalledOnce());
+    expect(mocks.goto).toHaveBeenCalledWith("/login", { replaceState: true });
+  });
+});
diff --git a/web/src/lib/ErrorNotice.svelte b/web/src/lib/ErrorNotice.svelte
new file mode 100644
index 000000000..159d20709
--- /dev/null
+++ b/web/src/lib/ErrorNotice.svelte
@@ -0,0 +1,14 @@
+<script lang="ts">
+  import type { ApiError } from "$lib/api";
+
+  let { error }: { error: ApiError } = $props();
+  let message = $derived(error.displayMessage);
+  let requestId = $derived(error.requestId);
+</script>
+
+<div class="notice error" role="alert">
+  <strong>{message}</strong>
+  {#if requestId !== null}
+    <small>Request reference: <code>{requestId}</code></small>
+  {/if}
+</div>
diff --git a/web/src/lib/GraphqlCredentialEditor.svelte b/web/src/lib/GraphqlCredentialEditor.svelte
new file mode 100644
index 000000000..e22a73c03
--- /dev/null
+++ b/web/src/lib/GraphqlCredentialEditor.svelte
@@ -0,0 +1,424 @@
+<script lang="ts">
+  import { tick } from "svelte";
+  import ErrorNotice from "$lib/ErrorNotice.svelte";
+  import type { ApiError, ApiResult, OpenApiCredentialMetadata, Source } from "$lib/api";
+  import { useAuthState } from "$lib/auth.svelte";
+  import { createLatestRequest, unexpectedRequestError } from "$lib/catalog-state";
+  import {
+    buildGraphqlCredential,
+    clearGraphqlSecret,
+    emptyGraphqlAuthDraft,
+    graphqlDraftFromCredentialType,
+    type GraphqlAuthDraft,
+    type GraphqlCredential,
+  } from "$lib/graphql-source-state";
+
+  let {
+    source,
+    load,
+    save,
+    onbusychange,
+    onmutationchange,
+    disabled = false,
+  }: {
+    source: Source;
+    load: (sourceId: string, signal: AbortSignal) => Promise<ApiResult<OpenApiCredentialMetadata>>;
+    save: (
+      sourceId: string,
+      expectedRevision: number,
+      credential: GraphqlCredential,
+      signal: AbortSignal,
+    ) => Promise<ApiResult<OpenApiCredentialMetadata>>;
+    onbusychange?: (busy: boolean) => void;
+    onmutationchange?: (busy: boolean) => void;
+    disabled?: boolean;
+  } = $props();
+
+  const auth = useAuthState();
+  const latest = createLatestRequest();
+  let open = $state(false);
+  let loading = $state(false);
+  let saving = $state(false);
+  let confirmingClear = $state(false);
+  let revision = $state<number | null>(null);
+  let error = $state<ApiError | null>(null);
+  let notice = $state<string | null>(null);
+  let draft = $state<GraphqlAuthDraft>(emptyGraphqlAuthDraft());
+  let credential = $derived(buildGraphqlCredential(draft));
+  let cleanupLoad: (() => void) | null = null;
+  let saveController: AbortController | null = null;
+  let lifetime = 0;
+  let observedSourceId: string | null = null;
+  let reportedBusy = false;
+  let reportedMutation = false;
+
+  $effect(() => {
+    lifetime += 1;
+    return () => {
+      lifetime += 1;
+      cleanupLoad?.();
+      saveController?.abort();
+      draft = clearGraphqlSecret(draft);
+      if (reportedBusy) onbusychange?.(false);
+      if (reportedMutation) onmutationchange?.(false);
+    };
+  });
+
+  $effect(() => {
+    const busy = loading || saving;
+    if (busy === reportedBusy) return;
+    reportedBusy = busy;
+    onbusychange?.(busy);
+  });
+
+  $effect(() => {
+    if (saving === reportedMutation) return;
+    reportedMutation = saving;
+    onmutationchange?.(saving);
+  });
+
+  $effect(() => {
+    if (!disabled) {
+      if (open && revision === null && !loading && error === null) loadEditor(source.id);
+      return;
+    }
+
+    confirmingClear = false;
+    if (cleanupLoad !== null) {
+      cleanupLoad();
+      cleanupLoad = null;
+      loading = false;
+      revision = null;
+      error = null;
+    }
+    if (saveController !== null) {
+      saveController.abort();
+      saveController = null;
+      saving = false;
+      revision = null;
+      error = null;
+      draft = clearGraphqlSecret(draft);
+    }
+  });
+
+  $effect(() => {
+    const sourceId = source.id;
+    if (observedSourceId === null) {
+      observedSourceId = sourceId;
+      return;
+    }
+    if (observedSourceId === sourceId) return;
+
+    observedSourceId = sourceId;
+    const shouldReload = open;
+    resetEditorState();
+    notice = null;
+    open = shouldReload;
+    if (shouldReload) loadEditor(sourceId);
+  });
+
+  function toggle() {
+    if (open) {
+      closeEditor();
+      return;
+    }
+    open = true;
+    notice = null;
+    loadEditor(source.id);
+  }
+
+  function loadEditor(sourceId: string) {
+    loading = true;
+    error = null;
+    revision = null;
+    confirmingClear = false;
+    draft = emptyGraphqlAuthDraft();
+    cleanupLoad = latest.start(
+      (signal) => load(sourceId, signal),
+      (result) => {
+        cleanupLoad = null;
+        loading = false;
+        if (!result.ok) {
+          if (!auth?.recoverFromApiError(result.error)) error = result.error;
+          return;
+        }
+        draft = graphqlDraftFromCredentialType(result.value.configuredSchemes[0]?.credentialType);
+        revision = result.value.revision;
+      },
+      () => {
+        cleanupLoad = null;
+        loading = false;
+        error = unexpectedRequestError();
+      },
+    );
+  }
+
+  function changeAuthType() {
+    draft = { ...draft, headerName: "", username: "", secret: "" };
+    confirmingClear = false;
+  }
+
+  async function saveReplacement(event: SubmitEvent) {
+    event.preventDefault();
+    const currentCredential = credential;
+    if (currentCredential === null || currentCredential === undefined) return;
+    await persist(currentCredential, "Credentials replaced. Secret values remain hidden.");
+  }
+
+  async function clearCredentials() {
+    await persist(null, "Credentials cleared for this source.");
+  }
+
+  async function persist(nextCredential: GraphqlCredential, successNotice: string) {
+    const expectedRevision = revision;
+    if (disabled || saving || expectedRevision === null) return;
+    const sourceId = source.id;
+
+    saveController?.abort();
+    const controller = new AbortController();
+    const owner = lifetime;
+    saveController = controller;
+    saving = true;
+    error = null;
+    notice = null;
+    draft = clearGraphqlSecret(draft);
+    const settled = await save(sourceId, expectedRevision, nextCredential, controller.signal).then(
+      (result) => ({ ok: true, result }) as const,
+      () => ({ ok: false }) as const,
+    );
+    if (owner !== lifetime || saveController !== controller || controller.signal.aborted) return;
+    saveController = null;
+    saving = false;
+
+    if (!settled.ok) {
+      error = unexpectedRequestError();
+      await focusEditorError();
+      return;
+    }
+    if (!settled.result.ok) {
+      if (auth?.recoverFromApiError(settled.result.error)) return;
+      if (settled.result.error.status === 409) revision = null;
+      confirmingClear = false;
+      error = settled.result.error;
+      await focusEditorError();
+      return;
+    }
+
+    revision = settled.result.value.revision;
+    open = false;
+    confirmingClear = false;
+    notice = successNotice;
+    await tick();
+    document.getElementById(`graphql-credential-status-${source.id}`)?.focus();
+  }
+
+  function beginClear() {
+    if (disabled) return;
+    draft = clearGraphqlSecret(draft);
+    confirmingClear = true;
+    void tick().then(() => document.getElementById(`graphql-cancel-clear-${source.id}`)?.focus());
+  }
+
+  function cancelClear() {
+    confirmingClear = false;
+    void tick().then(() =>
+      document.getElementById(`graphql-clear-credentials-${source.id}`)?.focus(),
+    );
+  }
+
+  function closeEditor() {
+    resetEditorState();
+    void tick().then(() => document.getElementById(`graphql-credentials-${source.id}`)?.focus());
+  }
+
+  function resetEditorState() {
+    cleanupLoad?.();
+    cleanupLoad = null;
+    saveController?.abort();
+    saveController = null;
+    open = false;
+    loading = false;
+    saving = false;
+    confirmingClear = false;
+    error = null;
+    revision = null;
+    draft = emptyGraphqlAuthDraft();
+  }
+
+  async function focusEditorError() {
+    await tick();
+    document.getElementById(`graphql-credential-error-${source.id}`)?.focus();
+  }
+</script>
+
+<button
+  id={`graphql-credentials-${source.id}`}
+  type="button"
+  {disabled}
+  aria-expanded={open}
+  aria-controls={`graphql-credential-editor-${source.id}`}
+  onclick={toggle}
+>
+  {open ? "Close credentials" : "Manage credentials"}
+</button>
+
+{#if notice !== null}
+  <p id={`graphql-credential-status-${source.id}`} class="notice" role="status" tabindex="-1">
+    {notice}
+  </p>
+{/if}
+
+{#if open}
+  <form
+    id={`graphql-credential-editor-${source.id}`}
+    class="credential-editor"
+    aria-label={`Credentials for ${source.displayName}`}
+    onsubmit={saveReplacement}
+  >
+    <div>
+      <h3>Replace credentials</h3>
+      <p>Existing values are hidden. Saving replaces the complete credential set.</p>
+    </div>
+
+    {#if loading}
+      <p aria-live="polite">Loading credential metadata...</p>
+    {:else if revision !== null}
+      <fieldset disabled={disabled || saving}>
+        <legend>GraphQL authentication</legend>
+        <label>
+          Method
+          <select bind:value={draft.type} onchange={changeAuthType}>
+            <option value="none">None</option>
+            <option value="bearer">Bearer token</option>
+            <option value="basic">Basic auth</option>
+            <option value="api_key_header">API key header</option>
+            <option value="oauth_access_token">OAuth access token (manual, advanced)</option>
+          </select>
+        </label>
+        {#if draft.type === "api_key_header"}
+          <label>
+            Header name
+            <input required autocomplete="off" bind:value={draft.headerName} />
+          </label>
+        {/if}
+        {#if draft.type === "basic"}
+          <label>
+            Username
+            <input required autocomplete="off" bind:value={draft.username} />
+          </label>
+        {/if}
+        {#if draft.type !== "none"}
+          <label>
+            {draft.type === "bearer"
+              ? "Bearer token"
+              : draft.type === "basic"
+                ? "Password"
+                : draft.type === "oauth_access_token"
+                  ? "OAuth access token"
+                  : "Header value"}
+            <input type="password" required autocomplete="off" bind:value={draft.secret} />
+          </label>
+        {/if}
+      </fieldset>
+    {/if}
+
+    {#if error !== null}
+      <div id={`graphql-credential-error-${source.id}`} tabindex="-1"><ErrorNotice {error} /></div>
+    {/if}
+    <div class="button-row">
+      <button type="button" disabled={saving} onclick={closeEditor}>Cancel</button>
+      <button
+        type="submit"
+        class="primary"
+        disabled={disabled ||
+          loading ||
+          saving ||
+          revision === null ||
+          credential === null ||
+          credential === undefined}
+      >
+        {saving ? "Saving..." : "Save replacement"}
+      </button>
+      {#if confirmingClear}
+        <span
+          class="confirmation-actions"
+          role="group"
+          aria-label={`Confirm clearing credentials for ${source.displayName}`}
+        >
+          <button
+            id={`graphql-cancel-clear-${source.id}`}
+            type="button"
+            disabled={disabled || saving}
+            onkeydown={(event) => {
+              if (event.key === "Escape") cancelClear();
+            }}
+            onclick={cancelClear}>Cancel clear</button
+          >
+          <button
+            type="button"
+            class="danger-button"
+            disabled={disabled || saving || revision === null}
+            onkeydown={(event) => {
+              if (event.key === "Escape") cancelClear();
+            }}
+            onclick={clearCredentials}>Confirm clear</button
+          >
+        </span>
+      {:else}
+        <button
+          id={`graphql-clear-credentials-${source.id}`}
+          type="button"
+          class="danger-link"
+          disabled={disabled || loading || saving || revision === null}
+          onclick={beginClear}>Clear credentials</button
+        >
+      {/if}
+    </div>
+  </form>
+{/if}
+
+<style>
+  .credential-editor,
+  fieldset {
+    display: grid;
+    gap: 0.85rem;
+  }
+
+  .credential-editor {
+    flex-basis: 100%;
+    width: 100%;
+    border-top: 1px solid #293247;
+    padding-top: 1rem;
+  }
+
+  .credential-editor h3,
+  .credential-editor p {
+    margin: 0;
+  }
+
+  .credential-editor > div:first-child p {
+    margin-top: 0.3rem;
+    color: #9da8bb;
+    font-size: 0.78rem;
+  }
+
+  fieldset {
+    min-width: 0;
+    margin: 0;
+    border: 1px solid #293247;
+    border-radius: 10px;
+    padding: 0.85rem;
+    background: #0d131d;
+  }
+
+  legend {
+    padding: 0 0.35rem;
+    color: #aeb8ca;
+    font-size: 0.72rem;
+    font-weight: 750;
+  }
+
+  .confirmation-actions {
+    display: contents;
+  }
+</style>
diff --git a/web/src/lib/GraphqlCredentialEditor.test.ts b/web/src/lib/GraphqlCredentialEditor.test.ts
new file mode 100644
index 000000000..781cba7d2
--- /dev/null
+++ b/web/src/lib/GraphqlCredentialEditor.test.ts
@@ -0,0 +1,376 @@
+import { afterEach, describe, expect, it, vi } from "@effect/vitest";
+import { cleanup, fireEvent, render, screen, waitFor } from "@testing-library/svelte";
+import { ApiError, type ApiResult, type OpenApiCredentialMetadata, type Source } from "./api";
+import GraphqlCredentialEditor from "./GraphqlCredentialEditor.svelte";
+import type { GraphqlCredential } from "./graphql-source-state";
+
+function sourceFixture(id = "graphql-source"): Source {
+  return {
+    id,
+    kind: "graphql",
+    slug: "product",
+    displayName: "Product API",
+    description: null,
+    configuration: {
+      endpoint: "https://api.example.test/graphql?token=hidden",
+      allowPrivateNetwork: false,
+    },
+    modeOverride: null,
+    healthStatus: "healthy",
+    healthErrorCode: null,
+    revision: 1,
+    catalogRevision: 1,
+    createdAt: 100,
+    updatedAt: 100,
+    lastRefreshedAt: 100,
+    toolCount: 4,
+    tombstonedToolCount: 0,
+  };
+}
+
+function metadata(
+  revision: number,
+  credentialType: "bearer" | "basic" | "api_key_header" | "oauth_access_token" = "bearer",
+): OpenApiCredentialMetadata {
+  return {
+    revision,
+    configuredSchemes: [{ name: "default", credentialType }],
+  };
+}
+
+function deferred<Value>() {
+  let resolve = (_value: Value) => {};
+  const promise = new Promise<Value>((complete) => {
+    resolve = complete;
+  });
+  return { promise, resolve };
+}
+
+afterEach(cleanup);
+
+describe("GraphQL credential editor", () => {
+  it("replaces credentials with the metadata CAS revision", async () => {
+    const load = vi.fn(async () => ({ ok: true, value: metadata(4) }) as const);
+    const saves: Array<{ revision: number; credential: GraphqlCredential }> = [];
+    const save = vi.fn(
+      async (_sourceId: string, revision: number, credential: GraphqlCredential) => {
+        saves.push({ revision, credential });
+        return { ok: true, value: metadata(5, "api_key_header") } as const;
+      },
+    );
+    render(GraphqlCredentialEditor, { source: sourceFixture(), load, save });
+    await fireEvent.click(screen.getByRole("button", { name: "Manage credentials" }));
+    const method = await screen.findByLabelText("Method");
+    await fireEvent.change(method, { target: { value: "api_key_header" } });
+    await fireEvent.input(screen.getByLabelText("Header name"), {
+      target: { value: " X-Service-Key " },
+    });
+    await fireEvent.input(screen.getByLabelText("Header value"), {
+      target: { value: " exact key " },
+    });
+    await fireEvent.click(screen.getByRole("button", { name: "Save replacement" }));
+
+    await waitFor(() => expect(screen.getByRole("status")).toBeDefined());
+    expect(saves).toEqual([
+      {
+        revision: 4,
+        credential: { type: "api_key_header", name: "X-Service-Key", value: " exact key " },
+      },
+    ]);
+    expect(document.body.textContent).not.toContain("exact key");
+    expect(document.body.textContent).not.toContain("token=hidden");
+    expect(document.activeElement).toBe(
+      document.getElementById("graphql-credential-status-graphql-source"),
+    );
+  });
+
+  it("requires explicit confirmation and clears credentials with CAS", async () => {
+    const load = vi.fn(async () => ({ ok: true, value: metadata(7) }) as const);
+    const save = vi.fn(async () => ({ ok: true, value: metadata(8) }) as const);
+    render(GraphqlCredentialEditor, { source: sourceFixture(), load, save });
+    await fireEvent.click(screen.getByRole("button", { name: "Manage credentials" }));
+    await screen.findByLabelText("Method");
+    await fireEvent.click(screen.getByRole("button", { name: "Clear credentials" }));
+    expect(document.activeElement).toBe(
+      document.getElementById("graphql-cancel-clear-graphql-source"),
+    );
+    await fireEvent.click(screen.getByRole("button", { name: "Confirm clear" }));
+
+    await waitFor(() => expect(screen.getByRole("status")).toBeDefined());
+    expect(save).toHaveBeenCalledWith("graphql-source", 7, null, expect.any(AbortSignal));
+  });
+
+  it("clears secret input and disables saving after a CAS conflict", async () => {
+    const load = vi.fn(async () => ({ ok: true, value: metadata(4) }) as const);
+    const save = vi.fn(
+      async () =>
+        ({
+          ok: false,
+          error: new ApiError({
+            code: "revision_conflict",
+            displayMessage: "Credentials changed elsewhere.",
+            requestId: "request-conflict",
+            status: 409,
+          }),
+        }) as const,
+    );
+    render(GraphqlCredentialEditor, { source: sourceFixture(), load, save });
+    await fireEvent.click(screen.getByRole("button", { name: "Manage credentials" }));
+    const secret = await screen.findByLabelText<HTMLInputElement>("Bearer token");
+    await fireEvent.input(secret, { target: { value: "clear-after-conflict" } });
+    await fireEvent.click(screen.getByRole("button", { name: "Save replacement" }));
+
+    await waitFor(() => expect(screen.getByRole("alert")).toBeDefined());
+    await waitFor(() => expect(screen.queryByLabelText("Bearer token")).toBeNull());
+    expect(document.body.textContent).not.toContain("clear-after-conflict");
+    expect(document.activeElement).toBe(
+      document.getElementById("graphql-credential-error-graphql-source"),
+    );
+    expect(
+      screen.getByRole<HTMLButtonElement>("button", { name: "Save replacement" }).disabled,
+    ).toBe(true);
+  });
+
+  it("aborts metadata loading and ignores its completion after unmount", async () => {
+    const response = deferred<ApiResult<OpenApiCredentialMetadata>>();
+    const request = { signal: null as AbortSignal | null };
+    const load = vi.fn((_sourceId: string, signal: AbortSignal) => {
+      request.signal = signal;
+      return response.promise;
+    });
+    const save = vi.fn();
+    const mounted = render(GraphqlCredentialEditor, { source: sourceFixture(), load, save });
+    await fireEvent.click(screen.getByRole("button", { name: "Manage credentials" }));
+    mounted.unmount();
+
+    expect(request.signal?.aborted).toBe(true);
+    response.resolve({ ok: true, value: metadata(3) });
+    await response.promise;
+    await Promise.resolve();
+    expect(save).not.toHaveBeenCalled();
+  });
+
+  it("reports only credential writes as mutations and clears the fence on unmount", async () => {
+    const response = deferred<ApiResult<OpenApiCredentialMetadata>>();
+    const request = { signal: null as AbortSignal | null };
+    const load = vi.fn(async () => ({ ok: true, value: metadata(4) }) as const);
+    const save = vi.fn(
+      (
+        _sourceId: string,
+        _revision: number,
+        _credential: GraphqlCredential,
+        signal: AbortSignal,
+      ) => {
+        request.signal = signal;
+        return response.promise;
+      },
+    );
+    const onmutationchange = vi.fn();
+    const mounted = render(GraphqlCredentialEditor, {
+      source: sourceFixture(),
+      load,
+      save,
+      onmutationchange,
+    });
+
+    await fireEvent.click(screen.getByRole("button", { name: "Manage credentials" }));
+    const token = await screen.findByLabelText("Bearer token");
+    expect(onmutationchange).not.toHaveBeenCalled();
+    await fireEvent.input(token, { target: { value: "pending-secret" } });
+    await fireEvent.click(screen.getByRole("button", { name: "Save replacement" }));
+    await waitFor(() => expect(onmutationchange).toHaveBeenLastCalledWith(true));
+
+    mounted.unmount();
+    expect(request.signal?.aborted).toBe(true);
+    expect(onmutationchange).toHaveBeenLastCalledWith(false);
+    response.resolve({ ok: true, value: metadata(5) });
+    await response.promise;
+  });
+
+  it("aborts an old metadata load and rejects it after the source changes", async () => {
+    const first = deferred<ApiResult<OpenApiCredentialMetadata>>();
+    const second = deferred<ApiResult<OpenApiCredentialMetadata>>();
+    const firstRequest = { signal: null as AbortSignal | null };
+    const load = vi.fn((sourceId: string, signal: AbortSignal) => {
+      if (sourceId === "source-a") {
+        firstRequest.signal = signal;
+        return first.promise;
+      }
+      return second.promise;
+    });
+    const save = vi.fn();
+    const mounted = render(GraphqlCredentialEditor, {
+      source: sourceFixture("source-a"),
+      load,
+      save,
+    });
+    await fireEvent.click(screen.getByRole("button", { name: "Manage credentials" }));
+    await mounted.rerender({ source: sourceFixture("source-b"), load, save });
+
+    await waitFor(() => expect(load).toHaveBeenCalledTimes(2));
+    expect(firstRequest.signal?.aborted).toBe(true);
+    second.resolve({ ok: true, value: metadata(8, "basic") });
+    await screen.findByLabelText("Username");
+    first.resolve({ ok: true, value: metadata(3, "bearer") });
+    await first.promise;
+    await Promise.resolve();
+    expect(screen.queryByLabelText("Bearer token")).toBeNull();
+  });
+
+  it("reloads the CAS revision before saving after an open source changes", async () => {
+    const load = vi.fn(async (sourceId: string) =>
+      sourceId === "source-a"
+        ? ({ ok: true, value: metadata(4) } as const)
+        : ({ ok: true, value: metadata(9, "basic") } as const),
+    );
+    const save = vi.fn(async () => ({ ok: true, value: metadata(10, "basic") }) as const);
+    const mounted = render(GraphqlCredentialEditor, {
+      source: sourceFixture("source-a"),
+      load,
+      save,
+    });
+    await fireEvent.click(screen.getByRole("button", { name: "Manage credentials" }));
+    await screen.findByLabelText("Bearer token");
+    await mounted.rerender({ source: sourceFixture("source-b"), load, save });
+    await screen.findByLabelText("Username");
+    await fireEvent.input(screen.getByLabelText("Username"), { target: { value: "operator" } });
+    await fireEvent.input(screen.getByLabelText("Password"), { target: { value: "password" } });
+    await fireEvent.click(screen.getByRole("button", { name: "Save replacement" }));
+
+    await waitFor(() => expect(save).toHaveBeenCalledOnce());
+    expect(save).toHaveBeenCalledWith(
+      "source-b",
+      9,
+      { type: "basic", username: "operator", password: "password" },
+      expect.any(AbortSignal),
+    );
+  });
+
+  it("aborts a pending save and rejects its completion after the source changes", async () => {
+    const pendingSave = deferred<ApiResult<OpenApiCredentialMetadata>>();
+    const saveRequest = { signal: null as AbortSignal | null };
+    const load = vi.fn(async (sourceId: string) =>
+      sourceId === "source-a"
+        ? ({ ok: true, value: metadata(4) } as const)
+        : ({ ok: true, value: metadata(9, "basic") } as const),
+    );
+    const save = vi.fn(
+      (
+        _sourceId: string,
+        _revision: number,
+        _credential: GraphqlCredential,
+        signal: AbortSignal,
+      ) => {
+        saveRequest.signal = signal;
+        return pendingSave.promise;
+      },
+    );
+    const mounted = render(GraphqlCredentialEditor, {
+      source: sourceFixture("source-a"),
+      load,
+      save,
+    });
+    await fireEvent.click(screen.getByRole("button", { name: "Manage credentials" }));
+    const token = await screen.findByLabelText("Bearer token");
+    await fireEvent.input(token, { target: { value: "source-a-token" } });
+    await fireEvent.click(screen.getByRole("button", { name: "Save replacement" }));
+    await mounted.rerender({ source: sourceFixture("source-b"), load, save });
+
+    await screen.findByLabelText("Username");
+    expect(saveRequest.signal?.aborted).toBe(true);
+    pendingSave.resolve({ ok: true, value: metadata(5) });
+    await pendingSave.promise;
+    await Promise.resolve();
+    expect(screen.getByRole("button", { name: "Close credentials" })).toBeDefined();
+    expect(screen.queryByRole("status")).toBeNull();
+    expect(screen.queryByLabelText("Bearer token")).toBeNull();
+  });
+
+  it("clears a completed source notice when the source identity changes", async () => {
+    const load = vi.fn(async () => ({ ok: true, value: metadata(4) }) as const);
+    const save = vi.fn(async () => ({ ok: true, value: metadata(5) }) as const);
+    const mounted = render(GraphqlCredentialEditor, {
+      source: sourceFixture("source-a"),
+      load,
+      save,
+    });
+    await fireEvent.click(screen.getByRole("button", { name: "Manage credentials" }));
+    const token = await screen.findByLabelText("Bearer token");
+    await fireEvent.input(token, { target: { value: "source-a-token" } });
+    await fireEvent.click(screen.getByRole("button", { name: "Save replacement" }));
+    await waitFor(() => expect(screen.getByRole("status")).toBeDefined());
+
+    await mounted.rerender({ source: sourceFixture("source-b"), load, save });
+    await waitFor(() => expect(screen.queryByRole("status")).toBeNull());
+    expect(screen.getByRole("button", { name: "Manage credentials" })).toBeDefined();
+  });
+
+  it("disables an open editor while a card operation is active", async () => {
+    const load = vi.fn(async () => ({ ok: true, value: metadata(4) }) as const);
+    const save = vi.fn();
+    const mounted = render(GraphqlCredentialEditor, {
+      source: sourceFixture(),
+      load,
+      save,
+      disabled: false,
+    });
+    await fireEvent.click(screen.getByRole("button", { name: "Manage credentials" }));
+    const method = await screen.findByLabelText<HTMLSelectElement>("Method");
+    await mounted.rerender({ source: sourceFixture(), load, save, disabled: true });
+
+    await waitFor(() => expect(method.closest("fieldset")?.hasAttribute("disabled")).toBe(true));
+    expect(
+      screen.getByRole<HTMLButtonElement>("button", { name: "Close credentials" }).disabled,
+    ).toBe(true);
+    expect(
+      screen.getByRole<HTMLButtonElement>("button", { name: "Save replacement" }).disabled,
+    ).toBe(true);
+    expect(
+      screen.getByRole<HTMLButtonElement>("button", { name: "Clear credentials" }).disabled,
+    ).toBe(true);
+    expect(save).not.toHaveBeenCalled();
+  });
+
+  it("reports save activity and aborts it when an external card operation starts", async () => {
+    const response = deferred<ApiResult<OpenApiCredentialMetadata>>();
+    const request = { signal: null as AbortSignal | null };
+    const load = vi.fn(async () => ({ ok: true, value: metadata(4) }) as const);
+    const save = vi.fn(
+      (
+        _sourceId: string,
+        _revision: number,
+        _credential: GraphqlCredential,
+        signal: AbortSignal,
+      ) => {
+        request.signal = signal;
+        return response.promise;
+      },
+    );
+    const onbusychange = vi.fn();
+    const mounted = render(GraphqlCredentialEditor, {
+      source: sourceFixture(),
+      load,
+      save,
+      onbusychange,
+      disabled: false,
+    });
+    await fireEvent.click(screen.getByRole("button", { name: "Manage credentials" }));
+    const token = await screen.findByLabelText("Bearer token");
+    await fireEvent.input(token, { target: { value: "credential-secret" } });
+    await fireEvent.click(screen.getByRole("button", { name: "Save replacement" }));
+    await waitFor(() => expect(onbusychange).toHaveBeenLastCalledWith(true));
+
+    await mounted.rerender({
+      source: sourceFixture(),
+      load,
+      save,
+      onbusychange,
+      disabled: true,
+    });
+    await waitFor(() => expect(request.signal?.aborted).toBe(true));
+    await waitFor(() => expect(onbusychange).toHaveBeenLastCalledWith(false));
+    expect(document.body.textContent).not.toContain("credential-secret");
+    response.resolve({ ok: true, value: metadata(5) });
+    await response.promise;
+  });
+});
diff --git a/web/src/lib/GraphqlSourceForm.svelte b/web/src/lib/GraphqlSourceForm.svelte
new file mode 100644
index 000000000..9da1802b7
--- /dev/null
+++ b/web/src/lib/GraphqlSourceForm.svelte
@@ -0,0 +1,332 @@
+<script lang="ts">
+  import { tick } from "svelte";
+  import ErrorNotice from "$lib/ErrorNotice.svelte";
+  import type { ApiError, ApiResult, Source } from "$lib/api";
+  import { useAuthState } from "$lib/auth.svelte";
+  import { unexpectedRequestError } from "$lib/catalog-state";
+  import {
+    buildGraphqlCredential,
+    clearGraphqlSecret,
+    emptyGraphqlAuthDraft,
+    normalizeGraphqlEndpoint,
+    requiresGraphqlPrivateNetworkOptIn,
+    type GraphqlAuthDraft,
+    type GraphqlSourceInput,
+  } from "$lib/graphql-source-state";
+  let {
+    create,
+    oncreated,
+    onbusychange,
+    disabled = false,
+  }: {
+    create: (input: GraphqlSourceInput, signal: AbortSignal) => Promise<ApiResult<Source>>;
+    oncreated?: (source: Source) => void;
+    onbusychange?: (busy: boolean) => void;
+    disabled?: boolean;
+  } = $props();
+
+  const auth = useAuthState();
+  let endpoint = $state("");
+  let displayName = $state("");
+  let preferredSlug = $state("");
+  let description = $state("");
+  let allowPrivateNetwork = $state(false);
+  let credentialDraft = $state<GraphqlAuthDraft>(emptyGraphqlAuthDraft());
+  let busy = $state(false);
+  let error = $state<ApiError | null>(null);
+  let credential = $derived(buildGraphqlCredential(credentialDraft));
+  let normalizedEndpoint = $derived(normalizeGraphqlEndpoint(endpoint));
+  let endpointInvalid = $derived(endpoint.trim() !== "" && normalizedEndpoint === null);
+  let localOptInMissing = $derived(
+    endpoint.trim() !== "" && requiresGraphqlPrivateNetworkOptIn(endpoint) && !allowPrivateNetwork,
+  );
+  let activeController: AbortController | null = null;
+  let lifetime = 0;
+  let reportedBusy = false;
+
+  $effect(() => {
+    lifetime += 1;
+    return () => {
+      lifetime += 1;
+      activeController?.abort();
+      activeController = null;
+      credentialDraft = clearGraphqlSecret(credentialDraft);
+      if (reportedBusy) onbusychange?.(false);
+    };
+  });
+
+  $effect(() => {
+    if (busy === reportedBusy) return;
+    reportedBusy = busy;
+    onbusychange?.(busy);
+  });
+
+  function changeAuthType() {
+    credentialDraft = {
+      ...credentialDraft,
+      headerName: "",
+      username: "",
+      secret: "",
+    };
+  }
+
+  async function connect(event: SubmitEvent) {
+    event.preventDefault();
+    const currentCredential = credential;
+    const currentEndpoint = normalizedEndpoint;
+    if (
+      busy ||
+      disabled ||
+      localOptInMissing ||
+      currentCredential === undefined ||
+      currentEndpoint === null
+    ) {
+      return;
+    }
+
+    activeController?.abort();
+    const controller = new AbortController();
+    const owner = lifetime;
+    activeController = controller;
+    busy = true;
+    error = null;
+    credentialDraft = clearGraphqlSecret(credentialDraft);
+    const result = await create(
+      {
+        kind: "graphql",
+        displayName: displayName.trim(),
+        ...(preferredSlug.trim() ? { preferredSlug: preferredSlug.trim() } : {}),
+        ...(description.trim() ? { description: description.trim() } : {}),
+        endpoint: currentEndpoint,
+        allowPrivateNetwork,
+        ...(currentCredential === null ? {} : { credential: currentCredential }),
+      },
+      controller.signal,
+    ).then(
+      (response) => response,
+      () => ({ ok: false, error: unexpectedRequestError() }) as const,
+    );
+    if (owner !== lifetime || activeController !== controller || controller.signal.aborted) return;
+
+    activeController = null;
+    busy = false;
+
+    if (!result.ok) {
+      if (!auth?.recoverFromApiError(result.error)) {
+        error = result.error;
+        await focusError();
+      }
+      return;
+    }
+
+    const source = result.value;
+    endpoint = "";
+    displayName = "";
+    preferredSlug = "";
+    description = "";
+    allowPrivateNetwork = false;
+    credentialDraft = emptyGraphqlAuthDraft();
+    oncreated?.(source);
+  }
+
+  async function focusError() {
+    await tick();
+    document.getElementById("graphql-source-error")?.focus();
+  }
+</script>
+
+<form class="graphql-form" onsubmit={connect} aria-labelledby="graphql-form-title">
+  <fieldset disabled={busy || disabled}>
+    <legend id="graphql-form-title">GraphQL API</legend>
+    <p>Connect an introspection-enabled GraphQL endpoint and import its queries and mutations.</p>
+    <label>
+      Endpoint
+      <input
+        type="url"
+        required
+        bind:value={endpoint}
+        placeholder="https://api.example.com/graphql"
+        aria-invalid={endpointInvalid}
+        aria-describedby={endpointInvalid
+          ? "graphql-endpoint-error graphql-connection-policy"
+          : "graphql-connection-policy"}
+      />
+    </label>
+    {#if endpointInvalid}
+      <p id="graphql-endpoint-error" class="field-error">
+        Use HTTPS without user info, query parameters, or fragments. Plain HTTP is allowed only for
+        loopback development. Put secrets in Authentication.
+      </p>
+    {/if}
+    <label>
+      Source name
+      <input required maxlength="120" bind:value={displayName} placeholder="Product API" />
+    </label>
+    <label>
+      Preferred slug (optional)
+      <input maxlength="80" autocomplete="off" bind:value={preferredSlug} placeholder="product" />
+    </label>
+    <label>
+      Description (optional)
+      <input maxlength="500" bind:value={description} />
+    </label>
+    <label class="checkbox-label private-network-choice">
+      <input type="checkbox" bind:checked={allowPrivateNetwork} />
+      Allow private network addresses for this source
+    </label>
+    <p class="field-help">
+      This permits loopback and private-network targets. Link-local and cloud metadata targets stay
+      blocked.
+    </p>
+    <fieldset class="auth-fields">
+      <legend>Authentication</legend>
+      <label>
+        Method
+        <select bind:value={credentialDraft.type} onchange={changeAuthType}>
+          <option value="none">None</option>
+          <option value="bearer">Bearer token</option>
+          <option value="basic">Basic auth</option>
+          <option value="api_key_header">API key header</option>
+          <option value="oauth_access_token">OAuth access token (manual, advanced)</option>
+        </select>
+      </label>
+      {#if credentialDraft.type === "api_key_header"}
+        <label>
+          Header name
+          <input required autocomplete="off" bind:value={credentialDraft.headerName} />
+        </label>
+      {/if}
+      {#if credentialDraft.type === "basic"}
+        <label>
+          Username
+          <input required autocomplete="off" bind:value={credentialDraft.username} />
+        </label>
+      {/if}
+      {#if credentialDraft.type !== "none"}
+        <label>
+          {credentialDraft.type === "bearer"
+            ? "Bearer token"
+            : credentialDraft.type === "basic"
+              ? "Password"
+              : credentialDraft.type === "oauth_access_token"
+                ? "OAuth access token"
+                : "Header value"}
+          <input type="password" required autocomplete="off" bind:value={credentialDraft.secret} />
+        </label>
+      {/if}
+      {#if credentialDraft.type === "oauth_access_token"}
+        <p class="field-help">Paste an access token managed outside Executor.</p>
+      {/if}
+      <p class="field-help">Credentials are encrypted locally and never shown again.</p>
+    </fieldset>
+    {#if localOptInMissing}
+      <p class="notice warning" role="status">
+        This looks like a local or private endpoint. Enable private network access to connect it.
+      </p>
+    {/if}
+  </fieldset>
+
+  <dl id="graphql-connection-policy" class="connection-policy">
+    <div>
+      <dt>Introspection</dt>
+      <dd>Required when connecting and refreshing</dd>
+    </div>
+    <div>
+      <dt>Redirects</dt>
+      <dd>Disabled</dd>
+    </div>
+    <div>
+      <dt>Proxies</dt>
+      <dd>Ignored, Executor connects directly</dd>
+    </div>
+  </dl>
+
+  {#if error !== null}
+    <div id="graphql-source-error" tabindex="-1"><ErrorNotice {error} /></div>
+  {/if}
+  <p class="field-help">
+    Queries start Enabled, mutations start Ask, and deprecated operations start Disabled. Review or
+    change any mode from Tools after connecting.
+  </p>
+  <button
+    class="primary"
+    type="submit"
+    disabled={busy ||
+      disabled ||
+      localOptInMissing ||
+      normalizedEndpoint === null ||
+      credential === undefined}
+  >
+    {busy ? "Connecting..." : "Connect source"}
+  </button>
+</form>
+
+<style>
+  .graphql-form {
+    display: grid;
+    gap: 1rem;
+    padding: 1.3rem;
+  }
+
+  fieldset {
+    display: grid;
+    gap: 1rem;
+    min-width: 0;
+    margin: 0;
+    border: 0;
+    padding: 0;
+  }
+
+  .auth-fields {
+    border: 1px solid #293247;
+    border-radius: 10px;
+    padding: 0.85rem;
+    background: #0d131d;
+  }
+
+  legend {
+    color: #edf0f6;
+    font-size: 1.05rem;
+    font-weight: 750;
+  }
+
+  fieldset > p:first-of-type {
+    margin: 0;
+    color: #a8b2c4;
+    line-height: 1.55;
+  }
+
+  .connection-policy {
+    display: grid;
+    grid-template-columns: repeat(3, minmax(0, 1fr));
+    gap: 0.65rem;
+    margin: 0;
+  }
+
+  .connection-policy div {
+    border: 1px solid #293247;
+    border-radius: 10px;
+    padding: 0.75rem;
+    background: #0d131d;
+  }
+
+  dt {
+    color: #8f9bb1;
+    font-size: 0.65rem;
+    font-weight: 800;
+    letter-spacing: 0.08em;
+    text-transform: uppercase;
+  }
+
+  dd {
+    margin: 0.35rem 0 0;
+    color: #d9deea;
+    font-size: 0.78rem;
+  }
+
+  @media (max-width: 720px) {
+    .connection-policy {
+      grid-template-columns: 1fr;
+    }
+  }
+</style>
diff --git a/web/src/lib/GraphqlSourceForm.test.ts b/web/src/lib/GraphqlSourceForm.test.ts
new file mode 100644
index 000000000..f56025b7e
--- /dev/null
+++ b/web/src/lib/GraphqlSourceForm.test.ts
@@ -0,0 +1,210 @@
+import { afterEach, describe, expect, it, vi } from "@effect/vitest";
+import { cleanup, fireEvent, render, screen, waitFor } from "@testing-library/svelte";
+import { ApiError, type ApiResult, type Source } from "./api";
+import GraphqlSourceForm from "./GraphqlSourceForm.svelte";
+import type { GraphqlSourceInput } from "./graphql-source-state";
+
+function sourceFixture(): Source {
+  return {
+    id: "graphql-source",
+    kind: "graphql",
+    slug: "product",
+    displayName: "Product API",
+    description: null,
+    configuration: { endpoint: "https://api.example.test/graphql", allowPrivateNetwork: false },
+    modeOverride: null,
+    healthStatus: "healthy",
+    healthErrorCode: null,
+    revision: 1,
+    catalogRevision: 1,
+    createdAt: 100,
+    updatedAt: 100,
+    lastRefreshedAt: 100,
+    toolCount: 4,
+    tombstonedToolCount: 0,
+  };
+}
+
+function deferred<Value>() {
+  let resolve = (_value: Value) => {};
+  const promise = new Promise<Value>((complete) => {
+    resolve = complete;
+  });
+  return { promise, resolve };
+}
+
+async function fillRequiredFields() {
+  await fireEvent.input(screen.getByLabelText("Endpoint"), {
+    target: { value: "https://api.example.test/graphql" },
+  });
+  await fireEvent.input(screen.getByLabelText("Source name"), {
+    target: { value: "Product API" },
+  });
+}
+
+afterEach(cleanup);
+
+describe("GraphQL source form", () => {
+  it("submits the stable source contract and clears the completed draft", async () => {
+    const inputs: GraphqlSourceInput[] = [];
+    const create = vi.fn(async (input: GraphqlSourceInput) => {
+      inputs.push(input);
+      return { ok: true, value: sourceFixture() } as const;
+    });
+    const created = vi.fn();
+    render(GraphqlSourceForm, { create, oncreated: created });
+    await fillRequiredFields();
+    await fireEvent.input(screen.getByLabelText("Preferred slug (optional)"), {
+      target: { value: " product " },
+    });
+    await fireEvent.change(screen.getByLabelText("Method"), { target: { value: "bearer" } });
+    await fireEvent.input(screen.getByLabelText("Bearer token"), {
+      target: { value: " exact token " },
+    });
+    await fireEvent.click(screen.getByRole("button", { name: "Connect source" }));
+
+    await waitFor(() => expect(created).toHaveBeenCalledOnce());
+    expect(inputs).toEqual([
+      {
+        kind: "graphql",
+        displayName: "Product API",
+        preferredSlug: "product",
+        endpoint: "https://api.example.test/graphql",
+        allowPrivateNetwork: false,
+        credential: { type: "bearer", token: " exact token " },
+      },
+    ]);
+    expect(screen.getByLabelText<HTMLInputElement>("Endpoint").value).toBe("");
+    expect(document.body.textContent).not.toContain("exact token");
+  });
+
+  it("rejects query-bearing endpoints before serialization", async () => {
+    const create = vi.fn();
+    render(GraphqlSourceForm, { create, oncreated: vi.fn() });
+    await fireEvent.input(screen.getByLabelText("Endpoint"), {
+      target: { value: "https://api.example.test/graphql?token=do-not-store" },
+    });
+    await fireEvent.input(screen.getByLabelText("Source name"), {
+      target: { value: "Product API" },
+    });
+
+    expect(screen.getByText(/without user info, query parameters, or fragments/)).toBeDefined();
+    expect(screen.getByRole<HTMLButtonElement>("button", { name: "Connect source" }).disabled).toBe(
+      true,
+    );
+    expect(create).not.toHaveBeenCalled();
+  });
+
+  it("rejects credential-bearing remote plaintext endpoints", async () => {
+    const create = vi.fn();
+    render(GraphqlSourceForm, { create, oncreated: vi.fn() });
+    await fireEvent.input(screen.getByLabelText("Endpoint"), {
+      target: { value: "http://api.example.test/graphql" },
+    });
+    await fireEvent.input(screen.getByLabelText("Source name"), {
+      target: { value: "Product API" },
+    });
+    await fireEvent.change(screen.getByLabelText("Method"), { target: { value: "bearer" } });
+    await fireEvent.input(screen.getByLabelText("Bearer token"), {
+      target: { value: "do-not-send-in-cleartext" },
+    });
+
+    expect(screen.getByText(/Plain HTTP is allowed only for loopback/)).toBeDefined();
+    expect(screen.getByRole<HTMLButtonElement>("button", { name: "Connect source" }).disabled).toBe(
+      true,
+    );
+    expect(create).not.toHaveBeenCalled();
+  });
+
+  it("blocks an obvious private endpoint until the operator opts in", async () => {
+    const create = vi.fn();
+    render(GraphqlSourceForm, { create, oncreated: vi.fn() });
+    await fireEvent.input(screen.getByLabelText("Endpoint"), {
+      target: { value: "http://127.0.0.1:4000/graphql" },
+    });
+    await fireEvent.input(screen.getByLabelText("Source name"), {
+      target: { value: "Local GraphQL" },
+    });
+
+    expect(screen.getByRole<HTMLButtonElement>("button", { name: "Connect source" }).disabled).toBe(
+      true,
+    );
+    expect(screen.getByText(/Enable private network access/)).toBeDefined();
+    expect(create).not.toHaveBeenCalled();
+  });
+
+  it("aborts on unmount and rejects the late completion", async () => {
+    const response = deferred<ApiResult<Source>>();
+    const request = { signal: null as AbortSignal | null };
+    const create = vi.fn((_input: GraphqlSourceInput, signal: AbortSignal) => {
+      request.signal = signal;
+      return response.promise;
+    });
+    const created = vi.fn();
+    const mounted = render(GraphqlSourceForm, { create, oncreated: created });
+    await fillRequiredFields();
+    await fireEvent.click(screen.getByRole("button", { name: "Connect source" }));
+    mounted.unmount();
+
+    expect(request.signal?.aborted).toBe(true);
+    response.resolve({ ok: true, value: sourceFixture() });
+    await response.promise;
+    await Promise.resolve();
+    expect(created).not.toHaveBeenCalled();
+  });
+
+  it("keeps busy until the coordinator settles and focuses a recovery failure", async () => {
+    const response = deferred<ApiResult<Source>>();
+    const create = vi.fn(() => response.promise);
+    const busy = vi.fn();
+    render(GraphqlSourceForm, {
+      create,
+      onbusychange: busy,
+      oncreated: vi.fn(),
+    });
+    await fillRequiredFields();
+    await fireEvent.click(screen.getByRole("button", { name: "Connect source" }));
+
+    await waitFor(() => expect(busy).toHaveBeenLastCalledWith(true));
+    response.resolve({
+      ok: false,
+      error: new ApiError({
+        code: "source_create_recovery_pending",
+        displayMessage: "Source recovery is pending.",
+        requestId: null,
+        status: 0,
+      }),
+    });
+    await response.promise;
+    await waitFor(() => expect(busy).toHaveBeenLastCalledWith(false));
+    expect(screen.getByText("Source recovery is pending.")).toBeDefined();
+    expect(document.activeElement).toBe(document.getElementById("graphql-source-error"));
+    expect(create).toHaveBeenCalledOnce();
+  });
+
+  it("clears secrets and focuses a rejected request", async () => {
+    const create = vi.fn(
+      async () =>
+        ({
+          ok: false,
+          error: new ApiError({
+            code: "graphql_introspection_failed",
+            displayMessage: "GraphQL introspection failed.",
+            requestId: "request-1",
+            status: 422,
+          }),
+        }) as const,
+    );
+    render(GraphqlSourceForm, { create, oncreated: vi.fn() });
+    await fillRequiredFields();
+    await fireEvent.change(screen.getByLabelText("Method"), { target: { value: "bearer" } });
+    const secret = screen.getByLabelText<HTMLInputElement>("Bearer token");
+    await fireEvent.input(secret, { target: { value: "clear-me" } });
+    await fireEvent.click(screen.getByRole("button", { name: "Connect source" }));
+
+    await waitFor(() => expect(screen.getByRole("alert")).toBeDefined());
+    expect(secret.value).toBe("");
+    expect(document.body.textContent).not.toContain("clear-me");
+    expect(document.activeElement).toBe(document.getElementById("graphql-source-error"));
+  });
+});
diff --git a/web/src/lib/McpCredentialEditor.svelte b/web/src/lib/McpCredentialEditor.svelte
new file mode 100644
index 000000000..02cf1d5a5
--- /dev/null
+++ b/web/src/lib/McpCredentialEditor.svelte
@@ -0,0 +1,439 @@
+<script lang="ts">
+  import { tick, untrack } from "svelte";
+  import ErrorNotice from "$lib/ErrorNotice.svelte";
+  import {
+    getSourceCredentials,
+    listMcpStdioTemplates,
+    putMcpHttpCredentials,
+    putMcpStdioCredentials,
+    type ApiError,
+    type Source,
+  } from "$lib/api";
+  import { useAuthState } from "$lib/auth.svelte";
+  import { createLatestRequest, unexpectedRequestError } from "$lib/catalog-state";
+  import {
+    buildMcpHttpCredential,
+    safeMcpSourceDetails,
+    templateSecretFields,
+    validateTemplateCatalog,
+    validateTemplateDraft,
+    type McpHttpAuthDraft,
+    type McpTemplateField,
+  } from "$lib/mcp-source-state";
+
+  let {
+    source,
+    disabled = false,
+    onbusychange,
+    onmutationchange,
+  }: {
+    source: Source;
+    disabled?: boolean;
+    onbusychange?: (busy: boolean) => void;
+    onmutationchange?: (busy: boolean) => void;
+  } = $props();
+
+  const auth = useAuthState();
+  const latest = createLatestRequest();
+  let open = $state(false);
+  let loading = $state(false);
+  let saving = $state(false);
+  let revision = $state<number | null>(null);
+  let error = $state<ApiError | null>(null);
+  let notice = $state<string | null>(null);
+  let httpDraft = $state<McpHttpAuthDraft>({
+    type: "none",
+    headerName: "",
+    username: "",
+    secret: "",
+  });
+  let stdioFields = $state<readonly McpTemplateField[]>([]);
+  let stdioSecrets = $state<Record<string, string>>({});
+  let cleanupLoad: (() => void) | null = null;
+  let saveController: AbortController | null = null;
+  let lifetime = 0;
+  let reportedBusy = false;
+  let reportedMutation = false;
+  let httpCredential = $derived(buildMcpHttpCredential(httpDraft));
+  let stdioCredential = $derived(validateTemplateDraft(stdioFields, stdioSecrets));
+
+  $effect(() => {
+    lifetime += 1;
+    return () => {
+      lifetime += 1;
+      cleanupLoad?.();
+      saveController?.abort();
+      if (reportedBusy) onbusychange?.(false);
+      if (reportedMutation) onmutationchange?.(false);
+    };
+  });
+
+  $effect(() => {
+    const busy = loading || saving;
+    if (busy === reportedBusy) return;
+    reportedBusy = busy;
+    onbusychange?.(busy);
+  });
+
+  $effect(() => {
+    if (saving === reportedMutation) return;
+    reportedMutation = saving;
+    onmutationchange?.(saving);
+  });
+
+  $effect(() => {
+    const isDisabled = disabled;
+    untrack(() => {
+      if (!isDisabled) {
+        if (open && revision === null && !loading && error === null) loadEditor();
+        return;
+      }
+
+      if (cleanupLoad !== null) {
+        cleanupLoad();
+        cleanupLoad = null;
+        loading = false;
+        revision = null;
+        error = null;
+      }
+      if (saveController !== null) {
+        saveController.abort();
+        saveController = null;
+        saving = false;
+        revision = null;
+        error = null;
+        clearSecretDrafts();
+      }
+    });
+  });
+
+  function toggle() {
+    if (disabled) return;
+    if (open) {
+      closeEditor();
+      return;
+    }
+    open = true;
+    notice = null;
+    loadEditor();
+  }
+
+  function loadEditor() {
+    if (disabled) return;
+    loading = true;
+    error = null;
+    revision = null;
+    stdioFields = [];
+    stdioSecrets = {};
+    cleanupLoad = latest.start(
+      async (signal) => {
+        const credentials = await getSourceCredentials(source.id, undefined, signal);
+        const templates =
+          source.kind === "mcp_stdio"
+            ? await listMcpStdioTemplates(undefined, signal)
+            : ({ ok: true, value: { templates: [] } } as const);
+        return { credentials, templates };
+      },
+      ({ credentials, templates }) => {
+        cleanupLoad = null;
+        loading = false;
+        if (!credentials.ok) {
+          if (!auth?.recoverFromApiError(credentials.error)) error = credentials.error;
+          return;
+        }
+        if (!templates.ok) {
+          if (!auth?.recoverFromApiError(templates.error)) error = templates.error;
+          return;
+        }
+        if (source.kind === "mcp_http") {
+          const configured = credentials.value.configuredSchemes[0]?.credentialType;
+          const type =
+            configured === "header"
+              ? "api_key_header"
+              : configured === "bearer" ||
+                  configured === "basic" ||
+                  configured === "api_key_header" ||
+                  configured === "oauth_access_token"
+                ? configured
+                : "none";
+          httpDraft = {
+            type,
+            headerName: "",
+            username: "",
+            secret: "",
+          };
+          revision = credentials.value.revision;
+          return;
+        }
+
+        const validated = validateTemplateCatalog(templates.value.templates);
+        const templateName = safeMcpSourceDetails("mcp_stdio", source.configuration).templateName;
+        const template = validated?.find((candidate) => candidate.name === templateName);
+        if (template === undefined) {
+          error = unexpectedRequestError();
+          return;
+        }
+        stdioFields = templateSecretFields(template);
+        stdioSecrets = {};
+        revision = credentials.value.revision;
+      },
+      () => {
+        cleanupLoad = null;
+        loading = false;
+        error = unexpectedRequestError();
+      },
+    );
+  }
+
+  async function save(event: SubmitEvent) {
+    event.preventDefault();
+    const expectedRevision = revision;
+    const currentHttpCredential = httpCredential;
+    const currentStdioCredential = stdioCredential;
+    if (disabled || saving || expectedRevision === null) return;
+    if (source.kind !== "mcp_http" && source.kind !== "mcp_stdio") return;
+    if (source.kind === "mcp_http" && currentHttpCredential === null) return;
+    if (source.kind === "mcp_stdio" && currentStdioCredential === null) return;
+
+    saveController?.abort();
+    const controller = new AbortController();
+    const owner = lifetime;
+    saveController = controller;
+    saving = true;
+    error = null;
+    notice = null;
+    let operation;
+    if (source.kind === "mcp_http") {
+      if (currentHttpCredential === null) return;
+      operation = putMcpHttpCredentials(
+        source.id,
+        expectedRevision,
+        currentHttpCredential,
+        undefined,
+        controller.signal,
+      );
+    } else {
+      if (currentStdioCredential === null) return;
+      operation = putMcpStdioCredentials(
+        source.id,
+        expectedRevision,
+        { secretValues: currentStdioCredential },
+        undefined,
+        controller.signal,
+      );
+    }
+    const settled = await operation.then(
+      (result) => ({ ok: true, result }) as const,
+      () => ({ ok: false }) as const,
+    );
+    if (owner !== lifetime || saveController !== controller || controller.signal.aborted) return;
+    saveController = null;
+    saving = false;
+    clearSecretDrafts();
+
+    if (!settled.ok) {
+      error = unexpectedRequestError();
+      await focusEditorError();
+      return;
+    }
+    if (!settled.result.ok) {
+      if (auth?.recoverFromApiError(settled.result.error)) return;
+      if (settled.result.error.status === 409) {
+        revision = null;
+        error = settled.result.error;
+        await focusEditorError();
+        return;
+      }
+      error = settled.result.error;
+      await focusEditorError();
+      return;
+    }
+
+    revision = settled.result.value.revision;
+    open = false;
+    notice = "Credentials replaced. Secret values remain hidden.";
+    await tick();
+    document.getElementById(`mcp-credential-status-${source.id}`)?.focus();
+  }
+
+  function clearSecretDrafts() {
+    httpDraft = { ...httpDraft, headerName: "", username: "", secret: "" };
+    stdioSecrets = {};
+  }
+
+  function closeEditor() {
+    cleanupLoad?.();
+    cleanupLoad = null;
+    saveController?.abort();
+    saveController = null;
+    open = false;
+    loading = false;
+    saving = false;
+    error = null;
+    revision = null;
+    stdioFields = [];
+    clearSecretDrafts();
+    void tick().then(() => document.getElementById(`mcp-credentials-${source.id}`)?.focus());
+  }
+
+  async function focusEditorError() {
+    await tick();
+    document.getElementById(`mcp-credential-error-${source.id}`)?.focus();
+  }
+</script>
+
+<button
+  id={`mcp-credentials-${source.id}`}
+  type="button"
+  {disabled}
+  aria-expanded={open}
+  aria-controls={`mcp-credential-editor-${source.id}`}
+  onclick={toggle}
+>
+  {open ? "Close credentials" : "Manage credentials"}
+</button>
+
+{#if notice !== null}
+  <p id={`mcp-credential-status-${source.id}`} class="notice" role="status" tabindex="-1">
+    {notice}
+  </p>
+{/if}
+
+{#if open}
+  <form
+    id={`mcp-credential-editor-${source.id}`}
+    class="credential-editor"
+    aria-label={`Credentials for ${source.displayName}`}
+    onsubmit={save}
+  >
+    <div>
+      <h3>Replace credentials</h3>
+      <p>Existing values are hidden. Saving replaces the complete credential set.</p>
+    </div>
+
+    {#if loading}
+      <p aria-live="polite">Loading credential metadata...</p>
+    {:else if revision !== null && source.kind === "mcp_http"}
+      <fieldset disabled={saving || disabled}>
+        <legend>HTTP authentication</legend>
+        <label>
+          Method
+          <select
+            bind:value={httpDraft.type}
+            onchange={() =>
+              (httpDraft = { ...httpDraft, headerName: "", username: "", secret: "" })}
+          >
+            <option value="none">None</option>
+            <option value="bearer">Bearer token</option>
+            <option value="basic">Basic auth</option>
+            <option value="api_key_header">API key header</option>
+            <option value="oauth_access_token">OAuth access token (manual, advanced)</option>
+          </select>
+        </label>
+        {#if httpDraft.type === "api_key_header"}
+          <label>
+            Header name
+            <input required autocomplete="off" bind:value={httpDraft.headerName} />
+          </label>
+        {/if}
+        {#if httpDraft.type === "basic"}
+          <label>
+            Username
+            <input required autocomplete="off" bind:value={httpDraft.username} />
+          </label>
+        {/if}
+        {#if httpDraft.type !== "none"}
+          <label>
+            {httpDraft.type === "bearer"
+              ? "Bearer token"
+              : httpDraft.type === "basic"
+                ? "Password"
+                : httpDraft.type === "oauth_access_token"
+                  ? "OAuth access token"
+                  : "Header value"}
+            <input type="password" required autocomplete="off" bind:value={httpDraft.secret} />
+          </label>
+        {/if}
+      </fieldset>
+    {:else if revision !== null && source.kind === "mcp_stdio"}
+      <fieldset disabled={saving || disabled}>
+        <legend>Template secrets</legend>
+        {#each stdioFields as field (field.key)}
+          <label>
+            {field.label}
+            <input
+              type="password"
+              required
+              autocomplete="off"
+              aria-label={field.label}
+              value={stdioSecrets[field.key] ?? ""}
+              oninput={(event) => {
+                stdioSecrets = { ...stdioSecrets, [field.key]: event.currentTarget.value };
+              }}
+            />
+          </label>
+        {/each}
+      </fieldset>
+    {/if}
+
+    {#if error !== null}
+      <div id={`mcp-credential-error-${source.id}`} tabindex="-1"><ErrorNotice {error} /></div>
+    {/if}
+    <div class="button-row">
+      <button type="button" disabled={saving || disabled} onclick={closeEditor}>Cancel</button>
+      <button
+        type="submit"
+        class="primary"
+        disabled={loading ||
+          saving ||
+          disabled ||
+          revision === null ||
+          (source.kind === "mcp_http" ? httpCredential === null : stdioCredential === null)}
+      >
+        {saving ? "Saving..." : "Save replacement"}
+      </button>
+    </div>
+  </form>
+{/if}
+
+<style>
+  .credential-editor,
+  fieldset {
+    display: grid;
+    gap: 0.85rem;
+  }
+
+  .credential-editor {
+    flex-basis: 100%;
+    width: 100%;
+    border-top: 1px solid #293247;
+    padding-top: 1rem;
+  }
+
+  .credential-editor h3,
+  .credential-editor p {
+    margin: 0;
+  }
+
+  .credential-editor > div:first-child p {
+    margin-top: 0.3rem;
+    color: #9da8bb;
+    font-size: 0.78rem;
+  }
+
+  fieldset {
+    min-width: 0;
+    margin: 0;
+    border: 1px solid #293247;
+    border-radius: 10px;
+    padding: 0.85rem;
+    background: #0d131d;
+  }
+
+  legend {
+    padding: 0 0.35rem;
+    color: #aeb8ca;
+    font-size: 0.72rem;
+    font-weight: 750;
+  }
+</style>
diff --git a/web/src/lib/McpCredentialEditor.test.ts b/web/src/lib/McpCredentialEditor.test.ts
new file mode 100644
index 000000000..7154be864
--- /dev/null
+++ b/web/src/lib/McpCredentialEditor.test.ts
@@ -0,0 +1,444 @@
+import { afterEach, describe, expect, it, vi } from "@effect/vitest";
+import { cleanup, fireEvent, render, screen, waitFor } from "@testing-library/svelte";
+import { Schema } from "effect";
+import McpCredentialEditor from "./McpCredentialEditor.svelte";
+import type { Source } from "./api";
+
+const decodeJson = Schema.decodeUnknownSync(Schema.fromJsonString(Schema.Unknown));
+
+function deferred<Value>() {
+  let resolve = (_value: Value) => {};
+  const promise = new Promise<Value>((complete) => {
+    resolve = complete;
+  });
+  return { promise, resolve };
+}
+
+function deferredDecodedResponse() {
+  const response = deferred<Response>();
+  const settled = deferred<void>();
+  return {
+    promise: response.promise,
+    settled: settled.promise,
+    resolve(value: unknown) {
+      const decodedResponse = Response.json(value);
+      const read = decodedResponse.text.bind(decodedResponse);
+      decodedResponse.text = async () => {
+        const text = await read();
+        // The next task starts after API decoding and component promise continuations settle.
+        setTimeout(() => settled.resolve(undefined), 0);
+        return text;
+      };
+      response.resolve(decodedResponse);
+    },
+  };
+}
+
+function source(kind: "mcp_http" | "mcp_stdio"): Source {
+  return {
+    id: `${kind}-source`,
+    kind,
+    slug: kind,
+    displayName: kind === "mcp_http" ? "Remote MCP" : "Local MCP",
+    description: null,
+    configuration:
+      kind === "mcp_http"
+        ? { endpoint: "https://mcp.example.test/mcp", allowPrivateNetwork: false }
+        : { templateName: "github" },
+    modeOverride: null,
+    healthStatus: "healthy",
+    healthErrorCode: null,
+    revision: 1,
+    catalogRevision: 1,
+    createdAt: 100,
+    updatedAt: 100,
+    lastRefreshedAt: 100,
+    toolCount: 3,
+    tombstonedToolCount: 0,
+  };
+}
+
+afterEach(() => {
+  cleanup();
+  vi.unstubAllGlobals();
+});
+
+describe("MCP credential editor", () => {
+  it("preserves an unsaved HTTP secret across a temporary disabled state", async () => {
+    const fetcher = vi.fn<typeof fetch>(async () =>
+      Response.json({
+        revision: 4,
+        configuredSchemes: [{ name: "authorization", credentialType: "bearer" }],
+      }),
+    );
+    vi.stubGlobal("fetch", fetcher);
+    const mounted = render(McpCredentialEditor, { source: source("mcp_http") });
+    await fireEvent.click(screen.getByRole("button", { name: "Manage credentials" }));
+    const token = await screen.findByLabelText<HTMLInputElement>("Bearer token");
+    await fireEvent.input(token, { target: { value: "still-unsaved" } });
+
+    await mounted.rerender({ source: source("mcp_http"), disabled: true });
+    await waitFor(() => expect(token.closest("fieldset")?.hasAttribute("disabled")).toBe(true));
+    expect(token.value).toBe("still-unsaved");
+
+    await mounted.rerender({ source: source("mcp_http"), disabled: false });
+    await waitFor(() => expect(token.closest("fieldset")?.hasAttribute("disabled")).toBe(false));
+    expect(token.value).toBe("still-unsaved");
+    expect(fetcher).toHaveBeenCalledOnce();
+  });
+
+  it("preserves an unsaved stdio secret across a temporary disabled state", async () => {
+    const fetcher = vi.fn<typeof fetch>(async (input) => {
+      if (String(input).endsWith("/credentials")) {
+        return Response.json({
+          revision: 9,
+          configuredSchemes: [{ name: "TOKEN", credentialType: "secret_env" }],
+        });
+      }
+      return Response.json({ templates: [{ name: "github", secretFields: ["TOKEN"] }] });
+    });
+    vi.stubGlobal("fetch", fetcher);
+    const mounted = render(McpCredentialEditor, { source: source("mcp_stdio") });
+    await fireEvent.click(screen.getByRole("button", { name: "Manage credentials" }));
+    const secret = await screen.findByLabelText<HTMLInputElement>("TOKEN");
+    await fireEvent.input(secret, { target: { value: "still-unsaved" } });
+
+    await mounted.rerender({ source: source("mcp_stdio"), disabled: true });
+    await waitFor(() => expect(secret.closest("fieldset")?.hasAttribute("disabled")).toBe(true));
+    expect(secret.value).toBe("still-unsaved");
+
+    await mounted.rerender({ source: source("mcp_stdio"), disabled: false });
+    await waitFor(() => expect(secret.closest("fieldset")?.hasAttribute("disabled")).toBe(false));
+    expect(secret.value).toBe("still-unsaved");
+    expect(fetcher).toHaveBeenCalledTimes(2);
+  });
+
+  it("aborts a submitted secret, reloads metadata, and ignores the late save completion", async () => {
+    const saveA = deferredDecodedResponse();
+    const reloadB = deferredDecodedResponse();
+    const request = { signal: null as AbortSignal | null };
+    let metadataRequests = 0;
+    const onbusychange = vi.fn();
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((_input, init) => {
+        if (init?.method !== "PUT") {
+          metadataRequests += 1;
+          if (metadataRequests === 2) return reloadB.promise;
+          return Promise.resolve(
+            Response.json({
+              revision: 4,
+              configuredSchemes: [{ name: "authorization", credentialType: "bearer" }],
+            }),
+          );
+        }
+        request.signal = init.signal ?? null;
+        return saveA.promise;
+      }),
+    );
+    const mounted = render(McpCredentialEditor, {
+      source: source("mcp_http"),
+      onbusychange,
+    });
+    await fireEvent.click(screen.getByRole("button", { name: "Manage credentials" }));
+    const token = await screen.findByLabelText<HTMLInputElement>("Bearer token");
+    onbusychange.mockClear();
+    await fireEvent.input(token, { target: { value: "must-be-cleared" } });
+    await fireEvent.click(screen.getByRole("button", { name: "Save replacement" }));
+    await waitFor(() => expect(request.signal).not.toBeNull());
+    await waitFor(() => expect(onbusychange.mock.calls).toEqual([[true]]));
+
+    await mounted.rerender({
+      source: source("mcp_http"),
+      disabled: true,
+      onbusychange,
+    });
+    await waitFor(() => expect(request.signal?.aborted).toBe(true));
+    await waitFor(() => expect(screen.queryByLabelText("Bearer token")).toBeNull());
+    await waitFor(() => expect(onbusychange.mock.calls).toEqual([[true], [false]]));
+    expect(
+      screen.getByRole<HTMLButtonElement>("button", { name: "Save replacement" }).disabled,
+    ).toBe(true);
+
+    await mounted.rerender({
+      source: source("mcp_http"),
+      disabled: false,
+      onbusychange,
+    });
+    await waitFor(() => expect(metadataRequests).toBe(2));
+    await waitFor(() => expect(onbusychange.mock.calls).toEqual([[true], [false], [true]]));
+    reloadB.resolve({
+      revision: 8,
+      configuredSchemes: [{ name: "authorization", credentialType: "bearer" }],
+    });
+    await reloadB.settled;
+    const reloadedToken = await screen.findByLabelText<HTMLInputElement>("Bearer token");
+    expect(reloadedToken.value).toBe("");
+    await waitFor(() =>
+      expect(onbusychange.mock.calls).toEqual([[true], [false], [true], [false]]),
+    );
+
+    saveA.resolve({
+      revision: 5,
+      configuredSchemes: [{ name: "authorization", credentialType: "bearer" }],
+    });
+    await saveA.settled;
+    expect(screen.getByRole("button", { name: "Close credentials" })).toBeDefined();
+    expect(screen.queryByRole("status")).toBeNull();
+    expect(onbusychange.mock.calls).toEqual([[true], [false], [true], [false]]);
+  });
+
+  it("reports only MCP credential writes as mutations and clears the fence on unmount", async () => {
+    const saveResponse = deferredDecodedResponse();
+    const request = { signal: null as AbortSignal | null };
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((_input, init) => {
+        if (init?.method === "PUT") {
+          request.signal = init.signal ?? null;
+          return saveResponse.promise;
+        }
+        return Promise.resolve(
+          Response.json({
+            revision: 4,
+            configuredSchemes: [{ name: "authorization", credentialType: "bearer" }],
+          }),
+        );
+      }),
+    );
+    const onmutationchange = vi.fn();
+    const mounted = render(McpCredentialEditor, {
+      source: source("mcp_http"),
+      onmutationchange,
+    });
+
+    await fireEvent.click(screen.getByRole("button", { name: "Manage credentials" }));
+    const token = await screen.findByLabelText<HTMLInputElement>("Bearer token");
+    expect(onmutationchange).not.toHaveBeenCalled();
+    await fireEvent.input(token, { target: { value: "pending-secret" } });
+    await fireEvent.click(screen.getByRole("button", { name: "Save replacement" }));
+    await waitFor(() => expect(onmutationchange).toHaveBeenLastCalledWith(true));
+
+    mounted.unmount();
+    expect(request.signal?.aborted).toBe(true);
+    expect(onmutationchange).toHaveBeenLastCalledWith(false);
+    saveResponse.resolve({
+      revision: 5,
+      configuredSchemes: [{ name: "authorization", credentialType: "bearer" }],
+    });
+    await saveResponse.settled;
+  });
+
+  it("retries an aborted metadata load and ignores its late completion", async () => {
+    const loadA = deferredDecodedResponse();
+    const retryB = deferredDecodedResponse();
+    const requests: AbortSignal[] = [];
+    const onbusychange = vi.fn();
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((_input, init) => {
+        if (init?.signal instanceof AbortSignal) requests.push(init.signal);
+        return requests.length === 1 ? loadA.promise : retryB.promise;
+      }),
+    );
+    const mounted = render(McpCredentialEditor, {
+      source: source("mcp_http"),
+      onbusychange,
+    });
+    await fireEvent.click(screen.getByRole("button", { name: "Manage credentials" }));
+    await waitFor(() => expect(requests).toHaveLength(1));
+    await waitFor(() => expect(onbusychange.mock.calls).toEqual([[true]]));
+
+    await mounted.rerender({
+      source: source("mcp_http"),
+      disabled: true,
+      onbusychange,
+    });
+    await waitFor(() => expect(requests[0]?.aborted).toBe(true));
+    await waitFor(() => expect(onbusychange.mock.calls).toEqual([[true], [false]]));
+
+    await mounted.rerender({
+      source: source("mcp_http"),
+      disabled: false,
+      onbusychange,
+    });
+    await waitFor(() => expect(requests).toHaveLength(2));
+    expect(screen.queryByLabelText("Username")).toBeNull();
+
+    retryB.resolve({
+      revision: 7,
+      configuredSchemes: [{ name: "authorization", credentialType: "bearer" }],
+    });
+    await retryB.settled;
+    await screen.findByLabelText("Bearer token");
+    expect(onbusychange.mock.calls).toEqual([[true], [false], [true], [false]]);
+
+    loadA.resolve({
+      revision: 3,
+      configuredSchemes: [{ name: "authorization", credentialType: "basic" }],
+    });
+    await loadA.settled;
+    expect(screen.queryByLabelText("Username")).toBeNull();
+    expect(screen.getByLabelText("Bearer token")).toBeDefined();
+    expect(onbusychange.mock.calls).toEqual([[true], [false], [true], [false]]);
+  });
+
+  it("replaces HTTP API-key auth with the viewed CAS revision", async () => {
+    const bodies: unknown[] = [];
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>(async (input, init) => {
+        if (init?.method !== "PUT") {
+          return Response.json({ revision: 4, configuredSchemes: [] });
+        }
+        bodies.push(decodeJson(String(init.body)));
+        return Response.json({
+          revision: 5,
+          configuredSchemes: [{ name: "authorization", credentialType: "api_key_header" }],
+        });
+      }),
+    );
+    render(McpCredentialEditor, { source: source("mcp_http") });
+    await fireEvent.click(screen.getByRole("button", { name: "Manage credentials" }));
+    const method = await screen.findByLabelText<HTMLSelectElement>("Method");
+    await fireEvent.change(method, { target: { value: "api_key_header" } });
+    await fireEvent.input(screen.getByLabelText("Header name"), {
+      target: { value: "X-Service-Key" },
+    });
+    await fireEvent.input(screen.getByLabelText("Header value"), {
+      target: { value: " exact key " },
+    });
+    await fireEvent.click(screen.getByRole("button", { name: "Save replacement" }));
+
+    await waitFor(() => expect(screen.getByRole("status")).toBeDefined());
+    expect(bodies).toEqual([
+      {
+        expectedRevision: 4,
+        credential: {
+          credential: {
+            type: "api_key_header",
+            name: "X-Service-Key",
+            value: " exact key ",
+          },
+        },
+      },
+    ]);
+    expect(document.body.textContent).not.toContain("exact key");
+    expect(document.activeElement).toBe(
+      document.getElementById("mcp-credential-status-mcp_http-source"),
+    );
+  });
+
+  it("uses only template-approved stdio fields and preserves secret bytes", async () => {
+    const bodies: unknown[] = [];
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>(async (input, init) => {
+        if (String(input).endsWith("/credentials") && init?.method !== "PUT") {
+          return Response.json({
+            revision: 9,
+            configuredSchemes: [{ name: "TOKEN", credentialType: "secret_env" }],
+          });
+        }
+        if (String(input) === "/api/v1/mcp/stdio/templates") {
+          return Response.json({ templates: [{ name: "github", secretFields: ["TOKEN"] }] });
+        }
+        bodies.push(decodeJson(String(init?.body)));
+        return Response.json({
+          revision: 10,
+          configuredSchemes: [{ name: "TOKEN", credentialType: "secret_env" }],
+        });
+      }),
+    );
+    render(McpCredentialEditor, { source: source("mcp_stdio") });
+    await fireEvent.click(screen.getByRole("button", { name: "Manage credentials" }));
+    const secret = await screen.findByLabelText<HTMLInputElement>("TOKEN");
+    await fireEvent.input(secret, { target: { value: " exact token " } });
+    await fireEvent.click(screen.getByRole("button", { name: "Save replacement" }));
+
+    await waitFor(() => expect(screen.getByRole("status")).toBeDefined());
+    expect(bodies).toEqual([
+      {
+        expectedRevision: 9,
+        credential: { secretValues: { TOKEN: " exact token " } },
+      },
+    ]);
+    expect(document.body.textContent).not.toContain("exact token");
+  });
+
+  it("clears secrets and focuses a CAS conflict for review", async () => {
+    const fetcher = vi
+      .fn<typeof fetch>()
+      .mockResolvedValueOnce(
+        Response.json({
+          revision: 4,
+          configuredSchemes: [{ name: "authorization", credentialType: "bearer" }],
+        }),
+      )
+      .mockResolvedValueOnce(
+        Response.json(
+          {
+            error: {
+              code: "revision_conflict",
+              message: "Credentials changed elsewhere.",
+              requestId: "request-conflict",
+            },
+          },
+          { status: 409 },
+        ),
+      );
+    vi.stubGlobal("fetch", fetcher);
+    render(McpCredentialEditor, { source: source("mcp_http") });
+    await fireEvent.click(screen.getByRole("button", { name: "Manage credentials" }));
+    const token = await screen.findByLabelText<HTMLInputElement>("Bearer token");
+    await fireEvent.input(token, { target: { value: "clear-after-conflict" } });
+    await fireEvent.click(screen.getByRole("button", { name: "Save replacement" }));
+
+    await waitFor(() => expect(screen.getByRole("alert")).toBeDefined());
+    expect(screen.queryByLabelText("Bearer token")).toBeNull();
+    expect(document.body.textContent).not.toContain("clear-after-conflict");
+    expect(document.activeElement).toBe(
+      document.getElementById("mcp-credential-error-mcp_http-source"),
+    );
+    expect(
+      screen.getByRole<HTMLButtonElement>("button", { name: "Save replacement" }).disabled,
+    ).toBe(true);
+  });
+
+  it("does not reuse stdio fields when a later template lookup is invalid", async () => {
+    const fetcher = vi
+      .fn<typeof fetch>()
+      .mockResolvedValueOnce(
+        Response.json({
+          revision: 2,
+          configuredSchemes: [{ name: "TOKEN", credentialType: "secret_env" }],
+        }),
+      )
+      .mockResolvedValueOnce(
+        Response.json({ templates: [{ name: "github", secretFields: ["TOKEN"] }] }),
+      )
+      .mockResolvedValueOnce(
+        Response.json({
+          revision: 3,
+          configuredSchemes: [{ name: "TOKEN", credentialType: "secret_env" }],
+        }),
+      )
+      .mockResolvedValueOnce(
+        Response.json({ templates: [{ name: "different", secretFields: ["OTHER"] }] }),
+      );
+    vi.stubGlobal("fetch", fetcher);
+    render(McpCredentialEditor, { source: source("mcp_stdio") });
+
+    await fireEvent.click(screen.getByRole("button", { name: "Manage credentials" }));
+    await screen.findByLabelText("TOKEN");
+    await fireEvent.click(screen.getByRole("button", { name: "Cancel" }));
+    await fireEvent.click(screen.getByRole("button", { name: "Manage credentials" }));
+
+    await waitFor(() => expect(screen.getByRole("alert")).toBeDefined());
+    expect(screen.queryByLabelText("TOKEN")).toBeNull();
+    expect(screen.queryByLabelText("OTHER")).toBeNull();
+    expect(
+      screen.getByRole<HTMLButtonElement>("button", { name: "Save replacement" }).disabled,
+    ).toBe(true);
+  });
+});
diff --git a/web/src/lib/McpHttpSourceForm.svelte b/web/src/lib/McpHttpSourceForm.svelte
new file mode 100644
index 000000000..e1d09eb31
--- /dev/null
+++ b/web/src/lib/McpHttpSourceForm.svelte
@@ -0,0 +1,298 @@
+<script lang="ts">
+  import { tick } from "svelte";
+  import ErrorNotice from "$lib/ErrorNotice.svelte";
+  import { type ApiError, type ApiResult, type McpHttpSourceInput, type Source } from "$lib/api";
+  import { useAuthState } from "$lib/auth.svelte";
+  import { unexpectedRequestError } from "$lib/catalog-state";
+  import {
+    buildMcpHttpCredential,
+    requiresPrivateNetworkOptIn,
+    type McpHttpAuthDraft,
+  } from "$lib/mcp-source-state";
+  let {
+    create,
+    oncreated,
+    onbusychange,
+    disabled = false,
+  }: {
+    create: (input: McpHttpSourceInput, signal: AbortSignal) => Promise<ApiResult<Source>>;
+    oncreated?: (source: Source) => void;
+    onbusychange?: (busy: boolean) => void;
+    disabled?: boolean;
+  } = $props();
+
+  const auth = useAuthState();
+  let endpoint = $state("");
+  let displayName = $state("");
+  let description = $state("");
+  let allowPrivateNetwork = $state(false);
+  let credentialDraft = $state<McpHttpAuthDraft>({
+    type: "none",
+    headerName: "",
+    username: "",
+    secret: "",
+  });
+  let busy = $state(false);
+  let error = $state<ApiError | null>(null);
+  let localOptInMissing = $derived(
+    endpoint.trim() !== "" && requiresPrivateNetworkOptIn(endpoint) && !allowPrivateNetwork,
+  );
+  let credentialPayload = $derived(buildMcpHttpCredential(credentialDraft));
+  let activeController: AbortController | null = null;
+  let lifetime = 0;
+  let reportedBusy = false;
+
+  $effect(() => {
+    lifetime += 1;
+    return () => {
+      lifetime += 1;
+      activeController?.abort();
+      activeController = null;
+      credentialDraft = { ...credentialDraft, secret: "" };
+      if (reportedBusy) onbusychange?.(false);
+    };
+  });
+
+  $effect(() => {
+    if (busy === reportedBusy) return;
+    reportedBusy = busy;
+    onbusychange?.(busy);
+  });
+
+  async function connect(event: SubmitEvent) {
+    event.preventDefault();
+    const currentCredential = credentialPayload;
+    if (busy || disabled || localOptInMissing || currentCredential === null) return;
+
+    activeController?.abort();
+    const controller = new AbortController();
+    const owner = lifetime;
+    activeController = controller;
+    busy = true;
+    error = null;
+    const input = {
+      kind: "mcp_http",
+      displayName: displayName.trim(),
+      ...(description.trim() ? { description: description.trim() } : {}),
+      endpoint: endpoint.trim(),
+      allowPrivateNetwork,
+      ...(currentCredential.credential === null
+        ? {}
+        : { credential: currentCredential.credential }),
+    } satisfies McpHttpSourceInput;
+    credentialDraft = { ...credentialDraft, secret: "" };
+    const result = await create(input, controller.signal).then(
+      (response) => response,
+      () => ({ ok: false, error: unexpectedRequestError() }) as const,
+    );
+    if (owner !== lifetime || activeController !== controller || controller.signal.aborted) return;
+
+    activeController = null;
+    busy = false;
+
+    if (!result.ok) {
+      if (!auth?.recoverFromApiError(result.error)) {
+        error = result.error;
+        await focusError();
+      }
+      return;
+    }
+
+    const source = result.value;
+    endpoint = "";
+    displayName = "";
+    description = "";
+    allowPrivateNetwork = false;
+    credentialDraft = { type: "none", headerName: "", username: "", secret: "" };
+    oncreated?.(source);
+  }
+
+  async function focusError() {
+    await tick();
+    document.getElementById("mcp-http-error")?.focus();
+  }
+</script>
+
+<form class="mcp-form" onsubmit={connect} aria-labelledby="mcp-http-form-title">
+  <fieldset disabled={busy || disabled}>
+    <legend id="mcp-http-form-title">MCP Streamable HTTP</legend>
+    <p>
+      Connect a remote or local MCP server. Executor negotiates the protocol and imports its tool
+      catalog.
+    </p>
+    <label>
+      Endpoint
+      <input
+        type="url"
+        required
+        bind:value={endpoint}
+        placeholder="https://mcp.example.com/mcp"
+        aria-describedby="mcp-http-connection-policy"
+      />
+    </label>
+    <label>
+      Source name
+      <input required maxlength="120" bind:value={displayName} placeholder="Issue tracker" />
+    </label>
+    <label>
+      Description (optional)
+      <input maxlength="500" bind:value={description} />
+    </label>
+    <label class="checkbox-label private-network-choice">
+      <input type="checkbox" bind:checked={allowPrivateNetwork} />
+      Allow private network addresses for this source
+    </label>
+    <p class="field-help">
+      This permits loopback and private-network targets. Link-local and cloud metadata targets stay
+      blocked.
+    </p>
+    <fieldset class="auth-fields">
+      <legend>Authentication</legend>
+      <label>
+        Method
+        <select
+          bind:value={credentialDraft.type}
+          onchange={() =>
+            (credentialDraft = {
+              ...credentialDraft,
+              headerName: "",
+              username: "",
+              secret: "",
+            })}
+        >
+          <option value="none">None</option>
+          <option value="bearer">Bearer token</option>
+          <option value="basic">Basic auth</option>
+          <option value="api_key_header">API key header</option>
+          <option value="oauth_access_token">OAuth access token (manual, advanced)</option>
+        </select>
+      </label>
+      {#if credentialDraft.type === "api_key_header"}
+        <label>
+          Header name
+          <input required autocomplete="off" bind:value={credentialDraft.headerName} />
+        </label>
+      {/if}
+      {#if credentialDraft.type === "basic"}
+        <label>
+          Username
+          <input required autocomplete="off" bind:value={credentialDraft.username} />
+        </label>
+      {/if}
+      {#if credentialDraft.type !== "none"}
+        <label>
+          {credentialDraft.type === "bearer"
+            ? "Bearer token"
+            : credentialDraft.type === "basic"
+              ? "Password"
+              : credentialDraft.type === "oauth_access_token"
+                ? "OAuth access token"
+                : "Header value"}
+          <input type="password" required autocomplete="off" bind:value={credentialDraft.secret} />
+        </label>
+      {/if}
+      <p class="field-help">Credentials are encrypted locally and never shown again.</p>
+    </fieldset>
+    {#if localOptInMissing}
+      <p class="notice warning" role="status">
+        This looks like a local or private endpoint. Enable private network access to connect it.
+      </p>
+    {/if}
+  </fieldset>
+
+  <dl id="mcp-http-connection-policy" class="connection-policy">
+    <div>
+      <dt>Sessions</dt>
+      <dd>Kept in memory and never displayed</dd>
+    </div>
+    <div>
+      <dt>Redirects</dt>
+      <dd>Disabled</dd>
+    </div>
+    <div>
+      <dt>Proxies</dt>
+      <dd>Ignored, Executor connects directly</dd>
+    </div>
+  </dl>
+
+  {#if error !== null}
+    <div id="mcp-http-error" tabindex="-1"><ErrorNotice {error} /></div>
+  {/if}
+  <button
+    class="primary"
+    type="submit"
+    disabled={busy || disabled || localOptInMissing || credentialPayload === null}
+  >
+    {busy ? "Connecting..." : "Connect source"}
+  </button>
+</form>
+
+<style>
+  .mcp-form {
+    display: grid;
+    gap: 1rem;
+    padding: 1.3rem;
+  }
+
+  fieldset {
+    display: grid;
+    gap: 1rem;
+    min-width: 0;
+    margin: 0;
+    border: 0;
+    padding: 0;
+  }
+
+  .auth-fields {
+    border: 1px solid #293247;
+    border-radius: 10px;
+    padding: 0.85rem;
+    background: #0d131d;
+  }
+
+  legend {
+    color: #edf0f6;
+    font-size: 1.05rem;
+    font-weight: 750;
+  }
+
+  fieldset > p:first-of-type {
+    margin: 0;
+    color: #a8b2c4;
+    line-height: 1.55;
+  }
+
+  .connection-policy {
+    display: grid;
+    grid-template-columns: repeat(3, minmax(0, 1fr));
+    gap: 0.65rem;
+    margin: 0;
+  }
+
+  .connection-policy div {
+    border: 1px solid #293247;
+    border-radius: 10px;
+    padding: 0.75rem;
+    background: #0d131d;
+  }
+
+  dt {
+    color: #8f9bb1;
+    font-size: 0.65rem;
+    font-weight: 750;
+    letter-spacing: 0.06em;
+    text-transform: uppercase;
+  }
+
+  dd {
+    margin: 0.3rem 0 0;
+    color: #d7dde8;
+    font-size: 0.76rem;
+  }
+
+  @media (max-width: 640px) {
+    .connection-policy {
+      grid-template-columns: 1fr;
+    }
+  }
+</style>
diff --git a/web/src/lib/McpHttpSourceForm.test.ts b/web/src/lib/McpHttpSourceForm.test.ts
new file mode 100644
index 000000000..6d56db517
--- /dev/null
+++ b/web/src/lib/McpHttpSourceForm.test.ts
@@ -0,0 +1,148 @@
+import { afterEach, describe, expect, it, vi } from "@effect/vitest";
+import { cleanup, fireEvent, render, screen, waitFor } from "@testing-library/svelte";
+import { ApiError, type ApiResult, type McpHttpSourceInput, type Source } from "./api";
+import McpHttpSourceForm from "./McpHttpSourceForm.svelte";
+
+function sourceFixture(): Source {
+  return {
+    id: "source-1",
+    kind: "mcp_http",
+    slug: "issues",
+    displayName: "Issue tracker",
+    description: null,
+    configuration: { endpoint: "https://mcp.example.test/mcp", allowPrivateNetwork: false },
+    modeOverride: null,
+    healthStatus: "healthy",
+    healthErrorCode: null,
+    revision: 1,
+    catalogRevision: 1,
+    createdAt: 100,
+    updatedAt: 100,
+    lastRefreshedAt: 100,
+    toolCount: 4,
+    tombstonedToolCount: 0,
+  };
+}
+
+function deferred<Value>() {
+  let resolve = (_value: Value) => {};
+  const promise = new Promise<Value>((complete) => {
+    resolve = complete;
+  });
+  return { promise, resolve };
+}
+
+afterEach(() => {
+  cleanup();
+  vi.unstubAllGlobals();
+});
+
+describe("MCP HTTP source form", () => {
+  it("submits the stable source contract and clears the completed draft", async () => {
+    const inputs: McpHttpSourceInput[] = [];
+    const create = vi.fn(async (input: McpHttpSourceInput) => {
+      inputs.push(input);
+      return { ok: true, value: sourceFixture() } as const;
+    });
+    const created = vi.fn();
+    render(McpHttpSourceForm, { create, oncreated: created });
+
+    await fireEvent.input(screen.getByLabelText("Endpoint"), {
+      target: { value: "https://mcp.example.test/mcp" },
+    });
+    await fireEvent.input(screen.getByLabelText("Source name"), {
+      target: { value: "Issue tracker" },
+    });
+    await fireEvent.click(screen.getByRole("button", { name: "Connect source" }));
+
+    await waitFor(() => expect(created).toHaveBeenCalledOnce());
+    expect(inputs).toEqual([
+      {
+        kind: "mcp_http",
+        displayName: "Issue tracker",
+        endpoint: "https://mcp.example.test/mcp",
+        allowPrivateNetwork: false,
+      },
+    ]);
+    expect(screen.getByLabelText<HTMLInputElement>("Endpoint").value).toBe("");
+    expect(screen.getByLabelText<HTMLInputElement>("Source name").value).toBe("");
+  });
+
+  it("blocks an obvious private endpoint until the operator opts in", async () => {
+    const create = vi.fn();
+    render(McpHttpSourceForm, { create, oncreated: vi.fn() });
+
+    await fireEvent.input(screen.getByLabelText("Endpoint"), {
+      target: { value: "http://127.42.0.1:7331/mcp" },
+    });
+    await fireEvent.input(screen.getByLabelText("Source name"), {
+      target: { value: "Local tools" },
+    });
+
+    expect(screen.getByRole<HTMLButtonElement>("button", { name: "Connect source" }).disabled).toBe(
+      true,
+    );
+    expect(screen.getByText(/Enable private network access/)).toBeDefined();
+    expect(create).not.toHaveBeenCalled();
+  });
+
+  it("rejects a completion after unmount and aborts the request", async () => {
+    const response = deferred<ApiResult<Source>>();
+    const request = { signal: null as AbortSignal | null };
+    const create = vi.fn((_input: McpHttpSourceInput, signal: AbortSignal) => {
+      request.signal = signal;
+      return response.promise;
+    });
+    const created = vi.fn();
+    const mounted = render(McpHttpSourceForm, { create, oncreated: created });
+    await fireEvent.input(screen.getByLabelText("Endpoint"), {
+      target: { value: "https://mcp.example.test/mcp" },
+    });
+    await fireEvent.input(screen.getByLabelText("Source name"), {
+      target: { value: "Issue tracker" },
+    });
+    await fireEvent.click(screen.getByRole("button", { name: "Connect source" }));
+
+    mounted.unmount();
+    expect(request.signal?.aborted).toBe(true);
+    response.resolve({ ok: true, value: sourceFixture() });
+    await response.promise;
+    await Promise.resolve();
+    expect(created).not.toHaveBeenCalled();
+  });
+
+  it("clears the submitted secret and focuses a coordinator failure", async () => {
+    const busy = vi.fn();
+    const create = vi.fn(
+      async () =>
+        ({
+          ok: false,
+          error: new ApiError({
+            code: "source_create_recovery_pending",
+            displayMessage: "Source recovery is pending.",
+            requestId: null,
+            status: 0,
+          }),
+        }) as const,
+    );
+    render(McpHttpSourceForm, { create, oncreated: vi.fn(), onbusychange: busy });
+    await fireEvent.input(screen.getByLabelText("Endpoint"), {
+      target: { value: "https://mcp.example.test/mcp" },
+    });
+    await fireEvent.input(screen.getByLabelText("Source name"), {
+      target: { value: "Issue tracker" },
+    });
+    await fireEvent.change(screen.getByLabelText("Method"), {
+      target: { value: "bearer" },
+    });
+    const bearer = screen.getByLabelText<HTMLInputElement>("Bearer token");
+    await fireEvent.input(bearer, { target: { value: "clear-after-attempt" } });
+    await fireEvent.click(screen.getByRole("button", { name: "Connect source" }));
+
+    await waitFor(() => expect(screen.getByRole("alert")).toBeDefined());
+    await waitFor(() => expect(bearer.value).toBe(""));
+    expect(busy).toHaveBeenLastCalledWith(false);
+    expect(screen.getByText("Source recovery is pending.")).toBeDefined();
+    expect(document.activeElement).toBe(document.getElementById("mcp-http-error"));
+  });
+});
diff --git a/web/src/lib/McpStdioSourceForm.svelte b/web/src/lib/McpStdioSourceForm.svelte
new file mode 100644
index 000000000..e873e2cf8
--- /dev/null
+++ b/web/src/lib/McpStdioSourceForm.svelte
@@ -0,0 +1,330 @@
+<script lang="ts">
+  import { tick, untrack } from "svelte";
+  import ErrorNotice from "$lib/ErrorNotice.svelte";
+  import {
+    listMcpStdioTemplates,
+    type ApiError,
+    type ApiResult,
+    type McpStdioSourceInput,
+    type McpStdioTemplate,
+    type Source,
+  } from "$lib/api";
+  import { useAuthState } from "$lib/auth.svelte";
+  import {
+    beginResourceLoad,
+    createLatestRequest,
+    emptyResource,
+    settleResourceLoad,
+    unexpectedRequestError,
+  } from "$lib/catalog-state";
+  import {
+    reconcileTemplateSelection,
+    templateDescriptorFingerprint,
+    templateSecretFields,
+    validateTemplateCatalog,
+    validateTemplateDraft,
+  } from "$lib/mcp-source-state";
+  let {
+    create,
+    oncreated,
+    onbusychange,
+    disabled = false,
+  }: {
+    create: (input: McpStdioSourceInput, signal: AbortSignal) => Promise<ApiResult<Source>>;
+    oncreated?: (source: Source) => void;
+    onbusychange?: (busy: boolean) => void;
+    disabled?: boolean;
+  } = $props();
+
+  const auth = useAuthState();
+  const latestTemplates = createLatestRequest();
+  let templates = $state(emptyResource<readonly McpStdioTemplate[]>());
+  let refreshKey = $state(0);
+  let selectedTemplate = $state<string | null>(null);
+  let displayName = $state("");
+  let description = $state("");
+  let secretValues = $state<Record<string, string>>({});
+  let busy = $state(false);
+  let error = $state<ApiError | null>(null);
+  let activeController: AbortController | null = null;
+  let lifetime = 0;
+  let reportedBusy = false;
+  let currentTemplate = $derived(
+    templates.data?.find((template) => template.name === selectedTemplate) ?? null,
+  );
+  let currentFields = $derived(
+    currentTemplate === null ? [] : templateSecretFields(currentTemplate),
+  );
+  let validatedSecrets = $derived(validateTemplateDraft(currentFields, secretValues));
+
+  $effect(() => {
+    const requestKey = String(refreshKey);
+    templates = beginResourceLoad(untrack(() => templates));
+    return latestTemplates.start(
+      async (signal) => ({ requestKey, result: await listMcpStdioTemplates(undefined, signal) }),
+      ({ requestKey: completedKey, result }) => {
+        if (completedKey !== String(refreshKey)) return;
+        if (!result.ok) {
+          if (!auth?.recoverFromApiError(result.error)) {
+            templates = settleResourceLoad(templates, result);
+          }
+          return;
+        }
+        const validated = validateTemplateCatalog(result.value.templates);
+        if (validated === null) {
+          templates = settleResourceLoad(templates, {
+            ok: false,
+            error: unexpectedRequestError(),
+          });
+          return;
+        }
+        const previousDescriptor = templates.data?.find(
+          (template) => template.name === selectedTemplate,
+        );
+        templates = settleResourceLoad(templates, { ok: true, value: validated });
+        const nextSelection = reconcileTemplateSelection(selectedTemplate, validated);
+        if (nextSelection !== selectedTemplate) selectTemplate(nextSelection);
+        else {
+          const nextDescriptor = validated.find((template) => template.name === nextSelection);
+          if (
+            templateDescriptorFingerprint(previousDescriptor) !==
+            templateDescriptorFingerprint(nextDescriptor)
+          ) {
+            secretValues = {};
+          }
+        }
+      },
+      () => {
+        templates = settleResourceLoad(templates, {
+          ok: false,
+          error: unexpectedRequestError(),
+        });
+      },
+    );
+  });
+
+  $effect(() => {
+    lifetime += 1;
+    return () => {
+      lifetime += 1;
+      activeController?.abort();
+      activeController = null;
+      secretValues = {};
+      if (reportedBusy) onbusychange?.(false);
+    };
+  });
+
+  $effect(() => {
+    if (busy === reportedBusy) return;
+    reportedBusy = busy;
+    onbusychange?.(busy);
+  });
+
+  function selectTemplate(name: string | null) {
+    if (disabled || name === selectedTemplate) return;
+    selectedTemplate = name;
+    secretValues = {};
+    error = null;
+  }
+
+  async function connect(event: SubmitEvent) {
+    event.preventDefault();
+    const templateName = selectedTemplate;
+    const secrets = validatedSecrets;
+    if (busy || disabled || templateName === null || secrets === null) return;
+
+    activeController?.abort();
+    const controller = new AbortController();
+    const owner = lifetime;
+    activeController = controller;
+    busy = true;
+    error = null;
+    const input = {
+      kind: "mcp_stdio",
+      displayName: displayName.trim(),
+      ...(description.trim() ? { description: description.trim() } : {}),
+      templateName,
+      secretValues: secrets,
+    } satisfies McpStdioSourceInput;
+    secretValues = {};
+    const result = await create(input, controller.signal).then(
+      (response) => response,
+      () => ({ ok: false, error: unexpectedRequestError() }) as const,
+    );
+    if (owner !== lifetime || activeController !== controller || controller.signal.aborted) return;
+
+    activeController = null;
+    busy = false;
+
+    if (!result.ok) {
+      if (!auth?.recoverFromApiError(result.error)) {
+        error = result.error;
+        await focusError();
+      }
+      return;
+    }
+
+    const source = result.value;
+    displayName = "";
+    description = "";
+    secretValues = {};
+    oncreated?.(source);
+  }
+
+  async function focusError() {
+    await tick();
+    document.getElementById("mcp-stdio-error")?.focus();
+  }
+</script>
+
+<section class="mcp-form" aria-labelledby="mcp-stdio-form-title">
+  <div>
+    <h2 id="mcp-stdio-form-title">Trusted local MCP template</h2>
+    <p>
+      Choose a template configured on this machine. Browser users cannot enter commands, arguments,
+      working directories, or environment variable names.
+    </p>
+  </div>
+  {#if templates.data !== null && templates.data.length > 0 && !templates.stale}
+    <button
+      type="button"
+      disabled={disabled || templates.loading}
+      onclick={() => (refreshKey += 1)}
+    >
+      {templates.loading ? "Refreshing templates..." : "Refresh templates"}
+    </button>
+  {/if}
+
+  {#if templates.stale && templates.error !== null}
+    <div class="notice warning" role="status">
+      Showing the last loaded template list while Executor reconnects.
+      <ErrorNotice error={templates.error} />
+      <button
+        type="button"
+        disabled={disabled || templates.loading}
+        onclick={() => (refreshKey += 1)}
+      >
+        {templates.loading ? "Retrying..." : "Try again"}
+      </button>
+    </div>
+  {:else if templates.error !== null}
+    <div class="table-unavailable">
+      <ErrorNotice error={templates.error} />
+      <button type="button" onclick={() => (refreshKey += 1)}>Try again</button>
+    </div>
+  {/if}
+
+  {#if templates.data === null && templates.loading}
+    <p aria-live="polite">Loading trusted templates...</p>
+  {:else if templates.data?.length === 0}
+    <div class="notice">
+      <strong>No trusted local templates are configured.</strong>
+      <small>
+        Add templates to the machine-admin JSON registry selected by
+        <code>--mcp-stdio-templates</code> or <code>EXECUTOR_MCP_STDIO_TEMPLATES_FILE</code>,
+        restart Executor, then try again.
+      </small>
+    </div>
+    <button
+      type="button"
+      disabled={disabled || templates.loading}
+      onclick={() => (refreshKey += 1)}
+    >
+      {templates.loading ? "Refreshing..." : "Refresh templates"}
+    </button>
+  {:else if templates.data !== null}
+    <form onsubmit={connect}>
+      <fieldset disabled={busy || disabled || templates.loading || templates.stale}>
+        <legend>Local process source</legend>
+        <label>
+          Trusted template
+          <select
+            value={selectedTemplate ?? ""}
+            onchange={(event) => selectTemplate(event.currentTarget.value || null)}
+          >
+            {#each templates.data as template (template.name)}
+              <option value={template.name}>{template.name}</option>
+            {/each}
+          </select>
+        </label>
+        <label>
+          Source name
+          <input required maxlength="120" bind:value={displayName} placeholder="Local tools" />
+        </label>
+        <label>
+          Description (optional)
+          <input maxlength="500" bind:value={description} />
+        </label>
+        {#each currentFields as field (field.key)}
+          <label>
+            {field.label}
+            <input
+              type="password"
+              required
+              autocomplete="off"
+              aria-label={field.label}
+              value={secretValues[field.key] ?? ""}
+              oninput={(event) => {
+                secretValues = { ...secretValues, [field.key]: event.currentTarget.value };
+              }}
+            />
+            <small>{field.description} It is encrypted locally and never shown again.</small>
+          </label>
+        {/each}
+      </fieldset>
+
+      {#if error !== null}
+        <div id="mcp-stdio-error" tabindex="-1"><ErrorNotice {error} /></div>
+      {/if}
+      <button
+        class="primary"
+        type="submit"
+        disabled={busy ||
+          disabled ||
+          templates.loading ||
+          templates.stale ||
+          selectedTemplate === null ||
+          validatedSecrets === null}
+      >
+        {busy ? "Connecting..." : "Connect source"}
+      </button>
+    </form>
+  {/if}
+</section>
+
+<style>
+  .mcp-form,
+  form,
+  fieldset {
+    display: grid;
+    gap: 1rem;
+  }
+
+  .mcp-form {
+    padding: 1.3rem;
+  }
+
+  .mcp-form h2,
+  .mcp-form p {
+    margin: 0;
+  }
+
+  .mcp-form > div:first-child p {
+    margin-top: 0.35rem;
+    color: #a8b2c4;
+    line-height: 1.55;
+  }
+
+  fieldset {
+    min-width: 0;
+    margin: 0;
+    border: 0;
+    padding: 0;
+  }
+
+  legend {
+    color: #edf0f6;
+    font-size: 1.05rem;
+    font-weight: 750;
+  }
+</style>
diff --git a/web/src/lib/McpStdioSourceForm.test.ts b/web/src/lib/McpStdioSourceForm.test.ts
new file mode 100644
index 000000000..cc4021585
--- /dev/null
+++ b/web/src/lib/McpStdioSourceForm.test.ts
@@ -0,0 +1,243 @@
+import { afterEach, describe, expect, it, vi } from "@effect/vitest";
+import { cleanup, fireEvent, render, screen, waitFor } from "@testing-library/svelte";
+import { Effect } from "effect";
+import { ApiError, type ApiResult, type McpStdioSourceInput, type Source } from "./api";
+import McpStdioSourceForm from "./McpStdioSourceForm.svelte";
+
+function sourceFixture(): Source {
+  return {
+    id: "source-stdio",
+    kind: "mcp_stdio",
+    slug: "github-local",
+    displayName: "Local GitHub",
+    description: null,
+    configuration: { templateName: "github" },
+    modeOverride: null,
+    healthStatus: "healthy",
+    healthErrorCode: null,
+    revision: 1,
+    catalogRevision: 1,
+    createdAt: 100,
+    updatedAt: 100,
+    lastRefreshedAt: 100,
+    toolCount: 3,
+    tombstonedToolCount: 0,
+  };
+}
+
+function deferred<Value>() {
+  let resolve = (_value: Value) => {};
+  const promise = new Promise<Value>((complete) => {
+    resolve = complete;
+  });
+  return { promise, resolve };
+}
+
+afterEach(() => {
+  cleanup();
+  vi.unstubAllGlobals();
+});
+
+describe("MCP stdio source form", () => {
+  it("shows only trusted templates and preserves secret bytes in create payloads", async () => {
+    const inputs: McpStdioSourceInput[] = [];
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>(async () =>
+        Response.json({ templates: [{ name: "github", secretFields: ["TOKEN"] }] }),
+      ),
+    );
+    const create = vi.fn(async (input: McpStdioSourceInput) => {
+      inputs.push(input);
+      return { ok: true, value: sourceFixture() } as const;
+    });
+    const created = vi.fn();
+    render(McpStdioSourceForm, { create, oncreated: created });
+
+    await screen.findByRole("option", { name: "github" });
+    await fireEvent.input(screen.getByLabelText("Source name"), {
+      target: { value: "Local GitHub" },
+    });
+    await fireEvent.input(screen.getByLabelText("TOKEN"), {
+      target: { value: " whitespace-sensitive " },
+    });
+    await fireEvent.click(screen.getByRole("button", { name: "Connect source" }));
+
+    await waitFor(() => expect(created).toHaveBeenCalledOnce());
+    expect(fetch).toHaveBeenCalledOnce();
+    expect(inputs).toEqual([
+      {
+        kind: "mcp_stdio",
+        displayName: "Local GitHub",
+        templateName: "github",
+        secretValues: { TOKEN: " whitespace-sensitive " },
+      },
+    ]);
+    expect(document.body.textContent).not.toContain("whitespace-sensitive");
+  });
+
+  it("clears secrets whenever the trusted template changes", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>(async () =>
+        Response.json({
+          templates: [
+            { name: "github", secretFields: ["TOKEN"] },
+            { name: "linear", secretFields: ["TOKEN"] },
+          ],
+        }),
+      ),
+    );
+    render(McpStdioSourceForm, { create: vi.fn(), oncreated: vi.fn() });
+
+    const selector = await screen.findByLabelText<HTMLSelectElement>("Trusted template");
+    const secret = screen.getByLabelText<HTMLInputElement>("TOKEN");
+    await fireEvent.input(secret, { target: { value: "must-not-cross-templates" } });
+    await fireEvent.change(selector, { target: { value: "linear" } });
+
+    expect(screen.getByLabelText<HTMLInputElement>("TOKEN").value).toBe("");
+    expect(document.body.textContent).not.toContain("must-not-cross-templates");
+  });
+
+  it("shows an honest empty state instead of a dead connect action", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>(async () => Response.json({ templates: [] })),
+    );
+    render(McpStdioSourceForm, { create: vi.fn(), oncreated: vi.fn() });
+
+    expect(await screen.findByText("No trusted local templates are configured.")).toBeDefined();
+    expect(screen.getByText(/machine-admin JSON registry selected by/)).toBeDefined();
+    expect(screen.getByText("--mcp-stdio-templates")).toBeDefined();
+    expect(screen.getByText("EXECUTOR_MCP_STDIO_TEMPLATES_FILE")).toBeDefined();
+    expect(document.body.textContent).not.toContain("local CLI");
+    expect(screen.queryByRole("button", { name: "Connect source" })).toBeNull();
+    expect(screen.getByRole("button", { name: "Refresh templates" })).toBeDefined();
+  });
+
+  it("retries a failed template refresh before making stale fields writable", async () => {
+    const fetcher = vi
+      .fn<typeof fetch>()
+      .mockResolvedValueOnce(
+        Response.json({ templates: [{ name: "github", secretFields: ["TOKEN"] }] }),
+      )
+      .mockImplementationOnce(() => Effect.runPromise(Effect.fail("offline")))
+      .mockResolvedValueOnce(
+        Response.json({ templates: [{ name: "github", secretFields: ["TOKEN"] }] }),
+      );
+    vi.stubGlobal("fetch", fetcher);
+    render(McpStdioSourceForm, { create: vi.fn(), oncreated: vi.fn() });
+
+    await screen.findByRole("option", { name: "github" });
+    await fireEvent.click(screen.getByRole("button", { name: "Refresh templates" }));
+    expect(await screen.findByText(/Showing the last loaded template list/)).toBeDefined();
+    expect(
+      screen.getByRole<HTMLFieldSetElement>("group", { name: "Local process source" }).disabled,
+    ).toBe(true);
+
+    await fireEvent.click(screen.getByRole("button", { name: "Try again" }));
+    await waitFor(() =>
+      expect(
+        screen.getByRole<HTMLFieldSetElement>("group", { name: "Local process source" }).disabled,
+      ).toBe(false),
+    );
+  });
+
+  it("clears secrets when a same-name template changes its approved fields", async () => {
+    const fetcher = vi
+      .fn<typeof fetch>()
+      .mockResolvedValueOnce(
+        Response.json({ templates: [{ name: "github", secretFields: ["TOKEN"] }] }),
+      )
+      .mockResolvedValueOnce(
+        Response.json({ templates: [{ name: "github", secretFields: ["API_KEY"] }] }),
+      );
+    vi.stubGlobal("fetch", fetcher);
+    render(McpStdioSourceForm, { create: vi.fn(), oncreated: vi.fn() });
+
+    const oldSecret = await screen.findByLabelText<HTMLInputElement>("TOKEN");
+    await fireEvent.input(oldSecret, { target: { value: "must-be-forgotten" } });
+    await fireEvent.click(screen.getByRole("button", { name: "Refresh templates" }));
+
+    const nextSecret = await screen.findByLabelText<HTMLInputElement>("API_KEY");
+    expect(nextSecret.value).toBe("");
+    expect(screen.queryByLabelText("TOKEN")).toBeNull();
+    expect(document.body.textContent).not.toContain("must-be-forgotten");
+  });
+
+  it("reports not busy on unmount and ignores a late create completion", async () => {
+    const creation = deferred<ApiResult<Source>>();
+    const request = { signal: null as AbortSignal | null };
+    const busy = vi.fn();
+    const created = vi.fn();
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>(() =>
+        Promise.resolve(
+          Response.json({ templates: [{ name: "github", secretFields: ["TOKEN"] }] }),
+        ),
+      ),
+    );
+    const create = vi.fn((_input: McpStdioSourceInput, signal: AbortSignal) => {
+      request.signal = signal;
+      return creation.promise;
+    });
+    const mounted = render(McpStdioSourceForm, { create, oncreated: created, onbusychange: busy });
+
+    await screen.findByRole("option", { name: "github" });
+    await fireEvent.input(screen.getByLabelText("Source name"), {
+      target: { value: "Local GitHub" },
+    });
+    await fireEvent.input(screen.getByLabelText("TOKEN"), {
+      target: { value: "forget-on-unmount" },
+    });
+    await fireEvent.click(screen.getByRole("button", { name: "Connect source" }));
+    await waitFor(() => expect(busy).toHaveBeenLastCalledWith(true));
+
+    mounted.unmount();
+    expect(request.signal?.aborted).toBe(true);
+    expect(busy).toHaveBeenLastCalledWith(false);
+    creation.resolve({ ok: true, value: sourceFixture() });
+    await creation.promise;
+    await Promise.resolve();
+    expect(created).not.toHaveBeenCalled();
+  });
+
+  it("clears template secrets and focuses a coordinator failure", async () => {
+    const busy = vi.fn();
+    const fetcher = vi
+      .fn<typeof fetch>()
+      .mockResolvedValueOnce(
+        Response.json({ templates: [{ name: "github", secretFields: ["TOKEN"] }] }),
+      );
+    vi.stubGlobal("fetch", fetcher);
+    const create = vi.fn(
+      async () =>
+        ({
+          ok: false,
+          error: new ApiError({
+            code: "source_create_recovery_pending",
+            displayMessage: "Source recovery is pending.",
+            requestId: null,
+            status: 0,
+          }),
+        }) as const,
+    );
+    render(McpStdioSourceForm, { create, oncreated: vi.fn(), onbusychange: busy });
+
+    await screen.findByRole("option", { name: "github" });
+    await fireEvent.input(screen.getByLabelText("Source name"), {
+      target: { value: "Local GitHub" },
+    });
+    await fireEvent.input(screen.getByLabelText("TOKEN"), {
+      target: { value: "clear-me" },
+    });
+    await fireEvent.click(screen.getByRole("button", { name: "Connect source" }));
+
+    await waitFor(() => expect(screen.getByRole("alert")).toBeDefined());
+    expect(screen.getByLabelText<HTMLInputElement>("TOKEN").value).toBe("");
+    expect(busy).toHaveBeenLastCalledWith(false);
+    expect(screen.getByText("Source recovery is pending.")).toBeDefined();
+    expect(document.activeElement).toBe(document.getElementById("mcp-stdio-error"));
+  });
+});
diff --git a/web/src/lib/OAuthConnectionPanel.svelte b/web/src/lib/OAuthConnectionPanel.svelte
new file mode 100644
index 000000000..780b85247
--- /dev/null
+++ b/web/src/lib/OAuthConnectionPanel.svelte
@@ -0,0 +1,996 @@
+<script lang="ts">
+  import { tick, untrack } from "svelte";
+  import { ApiError } from "$lib/api";
+  import { useAuthState } from "$lib/auth.svelte";
+  import { copyText } from "$lib/clipboard";
+  import {
+    buildOAuthConnectionInput,
+    canDisconnectOAuth,
+    draftFromOAuthSummary,
+    emptyOAuthDraft,
+    oauthStatusLabel,
+    oauthStatusTone,
+    safeAuthorizationUrl,
+    type OAuthConnectionDraft,
+    type OAuthConnectionOperations,
+    type OAuthConnectionSummary,
+    type OAuthOperationError,
+  } from "$lib/oauth-connection-state";
+
+  let {
+    sourceId,
+    credentialKey,
+    callbackRefreshKey = null,
+    emptyRevision = 0,
+    defaultRequestedScopes = [],
+    discoveryType = "issuer",
+    configurationDisabled = false,
+    disabled = false,
+    operations,
+    navigate,
+    onbusychange,
+    onmutationchange,
+  }: {
+    sourceId: string;
+    credentialKey: string;
+    callbackRefreshKey?: string | null;
+    emptyRevision?: number;
+    defaultRequestedScopes?: readonly string[];
+    discoveryType?: "issuer" | "mcp";
+    configurationDisabled?: boolean;
+    disabled?: boolean;
+    operations: OAuthConnectionOperations;
+    navigate?: (url: string) => void;
+    onbusychange?: (busy: boolean) => void;
+    onmutationchange?: (busy: boolean) => void;
+  } = $props();
+
+  const auth = useAuthState();
+  let summary = $state<OAuthConnectionSummary | null>(null);
+  let draft = $state<OAuthConnectionDraft>(emptyOAuthDraft());
+  let revision = $state(0);
+  let loading = $state(true);
+  let busy = $state<"save" | "authorize" | "disconnect" | "remove" | null>(null);
+  let dirty = $state(false);
+  let draftConflict = $state(false);
+  let conflictLatestLoaded = $state(false);
+  let conflictRefreshFailed = $state(false);
+  let error = $state<OAuthOperationError | null>(null);
+  let notice = $state<string | null>(null);
+  let confirmingDisconnect = $state(false);
+  let confirmingDelete = $state(false);
+  let copyStatus = $state("");
+  let callbackField = $state<HTMLInputElement>();
+  let disconnectDialog = $state<HTMLDialogElement>();
+  let disconnectButton = $state<HTMLButtonElement>();
+  let disconnectCancelButton = $state<HTMLButtonElement>();
+  let deleteDialog = $state<HTMLDialogElement>();
+  let deleteButton = $state<HTMLButtonElement>();
+  let deleteCancelButton = $state<HTMLButtonElement>();
+  let refreshNonce = $state(0);
+  let loadGeneration = 0;
+  let lifetime = 0;
+  let loadController: AbortController | null = null;
+  let mutationController: AbortController | null = null;
+  let loadedIdentity = "";
+  let reportedBusy = false;
+  let reportedMutation = false;
+  let panelId = $derived(`oauth-${encodeDomId(sourceId)}-${encodeDomId(credentialKey)}`);
+  let saveInput = $derived(buildOAuthConnectionInput(draft, revision, discoveryType));
+  let statusTone = $derived(summary === null ? "neutral" : oauthStatusTone(summary.status));
+  let configurationUnavailable = $derived(
+    configurationDisabled || summary?.managedOAuthEligible === false,
+  );
+
+  $effect(() => {
+    lifetime += 1;
+    return () => {
+      lifetime += 1;
+      loadController?.abort();
+      mutationController?.abort();
+      draft = { ...draft, clientSecret: "" };
+      if (reportedBusy) onbusychange?.(false);
+      if (reportedMutation) onmutationchange?.(false);
+    };
+  });
+
+  $effect(() => {
+    const active = loading || busy !== null;
+    if (active === reportedBusy) return;
+    reportedBusy = active;
+    onbusychange?.(active);
+  });
+
+  $effect(() => {
+    const active = busy !== null;
+    if (active === reportedMutation) return;
+    reportedMutation = active;
+    onmutationchange?.(active);
+  });
+
+  $effect(() => {
+    const currentSourceId = sourceId;
+    const currentCredentialKey = credentialKey;
+    const currentCallbackKey = callbackRefreshKey;
+    const currentEmptyRevision = emptyRevision;
+    const currentDefaultScopes = defaultRequestedScopes;
+    const currentOperations = operations;
+    const currentRefreshNonce = refreshNonce;
+    const currentDisabled = disabled;
+    const identity = `${currentSourceId}\u0000${currentCredentialKey}`;
+    void currentCallbackKey;
+    void currentRefreshNonce;
+
+    mutationController?.abort();
+    mutationController = null;
+    busy = null;
+    if (currentDisabled) {
+      loadController?.abort();
+      loadController = null;
+      loading = false;
+      return;
+    }
+
+    const confirmationFocus = moveConfirmationFocusToPanel();
+
+    if (loadedIdentity !== identity) {
+      loadedIdentity = identity;
+      summary = null;
+      draft = emptyDraftWithScopes(currentDefaultScopes);
+      revision = currentEmptyRevision;
+      dirty = false;
+      draftConflict = false;
+      conflictLatestLoaded = false;
+      conflictRefreshFailed = false;
+      confirmingDisconnect = false;
+      confirmingDelete = false;
+      copyStatus = "";
+      notice = null;
+    }
+
+    const generation = ++loadGeneration;
+    const controller = new AbortController();
+    loadController?.abort();
+    loadController = controller;
+    loading = true;
+    error = null;
+
+    void currentOperations.load(currentSourceId, controller.signal).then(
+      (result) => {
+        if (generation !== loadGeneration || controller.signal.aborted) return;
+        loadController = null;
+        loading = false;
+        if (!result.ok) {
+          if (auth?.recoverFromApiError(new ApiError(result.error))) return;
+          error = result.error;
+          if (draftConflict) conflictRefreshFailed = true;
+          if (confirmationFocus !== null) {
+            void refocusConfirmation(confirmationFocus, generation);
+          }
+          return;
+        }
+        const connection =
+          result.value.connections.find(
+            (candidate) => candidate.credentialKey === currentCredentialKey,
+          ) ?? null;
+        summary = connection;
+        const disconnectAvailable = connection !== null && canDisconnectOAuth(connection.status);
+        if (!disconnectAvailable) {
+          confirmingDisconnect = false;
+        }
+        if (!dirty) {
+          revision = connection?.revision ?? currentEmptyRevision;
+          draft =
+            connection === null
+              ? emptyDraftWithScopes(currentDefaultScopes)
+              : draftFromOAuthSummary(connection);
+          draftConflict = false;
+          conflictRefreshFailed = false;
+        } else if (draftConflict) {
+          conflictLatestLoaded = true;
+          conflictRefreshFailed = false;
+          error = {
+            code: "revision_conflict",
+            displayMessage:
+              "This OAuth configuration changed elsewhere. Discard your draft before editing the latest version.",
+            requestId: null,
+            status: 409,
+          };
+          void focusError();
+        }
+        if (confirmationFocus !== null) {
+          void refocusConfirmation(confirmationFocus, generation);
+        }
+      },
+      () => {
+        if (generation !== loadGeneration || controller.signal.aborted) return;
+        loadController = null;
+        loading = false;
+        error = localOperationError();
+        if (draftConflict) conflictRefreshFailed = true;
+        if (confirmationFocus !== null) {
+          void refocusConfirmation(confirmationFocus, generation);
+        }
+      },
+    );
+
+    return () => {
+      loadGeneration += 1;
+      controller.abort();
+      if (loadController === controller) loadController = null;
+    };
+  });
+
+  function updateDraft(patch: Partial<OAuthConnectionDraft>) {
+    draft = { ...draft, ...patch };
+    dirty = true;
+    notice = null;
+    if (!draftConflict) error = null;
+  }
+
+  function changeClientKind(kind: OAuthConnectionDraft["clientKind"]) {
+    updateDraft({
+      clientKind: kind,
+      clientSecretAction:
+        kind === "public" ? "clear" : summary?.hasClientSecret ? "preserve" : "replace",
+      clientSecret: "",
+    });
+  }
+
+  function changeSecretAction(action: OAuthConnectionDraft["clientSecretAction"]) {
+    updateDraft({ clientSecretAction: action, clientSecret: "" });
+  }
+
+  async function save(event: SubmitEvent) {
+    event.preventDefault();
+    const input = saveInput;
+    if (input === null || busy !== null || loading || disabled || configurationUnavailable) return;
+    draft = { ...draft, clientSecret: "" };
+    await mutate(
+      "save",
+      (signal) => operations.save(sourceId, credentialKey, input, signal),
+      (next) => {
+        summary = next;
+        revision = next.revision;
+        draft = draftFromOAuthSummary(next);
+        dirty = false;
+        draftConflict = false;
+        conflictLatestLoaded = false;
+        conflictRefreshFailed = false;
+        notice = "OAuth configuration saved. Connect when you are ready to authorize it.";
+      },
+    );
+  }
+
+  async function connect() {
+    if (
+      summary === null ||
+      dirty ||
+      busy !== null ||
+      loading ||
+      disabled ||
+      configurationUnavailable
+    )
+      return;
+    await mutate(
+      "authorize",
+      (signal) =>
+        operations.authorize(
+          sourceId,
+          credentialKey,
+          { expectedRevision: summary?.revision ?? revision },
+          signal,
+        ),
+      (authorization) => {
+        const destination = safeAuthorizationUrl(authorization.authorizationUrl);
+        if (destination === null) {
+          error = {
+            code: "invalid_authorization_url",
+            displayMessage: "Executor returned an invalid OAuth authorization destination.",
+            requestId: null,
+            status: 502,
+          };
+          return;
+        }
+        if (navigate === undefined) {
+          window.location.assign(destination);
+        } else {
+          navigate(destination);
+        }
+      },
+    );
+  }
+
+  async function disconnect() {
+    if (
+      summary === null ||
+      !canDisconnectOAuth(summary.status) ||
+      busy !== null ||
+      loading ||
+      disabled
+    )
+      return;
+    await mutate(
+      "disconnect",
+      (signal) =>
+        operations.disconnect(
+          sourceId,
+          credentialKey,
+          { expectedRevision: summary?.revision ?? revision },
+          signal,
+        ),
+      (next) => {
+        summary = next;
+        revision = next.revision;
+        draft = draftFromOAuthSummary(next);
+        dirty = false;
+        draftConflict = false;
+        conflictLatestLoaded = false;
+        conflictRefreshFailed = false;
+        confirmingDisconnect = false;
+        notice = "OAuth tokens disconnected. The saved client configuration remains available.";
+        void focusNotice();
+      },
+    );
+  }
+
+  async function remove() {
+    if (summary === null || busy !== null || loading || disabled) return;
+    await mutate(
+      "remove",
+      (signal) =>
+        operations.remove(
+          sourceId,
+          credentialKey,
+          { expectedRevision: summary?.revision ?? revision },
+          signal,
+        ),
+      () => {
+        summary = null;
+        revision = emptyRevision;
+        draft = emptyDraftWithScopes(defaultRequestedScopes);
+        dirty = false;
+        draftConflict = false;
+        conflictLatestLoaded = false;
+        conflictRefreshFailed = false;
+        confirmingDelete = false;
+        notice = "OAuth configuration deleted.";
+        void focusNotice();
+      },
+    );
+  }
+
+  async function mutate<Value>(
+    kind: NonNullable<typeof busy>,
+    operation: (
+      signal: AbortSignal,
+    ) => Promise<
+      | { readonly ok: true; readonly value: Value }
+      | { readonly ok: false; readonly error: OAuthOperationError }
+    >,
+    complete: (value: Value) => void,
+  ) {
+    mutationController?.abort();
+    const controller = new AbortController();
+    const owner = lifetime;
+    mutationController = controller;
+    busy = kind;
+    error = null;
+    notice = null;
+    const settled = await operation(controller.signal).then(
+      (result) => ({ ok: true, result }) as const,
+      () => ({ ok: false }) as const,
+    );
+    if (owner !== lifetime || mutationController !== controller || controller.signal.aborted)
+      return;
+    mutationController = null;
+    busy = null;
+    draft = { ...draft, clientSecret: "" };
+
+    if (!settled.ok) {
+      error = localOperationError();
+      await focusError();
+      return;
+    }
+    if (!settled.result.ok) {
+      if (auth?.recoverFromApiError(new ApiError(settled.result.error))) return;
+      error = settled.result.error;
+      if (settled.result.error.status === 409) {
+        draftConflict = true;
+        conflictLatestLoaded = false;
+        conflictRefreshFailed = false;
+        refreshNonce += 1;
+      }
+      await focusError();
+      return;
+    }
+    complete(settled.result.value);
+  }
+
+  async function copyCallback() {
+    const field = callbackField;
+    const callbackUrl = summary?.callbackUrl;
+    if (field === undefined || callbackUrl === undefined) return;
+    copyStatus = (await copyText(callbackUrl, field)) ? "Callback URL copied." : "Copy failed.";
+  }
+
+  async function focusError() {
+    await tick();
+    document.getElementById(`${panelId}-error`)?.focus();
+  }
+
+  async function focusNotice() {
+    await tick();
+    document.getElementById(`${panelId}-notice`)?.focus();
+  }
+
+  function discardConflictedDraft() {
+    draft = summary === null ? emptyOAuthDraft() : draftFromOAuthSummary(summary);
+    revision = summary?.revision ?? emptyRevision;
+    dirty = false;
+    draftConflict = false;
+    conflictLatestLoaded = false;
+    conflictRefreshFailed = false;
+    error = null;
+    notice = "Latest OAuth configuration loaded.";
+    void focusNotice();
+  }
+
+  function retryConflictRefresh() {
+    conflictRefreshFailed = false;
+    refreshNonce += 1;
+  }
+
+  async function showDisconnectConfirmation() {
+    confirmingDelete = false;
+    confirmingDisconnect = true;
+    await tick();
+    disconnectCancelButton?.focus();
+  }
+
+  function moveConfirmationFocusToPanel() {
+    return untrack(() => {
+      const focused = document.activeElement;
+      const kind: "disconnect" | "delete" | null = disconnectDialog?.contains(focused)
+        ? "disconnect"
+        : deleteDialog?.contains(focused)
+          ? "delete"
+          : null;
+      if (kind === null) return null;
+      const fallback = document.getElementById(`${panelId}-title`);
+      if (!(fallback instanceof HTMLElement)) return null;
+      fallback.focus();
+      if (document.activeElement !== fallback) return null;
+      return { kind, fallback };
+    });
+  }
+
+  async function refocusConfirmation(
+    focus: NonNullable<ReturnType<typeof moveConfirmationFocusToPanel>>,
+    generation: number,
+  ) {
+    await tick();
+    if (generation !== loadGeneration || document.activeElement !== focus.fallback) return;
+    if (focus.kind === "disconnect") {
+      if (!confirmingDisconnect) return;
+      disconnectCancelButton?.focus();
+      return;
+    }
+    if (!confirmingDelete) return;
+    deleteCancelButton?.focus();
+  }
+
+  async function cancelDisconnectConfirmation() {
+    confirmingDisconnect = false;
+    await tick();
+    disconnectButton?.focus();
+  }
+
+  async function showDeleteConfirmation() {
+    confirmingDisconnect = false;
+    confirmingDelete = true;
+    await tick();
+    deleteCancelButton?.focus();
+  }
+
+  async function cancelDeleteConfirmation() {
+    confirmingDelete = false;
+    await tick();
+    deleteButton?.focus();
+  }
+
+  function handleConfirmationKeydown(event: KeyboardEvent, cancel: () => Promise<void>) {
+    if (event.key !== "Escape") return;
+    event.preventDefault();
+    void cancel();
+  }
+
+  function encodeDomId(value: string) {
+    return `u${Array.from(value, (character) => {
+      const codePoint = character.codePointAt(0);
+      return codePoint === undefined ? "" : codePoint.toString(16).padStart(6, "0");
+    }).join("")}`;
+  }
+
+  function localOperationError(): OAuthOperationError {
+    return {
+      code: "network_error",
+      displayMessage: "Executor could not complete the OAuth request.",
+      requestId: null,
+      status: 0,
+    };
+  }
+
+  function emptyDraftWithScopes(scopes: readonly string[]) {
+    return { ...emptyOAuthDraft(), scopes: scopes.join(" ") };
+  }
+</script>
+
+<section class="oauth-panel" aria-labelledby={`${panelId}-title`}>
+  <div class="oauth-heading">
+    <div>
+      <p class="eyebrow">Managed OAuth</p>
+      <h3 id={`${panelId}-title`} tabindex="-1">{credentialKey}</h3>
+    </div>
+    {#if summary !== null}
+      <span
+        class:connected={statusTone === "connected"}
+        class:error={statusTone === "error"}
+        class:pending={statusTone === "pending"}
+        class="oauth-status"
+        role="status"
+        aria-live="polite"
+        aria-atomic="true"
+      >
+        {oauthStatusLabel(summary.status)}
+      </span>
+    {/if}
+  </div>
+
+  {#if loading}
+    <p class="oauth-loading" aria-live="polite">Loading OAuth configuration...</p>
+  {:else}
+    {#if summary !== null}
+      <dl class="oauth-summary">
+        <div>
+          <dt>Issuer</dt>
+          <dd>{summary.issuer}</dd>
+        </div>
+        <div>
+          <dt>Client</dt>
+          <dd>{summary.clientAuthMethod === "none" ? "Public" : "Confidential"}</dd>
+        </div>
+        <div>
+          <dt>Granted scopes</dt>
+          <dd>{summary.grantedScopes.length > 0 ? summary.grantedScopes.join(" ") : "None yet"}</dd>
+        </div>
+        <div>
+          <dt>Refresh token</dt>
+          <dd>{summary.hasRefreshToken ? "Stored securely" : "Not stored"}</dd>
+        </div>
+      </dl>
+
+      <div class="callback-field">
+        <label for={`${panelId}-callback`}>Exact callback URL</label>
+        <div>
+          <input
+            id={`${panelId}-callback`}
+            bind:this={callbackField}
+            readonly
+            value={summary.callbackUrl}
+          />
+          <button type="button" onclick={copyCallback}>Copy</button>
+        </div>
+        <p class="field-help">Register this exact URL with the OAuth provider.</p>
+        <p class="copy-status" role="status">{copyStatus}</p>
+      </div>
+    {/if}
+
+    <form class="oauth-form" onsubmit={save}>
+      {#if configurationUnavailable}
+        <p class="notice warning" role="status">
+          This source no longer offers this managed OAuth credential. Disconnect or delete the saved
+          connection, or refresh the source configuration.
+        </p>
+      {/if}
+      <fieldset disabled={busy !== null || disabled || configurationUnavailable}>
+        <legend>{summary === null ? "Configure connection" : "Connection settings"}</legend>
+        <label>
+          {discoveryType === "mcp" ? "Authorization server override (optional)" : "Issuer URL"}
+          <input
+            type="url"
+            required={discoveryType === "issuer"}
+            autocomplete="url"
+            value={draft.issuer}
+            oninput={(event) => updateDraft({ issuer: event.currentTarget.value })}
+            placeholder="https://identity.example.com"
+          />
+        </label>
+        <label>
+          Client type
+          <select
+            value={draft.clientKind}
+            onchange={(event) =>
+              changeClientKind(event.currentTarget.value as "public" | "confidential")}
+          >
+            <option value="public">Public client (PKCE)</option>
+            <option value="confidential">Confidential client</option>
+          </select>
+        </label>
+        <label>
+          Client ID
+          <input
+            required
+            autocomplete="off"
+            value={draft.clientId}
+            oninput={(event) => updateDraft({ clientId: event.currentTarget.value })}
+          />
+        </label>
+        {#if draft.clientKind === "confidential"}
+          <label>
+            Client authentication
+            <select
+              value={draft.clientAuthMethod}
+              onchange={(event) =>
+                updateDraft({
+                  clientAuthMethod: event.currentTarget.value as
+                    | "client_secret_basic"
+                    | "client_secret_post",
+                })}
+            >
+              <option value="client_secret_basic">HTTP Basic</option>
+              <option value="client_secret_post">Request body</option>
+            </select>
+          </label>
+          <fieldset class="secret-fieldset">
+            <legend>Client secret</legend>
+            {#if summary?.hasClientSecret}
+              <label class="radio-label">
+                <input
+                  type="radio"
+                  name={`${panelId}-secret-action`}
+                  checked={draft.clientSecretAction === "preserve"}
+                  onchange={() => changeSecretAction("preserve")}
+                />
+                Preserve the saved secret
+              </label>
+            {/if}
+            <label class="radio-label">
+              <input
+                type="radio"
+                name={`${panelId}-secret-action`}
+                checked={draft.clientSecretAction === "replace"}
+                onchange={() => changeSecretAction("replace")}
+              />
+              {summary?.hasClientSecret ? "Replace the saved secret" : "Set a client secret"}
+            </label>
+            {#if draft.clientSecretAction === "replace"}
+              <label>
+                New client secret
+                <input
+                  type="password"
+                  required
+                  autocomplete="new-password"
+                  value={draft.clientSecret}
+                  oninput={(event) => updateDraft({ clientSecret: event.currentTarget.value })}
+                />
+              </label>
+            {/if}
+          </fieldset>
+        {:else if summary?.hasClientSecret}
+          <p class="notice warning" role="status">
+            Saving as a public client clears the stored client secret.
+          </p>
+        {/if}
+        <label>
+          Requested scopes
+          <input
+            autocomplete="off"
+            value={draft.scopes}
+            oninput={(event) => updateDraft({ scopes: event.currentTarget.value })}
+            placeholder="openid profile offline_access"
+          />
+          <small>Separate scopes with spaces, commas, or new lines.</small>
+        </label>
+      </fieldset>
+
+      <div class="button-row">
+        <button
+          class="primary"
+          type="submit"
+          disabled={disabled ||
+            configurationUnavailable ||
+            busy !== null ||
+            saveInput === null ||
+            !dirty ||
+            draftConflict}
+        >
+          {busy === "save" ? "Saving..." : "Save configuration"}
+        </button>
+        <button
+          type="button"
+          disabled={disabled ||
+            configurationUnavailable ||
+            summary === null ||
+            dirty ||
+            busy !== null}
+          onclick={connect}
+        >
+          {busy === "authorize" ? "Starting..." : "Connect OAuth"}
+        </button>
+      </div>
+      {#if dirty && summary !== null}
+        <p class="field-help">Save your changes before starting the OAuth authorization.</p>
+      {/if}
+    </form>
+
+    {#if summary !== null}
+      <div class="oauth-actions">
+        {#if confirmingDisconnect}
+          <dialog
+            bind:this={disconnectDialog}
+            open
+            class="inline-confirm-dialog"
+            aria-labelledby={`${panelId}-disconnect-title`}
+            onkeydown={(event) => handleConfirmationKeydown(event, cancelDisconnectConfirmation)}
+          >
+            <strong id={`${panelId}-disconnect-title`}>Disconnect OAuth tokens?</strong>
+            <p>The saved client configuration will remain available.</p>
+            <div class="button-row">
+              <button
+                type="button"
+                disabled={disabled || busy !== null || !canDisconnectOAuth(summary.status)}
+                onclick={disconnect}
+              >
+                {busy === "disconnect" ? "Disconnecting..." : "Disconnect tokens"}
+              </button>
+              <button
+                bind:this={disconnectCancelButton}
+                type="button"
+                disabled={disabled || busy !== null}
+                onclick={cancelDisconnectConfirmation}>Cancel</button
+              >
+            </div>
+          </dialog>
+        {:else}
+          <button
+            bind:this={disconnectButton}
+            type="button"
+            disabled={disabled || busy !== null || !canDisconnectOAuth(summary.status)}
+            onclick={showDisconnectConfirmation}
+          >
+            Disconnect tokens
+          </button>
+        {/if}
+        {#if confirmingDelete}
+          <dialog
+            bind:this={deleteDialog}
+            open
+            class="inline-confirm-dialog"
+            aria-labelledby={`${panelId}-delete-title`}
+            onkeydown={(event) => handleConfirmationKeydown(event, cancelDeleteConfirmation)}
+          >
+            <strong id={`${panelId}-delete-title`}>Delete this OAuth configuration?</strong>
+            <p>This removes the client configuration and all stored OAuth tokens.</p>
+            <div class="button-row">
+              <button
+                class="danger-button"
+                type="button"
+                disabled={disabled || busy !== null}
+                onclick={remove}
+              >
+                {busy === "remove" ? "Deleting..." : "Delete"}
+              </button>
+              <button
+                bind:this={deleteCancelButton}
+                type="button"
+                disabled={disabled || busy !== null}
+                onclick={cancelDeleteConfirmation}>Cancel</button
+              >
+            </div>
+          </dialog>
+        {:else}
+          <button
+            bind:this={deleteButton}
+            class="danger-link"
+            type="button"
+            disabled={disabled || busy !== null}
+            onclick={showDeleteConfirmation}>Delete configuration</button
+          >
+        {/if}
+      </div>
+    {/if}
+  {/if}
+
+  {#if notice !== null}
+    <p id={`${panelId}-notice`} class="notice" role="status" tabindex="-1">{notice}</p>
+  {/if}
+  {#if error !== null}
+    <div id={`${panelId}-error`} class="notice error" role="alert" tabindex="-1">
+      <strong>{error.displayMessage}</strong>
+      {#if error.requestId !== null}<small>Request reference: <code>{error.requestId}</code></small
+        >{/if}
+    </div>
+    {#if draftConflict && conflictLatestLoaded}
+      <button type="button" onclick={discardConflictedDraft}>Discard draft and load latest</button>
+    {:else if draftConflict && conflictRefreshFailed}
+      <button type="button" onclick={retryConflictRefresh}>Retry loading latest</button>
+    {:else if draftConflict}
+      <p class="field-help" aria-live="polite">Loading the latest OAuth configuration...</p>
+    {/if}
+  {/if}
+</section>
+
+<style>
+  .oauth-panel,
+  .oauth-form,
+  .oauth-form fieldset,
+  .secret-fieldset {
+    display: grid;
+    gap: 1rem;
+  }
+
+  .oauth-panel {
+    width: 100%;
+    border-top: 1px solid #293247;
+    padding-top: 1rem;
+  }
+
+  .oauth-heading,
+  .oauth-actions,
+  .callback-field > div,
+  .inline-confirm-dialog .button-row {
+    display: flex;
+    gap: 0.7rem;
+    align-items: center;
+  }
+
+  .oauth-heading {
+    justify-content: space-between;
+  }
+
+  .oauth-heading h3,
+  .oauth-heading p,
+  .oauth-loading {
+    margin: 0;
+  }
+
+  .oauth-status {
+    border: 1px solid #4a556d;
+    border-radius: 999px;
+    padding: 0.28rem 0.55rem;
+    color: #c1cada;
+    background: #171e2b;
+    font-size: 0.68rem;
+    font-weight: 750;
+  }
+
+  .oauth-status.connected {
+    border-color: #315b50;
+    color: #75d5b3;
+    background: #11231f;
+  }
+
+  .oauth-status.error {
+    border-color: #6a3c48;
+    color: #f4bdc8;
+    background: #24141a;
+  }
+
+  .oauth-status.pending {
+    border-color: #75683f;
+    color: #f0e2b7;
+    background: #252015;
+  }
+
+  .oauth-summary {
+    display: grid;
+    grid-template-columns: repeat(2, minmax(0, 1fr));
+    gap: 0.7rem;
+    margin: 0;
+  }
+
+  .oauth-summary div {
+    min-width: 0;
+    border: 1px solid #283146;
+    border-radius: 10px;
+    padding: 0.75rem;
+    background: #0d131d;
+  }
+
+  .oauth-summary dt {
+    color: #8f9bb1;
+    font-size: 0.65rem;
+    font-weight: 750;
+    letter-spacing: 0.06em;
+    text-transform: uppercase;
+  }
+
+  .oauth-summary dd {
+    margin: 0.3rem 0 0;
+    overflow-wrap: anywhere;
+    color: #d7dde8;
+    font-size: 0.78rem;
+  }
+
+  .oauth-form > fieldset,
+  .secret-fieldset {
+    min-width: 0;
+    margin: 0;
+    border: 1px solid #293247;
+    border-radius: 10px;
+    padding: 0.85rem;
+    background: #0d131d;
+  }
+
+  legend {
+    padding: 0 0.35rem;
+    color: #aeb8ca;
+    font-size: 0.72rem;
+    font-weight: 750;
+  }
+
+  .callback-field > div input {
+    min-width: 0;
+  }
+
+  .callback-field > div button {
+    flex: 0 0 auto;
+  }
+
+  .copy-status {
+    min-height: 1.2rem;
+    margin: 0.25rem 0 0;
+    color: #a8b2c4;
+    font-size: 0.74rem;
+  }
+
+  .radio-label {
+    display: flex;
+    gap: 0.5rem;
+    align-items: center;
+  }
+
+  .radio-label input {
+    width: auto;
+    margin: 0;
+  }
+
+  .oauth-actions {
+    flex-wrap: wrap;
+    justify-content: space-between;
+    border-top: 1px solid #293247;
+    padding-top: 1rem;
+  }
+
+  .inline-confirm-dialog {
+    display: grid;
+    flex: 1 1 100%;
+    gap: 0.65rem;
+    width: 100%;
+    margin: 0;
+    border: 1px solid #4a3a45;
+    border-radius: 10px;
+    padding: 0.85rem;
+    color: #f1c2cc;
+    background: #21151a;
+    font-size: 0.78rem;
+  }
+
+  .inline-confirm-dialog p {
+    margin: 0;
+    color: #cbaab2;
+  }
+
+  @media (max-width: 560px) {
+    .oauth-summary {
+      grid-template-columns: 1fr;
+    }
+
+    .callback-field > div,
+    .oauth-actions {
+      align-items: stretch;
+      flex-direction: column;
+    }
+  }
+</style>
diff --git a/web/src/lib/OAuthConnectionPanel.test.ts b/web/src/lib/OAuthConnectionPanel.test.ts
new file mode 100644
index 000000000..d825a868d
--- /dev/null
+++ b/web/src/lib/OAuthConnectionPanel.test.ts
@@ -0,0 +1,692 @@
+import { afterEach, describe, expect, it, vi } from "@effect/vitest";
+import { cleanup, fireEvent, render, screen, waitFor } from "@testing-library/svelte";
+import { tick } from "svelte";
+import OAuthConnectionPanel from "./OAuthConnectionPanel.svelte";
+import type {
+  OAuthConnectionOperations,
+  OAuthConnectionList,
+  OAuthConnectionSummary,
+  OAuthOperationResult,
+} from "./oauth-connection-state";
+
+function summary(overrides: Partial<OAuthConnectionSummary> = {}): OAuthConnectionSummary {
+  return {
+    id: "oauth-1",
+    credentialKey: "provider-oauth",
+    revision: 4,
+    status: "connected",
+    issuer: "https://identity.example.test/",
+    clientId: "executor-client",
+    clientAuthMethod: "client_secret_basic",
+    callbackUrl: "https://executor.example.test/api/v1/oauth/callback/provider-oauth",
+    requestedScopes: ["read", "write"],
+    grantedScopes: ["read"],
+    hasClientSecret: true,
+    hasRefreshToken: true,
+    accessExpiresAt: 100,
+    authorizedAt: 90,
+    lastRefreshedAt: 95,
+    errorCode: null,
+    managedOAuthEligible: true,
+    ...overrides,
+  };
+}
+
+function success<Value>(value: Value): OAuthOperationResult<Value> {
+  return { ok: true, value };
+}
+
+function connectionList(connections: readonly OAuthConnectionSummary[]): OAuthConnectionList {
+  return { connections, availableCredentials: [] };
+}
+
+function operations(connection: OAuthConnectionSummary | null = summary()) {
+  return {
+    load: vi.fn(async (_sourceId: string, _signal: AbortSignal) =>
+      success(connectionList(connection === null ? [] : [connection])),
+    ),
+    save: vi.fn(async (_sourceId, _credentialKey, _input, _signal) =>
+      success(summary({ revision: 5 })),
+    ),
+    authorize: vi.fn(async (_sourceId, _credentialKey, _input, _signal) =>
+      success({ authorizationUrl: "https://identity.example.test/authorize" }),
+    ),
+    disconnect: vi.fn(async (_sourceId, _credentialKey, _input, _signal) =>
+      success(summary({ revision: 5, status: "ready_to_connect", hasRefreshToken: false })),
+    ),
+    remove: vi.fn(async (_sourceId, _credentialKey, _input, _signal) => success(undefined)),
+  } satisfies OAuthConnectionOperations;
+}
+
+function deferred<Value>() {
+  let resolve = (_value: Value) => {};
+  const promise = new Promise<Value>((complete) => {
+    resolve = complete;
+  });
+  return { promise, resolve };
+}
+
+function focusedCancel() {
+  const focused = document.activeElement ?? document.body;
+  expect(focused).toBe(screen.getByRole("button", { name: "Cancel" }));
+  return focused;
+}
+
+afterEach(() => cleanup());
+
+describe("managed OAuth connection panel", () => {
+  it("shows redacted connection metadata and keeps authorization separate from saving", async () => {
+    const api = operations();
+    const navigate = vi.fn();
+    render(OAuthConnectionPanel, {
+      sourceId: "source-1",
+      credentialKey: "provider-oauth",
+      operations: api,
+      navigate,
+    });
+
+    expect(await screen.findByText("Connected")).toBeDefined();
+    expect(screen.getByDisplayValue(summary().callbackUrl)).toBeDefined();
+    expect(screen.getByText("Stored securely")).toBeDefined();
+    expect(document.body.textContent).not.toContain("refresh-token");
+    expect(document.body.textContent).not.toContain("client-secret");
+
+    await fireEvent.input(screen.getByLabelText(/Requested scopes/), {
+      target: { value: "read write profile" },
+    });
+    expect(screen.getByRole<HTMLButtonElement>("button", { name: "Connect OAuth" }).disabled).toBe(
+      true,
+    );
+    await fireEvent.click(screen.getByRole("button", { name: "Save configuration" }));
+
+    await waitFor(() => expect(api.save).toHaveBeenCalledOnce());
+    expect(api.save.mock.calls[0]?.[2]).toEqual({
+      expectedRevision: 4,
+      discovery: { type: "issuer", issuer: "https://identity.example.test/" },
+      client: {
+        clientId: "executor-client",
+        authentication: "client_secret_basic",
+        clientSecret: { action: "preserve" },
+      },
+      scopes: ["read", "write", "profile"],
+    });
+    await fireEvent.click(screen.getByRole("button", { name: "Connect OAuth" }));
+    await waitFor(() =>
+      expect(navigate).toHaveBeenCalledWith("https://identity.example.test/authorize"),
+    );
+    expect(api.authorize).toHaveBeenCalledWith(
+      "source-1",
+      "provider-oauth",
+      { expectedRevision: 5 },
+      expect.any(AbortSignal),
+    );
+  });
+
+  it("clears a replacement secret after a failed save without echoing it", async () => {
+    const api = operations();
+    const response = deferred<OAuthOperationResult<OAuthConnectionSummary>>();
+    api.save.mockImplementation(() => response.promise);
+    const failure = {
+      ok: false,
+      error: {
+        code: "upstream_rejected",
+        displayMessage: "The OAuth configuration was rejected.",
+        requestId: "request-safe",
+        status: 400,
+      },
+    } as const;
+    render(OAuthConnectionPanel, {
+      sourceId: "source-1",
+      credentialKey: "provider-oauth",
+      operations: api,
+    });
+
+    await screen.findByText("Connected");
+    await fireEvent.click(screen.getByLabelText("Replace the saved secret"));
+    const secret = screen.getByLabelText<HTMLInputElement>("New client secret");
+    await fireEvent.input(secret, { target: { value: " never-render-this " } });
+    await fireEvent.click(screen.getByRole("button", { name: "Save configuration" }));
+
+    await waitFor(() => expect(api.save).toHaveBeenCalledOnce());
+    expect(screen.getByLabelText<HTMLInputElement>("New client secret").value).toBe("");
+    expect(document.body.textContent).not.toContain("never-render-this");
+    response.resolve(failure);
+    await waitFor(() => expect(screen.getByRole("alert")).toBeDefined());
+    expect(api.save.mock.calls[0]?.[2].client).toEqual({
+      clientId: "executor-client",
+      authentication: "client_secret_basic",
+      clientSecret: { action: "replace", value: " never-render-this " },
+    });
+  });
+
+  it("makes the public-client transition explicitly clear the stored secret", async () => {
+    const api = operations();
+    render(OAuthConnectionPanel, {
+      sourceId: "source-1",
+      credentialKey: "provider-oauth",
+      operations: api,
+    });
+
+    await screen.findByText("Connected");
+    await fireEvent.change(screen.getByLabelText("Client type"), { target: { value: "public" } });
+    expect(screen.getByText(/clears the stored client secret/)).toBeDefined();
+    await fireEvent.click(screen.getByRole("button", { name: "Save configuration" }));
+    await waitFor(() => expect(api.save).toHaveBeenCalledOnce());
+    expect(api.save.mock.calls[0]?.[2].client).toEqual({
+      clientId: "executor-client",
+      authentication: "none",
+    });
+  });
+
+  it("saves MCP discovery with default scopes and no required issuer override", async () => {
+    const api = operations(null);
+    render(OAuthConnectionPanel, {
+      sourceId: "source-1",
+      credentialKey: "default",
+      defaultRequestedScopes: ["tools.read", "tools.call"],
+      discoveryType: "mcp",
+      operations: api,
+    });
+
+    expect(await screen.findByDisplayValue("tools.read tools.call")).toBeDefined();
+    await fireEvent.input(screen.getByLabelText("Client ID"), {
+      target: { value: "executor-client" },
+    });
+    await fireEvent.click(screen.getByRole("button", { name: "Save configuration" }));
+
+    await waitFor(() => expect(api.save).toHaveBeenCalledOnce());
+    expect(api.save.mock.calls[0]?.[2]).toEqual({
+      expectedRevision: 0,
+      discovery: { type: "mcp" },
+      client: { clientId: "executor-client", authentication: "none" },
+      scopes: ["tools.read", "tools.call"],
+    });
+  });
+
+  it("refetches on an opaque callback key and rejects an older completion", async () => {
+    const first = deferred<OAuthOperationResult<OAuthConnectionList>>();
+    const second = deferred<OAuthOperationResult<OAuthConnectionList>>();
+    const api = operations();
+    api.load
+      .mockImplementationOnce(() => first.promise)
+      .mockImplementationOnce(() => second.promise);
+    const mounted = render(OAuthConnectionPanel, {
+      sourceId: "source-1",
+      credentialKey: "provider-oauth",
+      callbackRefreshKey: null,
+      operations: api,
+    });
+
+    await mounted.rerender({
+      sourceId: "source-1",
+      credentialKey: "provider-oauth",
+      callbackRefreshKey: "success:oauth-1:provider-secret-data",
+      operations: api,
+    });
+    second.resolve(success(connectionList([summary({ status: "connected" })])));
+    const status = await screen.findByText("Connected");
+    expect(status.getAttribute("role")).toBe("status");
+    expect(status.getAttribute("aria-live")).toBe("polite");
+    first.resolve(success(connectionList([summary({ status: "error" })])));
+    await first.promise;
+    await Promise.resolve();
+    expect(screen.queryByText("Connection error")).toBeNull();
+    expect(document.body.textContent).not.toContain("provider-secret-data");
+  });
+
+  it("aborts an owned load when the panel unmounts", async () => {
+    const request = { signal: null as AbortSignal | null };
+    const pending = deferred<OAuthOperationResult<OAuthConnectionList>>();
+    const api = operations();
+    api.load.mockImplementation((_sourceId, currentSignal) => {
+      request.signal = currentSignal;
+      return pending.promise;
+    });
+    const mounted = render(OAuthConnectionPanel, {
+      sourceId: "source-1",
+      credentialKey: "provider-oauth",
+      operations: api,
+    });
+
+    await waitFor(() => expect(request.signal).not.toBeNull());
+    mounted.unmount();
+    expect(request.signal?.aborted).toBe(true);
+  });
+
+  it("reports only OAuth writes as mutations and clears the fence on unmount", async () => {
+    const response = deferred<OAuthOperationResult<OAuthConnectionSummary>>();
+    const request = { signal: null as AbortSignal | null };
+    const api = operations();
+    api.save.mockImplementation((_sourceId, _credentialKey, _input, signal) => {
+      request.signal = signal;
+      return response.promise;
+    });
+    const onmutationchange = vi.fn();
+    const mounted = render(OAuthConnectionPanel, {
+      sourceId: "source-1",
+      credentialKey: "provider-oauth",
+      operations: api,
+      onmutationchange,
+    });
+
+    await screen.findByText("Connected");
+    expect(onmutationchange).not.toHaveBeenCalled();
+    await fireEvent.input(screen.getByLabelText(/Requested scopes/), {
+      target: { value: "read profile" },
+    });
+    await fireEvent.click(screen.getByRole("button", { name: "Save configuration" }));
+    await waitFor(() => expect(onmutationchange).toHaveBeenLastCalledWith(true));
+
+    mounted.unmount();
+    expect(request.signal?.aborted).toBe(true);
+    expect(onmutationchange).toHaveBeenLastCalledWith(false);
+    response.resolve(success(summary({ revision: 5 })));
+    await response.promise;
+  });
+
+  it("aborts and rejects an authorization completion after the panel identity changes", async () => {
+    const authorization = deferred<OAuthOperationResult<{ authorizationUrl: string }>>();
+    const request = { signal: null as AbortSignal | null };
+    const api = operations();
+    api.authorize.mockImplementation((_sourceId, _credentialKey, _input, signal) => {
+      request.signal = signal;
+      return authorization.promise;
+    });
+    const navigate = vi.fn();
+    const mounted = render(OAuthConnectionPanel, {
+      sourceId: "source-a",
+      credentialKey: "provider-oauth",
+      operations: api,
+      navigate,
+    });
+    await screen.findByText("Connected");
+    await fireEvent.click(screen.getByRole("button", { name: "Connect OAuth" }));
+    await waitFor(() => expect(request.signal).not.toBeNull());
+
+    await mounted.rerender({
+      sourceId: "source-b",
+      credentialKey: "provider-oauth",
+      operations: api,
+      navigate,
+    });
+    expect(request.signal?.aborted).toBe(true);
+    authorization.resolve(success({ authorizationUrl: "https://old.example.test/authorize" }));
+    await authorization.promise;
+    await Promise.resolve();
+    expect(navigate).not.toHaveBeenCalled();
+  });
+
+  it("aborts a save when an OAuth callback triggers a status refresh", async () => {
+    const response = deferred<OAuthOperationResult<OAuthConnectionSummary>>();
+    const request = { signal: null as AbortSignal | null };
+    const api = operations();
+    api.save.mockImplementation((_sourceId, _credentialKey, _input, signal) => {
+      request.signal = signal;
+      return response.promise;
+    });
+    const mounted = render(OAuthConnectionPanel, {
+      sourceId: "source-1",
+      credentialKey: "provider-oauth",
+      callbackRefreshKey: null,
+      operations: api,
+    });
+    await screen.findByText("Connected");
+    await fireEvent.input(screen.getByLabelText(/Requested scopes/), {
+      target: { value: "read profile" },
+    });
+    await fireEvent.click(screen.getByRole("button", { name: "Save configuration" }));
+    await waitFor(() => expect(request.signal).not.toBeNull());
+
+    await mounted.rerender({
+      sourceId: "source-1",
+      credentialKey: "provider-oauth",
+      callbackRefreshKey: "success:oauth-1",
+      operations: api,
+    });
+    expect(request.signal?.aborted).toBe(true);
+    response.resolve(success(summary({ revision: 99 })));
+    await response.promise;
+    await Promise.resolve();
+    expect(screen.queryByText(/OAuth configuration saved/)).toBeNull();
+  });
+
+  it("aborts authorization when the operations implementation changes", async () => {
+    const authorization = deferred<OAuthOperationResult<{ authorizationUrl: string }>>();
+    const request = { signal: null as AbortSignal | null };
+    const firstOperations = operations();
+    firstOperations.authorize.mockImplementation((_sourceId, _credentialKey, _input, signal) => {
+      request.signal = signal;
+      return authorization.promise;
+    });
+    const nextOperations = operations();
+    const navigate = vi.fn();
+    const mounted = render(OAuthConnectionPanel, {
+      sourceId: "source-1",
+      credentialKey: "provider-oauth",
+      operations: firstOperations,
+      navigate,
+    });
+    await screen.findByText("Connected");
+    await fireEvent.click(screen.getByRole("button", { name: "Connect OAuth" }));
+    await waitFor(() => expect(request.signal).not.toBeNull());
+
+    await mounted.rerender({
+      sourceId: "source-1",
+      credentialKey: "provider-oauth",
+      operations: nextOperations,
+      navigate,
+    });
+    expect(request.signal?.aborted).toBe(true);
+    authorization.resolve(success({ authorizationUrl: "https://old.example.test/authorize" }));
+    await authorization.promise;
+    await Promise.resolve();
+    expect(navigate).not.toHaveBeenCalled();
+  });
+
+  it("clears a completed mutation notice when the panel identity changes", async () => {
+    const api = operations();
+    const mounted = render(OAuthConnectionPanel, {
+      sourceId: "source-a",
+      credentialKey: "provider-oauth",
+      operations: api,
+    });
+    await screen.findByText("Connected");
+    await fireEvent.input(screen.getByLabelText(/Requested scopes/), {
+      target: { value: "read profile" },
+    });
+    await fireEvent.click(screen.getByRole("button", { name: "Save configuration" }));
+    expect(await screen.findByText(/OAuth configuration saved/)).toBeDefined();
+
+    await mounted.rerender({
+      sourceId: "source-b",
+      credentialKey: "provider-oauth",
+      operations: api,
+    });
+    await waitFor(() => expect(screen.queryByText(/OAuth configuration saved/)).toBeNull());
+  });
+
+  it("blocks a conflicted draft until the operator loads the latest revision", async () => {
+    const api = operations();
+    api.load
+      .mockResolvedValueOnce(success(connectionList([summary({ revision: 4 })])))
+      .mockResolvedValueOnce({
+        ok: false,
+        error: {
+          code: "network_error",
+          displayMessage: "Executor could not load the latest configuration.",
+          requestId: null,
+          status: 503,
+        },
+      })
+      .mockResolvedValueOnce(
+        success(connectionList([summary({ revision: 5, requestedScopes: ["server-change"] })])),
+      );
+    api.save
+      .mockResolvedValueOnce({
+        ok: false,
+        error: {
+          code: "revision_conflict",
+          displayMessage: "OAuth configuration changed elsewhere.",
+          requestId: "request-conflict",
+          status: 409,
+        },
+      })
+      .mockResolvedValueOnce(success(summary({ revision: 6 })));
+    render(OAuthConnectionPanel, {
+      sourceId: "source-1",
+      credentialKey: "provider-oauth",
+      operations: api,
+    });
+    await screen.findByText("Connected");
+    let scopes = screen.getByLabelText<HTMLInputElement>(/Requested scopes/);
+    await fireEvent.input(scopes, { target: { value: "my-draft" } });
+    await fireEvent.click(screen.getByRole("button", { name: "Save configuration" }));
+
+    const retry = await screen.findByRole("button", { name: "Retry loading latest" });
+    expect(
+      screen.getByRole<HTMLButtonElement>("button", { name: "Save configuration" }).disabled,
+    ).toBe(true);
+    expect(api.save.mock.calls[0]?.[2].expectedRevision).toBe(4);
+    await fireEvent.click(retry);
+    const discard = await screen.findByRole("button", { name: "Discard draft and load latest" });
+    await fireEvent.click(discard);
+    await waitFor(() =>
+      expect(screen.getByLabelText<HTMLInputElement>(/Requested scopes/).value).toBe(
+        "server-change",
+      ),
+    );
+
+    scopes = screen.getByLabelText<HTMLInputElement>(/Requested scopes/);
+    await fireEvent.input(scopes, { target: { value: "server-change mine" } });
+    await fireEvent.click(screen.getByRole("button", { name: "Save configuration" }));
+    await waitFor(() => expect(api.save).toHaveBeenCalledTimes(2));
+    expect(api.save.mock.calls[1]?.[2].expectedRevision).toBe(5);
+  });
+
+  it("allows access-token-only disconnects and closes confirmation when status clears", async () => {
+    const refreshed = deferred<OAuthOperationResult<OAuthConnectionList>>();
+    const api = operations();
+    api.load
+      .mockResolvedValueOnce(
+        success(connectionList([summary({ status: "connected", hasRefreshToken: false })])),
+      )
+      .mockImplementationOnce(() => refreshed.promise);
+    const mounted = render(OAuthConnectionPanel, {
+      sourceId: "source-1",
+      credentialKey: "provider-oauth",
+      callbackRefreshKey: null,
+      operations: api,
+    });
+    expect(await screen.findByText("Not stored")).toBeDefined();
+    const disconnect = screen.getByRole<HTMLButtonElement>("button", {
+      name: "Disconnect tokens",
+    });
+    expect(disconnect.disabled).toBe(false);
+    await fireEvent.click(disconnect);
+    expect(screen.getByRole("dialog", { name: "Disconnect OAuth tokens?" })).toBeDefined();
+    focusedCancel();
+
+    await mounted.rerender({
+      sourceId: "source-1",
+      credentialKey: "provider-oauth",
+      callbackRefreshKey: "success:oauth-1",
+      operations: api,
+    });
+    await waitFor(() => expect(api.load).toHaveBeenCalledTimes(2));
+    const panelHeading = screen.getByRole("heading", { name: "provider-oauth" });
+    expect(document.activeElement).toBe(panelHeading);
+    refreshed.resolve(
+      success(connectionList([summary({ status: "ready_to_connect", hasRefreshToken: false })])),
+    );
+    const disabledDisconnect = await screen.findByRole<HTMLButtonElement>("button", {
+      name: "Disconnect tokens",
+    });
+    await waitFor(() =>
+      expect(screen.queryByRole("dialog", { name: "Disconnect OAuth tokens?" })).toBeNull(),
+    );
+    expect(disabledDisconnect.disabled).toBe(true);
+    expect(document.activeElement).toBe(panelHeading);
+  });
+
+  it("restores Cancel after a refresh removes focused disconnect confirmation", async () => {
+    const refreshed = deferred<OAuthOperationResult<OAuthConnectionList>>();
+    const api = operations();
+    api.load
+      .mockResolvedValueOnce(success(connectionList([summary()])))
+      .mockImplementationOnce(() => refreshed.promise);
+    const mounted = render(OAuthConnectionPanel, {
+      sourceId: "source-1",
+      credentialKey: "provider-oauth",
+      callbackRefreshKey: null,
+      operations: api,
+    });
+    await screen.findByText("Connected");
+    await fireEvent.click(screen.getByRole("button", { name: "Disconnect tokens" }));
+    const confirm = screen.getByRole("button", { name: "Disconnect tokens" });
+    confirm.focus();
+    expect(document.activeElement).toBe(confirm);
+
+    await mounted.rerender({
+      sourceId: "source-1",
+      credentialKey: "provider-oauth",
+      callbackRefreshKey: "success:oauth-1",
+      operations: api,
+    });
+    await waitFor(() => expect(api.load).toHaveBeenCalledTimes(2));
+    expect(document.activeElement).toBe(screen.getByRole("heading", { name: "provider-oauth" }));
+
+    refreshed.resolve(success(connectionList([summary()])));
+    expect(await screen.findByRole("dialog", { name: "Disconnect OAuth tokens?" })).toBeDefined();
+    await waitFor(() => focusedCancel());
+  });
+
+  it("restores Cancel after a refresh removes focused delete confirmation", async () => {
+    const refreshed = deferred<OAuthOperationResult<OAuthConnectionList>>();
+    const api = operations();
+    api.load
+      .mockResolvedValueOnce(success(connectionList([summary()])))
+      .mockImplementationOnce(() => refreshed.promise);
+    const mounted = render(OAuthConnectionPanel, {
+      sourceId: "source-1",
+      credentialKey: "provider-oauth",
+      callbackRefreshKey: null,
+      operations: api,
+    });
+    await screen.findByText("Connected");
+    await fireEvent.click(screen.getByRole("button", { name: "Delete configuration" }));
+    const confirm = screen.getByRole("button", { name: "Delete" });
+    confirm.focus();
+    expect(document.activeElement).toBe(confirm);
+
+    await mounted.rerender({
+      sourceId: "source-1",
+      credentialKey: "provider-oauth",
+      callbackRefreshKey: "success:oauth-1",
+      operations: api,
+    });
+    await waitFor(() => expect(api.load).toHaveBeenCalledTimes(2));
+    expect(document.activeElement).toBe(screen.getByRole("heading", { name: "provider-oauth" }));
+
+    refreshed.resolve(success(connectionList([summary()])));
+    expect(
+      await screen.findByRole("dialog", { name: "Delete this OAuth configuration?" }),
+    ).toBeDefined();
+    await waitFor(() => focusedCancel());
+  });
+
+  it("does not restore confirmation focus after the operator moves elsewhere", async () => {
+    const refreshed = deferred<OAuthOperationResult<OAuthConnectionList>>();
+    const api = operations();
+    api.load
+      .mockResolvedValueOnce(success(connectionList([summary()])))
+      .mockImplementationOnce(() => refreshed.promise);
+    const mounted = render(OAuthConnectionPanel, {
+      sourceId: "source-1",
+      credentialKey: "provider-oauth",
+      callbackRefreshKey: null,
+      operations: api,
+    });
+    await screen.findByText("Connected");
+    await fireEvent.click(screen.getByRole("button", { name: "Disconnect tokens" }));
+    screen.getByRole("button", { name: "Disconnect tokens" }).focus();
+
+    await mounted.rerender({
+      sourceId: "source-1",
+      credentialKey: "provider-oauth",
+      callbackRefreshKey: "success:oauth-1",
+      operations: api,
+    });
+    await waitFor(() => expect(api.load).toHaveBeenCalledTimes(2));
+    expect(document.activeElement).toBe(screen.getByRole("heading", { name: "provider-oauth" }));
+    const elsewhere = document.createElement("button");
+    elsewhere.textContent = "Elsewhere";
+    mounted.container.append(elsewhere);
+    elsewhere.focus();
+    expect(document.activeElement).toBe(elsewhere);
+
+    refreshed.resolve(success(connectionList([summary()])));
+    expect(await screen.findByRole("dialog", { name: "Disconnect OAuth tokens?" })).toBeDefined();
+    expect(screen.getByRole("button", { name: "Cancel" })).toBeDefined();
+    await tick();
+    expect(document.activeElement).toBe(elsewhere);
+  });
+
+  it("confirms destructive actions and manages keyboard focus", async () => {
+    const api = operations();
+    render(OAuthConnectionPanel, {
+      sourceId: "source-1",
+      credentialKey: "provider-oauth",
+      operations: api,
+    });
+    await screen.findByText("Connected");
+
+    const disconnectOpener = screen.getByRole("button", { name: "Disconnect tokens" });
+    await fireEvent.click(disconnectOpener);
+    expect(screen.getByRole("dialog", { name: "Disconnect OAuth tokens?" })).toBeDefined();
+    await fireEvent.click(focusedCancel());
+    await waitFor(() =>
+      expect(document.activeElement).toBe(
+        screen.getByRole("button", { name: "Disconnect tokens" }),
+      ),
+    );
+    expect(api.disconnect).not.toHaveBeenCalled();
+
+    await fireEvent.click(screen.getByRole("button", { name: "Disconnect tokens" }));
+    expect(screen.getByRole("dialog", { name: "Disconnect OAuth tokens?" })).toBeDefined();
+    await fireEvent.keyDown(focusedCancel(), { key: "Escape" });
+    await waitFor(() =>
+      expect(document.activeElement).toBe(
+        screen.getByRole("button", { name: "Disconnect tokens" }),
+      ),
+    );
+    expect(api.disconnect).not.toHaveBeenCalled();
+
+    await fireEvent.click(screen.getByRole("button", { name: "Disconnect tokens" }));
+    expect(screen.getByRole("dialog", { name: "Disconnect OAuth tokens?" })).toBeDefined();
+    focusedCancel();
+    await fireEvent.click(screen.getByRole("button", { name: "Disconnect tokens" }));
+    await waitFor(() => expect(api.disconnect).toHaveBeenCalledOnce());
+    expect(api.disconnect).toHaveBeenCalledWith(
+      "source-1",
+      "provider-oauth",
+      { expectedRevision: 4 },
+      expect.any(AbortSignal),
+    );
+    const disconnectedNotice = screen.getByText(/OAuth tokens disconnected/);
+    await waitFor(() => expect(document.activeElement).toBe(disconnectedNotice));
+    expect(
+      screen.getByRole<HTMLButtonElement>("button", { name: "Disconnect tokens" }).disabled,
+    ).toBe(true);
+
+    const deleteOpener = screen.getByRole("button", { name: "Delete configuration" });
+    await fireEvent.click(deleteOpener);
+    expect(screen.getByText("Delete this OAuth configuration?")).toBeDefined();
+    expect(screen.getByRole("dialog", { name: "Delete this OAuth configuration?" })).toBeDefined();
+    await fireEvent.click(focusedCancel());
+    await waitFor(() =>
+      expect(document.activeElement).toBe(
+        screen.getByRole("button", { name: "Delete configuration" }),
+      ),
+    );
+    expect(api.remove).not.toHaveBeenCalled();
+
+    await fireEvent.click(screen.getByRole("button", { name: "Delete configuration" }));
+    expect(screen.getByRole("dialog", { name: "Delete this OAuth configuration?" })).toBeDefined();
+    await fireEvent.keyDown(focusedCancel(), { key: "Escape" });
+    await waitFor(() =>
+      expect(document.activeElement).toBe(
+        screen.getByRole("button", { name: "Delete configuration" }),
+      ),
+    );
+    expect(api.remove).not.toHaveBeenCalled();
+
+    await fireEvent.click(screen.getByRole("button", { name: "Delete configuration" }));
+    expect(screen.getByRole("dialog", { name: "Delete this OAuth configuration?" })).toBeDefined();
+    focusedCancel();
+    await fireEvent.click(screen.getByRole("button", { name: "Delete" }));
+    await waitFor(() => expect(api.remove).toHaveBeenCalledOnce());
+    expect(screen.queryByDisplayValue(summary().callbackUrl)).toBeNull();
+    const deletedNotice = screen.getByText("OAuth configuration deleted.");
+    await waitFor(() => expect(document.activeElement).toBe(deletedNotice));
+  });
+});
diff --git a/web/src/lib/OAuthSourceConnections.svelte b/web/src/lib/OAuthSourceConnections.svelte
new file mode 100644
index 000000000..a738b6386
--- /dev/null
+++ b/web/src/lib/OAuthSourceConnections.svelte
@@ -0,0 +1,322 @@
+<script lang="ts">
+  import { untrack } from "svelte";
+  import OAuthConnectionPanel from "$lib/OAuthConnectionPanel.svelte";
+  import { useAuthState } from "$lib/auth.svelte";
+  import {
+    oauthCallbackConnectionId,
+    oauthCallbackOutcomeNotice,
+    type OAuthAvailableCredential,
+    type OAuthConnectionList,
+    type OAuthConnectionOperations,
+    type OAuthOperationError,
+  } from "$lib/oauth-connection-state";
+  import { ApiError, type Source } from "$lib/api";
+
+  type OAuthConnectionEntry = Omit<OAuthAvailableCredential, "managedOAuthEligible"> & {
+    readonly managedOAuthEligible: boolean;
+  };
+
+  let {
+    source,
+    sourceIdentity,
+    operations,
+    callbackRefreshKey = null,
+    disabled = false,
+    onbusychange,
+    onmutationchange,
+    oncallbackchecked,
+  }: {
+    source: Source;
+    sourceIdentity?: string;
+    operations: OAuthConnectionOperations;
+    callbackRefreshKey?: string | null;
+    disabled?: boolean;
+    onbusychange?: (busy: boolean) => void;
+    onmutationchange?: (busy: boolean) => void;
+    oncallbackchecked?: (matched: boolean) => void;
+  } = $props();
+
+  const auth = useAuthState();
+  let list = $state<OAuthConnectionList | null>(null);
+  let loading = $state(false);
+  let error = $state<OAuthOperationError | null>(null);
+  let panelBusyKeys = $state<string[]>([]);
+  let panelMutationKeys = $state<string[]>([]);
+  let refreshNonce = $state(0);
+  let controller: AbortController | null = null;
+  let generation = 0;
+  let reportedBusy = false;
+  let reportedMutation = false;
+  let callbackNotice = $state<{
+    key: string;
+    tone: "success" | "error";
+    message: string;
+  } | null>(null);
+  let latestCallbackKey: string | null = null;
+  let stableSourceId = $state(untrack(() => sourceIdentity ?? source.id));
+  let stableSourceKind = $state(untrack(() => source.kind));
+  let stableSourceDisplayName = $state(untrack(() => source.displayName));
+  let stableOperations = $state.raw(untrack(() => operations));
+  let stableCallbackRefreshKey = $state<string | null>(untrack(() => callbackRefreshKey));
+  let stableDisabled = $state(untrack(() => disabled));
+  let entries = $derived(connectionEntries(list, stableSourceKind));
+
+  $effect(() => {
+    const nextSourceId = sourceIdentity ?? source.id;
+    const nextSourceKind = source.kind;
+    const nextSourceDisplayName = source.displayName;
+    const nextOperations = operations;
+    const nextCallbackRefreshKey = callbackRefreshKey;
+    const nextDisabled = disabled;
+    if (stableSourceId !== nextSourceId) stableSourceId = nextSourceId;
+    if (stableSourceKind !== nextSourceKind) stableSourceKind = nextSourceKind;
+    if (stableSourceDisplayName !== nextSourceDisplayName) {
+      stableSourceDisplayName = nextSourceDisplayName;
+    }
+    if (stableOperations !== nextOperations) stableOperations = nextOperations;
+    if (stableCallbackRefreshKey !== nextCallbackRefreshKey) {
+      stableCallbackRefreshKey = nextCallbackRefreshKey;
+    }
+    if (stableDisabled !== nextDisabled) stableDisabled = nextDisabled;
+  });
+
+  $effect(() => {
+    const currentSourceId = stableSourceId;
+    const currentCallbackKey = stableCallbackRefreshKey;
+    const currentOperations = stableOperations;
+    const currentDisabled = stableDisabled;
+    const currentRefreshNonce = refreshNonce;
+    void currentRefreshNonce;
+    if (currentCallbackKey !== null && currentCallbackKey !== latestCallbackKey) {
+      latestCallbackKey = currentCallbackKey;
+      callbackNotice = null;
+    }
+    if (currentDisabled) {
+      controller?.abort();
+      controller = null;
+      loading = false;
+      return;
+    }
+
+    const mine = ++generation;
+    const request = new AbortController();
+    controller?.abort();
+    controller = request;
+    loading = true;
+    error = null;
+    void currentOperations.load(currentSourceId, request.signal).then(
+      (result) => {
+        if (mine !== generation || request.signal.aborted) return;
+        controller = null;
+        loading = false;
+        if (!result.ok) {
+          const apiError = new ApiError(result.error);
+          if (!auth?.recoverFromApiError(apiError)) error = result.error;
+          return;
+        }
+        list = result.value;
+        const callbackConnectionId = oauthCallbackConnectionId(currentCallbackKey);
+        const callbackMatches =
+          callbackConnectionId !== null &&
+          result.value.connections.some((connection) => connection.id === callbackConnectionId);
+        if (callbackMatches) {
+          const notice = oauthCallbackOutcomeNotice(currentCallbackKey ?? "", true);
+          callbackNotice = { key: currentCallbackKey ?? "", ...notice };
+        }
+        if (callbackConnectionId !== null) oncallbackchecked?.(callbackMatches);
+      },
+      () => {
+        if (mine !== generation || request.signal.aborted) return;
+        controller = null;
+        loading = false;
+        error = localLoadError();
+      },
+    );
+
+    return () => {
+      generation += 1;
+      request.abort();
+      if (controller === request) controller = null;
+    };
+  });
+
+  $effect(() => {
+    const busy = loading || panelBusyKeys.length > 0;
+    if (busy === reportedBusy) return;
+    reportedBusy = busy;
+    onbusychange?.(busy);
+  });
+
+  $effect(() => {
+    const busy = panelMutationKeys.length > 0;
+    if (busy === reportedMutation) return;
+    reportedMutation = busy;
+    onmutationchange?.(busy);
+  });
+
+  $effect(() => () => {
+    controller?.abort();
+    if (reportedBusy) onbusychange?.(false);
+    if (reportedMutation) onmutationchange?.(false);
+  });
+
+  function setPanelBusy(credentialKey: string, busy: boolean) {
+    panelBusyKeys = busy
+      ? [...new Set([...panelBusyKeys, credentialKey])]
+      : panelBusyKeys.filter((candidate) => candidate !== credentialKey);
+  }
+
+  function setPanelMutation(credentialKey: string, busy: boolean) {
+    panelMutationKeys = busy
+      ? [...new Set([...panelMutationKeys, credentialKey])]
+      : panelMutationKeys.filter((candidate) => candidate !== credentialKey);
+  }
+
+  function retryLoad() {
+    refreshNonce += 1;
+  }
+
+  function localLoadError(): OAuthOperationError {
+    return {
+      code: "network_error",
+      displayMessage: "Executor could not load managed OAuth connections.",
+      requestId: null,
+      status: 0,
+    };
+  }
+
+  function connectionEntries(current: OAuthConnectionList | null, sourceKind: Source["kind"]) {
+    if (current === null) return [];
+    const options = new Map<string, OAuthConnectionEntry>();
+    for (const option of current.availableCredentials) options.set(option.credentialKey, option);
+    for (const connection of current.connections) {
+      if (options.has(connection.credentialKey)) continue;
+      const protocol =
+        sourceKind === "graphql"
+          ? "graphql"
+          : sourceKind === "mcp_http"
+            ? "mcp_http"
+            : sourceKind === "openapi"
+              ? "openapi"
+              : null;
+      if (protocol === null) continue;
+      options.set(connection.credentialKey, {
+        credentialKey: connection.credentialKey,
+        protocol,
+        requestedScopes: connection.requestedScopes,
+        managedOAuthEligible: connection.managedOAuthEligible,
+      });
+    }
+    return [...options.values()].sort((left, right) =>
+      left.credentialKey.localeCompare(right.credentialKey),
+    );
+  }
+</script>
+
+{#if loading && list === null}
+  <p class="oauth-loading" aria-live="polite">Loading managed OAuth options...</p>
+{:else if error !== null && list === null}
+  <div class="notice error" role="alert">
+    <strong>{error.displayMessage}</strong>
+    {#if error.requestId !== null}<small>Request reference: <code>{error.requestId}</code></small
+      >{/if}
+    <button type="button" onclick={retryLoad}>Retry managed OAuth</button>
+  </div>
+{:else if list !== null}
+  <section class="oauth-connections" aria-label={`Managed OAuth for ${stableSourceDisplayName}`}>
+    {#if error !== null}
+      <div class="notice error" role="alert">
+        <strong>{error.displayMessage}</strong>
+        <span>Showing the last loaded managed OAuth options.</span>
+        {#if error.requestId !== null}<small
+            >Request reference: <code>{error.requestId}</code></small
+          >{/if}
+        <button type="button" onclick={retryLoad}>Retry managed OAuth</button>
+      </div>
+    {:else if loading}
+      <p class="oauth-loading" aria-live="polite">Refreshing managed OAuth options...</p>
+    {/if}
+    {#if callbackNotice !== null}
+      <p
+        class:error={callbackNotice.tone === "error"}
+        class="notice callback-notice"
+        role={callbackNotice.tone === "error" ? "alert" : "status"}
+      >
+        {callbackNotice.message}
+      </p>
+    {/if}
+    {#if entries.length > 0}
+      <div class="oauth-intro">
+        <div>
+          <p class="eyebrow">Managed OAuth</p>
+          <h3>Provider connections</h3>
+        </div>
+        <p>
+          Executor stores refreshable tokens locally. Manual access tokens remain available under
+          advanced credential settings.
+        </p>
+      </div>
+      {#each entries as entry (entry.credentialKey)}
+        <OAuthConnectionPanel
+          sourceId={stableSourceId}
+          credentialKey={entry.credentialKey}
+          defaultRequestedScopes={entry.requestedScopes}
+          discoveryType={entry.protocol === "mcp_http" ? "mcp" : "issuer"}
+          configurationDisabled={!entry.managedOAuthEligible}
+          operations={stableOperations}
+          callbackRefreshKey={stableCallbackRefreshKey}
+          disabled={stableDisabled}
+          onbusychange={(busy) => setPanelBusy(entry.credentialKey, busy)}
+          onmutationchange={(busy) => setPanelMutation(entry.credentialKey, busy)}
+        />
+      {/each}
+    {/if}
+  </section>
+{/if}
+
+<style>
+  .oauth-connections {
+    display: grid;
+    flex-basis: 100%;
+    gap: 1rem;
+    width: 100%;
+    border-top: 1px solid #293247;
+    padding-top: 1rem;
+  }
+
+  .oauth-intro {
+    display: flex;
+    justify-content: space-between;
+    gap: 1rem;
+    align-items: flex-start;
+  }
+
+  .oauth-intro h3,
+  .oauth-intro p {
+    margin: 0;
+  }
+
+  .oauth-intro > p {
+    max-width: 32rem;
+    color: #9da8bb;
+    font-size: 0.76rem;
+    line-height: 1.5;
+  }
+
+  .oauth-loading {
+    flex-basis: 100%;
+    margin: 0;
+    color: #a8b2c4;
+    font-size: 0.78rem;
+  }
+
+  .callback-notice {
+    margin: 0;
+  }
+
+  @media (max-width: 560px) {
+    .oauth-intro {
+      flex-direction: column;
+    }
+  }
+</style>
diff --git a/web/src/lib/OAuthSourceConnections.test.ts b/web/src/lib/OAuthSourceConnections.test.ts
new file mode 100644
index 000000000..4f3f00ae1
--- /dev/null
+++ b/web/src/lib/OAuthSourceConnections.test.ts
@@ -0,0 +1,368 @@
+import { afterEach, describe, expect, it, vi } from "@effect/vitest";
+import { cleanup, fireEvent, render, screen, waitFor, within } from "@testing-library/svelte";
+import OAuthSourceConnections from "./OAuthSourceConnections.svelte";
+import type {
+  OAuthConnectionList,
+  OAuthConnectionOperations,
+  OAuthConnectionSummary,
+  OAuthOperationResult,
+} from "./oauth-connection-state";
+import type { Source } from "./api";
+
+function source(): Source {
+  return {
+    id: "source-1",
+    kind: "openapi",
+    slug: "provider",
+    displayName: "Provider API",
+    description: null,
+    configuration: {},
+    modeOverride: null,
+    healthStatus: "healthy",
+    healthErrorCode: null,
+    revision: 1,
+    catalogRevision: 1,
+    createdAt: 1,
+    updatedAt: 1,
+    lastRefreshedAt: 1,
+    toolCount: 2,
+    tombstonedToolCount: 0,
+  };
+}
+
+function connection(overrides: Partial<OAuthConnectionSummary> = {}): OAuthConnectionSummary {
+  return {
+    id: "connection-1",
+    credentialKey: "configured-oauth",
+    revision: 3,
+    status: "connected",
+    issuer: "https://identity.example.test/",
+    clientId: "executor",
+    clientAuthMethod: "none",
+    callbackUrl: "https://executor.example.test/api/v1/oauth/callback/connection-1",
+    requestedScopes: ["read"],
+    grantedScopes: ["read"],
+    hasClientSecret: false,
+    hasRefreshToken: true,
+    accessExpiresAt: null,
+    authorizedAt: 1,
+    lastRefreshedAt: 1,
+    errorCode: null,
+    managedOAuthEligible: true,
+    ...overrides,
+  };
+}
+
+function success<Value>(value: Value): OAuthOperationResult<Value> {
+  return { ok: true, value };
+}
+
+function deferred<Value>() {
+  let resolve = (_value: Value) => {};
+  const promise = new Promise<Value>((complete) => {
+    resolve = complete;
+  });
+  return { promise, resolve };
+}
+
+function operations() {
+  const list: OAuthConnectionList = {
+    connections: [connection()],
+    availableCredentials: [
+      {
+        credentialKey: "new-oauth",
+        protocol: "openapi" as const,
+        requestedScopes: ["read", "write"],
+        managedOAuthEligible: true as const,
+      },
+    ],
+  };
+  return {
+    load: vi.fn(async () => success(list)),
+    save: vi.fn(async () => success(connection())),
+    authorize: vi.fn(async () =>
+      success({ authorizationUrl: "https://identity.example.test/authorize?state=opaque" }),
+    ),
+    disconnect: vi.fn(async () =>
+      success({ ...connection(), status: "ready_to_connect" as const }),
+    ),
+    remove: vi.fn(async () => success(undefined)),
+  } satisfies OAuthConnectionOperations;
+}
+
+afterEach(cleanup);
+
+describe("OAuth source connections", () => {
+  it("renders only discovered and configured credential keys without a free-form key", async () => {
+    const api = operations();
+    render(OAuthSourceConnections, { source: source(), operations: api });
+
+    expect(await screen.findByText("new-oauth")).toBeDefined();
+    expect(screen.getByText("configured-oauth")).toBeDefined();
+    expect(screen.queryByLabelText(/Credential key/i)).toBeNull();
+    expect(screen.getByDisplayValue("read write")).toBeDefined();
+  });
+
+  it("announces and consumes a failed callback only after its connection source refetches", async () => {
+    const api = operations();
+    const checked = vi.fn();
+    const busy = vi.fn();
+    const mounted = render(OAuthSourceConnections, {
+      source: source(),
+      operations: api,
+      callbackRefreshKey: "failed:connection-1",
+      oncallbackchecked: checked,
+      onbusychange: busy,
+    });
+
+    await waitFor(() => expect(checked).toHaveBeenCalledWith(true));
+    expect(screen.getByRole("alert").textContent).toContain("OAuth authorization did not complete");
+    expect(busy).toHaveBeenCalledWith(true);
+    await waitFor(() => expect(busy).toHaveBeenLastCalledWith(false));
+
+    await mounted.rerender({
+      source: source(),
+      operations: api,
+      callbackRefreshKey: "success:connection-1",
+      oncallbackchecked: checked,
+      onbusychange: busy,
+    });
+    expect(await screen.findByText(/OAuth authorization completed/)).toBeDefined();
+    expect(screen.queryByText(/OAuth authorization did not complete/)).toBeNull();
+  });
+
+  it("cleans a failed callback for a missing connection without claiming a connection result", async () => {
+    const api = operations();
+    api.load.mockResolvedValue(
+      success({
+        connections: [],
+        availableCredentials: [
+          {
+            credentialKey: "new-oauth",
+            protocol: "openapi",
+            requestedScopes: [],
+            managedOAuthEligible: true,
+          },
+        ],
+      }),
+    );
+    const checked = vi.fn();
+    render(OAuthSourceConnections, {
+      source: source(),
+      operations: api,
+      callbackRefreshKey: "failed:deleted-connection",
+      oncallbackchecked: checked,
+    });
+
+    await waitFor(() => expect(checked).toHaveBeenCalledWith(false));
+    expect(screen.queryByText(/OAuth authorization did not complete/)).toBeNull();
+  });
+
+  it("keeps configured but ineligible connections removable while blocking save and connect", async () => {
+    const api = operations();
+    api.load.mockResolvedValue(
+      success({
+        connections: [connection({ managedOAuthEligible: false })],
+        availableCredentials: [],
+      }),
+    );
+    render(OAuthSourceConnections, { source: source(), operations: api });
+
+    expect(await screen.findByText(/no longer offers this managed OAuth credential/)).toBeDefined();
+    expect(
+      screen.getByRole<HTMLButtonElement>("button", { name: "Save configuration" }).disabled,
+    ).toBe(true);
+    expect(screen.getByRole<HTMLButtonElement>("button", { name: "Connect OAuth" }).disabled).toBe(
+      true,
+    );
+    expect(
+      screen.getByRole<HTMLButtonElement>("button", { name: "Disconnect tokens" }).disabled,
+    ).toBe(false);
+    expect(
+      screen.getByRole<HTMLButtonElement>("button", { name: "Delete configuration" }).disabled,
+    ).toBe(false);
+  });
+
+  it("keeps the prior list visible after a callback reload fails and consumes it after retry", async () => {
+    const api = operations();
+    const checked = vi.fn();
+    api.load
+      .mockResolvedValueOnce(
+        success({
+          connections: [],
+          availableCredentials: [],
+        }),
+      )
+      .mockResolvedValueOnce({
+        ok: false,
+        error: {
+          code: "network_error",
+          displayMessage: "Managed OAuth refresh failed.",
+          requestId: "oauth-reload",
+          status: 503,
+        },
+      })
+      .mockResolvedValue(
+        success({
+          connections: [connection()],
+          availableCredentials: [],
+        }),
+      );
+    const mounted = render(OAuthSourceConnections, {
+      source: source(),
+      operations: api,
+      oncallbackchecked: checked,
+    });
+    await waitFor(() => expect(api.load).toHaveBeenCalledOnce());
+
+    await mounted.rerender({
+      source: source(),
+      operations: api,
+      callbackRefreshKey: "success:connection-1",
+      oncallbackchecked: checked,
+    });
+
+    const staleError = await screen.findByRole("alert");
+    expect(staleError.textContent).toContain("Managed OAuth refresh failed.");
+    expect(staleError.textContent).toContain("Showing the last loaded managed OAuth options.");
+    expect(checked).not.toHaveBeenCalled();
+
+    await fireEvent.click(screen.getByRole("button", { name: "Retry managed OAuth" }));
+    await waitFor(() => expect(checked).toHaveBeenCalledOnce());
+    expect(checked).toHaveBeenCalledWith(true);
+    expect(screen.queryByText("Managed OAuth refresh failed.")).toBeNull();
+    expect(screen.getByText(/OAuth authorization completed/)).toBeDefined();
+  });
+
+  it("ignores a late callback reload failure after a newer load succeeds", async () => {
+    const api = operations();
+    const oldLoad = deferred<OAuthOperationResult<OAuthConnectionList>>();
+    const newLoad = deferred<OAuthOperationResult<OAuthConnectionList>>();
+    api.load
+      .mockResolvedValueOnce(
+        success({
+          connections: [],
+          availableCredentials: [],
+        }),
+      )
+      .mockImplementationOnce(() => oldLoad.promise)
+      .mockImplementationOnce(() => newLoad.promise)
+      .mockResolvedValue(
+        success({
+          connections: [connection()],
+          availableCredentials: [],
+        }),
+      );
+    const checked = vi.fn();
+    const mounted = render(OAuthSourceConnections, {
+      source: source(),
+      operations: api,
+      oncallbackchecked: checked,
+    });
+    await waitFor(() => expect(api.load).toHaveBeenCalledOnce());
+
+    await mounted.rerender({
+      source: source(),
+      operations: api,
+      callbackRefreshKey: "failed:connection-1",
+      oncallbackchecked: checked,
+    });
+    await waitFor(() => expect(api.load).toHaveBeenCalledTimes(2));
+    await mounted.rerender({
+      source: source(),
+      operations: api,
+      callbackRefreshKey: "success:connection-1",
+      oncallbackchecked: checked,
+    });
+    await waitFor(() => expect(api.load).toHaveBeenCalledTimes(3));
+    newLoad.resolve(
+      success({
+        connections: [connection()],
+        availableCredentials: [],
+      }),
+    );
+    await waitFor(() => expect(checked).toHaveBeenCalledOnce());
+
+    oldLoad.resolve({
+      ok: false,
+      error: {
+        code: "network_error",
+        displayMessage: "Late old failure.",
+        requestId: null,
+        status: 503,
+      },
+    });
+    await oldLoad.promise;
+    await Promise.resolve();
+    expect(screen.queryByText("Late old failure.")).toBeNull();
+    expect(screen.getByText(/OAuth authorization completed/)).toBeDefined();
+  });
+
+  it("uses collision-free panel IDs and keeps error focus inside the active credential panel", async () => {
+    const api = operations();
+    api.load.mockResolvedValue(
+      success({
+        connections: [
+          connection({
+            id: "dot-connection",
+            credentialKey: "client.id",
+            callbackUrl: "https://executor.example.test/callback/dot",
+            clientAuthMethod: "client_secret_basic",
+            hasClientSecret: true,
+          }),
+          connection({
+            id: "dash-connection",
+            credentialKey: "client-id",
+            callbackUrl: "https://executor.example.test/callback/dash",
+            clientAuthMethod: "client_secret_basic",
+            hasClientSecret: true,
+          }),
+        ],
+        availableCredentials: [],
+      }),
+    );
+    api.save.mockResolvedValue({
+      ok: false,
+      error: {
+        code: "invalid_oauth_configuration",
+        displayMessage: "Review this OAuth configuration.",
+        requestId: null,
+        status: 400,
+      },
+    });
+    render(OAuthSourceConnections, { source: source(), operations: api });
+
+    const dotHeading = await screen.findByRole("heading", { name: "client.id" });
+    const dashHeading = screen.getByRole("heading", { name: "client-id" });
+    const dotPanel = dotHeading.closest("section");
+    const dashPanel = dashHeading.closest("section");
+    expect(dotPanel).not.toBeNull();
+    expect(dashPanel).not.toBeNull();
+    if (dotPanel === null || dashPanel === null) return;
+
+    expect(dotHeading.id).not.toBe(dashHeading.id);
+    expect(dotPanel.getAttribute("aria-labelledby")).toBe(dotHeading.id);
+    expect(dashPanel.getAttribute("aria-labelledby")).toBe(dashHeading.id);
+    const dotCallback = within(dotPanel).getByLabelText<HTMLInputElement>("Exact callback URL");
+    const dashCallback = within(dashPanel).getByLabelText<HTMLInputElement>("Exact callback URL");
+    expect(dotCallback.id).not.toBe(dashCallback.id);
+    const dotRadio = dotPanel.querySelector<HTMLInputElement>('input[type="radio"]');
+    const dashRadio = dashPanel.querySelector<HTMLInputElement>('input[type="radio"]');
+    expect(dotRadio?.name).not.toBe(dashRadio?.name);
+
+    await fireEvent.input(within(dotPanel).getByLabelText(/Requested scopes/), {
+      target: { value: "dot-change" },
+    });
+    await fireEvent.click(within(dotPanel).getByRole("button", { name: "Save configuration" }));
+    await waitFor(() => expect(dotPanel.contains(document.activeElement)).toBe(true));
+
+    await fireEvent.input(within(dashPanel).getByLabelText(/Requested scopes/), {
+      target: { value: "dash-change" },
+    });
+    await fireEvent.click(within(dashPanel).getByRole("button", { name: "Save configuration" }));
+    await waitFor(() => expect(dashPanel.contains(document.activeElement)).toBe(true));
+    expect(dotPanel.querySelector('[role="alert"]')?.id).not.toBe(
+      dashPanel.querySelector('[role="alert"]')?.id,
+    );
+  });
+});
diff --git a/web/src/lib/PlaceholderPanel.svelte b/web/src/lib/PlaceholderPanel.svelte
new file mode 100644
index 000000000..411c0d26f
--- /dev/null
+++ b/web/src/lib/PlaceholderPanel.svelte
@@ -0,0 +1,20 @@
+<script lang="ts">
+  let { label, title, detail }: { label: string; title: string; detail: string } = $props();
+</script>
+
+<div class="placeholder-grid">
+  <article class="surface empty-state">
+    <span class="number-chip">{label}</span>
+    <h2>{title}</h2>
+    <p>{detail}</p>
+    <p class="availability">Not available yet</p>
+  </article>
+  <aside class="surface scope-card">
+    <p class="eyebrow">Current status</p>
+    <h3>No sample data</h3>
+    <p>
+      Executor keeps unavailable workflows empty, so anything shown in this dashboard represents
+      real instance data.
+    </p>
+  </aside>
+</div>
diff --git a/web/src/lib/api.test.ts b/web/src/lib/api.test.ts
new file mode 100644
index 000000000..9b174d9ef
--- /dev/null
+++ b/web/src/lib/api.test.ts
@@ -0,0 +1,1733 @@
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, Schema } from "effect";
+import {
+  ApiError,
+  authorizeOAuthConnection,
+  bulkSetToolModes,
+  createGraphqlSource,
+  createMcpHttpSource,
+  createMcpStdioSource,
+  createOpenApiSource,
+  createToken,
+  decideApproval,
+  deleteOAuthConnection,
+  deleteOpenApiCredentials,
+  getApproval,
+  getOpenApiCredentials,
+  getSourceCreationResolution,
+  getSourceCredentials,
+  getBootstrap,
+  disconnectOAuthConnection,
+  listApprovals,
+  listOAuthConnections,
+  listMcpStdioTemplates,
+  listRequestLogs,
+  listSources,
+  listTokens,
+  listTools,
+  loginAdmin,
+  previewOpenApiSource,
+  putOpenApiCredentials,
+  putMcpHttpCredentials,
+  putMcpStdioCredentials,
+  putOAuthConnection,
+  putGraphqlCredentials,
+  refreshOpenApiSource,
+  revokeToken,
+  sealMissingSourceCreation,
+  setSourceMode,
+} from "./api";
+
+function sourceFixture() {
+  return {
+    id: "source-1",
+    kind: "openapi",
+    slug: "github",
+    displayName: "GitHub",
+    description: "Repository API",
+    configuration: { publicBaseUrl: "https://api.example.test" },
+    modeOverride: null,
+    healthStatus: "healthy",
+    healthErrorCode: null,
+    revision: 3,
+    catalogRevision: 8,
+    createdAt: 100,
+    updatedAt: 200,
+    lastRefreshedAt: 190,
+    toolCount: 2,
+    tombstonedToolCount: 1,
+  };
+}
+
+function toolFixture() {
+  return {
+    id: "tool-1",
+    sourceId: "source-1",
+    sourceSlug: "github",
+    stableKey: "GET /repos",
+    localName: "list_repos",
+    callablePath: "tools.github.list_repos",
+    sandboxPath: "github.list_repos",
+    displayName: "List repositories",
+    description: "Lists repositories",
+    intrinsicMode: "enabled",
+    modeOverride: null,
+    effectiveMode: { mode: "enabled", provenance: "intrinsic" },
+    present: true,
+    revision: 4,
+    createdAt: 100,
+    updatedAt: 200,
+    lastSeenAt: 190,
+    tombstonedAt: null,
+  };
+}
+
+function logFixture() {
+  return {
+    requestId: "request-1",
+    actorApiTokenId: "token-id",
+    surface: "gateway",
+    sourceId: "source-1",
+    toolId: "tool-1",
+    pathSnapshot: "tools.github.list_repos",
+    outcome: "succeeded",
+    errorCode: null,
+    durationMs: 27,
+    approvalId: null,
+    createdAt: 200,
+  };
+}
+
+function approvalSummaryFixture() {
+  return {
+    id: "approval-1",
+    status: "pending",
+    revision: 4,
+    sourceId: "source-1",
+    toolId: "tool-1",
+    path: "tools.github.create_issue",
+    sourceDisplayName: "GitHub",
+    toolDisplayName: "Create issue",
+    actorKind: "api_token",
+    actorId: "token-1",
+    actorName: "Laptop",
+    actorLabel: "Laptop",
+    actorApiTokenId: "token-1",
+    actorTokenName: "Laptop",
+    surface: "gateway",
+    mode: "ask",
+    provenance: "tool_override",
+    executionId: "execution-1",
+    callId: "call-1",
+    createdAt: 100,
+    updatedAt: 101,
+    expiresAt: 700,
+    decidedAt: null,
+    startedAt: null,
+    completedAt: null,
+    decision: null,
+    failureCode: null,
+  };
+}
+
+function approvalDetailFixture() {
+  return {
+    ...approvalSummaryFixture(),
+    redactedArguments: { title: "Issue title", body: "[REDACTED]" },
+    inputSchema: { type: "object" },
+  };
+}
+
+const decodeJson = Schema.decodeUnknownSync(Schema.fromJsonString(Schema.Unknown));
+const validTokenSecret = `exr_${"A".repeat(43)}`;
+
+describe("dashboard API client", () => {
+  it("normalizes bootstrap data from the control API", async () => {
+    const result = await getBootstrap(async () =>
+      Response.json({ setupRequired: true, authenticated: false }),
+    );
+
+    expect(result).toEqual({
+      ok: true,
+      value: { setupRequired: true, authenticated: false },
+    });
+  });
+
+  it("sends cookies and the double-submit CSRF token for authenticated mutations", async () => {
+    document.cookie = "executor_csrf=csrf_test_value; Path=/";
+    let observedHeaders = new Headers();
+    let observedCredentials: RequestCredentials | undefined;
+    const created = await createToken("Laptop", "a".repeat(64), async (_input, init) => {
+      observedHeaders = new Headers(init?.headers);
+      observedCredentials = init?.credentials;
+      return Response.json(
+        {
+          id: "token-id",
+          name: "Laptop",
+          token: validTokenSecret,
+          createdAt: 123,
+        },
+        { status: 201, headers: { "cache-control": "no-store" } },
+      );
+    });
+
+    expect(observedHeaders.get("x-executor-csrf")).toBe("csrf_test_value");
+    expect(observedHeaders.get("content-type")).toBe("application/json");
+    expect(observedHeaders.get("idempotency-key")).toBe("a".repeat(64));
+    expect(
+      [...observedHeaders.keys()].filter((header) => header === "idempotency-key"),
+    ).toHaveLength(1);
+    expect(observedCredentials).toBe("same-origin");
+    expect(created).toEqual({
+      ok: true,
+      value: {
+        id: "token-id",
+        name: "Laptop",
+        token: validTokenSecret,
+        createdAt: 123,
+      },
+      replayProvenance: "none",
+      responseDisposition: "authoritative",
+    });
+  });
+
+  it("accepts only strict no-store token creation and replay responses", async () => {
+    const createdToken = {
+      id: "token-id",
+      name: "Laptop",
+      token: validTokenSecret,
+      createdAt: 123,
+    };
+    const fresh = await createToken("Laptop", "1".repeat(64), async () =>
+      Response.json(createdToken, {
+        status: 201,
+        headers: { "cache-control": "private, no-store" },
+      }),
+    );
+    const replay = await createToken("Laptop", "1".repeat(64), async () =>
+      Response.json(createdToken, {
+        status: 201,
+        headers: {
+          "cache-control": "no-store",
+          "idempotency-replayed": "true",
+        },
+      }),
+    );
+    const missingNoStore = await createToken("Laptop", "1".repeat(64), async () =>
+      Response.json(createdToken, { status: 201 }),
+    );
+    const wrongStatus = await createToken("Laptop", "1".repeat(64), async () =>
+      Response.json(createdToken, {
+        status: 200,
+        headers: { "cache-control": "no-store" },
+      }),
+    );
+    const invalidReplay = await createToken("Laptop", "1".repeat(64), async () =>
+      Response.json(createdToken, {
+        status: 201,
+        headers: {
+          "cache-control": "no-store",
+          "idempotency-replayed": "false",
+        },
+      }),
+    );
+
+    expect(fresh).toMatchObject({
+      ok: true,
+      replayProvenance: "none",
+      responseDisposition: "authoritative",
+    });
+    expect(replay).toMatchObject({
+      ok: true,
+      replayProvenance: "authoritative",
+      responseDisposition: "authoritative",
+    });
+    for (const result of [missingNoStore, wrongStatus, invalidReplay]) {
+      expect(result).toMatchObject({
+        ok: false,
+        error: { code: "invalid_response" },
+        responseDisposition: "ambiguous",
+      });
+    }
+  });
+
+  it("keeps semantically malformed token successes ambiguous", async () => {
+    const valid = {
+      id: "token-id",
+      name: "Laptop",
+      token: validTokenSecret,
+      createdAt: 123,
+    };
+    const malformed = [
+      { ...valid, id: "" },
+      { ...valid, id: "x".repeat(129) },
+      { ...valid, name: "Different agent" },
+      { ...valid, token: "exr_not-a-32-byte-secret" },
+      { ...valid, token: `exr_${"A".repeat(42)}_` },
+      { ...valid, createdAt: -1 },
+      { ...valid, createdAt: Number.MAX_SAFE_INTEGER + 1 },
+    ];
+
+    for (const body of malformed) {
+      const result = await createToken("Laptop", "2".repeat(64), async () =>
+        Response.json(body, {
+          status: 201,
+          headers: { "cache-control": "no-store" },
+        }),
+      );
+
+      expect(result).toMatchObject({
+        ok: false,
+        error: { code: "invalid_response" },
+        responseDisposition: "ambiguous",
+      });
+    }
+  });
+
+  it("automatically retries one ambiguous token revocation", async () => {
+    const calls: Array<{ path: string; method: string | undefined }> = [];
+    const result = await revokeToken("token/one", async (input, init) => {
+      calls.push({ path: String(input), method: init?.method });
+      if (calls.length === 1) return Effect.runPromise(Effect.fail("response lost"));
+      return new Response(null, { status: 204 });
+    });
+
+    expect(result).toEqual({ ok: true, value: undefined });
+    expect(calls).toEqual([
+      { path: "/api/v1/tokens/token%2Fone", method: "DELETE" },
+      { path: "/api/v1/tokens/token%2Fone", method: "DELETE" },
+    ]);
+  });
+
+  it("does not attach a stale CSRF token to login", async () => {
+    document.cookie = "executor_csrf=stale_value; Path=/";
+    let observedHeaders = new Headers();
+    await loginAdmin({ username: "admin", password: "password" }, async (_input, init) => {
+      observedHeaders = new Headers(init?.headers);
+      return Response.json({ username: "admin", csrfToken: "csrf_fresh" });
+    });
+
+    expect(observedHeaders.has("x-executor-csrf")).toBe(false);
+  });
+
+  it("sends exactly one opaque idempotency header for every source connector", async () => {
+    const observations: Array<{
+      headers: Headers;
+      body: unknown;
+      credentials: RequestCredentials | undefined;
+    }> = [];
+    const fetcher = async (_input: RequestInfo | URL, init?: RequestInit) => {
+      observations.push({
+        headers: new Headers(init?.headers),
+        body: decodeJson(String(init?.body)),
+        credentials: init?.credentials,
+      });
+      return Response.json(sourceFixture(), { status: 201 });
+    };
+
+    await createOpenApiSource(
+      {
+        kind: "openapi",
+        displayName: "OpenAPI",
+        spec: { type: "inline", content: "openapi: 3.1.0" },
+      },
+      "openapi-key",
+      fetcher,
+    );
+    await createGraphqlSource(
+      {
+        kind: "graphql",
+        displayName: "GraphQL",
+        endpoint: "https://api.example.test/graphql",
+      },
+      "graphql-key",
+      fetcher,
+    );
+    await createMcpHttpSource(
+      {
+        kind: "mcp_http",
+        displayName: "MCP HTTP",
+        endpoint: "https://mcp.example.test/mcp",
+      },
+      "mcp-http-key",
+      fetcher,
+    );
+    await createMcpStdioSource(
+      {
+        kind: "mcp_stdio",
+        displayName: "MCP stdio",
+        templateName: "local",
+        secretValues: {},
+      },
+      "mcp-stdio-key",
+      fetcher,
+    );
+
+    expect(observations.map(({ headers }) => headers.get("idempotency-key"))).toEqual([
+      "openapi-key",
+      "graphql-key",
+      "mcp-http-key",
+      "mcp-stdio-key",
+    ]);
+    for (const observation of observations) {
+      expect(
+        [...observation.headers.keys()].filter((name) => name === "idempotency-key"),
+      ).toHaveLength(1);
+      expect(observation.credentials).toBe("same-origin");
+      expect(JSON.stringify(observation.body)).not.toContain("-key");
+    }
+  });
+
+  it("preserves failed source-create replay metadata and transport ambiguity", async () => {
+    const input = {
+      kind: "graphql" as const,
+      displayName: "GraphQL",
+      endpoint: "https://api.example.test/graphql",
+    };
+    const replayedFailure = await createGraphqlSource(input, "replayed-key", async () =>
+      Response.json(
+        {
+          error: {
+            code: "internal_error",
+            message: "The stored source creation failed.",
+            requestId: "stored-failure",
+          },
+        },
+        {
+          status: 500,
+          headers: { "cache-control": "no-store", "idempotency-replayed": "true" },
+        },
+      ),
+    );
+    const firstFailure = await createGraphqlSource(input, "first-key", async () =>
+      Response.json(
+        {
+          error: {
+            code: "internal_error",
+            message: "Source creation failed.",
+            requestId: "first-failure",
+          },
+        },
+        { status: 500 },
+      ),
+    );
+    const duplicateReplayHeaders = new Headers();
+    duplicateReplayHeaders.set("Cache-Control", "no-store");
+    duplicateReplayHeaders.append("Idempotency-Replayed", "true");
+    duplicateReplayHeaders.append("idempotency-replayed", "true");
+    const invalidReplayFailure = await createGraphqlSource(input, "invalid-replay-key", async () =>
+      Response.json(
+        {
+          error: {
+            code: "internal_error",
+            message: "Source creation failed.",
+            requestId: "invalid-replay-failure",
+          },
+        },
+        { status: 500, headers: duplicateReplayHeaders },
+      ),
+    );
+    const transportFailure = await createGraphqlSource(input, "transport-key", async () =>
+      Effect.runPromise(Effect.fail("connection lost")),
+    );
+
+    expect(replayedFailure).toEqual({
+      ok: false,
+      error: new ApiError({
+        code: "internal_error",
+        displayMessage: "The stored source creation failed.",
+        requestId: "stored-failure",
+        status: 500,
+      }),
+      replayProvenance: "authoritative",
+      responseDisposition: "authoritative",
+    });
+    expect(firstFailure).toMatchObject({
+      ok: false,
+      error: { code: "internal_error", status: 500 },
+      replayProvenance: "none",
+    });
+    expect(invalidReplayFailure).toMatchObject({
+      ok: false,
+      error: { code: "internal_error", status: 500 },
+      replayProvenance: "invalid",
+    });
+    expect(transportFailure).toMatchObject({
+      ok: false,
+      error: { code: "network_error", status: 0 },
+      replayProvenance: "none",
+    });
+  });
+
+  it("keeps malformed replayed failure bodies ambiguous", async () => {
+    const input = {
+      kind: "graphql" as const,
+      displayName: "GraphQL",
+      endpoint: "https://api.example.test/graphql",
+    };
+    const headers = {
+      "cache-control": "no-store",
+      "idempotency-replayed": "true",
+    };
+    const malformedText = await createGraphqlSource(
+      input,
+      "text-key",
+      async () => new Response("gateway failure", { status: 500, headers }),
+    );
+    const malformedJson = await createGraphqlSource(
+      input,
+      "json-key",
+      async () => new Response('{"error":', { status: 500, headers }),
+    );
+    const incompleteError = await createGraphqlSource(input, "incomplete-key", async () =>
+      Response.json(
+        { error: { code: "internal_error", message: "Stored failure." } },
+        { status: 500, headers },
+      ),
+    );
+    const missingNoStore = await createGraphqlSource(input, "cache-key", async () =>
+      Response.json(
+        {
+          error: {
+            code: "internal_error",
+            message: "Stored failure.",
+            requestId: "stored-failure",
+          },
+        },
+        { status: 500, headers: { "idempotency-replayed": "true" } },
+      ),
+    );
+
+    for (const result of [malformedText, malformedJson, incompleteError, missingNoStore]) {
+      expect(result.ok).toBe(false);
+      expect(result.replayProvenance).toBe("invalid");
+    }
+  });
+
+  it("requires a valid source body and replay contract for authoritative success", async () => {
+    const input = {
+      kind: "graphql" as const,
+      displayName: "GraphQL",
+      endpoint: "https://api.example.test/graphql",
+    };
+    const replayHeaders = {
+      "cache-control": "private, No-Store",
+      "idempotency-replayed": "true",
+    };
+    const authoritative = await createGraphqlSource(input, "success-key", async () =>
+      Response.json(sourceFixture(), { status: 201, headers: replayHeaders }),
+    );
+    const incompleteBody = await createGraphqlSource(input, "incomplete-key", async () =>
+      Response.json({ ...sourceFixture(), id: undefined }, { status: 201, headers: replayHeaders }),
+    );
+    const missingNoStore = await createGraphqlSource(input, "cache-key", async () =>
+      Response.json(sourceFixture(), {
+        status: 201,
+        headers: { "idempotency-replayed": "true" },
+      }),
+    );
+
+    expect(authoritative).toMatchObject({ ok: true, replayProvenance: "authoritative" });
+    expect(incompleteBody).toMatchObject({
+      ok: false,
+      error: { code: "invalid_response" },
+      replayProvenance: "invalid",
+    });
+    expect(missingNoStore).toMatchObject({ ok: true, replayProvenance: "invalid" });
+  });
+
+  it("looks up source creation using only a no-store authenticated header", async () => {
+    const result = await getSourceCreationResolution("lookup-key", async (input, init) => {
+      expect(String(input)).toBe("/api/v1/sources/idempotency");
+      expect(init?.method).toBe("GET");
+      expect(init?.body).toBeUndefined();
+      expect(init?.credentials).toBe("same-origin");
+      expect(init?.cache).toBe("no-store");
+      const headers = new Headers(init?.headers);
+      expect(headers.get("idempotency-key")).toBe("lookup-key");
+      expect(headers.has("content-type")).toBe(false);
+      return Response.json({ status: "missing" }, { headers: { "cache-control": "no-store" } });
+    });
+
+    expect(result).toEqual({ ok: true, value: { kind: "status", status: "missing" } });
+  });
+
+  it("accepts a case-insensitive no-store directive from combined Fetch headers", async () => {
+    const headers = new Headers();
+    headers.append("Cache-Control", "private");
+    headers.append("cache-control", "No-Store");
+    expect(headers.get("cache-control")).toBe("private, No-Store");
+
+    const result = await getSourceCreationResolution("lookup-key", async () =>
+      Response.json({ status: "missing" }, { headers }),
+    );
+
+    expect(result).toEqual({ ok: true, value: { kind: "status", status: "missing" } });
+  });
+
+  it("strictly distinguishes successful and failed stored replays", async () => {
+    const completed = await getSourceCreationResolution("completed-key", async () =>
+      Response.json(sourceFixture(), {
+        status: 201,
+        headers: {
+          "cache-control": "no-store",
+          "idempotency-replayed": "true",
+        },
+      }),
+    );
+    const failed = await getSourceCreationResolution("failed-key", async () =>
+      Response.json(
+        {
+          error: {
+            code: "invalid_source",
+            message: "The source is invalid.",
+            requestId: "failed-request",
+          },
+        },
+        {
+          status: 422,
+          headers: {
+            "cache-control": "no-store",
+            "idempotency-replayed": "true",
+          },
+        },
+      ),
+    );
+
+    expect(completed.ok && completed.value.kind).toBe("replay");
+    expect(completed.ok && completed.value.kind === "replay" && completed.value.result.ok).toBe(
+      true,
+    );
+    expect(failed).toEqual({
+      ok: true,
+      value: {
+        kind: "replay",
+        result: {
+          ok: false,
+          error: new ApiError({
+            code: "invalid_source",
+            displayMessage: "The source is invalid.",
+            requestId: "failed-request",
+            status: 422,
+          }),
+        },
+      },
+    });
+  });
+
+  it("accepts failed replays only for HTTP error statuses across every source path", async () => {
+    const input = {
+      kind: "graphql" as const,
+      displayName: "GraphQL",
+      endpoint: "https://api.example.test/graphql",
+    };
+    const invalidStatuses = [199, 200, 204, 302, 399, 600] as const;
+    const authoritativeStatuses = [400, 599] as const;
+
+    function failedReplayResponse(status: number) {
+      const nativeStatus = status < 200 ? 200 : status > 599 ? 599 : status;
+      const init = {
+        status: nativeStatus,
+        headers: {
+          "cache-control": "no-store",
+          "idempotency-replayed": "true",
+        },
+      };
+      const response =
+        nativeStatus === 204
+          ? new Response(null, init)
+          : Response.json(
+              {
+                error: {
+                  code: "internal_error",
+                  message: "The stored source creation failed.",
+                  requestId: `failed-${status}`,
+                },
+              },
+              init,
+            );
+      if (nativeStatus !== status) Object.defineProperty(response, "status", { value: status });
+      return response;
+    }
+
+    for (const status of invalidStatuses) {
+      const direct = await createGraphqlSource(input, `direct-${status}`, async () =>
+        failedReplayResponse(status),
+      );
+      const lookup = await getSourceCreationResolution(`lookup-${status}`, async () =>
+        failedReplayResponse(status),
+      );
+      const seal = await sealMissingSourceCreation(`seal-${status}`, async () =>
+        failedReplayResponse(status),
+      );
+
+      expect(direct.ok).toBe(false);
+      expect(direct.replayProvenance).toBe("invalid");
+      for (const result of [lookup, seal]) {
+        expect(result).toMatchObject({
+          ok: false,
+          error: { code: "invalid_response" },
+        });
+      }
+    }
+
+    for (const status of authoritativeStatuses) {
+      const direct = await createGraphqlSource(input, `direct-${status}`, async () =>
+        failedReplayResponse(status),
+      );
+      const lookup = await getSourceCreationResolution(`lookup-${status}`, async () =>
+        failedReplayResponse(status),
+      );
+      const seal = await sealMissingSourceCreation(`seal-${status}`, async () =>
+        failedReplayResponse(status),
+      );
+
+      expect(direct.ok).toBe(false);
+      expect(direct.replayProvenance).toBe("authoritative");
+      for (const result of [lookup, seal]) {
+        expect(result).toMatchObject({
+          ok: true,
+          value: {
+            kind: "replay",
+            result: { ok: false, error: { code: "internal_error", status } },
+          },
+        });
+      }
+    }
+  });
+
+  it("seals with no body and validates the in-progress retry contract", async () => {
+    document.cookie = "executor_csrf=seal_csrf; Path=/";
+    const result = await sealMissingSourceCreation("seal-key", async (input, init) => {
+      expect(String(input)).toBe("/api/v1/sources/idempotency/seal");
+      expect(init?.method).toBe("POST");
+      expect(init?.body).toBeUndefined();
+      expect(init?.credentials).toBe("same-origin");
+      expect(init?.cache).toBe("no-store");
+      const headers = new Headers(init?.headers);
+      expect(headers.get("idempotency-key")).toBe("seal-key");
+      expect(headers.get("x-executor-csrf")).toBe("seal_csrf");
+      expect(headers.has("content-type")).toBe(false);
+      return Response.json(
+        {
+          error: {
+            code: "idempotency_in_progress",
+            message: "Source creation is still in progress.",
+            requestId: "seal-request",
+          },
+        },
+        {
+          status: 409,
+          headers: { "cache-control": "no-store", "retry-after": "1" },
+        },
+      );
+    });
+
+    expect(result).toEqual({ ok: true, value: { kind: "status", status: "in_progress" } });
+  });
+
+  it("normalizes terminal seal races without treating them as transport failures", async () => {
+    const result = await sealMissingSourceCreation("expired-key", async () =>
+      Response.json(
+        {
+          error: {
+            code: "idempotency_expired_unknown",
+            message: "The record expired.",
+            requestId: "expired-request",
+          },
+        },
+        { status: 410, headers: { "cache-control": "no-store" } },
+      ),
+    );
+
+    expect(result).toEqual({
+      ok: true,
+      value: { kind: "status", status: "expired_unknown" },
+    });
+  });
+
+  it("rejects malformed source creation status metadata", async () => {
+    const missingNoStore = await getSourceCreationResolution("key", async () =>
+      Response.json({ status: "missing" }),
+    );
+    const unknownStatus = await getSourceCreationResolution("key", async () =>
+      Response.json({ status: "completed" }, { headers: { "cache-control": "no-store" } }),
+    );
+    const invalidReplayHeader = await getSourceCreationResolution("key", async () =>
+      Response.json(sourceFixture(), {
+        status: 201,
+        headers: {
+          "cache-control": "no-store",
+          "idempotency-replayed": "false",
+        },
+      }),
+    );
+    const invalidReplayStatus = await getSourceCreationResolution("key", async () =>
+      Response.json(sourceFixture(), {
+        status: 200,
+        headers: {
+          "cache-control": "no-store",
+          "idempotency-replayed": "true",
+        },
+      }),
+    );
+    const missingRetryAfter = await sealMissingSourceCreation("key", async () =>
+      Response.json(
+        {
+          error: {
+            code: "idempotency_in_progress",
+            message: "Still running.",
+            requestId: "request",
+          },
+        },
+        { status: 409, headers: { "cache-control": "no-store" } },
+      ),
+    );
+
+    for (const result of [
+      missingNoStore,
+      unknownStatus,
+      invalidReplayHeader,
+      invalidReplayStatus,
+      missingRetryAfter,
+    ]) {
+      expect(result.ok).toBe(false);
+      expect(!result.ok && result.error.code).toBe("invalid_response");
+    }
+  });
+
+  it("rejects excess properties in lookup and seal status responses", async () => {
+    const lookup = await getSourceCreationResolution("key", async () =>
+      Response.json(
+        { status: "missing", outcome: "completed" },
+        { headers: { "cache-control": "no-store" } },
+      ),
+    );
+    const seal = await sealMissingSourceCreation("key", async () =>
+      Response.json(
+        { status: "missing", outcome: "completed" },
+        { headers: { "cache-control": "no-store" } },
+      ),
+    );
+
+    for (const result of [lookup, seal]) {
+      expect(result.ok).toBe(false);
+      expect(!result.ok && result.error.code).toBe("invalid_response");
+    }
+  });
+
+  it("keeps token list responses masked", async () => {
+    const tokens = await listTokens(async () =>
+      Response.json({
+        tokens: [
+          {
+            id: "token-id",
+            name: "Laptop",
+            maskedToken: "exr_abcd...wxyz",
+            createdAt: 123,
+            lastUsedAt: null,
+            revokedAt: null,
+          },
+        ],
+      }),
+    );
+
+    expect(tokens).toEqual({
+      ok: true,
+      value: [
+        {
+          id: "token-id",
+          name: "Laptop",
+          maskedToken: "exr_abcd...wxyz",
+          createdAt: 123,
+          lastUsedAt: null,
+          revokedAt: null,
+        },
+      ],
+    });
+  });
+
+  it("preserves the stable server error envelope", async () => {
+    const failure = await getBootstrap(async () =>
+      Response.json(
+        {
+          error: {
+            code: "unauthorized",
+            message: "An administrator session is required.",
+            requestId: "request-body",
+          },
+        },
+        { status: 401, headers: { "x-request-id": "request-header" } },
+      ),
+    );
+
+    expect(failure).toEqual({
+      ok: false,
+      error: new ApiError({
+        code: "unauthorized",
+        displayMessage: "An administrator session is required.",
+        requestId: "request-body",
+        status: 401,
+      }),
+    });
+  });
+
+  it("uses a response request ID when an error body is malformed", async () => {
+    const failure = await getBootstrap(
+      async () =>
+        new Response("upstream exploded", {
+          status: 502,
+          headers: { "x-request-id": "request-header" },
+        }),
+    );
+
+    expect(failure).toEqual({
+      ok: false,
+      error: new ApiError({
+        code: "http_502",
+        displayMessage: "Executor could not complete the request.",
+        requestId: "request-header",
+        status: 502,
+      }),
+    });
+  });
+
+  it("reports successful payloads that drift from the Rust DTO", async () => {
+    const failure = await getBootstrap(async () =>
+      Response.json(
+        { setupRequired: "yes", authenticated: false },
+        { headers: { "x-request-id": "request-invalid" } },
+      ),
+    );
+
+    expect(failure).toEqual({
+      ok: false,
+      error: new ApiError({
+        code: "invalid_response",
+        displayMessage: "Executor returned a response the dashboard could not understand.",
+        requestId: "request-invalid",
+        status: 502,
+      }),
+    });
+  });
+
+  it("strictly decodes source and tool catalog snapshots", async () => {
+    const sources = await listSources(async () =>
+      Response.json({ sources: [sourceFixture()], catalogRevision: 12 }),
+    );
+    const tools = await listTools(
+      {
+        query: "repos & teams",
+        sourceId: "source/one",
+        mode: "ask",
+        includeTombstoned: true,
+        limit: 50,
+        offset: 100,
+      },
+      async (input) => {
+        expect(String(input)).toBe(
+          "/api/v1/tools?query=repos+%26+teams&sourceId=source%2Fone&mode=ask&includeTombstoned=true&limit=50&offset=100",
+        );
+        return Response.json({
+          items: [toolFixture()],
+          total: 1,
+          hasMore: false,
+          nextOffset: null,
+          catalogRevision: 12,
+        });
+      },
+    );
+
+    expect(sources.ok && sources.value.sources[0]?.kind).toBe("openapi");
+    expect(tools.ok && tools.value.items[0]?.effectiveMode.provenance).toBe("intrinsic");
+  });
+
+  it("rejects catalog enum drift instead of trusting response JSON", async () => {
+    const source = sourceFixture();
+    const result = await listSources(async () =>
+      Response.json(
+        { sources: [{ ...source, healthStatus: "mostly_fine" }], catalogRevision: 12 },
+        { headers: { "x-request-id": "request-invalid-catalog" } },
+      ),
+    );
+
+    expect(result).toEqual({
+      ok: false,
+      error: new ApiError({
+        code: "invalid_response",
+        displayMessage: "Executor returned a response the dashboard could not understand.",
+        requestId: "request-invalid-catalog",
+        status: 502,
+      }),
+    });
+  });
+
+  it("strips nested private source configuration before it enters browser state", async () => {
+    const secret = "nested-source-secret";
+    const result = await listSources(async () =>
+      Response.json({
+        sources: [
+          {
+            ...sourceFixture(),
+            kind: "mcp_http",
+            configuration: {
+              endpoint: "https://mcp.example.test/mcp",
+              allowPrivateNetwork: false,
+              sessionId: secret,
+              query: `token=${secret}`,
+              headers: { authorization: secret },
+              env: { TOKEN: secret },
+              stderr: secret,
+              command: secret,
+            },
+          },
+        ],
+        catalogRevision: 12,
+      }),
+    );
+
+    expect(result.ok && result.value.sources[0]?.configuration).toEqual({
+      endpoint: "https://mcp.example.test",
+      allowPrivateNetwork: false,
+    });
+    expect(JSON.stringify(result)).not.toContain(secret);
+  });
+
+  it("sends source and current-page bulk revisions exactly once", async () => {
+    const bodies: unknown[] = [];
+    await setSourceMode("source/1", "ask", 7, async (input, init) => {
+      expect(String(input)).toBe("/api/v1/sources/source%2F1/mode");
+      bodies.push(decodeJson(String(init?.body)));
+      return Response.json({ ...sourceFixture(), modeOverride: "ask", revision: 8 });
+    });
+    await bulkSetToolModes(["tool-1", "tool-2"], "disabled", 19, async (_input, init) => {
+      bodies.push(decodeJson(String(init?.body)));
+      return Response.json({
+        updatedCount: 2,
+        catalogRevision: 20,
+        sourceRevisions: { "source-1": 9 },
+      });
+    });
+
+    expect(bodies).toEqual([
+      { mode: "ask", expectedRevision: 7 },
+      {
+        selection: {
+          type: "tool_ids",
+          toolIds: ["tool-1", "tool-2"],
+          expectedCatalogRevision: 19,
+        },
+        mode: "disabled",
+      },
+    ]);
+  });
+
+  it("preserves revision conflicts for review instead of retrying", async () => {
+    const result = await setSourceMode("source-1", "enabled", 2, async () =>
+      Response.json(
+        {
+          error: {
+            code: "revision_conflict",
+            message: "The source changed.",
+            requestId: "request-conflict",
+          },
+        },
+        { status: 409 },
+      ),
+    );
+
+    expect(result).toEqual({
+      ok: false,
+      error: new ApiError({
+        code: "revision_conflict",
+        displayMessage: "The source changed.",
+        requestId: "request-conflict",
+        status: 409,
+      }),
+    });
+  });
+
+  it("keeps request-log state metadata-only even if a server adds secret fields", async () => {
+    const secret = "secret-sentinel-never-render";
+    const result = await listRequestLogs(null, async (input) => {
+      expect(String(input)).toBe("/api/v1/request-logs?limit=50");
+      return Response.json({
+        items: [
+          {
+            ...logFixture(),
+            requestBody: secret,
+            responseBody: secret,
+            headers: { authorization: secret },
+            credential: secret,
+            token: secret,
+          },
+        ],
+        nextCursor: "older",
+      });
+    });
+
+    expect(result.ok).toBe(true);
+    expect(JSON.stringify(result)).not.toContain(secret);
+    expect(result.ok && Object.keys(result.value.items[0] ?? {})).toEqual([
+      "requestId",
+      "actorApiTokenId",
+      "surface",
+      "sourceId",
+      "toolId",
+      "pathSnapshot",
+      "outcome",
+      "errorCode",
+      "durationMs",
+      "approvalId",
+      "createdAt",
+    ]);
+  });
+
+  it("previews an OpenAPI URL with strict tool metadata", async () => {
+    let body: unknown;
+    const result = await previewOpenApiSource(
+      { type: "url", url: "https://api.example.test/openapi.json" },
+      false,
+      async (input, init) => {
+        expect(String(input)).toBe("/api/v1/sources/openapi/preview");
+        body = decodeJson(String(init?.body));
+        return Response.json({
+          title: "Example API",
+          description: null,
+          toolCount: 1,
+          tools: [
+            {
+              preferredName: "list_widgets",
+              displayName: "List widgets",
+              description: "Lists widgets",
+              intrinsicMode: "enabled",
+              security: [["bearerAuth"]],
+            },
+          ],
+          securitySchemes: [
+            {
+              name: "bearerAuth",
+              credentialType: "bearer",
+              placement: "header",
+              supported: true,
+              oauthFlows: null,
+            },
+          ],
+        });
+      },
+    );
+
+    expect(body).toEqual({
+      spec: { type: "url", url: "https://api.example.test/openapi.json" },
+      allowPrivateNetwork: false,
+    });
+    expect(result.ok && result.value.tools[0]?.intrinsicMode).toBe("enabled");
+    expect(result.ok && result.value.securitySchemes[0]?.name).toBe("bearerAuth");
+  });
+
+  it("imports credentials without accepting secret echoes in the source response", async () => {
+    const secret = "source-secret-sentinel";
+    let body: unknown;
+    const result = await createOpenApiSource(
+      {
+        kind: "openapi",
+        displayName: "Example API",
+        spec: { type: "inline", content: "openapi: 3.1.0" },
+        credential: {
+          schemes: { bearerAuth: { type: "bearer", token: secret } },
+        },
+      },
+      "openapi-import-key",
+      async (input, init) => {
+        expect(String(input)).toBe("/api/v1/sources");
+        expect(init?.method).toBe("POST");
+        body = decodeJson(String(init?.body));
+        return Response.json({ ...sourceFixture(), credentials: secret }, { status: 201 });
+      },
+    );
+
+    expect(JSON.stringify(body)).toContain(secret);
+    expect(result.ok).toBe(true);
+    expect(JSON.stringify(result)).not.toContain(secret);
+  });
+
+  it("creates an MCP HTTP source and strips unrecognized connection secrets", async () => {
+    let body: unknown;
+    const result = await createMcpHttpSource(
+      {
+        kind: "mcp_http",
+        displayName: "Issue tracker",
+        description: "Local issue tools",
+        endpoint: "https://mcp.example.test/rpc?tenant=private",
+        allowPrivateNetwork: false,
+      },
+      "mcp-http-create-key",
+      async (input, init) => {
+        expect(String(input)).toBe("/api/v1/sources");
+        body = decodeJson(String(init?.body));
+        return Response.json(
+          {
+            ...sourceFixture(),
+            kind: "mcp_http",
+            displayName: "Issue tracker",
+            configuration: {
+              endpoint: "https://mcp.example.test/rpc",
+              allowPrivateNetwork: false,
+            },
+            sessionId: "upstream-session-secret",
+            authorization: "Bearer source-secret",
+          },
+          { status: 201 },
+        );
+      },
+    );
+
+    expect(body).toEqual({
+      kind: "mcp_http",
+      displayName: "Issue tracker",
+      description: "Local issue tools",
+      endpoint: "https://mcp.example.test/rpc?tenant=private",
+      allowPrivateNetwork: false,
+    });
+    expect(result.ok && result.value.kind).toBe("mcp_http");
+    expect(JSON.stringify(result)).not.toContain("upstream-session-secret");
+    expect(JSON.stringify(result)).not.toContain("source-secret");
+  });
+
+  it("sends every supported initial MCP HTTP credential directly on source create", async () => {
+    const credentials = [
+      { type: "bearer", token: "bearer-secret" },
+      { type: "basic", username: "admin", password: "password-secret" },
+      { type: "api_key_header", name: "X-Service-Key", value: "header-secret" },
+      { type: "oauth_access_token", accessToken: "oauth-secret" },
+    ] as const;
+    const bodies: unknown[] = [];
+
+    for (const credential of credentials) {
+      await createMcpHttpSource(
+        {
+          kind: "mcp_http",
+          displayName: "Authenticated MCP",
+          endpoint: "https://mcp.example.test/mcp",
+          credential,
+        },
+        `mcp-http-credential-${credential.type}`,
+        async (_input, init) => {
+          bodies.push(decodeJson(String(init?.body)));
+          return Response.json({
+            ...sourceFixture(),
+            kind: "mcp_http",
+            configuration: {
+              endpoint: "https://mcp.example.test/mcp",
+              allowPrivateNetwork: false,
+            },
+          });
+        },
+      );
+    }
+
+    expect(bodies).toEqual(
+      credentials.map((credential) => ({
+        kind: "mcp_http",
+        displayName: "Authenticated MCP",
+        endpoint: "https://mcp.example.test/mcp",
+        credential,
+      })),
+    );
+  });
+
+  it("creates GraphQL sources with the flattened credential contract and redacted public endpoint", async () => {
+    const secret = "graphql-query-secret";
+    let body: unknown;
+    const result = await createGraphqlSource(
+      {
+        kind: "graphql",
+        displayName: "Product API",
+        preferredSlug: "product",
+        endpoint: `https://api.example.test/graphql?token=${secret}`,
+        allowPrivateNetwork: false,
+        credential: { type: "bearer", token: "bearer-secret" },
+      },
+      "graphql-create-key",
+      async (input, init) => {
+        expect(String(input)).toBe("/api/v1/sources");
+        body = decodeJson(String(init?.body));
+        return Response.json(
+          {
+            ...sourceFixture(),
+            kind: "graphql",
+            slug: "product",
+            displayName: "Product API",
+            configuration: {
+              endpoint: `https://api.example.test/graphql?token=${secret}`,
+              allowPrivateNetwork: false,
+              encryptedEndpoint: secret,
+            },
+          },
+          { status: 201 },
+        );
+      },
+    );
+
+    expect(body).toEqual({
+      kind: "graphql",
+      displayName: "Product API",
+      preferredSlug: "product",
+      endpoint: `https://api.example.test/graphql?token=${secret}`,
+      allowPrivateNetwork: false,
+      credential: { type: "bearer", token: "bearer-secret" },
+    });
+    expect(result.ok && result.value.configuration).toEqual({
+      endpoint: "https://api.example.test",
+      allowPrivateNetwork: false,
+    });
+    expect(JSON.stringify(result)).not.toContain(secret);
+    expect(JSON.stringify(result)).not.toContain("bearer-secret");
+  });
+
+  it("strips path credentials from source endpoints before browser state", async () => {
+    const pathSecret = "path-secret-never-render";
+    const result = await listSources(async () =>
+      Response.json({
+        sources: [
+          {
+            ...sourceFixture(),
+            kind: "graphql",
+            configuration: {
+              endpoint: `https://api.example.test/graphql/${pathSecret}`,
+              allowPrivateNetwork: false,
+            },
+          },
+        ],
+        catalogRevision: 12,
+      }),
+    );
+
+    expect(result.ok && result.value.sources[0]?.configuration.endpoint).toBe(
+      "https://api.example.test",
+    );
+    expect(JSON.stringify(result)).not.toContain(pathSecret);
+  });
+
+  it("lists trusted stdio templates without decoding raw process configuration", async () => {
+    const secret = "raw-process-secret";
+    const result = await listMcpStdioTemplates(async (input) => {
+      expect(String(input)).toBe("/api/v1/mcp/stdio/templates");
+      return Response.json({
+        templates: [
+          {
+            name: "github-local",
+            secretFields: ["GITHUB_TOKEN"],
+            command: "/usr/local/bin/private-server",
+            args: ["--token", secret],
+            env: { TOKEN: secret },
+          },
+        ],
+      });
+    });
+
+    expect(result).toEqual({
+      ok: true,
+      value: { templates: [{ name: "github-local", secretFields: ["GITHUB_TOKEN"] }] },
+    });
+    expect(JSON.stringify(result)).not.toContain(secret);
+    expect(JSON.stringify(result)).not.toContain("private-server");
+  });
+
+  it("creates a trusted stdio source without accepting a secret echo", async () => {
+    const secret = " whitespace-sensitive-secret ";
+    let body: unknown;
+    const result = await createMcpStdioSource(
+      {
+        kind: "mcp_stdio",
+        displayName: "Local GitHub",
+        templateName: "github-local",
+        secretValues: { GITHUB_TOKEN: secret },
+      },
+      "mcp-stdio-create-key",
+      async (input, init) => {
+        expect(String(input)).toBe("/api/v1/sources");
+        expect(init?.method).toBe("POST");
+        body = decodeJson(String(init?.body));
+        return Response.json({
+          ...sourceFixture(),
+          kind: "mcp_stdio",
+          configuration: { templateName: "github-local" },
+          secretValues: { GITHUB_TOKEN: secret },
+        });
+      },
+    );
+
+    expect(body).toEqual({
+      kind: "mcp_stdio",
+      displayName: "Local GitHub",
+      templateName: "github-local",
+      secretValues: { GITHUB_TOKEN: secret },
+    });
+    expect(result.ok && result.value.configuration).toEqual({ templateName: "github-local" });
+    expect(JSON.stringify(result)).not.toContain(secret);
+  });
+
+  it("reads MCP credential metadata and sends protocol-specific CAS replacements", async () => {
+    const reads = await getSourceCredentials("mcp/source", async (input) => {
+      expect(String(input)).toBe("/api/v1/sources/mcp%2Fsource/credentials");
+      return Response.json({
+        revision: 7,
+        configuredSchemes: [{ name: "TOKEN", credentialType: "secret_env" }],
+      });
+    });
+    const bodies: unknown[] = [];
+    await putMcpHttpCredentials(
+      "http-source",
+      4,
+      {
+        credential: { type: "api_key_header", name: "X-Service-Key", value: "secret" },
+      },
+      async (_input, init) => {
+        bodies.push(decodeJson(String(init?.body)));
+        return Response.json({
+          revision: 5,
+          configuredSchemes: [{ name: "authorization", credentialType: "api_key_header" }],
+        });
+      },
+    );
+    await putMcpStdioCredentials(
+      "stdio-source",
+      7,
+      { secretValues: { TOKEN: " exact secret " } },
+      async (_input, init) => {
+        bodies.push(decodeJson(String(init?.body)));
+        return Response.json({
+          revision: 8,
+          configuredSchemes: [{ name: "TOKEN", credentialType: "secret_env" }],
+        });
+      },
+    );
+
+    expect(reads.ok && reads.value.revision).toBe(7);
+    expect(bodies).toEqual([
+      {
+        expectedRevision: 4,
+        credential: {
+          credential: { type: "api_key_header", name: "X-Service-Key", value: "secret" },
+        },
+      },
+      {
+        expectedRevision: 7,
+        credential: { secretValues: { TOKEN: " exact secret " } },
+      },
+    ]);
+  });
+
+  it("sends GraphQL replacement and clear credentials without an extra envelope", async () => {
+    const bodies: unknown[] = [];
+    await putGraphqlCredentials(
+      "graphql/source",
+      7,
+      { type: "api_key_header", name: "X-Service-Key", value: " exact secret " },
+      async (input, init) => {
+        expect(String(input)).toBe("/api/v1/sources/graphql%2Fsource/credentials");
+        bodies.push(decodeJson(String(init?.body)));
+        return Response.json({
+          revision: 8,
+          configuredSchemes: [{ name: "default", credentialType: "api_key_header" }],
+        });
+      },
+    );
+    await putGraphqlCredentials("graphql/source", 8, null, async (_input, init) => {
+      bodies.push(decodeJson(String(init?.body)));
+      return Response.json({ revision: 9, configuredSchemes: [] });
+    });
+
+    expect(bodies).toEqual([
+      {
+        expectedRevision: 7,
+        credential: {
+          type: "api_key_header",
+          name: "X-Service-Key",
+          value: " exact secret ",
+        },
+      },
+      { expectedRevision: 8, credential: null },
+    ]);
+  });
+
+  it("strictly decodes managed OAuth metadata and sends credential-keyed CAS operations", async () => {
+    const secret = "oauth-secret-never-decode";
+    const connection = {
+      id: "connection-1",
+      credentialKey: "oauth/scheme",
+      revision: 4,
+      status: "connected",
+      issuer: "https://identity.example.test/",
+      clientId: "executor-client",
+      clientAuthMethod: "client_secret_basic",
+      callbackUrl: "https://executor.example.test/api/v1/oauth/callback/connection-1",
+      requestedScopes: ["read"],
+      grantedScopes: ["read"],
+      hasClientSecret: true,
+      hasRefreshToken: true,
+      accessExpiresAt: 900,
+      authorizedAt: 100,
+      lastRefreshedAt: 200,
+      errorCode: null,
+      managedOAuthEligible: true,
+    } as const;
+    const listed = await listOAuthConnections("source/1", async (input) => {
+      expect(String(input)).toBe("/api/v1/sources/source%2F1/oauth");
+      return Response.json({
+        connections: [
+          {
+            ...connection,
+            managedOAuthEligible: false,
+            accessToken: secret,
+            clientSecret: secret,
+          },
+        ],
+        availableCredentials: [
+          {
+            credentialKey: "oauth/scheme",
+            protocol: "openapi",
+            requestedScopes: ["read"],
+            managedOAuthEligible: true,
+            providerMetadata: secret,
+          },
+        ],
+        tokenResponse: secret,
+      });
+    });
+    expect(listed.ok).toBe(true);
+    expect(listed.ok && listed.value.connections[0]?.managedOAuthEligible).toBe(false);
+    expect(JSON.stringify(listed)).not.toContain(secret);
+
+    const bodies: unknown[] = [];
+    const saveInput = {
+      expectedRevision: 4,
+      discovery: { type: "issuer" as const, issuer: "https://identity.example.test/" },
+      client: {
+        clientId: "executor-client",
+        authentication: "client_secret_basic" as const,
+        clientSecret: { action: "preserve" as const },
+      },
+      scopes: ["read"],
+    };
+    await putOAuthConnection("source/1", "oauth/scheme", saveInput, async (input, init) => {
+      expect(String(input)).toBe("/api/v1/sources/source%2F1/oauth/oauth%2Fscheme");
+      bodies.push(decodeJson(String(init?.body)));
+      return Response.json({ ...connection, revision: 5 });
+    });
+    await authorizeOAuthConnection(
+      "source/1",
+      "oauth/scheme",
+      { expectedRevision: 5 },
+      async (input, init) => {
+        expect(String(input)).toBe("/api/v1/sources/source%2F1/oauth/oauth%2Fscheme/authorize");
+        bodies.push(decodeJson(String(init?.body)));
+        return Response.json({
+          authorizationUrl: "https://identity.example.test/authorize?state=opaque",
+          state: secret,
+        });
+      },
+    );
+    const disconnected = await disconnectOAuthConnection(
+      "source/1",
+      "oauth/scheme",
+      { expectedRevision: 5 },
+      async (input, init) => {
+        expect(String(input)).toBe("/api/v1/sources/source%2F1/oauth/oauth%2Fscheme/disconnect");
+        bodies.push(decodeJson(String(init?.body)));
+        return Response.json({
+          ...connection,
+          revision: 6,
+          status: "ready_to_connect",
+          managedOAuthEligible: false,
+        });
+      },
+    );
+    expect(disconnected.ok && disconnected.value.managedOAuthEligible).toBe(false);
+    await deleteOAuthConnection(
+      "source/1",
+      "oauth/scheme",
+      { expectedRevision: 6 },
+      async (input, init) => {
+        expect(String(input)).toBe(
+          "/api/v1/sources/source%2F1/oauth/oauth%2Fscheme?expectedRevision=6",
+        );
+        expect(init?.method).toBe("DELETE");
+        return new Response(null, { status: 204 });
+      },
+    );
+    expect(bodies).toEqual([saveInput, { expectedRevision: 5 }, { expectedRevision: 5 }]);
+  });
+
+  it("decodes OpenAPI refresh counts", async () => {
+    const result = await refreshOpenApiSource("source/1", async (input, init) => {
+      expect(String(input)).toBe("/api/v1/sources/source%2F1/refresh");
+      expect(init?.body).toBe("{}");
+      return Response.json({
+        sourceId: "source/1",
+        sourceRevision: 4,
+        catalogRevision: 9,
+        globalRevision: 13,
+        activeToolCount: 6,
+        tombstonedToolCount: 2,
+      });
+    });
+
+    expect(result.ok && result.value.activeToolCount).toBe(6);
+  });
+
+  it("reads and replaces only credential metadata and sends CAS revisions", async () => {
+    const metadata = {
+      revision: 4,
+      configuredSchemes: [{ name: "bearerAuth", credentialType: "bearer" }],
+    };
+    const read = await getOpenApiCredentials("source-1", async () => Response.json(metadata));
+    let putBody: unknown;
+    const replaced = await putOpenApiCredentials(
+      "source-1",
+      4,
+      { oauth: { type: "oauth_access_token", access_token: "secret-token" } },
+      async (_input, init) => {
+        putBody = decodeJson(String(init?.body));
+        return Response.json({
+          revision: 5,
+          configuredSchemes: [{ name: "oauth", credentialType: "manual_oauth_access_token" }],
+        });
+      },
+    );
+
+    expect(read).toEqual({ ok: true, value: metadata });
+    expect(putBody).toEqual({
+      expectedRevision: 4,
+      credential: {
+        schemes: { oauth: { type: "oauth_access_token", access_token: "secret-token" } },
+      },
+    });
+    expect(replaced.ok && replaced.value.revision).toBe(5);
+  });
+
+  it("clears credentials with an encoded CAS query", async () => {
+    const result = await deleteOpenApiCredentials("source/1", 5, async (input, init) => {
+      expect(String(input)).toBe("/api/v1/sources/source%2F1/credentials?expectedRevision=5");
+      expect(init?.method).toBe("DELETE");
+      return Response.json({ revision: 6, configuredSchemes: [] });
+    });
+
+    expect(result.ok && result.value.configuredSchemes).toEqual([]);
+  });
+
+  it("lists and reads strict approval DTOs without retaining secret extras", async () => {
+    const secret = "approval-secret-sentinel";
+    const list = await listApprovals(
+      { status: "pending", cursor: "older/page", limit: 50 },
+      async (input) => {
+        expect(String(input)).toBe("/api/v1/approvals?limit=50&status=pending&cursor=older%2Fpage");
+        return Response.json({
+          items: [
+            {
+              ...approvalSummaryFixture(),
+              sourceDisplayName: null,
+              toolDisplayName: null,
+              actorKind: "system",
+              actorId: "local_cli",
+              actorName: null,
+              actorLabel: "Local CLI",
+              actorApiTokenId: null,
+              actorTokenName: null,
+              rawArguments: { password: secret },
+              encryptedArguments: secret,
+              credential: secret,
+            },
+          ],
+          nextCursor: "next",
+          internalKey: secret,
+        });
+      },
+    );
+    const detail = await getApproval("approval/1", async (input) => {
+      expect(String(input)).toBe("/api/v1/approvals/approval%2F1");
+      return Response.json({
+        ...approvalDetailFixture(),
+        rawArguments: { password: secret },
+        encryptedArguments: secret,
+        result: secret,
+      });
+    });
+
+    expect(list.ok).toBe(true);
+    expect(detail.ok).toBe(true);
+    expect(JSON.stringify(list)).not.toContain(secret);
+    expect(JSON.stringify(detail)).not.toContain(secret);
+    expect(list.ok && list.value.items[0]?.sourceDisplayName).toBeNull();
+    expect(list.ok && list.value.items[0]?.toolDisplayName).toBeNull();
+    expect(list.ok && list.value.items[0]?.actorTokenName).toBeNull();
+    expect(list.ok && list.value.items[0]?.actorKind).toBe("system");
+    expect(list.ok && list.value.items[0]?.actorLabel).toBe("Local CLI");
+    expect(list.ok && list.value.items[0]?.actorApiTokenId).toBeNull();
+    expect(detail.ok && detail.value.redactedArguments).toEqual({
+      title: "Issue title",
+      body: "[REDACTED]",
+    });
+  });
+
+  it("omits the approval status parameter for an all-status list", async () => {
+    await listApprovals({ status: null, cursor: null, limit: 50 }, async (input) => {
+      expect(String(input)).toBe("/api/v1/approvals?limit=50");
+      return Response.json({ items: [], nextCursor: null });
+    });
+  });
+
+  it("sends approval decisions once with the viewed CAS revision", async () => {
+    document.cookie = "executor_csrf=approval_csrf; Path=/";
+    let calls = 0;
+    let body: unknown;
+    let csrf: string | null = null;
+    const result = await decideApproval("approval/1", "approve", 4, async (input, init) => {
+      calls += 1;
+      expect(String(input)).toBe("/api/v1/approvals/approval%2F1/decision");
+      expect(init?.method).toBe("POST");
+      body = decodeJson(String(init?.body));
+      csrf = new Headers(init?.headers).get("x-executor-csrf");
+      return Response.json({
+        ...approvalDetailFixture(),
+        status: "approved",
+        revision: 5,
+        decidedAt: 150,
+      });
+    });
+
+    expect(calls).toBe(1);
+    expect(body).toEqual({ decision: "approve", expectedRevision: 4 });
+    expect(csrf).toBe("approval_csrf");
+    expect(result.ok && result.value.status).toBe("approved");
+  });
+
+  it("preserves an approval conflict for refetch and review without retrying", async () => {
+    let calls = 0;
+    const result = await decideApproval("approval-1", "deny", 4, async () => {
+      calls += 1;
+      return Response.json(
+        {
+          error: {
+            code: "revision_conflict",
+            message: "The approval changed.",
+            requestId: "request-conflict",
+          },
+        },
+        { status: 409 },
+      );
+    });
+
+    expect(calls).toBe(1);
+    expect(result).toEqual({
+      ok: false,
+      error: new ApiError({
+        code: "revision_conflict",
+        displayMessage: "The approval changed.",
+        requestId: "request-conflict",
+        status: 409,
+      }),
+    });
+  });
+});
diff --git a/web/src/lib/api.ts b/web/src/lib/api.ts
new file mode 100644
index 000000000..e6827b14d
--- /dev/null
+++ b/web/src/lib/api.ts
@@ -0,0 +1,1676 @@
+import { Option, Schema } from "effect";
+import type { GraphqlCredential, GraphqlSourceInput } from "$lib/graphql-source-state";
+import type {
+  OAuthAuthorization,
+  OAuthConnectionInput,
+  OAuthConnectionList,
+  OAuthConnectionSummary,
+} from "$lib/oauth-connection-state";
+
+export type { GraphqlCredential, GraphqlSourceInput } from "$lib/graphql-source-state";
+export type {
+  OAuthAuthorization,
+  OAuthAvailableCredential,
+  OAuthConnectionInput,
+  OAuthConnectionList,
+  OAuthConnectionSummary,
+} from "$lib/oauth-connection-state";
+
+const BootstrapSchema = Schema.Struct({
+  setupRequired: Schema.Boolean,
+  authenticated: Schema.Boolean,
+});
+
+const SessionSchema = Schema.Struct({
+  username: Schema.String,
+  csrfToken: Schema.NullOr(Schema.String),
+});
+
+const TokenMetadataSchema = Schema.Struct({
+  id: Schema.String,
+  name: Schema.String,
+  maskedToken: Schema.String,
+  createdAt: Schema.Number,
+  lastUsedAt: Schema.NullOr(Schema.Number),
+  revokedAt: Schema.NullOr(Schema.Number),
+});
+
+const CreatedTokenSchema = Schema.Struct({
+  id: Schema.String,
+  name: Schema.String,
+  token: Schema.String,
+  createdAt: Schema.Number,
+});
+
+const TokenListSchema = Schema.Struct({
+  tokens: Schema.Array(TokenMetadataSchema),
+});
+
+const ToolModeSchema = Schema.Literals(["enabled", "ask", "disabled"]);
+const ModeProvenanceSchema = Schema.Literals(["tool_override", "source_override", "intrinsic"]);
+const SourcePublicConfigurationSchema = Schema.Struct({
+  endpoint: Schema.optional(Schema.String),
+  allowPrivateNetwork: Schema.optional(Schema.Boolean),
+  templateName: Schema.optional(Schema.String),
+  negotiatedProtocolVersion: Schema.optional(Schema.String),
+});
+
+const SourceSchema = Schema.Struct({
+  id: Schema.String,
+  kind: Schema.Literals(["openapi", "graphql", "mcp_http", "mcp_stdio"]),
+  slug: Schema.String,
+  displayName: Schema.String,
+  description: Schema.NullOr(Schema.String),
+  configuration: SourcePublicConfigurationSchema,
+  modeOverride: Schema.NullOr(ToolModeSchema),
+  healthStatus: Schema.Literals(["unknown", "healthy", "error"]),
+  healthErrorCode: Schema.NullOr(Schema.String),
+  revision: Schema.Number,
+  catalogRevision: Schema.Number,
+  createdAt: Schema.Number,
+  updatedAt: Schema.Number,
+  lastRefreshedAt: Schema.NullOr(Schema.Number),
+  toolCount: Schema.Number,
+  tombstonedToolCount: Schema.Number,
+});
+
+const SourceListSchema = Schema.Struct({
+  sources: Schema.Array(SourceSchema),
+  catalogRevision: Schema.Number,
+});
+
+const SourceCreationStatusSchema = Schema.Struct({
+  status: Schema.Literals([
+    "missing",
+    "in_progress",
+    "abandoned",
+    "interrupted",
+    "expired_unknown",
+  ]),
+});
+
+const OAuthFlowSchema = Schema.Struct({
+  authorizationUrl: Schema.NullOr(Schema.String),
+  tokenUrl: Schema.NullOr(Schema.String),
+  refreshUrl: Schema.NullOr(Schema.String),
+  scopes: Schema.Record(Schema.String, Schema.String),
+});
+
+const OAuthFlowsSchema = Schema.Struct({
+  implicit: Schema.NullOr(OAuthFlowSchema),
+  password: Schema.NullOr(OAuthFlowSchema),
+  clientCredentials: Schema.NullOr(OAuthFlowSchema),
+  authorizationCode: Schema.NullOr(OAuthFlowSchema),
+});
+
+const OpenApiCredentialTypeSchema = Schema.Literals([
+  "api_key",
+  "bearer",
+  "basic",
+  "manual_oauth_access_token",
+  "http",
+  "mutual_tls",
+]);
+
+const OpenApiPreviewSchema = Schema.Struct({
+  title: Schema.String,
+  description: Schema.NullOr(Schema.String),
+  toolCount: Schema.Number,
+  tools: Schema.Array(
+    Schema.Struct({
+      preferredName: Schema.String,
+      displayName: Schema.String,
+      description: Schema.NullOr(Schema.String),
+      intrinsicMode: ToolModeSchema,
+      security: Schema.Array(Schema.Array(Schema.String)),
+    }),
+  ),
+  securitySchemes: Schema.Array(
+    Schema.Struct({
+      name: Schema.String,
+      credentialType: OpenApiCredentialTypeSchema,
+      placement: Schema.NullOr(Schema.Literals(["header", "query", "cookie", "path"])),
+      supported: Schema.Boolean,
+      oauthFlows: Schema.NullOr(OAuthFlowsSchema),
+    }),
+  ),
+});
+
+const CredentialMetadataSchema = Schema.Struct({
+  revision: Schema.Number,
+  configuredSchemes: Schema.Array(
+    Schema.Struct({
+      name: Schema.String,
+      credentialType: Schema.Literals([
+        "api_key",
+        "bearer",
+        "basic",
+        "manual_oauth_access_token",
+        "secret_env",
+        "header",
+        "api_key_header",
+        "oauth_access_token",
+      ]),
+    }),
+  ),
+});
+
+const McpStdioTemplateListSchema = Schema.Struct({
+  templates: Schema.Array(
+    Schema.Struct({
+      name: Schema.String,
+      secretFields: Schema.Array(Schema.String),
+    }),
+  ),
+});
+
+const OAuthConnectionStatusSchema = Schema.Literals([
+  "not_configured",
+  "ready_to_connect",
+  "connecting",
+  "connected",
+  "reauthorization_required",
+  "error",
+]);
+
+const OAuthConnectionSummarySchema = Schema.Struct({
+  id: Schema.String,
+  credentialKey: Schema.String,
+  revision: Schema.Number,
+  status: OAuthConnectionStatusSchema,
+  issuer: Schema.String,
+  clientId: Schema.String,
+  clientAuthMethod: Schema.Literals(["none", "client_secret_basic", "client_secret_post"]),
+  callbackUrl: Schema.String,
+  requestedScopes: Schema.Array(Schema.String),
+  grantedScopes: Schema.Array(Schema.String),
+  hasClientSecret: Schema.Boolean,
+  hasRefreshToken: Schema.Boolean,
+  accessExpiresAt: Schema.NullOr(Schema.Number),
+  authorizedAt: Schema.NullOr(Schema.Number),
+  lastRefreshedAt: Schema.NullOr(Schema.Number),
+  errorCode: Schema.NullOr(Schema.String),
+  managedOAuthEligible: Schema.Boolean,
+});
+
+const OAuthAvailableCredentialSchema = Schema.Struct({
+  credentialKey: Schema.String,
+  protocol: Schema.Literals(["openapi", "graphql", "mcp_http"]),
+  requestedScopes: Schema.Array(Schema.String),
+  managedOAuthEligible: Schema.Literal(true),
+});
+
+const OAuthConnectionListSchema = Schema.Struct({
+  connections: Schema.Array(OAuthConnectionSummarySchema),
+  availableCredentials: Schema.Array(OAuthAvailableCredentialSchema),
+});
+
+const OAuthAuthorizationSchema = Schema.Struct({ authorizationUrl: Schema.String });
+
+const CatalogSyncResultSchema = Schema.Struct({
+  sourceId: Schema.String,
+  sourceRevision: Schema.Number,
+  catalogRevision: Schema.Number,
+  globalRevision: Schema.Number,
+  activeToolCount: Schema.Number,
+  tombstonedToolCount: Schema.Number,
+});
+
+const EffectiveModeSchema = Schema.Struct({
+  mode: ToolModeSchema,
+  provenance: ModeProvenanceSchema,
+});
+
+const ToolSummarySchema = Schema.Struct({
+  id: Schema.String,
+  sourceId: Schema.String,
+  sourceSlug: Schema.String,
+  stableKey: Schema.String,
+  localName: Schema.String,
+  callablePath: Schema.String,
+  sandboxPath: Schema.String,
+  displayName: Schema.String,
+  description: Schema.NullOr(Schema.String),
+  intrinsicMode: ToolModeSchema,
+  modeOverride: Schema.NullOr(ToolModeSchema),
+  effectiveMode: EffectiveModeSchema,
+  present: Schema.Boolean,
+  revision: Schema.Number,
+  createdAt: Schema.Number,
+  updatedAt: Schema.Number,
+  lastSeenAt: Schema.Number,
+  tombstonedAt: Schema.NullOr(Schema.Number),
+});
+
+const ToolRecordSchema = Schema.Struct({
+  ...ToolSummarySchema.fields,
+  inputSchema: Schema.Unknown,
+  outputSchema: Schema.NullOr(Schema.Unknown),
+  inputTypescript: Schema.NullOr(Schema.String),
+  outputTypescript: Schema.NullOr(Schema.String),
+  typescriptDefinitions: Schema.Record(Schema.String, Schema.String),
+});
+
+const ToolPageSchema = Schema.Struct({
+  items: Schema.Array(ToolSummarySchema),
+  total: Schema.Number,
+  hasMore: Schema.Boolean,
+  nextOffset: Schema.NullOr(Schema.Number),
+  catalogRevision: Schema.Number,
+});
+
+const BulkToolModeResultSchema = Schema.Struct({
+  updatedCount: Schema.Number,
+  catalogRevision: Schema.Number,
+  sourceRevisions: Schema.Record(Schema.String, Schema.Number),
+});
+
+const RequestLogSchema = Schema.Struct({
+  requestId: Schema.String,
+  actorApiTokenId: Schema.NullOr(Schema.String),
+  surface: Schema.Literals(["admin", "gateway", "cli", "mcp"]),
+  sourceId: Schema.NullOr(Schema.String),
+  toolId: Schema.NullOr(Schema.String),
+  pathSnapshot: Schema.NullOr(Schema.String),
+  outcome: Schema.Literals(["succeeded", "failed", "pending_approval", "denied"]),
+  errorCode: Schema.NullOr(Schema.String),
+  durationMs: Schema.Number,
+  approvalId: Schema.NullOr(Schema.String),
+  createdAt: Schema.Number,
+});
+
+const RequestLogPageSchema = Schema.Struct({
+  items: Schema.Array(RequestLogSchema),
+  nextCursor: Schema.NullOr(Schema.String),
+});
+
+const ApprovalStatusSchema = Schema.Literals([
+  "pending",
+  "approved",
+  "executing",
+  "succeeded",
+  "failed",
+  "denied",
+  "canceled",
+  "expired",
+  "stale",
+  "interrupted",
+]);
+
+const ApprovalSummarySchema = Schema.Struct({
+  id: Schema.String,
+  status: ApprovalStatusSchema,
+  revision: Schema.Number,
+  sourceId: Schema.String,
+  toolId: Schema.String,
+  path: Schema.String,
+  sourceDisplayName: Schema.NullOr(Schema.String),
+  toolDisplayName: Schema.NullOr(Schema.String),
+  actorKind: Schema.Literals(["api_token", "admin", "system"]),
+  actorId: Schema.String,
+  actorName: Schema.NullOr(Schema.String),
+  actorLabel: Schema.String,
+  actorApiTokenId: Schema.NullOr(Schema.String),
+  actorTokenName: Schema.NullOr(Schema.String),
+  surface: Schema.Literals(["gateway", "cli", "mcp"]),
+  mode: Schema.Literal("ask"),
+  provenance: ModeProvenanceSchema,
+  executionId: Schema.String,
+  callId: Schema.String,
+  createdAt: Schema.Number,
+  updatedAt: Schema.Number,
+  expiresAt: Schema.Number,
+  decidedAt: Schema.NullOr(Schema.Number),
+  startedAt: Schema.NullOr(Schema.Number),
+  completedAt: Schema.NullOr(Schema.Number),
+  decision: Schema.NullOr(Schema.Literals(["approve", "deny"])),
+  failureCode: Schema.NullOr(Schema.String),
+});
+
+const ApprovalDetailSchema = Schema.Struct({
+  ...ApprovalSummarySchema.fields,
+  redactedArguments: Schema.Unknown,
+  inputSchema: Schema.Unknown,
+});
+
+const ApprovalPageSchema = Schema.Struct({
+  items: Schema.Array(ApprovalSummarySchema),
+  nextCursor: Schema.NullOr(Schema.String),
+});
+
+const ErrorEnvelopeSchema = Schema.Struct({
+  error: Schema.Struct({
+    code: Schema.String,
+    message: Schema.String,
+    requestId: Schema.String,
+  }),
+});
+
+export type Bootstrap = typeof BootstrapSchema.Type;
+export type Session = typeof SessionSchema.Type;
+export type TokenMetadata = typeof TokenMetadataSchema.Type;
+export type CreatedToken = typeof CreatedTokenSchema.Type;
+export type ToolMode = typeof ToolModeSchema.Type;
+export type Source = typeof SourceSchema.Type;
+export type SourceList = typeof SourceListSchema.Type;
+export type SourceCreationStatus = (typeof SourceCreationStatusSchema.Type)["status"];
+export type SourceCreationResolution =
+  | { readonly kind: "status"; readonly status: SourceCreationStatus }
+  | { readonly kind: "replay"; readonly result: ApiResult<Source> };
+export type OpenApiPreview = typeof OpenApiPreviewSchema.Type;
+export type CatalogSyncResult = typeof CatalogSyncResultSchema.Type;
+export type OpenApiCredentialMetadata = typeof CredentialMetadataSchema.Type;
+export type McpStdioTemplate = (typeof McpStdioTemplateListSchema.Type)["templates"][number];
+export type ToolSummary = typeof ToolSummarySchema.Type;
+export type ToolRecord = typeof ToolRecordSchema.Type;
+export type ToolPage = typeof ToolPageSchema.Type;
+export type BulkToolModeResult = typeof BulkToolModeResultSchema.Type;
+export type RequestLog = typeof RequestLogSchema.Type;
+export type RequestLogPage = typeof RequestLogPageSchema.Type;
+export type ApprovalStatus = typeof ApprovalStatusSchema.Type;
+export type ApprovalSummary = typeof ApprovalSummarySchema.Type;
+export type ApprovalDetail = typeof ApprovalDetailSchema.Type;
+export type ApprovalPage = typeof ApprovalPageSchema.Type;
+export type ApprovalDecision = "approve" | "deny";
+
+export class ApiError extends Schema.TaggedErrorClass<ApiError>()("ApiError", {
+  code: Schema.String,
+  displayMessage: Schema.String,
+  requestId: Schema.NullOr(Schema.String),
+  status: Schema.Number,
+}) {}
+
+export type ApiResult<Value> =
+  | { readonly ok: true; readonly value: Value }
+  | { readonly ok: false; readonly error: ApiError };
+
+export type TokenCreateApiResult =
+  | {
+      readonly ok: true;
+      readonly value: CreatedToken;
+      readonly replayProvenance: "none" | "authoritative" | "invalid";
+      readonly responseDisposition: "authoritative" | "ambiguous";
+    }
+  | {
+      readonly ok: false;
+      readonly error: ApiError;
+      readonly replayProvenance: "none" | "authoritative" | "invalid";
+      readonly responseDisposition: "authoritative" | "ambiguous";
+    };
+
+export type SourceCreateApiResult =
+  | {
+      readonly ok: true;
+      readonly value: Source;
+      readonly replayProvenance: "none" | "authoritative" | "invalid";
+      readonly responseDisposition: "authoritative" | "ambiguous";
+    }
+  | {
+      readonly ok: false;
+      readonly error: ApiError;
+      readonly replayProvenance: "none" | "authoritative" | "invalid";
+      readonly responseDisposition: "authoritative" | "ambiguous";
+    };
+
+type Fetcher = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
+type ResponsePayload = { text: string; requestId: string | null };
+
+const decodeBootstrap = Schema.decodeUnknownOption(Schema.fromJsonString(BootstrapSchema));
+const decodeSession = Schema.decodeUnknownOption(Schema.fromJsonString(SessionSchema));
+const decodeCreatedToken = Schema.decodeUnknownOption(Schema.fromJsonString(CreatedTokenSchema));
+const decodeTokenList = Schema.decodeUnknownOption(Schema.fromJsonString(TokenListSchema));
+const decodeRawSource = Schema.decodeUnknownOption(Schema.fromJsonString(SourceSchema));
+const decodeRawSourceList = Schema.decodeUnknownOption(Schema.fromJsonString(SourceListSchema));
+const decodeSourceCreationStatusJson = Schema.decodeUnknownOption(
+  Schema.fromJsonString(SourceCreationStatusSchema),
+);
+const decodeSourceCreationStatus = (text: string) =>
+  decodeSourceCreationStatusJson(text, { onExcessProperty: "error" });
+const decodeSource = (text: string) => sanitizeDecodedSource(decodeRawSource(text));
+const decodeSourceList = (text: string) => {
+  const decoded = decodeRawSourceList(text);
+  if (Option.isNone(decoded)) return decoded;
+  return Option.some({
+    ...decoded.value,
+    sources: decoded.value.sources.map(sanitizeSource),
+  });
+};
+const decodeOpenApiPreview = Schema.decodeUnknownOption(
+  Schema.fromJsonString(OpenApiPreviewSchema),
+);
+const decodeCatalogSyncResult = Schema.decodeUnknownOption(
+  Schema.fromJsonString(CatalogSyncResultSchema),
+);
+const decodeCredentialMetadata = Schema.decodeUnknownOption(
+  Schema.fromJsonString(CredentialMetadataSchema),
+);
+const decodeMcpStdioTemplateList = Schema.decodeUnknownOption(
+  Schema.fromJsonString(McpStdioTemplateListSchema),
+);
+const decodeOAuthConnection = Schema.decodeUnknownOption(
+  Schema.fromJsonString(OAuthConnectionSummarySchema),
+);
+const decodeOAuthConnectionList = Schema.decodeUnknownOption(
+  Schema.fromJsonString(OAuthConnectionListSchema),
+);
+const decodeOAuthAuthorization = Schema.decodeUnknownOption(
+  Schema.fromJsonString(OAuthAuthorizationSchema),
+);
+const decodeToolRecord = Schema.decodeUnknownOption(Schema.fromJsonString(ToolRecordSchema));
+const decodeToolPage = Schema.decodeUnknownOption(Schema.fromJsonString(ToolPageSchema));
+const decodeBulkToolModeResult = Schema.decodeUnknownOption(
+  Schema.fromJsonString(BulkToolModeResultSchema),
+);
+const decodeRequestLog = Schema.decodeUnknownOption(Schema.fromJsonString(RequestLogSchema));
+const decodeRequestLogPage = Schema.decodeUnknownOption(
+  Schema.fromJsonString(RequestLogPageSchema),
+);
+const decodeApprovalDetail = Schema.decodeUnknownOption(
+  Schema.fromJsonString(ApprovalDetailSchema),
+);
+const decodeApprovalPage = Schema.decodeUnknownOption(Schema.fromJsonString(ApprovalPageSchema));
+const decodeErrorEnvelope = Schema.decodeUnknownOption(Schema.fromJsonString(ErrorEnvelopeSchema));
+
+export async function getBootstrap(fetcher: Fetcher = fetch, signal?: AbortSignal) {
+  const response = await request("/api/v1/bootstrap", { signal }, fetcher);
+  if (!response.ok) return response;
+  return decodeResponse(response.value, decodeBootstrap);
+}
+
+export async function setupAdmin(
+  input: { setupToken: string; username: string; password: string },
+  fetcher: Fetcher = fetch,
+) {
+  const response = await request(
+    "/api/v1/setup",
+    { method: "POST", body: JSON.stringify(input) },
+    fetcher,
+    false,
+  );
+  if (!response.ok) return response;
+  return decodeResponse(response.value, decodeSession);
+}
+
+export async function loginAdmin(
+  input: { username: string; password: string },
+  fetcher: Fetcher = fetch,
+) {
+  const response = await request(
+    "/api/v1/session",
+    { method: "POST", body: JSON.stringify(input) },
+    fetcher,
+    false,
+  );
+  if (!response.ok) return response;
+  return decodeResponse(response.value, decodeSession);
+}
+
+export async function getSession(fetcher: Fetcher = fetch, signal?: AbortSignal) {
+  const response = await request("/api/v1/session", { signal }, fetcher);
+  if (!response.ok) return response;
+  return decodeResponse(response.value, decodeSession);
+}
+
+export async function logoutAdmin(fetcher: Fetcher = fetch) {
+  const response = await request("/api/v1/session", { method: "DELETE" }, fetcher);
+  if (!response.ok) return response;
+  return { ok: true, value: undefined } as const;
+}
+
+export async function listTokens(fetcher: Fetcher = fetch, signal?: AbortSignal) {
+  const response = await request("/api/v1/tokens", { signal }, fetcher);
+  if (!response.ok) return response;
+
+  const decoded = decodeResponse(response.value, decodeTokenList);
+  if (!decoded.ok) return decoded;
+  return { ok: true, value: [...decoded.value.tokens] } as const;
+}
+
+export async function createToken(
+  name: string,
+  idempotencyKey: string,
+  fetcher: Fetcher = fetch,
+  signal?: AbortSignal,
+) {
+  return tokenCreateRequest(name, idempotencyKey, fetcher, signal);
+}
+
+export async function revokeToken(tokenId: string, fetcher: Fetcher = fetch, signal?: AbortSignal) {
+  const revoke = () =>
+    request(`/api/v1/tokens/${encodeURIComponent(tokenId)}`, { method: "DELETE", signal }, fetcher);
+  const first = await revoke();
+  if (!isAmbiguousRevokeResult(first) || signal?.aborted) {
+    return first.ok ? ({ ok: true, value: undefined } as const) : first;
+  }
+
+  const second = await revoke();
+  return second.ok ? ({ ok: true, value: undefined } as const) : second;
+}
+
+export async function listSources(fetcher: Fetcher = fetch, signal?: AbortSignal) {
+  const response = await request("/api/v1/sources", { signal }, fetcher);
+  if (!response.ok) return response;
+  return decodeResponse(response.value, decodeSourceList);
+}
+
+export async function setSourceMode(
+  sourceId: string,
+  mode: ToolMode | null,
+  expectedRevision: number,
+  fetcher: Fetcher = fetch,
+  signal?: AbortSignal,
+) {
+  const response = await request(
+    `/api/v1/sources/${encodeURIComponent(sourceId)}/mode`,
+    {
+      method: "PATCH",
+      body: JSON.stringify({ mode, expectedRevision }),
+      signal,
+    },
+    fetcher,
+  );
+  if (!response.ok) return response;
+  return decodeResponse(response.value, decodeSource);
+}
+
+export async function deleteSource(
+  sourceId: string,
+  fetcher: Fetcher = fetch,
+  signal?: AbortSignal,
+) {
+  const response = await request(
+    `/api/v1/sources/${encodeURIComponent(sourceId)}`,
+    { method: "DELETE", signal },
+    fetcher,
+  );
+  if (!response.ok) return response;
+  return { ok: true, value: undefined } as const;
+}
+
+export type OpenApiSpecInput =
+  | { readonly type: "inline"; readonly content: string }
+  | { readonly type: "url"; readonly url: string };
+
+export type OpenApiStaticCredential =
+  | { readonly type: "api_key"; readonly value: string }
+  | { readonly type: "bearer"; readonly token: string }
+  | { readonly type: "basic"; readonly username: string; readonly password: string }
+  | { readonly type: "oauth_access_token"; readonly access_token: string };
+
+export type OpenApiSourceInput = {
+  readonly kind: "openapi";
+  readonly displayName: string;
+  readonly preferredSlug?: string;
+  readonly description?: string;
+  readonly spec: OpenApiSpecInput;
+  readonly allowPrivateNetwork?: boolean;
+  readonly credential?: {
+    readonly schemes: Readonly<Record<string, OpenApiStaticCredential>>;
+  };
+};
+
+export type McpHttpSourceInput = {
+  readonly kind: "mcp_http";
+  readonly displayName: string;
+  readonly description?: string;
+  readonly endpoint: string;
+  readonly allowPrivateNetwork?: boolean;
+  readonly credential?: Exclude<McpHttpCredential["credential"], null>;
+};
+
+export type McpStdioSourceInput = {
+  readonly kind: "mcp_stdio";
+  readonly displayName: string;
+  readonly description?: string;
+  readonly templateName: string;
+  readonly secretValues: Readonly<Record<string, string>>;
+};
+
+export type McpHttpCredential =
+  | { readonly credential: null }
+  | { readonly credential: { readonly type: "bearer"; readonly token: string } }
+  | {
+      readonly credential: {
+        readonly type: "basic";
+        readonly username: string;
+        readonly password: string;
+      };
+    }
+  | {
+      readonly credential: {
+        readonly type: "api_key_header";
+        readonly name: string;
+        readonly value: string;
+      };
+    }
+  | {
+      readonly credential: {
+        readonly type: "oauth_access_token";
+        readonly accessToken: string;
+      };
+    };
+
+export type McpStdioCredential = {
+  readonly secretValues: Readonly<Record<string, string>>;
+};
+
+export async function previewOpenApiSource(
+  spec: OpenApiSpecInput,
+  allowPrivateNetwork: boolean,
+  fetcher: Fetcher = fetch,
+  signal?: AbortSignal,
+) {
+  const response = await request(
+    "/api/v1/sources/openapi/preview",
+    { method: "POST", body: JSON.stringify({ spec, allowPrivateNetwork }), signal },
+    fetcher,
+  );
+  if (!response.ok) return response;
+  return decodeResponse(response.value, decodeOpenApiPreview);
+}
+
+export async function createOpenApiSource(
+  input: OpenApiSourceInput,
+  idempotencyKey: string,
+  fetcher: Fetcher = fetch,
+  signal?: AbortSignal,
+) {
+  return sourceCreateRequest(input, idempotencyKey, fetcher, signal);
+}
+
+export async function createMcpHttpSource(
+  input: McpHttpSourceInput,
+  idempotencyKey: string,
+  fetcher: Fetcher = fetch,
+  signal?: AbortSignal,
+) {
+  return sourceCreateRequest(input, idempotencyKey, fetcher, signal);
+}
+
+export async function createGraphqlSource(
+  input: GraphqlSourceInput,
+  idempotencyKey: string,
+  fetcher: Fetcher = fetch,
+  signal?: AbortSignal,
+) {
+  return sourceCreateRequest(input, idempotencyKey, fetcher, signal);
+}
+
+export async function listMcpStdioTemplates(fetcher: Fetcher = fetch, signal?: AbortSignal) {
+  const response = await request("/api/v1/mcp/stdio/templates", { signal }, fetcher);
+  if (!response.ok) return response;
+  return decodeResponse(response.value, decodeMcpStdioTemplateList);
+}
+
+export async function createMcpStdioSource(
+  input: McpStdioSourceInput,
+  idempotencyKey: string,
+  fetcher: Fetcher = fetch,
+  signal?: AbortSignal,
+) {
+  return sourceCreateRequest(input, idempotencyKey, fetcher, signal);
+}
+
+export async function getSourceCreationResolution(
+  idempotencyKey: string,
+  fetcher: Fetcher = fetch,
+  signal?: AbortSignal,
+) {
+  return sourceCreationResolutionRequest(
+    "/api/v1/sources/idempotency",
+    "GET",
+    idempotencyKey,
+    fetcher,
+    signal,
+  );
+}
+
+export async function sealMissingSourceCreation(
+  idempotencyKey: string,
+  fetcher: Fetcher = fetch,
+  signal?: AbortSignal,
+) {
+  return sourceCreationResolutionRequest(
+    "/api/v1/sources/idempotency/seal",
+    "POST",
+    idempotencyKey,
+    fetcher,
+    signal,
+  );
+}
+
+export async function refreshOpenApiSource(
+  sourceId: string,
+  fetcher: Fetcher = fetch,
+  signal?: AbortSignal,
+) {
+  const response = await request(
+    `/api/v1/sources/${encodeURIComponent(sourceId)}/refresh`,
+    { method: "POST", body: "{}", signal },
+    fetcher,
+  );
+  if (!response.ok) return response;
+  return decodeResponse(response.value, decodeCatalogSyncResult);
+}
+
+export async function refreshSourceCatalog(
+  sourceId: string,
+  fetcher: Fetcher = fetch,
+  signal?: AbortSignal,
+) {
+  const response = await request(
+    `/api/v1/sources/${encodeURIComponent(sourceId)}/refresh`,
+    { method: "POST", body: "{}", signal },
+    fetcher,
+  );
+  if (!response.ok) return response;
+  return decodeResponse(response.value, decodeCatalogSyncResult);
+}
+
+export async function getOpenApiCredentials(
+  sourceId: string,
+  fetcher: Fetcher = fetch,
+  signal?: AbortSignal,
+) {
+  const response = await request(
+    `/api/v1/sources/${encodeURIComponent(sourceId)}/credentials`,
+    { signal },
+    fetcher,
+  );
+  if (!response.ok) return response;
+  return decodeResponse(response.value, decodeCredentialMetadata);
+}
+
+export async function getSourceCredentials(
+  sourceId: string,
+  fetcher: Fetcher = fetch,
+  signal?: AbortSignal,
+) {
+  const response = await request(
+    `/api/v1/sources/${encodeURIComponent(sourceId)}/credentials`,
+    { signal },
+    fetcher,
+  );
+  if (!response.ok) return response;
+  return decodeResponse(response.value, decodeCredentialMetadata);
+}
+
+export async function putMcpHttpCredentials(
+  sourceId: string,
+  expectedRevision: number,
+  credential: McpHttpCredential,
+  fetcher: Fetcher = fetch,
+  signal?: AbortSignal,
+) {
+  return putProtocolCredentials(sourceId, expectedRevision, credential, fetcher, signal);
+}
+
+export async function putMcpStdioCredentials(
+  sourceId: string,
+  expectedRevision: number,
+  credential: McpStdioCredential,
+  fetcher: Fetcher = fetch,
+  signal?: AbortSignal,
+) {
+  return putProtocolCredentials(sourceId, expectedRevision, credential, fetcher, signal);
+}
+
+export async function putGraphqlCredentials(
+  sourceId: string,
+  expectedRevision: number,
+  credential: GraphqlCredential,
+  fetcher: Fetcher = fetch,
+  signal?: AbortSignal,
+) {
+  const response = await request(
+    `/api/v1/sources/${encodeURIComponent(sourceId)}/credentials`,
+    {
+      method: "PUT",
+      body: JSON.stringify({ expectedRevision, credential }),
+      signal,
+    },
+    fetcher,
+  );
+  if (!response.ok) return response;
+  return decodeResponse(response.value, decodeCredentialMetadata);
+}
+
+export async function listOAuthConnections(
+  sourceId: string,
+  fetcher: Fetcher = fetch,
+  signal?: AbortSignal,
+): Promise<ApiResult<OAuthConnectionList>> {
+  const response = await request(
+    `/api/v1/sources/${encodeURIComponent(sourceId)}/oauth`,
+    { signal },
+    fetcher,
+  );
+  if (!response.ok) return response;
+  return decodeResponse(response.value, decodeOAuthConnectionList);
+}
+
+export async function putOAuthConnection(
+  sourceId: string,
+  credentialKey: string,
+  input: OAuthConnectionInput,
+  fetcher: Fetcher = fetch,
+  signal?: AbortSignal,
+): Promise<ApiResult<OAuthConnectionSummary>> {
+  const response = await request(
+    `/api/v1/sources/${encodeURIComponent(sourceId)}/oauth/${encodeURIComponent(credentialKey)}`,
+    { method: "PUT", body: JSON.stringify(input), signal },
+    fetcher,
+  );
+  if (!response.ok) return response;
+  return decodeResponse(response.value, decodeOAuthConnection);
+}
+
+export async function authorizeOAuthConnection(
+  sourceId: string,
+  credentialKey: string,
+  input: { readonly expectedRevision: number },
+  fetcher: Fetcher = fetch,
+  signal?: AbortSignal,
+): Promise<ApiResult<OAuthAuthorization>> {
+  const response = await request(
+    `/api/v1/sources/${encodeURIComponent(sourceId)}/oauth/${encodeURIComponent(credentialKey)}/authorize`,
+    { method: "POST", body: JSON.stringify(input), signal },
+    fetcher,
+  );
+  if (!response.ok) return response;
+  return decodeResponse(response.value, decodeOAuthAuthorization);
+}
+
+export async function disconnectOAuthConnection(
+  sourceId: string,
+  credentialKey: string,
+  input: { readonly expectedRevision: number },
+  fetcher: Fetcher = fetch,
+  signal?: AbortSignal,
+): Promise<ApiResult<OAuthConnectionSummary>> {
+  const response = await request(
+    `/api/v1/sources/${encodeURIComponent(sourceId)}/oauth/${encodeURIComponent(credentialKey)}/disconnect`,
+    { method: "POST", body: JSON.stringify(input), signal },
+    fetcher,
+  );
+  if (!response.ok) return response;
+  return decodeResponse(response.value, decodeOAuthConnection);
+}
+
+export async function deleteOAuthConnection(
+  sourceId: string,
+  credentialKey: string,
+  input: { readonly expectedRevision: number },
+  fetcher: Fetcher = fetch,
+  signal?: AbortSignal,
+): Promise<ApiResult<void>> {
+  const response = await request(
+    `/api/v1/sources/${encodeURIComponent(sourceId)}/oauth/${encodeURIComponent(credentialKey)}?expectedRevision=${encodeURIComponent(String(input.expectedRevision))}`,
+    { method: "DELETE", signal },
+    fetcher,
+  );
+  if (!response.ok) return response;
+  return { ok: true, value: undefined };
+}
+
+export async function putOpenApiCredentials(
+  sourceId: string,
+  expectedRevision: number,
+  schemes: Readonly<Record<string, OpenApiStaticCredential>>,
+  fetcher: Fetcher = fetch,
+  signal?: AbortSignal,
+) {
+  const response = await request(
+    `/api/v1/sources/${encodeURIComponent(sourceId)}/credentials`,
+    {
+      method: "PUT",
+      body: JSON.stringify({ expectedRevision, credential: { schemes } }),
+      signal,
+    },
+    fetcher,
+  );
+  if (!response.ok) return response;
+  return decodeResponse(response.value, decodeCredentialMetadata);
+}
+
+export async function deleteOpenApiCredentials(
+  sourceId: string,
+  expectedRevision: number,
+  fetcher: Fetcher = fetch,
+  signal?: AbortSignal,
+) {
+  const response = await request(
+    `/api/v1/sources/${encodeURIComponent(sourceId)}/credentials?expectedRevision=${encodeURIComponent(String(expectedRevision))}`,
+    { method: "DELETE", signal },
+    fetcher,
+  );
+  if (!response.ok) return response;
+  return decodeResponse(response.value, decodeCredentialMetadata);
+}
+
+async function putProtocolCredentials(
+  sourceId: string,
+  expectedRevision: number,
+  credential: McpHttpCredential | McpStdioCredential,
+  fetcher: Fetcher,
+  signal?: AbortSignal,
+) {
+  const response = await request(
+    `/api/v1/sources/${encodeURIComponent(sourceId)}/credentials`,
+    {
+      method: "PUT",
+      body: JSON.stringify({ expectedRevision, credential }),
+      signal,
+    },
+    fetcher,
+  );
+  if (!response.ok) return response;
+  return decodeResponse(response.value, decodeCredentialMetadata);
+}
+
+export type ToolListFilters = {
+  query?: string;
+  sourceId?: string;
+  mode?: ToolMode;
+  includeTombstoned?: boolean;
+  limit?: number;
+  offset?: number;
+};
+
+export async function listTools(
+  filters: ToolListFilters,
+  fetcher: Fetcher = fetch,
+  signal?: AbortSignal,
+) {
+  const parameters = new URLSearchParams();
+  if (filters.query) parameters.set("query", filters.query);
+  if (filters.sourceId) parameters.set("sourceId", filters.sourceId);
+  if (filters.mode) parameters.set("mode", filters.mode);
+  if (filters.includeTombstoned) parameters.set("includeTombstoned", "true");
+  if (filters.limit !== undefined) parameters.set("limit", String(filters.limit));
+  if (filters.offset !== undefined) parameters.set("offset", String(filters.offset));
+  const response = await request(`/api/v1/tools?${parameters}`, { signal }, fetcher);
+  if (!response.ok) return response;
+  return decodeResponse(response.value, decodeToolPage);
+}
+
+export async function getTool(toolId: string, fetcher: Fetcher = fetch, signal?: AbortSignal) {
+  const response = await request(
+    `/api/v1/tools/${encodeURIComponent(toolId)}`,
+    { signal },
+    fetcher,
+  );
+  if (!response.ok) return response;
+  return decodeResponse(response.value, decodeToolRecord);
+}
+
+export async function setToolMode(
+  toolId: string,
+  mode: ToolMode | null,
+  expectedRevision: number,
+  fetcher: Fetcher = fetch,
+  signal?: AbortSignal,
+) {
+  const response = await request(
+    `/api/v1/tools/${encodeURIComponent(toolId)}/mode`,
+    {
+      method: "PATCH",
+      body: JSON.stringify({ mode, expectedRevision }),
+      signal,
+    },
+    fetcher,
+  );
+  if (!response.ok) return response;
+  return decodeResponse(response.value, decodeToolRecord);
+}
+
+export async function bulkSetToolModes(
+  toolIds: readonly string[],
+  mode: ToolMode | null,
+  expectedCatalogRevision: number,
+  fetcher: Fetcher = fetch,
+  signal?: AbortSignal,
+) {
+  const response = await request(
+    "/api/v1/tools/modes",
+    {
+      method: "PATCH",
+      body: JSON.stringify({
+        selection: { type: "tool_ids", toolIds, expectedCatalogRevision },
+        mode,
+      }),
+      signal,
+    },
+    fetcher,
+  );
+  if (!response.ok) return response;
+  return decodeResponse(response.value, decodeBulkToolModeResult);
+}
+
+export async function listRequestLogs(
+  cursor: string | null,
+  fetcher: Fetcher = fetch,
+  signal?: AbortSignal,
+) {
+  const parameters = new URLSearchParams({ limit: "50" });
+  if (cursor) parameters.set("cursor", cursor);
+  const response = await request(`/api/v1/request-logs?${parameters}`, { signal }, fetcher);
+  if (!response.ok) return response;
+  return decodeResponse(response.value, decodeRequestLogPage);
+}
+
+export async function getRequestLog(
+  requestId: string,
+  fetcher: Fetcher = fetch,
+  signal?: AbortSignal,
+) {
+  const response = await request(
+    `/api/v1/request-logs/${encodeURIComponent(requestId)}`,
+    { signal },
+    fetcher,
+  );
+  if (!response.ok) return response;
+  return decodeResponse(response.value, decodeRequestLog);
+}
+
+export async function listApprovals(
+  filters: {
+    readonly status: ApprovalStatus | null;
+    readonly cursor: string | null;
+    readonly limit: number;
+  },
+  fetcher: Fetcher = fetch,
+  signal?: AbortSignal,
+) {
+  const parameters = new URLSearchParams({ limit: String(filters.limit) });
+  if (filters.status !== null) parameters.set("status", filters.status);
+  if (filters.cursor !== null) parameters.set("cursor", filters.cursor);
+  const response = await request(`/api/v1/approvals?${parameters}`, { signal }, fetcher);
+  if (!response.ok) return response;
+  return decodeResponse(response.value, decodeApprovalPage);
+}
+
+export async function getApproval(
+  approvalId: string,
+  fetcher: Fetcher = fetch,
+  signal?: AbortSignal,
+) {
+  const response = await request(
+    `/api/v1/approvals/${encodeURIComponent(approvalId)}`,
+    { signal },
+    fetcher,
+  );
+  if (!response.ok) return response;
+  return decodeResponse(response.value, decodeApprovalDetail);
+}
+
+export async function decideApproval(
+  approvalId: string,
+  decision: ApprovalDecision,
+  expectedRevision: number,
+  fetcher: Fetcher = fetch,
+  signal?: AbortSignal,
+) {
+  const response = await request(
+    `/api/v1/approvals/${encodeURIComponent(approvalId)}/decision`,
+    {
+      method: "POST",
+      body: JSON.stringify({ decision, expectedRevision }),
+      signal,
+    },
+    fetcher,
+  );
+  if (!response.ok) return response;
+  return decodeResponse(response.value, decodeApprovalDetail);
+}
+
+async function tokenCreateRequest(
+  name: string,
+  idempotencyKey: string,
+  fetcher: Fetcher,
+  signal?: AbortSignal,
+): Promise<TokenCreateApiResult> {
+  const headers = new Headers({
+    accept: "application/json",
+    "content-type": "application/json",
+    "Idempotency-Key": idempotencyKey,
+  });
+  const csrfToken = readCookie("executor_csrf");
+  if (csrfToken !== null) headers.set("x-executor-csrf", csrfToken);
+
+  const fetched = await fetcher("/api/v1/tokens", {
+    method: "POST",
+    body: JSON.stringify({ name }),
+    headers,
+    credentials: "same-origin",
+    cache: "no-store",
+    signal,
+  }).then(
+    (response) => ({ ok: true, response }) as const,
+    () => ({ ok: false }) as const,
+  );
+  if (!fetched.ok) {
+    return tokenCreateResult(
+      failure(
+        signal?.aborted ? "request_cancelled" : "network_error",
+        signal?.aborted
+          ? "The request was cancelled."
+          : "Executor could not be reached. Check that the local server is running.",
+        null,
+        0,
+      ),
+      { replayProvenance: "none", responseDisposition: "ambiguous" },
+    );
+  }
+
+  const { response } = fetched;
+  const requestId = response.headers.get("x-request-id");
+  const body = await response.text().then(
+    (text) => ({ ok: true, text }) as const,
+    () => ({ ok: false }) as const,
+  );
+  if (!body.ok) {
+    return tokenCreateResult(
+      invalidTokenCreateResponse(requestId),
+      tokenCreateResponseMetadata(response, "failure", false),
+    );
+  }
+
+  if (response.ok) {
+    const decoded = decodeResponse({ text: body.text, requestId }, decodeCreatedToken);
+    const bodyValid = decoded.ok && validCreatedToken(decoded.value, name);
+    const metadata = tokenCreateResponseMetadata(response, "success", bodyValid);
+    return bodyValid && metadata.responseDisposition === "authoritative"
+      ? tokenCreateResult(decoded, metadata)
+      : tokenCreateResult(invalidTokenCreateResponse(requestId), metadata);
+  }
+
+  const decodedEnvelope = decodeErrorEnvelope(body.text);
+  const metadata = tokenCreateResponseMetadata(response, "failure", Option.isSome(decodedEnvelope));
+  return tokenCreateContractValid(response, "failure", Option.isSome(decodedEnvelope))
+    ? tokenCreateResult(decodeError(body.text, requestId, response.status), metadata)
+    : tokenCreateResult(invalidTokenCreateResponse(requestId), metadata);
+}
+
+function tokenCreateResult(
+  result: ApiResult<CreatedToken>,
+  metadata: Pick<TokenCreateApiResult, "replayProvenance" | "responseDisposition">,
+): TokenCreateApiResult {
+  return result.ok ? { ...result, ...metadata } : { ...result, ...metadata };
+}
+
+function tokenCreateResponseMetadata(
+  response: Response,
+  outcome: "success" | "failure",
+  bodyValid: boolean,
+): Pick<TokenCreateApiResult, "replayProvenance" | "responseDisposition"> {
+  const replayed = response.headers.get("idempotency-replayed");
+  const replayProvenance =
+    replayed === null ? "none" : replayed === "true" ? "authoritative" : "invalid";
+  const responseDisposition =
+    tokenCreateContractValid(response, outcome, bodyValid) &&
+    (outcome === "success" || replayProvenance === "authoritative" || response.status < 500)
+      ? "authoritative"
+      : "ambiguous";
+  return { replayProvenance, responseDisposition };
+}
+
+function tokenCreateContractValid(
+  response: Response,
+  outcome: "success" | "failure",
+  bodyValid: boolean,
+) {
+  const replayed = response.headers.get("idempotency-replayed");
+  const statusValid =
+    outcome === "success"
+      ? response.status === 201
+      : response.status >= 400 && response.status <= 599;
+  return (
+    bodyValid &&
+    statusValid &&
+    hasJsonContentType(response.headers.get("content-type")) &&
+    hasNoStoreDirective(response.headers.get("cache-control")) &&
+    (replayed === null || replayed === "true")
+  );
+}
+
+function invalidTokenCreateResponse(requestId: string | null) {
+  return failure(
+    "invalid_response",
+    "Executor returned a token creation response the dashboard could not safely use.",
+    requestId,
+    502,
+  );
+}
+
+function hasJsonContentType(value: string | null) {
+  return value?.split(";", 1)[0]?.trim().toLowerCase() === "application/json";
+}
+
+function validCreatedToken(token: CreatedToken, expectedName: string) {
+  return (
+    token.id === token.id.trim() &&
+    token.id.length > 0 &&
+    token.id.length <= 128 &&
+    token.name === expectedName &&
+    /^exr_[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/.test(token.token) &&
+    Number.isSafeInteger(token.createdAt) &&
+    token.createdAt >= 0
+  );
+}
+
+function isAmbiguousRevokeResult(result: ApiResult<unknown>) {
+  if (result.ok) return false;
+  if (
+    ["network_error", "invalid_response", "unexpected_client_error"].includes(result.error.code)
+  ) {
+    return true;
+  }
+  return result.error.status >= 500;
+}
+
+async function sourceCreateRequest(
+  input: OpenApiSourceInput | GraphqlSourceInput | McpHttpSourceInput | McpStdioSourceInput,
+  idempotencyKey: string,
+  fetcher: Fetcher,
+  signal?: AbortSignal,
+) {
+  const headers = new Headers({
+    accept: "application/json",
+    "content-type": "application/json",
+    "Idempotency-Key": idempotencyKey,
+  });
+  const csrfToken = readCookie("executor_csrf");
+  if (csrfToken !== null) headers.set("x-executor-csrf", csrfToken);
+
+  const fetched = await fetcher("/api/v1/sources", {
+    method: "POST",
+    body: JSON.stringify(input),
+    headers,
+    credentials: "same-origin",
+    signal,
+  }).then(
+    (response) => ({ ok: true, response }) as const,
+    () => ({ ok: false }) as const,
+  );
+  if (!fetched.ok) {
+    return sourceCreateResult(
+      failure(
+        signal?.aborted ? "request_cancelled" : "network_error",
+        signal?.aborted
+          ? "The request was cancelled."
+          : "Executor could not be reached. Check that the local server is running.",
+        null,
+        0,
+      ),
+      { replayProvenance: "none", responseDisposition: "ambiguous" },
+    );
+  }
+
+  const { response } = fetched;
+  const requestId = response.headers.get("x-request-id");
+  const body = await response.text().then(
+    (text) => ({ ok: true, text }) as const,
+    () => ({ ok: false }) as const,
+  );
+  if (!body.ok) {
+    return sourceCreateResult(
+      failure(
+        "invalid_response",
+        "Executor returned a response body the dashboard could not read.",
+        requestId,
+        502,
+      ),
+      sourceCreateResponseMetadata(response, "failure", false),
+    );
+  }
+  if (response.ok) {
+    const decoded = decodeResponse({ text: body.text, requestId }, decodeSource);
+    return sourceCreateResult(
+      decoded,
+      sourceCreateResponseMetadata(response, "success", decoded.ok),
+    );
+  }
+  const decodedError = decodeErrorEnvelope(body.text);
+  return sourceCreateResult(
+    decodeError(body.text, requestId, response.status),
+    sourceCreateResponseMetadata(response, "failure", Option.isSome(decodedError)),
+  );
+}
+
+function sourceCreateResult(
+  result: ApiResult<Source>,
+  metadata: Pick<SourceCreateApiResult, "replayProvenance" | "responseDisposition">,
+): SourceCreateApiResult {
+  return result.ok ? { ...result, ...metadata } : { ...result, ...metadata };
+}
+
+function sourceCreateResponseMetadata(
+  response: Response,
+  outcome: "success" | "failure",
+  bodyValid: boolean,
+) {
+  const replayed = response.headers.get("idempotency-replayed");
+  if (replayed === null) {
+    return isAuthoritativeSourceCreationResponse(response, "fresh", outcome, bodyValid)
+      ? ({ replayProvenance: "none", responseDisposition: "authoritative" } as const)
+      : ({ replayProvenance: "none", responseDisposition: "ambiguous" } as const);
+  }
+  return isAuthoritativeSourceCreationResponse(response, "replay", outcome, bodyValid)
+    ? ({ replayProvenance: "authoritative", responseDisposition: "authoritative" } as const)
+    : ({ replayProvenance: "invalid", responseDisposition: "ambiguous" } as const);
+}
+
+function isAuthoritativeSourceCreationResponse(
+  response: Pick<Response, "headers" | "status">,
+  origin: "fresh" | "replay",
+  outcome: "success" | "failure",
+  bodyValid: boolean,
+) {
+  const statusValid =
+    outcome === "success"
+      ? response.status === 201
+      : response.status >= 400 && response.status <= (origin === "fresh" ? 499 : 599);
+  const replayHeader = response.headers.get("idempotency-replayed");
+  return (
+    bodyValid &&
+    statusValid &&
+    (origin === "fresh" ? replayHeader === null : replayHeader === "true") &&
+    hasNoStoreDirective(response.headers.get("cache-control"))
+  );
+}
+
+async function sourceCreationResolutionRequest(
+  path: string,
+  method: "GET" | "POST",
+  idempotencyKey: string,
+  fetcher: Fetcher,
+  signal?: AbortSignal,
+) {
+  const headers = new Headers({
+    accept: "application/json",
+    "Idempotency-Key": idempotencyKey,
+  });
+  if (method === "POST") {
+    const csrfToken = readCookie("executor_csrf");
+    if (csrfToken !== null) headers.set("x-executor-csrf", csrfToken);
+  }
+  const fetched = await fetcher(path, {
+    method,
+    headers,
+    credentials: "same-origin",
+    cache: "no-store",
+    signal,
+  }).then(
+    (response) => ({ ok: true, response }) as const,
+    () => ({ ok: false }) as const,
+  );
+  if (!fetched.ok) {
+    return failure(
+      signal?.aborted ? "request_cancelled" : "network_error",
+      signal?.aborted
+        ? "The request was cancelled."
+        : "Executor could not be reached. Check that the local server is running.",
+      null,
+      0,
+    );
+  }
+
+  const { response } = fetched;
+  const requestId = response.headers.get("x-request-id");
+  const body = await response.text().then(
+    (text) => ({ ok: true, text }) as const,
+    () => ({ ok: false }) as const,
+  );
+  if (!body.ok) return invalidSourceCreationResolution(requestId);
+  if (!hasNoStoreDirective(response.headers.get("cache-control"))) {
+    return invalidSourceCreationResolution(requestId);
+  }
+
+  const replayed = response.headers.get("idempotency-replayed");
+  if (replayed !== null && replayed !== "true") {
+    return invalidSourceCreationResolution(requestId);
+  }
+  if (replayed === "true") {
+    if (response.status === 201) {
+      const decoded = decodeResponse({ text: body.text, requestId }, decodeSource);
+      if (
+        !decoded.ok ||
+        !isAuthoritativeSourceCreationResponse(response, "replay", "success", true)
+      ) {
+        return invalidSourceCreationResolution(requestId);
+      }
+      return {
+        ok: true,
+        value: { kind: "replay", result: decoded } as const,
+      } as const;
+    }
+    const decoded = decodeErrorEnvelope(body.text);
+    if (
+      Option.isNone(decoded) ||
+      !isAuthoritativeSourceCreationResponse(response, "replay", "failure", true)
+    ) {
+      return invalidSourceCreationResolution(requestId);
+    }
+    return {
+      ok: true,
+      value: {
+        kind: "replay",
+        result: failure(
+          decoded.value.error.code,
+          decoded.value.error.message,
+          decoded.value.error.requestId || requestId,
+          response.status,
+        ),
+      } as const,
+    } as const;
+  }
+
+  if (response.ok) {
+    if (response.status !== 200) return invalidSourceCreationResolution(requestId);
+    const decoded = decodeResponse({ text: body.text, requestId }, decodeSourceCreationStatus);
+    if (!decoded.ok) return decoded;
+    return {
+      ok: true,
+      value: { kind: "status", status: decoded.value.status } as const,
+    } as const;
+  }
+
+  const decoded = decodeErrorEnvelope(body.text);
+  if (Option.isNone(decoded)) return invalidSourceCreationResolution(requestId);
+  const error = failure(
+    decoded.value.error.code,
+    decoded.value.error.message,
+    decoded.value.error.requestId || requestId,
+    response.status,
+  );
+  if (
+    method === "POST" &&
+    response.status === 409 &&
+    decoded.value.error.code === "idempotency_in_progress"
+  ) {
+    const retryAfter = response.headers.get("retry-after");
+    if (retryAfter === null || !/^\d+$/.test(retryAfter) || Number(retryAfter) < 1) {
+      return invalidSourceCreationResolution(requestId);
+    }
+    return {
+      ok: true,
+      value: { kind: "status", status: "in_progress" } as const,
+    } as const;
+  }
+  if (method === "POST") {
+    const status = sourceCreationTerminalStatus(decoded.value.error.code);
+    const expectedStatus = status === "expired_unknown" ? 410 : 409;
+    if (status !== null && response.status === expectedStatus) {
+      return { ok: true, value: { kind: "status", status } as const } as const;
+    }
+  }
+  return error;
+}
+
+function sourceCreationTerminalStatus(code: string): SourceCreationStatus | null {
+  if (code === "idempotency_abandoned") return "abandoned";
+  if (code === "idempotency_interrupted") return "interrupted";
+  if (code === "idempotency_expired_unknown") return "expired_unknown";
+  return null;
+}
+
+function invalidSourceCreationResolution(requestId: string | null) {
+  return failure(
+    "invalid_response",
+    "Executor returned an idempotency status the dashboard could not understand.",
+    requestId,
+    502,
+  );
+}
+
+function hasNoStoreDirective(value: string | null) {
+  return (
+    value?.split(",").some((directive) => directive.trim().toLowerCase() === "no-store") ?? false
+  );
+}
+
+async function request(path: string, init: RequestInit, fetcher: Fetcher, includeCsrf = true) {
+  if (!path.startsWith("/api/")) {
+    return failure(
+      "invalid_request_path",
+      "The dashboard only sends requests to this Executor instance.",
+      null,
+      0,
+    );
+  }
+
+  const headers = new Headers(init.headers);
+  headers.set("accept", "application/json");
+  if (init.body !== undefined) headers.set("content-type", "application/json");
+  if (includeCsrf && isUnsafeMethod(init.method)) {
+    const csrfToken = readCookie("executor_csrf");
+    if (csrfToken !== null) headers.set("x-executor-csrf", csrfToken);
+  }
+
+  const fetched = await fetcher(path, {
+    ...init,
+    headers,
+    credentials: "same-origin",
+  }).then(
+    (response) => ({ ok: true, response }) as const,
+    () => ({ ok: false }) as const,
+  );
+
+  if (!fetched.ok) {
+    return failure(
+      init.signal?.aborted ? "request_cancelled" : "network_error",
+      init.signal?.aborted
+        ? "The request was cancelled."
+        : "Executor could not be reached. Check that the local server is running.",
+      null,
+      0,
+    );
+  }
+
+  const { response } = fetched;
+  const requestId = response.headers.get("x-request-id");
+  const body = await response.text().then(
+    (text) => ({ ok: true, text }) as const,
+    () => ({ ok: false }) as const,
+  );
+  if (!body.ok) {
+    return failure(
+      "invalid_response",
+      "Executor returned a response body the dashboard could not read.",
+      requestId,
+      502,
+    );
+  }
+
+  if (!response.ok) return decodeError(body.text, requestId, response.status);
+  return { ok: true, value: { text: body.text, requestId } } as const;
+}
+
+function decodeResponse<Value>(
+  response: ResponsePayload,
+  decoder: (text: string) => Option.Option<Value>,
+): ApiResult<Value> {
+  const decoded = decoder(response.text);
+  if (Option.isNone(decoded)) {
+    return failure(
+      "invalid_response",
+      "Executor returned a response the dashboard could not understand.",
+      response.requestId,
+      502,
+    );
+  }
+  return { ok: true, value: decoded.value };
+}
+
+function decodeError(text: string, headerRequestId: string | null, status: number) {
+  const decoded = decodeErrorEnvelope(text);
+  if (Option.isNone(decoded)) {
+    return failure(`http_${status}`, fallbackStatusMessage(status), headerRequestId, status);
+  }
+
+  return failure(
+    decoded.value.error.code,
+    decoded.value.error.message,
+    decoded.value.error.requestId || headerRequestId,
+    status,
+  );
+}
+
+function failure(code: string, displayMessage: string, requestId: string | null, status: number) {
+  return {
+    ok: false,
+    error: new ApiError({ code, displayMessage, requestId, status }),
+  } as const;
+}
+
+function fallbackStatusMessage(status: number) {
+  if (status === 401) return "Your administrator session is no longer valid.";
+  if (status === 403) return "Executor rejected this request.";
+  if (status === 404) return "The requested Executor resource does not exist.";
+  if (status >= 500) return "Executor could not complete the request.";
+  return `Executor rejected the request with status ${status}.`;
+}
+
+function isUnsafeMethod(method: string | undefined) {
+  return method !== undefined && !["GET", "HEAD", "OPTIONS"].includes(method.toUpperCase());
+}
+
+function readCookie(name: string) {
+  if (typeof document === "undefined") return null;
+  for (const part of document.cookie.split(";")) {
+    const [cookieName, ...valueParts] = part.trim().split("=");
+    if (cookieName === name) return valueParts.join("=");
+  }
+  return null;
+}
+
+function sanitizeDecodedSource(decoded: Option.Option<Source>) {
+  return Option.isNone(decoded) ? decoded : Option.some(sanitizeSource(decoded.value));
+}
+
+function sanitizeSource(source: Source): Source {
+  const endpoint = source.configuration.endpoint;
+  return {
+    ...source,
+    configuration: {
+      ...(endpoint === undefined ? {} : publicEndpoint(endpoint)),
+      ...(source.configuration.allowPrivateNetwork === undefined
+        ? {}
+        : { allowPrivateNetwork: source.configuration.allowPrivateNetwork }),
+      ...(source.configuration.templateName === undefined
+        ? {}
+        : { templateName: source.configuration.templateName }),
+      ...(source.configuration.negotiatedProtocolVersion === undefined
+        ? {}
+        : { negotiatedProtocolVersion: source.configuration.negotiatedProtocolVersion }),
+    },
+  };
+}
+
+function publicEndpoint(endpoint: string) {
+  if (!URL.canParse(endpoint)) return {};
+  const url = new URL(endpoint);
+  if (url.protocol !== "http:" && url.protocol !== "https:") return {};
+  return { endpoint: url.origin };
+}
diff --git a/web/src/lib/approval-state.test.ts b/web/src/lib/approval-state.test.ts
new file mode 100644
index 000000000..5d5043674
--- /dev/null
+++ b/web/src/lib/approval-state.test.ts
@@ -0,0 +1,152 @@
+import { describe, expect, it } from "@effect/vitest";
+import type { ApprovalDetail } from "$lib/api";
+import {
+  approvalCountdown,
+  approvalDecisionCopy,
+  approvalStatusLabel,
+  canDecideApproval,
+  createApprovalPoller,
+  decisionResultScope,
+  focusTargetAfterDecision,
+} from "./approval-state";
+
+function fixture(overrides: Partial<ApprovalDetail> = {}): ApprovalDetail {
+  return {
+    id: "approval-1",
+    status: "pending",
+    revision: 4,
+    createdAt: 100,
+    updatedAt: 101,
+    expiresAt: 200,
+    decidedAt: null,
+    completedAt: null,
+    sourceId: "source-1",
+    toolId: "tool-1",
+    path: "tools.github.create_issue",
+    sourceDisplayName: "GitHub",
+    toolDisplayName: "Create issue",
+    actorKind: "api_token",
+    actorId: "token-1",
+    actorName: "Laptop",
+    actorLabel: "Laptop",
+    actorApiTokenId: "token-1",
+    actorTokenName: "Laptop",
+    surface: "gateway",
+    mode: "ask",
+    provenance: "tool_override",
+    executionId: "execution-1",
+    callId: "call-1",
+    redactedArguments: { title: "Safe title", token: "[REDACTED]" },
+    inputSchema: { type: "object" },
+    failureCode: null,
+    startedAt: null,
+    decision: null,
+    ...overrides,
+  };
+}
+
+describe("approval UI state", () => {
+  it("labels every terminal and uncertain state honestly", () => {
+    expect(approvalStatusLabel("stale")).toBe("Stale");
+    expect(approvalStatusLabel("interrupted")).toBe("Interrupted");
+    expect(approvalStatusLabel("canceled")).toBe("Canceled");
+  });
+
+  it("only permits decisions while the approval is pending and unexpired", () => {
+    expect(canDecideApproval(fixture(), 150_000)).toBe(true);
+    expect(canDecideApproval(fixture({ status: "approved" }), 150_000)).toBe(false);
+    expect(canDecideApproval(fixture({ status: "stale" }), 150_000)).toBe(false);
+    expect(canDecideApproval(fixture(), 200_000)).toBe(false);
+  });
+
+  it("computes countdown text with an injected clock", () => {
+    expect(approvalCountdown(200, 150_000)).toBe("50s remaining");
+    expect(approvalCountdown(250, 150_000)).toBe("2m remaining");
+    expect(approvalCountdown(150, 150_000)).toBe("Expired");
+  });
+
+  it("restates the tool and side-effect boundary in confirmations", () => {
+    expect(approvalDecisionCopy(fixture(), "approve")).toContain(
+      "stored original arguments, including values hidden from this structural preview",
+    );
+    expect(approvalDecisionCopy(fixture(), "approve")).toContain(
+      "This may cause side effects in GitHub.",
+    );
+    expect(approvalDecisionCopy(fixture(), "deny")).toContain("waiting caller will not run");
+  });
+
+  it("uses safe confirmation fallbacks when snapshot names are unavailable", () => {
+    const approval = fixture({
+      sourceDisplayName: null,
+      toolDisplayName: null,
+    });
+    expect(approvalDecisionCopy(approval, "approve")).toContain(
+      "Approve one execution of tools.github.create_issue?",
+    );
+    expect(approvalDecisionCopy(approval, "approve")).toContain("the connected source");
+  });
+
+  it("chooses a stable focus target after a decision removes a pending row", () => {
+    const first = fixture();
+    const second = fixture({ id: "approval-2" });
+    const third = fixture({ id: "approval-3" });
+    expect(focusTargetAfterDecision([first, second, third], second.id)).toBe(
+      "inspect-approval-approval-3",
+    );
+    expect(focusTargetAfterDecision([first], first.id)).toBe("approvals-heading");
+  });
+
+  it("rejects a late decision result for a newer detail or list identity", () => {
+    expect(
+      decisionResultScope({
+        submittedApprovalId: "approval-a",
+        submittedListKey: "pending:first",
+        currentApprovalId: "approval-b",
+        currentListKey: "pending:first",
+      }),
+    ).toEqual({ sameDetail: false, sameList: true });
+    expect(
+      decisionResultScope({
+        submittedApprovalId: "approval-a",
+        submittedListKey: "pending:first",
+        currentApprovalId: "approval-a",
+        currentListKey: "denied:first",
+      }),
+    ).toEqual({ sameDetail: true, sameList: false });
+  });
+
+  it("polls only completed resources and cancels the scheduled retry on disposal", () => {
+    let listLoading = true;
+    let detailLoading = true;
+    let listRefreshes = 0;
+    let detailRefreshes = 0;
+    let nextHandle = 0;
+    const scheduled = new Map<number, () => void>();
+    const canceled: number[] = [];
+    const dispose = createApprovalPoller({
+      schedule: (callback) => {
+        const handle = ++nextHandle;
+        scheduled.set(handle, callback);
+        return handle;
+      },
+      cancel: (handle) => canceled.push(handle),
+      isVisible: () => true,
+      isListLoading: () => listLoading,
+      hasDetail: () => true,
+      isDetailLoading: () => detailLoading,
+      refreshList: () => (listRefreshes += 1),
+      refreshDetail: () => (detailRefreshes += 1),
+    });
+
+    scheduled.get(1)?.();
+    expect([listRefreshes, detailRefreshes]).toEqual([0, 0]);
+    listLoading = false;
+    detailLoading = false;
+    scheduled.get(2)?.();
+    expect([listRefreshes, detailRefreshes]).toEqual([1, 1]);
+    dispose();
+    expect(canceled).toEqual([3]);
+    scheduled.get(3)?.();
+    expect([listRefreshes, detailRefreshes]).toEqual([1, 1]);
+  });
+});
diff --git a/web/src/lib/approval-state.ts b/web/src/lib/approval-state.ts
new file mode 100644
index 000000000..95295ea70
--- /dev/null
+++ b/web/src/lib/approval-state.ts
@@ -0,0 +1,89 @@
+import type { ApprovalDecision, ApprovalDetail, ApprovalStatus, ApprovalSummary } from "$lib/api";
+
+export const approvalStatuses = [
+  "pending",
+  "approved",
+  "executing",
+  "succeeded",
+  "failed",
+  "denied",
+  "expired",
+  "canceled",
+  "stale",
+  "interrupted",
+] as const satisfies readonly ApprovalStatus[];
+
+export function approvalStatusLabel(status: ApprovalStatus) {
+  return `${status[0].toUpperCase()}${status.slice(1)}`;
+}
+
+export function canDecideApproval(approval: ApprovalSummary, now: number) {
+  return approval.status === "pending" && approval.expiresAt > Math.floor(now / 1000);
+}
+
+export function approvalCountdown(expiresAt: number, now: number) {
+  const remaining = expiresAt - Math.floor(now / 1000);
+  if (remaining <= 0) return "Expired";
+  if (remaining < 60) return `${remaining}s remaining`;
+  const minutes = Math.ceil(remaining / 60);
+  return `${minutes}m remaining`;
+}
+
+export function approvalDecisionCopy(approval: ApprovalDetail, decision: ApprovalDecision) {
+  const tool = approval.toolDisplayName ?? approval.path;
+  const source = approval.sourceDisplayName ?? "the connected source";
+  if (decision === "approve") {
+    return `Approve one execution of ${tool}? Executor will use the stored original arguments, including values hidden from this structural preview. This may cause side effects in ${source}.`;
+  }
+  return `Deny this execution of ${tool}? The waiting caller will not run this request.`;
+}
+
+export function focusTargetAfterDecision(items: readonly ApprovalSummary[], approvalId: string) {
+  const index = items.findIndex((approval) => approval.id === approvalId);
+  const next = items[index + 1] ?? items[index - 1];
+  return next === undefined ? "approvals-heading" : `inspect-approval-${next.id}`;
+}
+
+export function decisionResultScope(input: {
+  readonly submittedApprovalId: string;
+  readonly submittedListKey: string;
+  readonly currentApprovalId: string | null;
+  readonly currentListKey: string;
+}) {
+  return {
+    sameDetail: input.currentApprovalId === input.submittedApprovalId,
+    sameList: input.currentListKey === input.submittedListKey,
+  };
+}
+
+export function createApprovalPoller(
+  options: {
+    readonly schedule: (callback: () => void, delay: number) => number;
+    readonly cancel: (handle: number) => void;
+    readonly isVisible: () => boolean;
+    readonly isListLoading: () => boolean;
+    readonly hasDetail: () => boolean;
+    readonly isDetailLoading: () => boolean;
+    readonly refreshList: () => void;
+    readonly refreshDetail: () => void;
+  },
+  interval = 5_000,
+) {
+  let disposed = false;
+  let handle = 0;
+
+  function poll() {
+    if (disposed) return;
+    if (options.isVisible()) {
+      if (!options.isListLoading()) options.refreshList();
+      if (options.hasDetail() && !options.isDetailLoading()) options.refreshDetail();
+    }
+    handle = options.schedule(poll, interval);
+  }
+
+  handle = options.schedule(poll, interval);
+  return () => {
+    disposed = true;
+    options.cancel(handle);
+  };
+}
diff --git a/web/src/lib/approval-url.test.ts b/web/src/lib/approval-url.test.ts
new file mode 100644
index 000000000..8ef839fa8
--- /dev/null
+++ b/web/src/lib/approval-url.test.ts
@@ -0,0 +1,54 @@
+import { describe, expect, it } from "@effect/vitest";
+import { approvalsListKey, approvalsUrl, parseApprovalsUrl } from "./approval-url";
+
+describe("approval URL state", () => {
+  it("defaults invalid and missing status filters to pending", () => {
+    expect(parseApprovalsUrl(new URLSearchParams())).toEqual({
+      status: "pending",
+      cursor: null,
+      approval: null,
+    });
+    expect(parseApprovalsUrl(new URLSearchParams("status=surprise&cursor=&approval="))).toEqual({
+      status: "pending",
+      cursor: null,
+      approval: null,
+    });
+    expect(parseApprovalsUrl(new URLSearchParams("status=active"))).toEqual({
+      status: "pending",
+      cursor: null,
+      approval: null,
+    });
+  });
+
+  it("keeps status, pagination, and detail selection bookmarkable", () => {
+    const state = parseApprovalsUrl(
+      new URLSearchParams("status=denied&cursor=older-page&approval=approval-1"),
+    );
+
+    expect(state).toEqual({
+      status: "denied",
+      cursor: "older-page",
+      approval: "approval-1",
+    });
+    expect(approvalsUrl(state, { approval: null })).toBe(
+      "/approvals?status=denied&cursor=older-page",
+    );
+    expect(approvalsUrl(state, { status: "pending", cursor: null })).toBe(
+      "/approvals?approval=approval-1",
+    );
+  });
+
+  it("excludes detail selection from the list request identity", () => {
+    const first = parseApprovalsUrl(
+      new URLSearchParams("status=failed&cursor=older&approval=approval-a"),
+    );
+    const second = parseApprovalsUrl(
+      new URLSearchParams("status=failed&cursor=older&approval=approval-b"),
+    );
+
+    expect(approvalsListKey(first)).toBe(approvalsListKey(second));
+    expect(approvalsListKey(first)).not.toBe(
+      approvalsListKey({ status: "pending", cursor: "older", approval: "approval-a" }),
+    );
+  });
+});
diff --git a/web/src/lib/approval-url.ts b/web/src/lib/approval-url.ts
new file mode 100644
index 000000000..2aa6c080c
--- /dev/null
+++ b/web/src/lib/approval-url.ts
@@ -0,0 +1,53 @@
+import type { ApprovalStatus } from "$lib/api";
+
+const statuses = new Set<ApprovalStatus>([
+  "pending",
+  "approved",
+  "executing",
+  "succeeded",
+  "failed",
+  "denied",
+  "expired",
+  "canceled",
+  "stale",
+  "interrupted",
+]);
+
+export type ApprovalStatusFilter = ApprovalStatus | "all";
+
+export type ApprovalsUrlState = {
+  readonly status: ApprovalStatusFilter;
+  readonly cursor: string | null;
+  readonly approval: string | null;
+};
+
+export function parseApprovalsUrl(parameters: URLSearchParams): ApprovalsUrlState {
+  const rawStatus = parameters.get("status");
+  return {
+    status: rawStatus === "all" || isApprovalStatus(rawStatus) ? rawStatus : "pending",
+    cursor: nonEmpty(parameters.get("cursor")),
+    approval: nonEmpty(parameters.get("approval")),
+  };
+}
+
+export function approvalsUrl(state: ApprovalsUrlState, updates: Partial<ApprovalsUrlState> = {}) {
+  const next = { ...state, ...updates };
+  const parameters = new URLSearchParams();
+  if (next.status !== "pending") parameters.set("status", next.status);
+  if (next.cursor) parameters.set("cursor", next.cursor);
+  if (next.approval) parameters.set("approval", next.approval);
+  const search = parameters.toString();
+  return search ? `/approvals?${search}` : "/approvals";
+}
+
+export function approvalsListKey(state: ApprovalsUrlState) {
+  return JSON.stringify([state.status, state.cursor]);
+}
+
+function isApprovalStatus(value: string | null): value is ApprovalStatus {
+  return value !== null && statuses.has(value as ApprovalStatus);
+}
+
+function nonEmpty(value: string | null) {
+  return value === null || value === "" ? null : value;
+}
diff --git a/web/src/lib/assets/favicon.svg b/web/src/lib/assets/favicon.svg
new file mode 100644
index 000000000..7a5796457
--- /dev/null
+++ b/web/src/lib/assets/favicon.svg
@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Executor</title>
+  <rect width="64" height="64" rx="16" fill="#121824"/>
+  <path d="M17 18h30v8H25v8h18v8H25v4h22v8H17z" fill="#91a0ff"/>
+  <circle cx="47" cy="22" r="5" fill="#55d6a5"/>
+</svg>
diff --git a/web/src/lib/auth.svelte.ts b/web/src/lib/auth.svelte.ts
new file mode 100644
index 000000000..005ae4abd
--- /dev/null
+++ b/web/src/lib/auth.svelte.ts
@@ -0,0 +1,196 @@
+import { getContext, setContext } from "svelte";
+import {
+  getBootstrap,
+  getSession,
+  loginAdmin,
+  logoutAdmin,
+  setupAdmin,
+  type ApiError,
+} from "$lib/api";
+
+const authContext = Symbol("executor-auth");
+
+export function createAuthState() {
+  let phase = $state<"loading" | "ready" | "error">("loading");
+  let setupRequired = $state(false);
+  let authenticated = $state(false);
+  let username = $state<string | null>(null);
+  let error = $state<ApiError | null>(null);
+  let notice = $state<string | null>(null);
+  let refreshGeneration = 0;
+  let mutationGeneration = 0;
+
+  async function refresh(signal?: AbortSignal) {
+    const mine = ++refreshGeneration;
+    phase = "loading";
+    error = null;
+
+    const bootstrap = await getBootstrap(undefined, signal);
+    if (mine !== refreshGeneration || signal?.aborted) return;
+    if (!bootstrap.ok) {
+      if (recoverFromApiError(bootstrap.error)) return;
+      error = bootstrap.error;
+      phase = "error";
+      return;
+    }
+
+    let nextUsername: string | null = null;
+
+    if (bootstrap.value.authenticated) {
+      const session = await getSession(undefined, signal);
+      if (mine !== refreshGeneration || signal?.aborted) return;
+      if (!session.ok) {
+        if (recoverFromApiError(session.error)) return;
+        error = session.error;
+        phase = "error";
+        return;
+      }
+      nextUsername = session.value.username;
+    }
+
+    if (mine !== refreshGeneration || signal?.aborted) return;
+    setupRequired = bootstrap.value.setupRequired;
+    authenticated = bootstrap.value.authenticated;
+    username = nextUsername;
+    phase = "ready";
+  }
+
+  async function signIn(input: { username: string; password: string }) {
+    const mine = beginMutation();
+    const session = await loginAdmin(input);
+    settleMutation();
+    if (mine !== mutationGeneration) return session;
+    if (!session.ok) return session;
+    setupRequired = false;
+    authenticated = true;
+    username = session.value.username;
+    notice = null;
+    error = null;
+    phase = "ready";
+    return session;
+  }
+
+  async function completeSetup(input: { setupToken: string; username: string; password: string }) {
+    const mine = beginMutation();
+    const setup = await setupAdmin(input);
+    if (mine !== mutationGeneration) {
+      settleMutation();
+      return setup;
+    }
+    if (!setup.ok) {
+      settleMutation();
+      return setup;
+    }
+
+    const login = await loginAdmin({ username: input.username, password: input.password });
+    settleMutation();
+    if (mine !== mutationGeneration) return login;
+    if (!login.ok) {
+      setupRequired = false;
+      authenticated = false;
+      username = null;
+      notice =
+        "Your administrator was created, but automatic sign-in failed. Sign in with the credentials you just chose.";
+      error = null;
+      phase = "ready";
+      return login;
+    }
+
+    setupRequired = false;
+    authenticated = true;
+    username = login.value.username;
+    notice = null;
+    error = null;
+    phase = "ready";
+    return login;
+  }
+
+  async function signOut() {
+    const mine = beginMutation();
+    const logout = await logoutAdmin();
+    settleMutation();
+    if (mine !== mutationGeneration) return logout;
+    if (!logout.ok) {
+      recoverFromApiError(logout.error);
+      return logout;
+    }
+    authenticated = false;
+    username = null;
+    notice = null;
+    return logout;
+  }
+
+  function recoverFromApiError(apiError: ApiError) {
+    if (apiError.status !== 401 && apiError.code !== "invalid_csrf") return false;
+
+    mutationGeneration += 1;
+    refreshGeneration += 1;
+    authenticated = false;
+    username = null;
+    error = null;
+    notice =
+      apiError.code === "invalid_csrf"
+        ? "Your security token is no longer valid. Sign in again to continue."
+        : "Your session expired. Sign in again to continue.";
+    phase = "ready";
+    return true;
+  }
+
+  function beginMutation() {
+    refreshGeneration += 1;
+    mutationGeneration += 1;
+    return mutationGeneration;
+  }
+
+  function settleMutation() {
+    refreshGeneration += 1;
+    phase = "ready";
+  }
+
+  function clearNotice() {
+    notice = null;
+  }
+
+  function dispose() {
+    refreshGeneration += 1;
+    mutationGeneration += 1;
+  }
+
+  return {
+    get phase() {
+      return phase;
+    },
+    get setupRequired() {
+      return setupRequired;
+    },
+    get authenticated() {
+      return authenticated;
+    },
+    get username() {
+      return username;
+    },
+    get error() {
+      return error;
+    },
+    get notice() {
+      return notice;
+    },
+    refresh,
+    signIn,
+    completeSetup,
+    signOut,
+    recoverFromApiError,
+    clearNotice,
+    dispose,
+  };
+}
+
+export type AuthState = ReturnType<typeof createAuthState>;
+
+export function provideAuthState(auth: AuthState) {
+  setContext(authContext, auth);
+}
+
+export function useAuthState() {
+  return getContext<AuthState>(authContext);
+}
diff --git a/web/src/lib/auth.test.ts b/web/src/lib/auth.test.ts
new file mode 100644
index 000000000..67d2a4b88
--- /dev/null
+++ b/web/src/lib/auth.test.ts
@@ -0,0 +1,183 @@
+import { afterEach, describe, expect, it, vi } from "@effect/vitest";
+import { ApiError } from "./api";
+import { createAuthState } from "./auth.svelte";
+
+function deferred<Value>() {
+  let resolve = (_value: Value) => {};
+  const promise = new Promise<Value>((complete) => {
+    resolve = complete;
+  });
+  return { promise, resolve };
+}
+
+afterEach(() => {
+  vi.unstubAllGlobals();
+});
+
+describe("dashboard auth state", () => {
+  it("hydrates an authenticated administrator session", async () => {
+    const fetcher = vi
+      .fn<typeof fetch>()
+      .mockResolvedValueOnce(Response.json({ setupRequired: false, authenticated: true }))
+      .mockResolvedValueOnce(Response.json({ username: "admin", csrfToken: null }));
+    vi.stubGlobal("fetch", fetcher);
+
+    const auth = createAuthState();
+    await auth.refresh();
+
+    expect(auth.phase).toBe("ready");
+    expect(auth.setupRequired).toBe(false);
+    expect(auth.authenticated).toBe(true);
+    expect(auth.username).toBe("admin");
+    expect(fetcher).toHaveBeenCalledTimes(2);
+  });
+
+  it("claims first boot and immediately establishes the session", async () => {
+    const fetcher = vi
+      .fn<typeof fetch>()
+      .mockResolvedValueOnce(Response.json({ username: "admin", csrfToken: null }, { status: 201 }))
+      .mockResolvedValueOnce(Response.json({ username: "admin", csrfToken: "csrf_fresh" }));
+    vi.stubGlobal("fetch", fetcher);
+
+    const auth = createAuthState();
+    const result = await auth.completeSetup({
+      setupToken: "set_secret",
+      username: "admin",
+      password: "long-enough-password",
+    });
+
+    expect(result.ok).toBe(true);
+    expect(auth.setupRequired).toBe(false);
+    expect(auth.authenticated).toBe(true);
+    expect(auth.username).toBe("admin");
+    expect(auth.notice).toBeNull();
+    expect(fetcher).toHaveBeenCalledTimes(2);
+  });
+
+  it("does not let an older refresh overwrite a successful sign-in", async () => {
+    const bootstrap = deferred<Response>();
+    const fetcher = vi.fn<typeof fetch>((input, init) => {
+      if (String(input) === "/api/v1/session" && init?.method === "POST") {
+        return Promise.resolve(Response.json({ username: "admin", csrfToken: "csrf_fresh" }));
+      }
+      return bootstrap.promise;
+    });
+    vi.stubGlobal("fetch", fetcher);
+
+    const auth = createAuthState();
+    const refreshing = auth.refresh();
+    const signedIn = await auth.signIn({ username: "admin", password: "password" });
+    bootstrap.resolve(Response.json({ setupRequired: false, authenticated: false }));
+    await refreshing;
+
+    expect(signedIn.ok).toBe(true);
+    expect(auth.phase).toBe("ready");
+    expect(auth.authenticated).toBe(true);
+    expect(auth.username).toBe("admin");
+  });
+
+  it("does not let an older refresh overwrite a completed first boot", async () => {
+    const bootstrap = deferred<Response>();
+    const fetcher = vi.fn<typeof fetch>((input, init) => {
+      if (String(input) === "/api/v1/setup") {
+        return Promise.resolve(
+          Response.json({ username: "admin", csrfToken: null }, { status: 201 }),
+        );
+      }
+      if (String(input) === "/api/v1/session" && init?.method === "POST") {
+        return Promise.resolve(Response.json({ username: "admin", csrfToken: "csrf_fresh" }));
+      }
+      return bootstrap.promise;
+    });
+    vi.stubGlobal("fetch", fetcher);
+
+    const auth = createAuthState();
+    const refreshing = auth.refresh();
+    const setup = await auth.completeSetup({
+      setupToken: "set_secret",
+      username: "admin",
+      password: "long-enough-password",
+    });
+    bootstrap.resolve(Response.json({ setupRequired: true, authenticated: false }));
+    await refreshing;
+
+    expect(setup.ok).toBe(true);
+    expect(auth.setupRequired).toBe(false);
+    expect(auth.authenticated).toBe(true);
+  });
+
+  it("does not let an older refresh restore a completed sign-out", async () => {
+    const bootstrap = deferred<Response>();
+    const fetcher = vi.fn<typeof fetch>((input, init) => {
+      if (String(input) === "/api/v1/session" && init?.method === "POST") {
+        return Promise.resolve(Response.json({ username: "admin", csrfToken: "csrf_fresh" }));
+      }
+      if (String(input) === "/api/v1/session" && init?.method === "DELETE") {
+        return Promise.resolve(new Response(null, { status: 204 }));
+      }
+      return bootstrap.promise;
+    });
+    vi.stubGlobal("fetch", fetcher);
+
+    const auth = createAuthState();
+    await auth.signIn({ username: "admin", password: "password" });
+    const refreshing = auth.refresh();
+    const signedOut = await auth.signOut();
+    bootstrap.resolve(Response.json({ setupRequired: false, authenticated: true }));
+    await refreshing;
+
+    expect(signedOut.ok).toBe(true);
+    expect(auth.phase).toBe("ready");
+    expect(auth.authenticated).toBe(false);
+    expect(auth.username).toBeNull();
+  });
+
+  it("transitions to sign-in when an authenticated API reports an invalid CSRF token", async () => {
+    const fetcher = vi
+      .fn<typeof fetch>()
+      .mockResolvedValue(Response.json({ username: "admin", csrfToken: "csrf_fresh" }));
+    vi.stubGlobal("fetch", fetcher);
+
+    const auth = createAuthState();
+    await auth.signIn({ username: "admin", password: "password" });
+    const recovered = auth.recoverFromApiError(
+      new ApiError({
+        code: "invalid_csrf",
+        displayMessage: "A valid CSRF token is required.",
+        requestId: "request-1",
+        status: 403,
+      }),
+    );
+
+    expect(recovered).toBe(true);
+    expect(auth.authenticated).toBe(false);
+    expect(auth.phase).toBe("ready");
+    expect(auth.notice).toContain("Sign in again");
+  });
+
+  it("recovers from a session that expires between bootstrap and session lookup", async () => {
+    const fetcher = vi
+      .fn<typeof fetch>()
+      .mockResolvedValueOnce(Response.json({ setupRequired: false, authenticated: true }))
+      .mockResolvedValueOnce(
+        Response.json(
+          {
+            error: {
+              code: "unauthorized",
+              message: "An administrator session is required.",
+              requestId: "request-expired",
+            },
+          },
+          { status: 401 },
+        ),
+      );
+    vi.stubGlobal("fetch", fetcher);
+
+    const auth = createAuthState();
+    await auth.refresh();
+
+    expect(auth.phase).toBe("ready");
+    expect(auth.authenticated).toBe(false);
+    expect(auth.notice).toContain("session expired");
+  });
+});
diff --git a/web/src/lib/catalog-state.test.ts b/web/src/lib/catalog-state.test.ts
new file mode 100644
index 000000000..76b8fde51
--- /dev/null
+++ b/web/src/lib/catalog-state.test.ts
@@ -0,0 +1,201 @@
+import { describe, expect, it } from "@effect/vitest";
+import { ApiError } from "$lib/api";
+import {
+  beginIdentityResourceLoad,
+  beginResourceLoad,
+  createLatestRequest,
+  emptyResource,
+  settleResourceLoad,
+} from "./catalog-state";
+
+describe("catalog resource state", () => {
+  it("distinguishes loading, empty, error, and stale data", () => {
+    const loading = emptyResource<readonly string[]>();
+    const empty = settleResourceLoad(loading, { ok: true, value: [] });
+    const refreshing = beginResourceLoad(empty);
+    const error = new ApiError({
+      code: "offline",
+      displayMessage: "offline",
+      requestId: null,
+      status: 0,
+    });
+    const failedEmpty = settleResourceLoad(loading, { ok: false, error });
+    const loaded = settleResourceLoad(loading, { ok: true, value: ["tool"] });
+    const stale = settleResourceLoad(loaded, { ok: false, error });
+
+    expect(loading).toMatchObject({ loading: true, data: null, stale: false });
+    expect(empty).toMatchObject({ loading: false, data: [], stale: false });
+    expect(refreshing).toMatchObject({ loading: true, data: [], stale: false });
+    expect(failedEmpty).toMatchObject({ loading: false, data: null, stale: false });
+    expect(stale).toMatchObject({ loading: false, data: ["tool"], stale: true, error });
+  });
+
+  it("can discard retained detail data when a same-identity reload fails", () => {
+    const loaded = settleResourceLoad(emptyResource<string>(), { ok: true, value: "tool-a" });
+    const refreshing = beginIdentityResourceLoad(loaded, "a", "a").state;
+    const error = new ApiError({
+      code: "network_error",
+      displayMessage: "offline",
+      requestId: null,
+      status: 0,
+    });
+    const failed = settleResourceLoad(
+      refreshing,
+      { ok: false, error },
+      {
+        retainDataOnError: false,
+      },
+    );
+
+    expect(failed).toEqual({ data: null, loading: false, stale: false, error });
+  });
+
+  it("rejects an older completion after a newer request wins", async () => {
+    const latest = createLatestRequest();
+    const commits: string[] = [];
+    let resolveA = (_value: string) => {};
+    let resolveB = (_value: string) => {};
+    const a = new Promise<string>((resolve) => (resolveA = resolve));
+    const b = new Promise<string>((resolve) => (resolveB = resolve));
+
+    latest.start(
+      () => a,
+      (value) => commits.push(value),
+      () => {},
+    );
+    latest.start(
+      () => b,
+      (value) => commits.push(value),
+      () => {},
+    );
+    resolveB("b");
+    await b;
+    resolveA("a");
+    await a;
+    await Promise.resolve();
+
+    expect(commits).toEqual(["b"]);
+  });
+
+  it("reports an unexpected rejection through the current request contract", async () => {
+    const latest = createLatestRequest();
+    const commits: string[] = [];
+    const rejections: unknown[] = [];
+    let reject = (_error: unknown) => {};
+    const pending = new Promise<string>((_resolve, fail) => (reject = fail));
+    const failure = { _tag: "UnexpectedTestRejection" } as const;
+
+    latest.start(
+      () => pending,
+      (value) => commits.push(value),
+      (error) => rejections.push(error),
+    );
+    await Promise.resolve();
+    reject(failure);
+    await Promise.resolve();
+    await Promise.resolve();
+
+    expect(commits).toEqual([]);
+    expect(rejections).toEqual([failure]);
+  });
+
+  it("ignores an older rejection after a newer request wins", async () => {
+    const latest = createLatestRequest();
+    const commits: string[] = [];
+    const rejections: unknown[] = [];
+    let rejectA = (_error: unknown) => {};
+    let resolveB = (_value: string) => {};
+    const a = new Promise<string>((_resolve, reject) => (rejectA = reject));
+    const b = new Promise<string>((resolve) => (resolveB = resolve));
+
+    latest.start(
+      () => a,
+      (value) => commits.push(value),
+      (error) => rejections.push(error),
+    );
+    latest.start(
+      () => b,
+      (value) => commits.push(value),
+      (error) => rejections.push(error),
+    );
+    await Promise.resolve();
+    resolveB("b");
+    await b;
+    rejectA({ _tag: "LateTestRejection" });
+    await Promise.resolve();
+    await Promise.resolve();
+
+    expect(commits).toEqual(["b"]);
+    expect(rejections).toEqual([]);
+  });
+
+  it("retains data for a refresh but clears it across detail identities", () => {
+    const loaded = settleResourceLoad(emptyResource<string>(), { ok: true, value: "tool-a" });
+
+    expect(beginIdentityResourceLoad(loaded, "a", "a")).toEqual({
+      identity: "a",
+      state: { data: "tool-a", loading: true, error: null, stale: false },
+    });
+    expect(beginIdentityResourceLoad(loaded, "a", "b")).toEqual({
+      identity: "b",
+      state: { data: null, loading: true, error: null, stale: false },
+    });
+  });
+
+  it("never leaves a previous tool list writable after a new list identity fails", () => {
+    const loaded = settleResourceLoad(emptyResource<readonly string[]>(), {
+      ok: true,
+      value: ["old-tool"],
+    });
+    const changed = beginIdentityResourceLoad(loaded, "source-a", "source-b").state;
+    const error = new ApiError({
+      code: "network_error",
+      displayMessage: "offline",
+      requestId: null,
+      status: 0,
+    });
+    const failed = settleResourceLoad(changed, { ok: false, error });
+
+    expect(changed.data).toBeNull();
+    expect(failed).toMatchObject({ data: null, loading: false, stale: false, error });
+  });
+
+  it("rejects completion after the owner is disposed", async () => {
+    const latest = createLatestRequest();
+    const commits: string[] = [];
+    let resolve = (_value: string) => {};
+    const pending = new Promise<string>((done) => (resolve = done));
+    const dispose = latest.start(
+      () => pending,
+      (value) => commits.push(value),
+      () => {},
+    );
+
+    dispose();
+    resolve("late");
+    await pending;
+    await Promise.resolve();
+
+    expect(commits).toEqual([]);
+  });
+
+  it("ignores a rejected task after the owner is disposed", async () => {
+    const latest = createLatestRequest();
+    const rejections: unknown[] = [];
+    let reject = (_error: unknown) => {};
+    const pending = new Promise<string>((_resolve, fail) => (reject = fail));
+    const dispose = latest.start(
+      () => pending,
+      () => {},
+      (error) => rejections.push(error),
+    );
+
+    await Promise.resolve();
+    dispose();
+    reject({ _tag: "LateDisposedTestRejection" });
+    await Promise.resolve();
+    await Promise.resolve();
+
+    expect(rejections).toEqual([]);
+  });
+});
diff --git a/web/src/lib/catalog-state.ts b/web/src/lib/catalog-state.ts
new file mode 100644
index 000000000..8bbb430ce
--- /dev/null
+++ b/web/src/lib/catalog-state.ts
@@ -0,0 +1,101 @@
+import { ApiError, type ApiResult, type ToolMode } from "$lib/api";
+
+export type ResourceState<Value> = {
+  readonly data: Value | null;
+  readonly loading: boolean;
+  readonly error: ApiError | null;
+  readonly stale: boolean;
+};
+
+export function emptyResource<Value>(): ResourceState<Value> {
+  return { data: null, loading: true, error: null, stale: false };
+}
+
+export function beginResourceLoad<Value>(state: ResourceState<Value>) {
+  return { ...state, loading: true, error: null };
+}
+
+export function beginIdentityResourceLoad<Value>(
+  state: ResourceState<Value>,
+  currentIdentity: string | null,
+  nextIdentity: string,
+) {
+  return {
+    identity: nextIdentity,
+    state: currentIdentity === nextIdentity ? beginResourceLoad(state) : emptyResource<Value>(),
+  };
+}
+
+export function settleResourceLoad<Value>(
+  state: ResourceState<Value>,
+  result: ApiResult<Value>,
+  options: { readonly retainDataOnError?: boolean } = {},
+) {
+  if (result.ok) {
+    return { data: result.value, loading: false, error: null, stale: false };
+  }
+  const data = options.retainDataOnError === false ? null : state.data;
+  return {
+    data,
+    loading: false,
+    error: result.error,
+    stale: data !== null,
+  };
+}
+
+export function unexpectedRequestError() {
+  return new ApiError({
+    code: "unexpected_client_error",
+    displayMessage: "The request ended unexpectedly. Try again.",
+    requestId: null,
+    status: 0,
+  });
+}
+
+export function createLatestRequest() {
+  let generation = 0;
+  let activeController: AbortController | null = null;
+
+  function start<Value>(
+    task: (signal: AbortSignal) => Promise<Value>,
+    commit: (value: Value) => void,
+    reject: (error: unknown) => void,
+  ) {
+    activeController?.abort();
+    const mine = ++generation;
+    const controller = new AbortController();
+    activeController = controller;
+    void task(controller.signal).then(
+      (value) => {
+        if (!controller.signal.aborted && mine === generation) commit(value);
+      },
+      (error: unknown) => {
+        if (!controller.signal.aborted && mine === generation) reject(error);
+      },
+    );
+
+    return () => {
+      controller.abort();
+      if (mine === generation) {
+        generation += 1;
+        activeController = null;
+      }
+    };
+  }
+
+  return { start };
+}
+
+export const toolModes = ["enabled", "ask", "disabled"] as const satisfies readonly ToolMode[];
+
+export function modeLabel(mode: ToolMode) {
+  if (mode === "enabled") return "Enabled";
+  if (mode === "ask") return "Ask";
+  return "Disabled";
+}
+
+export function provenanceLabel(provenance: "tool_override" | "source_override" | "intrinsic") {
+  if (provenance === "tool_override") return "Tool override";
+  if (provenance === "source_override") return "Source default";
+  return "Tool default";
+}
diff --git a/web/src/lib/catalog-url.test.ts b/web/src/lib/catalog-url.test.ts
new file mode 100644
index 000000000..8c5017617
--- /dev/null
+++ b/web/src/lib/catalog-url.test.ts
@@ -0,0 +1,61 @@
+import { describe, expect, it } from "@effect/vitest";
+import {
+  logsListKey,
+  logsUrl,
+  parseLogsUrl,
+  parseToolsUrl,
+  toolsListKey,
+  toolsUrl,
+} from "./catalog-url";
+
+describe("catalog URL state", () => {
+  it("normalizes invalid tool filters without hiding valid choices", () => {
+    const state = parseToolsUrl(
+      new URLSearchParams(
+        "q=deploy&source=github&mode=surprise&removed=true&offset=-4&tool=tool-1",
+      ),
+    );
+
+    expect(state).toEqual({
+      q: "deploy",
+      source: "github",
+      mode: null,
+      removed: false,
+      offset: 0,
+      tool: "tool-1",
+    });
+  });
+
+  it("creates bookmarkable tool URLs and resets offsets on filter changes", () => {
+    const state = parseToolsUrl(new URLSearchParams("source=github&offset=100&removed=1"));
+    expect(toolsUrl(state, { mode: "ask", offset: 0 })).toBe(
+      "/tools?source=github&mode=ask&removed=1",
+    );
+  });
+
+  it("keeps log cursors and inline request selection independently addressable", () => {
+    const state = parseLogsUrl(new URLSearchParams("cursor=older-page&request=req-1"));
+    expect(state).toEqual({ cursor: "older-page", request: "req-1" });
+    expect(logsUrl(state, { request: null })).toBe("/logs?cursor=older-page");
+    expect(logsUrl(state, { cursor: null })).toBe("/logs?request=req-1");
+  });
+
+  it("excludes detail-only selections from list request identities", () => {
+    const toolA = parseToolsUrl(new URLSearchParams("source=github&tool=a"));
+    const toolB = parseToolsUrl(new URLSearchParams("source=github&tool=b"));
+    const logA = parseLogsUrl(new URLSearchParams("cursor=older&request=a"));
+    const logB = parseLogsUrl(new URLSearchParams("cursor=older&request=b"));
+
+    expect(toolsListKey(toolA)).toBe(toolsListKey(toolB));
+    expect(logsListKey(logA)).toBe(logsListKey(logB));
+  });
+
+  it("changes list identity for filters, offsets, and cursors", () => {
+    const first = parseToolsUrl(new URLSearchParams("source=github&offset=0"));
+    const second = parseToolsUrl(new URLSearchParams("source=github&offset=50"));
+    expect(toolsListKey(first)).not.toBe(toolsListKey(second));
+    expect(logsListKey({ cursor: "a", request: null })).not.toBe(
+      logsListKey({ cursor: "b", request: null }),
+    );
+  });
+});
diff --git a/web/src/lib/catalog-url.ts b/web/src/lib/catalog-url.ts
new file mode 100644
index 000000000..7431716d4
--- /dev/null
+++ b/web/src/lib/catalog-url.ts
@@ -0,0 +1,82 @@
+import type { ToolMode } from "$lib/api";
+
+const modes = new Set<ToolMode>(["enabled", "ask", "disabled"]);
+const maxSearchLength = 256;
+const maxOffset = 1_000_000_000;
+
+export type ToolsUrlState = {
+  q: string;
+  source: string | null;
+  mode: ToolMode | null;
+  removed: boolean;
+  offset: number;
+  tool: string | null;
+};
+
+export function parseToolsUrl(parameters: URLSearchParams): ToolsUrlState {
+  const rawMode = parameters.get("mode");
+  return {
+    q: (parameters.get("q") ?? "").slice(0, maxSearchLength),
+    source: nonEmpty(parameters.get("source")),
+    mode: isToolMode(rawMode) ? rawMode : null,
+    removed: parameters.get("removed") === "1",
+    offset: parseOffset(parameters.get("offset")),
+    tool: nonEmpty(parameters.get("tool")),
+  };
+}
+
+export function toolsUrl(state: ToolsUrlState, updates: Partial<ToolsUrlState> = {}) {
+  const next = { ...state, ...updates };
+  const parameters = new URLSearchParams();
+  if (next.q) parameters.set("q", next.q);
+  if (next.source) parameters.set("source", next.source);
+  if (next.mode) parameters.set("mode", next.mode);
+  if (next.removed) parameters.set("removed", "1");
+  if (next.offset > 0) parameters.set("offset", String(next.offset));
+  if (next.tool) parameters.set("tool", next.tool);
+  const search = parameters.toString();
+  return search ? `/tools?${search}` : "/tools";
+}
+
+export function toolsListKey(state: ToolsUrlState) {
+  return JSON.stringify([state.q, state.source, state.mode, state.removed, state.offset]);
+}
+
+export type LogsUrlState = {
+  cursor: string | null;
+  request: string | null;
+};
+
+export function parseLogsUrl(parameters: URLSearchParams): LogsUrlState {
+  return {
+    cursor: nonEmpty(parameters.get("cursor")),
+    request: nonEmpty(parameters.get("request")),
+  };
+}
+
+export function logsUrl(state: LogsUrlState, updates: Partial<LogsUrlState> = {}) {
+  const next = { ...state, ...updates };
+  const parameters = new URLSearchParams();
+  if (next.cursor) parameters.set("cursor", next.cursor);
+  if (next.request) parameters.set("request", next.request);
+  const search = parameters.toString();
+  return search ? `/logs?${search}` : "/logs";
+}
+
+export function logsListKey(state: LogsUrlState) {
+  return state.cursor ?? "";
+}
+
+function isToolMode(value: string | null): value is ToolMode {
+  return value !== null && modes.has(value as ToolMode);
+}
+
+function nonEmpty(value: string | null) {
+  return value === null || value === "" ? null : value;
+}
+
+function parseOffset(value: string | null) {
+  if (value === null || !/^\d+$/.test(value)) return 0;
+  const parsed = Number(value);
+  return Number.isSafeInteger(parsed) ? Math.min(parsed, maxOffset) : 0;
+}
diff --git a/web/src/lib/catalog-ux.test.ts b/web/src/lib/catalog-ux.test.ts
new file mode 100644
index 000000000..e9828eebc
--- /dev/null
+++ b/web/src/lib/catalog-ux.test.ts
@@ -0,0 +1,37 @@
+import { describe, expect, it } from "@effect/vitest";
+import {
+  broadConfirmationText,
+  bulkActionLabel,
+  inheritLabel,
+  previewToolKey,
+  requiresBroadConfirmation,
+  sourceModeImpact,
+} from "./catalog-ux";
+
+describe("catalog mode UX", () => {
+  it("requires confirmation for broad enable and disable changes", () => {
+    expect(requiresBroadConfirmation("enabled")).toBe(true);
+    expect(requiresBroadConfirmation("disabled")).toBe(true);
+    expect(requiresBroadConfirmation("ask")).toBe(false);
+    expect(requiresBroadConfirmation(null)).toBe(false);
+  });
+
+  it("names bulk actions with their target and selected count", () => {
+    expect(bulkActionLabel("ask", 3)).toBe("Apply Ask to 3 selected");
+    expect(bulkActionLabel(null, 1)).toBe("Apply Inherit to 1 selected");
+    expect(broadConfirmationText("disabled", 2)).toBe(
+      "Disabled 2 selected tools? This sets an explicit mode override on every selected tool.",
+    );
+  });
+
+  it("explains inherited state and conservative source impact", () => {
+    expect(inheritLabel("enabled")).toBe("Inherit (currently Enabled)");
+    expect(sourceModeImpact(1)).toContain("Up to 1 active tool");
+    expect(sourceModeImpact(12)).toContain("Up to 12 active tools");
+    expect(sourceModeImpact(12)).toContain("Tool overrides stay unchanged");
+  });
+
+  it("keeps legal duplicate preview names collision-safe", () => {
+    expect(previewToolKey("duplicate", 0)).not.toBe(previewToolKey("duplicate", 1));
+  });
+});
diff --git a/web/src/lib/catalog-ux.ts b/web/src/lib/catalog-ux.ts
new file mode 100644
index 000000000..dd8d6f35c
--- /dev/null
+++ b/web/src/lib/catalog-ux.ts
@@ -0,0 +1,33 @@
+import type { ToolMode } from "$lib/api";
+
+export function requiresBroadConfirmation(mode: ToolMode | null) {
+  return mode === "enabled" || mode === "disabled";
+}
+
+export function sourceModeImpact(toolCount: number) {
+  const noun = toolCount === 1 ? "tool" : "tools";
+  return `Up to ${toolCount} active ${noun} may inherit this source default. Tool overrides stay unchanged.`;
+}
+
+export function bulkActionLabel(mode: ToolMode | null, count: number) {
+  const target = mode === null ? "Inherit" : modeName(mode);
+  return `Apply ${target} to ${count} selected`;
+}
+
+export function broadConfirmationText(mode: ToolMode, count: number) {
+  return `${modeName(mode)} ${count} selected ${count === 1 ? "tool" : "tools"}? This sets an explicit mode override on every selected tool.`;
+}
+
+export function modeName(mode: ToolMode) {
+  if (mode === "enabled") return "Enabled";
+  if (mode === "ask") return "Ask";
+  return "Disabled";
+}
+
+export function inheritLabel(mode: ToolMode) {
+  return `Inherit (currently ${modeName(mode)})`;
+}
+
+export function previewToolKey(preferredName: string, index: number) {
+  return `${index}:${preferredName}`;
+}
diff --git a/web/src/lib/clipboard.test.ts b/web/src/lib/clipboard.test.ts
new file mode 100644
index 000000000..323f71185
--- /dev/null
+++ b/web/src/lib/clipboard.test.ts
@@ -0,0 +1,44 @@
+import { afterEach, beforeEach, expect, it, vi } from "@effect/vitest";
+import { copyText } from "./clipboard";
+
+let clipboardDescriptor: PropertyDescriptor | undefined;
+let execCommandDescriptor: PropertyDescriptor | undefined;
+
+beforeEach(() => {
+  clipboardDescriptor = Object.getOwnPropertyDescriptor(navigator, "clipboard");
+  execCommandDescriptor = Object.getOwnPropertyDescriptor(document, "execCommand");
+});
+
+afterEach(() => {
+  if (clipboardDescriptor === undefined) {
+    Reflect.deleteProperty(navigator, "clipboard");
+  } else {
+    Object.defineProperty(navigator, "clipboard", clipboardDescriptor);
+  }
+
+  if (execCommandDescriptor === undefined) {
+    Reflect.deleteProperty(document, "execCommand");
+  } else {
+    Object.defineProperty(document, "execCommand", execCommandDescriptor);
+  }
+  document.body.replaceChildren();
+});
+
+it("uses the visible readonly field as a fallback and restores focus", async () => {
+  Object.defineProperty(navigator, "clipboard", { configurable: true, value: undefined });
+  const execCommand = vi.fn(() => true);
+  Object.defineProperty(document, "execCommand", { configurable: true, value: execCommand });
+
+  const copyButton = document.createElement("button");
+  const field = document.createElement("input");
+  field.readOnly = true;
+  document.body.append(copyButton, field);
+  copyButton.focus();
+
+  const copied = await copyText("exr_secret", field);
+
+  expect(copied).toBe(true);
+  expect(field.value).toBe("exr_secret");
+  expect(execCommand).toHaveBeenCalledWith("copy");
+  expect(document.activeElement).toBe(copyButton);
+});
diff --git a/web/src/lib/clipboard.ts b/web/src/lib/clipboard.ts
new file mode 100644
index 000000000..84e64cd2a
--- /dev/null
+++ b/web/src/lib/clipboard.ts
@@ -0,0 +1,24 @@
+export async function copyText(text: string, fallbackField: HTMLInputElement) {
+  if (navigator.clipboard?.writeText) {
+    const copied = await navigator.clipboard.writeText(text).then(
+      () => true,
+      () => false,
+    );
+    if (copied) return true;
+  }
+
+  const previousFocus =
+    document.activeElement instanceof HTMLElement ? document.activeElement : null;
+  fallbackField.value = text;
+  fallbackField.focus();
+  fallbackField.select();
+
+  // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: legacy clipboard fallback must report failure and restore focus
+  try {
+    return document.execCommand("copy");
+  } catch {
+    return false;
+  } finally {
+    previousFocus?.focus({ preventScroll: true });
+  }
+}
diff --git a/web/src/lib/graphql-source-state.test.ts b/web/src/lib/graphql-source-state.test.ts
new file mode 100644
index 000000000..422148313
--- /dev/null
+++ b/web/src/lib/graphql-source-state.test.ts
@@ -0,0 +1,75 @@
+import { describe, expect, it } from "@effect/vitest";
+import {
+  buildGraphqlCredential,
+  graphqlDraftFromCredentialType,
+  normalizeGraphqlEndpoint,
+  requiresGraphqlPrivateNetworkOptIn,
+  safeGraphqlSourceDetails,
+} from "./graphql-source-state";
+
+describe("GraphQL source state", () => {
+  it("preserves secret bytes while trimming public credential fields", () => {
+    expect(
+      buildGraphqlCredential({
+        type: "api_key_header",
+        headerName: " X-Service-Key ",
+        username: "",
+        secret: " exact secret ",
+      }),
+    ).toEqual({ type: "api_key_header", name: "X-Service-Key", value: " exact secret " });
+    expect(
+      buildGraphqlCredential({
+        type: "basic",
+        headerName: "",
+        username: " operator ",
+        secret: " exact password ",
+      }),
+    ).toEqual({ type: "basic", username: "operator", password: " exact password " });
+  });
+
+  it("requires complete credentials and normalizes stored OAuth metadata", () => {
+    expect(
+      buildGraphqlCredential({
+        type: "bearer",
+        headerName: "",
+        username: "",
+        secret: " ",
+      }),
+    ).toBeUndefined();
+    expect(graphqlDraftFromCredentialType("manual_oauth_access_token").type).toBe(
+      "oauth_access_token",
+    );
+  });
+
+  it("detects obvious private endpoints", () => {
+    expect(requiresGraphqlPrivateNetworkOptIn("http://127.10.0.1/graphql")).toBe(true);
+    expect(requiresGraphqlPrivateNetworkOptIn("http://192.168.2.4/graphql")).toBe(true);
+    expect(requiresGraphqlPrivateNetworkOptIn("http://[::ffff:7f00:1]/graphql")).toBe(true);
+    expect(requiresGraphqlPrivateNetworkOptIn("https://api.example.test/graphql")).toBe(false);
+  });
+
+  it("never exposes endpoint credentials, query parameters, or fragments", () => {
+    expect(
+      safeGraphqlSourceDetails({
+        endpoint: "https://user:pass@api.example.test/graphql?token=secret#private",
+        allowPrivateNetwork: false,
+      }),
+    ).toEqual({ endpoint: "https://api.example.test", allowPrivateNetwork: false });
+    expect(
+      safeGraphqlSourceDetails({
+        endpoint: "https://api.example.test/graphql/path-secret",
+        allowPrivateNetwork: false,
+      }),
+    ).toEqual({ endpoint: "https://api.example.test", allowPrivateNetwork: false });
+    expect(normalizeGraphqlEndpoint("https://api.example.test/graphql")).toBe(
+      "https://api.example.test/graphql",
+    );
+    expect(normalizeGraphqlEndpoint("https://api.example.test/graphql?token=secret")).toBeNull();
+    expect(normalizeGraphqlEndpoint("https://user:pass@api.example.test/graphql")).toBeNull();
+    expect(normalizeGraphqlEndpoint("https://api.example.test/graphql#secret")).toBeNull();
+    expect(normalizeGraphqlEndpoint("http://api.example.test/graphql")).toBeNull();
+    expect(normalizeGraphqlEndpoint("http://127.0.0.1:4000/graphql")).toBe(
+      "http://127.0.0.1:4000/graphql",
+    );
+  });
+});
diff --git a/web/src/lib/graphql-source-state.ts b/web/src/lib/graphql-source-state.ts
new file mode 100644
index 000000000..915d96316
--- /dev/null
+++ b/web/src/lib/graphql-source-state.ts
@@ -0,0 +1,137 @@
+export type GraphqlAuthDraft = {
+  readonly type: "none" | "bearer" | "basic" | "api_key_header" | "oauth_access_token";
+  readonly headerName: string;
+  readonly username: string;
+  readonly secret: string;
+};
+
+export type GraphqlCredential =
+  | null
+  | { readonly type: "bearer"; readonly token: string }
+  | { readonly type: "basic"; readonly username: string; readonly password: string }
+  | { readonly type: "api_key_header"; readonly name: string; readonly value: string }
+  | { readonly type: "oauth_access_token"; readonly accessToken: string };
+
+export type GraphqlSourceInput = {
+  readonly kind: "graphql";
+  readonly displayName: string;
+  readonly preferredSlug?: string;
+  readonly description?: string;
+  readonly endpoint: string;
+  readonly allowPrivateNetwork?: boolean;
+  readonly credential?: Exclude<GraphqlCredential, null>;
+};
+
+export function emptyGraphqlAuthDraft(): GraphqlAuthDraft {
+  return { type: "none", headerName: "", username: "", secret: "" };
+}
+
+export function clearGraphqlSecret(draft: GraphqlAuthDraft): GraphqlAuthDraft {
+  return { ...draft, headerName: "", username: "", secret: "" };
+}
+
+export function buildGraphqlCredential(draft: GraphqlAuthDraft): GraphqlCredential | undefined {
+  if (draft.type === "none") return null;
+  if (draft.secret.trim() === "") return undefined;
+  if (draft.type === "bearer") return { type: "bearer", token: draft.secret };
+  if (draft.type === "basic") {
+    const username = draft.username.trim();
+    return username === "" ? undefined : { type: "basic", username, password: draft.secret };
+  }
+  if (draft.type === "oauth_access_token") {
+    return { type: "oauth_access_token", accessToken: draft.secret };
+  }
+  const name = draft.headerName.trim();
+  return name === "" ? undefined : { type: "api_key_header", name, value: draft.secret };
+}
+
+export function graphqlDraftFromCredentialType(type: string | undefined): GraphqlAuthDraft {
+  const normalized = type === "manual_oauth_access_token" ? "oauth_access_token" : type;
+  if (
+    normalized === "bearer" ||
+    normalized === "basic" ||
+    normalized === "api_key_header" ||
+    normalized === "oauth_access_token"
+  ) {
+    return { type: normalized, headerName: "", username: "", secret: "" };
+  }
+  return emptyGraphqlAuthDraft();
+}
+
+export function requiresGraphqlPrivateNetworkOptIn(endpoint: string) {
+  const url = parseHttpUrl(endpoint);
+  if (url === null) return false;
+  const host = url.hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  if (host === "localhost" || host.endsWith(".localhost") || host.endsWith(".local")) return true;
+  if (host === "::1" || host.startsWith("fc") || host.startsWith("fd")) return true;
+  if (host.startsWith("::ffff:")) {
+    const groups = host.split(":");
+    const high = Number.parseInt(groups.at(-2) ?? "", 16);
+    const low = Number.parseInt(groups.at(-1) ?? "", 16);
+    if (Number.isInteger(high) && Number.isInteger(low)) {
+      return isPrivateIpv4([high >> 8, high & 0xff, low >> 8, low & 0xff]);
+    }
+  }
+  const firstIpv6Group = Number.parseInt(host.split(":", 1)[0] ?? "", 16);
+  if (Number.isInteger(firstIpv6Group) && firstIpv6Group >= 0xfe80 && firstIpv6Group <= 0xfebf) {
+    return true;
+  }
+  const octets = host.split(".").map(Number);
+  if (octets.length !== 4 || octets.some((octet) => !Number.isInteger(octet))) return false;
+  return isPrivateIpv4(octets);
+}
+
+export function normalizeGraphqlEndpoint(endpoint: string) {
+  const normalized = endpoint.trim();
+  const url = parseHttpUrl(normalized);
+  if (
+    url === null ||
+    url.username !== "" ||
+    url.password !== "" ||
+    url.search !== "" ||
+    url.hash !== "" ||
+    (url.protocol === "http:" && !isLoopbackHost(url.hostname))
+  ) {
+    return null;
+  }
+  return normalized;
+}
+
+function isLoopbackHost(hostname: string) {
+  const host = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  if (host === "localhost" || host.endsWith(".localhost") || host === "::1") return true;
+  const octets = host.split(".").map(Number);
+  return (
+    octets.length === 4 &&
+    octets.every((octet) => Number.isInteger(octet) && octet >= 0 && octet <= 255) &&
+    octets[0] === 127
+  );
+}
+
+function isPrivateIpv4(octets: readonly number[]) {
+  if (octets[0] === 10 || octets[0] === 127) return true;
+  if (octets[0] === 169 && octets[1] === 254) return true;
+  if (octets[0] === 172 && octets[1] >= 16 && octets[1] <= 31) return true;
+  return octets[0] === 192 && octets[1] === 168;
+}
+
+export function safeGraphqlSourceDetails(configuration: Readonly<Record<string, unknown>>) {
+  const endpoint =
+    typeof configuration.endpoint === "string" ? redactedEndpoint(configuration.endpoint) : null;
+  return {
+    endpoint,
+    allowPrivateNetwork: configuration.allowPrivateNetwork === true,
+  };
+}
+
+function redactedEndpoint(endpoint: string) {
+  const url = parseHttpUrl(endpoint);
+  return url === null ? null : url.origin;
+}
+
+function parseHttpUrl(value: string) {
+  const normalized = value.trim();
+  if (!URL.canParse(normalized)) return null;
+  const url = new URL(normalized);
+  return url.protocol === "http:" || url.protocol === "https:" ? url : null;
+}
diff --git a/web/src/lib/index.ts b/web/src/lib/index.ts
new file mode 100644
index 000000000..856f2b6c3
--- /dev/null
+++ b/web/src/lib/index.ts
@@ -0,0 +1 @@
+// place files you want to import through the `$lib` alias in this folder.
diff --git a/web/src/lib/mcp-source-state.test.ts b/web/src/lib/mcp-source-state.test.ts
new file mode 100644
index 000000000..c2e5181e8
--- /dev/null
+++ b/web/src/lib/mcp-source-state.test.ts
@@ -0,0 +1,185 @@
+import { describe, expect, it } from "@effect/vitest";
+import {
+  MCP_TOKEN_PLACEHOLDER,
+  buildMcpHttpCredential,
+  downstreamMcpSnippet,
+  mcpHttpFingerprint,
+  redactedEndpointLabel,
+  reconcileTemplateSelection,
+  requiresPrivateNetworkOptIn,
+  safeMcpSourceDetails,
+  templateDescriptorFingerprint,
+  templateSecretFields,
+  validateTemplateCatalog,
+  validateTemplateDraft,
+  type McpTemplateField,
+} from "./mcp-source-state";
+
+const templateFields = [
+  {
+    key: "access_token",
+    label: "Access token",
+    description: "Token issued by the local service.",
+    required: true,
+    secret: true,
+  },
+  {
+    key: "workspace",
+    label: "Workspace",
+    description: "Optional workspace name.",
+    required: false,
+    secret: false,
+  },
+] as const satisfies readonly McpTemplateField[];
+
+describe("MCP source state", () => {
+  it("requires explicit opt-in for obvious local and private endpoints", () => {
+    expect(requiresPrivateNetworkOptIn("http://localhost:7331/mcp")).toBe(true);
+    expect(requiresPrivateNetworkOptIn("http://10.200.1.8/mcp")).toBe(true);
+    expect(requiresPrivateNetworkOptIn("http://127.42.0.1/mcp")).toBe(true);
+    expect(requiresPrivateNetworkOptIn("https://192.168.1.8/mcp")).toBe(true);
+    expect(requiresPrivateNetworkOptIn("https://172.31.4.2/mcp")).toBe(true);
+    expect(requiresPrivateNetworkOptIn("http://[fe9f::1]/mcp")).toBe(true);
+    expect(requiresPrivateNetworkOptIn("http://[::ffff:10.200.1.8]/mcp")).toBe(true);
+    expect(requiresPrivateNetworkOptIn("https://api.example.com/mcp")).toBe(false);
+    expect(requiresPrivateNetworkOptIn("not a URL")).toBe(false);
+  });
+
+  it("includes the private-network choice in preview identity", () => {
+    expect(mcpHttpFingerprint(" https://example.com/mcp ", false)).toBe(
+      "public:https://example.com/mcp",
+    );
+    expect(mcpHttpFingerprint("https://example.com/mcp", true)).toBe(
+      "private:https://example.com/mcp",
+    );
+  });
+
+  it("removes query credentials and fragments from endpoint labels", () => {
+    expect(redactedEndpointLabel("https://example.com/mcp?token=secret#debug")).toBe(
+      "https://example.com/mcp",
+    );
+    expect(redactedEndpointLabel("file:///tmp/server")).toBeNull();
+  });
+
+  it("accepts only template-approved fields and enforces required values", () => {
+    expect(
+      validateTemplateDraft(templateFields, { access_token: " secret ", workspace: "" }),
+    ).toEqual({ access_token: " secret " });
+    expect(validateTemplateDraft(templateFields, { access_token: "" })).toBeNull();
+    expect(
+      validateTemplateDraft(templateFields, { access_token: "secret", raw_command: "rm -rf" }),
+    ).toBeNull();
+  });
+
+  it("builds supported HTTP auth without trimming secret bytes", () => {
+    expect(
+      buildMcpHttpCredential({ type: "none", headerName: "", username: "", secret: "" }),
+    ).toEqual({
+      credential: null,
+    });
+    expect(
+      buildMcpHttpCredential({
+        type: "bearer",
+        headerName: "",
+        username: "",
+        secret: " exact token ",
+      }),
+    ).toEqual({ credential: { type: "bearer", token: " exact token " } });
+    expect(
+      buildMcpHttpCredential({
+        type: "api_key_header",
+        headerName: " X-Service-Key ",
+        username: "",
+        secret: " exact key ",
+      }),
+    ).toEqual({
+      credential: { type: "api_key_header", name: "X-Service-Key", value: " exact key " },
+    });
+    expect(
+      buildMcpHttpCredential({
+        type: "api_key_header",
+        headerName: "",
+        username: "",
+        secret: "key",
+      }),
+    ).toBeNull();
+    expect(
+      buildMcpHttpCredential({
+        type: "basic",
+        headerName: "",
+        username: " admin ",
+        secret: " exact password ",
+      }),
+    ).toEqual({
+      credential: { type: "basic", username: "admin", password: " exact password " },
+    });
+    expect(
+      buildMcpHttpCredential({
+        type: "oauth_access_token",
+        headerName: "",
+        username: "",
+        secret: " exact oauth token ",
+      }),
+    ).toEqual({
+      credential: { type: "oauth_access_token", accessToken: " exact oauth token " },
+    });
+  });
+
+  it("rejects ambiguous template catalogs and preserves only valid selections", () => {
+    expect(
+      validateTemplateCatalog([
+        { name: "github", secretFields: ["TOKEN"] },
+        { name: "github", secretFields: ["OTHER"] },
+      ]),
+    ).toBeNull();
+    expect(
+      validateTemplateCatalog([{ name: "github", secretFields: ["TOKEN", "TOKEN"] }]),
+    ).toBeNull();
+    const templates = [
+      { name: "github", secretFields: ["TOKEN"] },
+      { name: "linear", secretFields: ["API_KEY"] },
+    ];
+    expect(reconcileTemplateSelection("linear", templates)).toBe("linear");
+    expect(reconcileTemplateSelection("missing", templates)).toBe("github");
+    expect(reconcileTemplateSelection(null, [])).toBeNull();
+    expect(templateSecretFields(templates[0]!)).toEqual([
+      {
+        key: "TOKEN",
+        label: "TOKEN",
+        description: "Secret required by the github template.",
+        required: true,
+        secret: true,
+      },
+    ]);
+    expect(templateDescriptorFingerprint(templates[0])).toBe('github:["TOKEN"]');
+    expect(templateDescriptorFingerprint(null)).toBeNull();
+  });
+
+  it("whitelists card metadata without returning sessions, commands, stderr, env, or secrets", () => {
+    const details = safeMcpSourceDetails("mcp_http", {
+      endpoint: "https://example.com/mcp?api_key=secret",
+      negotiatedProtocolVersion: "2025-06-18",
+      sessionId: "private-session",
+      command: "node",
+      stderr: "private output",
+      env: { TOKEN: "secret" },
+    });
+
+    expect(details).toEqual({
+      endpointLabel: "https://example.com/mcp",
+      templateName: null,
+      negotiatedProtocolVersion: "2025-06-18",
+      allowPrivateNetwork: false,
+    });
+    expect(JSON.stringify(details)).not.toContain("secret");
+    expect(JSON.stringify(details)).not.toContain("private-session");
+    expect(JSON.stringify(details)).not.toContain("node");
+  });
+
+  it("uses a placeholder token in downstream client configuration", () => {
+    const snippet = downstreamMcpSnippet("https://executor.example.test/admin");
+    expect(snippet).toContain("https://executor.example.test/mcp");
+    expect(snippet).toContain(MCP_TOKEN_PLACEHOLDER);
+    expect(snippet).not.toContain("sk_live");
+  });
+});
diff --git a/web/src/lib/mcp-source-state.ts b/web/src/lib/mcp-source-state.ts
new file mode 100644
index 000000000..e1938c274
--- /dev/null
+++ b/web/src/lib/mcp-source-state.ts
@@ -0,0 +1,201 @@
+export type McpSourceKind = "mcp_http" | "mcp_stdio";
+
+export type McpTemplateField = {
+  readonly key: string;
+  readonly label: string;
+  readonly description: string;
+  readonly required: boolean;
+  readonly secret: boolean;
+};
+
+export type McpTemplateDraft = Readonly<Record<string, string>>;
+
+export type McpHttpAuthDraft = {
+  readonly type: "none" | "bearer" | "basic" | "api_key_header" | "oauth_access_token";
+  readonly headerName: string;
+  readonly username: string;
+  readonly secret: string;
+};
+
+export type McpTemplateSummary = {
+  readonly name: string;
+  readonly secretFields: readonly string[];
+};
+
+export type SafeMcpSourceDetails = {
+  readonly endpointLabel: string | null;
+  readonly templateName: string | null;
+  readonly negotiatedProtocolVersion: string | null;
+  readonly allowPrivateNetwork: boolean;
+};
+
+export const MCP_TOKEN_PLACEHOLDER = "<EXECUTOR_API_TOKEN>";
+
+export function mcpHttpFingerprint(endpoint: string, allowPrivateNetwork: boolean) {
+  return `${allowPrivateNetwork ? "private" : "public"}:${endpoint.trim()}`;
+}
+
+export function requiresPrivateNetworkOptIn(endpoint: string) {
+  const url = parseHttpUrl(endpoint);
+  if (url === null) return false;
+  const host = url.hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  if (host === "localhost" || host.endsWith(".localhost") || host.endsWith(".local")) return true;
+  if (host === "::1" || isPrivateIpv6(host)) {
+    return true;
+  }
+  const octets = host.split(".").map(Number);
+  if (octets.length !== 4 || octets.some((octet) => !Number.isInteger(octet))) return false;
+  return isPrivateIpv4(octets);
+}
+
+function isPrivateIpv4(octets: readonly number[]) {
+  if (octets[0] === 10 || octets[0] === 127) return true;
+  if (octets[0] === 169 && octets[1] === 254) return true;
+  if (octets[0] === 172 && octets[1] >= 16 && octets[1] <= 31) return true;
+  return octets[0] === 192 && octets[1] === 168;
+}
+
+export function redactedEndpointLabel(endpoint: string) {
+  const url = parseHttpUrl(endpoint);
+  if (url === null) return null;
+  return `${url.origin}${url.pathname}`;
+}
+
+export function validateTemplateDraft(
+  fields: readonly McpTemplateField[],
+  draft: McpTemplateDraft,
+) {
+  const allowedKeys = new Set(fields.map((field) => field.key));
+  const hasUnknownField = Object.keys(draft).some((key) => !allowedKeys.has(key));
+  if (hasUnknownField) return null;
+
+  const values: Record<string, string> = {};
+  for (const field of fields) {
+    const rawValue = draft[field.key] ?? "";
+    if (field.required && rawValue.trim() === "") return null;
+    if (rawValue !== "") values[field.key] = field.secret ? rawValue : rawValue.trim();
+  }
+  return values;
+}
+
+export function buildMcpHttpCredential(draft: McpHttpAuthDraft) {
+  if (draft.type === "none") return { credential: null } as const;
+  if (draft.secret.trim() === "") return null;
+  if (draft.type === "bearer") {
+    return { credential: { type: "bearer", token: draft.secret } } as const;
+  }
+  if (draft.type === "basic") {
+    const username = draft.username.trim();
+    if (username === "") return null;
+    return { credential: { type: "basic", username, password: draft.secret } } as const;
+  }
+  if (draft.type === "oauth_access_token") {
+    return {
+      credential: { type: "oauth_access_token", accessToken: draft.secret },
+    } as const;
+  }
+  const name = draft.headerName.trim();
+  if (name === "") return null;
+  return { credential: { type: "api_key_header", name, value: draft.secret } } as const;
+}
+
+export function validateTemplateCatalog(templates: readonly McpTemplateSummary[]) {
+  const names = new Set<string>();
+  const validated: McpTemplateSummary[] = [];
+  for (const template of templates) {
+    if (template.name.trim() === "" || names.has(template.name)) return null;
+    names.add(template.name);
+    const fields = new Set<string>();
+    for (const field of template.secretFields) {
+      if (field.trim() === "" || fields.has(field)) return null;
+      fields.add(field);
+    }
+    validated.push({ name: template.name, secretFields: [...template.secretFields] });
+  }
+  return validated;
+}
+
+export function reconcileTemplateSelection(
+  selected: string | null,
+  templates: readonly McpTemplateSummary[],
+) {
+  if (selected !== null && templates.some((template) => template.name === selected)) {
+    return selected;
+  }
+  return templates[0]?.name ?? null;
+}
+
+export function templateDescriptorFingerprint(template: McpTemplateSummary | null | undefined) {
+  return template === null || template === undefined
+    ? null
+    : `${template.name}:${JSON.stringify(template.secretFields)}`;
+}
+
+export function templateSecretFields(template: McpTemplateSummary): readonly McpTemplateField[] {
+  return template.secretFields.map((key) => ({
+    key,
+    label: key,
+    description: `Secret required by the ${template.name} template.`,
+    required: true,
+    secret: true,
+  }));
+}
+
+export function safeMcpSourceDetails(
+  kind: McpSourceKind,
+  configuration: Readonly<Record<string, unknown>>,
+): SafeMcpSourceDetails {
+  return {
+    endpointLabel:
+      kind === "mcp_http" && typeof configuration.endpoint === "string"
+        ? redactedEndpointLabel(configuration.endpoint)
+        : null,
+    templateName:
+      kind === "mcp_stdio" && typeof configuration.templateName === "string"
+        ? configuration.templateName
+        : null,
+    negotiatedProtocolVersion:
+      typeof configuration.negotiatedProtocolVersion === "string"
+        ? configuration.negotiatedProtocolVersion
+        : null,
+    allowPrivateNetwork: configuration.allowPrivateNetwork === true,
+  };
+}
+
+export function downstreamMcpSnippet(origin: string) {
+  const endpoint = new URL("/mcp", origin).toString();
+  return JSON.stringify(
+    {
+      mcpServers: {
+        executor: {
+          type: "http",
+          url: endpoint,
+          headers: { Authorization: `Bearer ${MCP_TOKEN_PLACEHOLDER}` },
+        },
+      },
+    },
+    null,
+    2,
+  );
+}
+
+function parseHttpUrl(value: string) {
+  const normalized = value.trim();
+  if (!URL.canParse(normalized)) return null;
+  const url = new URL(normalized);
+  return url.protocol === "http:" || url.protocol === "https:" ? url : null;
+}
+
+function isPrivateIpv6(host: string) {
+  if (host.startsWith("fc") || host.startsWith("fd")) return true;
+  if (host.startsWith("::ffff:")) {
+    const groups = host.split(":");
+    const high = Number.parseInt(groups.at(-2) ?? "", 16);
+    const low = Number.parseInt(groups.at(-1) ?? "", 16);
+    if (Number.isInteger(high) && Number.isInteger(low)) {
+      return isPrivateIpv4([high >> 8, high & 0xff, low >> 8, low & 0xff]);
+    }
+  }
+  const firstGroup = Number.parseInt(host.split(":", 1)[0] ?? "", 16);
+  return Number.isInteger(firstGroup) && firstGroup >= 0xfe80 && firstGroup <= 0xfebf;
+}
diff --git a/web/src/lib/navigation.test.ts b/web/src/lib/navigation.test.ts
new file mode 100644
index 000000000..bf001f923
--- /dev/null
+++ b/web/src/lib/navigation.test.ts
@@ -0,0 +1,55 @@
+import { describe, expect, it } from "@effect/vitest";
+import { consumeSetupToken, routeDestination, safeReturnTo } from "./navigation";
+
+describe("dashboard navigation helpers", () => {
+  it("consumes a setup token without putting it in the replacement URL", () => {
+    let replacement = "";
+    const token = consumeSetupToken(
+      new URL("http://executor.local/setup?from=terminal#token=set_secret"),
+      (nextUrl) => {
+        replacement = nextUrl;
+      },
+    );
+
+    expect(token).toBe("set_secret");
+    expect(replacement).toBe("/setup?from=terminal");
+    expect(replacement).not.toContain("set_secret");
+  });
+
+  it("accepts only protected same-origin return paths", () => {
+    expect(safeReturnTo("/tokens?created=true", "http://executor.local")).toBe(
+      "/tokens?created=true",
+    );
+    expect(safeReturnTo("/tokens#active", "http://executor.local")).toBe("/tokens#active");
+    expect(safeReturnTo("/tokens#token=set_secret", "http://executor.local")).toBe("/tokens");
+    expect(safeReturnTo("//attacker.example/tokens", "http://executor.local")).toBeNull();
+    expect(safeReturnTo("https://attacker.example/tokens", "http://executor.local")).toBeNull();
+    expect(safeReturnTo("/login", "http://executor.local")).toBeNull();
+  });
+
+  it("retains an internal destination across login", () => {
+    const destination = routeDestination({
+      pathname: "/tokens",
+      search: "?filter=active",
+      hash: "#latest",
+      origin: "http://executor.local",
+      setupRequired: false,
+      authenticated: false,
+    });
+
+    expect(destination).toBe("/login?returnTo=%2Ftokens%3Ffilter%3Dactive%23latest");
+  });
+
+  it("omits a setup token fragment from the login return path", () => {
+    const destination = routeDestination({
+      pathname: "/tokens",
+      search: "",
+      hash: "#token=set_secret",
+      origin: "http://executor.local",
+      setupRequired: false,
+      authenticated: false,
+    });
+
+    expect(destination).toBe("/login?returnTo=%2Ftokens");
+  });
+});
diff --git a/web/src/lib/navigation.ts b/web/src/lib/navigation.ts
new file mode 100644
index 000000000..902569978
--- /dev/null
+++ b/web/src/lib/navigation.ts
@@ -0,0 +1,58 @@
+const protectedRoutes = ["/sources", "/tools", "/approvals", "/logs", "/tokens"];
+
+export function isProtectedPath(pathname: string) {
+  return protectedRoutes.some((route) => pathname === route || pathname.startsWith(`${route}/`));
+}
+
+export function safeReturnTo(value: string | null, origin: string) {
+  if (value === null || !value.startsWith("/") || value.startsWith("//")) return null;
+
+  if (!URL.canParse(value, origin)) return null;
+  const url = new URL(value, origin);
+
+  if (url.origin !== origin || !isProtectedPath(url.pathname)) return null;
+  return `${url.pathname}${url.search}${safeReturnHash(url.hash)}`;
+}
+
+export function safeReturnHash(hash: string) {
+  if (hash === "") return "";
+  return new URLSearchParams(hash.slice(1)).has("token") ? "" : hash;
+}
+
+export function consumeSetupToken(url: URL, replace: (nextUrl: string) => void) {
+  if (url.hash === "") return null;
+
+  const token = new URLSearchParams(url.hash.slice(1)).get("token");
+  replace(`${url.pathname}${url.search}`);
+  return token === null || token === "" ? null : token;
+}
+
+export function routeDestination(input: {
+  pathname: string;
+  search: string;
+  hash: string;
+  origin: string;
+  setupRequired: boolean;
+  authenticated: boolean;
+}) {
+  const { pathname, search, hash, origin, setupRequired, authenticated } = input;
+
+  if (setupRequired) return pathname === "/setup" ? null : "/setup";
+
+  if (authenticated) {
+    if (pathname === "/login") {
+      const returnTo = new URLSearchParams(search).get("returnTo");
+      return safeReturnTo(returnTo, origin) ?? "/sources";
+    }
+    if (pathname === "/" || pathname === "/setup") return "/sources";
+    if (!isProtectedPath(pathname)) return "/sources";
+    return null;
+  }
+
+  if (pathname === "/login") return null;
+  if (isProtectedPath(pathname)) {
+    const returnTo = `${pathname}${search}${safeReturnHash(hash)}`;
+    return `/login?returnTo=${encodeURIComponent(returnTo)}`;
+  }
+  return "/login";
+}
diff --git a/web/src/lib/oauth-connection-state.test.ts b/web/src/lib/oauth-connection-state.test.ts
new file mode 100644
index 000000000..418607fde
--- /dev/null
+++ b/web/src/lib/oauth-connection-state.test.ts
@@ -0,0 +1,198 @@
+import { describe, expect, it } from "@effect/vitest";
+import {
+  buildOAuthConnectionInput,
+  canDisconnectOAuth,
+  draftFromOAuthSummary,
+  normalizeOAuthScopes,
+  oauthCallbackConnectionId,
+  oauthCallbackOutcomeNotice,
+  oauthCallbackNoticeWithoutEligibleSources,
+  oauthCallbackRefreshKey,
+  safeAuthorizationUrl,
+  withoutOAuthCallbackParameters,
+  type OAuthConnectionSummary,
+} from "./oauth-connection-state";
+
+const summary: OAuthConnectionSummary = {
+  id: "oauth-1",
+  credentialKey: "oauth",
+  revision: 4,
+  status: "connected",
+  issuer: "https://identity.example.test",
+  clientId: "executor",
+  clientAuthMethod: "client_secret_basic",
+  callbackUrl: "https://executor.example.test/api/v1/oauth/callback",
+  requestedScopes: ["read", "write"],
+  grantedScopes: ["read"],
+  hasClientSecret: true,
+  hasRefreshToken: true,
+  accessExpiresAt: 100,
+  authorizedAt: 90,
+  lastRefreshedAt: 95,
+  errorCode: null,
+  managedOAuthEligible: true,
+};
+
+describe("OAuth connection state", () => {
+  it("builds a confidential-client update with explicit secret preservation", () => {
+    const draft = draftFromOAuthSummary(summary);
+    expect(buildOAuthConnectionInput(draft, summary.revision)).toEqual({
+      expectedRevision: 4,
+      discovery: { type: "issuer", issuer: "https://identity.example.test" },
+      client: {
+        clientId: "executor",
+        authentication: "client_secret_basic",
+        clientSecret: { action: "preserve" },
+      },
+      scopes: ["read", "write"],
+    });
+  });
+
+  it("makes changing to a public client an explicit secret-clearing operation", () => {
+    const draft = { ...draftFromOAuthSummary(summary), clientKind: "public" as const };
+    expect(buildOAuthConnectionInput(draft, 4)).toEqual({
+      expectedRevision: 4,
+      discovery: { type: "issuer", issuer: "https://identity.example.test" },
+      client: { clientId: "executor", authentication: "none" },
+      scopes: ["read", "write"],
+    });
+  });
+
+  it("requires a replacement value and never trims secret bytes", () => {
+    const draft = {
+      ...draftFromOAuthSummary(summary),
+      clientSecretAction: "replace" as const,
+      clientSecret: " exact secret ",
+    };
+    expect(buildOAuthConnectionInput(draft, 4)?.client).toEqual({
+      clientId: "executor",
+      authentication: "client_secret_basic",
+      clientSecret: { action: "replace", value: " exact secret " },
+    });
+    expect(buildOAuthConnectionInput({ ...draft, clientSecret: "" }, 4)).toBeNull();
+  });
+
+  it("builds MCP protected-resource discovery with an optional server override", () => {
+    const draft = {
+      ...draftFromOAuthSummary(summary),
+      issuer: "",
+      clientKind: "public" as const,
+    };
+    expect(buildOAuthConnectionInput(draft, 0, "mcp")?.discovery).toEqual({ type: "mcp" });
+    expect(
+      buildOAuthConnectionInput(
+        { ...draft, issuer: "https://identity.example.test/issuer" },
+        0,
+        "mcp",
+      )?.discovery,
+    ).toEqual({
+      type: "mcp",
+      authorizationServer: "https://identity.example.test/issuer",
+    });
+  });
+
+  it("preserves the exact root issuer path after validating the URL", () => {
+    const draft = {
+      ...draftFromOAuthSummary(summary),
+      clientKind: "public" as const,
+    };
+    expect(
+      buildOAuthConnectionInput({ ...draft, issuer: "https://identity.example.test" }, 4),
+    ).toMatchObject({
+      discovery: { type: "issuer", issuer: "https://identity.example.test" },
+    });
+    expect(
+      buildOAuthConnectionInput({ ...draft, issuer: "https://identity.example.test/" }, 4),
+    ).toMatchObject({
+      discovery: { type: "issuer", issuer: "https://identity.example.test/" },
+    });
+  });
+
+  it("normalizes and de-duplicates requested scopes", () => {
+    expect(normalizeOAuthScopes("read, write\nread profile")).toEqual(["read", "write", "profile"]);
+  });
+
+  it("uses only allowlisted callback fields as an opaque refetch key", () => {
+    const parameters = new URLSearchParams({
+      result: "failed",
+      oauth: "connection-1",
+      error_description: "provider secret detail",
+      code: "authorization-code",
+    });
+    expect(oauthCallbackRefreshKey(parameters)).toBe("failed:connection-1");
+    expect(oauthCallbackConnectionId("failed:connection-1")).toBe("connection-1");
+    parameters.set("result", "success_refresh_failed");
+    expect(oauthCallbackRefreshKey(parameters)).toBe("success_refresh_failed:connection-1");
+    parameters.set("result", "provider-specific-value");
+    expect(oauthCallbackRefreshKey(parameters)).toBeNull();
+  });
+
+  it("cleans only the fixed callback fields after refetch", () => {
+    const cleaned = withoutOAuthCallbackParameters(
+      new URL("https://executor.test/sources?oauth=connection-1&result=success&filter=active#list"),
+    );
+    expect(cleaned.toString()).toBe("https://executor.test/sources?filter=active#list");
+  });
+
+  it("returns fixed callback notices without provider-controlled detail", () => {
+    expect(oauthCallbackOutcomeNotice("failed:connection-1", true).message).toContain(
+      "did not complete",
+    );
+    expect(oauthCallbackOutcomeNotice("success:connection-1", true).message).toContain("completed");
+    expect(oauthCallbackOutcomeNotice("success_refresh_failed:connection-1", true)).toEqual({
+      tone: "error",
+      message:
+        "OAuth authorization completed, but the source catalog could not be refreshed. The connection remains authorized; retry the source refresh.",
+    });
+    expect(oauthCallbackOutcomeNotice("success:missing", false).message).toContain("no matching");
+  });
+
+  it("handles a callback after loading when no OAuth-capable source can report it", () => {
+    expect(
+      oauthCallbackNoticeWithoutEligibleSources("failed:missing", ["mcp_stdio"], false)?.message,
+    ).toContain("did not complete");
+    expect(
+      oauthCallbackNoticeWithoutEligibleSources("failed:missing", ["openapi"], false),
+    ).toBeNull();
+    expect(oauthCallbackNoticeWithoutEligibleSources("failed:missing", [], true)).toBeNull();
+  });
+
+  it("allows secure authorization destinations and loopback HTTP only", () => {
+    expect(safeAuthorizationUrl("https://identity.example.test/authorize?state=opaque")).toBe(
+      "https://identity.example.test/authorize?state=opaque",
+    );
+    expect(safeAuthorizationUrl("http://127.0.0.42:9911/authorize?state=opaque")).toBe(
+      "http://127.0.0.42:9911/authorize?state=opaque",
+    );
+    expect(safeAuthorizationUrl("http://identity.example.test/authorize")).toBeNull();
+    expect(safeAuthorizationUrl("https://operator@identity.example.test/authorize")).toBeNull();
+    expect(safeAuthorizationUrl("https://identity.example.test/authorize#token")).toBeNull();
+    expect(safeAuthorizationUrl("javascript:alert(1)")).toBeNull();
+  });
+
+  it("rejects unsafe issuer URLs before building a save payload", () => {
+    const draft = draftFromOAuthSummary(summary);
+    expect(
+      buildOAuthConnectionInput({ ...draft, issuer: "http://identity.example.test" }, 4),
+    ).toBeNull();
+    expect(
+      buildOAuthConnectionInput({ ...draft, issuer: "https://user@identity.example.test" }, 4),
+    ).toBeNull();
+    expect(
+      buildOAuthConnectionInput({ ...draft, issuer: "https://identity.example.test?tenant=a" }, 4),
+    ).toBeNull();
+    expect(
+      buildOAuthConnectionInput({ ...draft, issuer: "https://identity.example.test#fragment" }, 4),
+    ).toBeNull();
+    expect(
+      buildOAuthConnectionInput({ ...draft, issuer: "http://localhost:8443/issuer" }, 4),
+    ).not.toBeNull();
+  });
+
+  it("disconnects token-bearing statuses without assuming a refresh token exists", () => {
+    expect(canDisconnectOAuth("connected")).toBe(true);
+    expect(canDisconnectOAuth("reauthorization_required")).toBe(true);
+    expect(canDisconnectOAuth("ready_to_connect")).toBe(false);
+    expect(canDisconnectOAuth("connecting")).toBe(false);
+  });
+});
diff --git a/web/src/lib/oauth-connection-state.ts b/web/src/lib/oauth-connection-state.ts
new file mode 100644
index 000000000..9ab5c9263
--- /dev/null
+++ b/web/src/lib/oauth-connection-state.ts
@@ -0,0 +1,308 @@
+export type OAuthClientAuthentication = "none" | "client_secret_basic" | "client_secret_post";
+
+export type OAuthConnectionStatus =
+  | "not_configured"
+  | "ready_to_connect"
+  | "connecting"
+  | "connected"
+  | "reauthorization_required"
+  | "error";
+
+export type OAuthConnectionSummary = {
+  readonly id: string;
+  readonly credentialKey: string;
+  readonly revision: number;
+  readonly status: OAuthConnectionStatus;
+  readonly issuer: string;
+  readonly clientId: string;
+  readonly clientAuthMethod: OAuthClientAuthentication;
+  readonly callbackUrl: string;
+  readonly requestedScopes: readonly string[];
+  readonly grantedScopes: readonly string[];
+  readonly hasClientSecret: boolean;
+  readonly hasRefreshToken: boolean;
+  readonly accessExpiresAt: number | null;
+  readonly authorizedAt: number | null;
+  readonly lastRefreshedAt: number | null;
+  readonly errorCode: string | null;
+  readonly managedOAuthEligible: boolean;
+};
+
+export type OAuthConnectionList = {
+  readonly connections: readonly OAuthConnectionSummary[];
+  readonly availableCredentials: readonly OAuthAvailableCredential[];
+};
+
+export type OAuthAvailableCredential = {
+  readonly credentialKey: string;
+  readonly protocol: "openapi" | "graphql" | "mcp_http";
+  readonly requestedScopes: readonly string[];
+  readonly managedOAuthEligible: true;
+};
+
+export type OAuthClientSecretMutation =
+  | { readonly action: "preserve" }
+  | { readonly action: "replace"; readonly value: string };
+
+export type OAuthConnectionInput = {
+  readonly expectedRevision: number;
+  readonly discovery:
+    | { readonly type: "issuer"; readonly issuer: string }
+    | { readonly type: "mcp"; readonly authorizationServer?: string };
+  readonly client:
+    | { readonly clientId: string; readonly authentication: "none" }
+    | {
+        readonly clientId: string;
+        readonly authentication: "client_secret_basic" | "client_secret_post";
+        readonly clientSecret: OAuthClientSecretMutation;
+      };
+  readonly scopes: readonly string[];
+};
+
+export type OAuthAuthorization = {
+  readonly authorizationUrl: string;
+};
+
+export type OAuthOperationError = {
+  readonly code: string;
+  readonly displayMessage: string;
+  readonly requestId: string | null;
+  readonly status: number;
+};
+
+export type OAuthOperationResult<Value> =
+  | { readonly ok: true; readonly value: Value }
+  | { readonly ok: false; readonly error: OAuthOperationError };
+
+export type OAuthConnectionOperations = {
+  readonly load: (
+    sourceId: string,
+    signal: AbortSignal,
+  ) => Promise<OAuthOperationResult<OAuthConnectionList>>;
+  readonly save: (
+    sourceId: string,
+    credentialKey: string,
+    input: OAuthConnectionInput,
+    signal: AbortSignal,
+  ) => Promise<OAuthOperationResult<OAuthConnectionSummary>>;
+  readonly authorize: (
+    sourceId: string,
+    credentialKey: string,
+    input: { readonly expectedRevision: number },
+    signal: AbortSignal,
+  ) => Promise<OAuthOperationResult<OAuthAuthorization>>;
+  readonly disconnect: (
+    sourceId: string,
+    credentialKey: string,
+    input: { readonly expectedRevision: number },
+    signal: AbortSignal,
+  ) => Promise<OAuthOperationResult<OAuthConnectionSummary>>;
+  readonly remove: (
+    sourceId: string,
+    credentialKey: string,
+    input: { readonly expectedRevision: number },
+    signal: AbortSignal,
+  ) => Promise<OAuthOperationResult<void>>;
+};
+
+export type OAuthConnectionDraft = {
+  readonly issuer: string;
+  readonly clientKind: "public" | "confidential";
+  readonly clientId: string;
+  readonly clientAuthMethod: "client_secret_basic" | "client_secret_post";
+  readonly clientSecretAction: "preserve" | "replace" | "clear";
+  readonly clientSecret: string;
+  readonly scopes: string;
+};
+
+export function draftFromOAuthSummary(summary: OAuthConnectionSummary): OAuthConnectionDraft {
+  const confidential = summary.clientAuthMethod !== "none";
+  return {
+    issuer: summary.issuer,
+    clientKind: confidential ? "confidential" : "public",
+    clientId: summary.clientId,
+    clientAuthMethod: confidential ? summary.clientAuthMethod : "client_secret_basic",
+    clientSecretAction: confidential && summary.hasClientSecret ? "preserve" : "clear",
+    clientSecret: "",
+    scopes: summary.requestedScopes.join(" "),
+  };
+}
+
+export function emptyOAuthDraft(): OAuthConnectionDraft {
+  return {
+    issuer: "",
+    clientKind: "public",
+    clientId: "",
+    clientAuthMethod: "client_secret_basic",
+    clientSecretAction: "clear",
+    clientSecret: "",
+    scopes: "",
+  };
+}
+
+export function buildOAuthConnectionInput(
+  draft: OAuthConnectionDraft,
+  expectedRevision: number,
+  discoveryType: "issuer" | "mcp" = "issuer",
+): OAuthConnectionInput | null {
+  const clientId = draft.clientId.trim();
+  const issuer = draft.issuer.trim() === "" ? null : normalizedHttpUrl(draft.issuer);
+  if (clientId === "" || (discoveryType === "issuer" && issuer === null)) return null;
+  if (draft.issuer.trim() !== "" && issuer === null) return null;
+  const discovery: OAuthConnectionInput["discovery"] =
+    discoveryType === "mcp"
+      ? {
+          type: "mcp",
+          ...(issuer === null ? {} : { authorizationServer: issuer }),
+        }
+      : { type: "issuer", issuer: issuer ?? "" };
+
+  const scopes = normalizeOAuthScopes(draft.scopes);
+  if (draft.clientKind === "public") {
+    return {
+      expectedRevision,
+      discovery,
+      client: { clientId, authentication: "none" },
+      scopes,
+    };
+  }
+
+  if (draft.clientSecretAction === "clear") return null;
+  if (draft.clientSecretAction === "replace" && draft.clientSecret === "") return null;
+  const clientSecret =
+    draft.clientSecretAction === "replace"
+      ? { action: "replace" as const, value: draft.clientSecret }
+      : { action: "preserve" as const };
+  return {
+    expectedRevision,
+    discovery,
+    client: {
+      clientId,
+      authentication: draft.clientAuthMethod,
+      clientSecret,
+    },
+    scopes,
+  };
+}
+
+export function normalizeOAuthScopes(value: string) {
+  return [...new Set(value.split(/[\s,]+/u).filter(Boolean))];
+}
+
+export function oauthCallbackRefreshKey(parameters: URLSearchParams) {
+  const result = parameters.get("result");
+  if (result !== "success" && result !== "success_refresh_failed" && result !== "failed") {
+    return null;
+  }
+  const connectionId = parameters.get("oauth");
+  if (connectionId === null || connectionId.trim() === "") return null;
+  return `${result}:${connectionId}`;
+}
+
+export function oauthCallbackConnectionId(refreshKey: string | null) {
+  if (refreshKey === null) return null;
+  const separator = refreshKey.indexOf(":");
+  return separator < 0 ? null : refreshKey.slice(separator + 1);
+}
+
+export function oauthCallbackOutcomeNotice(refreshKey: string, matched: boolean) {
+  if (refreshKey.startsWith("failed:")) {
+    return {
+      tone: "error" as const,
+      message: "OAuth authorization did not complete. Review the connection status and try again.",
+    };
+  }
+  if (!matched) {
+    return {
+      tone: "error" as const,
+      message: "OAuth returned, but no matching managed connection is available.",
+    };
+  }
+  if (refreshKey.startsWith("success_refresh_failed:")) {
+    return {
+      tone: "error" as const,
+      message:
+        "OAuth authorization completed, but the source catalog could not be refreshed. The connection remains authorized; retry the source refresh.",
+    };
+  }
+  return {
+    tone: "success" as const,
+    message: "OAuth authorization completed and the connection status was refreshed.",
+  };
+}
+
+export function oauthCallbackNoticeWithoutEligibleSources(
+  refreshKey: string | null,
+  sourceKinds: readonly string[],
+  loading: boolean,
+) {
+  if (
+    refreshKey === null ||
+    loading ||
+    sourceKinds.some((kind) => kind === "openapi" || kind === "graphql" || kind === "mcp_http")
+  ) {
+    return null;
+  }
+  return oauthCallbackOutcomeNotice(refreshKey, false);
+}
+
+export function withoutOAuthCallbackParameters(value: URL) {
+  const url = new URL(value);
+  url.searchParams.delete("oauth");
+  url.searchParams.delete("result");
+  return url;
+}
+
+export function safeAuthorizationUrl(value: string) {
+  if (!URL.canParse(value)) return null;
+  const url = new URL(value);
+  if (!isSecureOAuthUrl(url) || hasUserInfo(url) || url.hash !== "") return null;
+  return url.toString();
+}
+
+export function oauthStatusTone(status: OAuthConnectionStatus) {
+  if (status === "connected") return "connected";
+  if (status === "error" || status === "reauthorization_required") return "error";
+  if (status === "connecting") return "pending";
+  return "neutral";
+}
+
+export function oauthStatusLabel(status: OAuthConnectionStatus) {
+  if (status === "not_configured") return "Not configured";
+  if (status === "ready_to_connect") return "Ready to connect";
+  if (status === "connecting") return "Connecting";
+  if (status === "connected") return "Connected";
+  if (status === "reauthorization_required") return "Reconnect required";
+  return "Connection error";
+}
+
+export function canDisconnectOAuth(status: OAuthConnectionStatus) {
+  return status === "connected" || status === "reauthorization_required";
+}
+
+function normalizedHttpUrl(value: string) {
+  const normalized = value.trim();
+  if (!URL.canParse(normalized)) return null;
+  const url = new URL(normalized);
+  if (!isSecureOAuthUrl(url) || hasUserInfo(url) || url.search !== "" || url.hash !== "") {
+    return null;
+  }
+  return normalized;
+}
+
+function isSecureOAuthUrl(url: URL) {
+  if (url.protocol === "https:") return true;
+  if (url.protocol !== "http:") return false;
+  const host = url.hostname.toLowerCase().replace(/^\[|\]$/gu, "");
+  if (host === "localhost" || host.endsWith(".localhost") || host === "::1") return true;
+  const octets = host.split(".").map(Number);
+  return (
+    octets.length === 4 &&
+    octets.every((octet) => Number.isInteger(octet) && octet >= 0 && octet <= 255) &&
+    octets[0] === 127
+  );
+}
+
+function hasUserInfo(url: URL) {
+  return url.username !== "" || url.password !== "";
+}
diff --git a/web/src/lib/openapi-credentials.test.ts b/web/src/lib/openapi-credentials.test.ts
new file mode 100644
index 000000000..3bdc15aa9
--- /dev/null
+++ b/web/src/lib/openapi-credentials.test.ts
@@ -0,0 +1,50 @@
+import { describe, expect, it } from "@effect/vitest";
+import {
+  buildCredentialMap,
+  duplicateCredentialNames,
+  type CredentialDraft,
+} from "./openapi-credentials";
+
+function draft(
+  name: string,
+  credentialType: CredentialDraft["credentialType"],
+  value: string,
+  username = "",
+): CredentialDraft {
+  return { key: name, name, credentialType, enabled: true, value, username };
+}
+
+describe("OpenAPI credential drafts", () => {
+  it("serializes every supported credential without changing OAuth field names", () => {
+    expect(
+      buildCredentialMap([
+        draft("key", "api_key", "key-secret"),
+        draft("bearer", "bearer", "bearer-secret"),
+        draft("basic", "basic", "password", "davis"),
+        draft("oauth", "oauth_access_token", "oauth-secret"),
+      ]),
+    ).toEqual({
+      key: { type: "api_key", value: "key-secret" },
+      bearer: { type: "bearer", token: "bearer-secret" },
+      basic: { type: "basic", username: "davis", password: "password" },
+      oauth: { type: "oauth_access_token", access_token: "oauth-secret" },
+    });
+  });
+
+  it("ignores disabled preview schemes", () => {
+    expect(
+      buildCredentialMap([{ ...draft("unused", "bearer", "secret"), enabled: false }]),
+    ).toEqual({});
+  });
+
+  it("rejects duplicate trimmed scheme names without dropping a secret", () => {
+    const rows = [draft("auth", "bearer", "one"), draft(" auth ", "bearer", "two")];
+    expect(duplicateCredentialNames(rows)).toEqual(["auth"]);
+    expect(buildCredentialMap(rows)).toBeNull();
+  });
+
+  it("rejects enabled credentials with missing names or secret values", () => {
+    expect(buildCredentialMap([draft("", "api_key", "secret")])).toBeNull();
+    expect(buildCredentialMap([draft("auth", "api_key", "")])).toBeNull();
+  });
+});
diff --git a/web/src/lib/openapi-credentials.ts b/web/src/lib/openapi-credentials.ts
new file mode 100644
index 000000000..bba9371e9
--- /dev/null
+++ b/web/src/lib/openapi-credentials.ts
@@ -0,0 +1,49 @@
+import type { OpenApiStaticCredential } from "$lib/api";
+
+export type SupportedCredentialType = "api_key" | "bearer" | "basic" | "oauth_access_token";
+
+export type CredentialDraft = {
+  key: string;
+  name: string;
+  credentialType: SupportedCredentialType;
+  enabled: boolean;
+  value: string;
+  username: string;
+};
+
+export function buildCredentialMap(rows: readonly CredentialDraft[]) {
+  const credentials: Record<string, OpenApiStaticCredential> = {};
+  const names = new Set<string>();
+  for (const row of rows) {
+    if (!row.enabled) continue;
+    const name = row.name.trim();
+    if (name === "" || row.value === "" || names.has(name)) return null;
+    names.add(name);
+    if (row.credentialType === "api_key") {
+      credentials[name] = { type: "api_key", value: row.value };
+    } else if (row.credentialType === "bearer") {
+      credentials[name] = { type: "bearer", token: row.value };
+    } else if (row.credentialType === "oauth_access_token") {
+      credentials[name] = { type: "oauth_access_token", access_token: row.value };
+    } else {
+      credentials[name] = { type: "basic", username: row.username, password: row.value };
+    }
+  }
+  return credentials;
+}
+
+export function duplicateCredentialNames(rows: readonly CredentialDraft[]) {
+  const seen = new Set<string>();
+  const duplicates = new Set<string>();
+  for (const row of rows) {
+    if (!row.enabled) continue;
+    const name = row.name.trim();
+    if (name !== "" && seen.has(name)) duplicates.add(name);
+    seen.add(name);
+  }
+  return [...duplicates];
+}
+
+export function isSupportedCredentialType(value: string): value is SupportedCredentialType {
+  return ["api_key", "bearer", "basic", "oauth_access_token"].includes(value);
+}
diff --git a/web/src/lib/source-create-lifecycle.test.ts b/web/src/lib/source-create-lifecycle.test.ts
new file mode 100644
index 000000000..8e57b9f67
--- /dev/null
+++ b/web/src/lib/source-create-lifecycle.test.ts
@@ -0,0 +1,678 @@
+import { describe, expect, it, vi } from "@effect/vitest";
+import { Effect } from "effect";
+import {
+  ApiError,
+  createGraphqlSource,
+  type ApiResult,
+  type Source,
+  type SourceCreateApiResult,
+  type SourceCreationResolution,
+} from "$lib/api";
+import {
+  SOURCE_CREATE_STORAGE_KEY,
+  createSourceCreateCoordinator,
+  isAmbiguousSourceCreateResult,
+  type SourceCreateEnvironment,
+  type SourceCreateInput,
+  type SourceCreateState,
+} from "$lib/source-create-lifecycle";
+
+function sourceFixture(): Source {
+  return {
+    id: "source-1",
+    kind: "graphql",
+    slug: "product",
+    displayName: "Product API",
+    description: null,
+    configuration: { endpoint: "https://api.example.test", allowPrivateNetwork: false },
+    modeOverride: null,
+    healthStatus: "healthy",
+    healthErrorCode: null,
+    revision: 1,
+    catalogRevision: 1,
+    createdAt: 100,
+    updatedAt: 100,
+    lastRefreshedAt: 100,
+    toolCount: 4,
+    tombstonedToolCount: 0,
+  };
+}
+
+function payload(secret = "exact-secret") {
+  return {
+    kind: "graphql",
+    displayName: "Product API",
+    endpoint: "https://api.example.test/graphql",
+    credential: { type: "bearer", token: secret },
+  } satisfies SourceCreateInput;
+}
+
+function deferred<Value>() {
+  let resolve = (_value: Value) => {};
+  const promise = new Promise<Value>((complete) => {
+    resolve = complete;
+  });
+  return { promise, resolve };
+}
+
+class MemoryStorage {
+  readonly values = new Map<string, string>();
+  readonly writes: Array<{ key: string; value: string }> = [];
+
+  getItem(key: string) {
+    return this.values.get(key) ?? null;
+  }
+
+  setItem(key: string, value: string) {
+    this.values.set(key, value);
+    this.writes.push({ key, value });
+  }
+
+  removeItem(key: string) {
+    this.values.delete(key);
+  }
+
+  clone() {
+    const clone = new MemoryStorage();
+    for (const [key, value] of this.values) clone.values.set(key, value);
+    return clone;
+  }
+}
+
+function environment(
+  storage: MemoryStorage,
+  options: {
+    readonly fillRandom?: SourceCreateEnvironment["fillRandom"];
+    readonly wait?: SourceCreateEnvironment["wait"];
+  } = {},
+): SourceCreateEnvironment {
+  return {
+    getStorage: () => storage,
+    fillRandom:
+      options.fillRandom ??
+      ((bytes) => {
+        bytes.fill(0xab);
+      }),
+    wait: options.wait ?? (() => Promise.resolve(true)),
+  };
+}
+
+function apiError(code: string, status: number) {
+  return new ApiError({ code, displayMessage: code, requestId: null, status });
+}
+
+function sourceCreateSuccess() {
+  return {
+    ok: true,
+    value: sourceFixture(),
+    replayProvenance: "none",
+    responseDisposition: "authoritative",
+  } as const satisfies SourceCreateApiResult;
+}
+
+function sourceCreateFailure(
+  code: string,
+  status: number,
+  replayProvenance: SourceCreateApiResult["replayProvenance"] = "none",
+  responseDisposition: SourceCreateApiResult["responseDisposition"] = status >= 400 && status <= 499
+    ? "authoritative"
+    : "ambiguous",
+) {
+  return {
+    ok: false,
+    error: apiError(code, status),
+    replayProvenance,
+    responseDisposition,
+  } as const satisfies SourceCreateApiResult;
+}
+
+function freshSourceResponse(status: number, includeNoStore = true) {
+  const nativeStatus = status < 200 ? 200 : status > 599 ? 599 : status;
+  const headers = includeNoStore ? { "cache-control": "no-store" } : undefined;
+  const response =
+    nativeStatus === 204
+      ? new Response(null, { status: nativeStatus, headers })
+      : Response.json(sourceFixture(), { status: nativeStatus, headers });
+  if (nativeStatus !== status) Object.defineProperty(response, "status", { value: status });
+  return response;
+}
+
+function freshErrorResponse(status: number, code = "invalid_source", includeNoStore = true) {
+  const nativeStatus = status < 200 ? 200 : status > 599 ? 599 : status;
+  const response = Response.json(
+    {
+      error: {
+        code,
+        message: `Failure ${status}`,
+        requestId: `failure-${status}`,
+      },
+    },
+    {
+      status: nativeStatus,
+      headers: includeNoStore ? { "cache-control": "no-store" } : undefined,
+    },
+  );
+  if (nativeStatus !== status) Object.defineProperty(response, "status", { value: status });
+  return response;
+}
+
+function successfulList() {
+  return {
+    ok: true,
+    value: { sources: [sourceFixture()], catalogRevision: 1 },
+  } as const;
+}
+
+function coordinatorHarness(
+  storage: MemoryStorage,
+  overrides: Partial<{
+    environment: SourceCreateEnvironment;
+    create: (
+      input: SourceCreateInput,
+      key: string,
+      signal: AbortSignal,
+    ) => Promise<SourceCreateApiResult>;
+    lookup: (key: string, signal: AbortSignal) => Promise<ApiResult<SourceCreationResolution>>;
+    seal: (key: string, signal: AbortSignal) => Promise<ApiResult<SourceCreationResolution>>;
+    refresh: (signal: AbortSignal) => Promise<ReturnType<typeof successfulList> | null>;
+  }> = {},
+) {
+  const states: SourceCreateState[] = [];
+  const completed: Source[] = [];
+  const coordinator = createSourceCreateCoordinator({
+    environment: overrides.environment ?? environment(storage),
+    create: overrides.create ?? (() => Promise.resolve(sourceCreateSuccess())),
+    lookup:
+      overrides.lookup ??
+      (() =>
+        Promise.resolve({
+          ok: true,
+          value: { kind: "status", status: "missing" },
+        } as const)),
+    seal:
+      overrides.seal ??
+      (() =>
+        Promise.resolve({
+          ok: true,
+          value: { kind: "status", status: "abandoned" },
+        } as const)),
+    refresh: overrides.refresh ?? (() => Promise.resolve(successfulList())),
+    onstatechange: (state) => states.push(state),
+    oncompleted: (source) => completed.push(source),
+  });
+  return { coordinator, states, completed };
+}
+
+describe("source create lifecycle", () => {
+  it("classifies only outcomes that require key reconciliation as ambiguous", () => {
+    expect(isAmbiguousSourceCreateResult(sourceCreateFailure("network_error", 0))).toBe(true);
+    expect(isAmbiguousSourceCreateResult(sourceCreateFailure("request_cancelled", 0))).toBe(true);
+    expect(isAmbiguousSourceCreateResult(sourceCreateFailure("invalid_response", 502))).toBe(true);
+    expect(isAmbiguousSourceCreateResult(sourceCreateFailure("unexpected_client_error", 0))).toBe(
+      true,
+    );
+    expect(isAmbiguousSourceCreateResult(sourceCreateFailure("http_502", 502))).toBe(true);
+    expect(isAmbiguousSourceCreateResult(sourceCreateFailure("http_504", 504))).toBe(true);
+    expect(isAmbiguousSourceCreateResult(sourceCreateFailure("idempotency_in_progress", 409))).toBe(
+      true,
+    );
+    expect(isAmbiguousSourceCreateResult(sourceCreateFailure("unauthorized", 401))).toBe(true);
+    expect(isAmbiguousSourceCreateResult(sourceCreateFailure("typed_gateway_error", 502))).toBe(
+      true,
+    );
+    expect(
+      isAmbiguousSourceCreateResult(
+        sourceCreateFailure("internal_error", 500, "authoritative", "authoritative"),
+      ),
+    ).toBe(false);
+    expect(
+      isAmbiguousSourceCreateResult({
+        ...sourceCreateSuccess(),
+        replayProvenance: "invalid",
+        responseDisposition: "ambiguous",
+      }),
+    ).toBe(true);
+    expect(isAmbiguousSourceCreateResult(sourceCreateFailure("invalid_source", 400))).toBe(false);
+  });
+
+  it("persists only a 128-bit opaque key synchronously before dispatch", async () => {
+    const storage = new MemoryStorage();
+    const submitted: Array<{ input: SourceCreateInput; key: string; stored: string | null }> = [];
+    const input = payload("never-persist-this-secret");
+    const { coordinator } = coordinatorHarness(storage, {
+      create: async (createdInput, key) => {
+        submitted.push({
+          input: createdInput,
+          key,
+          stored: storage.getItem(SOURCE_CREATE_STORAGE_KEY),
+        });
+        return sourceCreateSuccess();
+      },
+    });
+
+    const result = await coordinator.start(input);
+
+    expect(result.ok).toBe(true);
+    expect(submitted).toHaveLength(1);
+    expect(submitted[0]?.key).toMatch(/^[0-9a-f]{32}$/);
+    expect(submitted[0]?.stored).toBe(submitted[0]?.key);
+    expect(submitted[0]?.input).toBe(input);
+    expect(storage.writes).toEqual([
+      { key: SOURCE_CREATE_STORAGE_KEY, value: submitted[0]?.key ?? "" },
+    ]);
+    expect(JSON.stringify(storage.writes)).not.toContain("never-persist-this-secret");
+    expect(storage.getItem(SOURCE_CREATE_STORAGE_KEY)).toBeNull();
+  });
+
+  it("fails closed when secure randomness or tab storage is unavailable", async () => {
+    const randomStorage = new MemoryStorage();
+    const randomCreate = vi.fn();
+    const randomHarness = coordinatorHarness(randomStorage, {
+      environment: environment(randomStorage, {
+        fillRandom: () => Effect.runSync(Effect.fail("randomness unavailable")),
+      }),
+      create: randomCreate,
+    });
+    const storageCreate = vi.fn();
+    const storageHarness = coordinatorHarness(new MemoryStorage(), {
+      environment: {
+        getStorage: () => Effect.runSync(Effect.fail("storage unavailable")),
+        fillRandom: (bytes) => bytes.fill(1),
+        wait: () => Promise.resolve(true),
+      },
+      create: storageCreate,
+    });
+
+    const randomResult = await randomHarness.coordinator.start(payload());
+    const storageResult = await storageHarness.coordinator.start(payload());
+
+    expect(randomResult.ok).toBe(false);
+    expect(!randomResult.ok && randomResult.error.code).toBe(
+      "source_create_randomness_unavailable",
+    );
+    expect(storageResult.ok).toBe(false);
+    expect(!storageResult.ok && storageResult.error.code).toBe("source_create_storage_unavailable");
+    expect(randomCreate).not.toHaveBeenCalled();
+    expect(storageCreate).not.toHaveBeenCalled();
+  });
+
+  it("retries an ambiguous live request with the exact key and in-memory payload", async () => {
+    const storage = new MemoryStorage();
+    const calls: Array<{ input: SourceCreateInput; key: string }> = [];
+    let createCalls = 0;
+    const { coordinator } = coordinatorHarness(storage, {
+      create: async (input, key) => {
+        calls.push({ input, key });
+        createCalls += 1;
+        return createCalls === 1 ? sourceCreateFailure("network_error", 0) : sourceCreateSuccess();
+      },
+    });
+    const input = payload("same-secret-payload");
+
+    const result = await coordinator.start(input);
+
+    expect(result.ok).toBe(true);
+    expect(calls).toHaveLength(2);
+    expect(calls[0]?.key).toBe(calls[1]?.key);
+    expect(calls[0]?.input).toBe(input);
+    expect(calls[1]?.input).toBe(input);
+    expect(JSON.stringify(storage.writes)).not.toContain("same-secret-payload");
+  });
+
+  it("retains a non-replayed structured 5xx while reconciling its key", async () => {
+    const storage = new MemoryStorage();
+    const lookup = vi.fn(() =>
+      Promise.resolve({ ok: false, error: apiError("network_error", 0) } as const),
+    );
+    const { coordinator, states } = coordinatorHarness(storage, {
+      create: () => Promise.resolve(sourceCreateFailure("internal_error", 500)),
+      lookup,
+    });
+
+    const result = await coordinator.start(payload());
+    const key = storage.writes[0]?.value ?? null;
+
+    expect(result).toMatchObject({ ok: false, error: { code: "network_error" } });
+    expect(lookup).toHaveBeenCalledOnce();
+    expect(storage.getItem(SOURCE_CREATE_STORAGE_KEY)).toBe(key);
+    expect(states.at(-1)).toMatchObject({ phase: "blocked", key, retry: "lookup" });
+  });
+
+  it("reports and clears a structured 5xx only when it is a valid stored replay", async () => {
+    const storage = new MemoryStorage();
+    const lookup = vi.fn();
+    const error = apiError("internal_error", 500);
+    const { coordinator, states } = coordinatorHarness(storage, {
+      create: () =>
+        Promise.resolve({
+          ok: false,
+          error,
+          replayProvenance: "authoritative",
+          responseDisposition: "authoritative",
+        } as const),
+      lookup,
+    });
+
+    const result = await coordinator.start(payload());
+
+    expect(result).toEqual({ ok: false, error });
+    expect(lookup).not.toHaveBeenCalled();
+    expect(storage.getItem(SOURCE_CREATE_STORAGE_KEY)).toBeNull();
+    expect(states.at(-1)).toMatchObject({ phase: "idle", key: null, error });
+  });
+
+  it("keeps the key when source-create transport rejects during recovery", async () => {
+    const storage = new MemoryStorage();
+    const lookup = vi.fn(() =>
+      Promise.resolve({ ok: false, error: apiError("network_error", 0) } as const),
+    );
+    const { coordinator } = coordinatorHarness(storage, {
+      create: () => Effect.runPromise(Effect.fail("transport disconnected")),
+      lookup,
+    });
+
+    const result = await coordinator.start(payload());
+    const key = storage.writes[0]?.value ?? null;
+
+    expect(result).toMatchObject({ ok: false, error: { code: "network_error" } });
+    expect(lookup).toHaveBeenCalledOnce();
+    expect(storage.getItem(SOURCE_CREATE_STORAGE_KEY)).toBe(key);
+  });
+
+  it("reconciles invalid fresh response contracts without clearing their keys", async () => {
+    const responses = [
+      () => freshSourceResponse(199),
+      () => freshSourceResponse(200),
+      () => freshSourceResponse(204),
+      () => freshErrorResponse(302),
+      () => freshErrorResponse(399),
+      () => freshErrorResponse(500),
+      () => freshErrorResponse(600),
+      () => freshSourceResponse(201, false),
+      () =>
+        Response.json(
+          { error: { code: "invalid_source", message: "Missing request ID." } },
+          { status: 400, headers: { "cache-control": "no-store" } },
+        ),
+    ];
+
+    for (const response of responses) {
+      const storage = new MemoryStorage();
+      const lookup = vi.fn(() =>
+        Promise.resolve({ ok: false, error: apiError("network_error", 0) } as const),
+      );
+      const { coordinator, states } = coordinatorHarness(storage, {
+        create: (_input, key, signal) =>
+          createGraphqlSource(payload(), key, async () => response(), signal),
+        lookup,
+      });
+
+      const result = await coordinator.start(payload());
+      const key = storage.writes[0]?.value ?? null;
+
+      expect(result).toMatchObject({ ok: false, error: { code: "network_error" } });
+      expect(lookup).toHaveBeenCalledOnce();
+      expect(storage.getItem(SOURCE_CREATE_STORAGE_KEY)).toBe(key);
+      expect(states.at(-1)).toMatchObject({ phase: "blocked", key, retry: "lookup" });
+    }
+  });
+
+  it("settles valid fresh 201 successes and 400 through 499 client failures", async () => {
+    const successStorage = new MemoryStorage();
+    const successLookup = vi.fn();
+    const successHarness = coordinatorHarness(successStorage, {
+      create: (_input, key, signal) =>
+        createGraphqlSource(payload(), key, async () => freshSourceResponse(201), signal),
+      lookup: successLookup,
+    });
+
+    const success = await successHarness.coordinator.start(payload());
+
+    expect(success).toMatchObject({ ok: true, value: { id: "source-1" } });
+    expect(successLookup).not.toHaveBeenCalled();
+    expect(successStorage.getItem(SOURCE_CREATE_STORAGE_KEY)).toBeNull();
+
+    for (const status of [400, 499]) {
+      const storage = new MemoryStorage();
+      const lookup = vi.fn();
+      const { coordinator, states } = coordinatorHarness(storage, {
+        create: (_input, key, signal) =>
+          createGraphqlSource(payload(), key, async () => freshErrorResponse(status), signal),
+        lookup,
+      });
+
+      const result = await coordinator.start(payload());
+
+      expect(result).toMatchObject({
+        ok: false,
+        error: { code: "invalid_source", status },
+      });
+      expect(lookup).not.toHaveBeenCalled();
+      expect(storage.getItem(SOURCE_CREATE_STORAGE_KEY)).toBeNull();
+      expect(states.at(-1)).toMatchObject({ phase: "idle", key: null });
+    }
+  });
+
+  it("keeps typed auth and idempotency client failures in recovery", async () => {
+    const failures = [
+      { status: 401, code: "unauthorized" },
+      { status: 403, code: "invalid_csrf" },
+      { status: 409, code: "idempotency_in_progress" },
+    ] as const;
+
+    for (const { status, code } of failures) {
+      const storage = new MemoryStorage();
+      const lookup = vi.fn(() =>
+        Promise.resolve({ ok: false, error: apiError("network_error", 0) } as const),
+      );
+      const { coordinator } = coordinatorHarness(storage, {
+        create: (_input, key, signal) =>
+          createGraphqlSource(payload(), key, async () => freshErrorResponse(status, code), signal),
+        lookup,
+      });
+
+      await coordinator.start(payload());
+      const key = storage.writes[0]?.value ?? null;
+
+      expect(lookup).toHaveBeenCalledOnce();
+      expect(storage.getItem(SOURCE_CREATE_STORAGE_KEY)).toBe(key);
+    }
+  });
+
+  it("recovers a completed reload only after an authoritative refresh", async () => {
+    const storage = new MemoryStorage();
+    const key = "1".repeat(32);
+    storage.setItem(SOURCE_CREATE_STORAGE_KEY, key);
+    const refresh = deferred<ReturnType<typeof successfulList> | null>();
+    const { coordinator, completed } = coordinatorHarness(storage, {
+      lookup: async (observedKey) => {
+        expect(observedKey).toBe(key);
+        return {
+          ok: true,
+          value: { kind: "replay", result: { ok: true, value: sourceFixture() } },
+        };
+      },
+      refresh: () => refresh.promise,
+    });
+
+    const recovery = coordinator.recoverStored();
+    await Promise.resolve();
+    expect(storage.getItem(SOURCE_CREATE_STORAGE_KEY)).toBe(key);
+    refresh.resolve(successfulList());
+    const result = await recovery;
+
+    expect(result?.ok).toBe(true);
+    expect(storage.getItem(SOURCE_CREATE_STORAGE_KEY)).toBeNull();
+    expect(completed).toEqual([sourceFixture()]);
+  });
+
+  it("reports a stored definitive failure and compare-clears its key", async () => {
+    const storage = new MemoryStorage();
+    const key = "2".repeat(32);
+    storage.setItem(SOURCE_CREATE_STORAGE_KEY, key);
+    const failure = apiError("invalid_source", 422);
+    const { coordinator, states } = coordinatorHarness(storage, {
+      lookup: () =>
+        Promise.resolve({
+          ok: true,
+          value: { kind: "replay", result: { ok: false, error: failure } },
+        }),
+    });
+
+    const result = await coordinator.recoverStored();
+
+    expect(result).toEqual({ ok: false, error: failure });
+    expect(storage.getItem(SOURCE_CREATE_STORAGE_KEY)).toBeNull();
+    expect(states.at(-1)).toMatchObject({ phase: "idle", error: failure });
+  });
+
+  it("seals a missing reload key before clearing a cloned session store", async () => {
+    const original = new MemoryStorage();
+    const key = "3".repeat(32);
+    original.setItem(SOURCE_CREATE_STORAGE_KEY, key);
+    const clone = original.clone();
+    const seal = vi.fn(async (observedKey: string) => {
+      expect(clone.getItem(SOURCE_CREATE_STORAGE_KEY)).toBe(key);
+      expect(observedKey).toBe(key);
+      return {
+        ok: true,
+        value: { kind: "status", status: "abandoned" },
+      } as const;
+    });
+    const { coordinator } = coordinatorHarness(clone, { seal });
+
+    await coordinator.recoverStored();
+
+    expect(seal).toHaveBeenCalledOnce();
+    expect(clone.getItem(SOURCE_CREATE_STORAGE_KEY)).toBeNull();
+    expect(original.getItem(SOURCE_CREATE_STORAGE_KEY)).toBe(key);
+  });
+
+  it("retains the key and lock for unauthorized, network, and malformed status failures", async () => {
+    for (const error of [
+      apiError("unauthorized", 401),
+      apiError("network_error", 0),
+      apiError("invalid_response", 502),
+    ]) {
+      const storage = new MemoryStorage();
+      const key = "4".repeat(32);
+      storage.setItem(SOURCE_CREATE_STORAGE_KEY, key);
+      const { coordinator, states } = coordinatorHarness(storage, {
+        lookup: () => Promise.resolve({ ok: false, error }),
+      });
+
+      const result = await coordinator.recoverStored();
+
+      expect(result).toEqual({ ok: false, error });
+      expect(storage.getItem(SOURCE_CREATE_STORAGE_KEY)).toBe(key);
+      expect(states.at(-1)).toMatchObject({ phase: "blocked", key, retry: "lookup" });
+    }
+  });
+
+  it("aborts local polling on dispose without deleting the pending key", async () => {
+    const storage = new MemoryStorage();
+    const key = "5".repeat(32);
+    storage.setItem(SOURCE_CREATE_STORAGE_KEY, key);
+    const polling = deferred<boolean>();
+    const enteredPolling = deferred<void>();
+    const poll = { signal: null as AbortSignal | null };
+    const { coordinator } = coordinatorHarness(storage, {
+      environment: environment(storage, {
+        wait: (_milliseconds, signal) => {
+          poll.signal = signal;
+          enteredPolling.resolve();
+          return polling.promise;
+        },
+      }),
+      lookup: () =>
+        Promise.resolve({
+          ok: true,
+          value: { kind: "status", status: "in_progress" },
+        }),
+    });
+
+    const recovery = coordinator.recoverStored();
+    await enteredPolling.promise;
+    coordinator.dispose();
+
+    expect(poll.signal?.aborted).toBe(true);
+    expect(storage.getItem(SOURCE_CREATE_STORAGE_KEY)).toBe(key);
+    polling.resolve(false);
+    await recovery;
+  });
+
+  it("suspends recovery before sign-out and ignores a late missing lookup", async () => {
+    const storage = new MemoryStorage();
+    const lookupResponse = deferred<ApiResult<SourceCreationResolution>>();
+    const lookupStarted = deferred<void>();
+    const lookupRequest = { signal: null as AbortSignal | null };
+    const create = vi.fn(() => Promise.resolve(sourceCreateFailure("network_error", 0)));
+    const seal = vi.fn();
+    const { coordinator, states } = coordinatorHarness(storage, {
+      create,
+      lookup: (_key, signal) => {
+        lookupRequest.signal = signal;
+        lookupStarted.resolve();
+        return lookupResponse.promise;
+      },
+      seal,
+    });
+
+    const creation = coordinator.start(payload());
+    await lookupStarted.promise;
+    const key = storage.writes[0]?.value ?? null;
+
+    expect(coordinator.suspendForSignOut()).toBe(true);
+    expect(lookupRequest.signal?.aborted).toBe(true);
+    expect(states.at(-1)).toMatchObject({
+      phase: "paused",
+      key,
+      notice: "Source recovery paused for sign-out.",
+      retry: null,
+    });
+
+    lookupResponse.resolve({
+      ok: true,
+      value: { kind: "status", status: "missing" },
+    });
+    await creation;
+
+    expect(create).toHaveBeenCalledOnce();
+    expect(seal).not.toHaveBeenCalled();
+    expect(storage.getItem(SOURCE_CREATE_STORAGE_KEY)).toBe(key);
+
+    coordinator.signOutFailed();
+    expect(states.at(-1)).toMatchObject({
+      phase: "paused",
+      key,
+      notice:
+        "Source recovery is paused because sign-out failed. Resume source recovery or reload this page.",
+      retry: "lookup",
+    });
+  });
+
+  it("never lets stale operation A clear or overwrite stored operation B", async () => {
+    const storage = new MemoryStorage();
+    const refresh = deferred<ReturnType<typeof successfulList> | null>();
+    const keyB = "b".repeat(32);
+    const lookups: string[] = [];
+    const { coordinator, completed, states } = coordinatorHarness(storage, {
+      refresh: () => refresh.promise,
+      lookup: async (key) => {
+        lookups.push(key);
+        return { ok: false, error: apiError("network_error", 0) };
+      },
+    });
+
+    const operationA = coordinator.start(payload("operation-a-secret"));
+    await Promise.resolve();
+    storage.setItem(SOURCE_CREATE_STORAGE_KEY, keyB);
+    refresh.resolve(successfulList());
+    await operationA;
+
+    expect(storage.getItem(SOURCE_CREATE_STORAGE_KEY)).toBe(keyB);
+    expect(lookups).toEqual([keyB]);
+    expect(completed).toEqual([]);
+    expect(states.at(-1)).toMatchObject({ phase: "blocked", key: keyB });
+  });
+});
diff --git a/web/src/lib/source-create-lifecycle.ts b/web/src/lib/source-create-lifecycle.ts
new file mode 100644
index 000000000..17066c909
--- /dev/null
+++ b/web/src/lib/source-create-lifecycle.ts
@@ -0,0 +1,686 @@
+import { Effect, Exit } from "effect";
+import {
+  ApiError,
+  type ApiResult,
+  type GraphqlSourceInput,
+  type McpHttpSourceInput,
+  type McpStdioSourceInput,
+  type OpenApiSourceInput,
+  type Source,
+  type SourceCreateApiResult,
+  type SourceCreationResolution,
+  type SourceCreationStatus,
+  type SourceList,
+} from "$lib/api";
+
+export const SOURCE_CREATE_STORAGE_KEY = "executor.source-create.idempotency-key.v1";
+
+export type SourceCreateInput =
+  | OpenApiSourceInput
+  | GraphqlSourceInput
+  | McpHttpSourceInput
+  | McpStdioSourceInput;
+
+export type SourceCreatePhase = "idle" | "dispatching" | "recovering" | "blocked" | "paused";
+export type SourceCreateRetry = "dispatch" | "lookup" | null;
+
+export type SourceCreateState = {
+  readonly phase: SourceCreatePhase;
+  readonly key: string | null;
+  readonly error: ApiError | null;
+  readonly notice: string | null;
+  readonly retry: SourceCreateRetry;
+};
+
+export type SourceCreateEnvironment = {
+  readonly getStorage: () => Pick<Storage, "getItem" | "setItem" | "removeItem">;
+  readonly fillRandom: (bytes: Uint8Array<ArrayBuffer>) => void;
+  readonly wait: (milliseconds: number, signal: AbortSignal) => Promise<boolean>;
+};
+
+type SourceCreateCoordinatorOptions = {
+  readonly environment: SourceCreateEnvironment;
+  readonly create: (
+    input: SourceCreateInput,
+    idempotencyKey: string,
+    signal: AbortSignal,
+  ) => Promise<SourceCreateApiResult>;
+  readonly lookup: (
+    idempotencyKey: string,
+    signal: AbortSignal,
+  ) => Promise<ApiResult<SourceCreationResolution>>;
+  readonly seal: (
+    idempotencyKey: string,
+    signal: AbortSignal,
+  ) => Promise<ApiResult<SourceCreationResolution>>;
+  readonly refresh: (signal: AbortSignal) => Promise<ApiResult<SourceList> | null>;
+  readonly onstatechange: (state: SourceCreateState) => void;
+  readonly oncompleted: (source: Source) => void;
+};
+
+type ActiveSourceCreate = {
+  readonly key: string;
+  readonly payload: SourceCreateInput | null;
+  readonly generation: number;
+  readonly controller: AbortController;
+  readonly automaticRetryUsed: boolean;
+};
+
+type PausedSourceCreate = {
+  readonly key: string;
+  readonly payload: SourceCreateInput | null;
+  readonly automaticRetryUsed: boolean;
+  readonly retry: Exclude<SourceCreateRetry, null>;
+};
+
+export function emptySourceCreateState(): SourceCreateState {
+  return { phase: "idle", key: null, error: null, notice: null, retry: null };
+}
+
+export function browserSourceCreateEnvironment(): SourceCreateEnvironment {
+  return {
+    getStorage: () => window.sessionStorage,
+    fillRandom: (bytes) => {
+      globalThis.crypto.getRandomValues(bytes);
+    },
+    wait: waitForSourceCreatePoll,
+  };
+}
+
+export function isAmbiguousSourceCreateResult(result: SourceCreateApiResult) {
+  if (result.responseDisposition === "ambiguous") return true;
+  if (result.replayProvenance === "invalid") return true;
+  if (result.ok) return false;
+  const { error } = result;
+  if (
+    [
+      "invalid_response",
+      "network_error",
+      "request_cancelled",
+      "unexpected_client_error",
+      "idempotency_in_progress",
+      "invalid_csrf",
+    ].includes(error.code)
+  ) {
+    return true;
+  }
+  if (error.status === 401) return true;
+  return error.status >= 500 && result.replayProvenance !== "authoritative";
+}
+
+export function createSourceCreateCoordinator(options: SourceCreateCoordinatorOptions) {
+  let state = emptySourceCreateState();
+  let active: ActiveSourceCreate | null = null;
+  let paused: PausedSourceCreate | null = null;
+  let generation = 0;
+  let disposed = false;
+
+  function publish(next: SourceCreateState) {
+    state = next;
+    options.onstatechange(next);
+  }
+
+  function owns(operation: ActiveSourceCreate) {
+    return (
+      !disposed &&
+      active === operation &&
+      generation === operation.generation &&
+      !operation.controller.signal.aborted
+    );
+  }
+
+  function storage() {
+    return syncResult(options.environment.getStorage);
+  }
+
+  function readStoredKey() {
+    const available = storage();
+    if (!available.ok) return available;
+    return syncResult(() => available.value.getItem(SOURCE_CREATE_STORAGE_KEY));
+  }
+
+  function persistNewKey(key: string) {
+    const available = storage();
+    if (!available.ok) return { ok: false } as const;
+    const current = syncResult(() => available.value.getItem(SOURCE_CREATE_STORAGE_KEY));
+    if (!current.ok) return current;
+    if (current.value !== null) return { ok: true, value: current.value } as const;
+    const stored = syncResult(() => available.value.setItem(SOURCE_CREATE_STORAGE_KEY, key));
+    if (!stored.ok) return stored;
+    const verified = syncResult(() => available.value.getItem(SOURCE_CREATE_STORAGE_KEY));
+    if (!verified.ok || verified.value !== key) return { ok: false } as const;
+    return { ok: true, value: key } as const;
+  }
+
+  function compareAndClearStoredKey(key: string) {
+    const available = storage();
+    if (!available.ok) return { ok: false, mismatch: false } as const;
+    const current = syncResult(() => available.value.getItem(SOURCE_CREATE_STORAGE_KEY));
+    if (!current.ok) return { ok: false, mismatch: false } as const;
+    if (current.value !== key) return { ok: false, mismatch: true } as const;
+    const removed = syncResult(() => available.value.removeItem(SOURCE_CREATE_STORAGE_KEY));
+    if (!removed.ok) return { ok: false, mismatch: false } as const;
+    const verified = syncResult(() => available.value.getItem(SOURCE_CREATE_STORAGE_KEY));
+    return verified.ok && verified.value === null
+      ? ({ ok: true, mismatch: false } as const)
+      : ({ ok: false, mismatch: false } as const);
+  }
+
+  function generateKey() {
+    const bytes = new Uint8Array(16);
+    const filled = syncResult(() => options.environment.fillRandom(bytes));
+    if (!filled.ok) return null;
+    return [...bytes].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+  }
+
+  function newOperation(
+    key: string,
+    payload: SourceCreateInput | null,
+    automaticRetryUsed: boolean,
+  ) {
+    active?.controller.abort();
+    paused = null;
+    const operation = {
+      key,
+      payload,
+      generation: ++generation,
+      controller: new AbortController(),
+      automaticRetryUsed,
+    } satisfies ActiveSourceCreate;
+    active = operation;
+    return operation;
+  }
+
+  function operationError(
+    code: string,
+    displayMessage: string,
+    status = 0,
+    requestId: string | null = null,
+  ) {
+    return new ApiError({ code, displayMessage, requestId, status });
+  }
+
+  function publishBlocked(
+    operation: ActiveSourceCreate,
+    error: ApiError,
+    retry: Exclude<SourceCreateRetry, null>,
+  ) {
+    publish({
+      phase: "blocked",
+      key: operation.key,
+      error,
+      notice: "Executor could not safely finish source recovery. The pending key was retained.",
+      retry,
+    });
+    return { ok: false, error } as const;
+  }
+
+  async function blocked(
+    operation: ActiveSourceCreate,
+    error: ApiError,
+    retry: Exclude<SourceCreateRetry, null>,
+  ) {
+    if (!owns(operation)) return requestCancelled();
+    const stored = readStoredKey();
+    if (!stored.ok || stored.value === null) {
+      return publishBlocked(operation, storageUnavailableError(), "lookup");
+    }
+    if (stored.value !== operation.key) return recoverDifferentStoredKey(operation);
+    return publishBlocked(operation, error, retry);
+  }
+
+  async function fenceStoredKey(operation: ActiveSourceCreate) {
+    if (!owns(operation)) return requestCancelled();
+    const stored = readStoredKey();
+    if (!stored.ok || stored.value === null) {
+      return blocked(operation, storageUnavailableError(), "lookup");
+    }
+    if (stored.value !== operation.key) return recoverDifferentStoredKey(operation);
+    return null;
+  }
+
+  async function recoverDifferentStoredKey(operation: ActiveSourceCreate) {
+    if (!owns(operation)) return requestCancelled();
+    operation.controller.abort();
+    active = null;
+    generation += 1;
+    const recovered = await recoverStored();
+    return (
+      recovered ?? {
+        ok: false,
+        error: operationError(
+          "source_create_recovery_pending",
+          "Another source connection is pending in this browser tab.",
+        ),
+      }
+    );
+  }
+
+  async function settleSuccess(operation: ActiveSourceCreate, source: Source) {
+    if (!owns(operation)) return requestCancelled();
+    const beforeRefresh = readStoredKey();
+    if (!beforeRefresh.ok) {
+      return blocked(operation, storageUnavailableError(), "lookup");
+    }
+    if (beforeRefresh.value !== operation.key) return recoverDifferentStoredKey(operation);
+
+    const refreshed = await settlePromise(() => options.refresh(operation.controller.signal));
+    if (!owns(operation)) return requestCancelled();
+    if (!refreshed.ok || refreshed.value === null || !refreshed.value.ok) {
+      const error =
+        refreshed.ok && refreshed.value !== null && !refreshed.value.ok
+          ? refreshed.value.error
+          : operationError(
+              "source_list_refresh_failed",
+              "The source connection completed, but the authoritative source list could not be refreshed.",
+            );
+      return blocked(operation, error, "lookup");
+    }
+
+    const cleared = compareAndClearStoredKey(operation.key);
+    if (cleared.mismatch) return recoverDifferentStoredKey(operation);
+    if (!cleared.ok) return blocked(operation, storageUnavailableError(), "lookup");
+    if (!owns(operation)) return requestCancelled();
+    active = null;
+    publish({
+      phase: "idle",
+      key: null,
+      error: null,
+      notice: "Source connection completed and the authoritative source list was refreshed.",
+      retry: null,
+    });
+    options.oncompleted(source);
+    return { ok: true, value: source } as const;
+  }
+
+  async function settleFailure(operation: ActiveSourceCreate, error: ApiError) {
+    if (!owns(operation)) return requestCancelled();
+    const cleared = compareAndClearStoredKey(operation.key);
+    if (cleared.mismatch) return recoverDifferentStoredKey(operation);
+    if (!cleared.ok) return blocked(operation, storageUnavailableError(), "lookup");
+    if (!owns(operation)) return requestCancelled();
+    active = null;
+    publish({ phase: "idle", key: null, error, notice: null, retry: null });
+    return { ok: false, error } as const;
+  }
+
+  async function settleTerminal(
+    operation: ActiveSourceCreate,
+    status: Exclude<SourceCreationStatus, "missing" | "in_progress">,
+  ) {
+    return settleFailure(operation, terminalStatusError(status));
+  }
+
+  async function handleResolution(
+    operation: ActiveSourceCreate,
+    resolution: ApiResult<SourceCreationResolution>,
+    source: "lookup" | "seal",
+  ): Promise<ApiResult<Source>> {
+    if (!owns(operation)) return requestCancelled();
+    const fenced = await fenceStoredKey(operation);
+    if (fenced !== null) return fenced;
+    if (!resolution.ok) return blocked(operation, resolution.error, "lookup");
+    if (resolution.value.kind === "replay") {
+      return resolution.value.result.ok
+        ? settleSuccess(operation, resolution.value.result.value)
+        : settleFailure(operation, resolution.value.result.error);
+    }
+
+    const { status } = resolution.value;
+    if (status === "in_progress") {
+      publish({
+        phase: "recovering",
+        key: operation.key,
+        error: null,
+        notice: "Executor is still finishing this source connection.",
+        retry: null,
+      });
+      const elapsed = await options.environment.wait(1_000, operation.controller.signal);
+      if (!elapsed || !owns(operation)) return requestCancelled();
+      return lookup(operation);
+    }
+    if (status === "missing") {
+      if (operation.payload !== null) {
+        if (!operation.automaticRetryUsed) {
+          const retry = newOperation(operation.key, operation.payload, true);
+          return dispatch(retry);
+        }
+        return blocked(
+          operation,
+          operationError(
+            "source_create_retry_required",
+            "Executor has no record of this request. Retry the exact in-memory request with the retained key.",
+          ),
+          "dispatch",
+        );
+      }
+      if (source === "seal") {
+        return blocked(
+          operation,
+          operationError(
+            "invalid_response",
+            "Executor returned an invalid seal result. The pending key was retained.",
+            502,
+          ),
+          "lookup",
+        );
+      }
+      return seal(operation);
+    }
+    return settleTerminal(operation, status);
+  }
+
+  async function lookup(operation: ActiveSourceCreate): Promise<ApiResult<Source>> {
+    const fenced = await fenceStoredKey(operation);
+    if (fenced !== null) return fenced;
+    publish({
+      phase: "recovering",
+      key: operation.key,
+      error: null,
+      notice: "Checking the pending source connection with Executor.",
+      retry: null,
+    });
+    const resolution = await settlePromise(() =>
+      options.lookup(operation.key, operation.controller.signal),
+    );
+    if (!owns(operation)) return requestCancelled();
+    return handleResolution(
+      operation,
+      resolution.ok ? resolution.value : { ok: false, error: unexpectedRequestError() },
+      "lookup",
+    );
+  }
+
+  async function seal(operation: ActiveSourceCreate): Promise<ApiResult<Source>> {
+    const fenced = await fenceStoredKey(operation);
+    if (fenced !== null) return fenced;
+    publish({
+      phase: "recovering",
+      key: operation.key,
+      error: null,
+      notice: "Securing the unused source connection key before unlocking this page.",
+      retry: null,
+    });
+    const resolution = await settlePromise(() =>
+      options.seal(operation.key, operation.controller.signal),
+    );
+    if (!owns(operation)) return requestCancelled();
+    return handleResolution(
+      operation,
+      resolution.ok ? resolution.value : { ok: false, error: unexpectedRequestError() },
+      "seal",
+    );
+  }
+
+  async function dispatch(operation: ActiveSourceCreate): Promise<ApiResult<Source>> {
+    const payload = operation.payload;
+    if (!owns(operation) || payload === null) return requestCancelled();
+    const fenced = await fenceStoredKey(operation);
+    if (fenced !== null) return fenced;
+    publish({
+      phase: "dispatching",
+      key: operation.key,
+      error: null,
+      notice: "Submitting the source connection.",
+      retry: null,
+    });
+    const settled = await settlePromise(() =>
+      options.create(payload, operation.key, operation.controller.signal),
+    );
+    if (!owns(operation)) return requestCancelled();
+    if (!settled.ok) return lookup(operation);
+    if (isAmbiguousSourceCreateResult(settled.value)) return lookup(operation);
+    if (settled.value.ok) return settleSuccess(operation, settled.value.value);
+    return settleFailure(operation, settled.value.error);
+  }
+
+  async function start(input: SourceCreateInput) {
+    if (disposed) return requestCancelled();
+    if (state.phase !== "idle" || active !== null) {
+      return {
+        ok: false,
+        error: operationError(
+          "source_create_already_pending",
+          "Finish recovering the pending source connection before starting another.",
+        ),
+      } as const;
+    }
+
+    const key = generateKey();
+    if (key === null) {
+      const error = randomnessUnavailableError();
+      publish({ phase: "idle", key: null, error, notice: null, retry: null });
+      return { ok: false, error } as const;
+    }
+    const persisted = persistNewKey(key);
+    if (!persisted.ok) {
+      const error = storageUnavailableError();
+      publish({ phase: "idle", key: null, error, notice: null, retry: null });
+      return { ok: false, error } as const;
+    }
+    if (persisted.value !== key) {
+      void recoverStored();
+      return {
+        ok: false,
+        error: operationError(
+          "source_create_recovery_pending",
+          "A source connection from this browser tab must be recovered first.",
+        ),
+      } as const;
+    }
+
+    return dispatch(newOperation(key, input, false));
+  }
+
+  async function recoverStored() {
+    if (disposed || active !== null || state.phase === "paused") return null;
+    const stored = readStoredKey();
+    if (!stored.ok) {
+      const error = storageUnavailableError();
+      publish({
+        phase: "blocked",
+        key: null,
+        error,
+        notice: "The pending source state could not be read safely.",
+        retry: "lookup",
+      });
+      return { ok: false, error } as const;
+    }
+    if (stored.value === null) {
+      publish(emptySourceCreateState());
+      return null;
+    }
+    if (!/^[0-9a-f]{32}$/.test(stored.value)) {
+      const error = operationError(
+        "source_create_key_invalid",
+        "The stored source connection key is invalid. It was retained for manual recovery.",
+      );
+      publish({ phase: "blocked", key: null, error, notice: null, retry: "lookup" });
+      return { ok: false, error } as const;
+    }
+    return lookup(newOperation(stored.value, null, true));
+  }
+
+  async function resume() {
+    if (disposed) return requestCancelled();
+    if (state.phase === "paused") {
+      if (state.retry === null) return requestCancelled();
+      const suspended = paused;
+      if (suspended === null) {
+        publish({ ...state, phase: "blocked", retry: "lookup" });
+        return recoverStored();
+      }
+      const retry = state.retry;
+      const operation = newOperation(
+        suspended.key,
+        suspended.payload,
+        suspended.automaticRetryUsed,
+      );
+      if (retry === "dispatch" && operation.payload !== null) return dispatch(operation);
+      return lookup(operation);
+    }
+    if (active === null) return recoverStored();
+    const operation = active;
+    const stored = readStoredKey();
+    if (!stored.ok) return blocked(operation, storageUnavailableError(), "lookup");
+    if (stored.value !== operation.key) return recoverDifferentStoredKey(operation);
+    const retry = state.retry;
+    if (retry === "dispatch" && operation.payload !== null) {
+      return dispatch(newOperation(operation.key, operation.payload, true));
+    }
+    return lookup(newOperation(operation.key, operation.payload, operation.automaticRetryUsed));
+  }
+
+  function suspendForSignOut() {
+    if (disposed || state.phase === "dispatching") return false;
+    if (state.phase === "idle") return true;
+    if (active !== null) {
+      paused = {
+        key: active.key,
+        payload: active.payload,
+        automaticRetryUsed: active.automaticRetryUsed,
+        retry: state.retry ?? "lookup",
+      };
+    }
+    generation += 1;
+    const controller = active?.controller;
+    active = null;
+    controller?.abort();
+    publish({
+      phase: "paused",
+      key: state.key,
+      error: state.error,
+      notice: "Source recovery paused for sign-out.",
+      retry: null,
+    });
+    return true;
+  }
+
+  function signOutFailed() {
+    if (disposed || state.phase !== "paused") return;
+    publish({
+      ...state,
+      notice:
+        "Source recovery is paused because sign-out failed. Resume source recovery or reload this page.",
+      retry: paused?.retry ?? "lookup",
+    });
+  }
+
+  function dispose() {
+    disposed = true;
+    generation += 1;
+    active?.controller.abort();
+    active = null;
+    paused = null;
+  }
+
+  return {
+    start,
+    recoverStored,
+    resume,
+    suspendForSignOut,
+    signOutFailed,
+    dispose,
+    get state() {
+      return state;
+    },
+  };
+}
+
+function syncResult<Value>(evaluate: () => Value) {
+  const result = Effect.runSyncExit(Effect.try({ try: evaluate, catch: () => undefined }));
+  return Exit.isSuccess(result)
+    ? ({ ok: true, value: result.value } as const)
+    : ({ ok: false } as const);
+}
+
+async function settlePromise<Value>(evaluate: () => Promise<Value>) {
+  return Promise.resolve()
+    .then(evaluate)
+    .then(
+      (value) => ({ ok: true, value }) as const,
+      () => ({ ok: false }) as const,
+    );
+}
+
+function waitForSourceCreatePoll(milliseconds: number, signal: AbortSignal) {
+  if (signal.aborted) return Promise.resolve(false);
+  return new Promise<boolean>((resolve) => {
+    const timeout = setTimeout(() => {
+      signal.removeEventListener("abort", abort);
+      resolve(true);
+    }, milliseconds);
+    const abort = () => {
+      clearTimeout(timeout);
+      signal.removeEventListener("abort", abort);
+      resolve(false);
+    };
+    signal.addEventListener("abort", abort, { once: true });
+  });
+}
+
+function requestCancelled() {
+  return {
+    ok: false,
+    error: new ApiError({
+      code: "request_cancelled",
+      displayMessage: "The request was cancelled.",
+      requestId: null,
+      status: 0,
+    }),
+  } as const;
+}
+
+function unexpectedRequestError() {
+  return new ApiError({
+    code: "unexpected_client_error",
+    displayMessage: "The request ended unexpectedly. Try again.",
+    requestId: null,
+    status: 0,
+  });
+}
+
+function storageUnavailableError() {
+  return new ApiError({
+    code: "source_create_storage_unavailable",
+    displayMessage:
+      "Secure tab storage is unavailable. Executor did not start a new source connection.",
+    requestId: null,
+    status: 0,
+  });
+}
+
+function randomnessUnavailableError() {
+  return new ApiError({
+    code: "source_create_randomness_unavailable",
+    displayMessage:
+      "Secure browser randomness is unavailable. Executor did not start a new source connection.",
+    requestId: null,
+    status: 0,
+  });
+}
+
+function terminalStatusError(status: Exclude<SourceCreationStatus, "missing" | "in_progress">) {
+  if (status === "abandoned") {
+    return new ApiError({
+      code: "idempotency_abandoned",
+      displayMessage: "The unused source connection key was sealed. You can start a new request.",
+      requestId: null,
+      status: 409,
+    });
+  }
+  if (status === "interrupted") {
+    return new ApiError({
+      code: "idempotency_interrupted",
+      displayMessage: "The source connection was interrupted and cannot be retried.",
+      requestId: null,
+      status: 409,
+    });
+  }
+  return new ApiError({
+    code: "idempotency_expired_unknown",
+    displayMessage: "The source connection record expired without a confirmable outcome.",
+    requestId: null,
+    status: 409,
+  });
+}
diff --git a/web/src/lib/token-create-lifecycle.test.ts b/web/src/lib/token-create-lifecycle.test.ts
new file mode 100644
index 000000000..f695768f7
--- /dev/null
+++ b/web/src/lib/token-create-lifecycle.test.ts
@@ -0,0 +1,311 @@
+import { describe, expect, it, vi } from "@effect/vitest";
+import { Schema } from "effect";
+import { ApiError, type CreatedToken, type TokenCreateApiResult } from "./api";
+import {
+  TOKEN_CREATE_STORAGE_KEY,
+  createTokenCreateCoordinator,
+  isAmbiguousTokenCreateResult,
+  type TokenCreateEnvironment,
+  type TokenCreateState,
+} from "./token-create-lifecycle";
+
+const PendingRecordSchema = Schema.Struct({
+  version: Schema.Literal(1),
+  key: Schema.String,
+  name: Schema.String,
+});
+const decodePendingRecord = Schema.decodeUnknownSync(Schema.fromJsonString(PendingRecordSchema));
+
+class MemoryStorage implements Pick<Storage, "getItem" | "setItem" | "removeItem"> {
+  readonly values = new Map<string, string>();
+  readonly writes: Array<{ key: string; value: string }> = [];
+
+  getItem(key: string) {
+    return this.values.get(key) ?? null;
+  }
+
+  setItem(key: string, value: string) {
+    this.values.set(key, value);
+    this.writes.push({ key, value });
+  }
+
+  removeItem(key: string) {
+    this.values.delete(key);
+  }
+}
+
+function token(id = "token-1", name = "Laptop") {
+  return {
+    id,
+    name,
+    token: `exr_${"A".repeat(43)}`,
+    createdAt: 1_750_000_000,
+  } satisfies CreatedToken;
+}
+
+function success(value = token(), replayed = false): TokenCreateApiResult {
+  return {
+    ok: true,
+    value,
+    replayProvenance: replayed ? "authoritative" : "none",
+    responseDisposition: "authoritative",
+  };
+}
+
+function failure(
+  code: string,
+  status: number,
+  responseDisposition: TokenCreateApiResult["responseDisposition"] = "authoritative",
+  replayProvenance: TokenCreateApiResult["replayProvenance"] = "none",
+): TokenCreateApiResult {
+  return {
+    ok: false,
+    error: new ApiError({ code, displayMessage: code, requestId: null, status }),
+    replayProvenance,
+    responseDisposition,
+  };
+}
+
+function deferred<Value>() {
+  let resolve = (_value: Value) => {};
+  const promise = new Promise<Value>((complete) => {
+    resolve = complete;
+  });
+  return { promise, resolve };
+}
+
+function environment(storage: MemoryStorage): TokenCreateEnvironment {
+  return {
+    getStorage: () => storage,
+    fillRandom: (bytes) => bytes.fill(0xab),
+  };
+}
+
+function harness(
+  storage: MemoryStorage,
+  create: (name: string, key: string, signal: AbortSignal) => Promise<TokenCreateApiResult>,
+) {
+  const states: TokenCreateState[] = [];
+  const revealed: CreatedToken[] = [];
+  const coordinator = createTokenCreateCoordinator({
+    environment: environment(storage),
+    create,
+    onstatechange: (state) => states.push(state),
+    onrevealed: (created) => revealed.push(created),
+  });
+  return { coordinator, states, revealed };
+}
+
+function readPending(storage: MemoryStorage) {
+  const stored = storage.getItem(TOKEN_CREATE_STORAGE_KEY);
+  return stored === null ? null : decodePendingRecord(stored);
+}
+
+describe("delivery-safe token creation", () => {
+  it("persists a versioned 256-bit key and name before dispatch, then retries exactly once", async () => {
+    const storage = new MemoryStorage();
+    const calls: Array<{ name: string; key: string; stored: string | null }> = [];
+    const { coordinator, revealed } = harness(storage, async (name, key) => {
+      calls.push({ name, key, stored: storage.getItem(TOKEN_CREATE_STORAGE_KEY) });
+      return calls.length === 1
+        ? failure("network_error", 0, "ambiguous")
+        : success(token("token-replayed", name), true);
+    });
+
+    const result = await coordinator.start("  Laptop agent  ");
+
+    expect(result.ok).toBe(true);
+    expect(calls).toHaveLength(2);
+    expect(calls[0]?.key).toBe(calls[1]?.key);
+    expect(calls[0]?.key).toMatch(/^[0-9a-f]{64}$/);
+    expect(calls.map(({ name }) => name)).toEqual(["Laptop agent", "Laptop agent"]);
+    expect(calls[0]?.stored).toBe(calls[1]?.stored);
+    expect(readPending(storage)).toEqual({
+      version: 1,
+      key: calls[0]?.key,
+      name: "Laptop agent",
+    });
+    expect(JSON.stringify(storage.writes)).not.toContain(`exr_${"A".repeat(43)}`);
+    expect(revealed).toEqual([token("token-replayed", "Laptop agent")]);
+
+    expect(coordinator.acknowledge()).toEqual({ ok: true, value: undefined });
+    expect(storage.getItem(TOKEN_CREATE_STORAGE_KEY)).toBeNull();
+  });
+
+  it("recovers a reload by reposting the exact pending name and key", async () => {
+    const storage = new MemoryStorage();
+    const pending = {
+      version: 1,
+      key: "7".repeat(64),
+      name: "Reloaded agent",
+    } as const;
+    storage.setItem(TOKEN_CREATE_STORAGE_KEY, JSON.stringify(pending));
+    const create = vi.fn(async (name: string, key: string) => {
+      expect({ name, key }).toEqual({ name: pending.name, key: pending.key });
+      return success(token("token-recovered", name), true);
+    });
+    const { coordinator, revealed } = harness(storage, create);
+
+    const result = await coordinator.recoverStored();
+
+    expect(result?.ok).toBe(true);
+    expect(create).toHaveBeenCalledOnce();
+    expect(revealed).toEqual([token("token-recovered", pending.name)]);
+    expect(storage.getItem(TOKEN_CREATE_STORAGE_KEY)).toBe(JSON.stringify(pending));
+  });
+
+  it("retries a success with the wrong name and reveals only the exact pending name", async () => {
+    const storage = new MemoryStorage();
+    let calls = 0;
+    const { coordinator, revealed } = harness(storage, async () => {
+      calls += 1;
+      return calls === 1
+        ? success(token("wrong-name", "Different agent"))
+        : success(token("exact-name", "Laptop agent"), true);
+    });
+
+    const result = await coordinator.start("Laptop agent");
+
+    expect(result.ok).toBe(true);
+    expect(calls).toBe(2);
+    expect(revealed).toEqual([token("exact-name", "Laptop agent")]);
+    expect(readPending(storage)?.name).toBe("Laptop agent");
+  });
+
+  it("retains auth, mismatch, network, and invalid responses but clears replay-revoked", async () => {
+    for (const ambiguous of [
+      failure("unauthorized", 401),
+      failure("idempotency_mismatch", 409),
+      failure("network_error", 0, "ambiguous"),
+      failure("invalid_response", 502, "ambiguous"),
+      failure("internal_error", 500, "authoritative", "authoritative"),
+      failure("idempotency_replay_revoked", 500, "authoritative", "authoritative"),
+    ]) {
+      const storage = new MemoryStorage();
+      const { coordinator, states } = harness(storage, async () => ambiguous);
+
+      const result = await coordinator.start("Retained agent");
+
+      expect(result.ok).toBe(false);
+      expect(storage.getItem(TOKEN_CREATE_STORAGE_KEY)).not.toBeNull();
+      expect(states.at(-1)).toMatchObject({ phase: "blocked", canRetry: true });
+    }
+
+    const storage = new MemoryStorage();
+    const revoked = failure("idempotency_replay_revoked", 409, "authoritative", "authoritative");
+    const { coordinator, states } = harness(storage, async () => revoked);
+
+    const result = await coordinator.start("Revoked agent");
+
+    expect(result).toMatchObject({ ok: false, error: { code: "idempotency_replay_revoked" } });
+    expect(storage.getItem(TOKEN_CREATE_STORAGE_KEY)).toBeNull();
+    expect(states.at(-1)).toMatchObject({ phase: "idle", pending: null });
+  });
+
+  it("reuses the retained key after reauthentication", async () => {
+    const storage = new MemoryStorage();
+    let authenticated = false;
+    const calls: Array<{ name: string; key: string }> = [];
+    const { coordinator, revealed } = harness(storage, async (name, key) => {
+      calls.push({ name, key });
+      return authenticated
+        ? success(token("recovered-after-login", name), true)
+        : failure("unauthorized", 401);
+    });
+
+    const blocked = await coordinator.start("Reauthenticated agent");
+    const retained = readPending(storage);
+    authenticated = true;
+    const recovered = await coordinator.retry();
+
+    expect(blocked).toMatchObject({ ok: false, error: { code: "unauthorized" } });
+    expect(recovered?.ok).toBe(true);
+    expect(calls).toHaveLength(3);
+    expect(calls.map(({ key }) => key)).toEqual([retained?.key, retained?.key, retained?.key]);
+    expect(calls.map(({ name }) => name)).toEqual([
+      "Reauthenticated agent",
+      "Reauthenticated agent",
+      "Reauthenticated agent",
+    ]);
+    expect(revealed).toEqual([token("recovered-after-login", "Reauthenticated agent")]);
+    expect(readPending(storage)).toEqual(retained);
+  });
+
+  it("rejects stale completion A and recovers pending operation B", async () => {
+    const storage = new MemoryStorage();
+    const operationA = deferred<TokenCreateApiResult>();
+    const calls: string[] = [];
+    const { coordinator, revealed } = harness(storage, async (name) => {
+      calls.push(name);
+      return name === "Operation A"
+        ? operationA.promise
+        : success(token("token-b", "Operation B"), true);
+    });
+
+    const startedA = coordinator.start("Operation A");
+    await Promise.resolve();
+    const pendingB = {
+      version: 1,
+      key: "b".repeat(64),
+      name: "Operation B",
+    } as const;
+    storage.setItem(TOKEN_CREATE_STORAGE_KEY, JSON.stringify(pendingB));
+    operationA.resolve(success(token("token-a", "Operation A")));
+    const result = await startedA;
+
+    expect(result.ok).toBe(true);
+    expect(calls).toEqual(["Operation A", "Operation B"]);
+    expect(revealed).toEqual([token("token-b", "Operation B")]);
+    expect(readPending(storage)).toEqual(pendingB);
+  });
+
+  it("aborts on dispose and ignores a late token secret", async () => {
+    const storage = new MemoryStorage();
+    const response = deferred<TokenCreateApiResult>();
+    const started = deferred<void>();
+    const request = { signal: null as AbortSignal | null };
+    const { coordinator, revealed, states } = harness(storage, (_name, _key, signal) => {
+      request.signal = signal;
+      started.resolve();
+      return response.promise;
+    });
+
+    const creation = coordinator.start("Unmounted agent");
+    await started.promise;
+    const stored = storage.getItem(TOKEN_CREATE_STORAGE_KEY);
+    coordinator.dispose();
+
+    expect(request.signal?.aborted).toBe(true);
+    response.resolve(success(token("late-token")));
+    await creation;
+    expect(revealed).toEqual([]);
+    expect(storage.getItem(TOKEN_CREATE_STORAGE_KEY)).toBe(stored);
+    expect(states.some(({ phase }) => phase === "revealed")).toBe(false);
+  });
+});
+
+describe("token create ambiguity", () => {
+  it("keeps mismatch ambiguous while treating an authoritative revoked replay as final", () => {
+    expect(isAmbiguousTokenCreateResult(failure("idempotency_mismatch", 409))).toBe(true);
+    expect(
+      isAmbiguousTokenCreateResult(
+        failure("idempotency_replay_revoked", 409, "authoritative", "authoritative"),
+      ),
+    ).toBe(false);
+    expect(
+      isAmbiguousTokenCreateResult(
+        failure("idempotency_replay_revoked", 409, "authoritative", "none"),
+      ),
+    ).toBe(true);
+    expect(
+      isAmbiguousTokenCreateResult(
+        failure("internal_error", 500, "authoritative", "authoritative"),
+      ),
+    ).toBe(true);
+    expect(
+      isAmbiguousTokenCreateResult(
+        failure("idempotency_replay_revoked", 500, "authoritative", "authoritative"),
+      ),
+    ).toBe(true);
+  });
+});
diff --git a/web/src/lib/token-create-lifecycle.ts b/web/src/lib/token-create-lifecycle.ts
new file mode 100644
index 000000000..c851aad4c
--- /dev/null
+++ b/web/src/lib/token-create-lifecycle.ts
@@ -0,0 +1,508 @@
+import { Effect, Exit, Option, Schema } from "effect";
+import { ApiError, type ApiResult, type CreatedToken, type TokenCreateApiResult } from "$lib/api";
+
+export const TOKEN_CREATE_STORAGE_KEY = "executor.token-create.pending.v1";
+
+const PendingTokenCreationSchema = Schema.Struct({
+  version: Schema.Literal(1),
+  key: Schema.String,
+  name: Schema.String,
+});
+
+const decodePendingTokenCreationJson = Schema.decodeUnknownOption(
+  Schema.fromJsonString(PendingTokenCreationSchema),
+);
+const decodePendingTokenCreation = (text: string) =>
+  decodePendingTokenCreationJson(text, { onExcessProperty: "error" });
+
+export type PendingTokenCreation = typeof PendingTokenCreationSchema.Type;
+export type TokenCreatePhase = "idle" | "dispatching" | "blocked" | "revealed";
+
+export type TokenCreateState = {
+  readonly phase: TokenCreatePhase;
+  readonly pending: PendingTokenCreation | null;
+  readonly error: ApiError | null;
+  readonly notice: string | null;
+  readonly canRetry: boolean;
+};
+
+export type TokenCreateEnvironment = {
+  readonly getStorage: () => Pick<Storage, "getItem" | "setItem" | "removeItem">;
+  readonly fillRandom: (bytes: Uint8Array<ArrayBuffer>) => void;
+};
+
+type TokenCreateCoordinatorOptions = {
+  readonly environment: TokenCreateEnvironment;
+  readonly create: (
+    name: string,
+    idempotencyKey: string,
+    signal: AbortSignal,
+  ) => Promise<TokenCreateApiResult>;
+  readonly onstatechange: (state: TokenCreateState) => void;
+  readonly onrevealed: (token: CreatedToken) => void;
+};
+
+type ActiveTokenCreate = {
+  readonly pending: PendingTokenCreation;
+  readonly generation: number;
+  readonly controller: AbortController;
+  readonly automaticRetryUsed: boolean;
+};
+
+type PendingRead =
+  | { readonly ok: true; readonly value: PendingTokenCreation | null }
+  | { readonly ok: false; readonly reason: "invalid" | "storage" };
+
+export function emptyTokenCreateState(): TokenCreateState {
+  return { phase: "idle", pending: null, error: null, notice: null, canRetry: false };
+}
+
+export function browserTokenCreateEnvironment(): TokenCreateEnvironment {
+  return {
+    getStorage: () => window.sessionStorage,
+    fillRandom: (bytes) => {
+      globalThis.crypto.getRandomValues(bytes);
+    },
+  };
+}
+
+export function isAmbiguousTokenCreateResult(result: TokenCreateApiResult) {
+  if (
+    !result.ok &&
+    result.error.code === "idempotency_replay_revoked" &&
+    result.error.status === 409 &&
+    result.replayProvenance === "authoritative" &&
+    result.responseDisposition === "authoritative"
+  ) {
+    return false;
+  }
+  if (!result.ok && result.error.code === "idempotency_replay_revoked") return true;
+  if (!result.ok && result.replayProvenance === "authoritative") return true;
+  if (result.responseDisposition === "ambiguous" || result.replayProvenance === "invalid") {
+    return true;
+  }
+  if (result.ok) return false;
+  if (
+    [
+      "idempotency_mismatch",
+      "invalid_csrf",
+      "invalid_response",
+      "network_error",
+      "request_cancelled",
+      "unexpected_client_error",
+    ].includes(result.error.code)
+  ) {
+    return true;
+  }
+  if (result.error.status === 401) return true;
+  return result.error.status >= 500 && result.replayProvenance !== "authoritative";
+}
+
+export function createTokenCreateCoordinator(options: TokenCreateCoordinatorOptions) {
+  let state = emptyTokenCreateState();
+  let active: ActiveTokenCreate | null = null;
+  let revealedPending: PendingTokenCreation | null = null;
+  let generation = 0;
+  let disposed = false;
+
+  function publish(next: TokenCreateState) {
+    if (disposed) return;
+    state = next;
+    options.onstatechange(next);
+  }
+
+  function owns(operation: ActiveTokenCreate) {
+    return (
+      !disposed &&
+      active === operation &&
+      generation === operation.generation &&
+      !operation.controller.signal.aborted
+    );
+  }
+
+  function storage() {
+    return syncResult(options.environment.getStorage);
+  }
+
+  function readStoredPending(): PendingRead {
+    const available = storage();
+    if (!available.ok) return { ok: false, reason: "storage" };
+    const stored = syncResult(() => available.value.getItem(TOKEN_CREATE_STORAGE_KEY));
+    if (!stored.ok) return { ok: false, reason: "storage" };
+    if (stored.value === null) return { ok: true, value: null };
+    const decoded = decodePendingTokenCreation(stored.value);
+    if (Option.isNone(decoded) || !validPending(decoded.value)) {
+      return { ok: false, reason: "invalid" };
+    }
+    return { ok: true, value: decoded.value };
+  }
+
+  function persistPending(pending: PendingTokenCreation): PendingRead {
+    const current = readStoredPending();
+    if (!current.ok || current.value !== null) return current;
+    const available = storage();
+    if (!available.ok) return { ok: false, reason: "storage" };
+    const written = syncResult(() =>
+      available.value.setItem(TOKEN_CREATE_STORAGE_KEY, JSON.stringify(pending)),
+    );
+    if (!written.ok) return { ok: false, reason: "storage" };
+    const verified = readStoredPending();
+    return verified.ok && samePending(verified.value, pending)
+      ? ({ ok: true, value: pending } as const)
+      : ({ ok: false, reason: "storage" } as const);
+  }
+
+  function compareAndClearPending(pending: PendingTokenCreation) {
+    const current = readStoredPending();
+    if (!current.ok) return { ok: false, mismatch: false, reason: current.reason } as const;
+    if (!samePending(current.value, pending)) {
+      return { ok: false, mismatch: true, reason: "invalid" } as const;
+    }
+    const available = storage();
+    if (!available.ok) {
+      return { ok: false, mismatch: false, reason: "storage" } as const;
+    }
+    const removed = syncResult(() => available.value.removeItem(TOKEN_CREATE_STORAGE_KEY));
+    if (!removed.ok) return { ok: false, mismatch: false, reason: "storage" } as const;
+    const verified = readStoredPending();
+    return verified.ok && verified.value === null
+      ? ({ ok: true, mismatch: false } as const)
+      : ({ ok: false, mismatch: false, reason: "storage" } as const);
+  }
+
+  function generateKey() {
+    const bytes = new Uint8Array(32);
+    const filled = syncResult(() => options.environment.fillRandom(bytes));
+    if (!filled.ok) return null;
+    return [...bytes].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+  }
+
+  function newOperation(pending: PendingTokenCreation, automaticRetryUsed: boolean) {
+    active?.controller.abort();
+    const operation = {
+      pending,
+      generation: ++generation,
+      controller: new AbortController(),
+      automaticRetryUsed,
+    } satisfies ActiveTokenCreate;
+    active = operation;
+    return operation;
+  }
+
+  function publishBlocked(
+    pending: PendingTokenCreation | null,
+    error: ApiError,
+    canRetry: boolean,
+  ) {
+    active = null;
+    publish({
+      phase: "blocked",
+      pending,
+      error,
+      notice: "Executor could not safely finish token creation. The pending request was retained.",
+      canRetry,
+    });
+    return { ok: false, error } as const;
+  }
+
+  async function recoverDifferentPending(operation: ActiveTokenCreate) {
+    if (!owns(operation)) return requestCancelled();
+    operation.controller.abort();
+    active = null;
+    generation += 1;
+    const recovered = await recoverStored();
+    return recovered ?? requestCancelled();
+  }
+
+  async function fencePending(operation: ActiveTokenCreate) {
+    if (!owns(operation)) return requestCancelled();
+    const stored = readStoredPending();
+    if (!stored.ok) {
+      return publishBlocked(
+        operation.pending,
+        stored.reason === "invalid" ? invalidStoredPendingError() : storageUnavailableError(),
+        stored.reason !== "invalid",
+      );
+    }
+    if (!samePending(stored.value, operation.pending)) return recoverDifferentPending(operation);
+    return null;
+  }
+
+  async function settleDefinitiveFailure(operation: ActiveTokenCreate, error: ApiError) {
+    if (!owns(operation)) return requestCancelled();
+    const cleared = compareAndClearPending(operation.pending);
+    if (cleared.mismatch) return recoverDifferentPending(operation);
+    if (!cleared.ok) {
+      return publishBlocked(operation.pending, storageUnavailableError(), true);
+    }
+    if (!owns(operation)) return requestCancelled();
+    active = null;
+    publish({ phase: "idle", pending: null, error, notice: null, canRetry: false });
+    return { ok: false, error } as const;
+  }
+
+  async function handleAmbiguous(
+    operation: ActiveTokenCreate,
+    result: TokenCreateApiResult | null,
+  ): Promise<ApiResult<CreatedToken>> {
+    if (!owns(operation)) return requestCancelled();
+    if (!operation.automaticRetryUsed) {
+      return dispatch(newOperation(operation.pending, true));
+    }
+    const error = result !== null && !result.ok ? result.error : invalidTokenCreateResponseError();
+    return publishBlocked(operation.pending, error, true);
+  }
+
+  async function dispatch(operation: ActiveTokenCreate): Promise<ApiResult<CreatedToken>> {
+    const before = await fencePending(operation);
+    if (before !== null) return before;
+    publish({
+      phase: "dispatching",
+      pending: operation.pending,
+      error: null,
+      notice: operation.automaticRetryUsed
+        ? "Retrying the exact pending token request."
+        : "Submitting the token request.",
+      canRetry: false,
+    });
+    const settled = await settlePromise(() =>
+      options.create(operation.pending.name, operation.pending.key, operation.controller.signal),
+    );
+    if (!owns(operation)) return requestCancelled();
+    const after = await fencePending(operation);
+    if (after !== null) return after;
+    if (!settled.ok) return handleAmbiguous(operation, null);
+    if (isAmbiguousTokenCreateResult(settled.value)) {
+      return handleAmbiguous(operation, settled.value);
+    }
+    if (!settled.value.ok) {
+      return settleDefinitiveFailure(operation, settled.value.error);
+    }
+    if (settled.value.value.name !== operation.pending.name) {
+      return handleAmbiguous(operation, settled.value);
+    }
+
+    const token = settled.value.value;
+    active = null;
+    revealedPending = operation.pending;
+    publish({
+      phase: "revealed",
+      pending: operation.pending,
+      error: null,
+      notice: "Token created. Save the secret before acknowledging it.",
+      canRetry: false,
+    });
+    if (!disposed && revealedPending === operation.pending) options.onrevealed(token);
+    return { ok: true, value: token };
+  }
+
+  async function start(name: string) {
+    if (disposed) return requestCancelled();
+    if (active !== null || state.phase !== "idle" || revealedPending !== null) {
+      return {
+        ok: false,
+        error: operationError(
+          "token_create_already_pending",
+          "Finish the pending token request before creating another token.",
+        ),
+      } as const;
+    }
+
+    const normalizedName = name.trim();
+    if (normalizedName === "" || normalizedName.length > 80) {
+      const error = operationError(
+        "invalid_token_name",
+        "Token names must contain between 1 and 80 characters.",
+        400,
+      );
+      publish({ phase: "idle", pending: null, error, notice: null, canRetry: false });
+      return { ok: false, error } as const;
+    }
+    const key = generateKey();
+    if (key === null) {
+      const error = randomnessUnavailableError();
+      publish({ phase: "idle", pending: null, error, notice: null, canRetry: false });
+      return { ok: false, error } as const;
+    }
+    const pending = { version: 1, key, name: normalizedName } as const;
+    const persisted = persistPending(pending);
+    if (!persisted.ok) {
+      const error =
+        persisted.reason === "invalid" ? invalidStoredPendingError() : storageUnavailableError();
+      publish({ phase: "blocked", pending: null, error, notice: null, canRetry: false });
+      return { ok: false, error } as const;
+    }
+    if (!samePending(persisted.value, pending)) {
+      const recovered = await recoverStored();
+      return (
+        recovered ?? {
+          ok: false,
+          error: operationError(
+            "token_create_recovery_pending",
+            "A token request from this browser tab must be recovered first.",
+          ),
+        }
+      );
+    }
+    return dispatch(newOperation(pending, false));
+  }
+
+  async function recoverStored() {
+    if (disposed || active !== null || state.phase === "revealed") return null;
+    const stored = readStoredPending();
+    if (!stored.ok) {
+      const error =
+        stored.reason === "invalid" ? invalidStoredPendingError() : storageUnavailableError();
+      publish({
+        phase: "blocked",
+        pending: null,
+        error,
+        notice: "The pending token request could not be read safely.",
+        canRetry: false,
+      });
+      return { ok: false, error } as const;
+    }
+    if (stored.value === null) {
+      publish(emptyTokenCreateState());
+      return null;
+    }
+    return dispatch(newOperation(stored.value, false));
+  }
+
+  async function retry() {
+    if (disposed) return requestCancelled();
+    if (state.phase !== "blocked" || !state.canRetry) return recoverStored();
+    const stored = readStoredPending();
+    if (!stored.ok || stored.value === null) {
+      const error =
+        !stored.ok && stored.reason === "storage"
+          ? storageUnavailableError()
+          : invalidStoredPendingError();
+      return publishBlocked(null, error, false);
+    }
+    return dispatch(newOperation(stored.value, false));
+  }
+
+  function acknowledge() {
+    if (disposed || revealedPending === null || state.phase !== "revealed") {
+      return requestCancelled();
+    }
+    const pending = revealedPending;
+    const cleared = compareAndClearPending(pending);
+    if (!cleared.ok) {
+      const error = cleared.mismatch ? pendingChangedError() : storageUnavailableError();
+      publish({ ...state, error, notice: null });
+      return { ok: false, error } as const;
+    }
+    revealedPending = null;
+    publish(emptyTokenCreateState());
+    return { ok: true, value: undefined } as const;
+  }
+
+  function dispose() {
+    disposed = true;
+    generation += 1;
+    active?.controller.abort();
+    active = null;
+    revealedPending = null;
+  }
+
+  return {
+    start,
+    recoverStored,
+    retry,
+    acknowledge,
+    dispose,
+    get state() {
+      return state;
+    },
+  };
+}
+
+function validPending(pending: PendingTokenCreation) {
+  return (
+    /^[0-9a-f]{64}$/.test(pending.key) &&
+    pending.name === pending.name.trim() &&
+    pending.name.length > 0 &&
+    pending.name.length <= 80
+  );
+}
+
+function samePending(left: PendingTokenCreation | null, right: PendingTokenCreation | null) {
+  return (
+    left === right ||
+    (left !== null &&
+      right !== null &&
+      left.version === right.version &&
+      left.key === right.key &&
+      left.name === right.name)
+  );
+}
+
+function syncResult<Value>(evaluate: () => Value) {
+  const result = Effect.runSyncExit(Effect.try({ try: evaluate, catch: () => undefined }));
+  return Exit.isSuccess(result)
+    ? ({ ok: true, value: result.value } as const)
+    : ({ ok: false } as const);
+}
+
+async function settlePromise<Value>(evaluate: () => Promise<Value>) {
+  return Promise.resolve()
+    .then(evaluate)
+    .then(
+      (value) => ({ ok: true, value }) as const,
+      () => ({ ok: false }) as const,
+    );
+}
+
+function operationError(
+  code: string,
+  displayMessage: string,
+  status = 0,
+  requestId: string | null = null,
+) {
+  return new ApiError({ code, displayMessage, requestId, status });
+}
+
+function requestCancelled() {
+  return {
+    ok: false,
+    error: operationError("request_cancelled", "The request was cancelled."),
+  } as const;
+}
+
+function storageUnavailableError() {
+  return operationError(
+    "token_create_storage_unavailable",
+    "Secure tab storage is unavailable. Executor did not start a new token request.",
+  );
+}
+
+function randomnessUnavailableError() {
+  return operationError(
+    "token_create_randomness_unavailable",
+    "Secure browser randomness is unavailable. Executor did not start a new token request.",
+  );
+}
+
+function invalidStoredPendingError() {
+  return operationError(
+    "token_create_pending_invalid",
+    "The stored token request is invalid. It was retained for manual recovery.",
+  );
+}
+
+function invalidTokenCreateResponseError() {
+  return operationError(
+    "invalid_response",
+    "Executor returned a token creation response the dashboard could not safely use.",
+    502,
+  );
+}
+
+function pendingChangedError() {
+  return operationError(
+    "token_create_pending_changed",
+    "A different token request is pending. Its recovery state was not cleared.",
+  );
+}
diff --git a/web/src/lib/token-page-state.test.ts b/web/src/lib/token-page-state.test.ts
new file mode 100644
index 000000000..73d3d3b29
--- /dev/null
+++ b/web/src/lib/token-page-state.test.ts
@@ -0,0 +1,129 @@
+import { describe, expect, it } from "@effect/vitest";
+import {
+  canCreateToken,
+  isTokenRecoveryAuthNavigation,
+  shouldBlockTokenExit,
+  tokenExitBlockReason,
+  tokenListView,
+} from "./token-page-state";
+
+describe("API token page state", () => {
+  it("distinguishes an unavailable initial load from an empty successful load", () => {
+    expect(tokenListView({ loading: false, hasLoaded: false, hasError: true, tokenCount: 0 })).toBe(
+      "unavailable",
+    );
+    expect(tokenListView({ loading: false, hasLoaded: true, hasError: false, tokenCount: 0 })).toBe(
+      "empty",
+    );
+  });
+
+  it("labels retained data as stale after a refresh failure", () => {
+    expect(tokenListView({ loading: false, hasLoaded: true, hasError: true, tokenCount: 2 })).toBe(
+      "stale",
+    );
+  });
+
+  it("blocks another token creation until the revealed secret is explicitly saved", () => {
+    expect(
+      canCreateToken({
+        name: "Laptop",
+        creating: false,
+        hasPendingCreate: true,
+        hasUnsavedToken: false,
+      }),
+    ).toBe(false);
+    expect(
+      canCreateToken({
+        name: "Laptop",
+        creating: false,
+        hasPendingCreate: false,
+        hasUnsavedToken: true,
+      }),
+    ).toBe(false);
+    expect(
+      canCreateToken({
+        name: "Laptop",
+        creating: false,
+        hasPendingCreate: false,
+        hasUnsavedToken: false,
+      }),
+    ).toBe(true);
+  });
+
+  it("guards navigation throughout creation and one-time reveal", () => {
+    expect(
+      shouldBlockTokenExit({
+        creating: true,
+        hasPendingCreate: true,
+        hasUnsavedToken: false,
+      }),
+    ).toBe(true);
+    expect(
+      shouldBlockTokenExit({
+        creating: false,
+        hasPendingCreate: true,
+        hasUnsavedToken: true,
+      }),
+    ).toBe(true);
+    expect(
+      shouldBlockTokenExit({
+        creating: false,
+        hasPendingCreate: true,
+        hasUnsavedToken: false,
+      }),
+    ).toBe(true);
+    expect(
+      shouldBlockTokenExit({
+        creating: false,
+        hasPendingCreate: false,
+        hasUnsavedToken: false,
+      }),
+    ).toBe(false);
+  });
+
+  it("reports why an exit is blocked so creation can show page-level feedback", () => {
+    expect(
+      tokenExitBlockReason({
+        creating: true,
+        hasPendingCreate: true,
+        hasUnsavedToken: false,
+      }),
+    ).toBe("creating");
+    expect(
+      tokenExitBlockReason({
+        creating: false,
+        hasPendingCreate: true,
+        hasUnsavedToken: true,
+      }),
+    ).toBe("unsaved-token");
+    expect(
+      tokenExitBlockReason({
+        creating: false,
+        hasPendingCreate: true,
+        hasUnsavedToken: false,
+      }),
+    ).toBe("pending-recovery");
+    expect(
+      tokenExitBlockReason({
+        creating: false,
+        hasPendingCreate: false,
+        hasUnsavedToken: false,
+      }),
+    ).toBeNull();
+  });
+
+  it("allows only forced reauthentication to bypass a pending recovery guard", () => {
+    expect(isTokenRecoveryAuthNavigation({ authenticated: false, destinationPath: "/login" })).toBe(
+      true,
+    );
+    expect(isTokenRecoveryAuthNavigation({ authenticated: true, destinationPath: "/login" })).toBe(
+      false,
+    );
+    expect(
+      isTokenRecoveryAuthNavigation({ authenticated: false, destinationPath: "/sources" }),
+    ).toBe(false);
+    expect(isTokenRecoveryAuthNavigation({ authenticated: false, destinationPath: null })).toBe(
+      false,
+    );
+  });
+});
diff --git a/web/src/lib/token-page-state.ts b/web/src/lib/token-page-state.ts
new file mode 100644
index 000000000..e296708f7
--- /dev/null
+++ b/web/src/lib/token-page-state.ts
@@ -0,0 +1,50 @@
+export type TokenListView = "loading" | "unavailable" | "empty" | "ready" | "stale";
+
+export function tokenListView(input: {
+  loading: boolean;
+  hasLoaded: boolean;
+  hasError: boolean;
+  tokenCount: number;
+}) {
+  if (!input.hasLoaded && input.loading) return "loading";
+  if (!input.hasLoaded) return input.hasError ? "unavailable" : "loading";
+  if (input.hasError) return "stale";
+  return input.tokenCount === 0 ? "empty" : "ready";
+}
+
+export function canCreateToken(input: {
+  name: string;
+  creating: boolean;
+  hasPendingCreate: boolean;
+  hasUnsavedToken: boolean;
+}) {
+  return (
+    input.name.trim() !== "" && !input.creating && !input.hasPendingCreate && !input.hasUnsavedToken
+  );
+}
+
+export function tokenExitBlockReason(input: {
+  creating: boolean;
+  hasPendingCreate: boolean;
+  hasUnsavedToken: boolean;
+}) {
+  if (input.creating) return "creating";
+  if (input.hasUnsavedToken) return "unsaved-token";
+  if (input.hasPendingCreate) return "pending-recovery";
+  return null;
+}
+
+export function shouldBlockTokenExit(input: {
+  creating: boolean;
+  hasPendingCreate: boolean;
+  hasUnsavedToken: boolean;
+}) {
+  return tokenExitBlockReason(input) !== null;
+}
+
+export function isTokenRecoveryAuthNavigation(input: {
+  authenticated: boolean;
+  destinationPath: string | null;
+}) {
+  return !input.authenticated && input.destinationPath === "/login";
+}
diff --git a/web/src/lib/token-reveal-focus.test.ts b/web/src/lib/token-reveal-focus.test.ts
new file mode 100644
index 000000000..9e0a073a0
--- /dev/null
+++ b/web/src/lib/token-reveal-focus.test.ts
@@ -0,0 +1,57 @@
+import { afterEach, describe, expect, it } from "@effect/vitest";
+import { focusRevealedToken } from "./token-reveal-focus";
+
+const token = {
+  id: "token-1",
+  name: "Laptop agent",
+  token: "exr_public_secret",
+  createdAt: 1_750_000_000,
+};
+
+afterEach(() => {
+  document.body.replaceChildren();
+});
+
+describe("one-time token focus", () => {
+  it("focuses and selects the revealed token after its input renders", async () => {
+    const previous = document.createElement("button");
+    const field = document.createElement("input");
+    field.readOnly = true;
+    field.value = token.token;
+    document.body.append(previous, field);
+    previous.focus();
+
+    await focusRevealedToken({
+      token,
+      currentToken: () => token,
+      field: () => field,
+      isCurrentLifetime: () => true,
+    });
+
+    expect(document.activeElement).toBe(field);
+    expect(field.selectionStart).toBe(0);
+    expect(field.selectionEnd).toBe(token.token.length);
+  });
+
+  it("leaves focus alone for a stale lifetime or replaced token", async () => {
+    const previous = document.createElement("button");
+    const field = document.createElement("input");
+    document.body.append(previous, field);
+    previous.focus();
+
+    await focusRevealedToken({
+      token,
+      currentToken: () => token,
+      field: () => field,
+      isCurrentLifetime: () => false,
+    });
+    await focusRevealedToken({
+      token,
+      currentToken: () => null,
+      field: () => field,
+      isCurrentLifetime: () => true,
+    });
+
+    expect(document.activeElement).toBe(previous);
+  });
+});
diff --git a/web/src/lib/token-reveal-focus.ts b/web/src/lib/token-reveal-focus.ts
new file mode 100644
index 000000000..887b05b55
--- /dev/null
+++ b/web/src/lib/token-reveal-focus.ts
@@ -0,0 +1,17 @@
+import { tick } from "svelte";
+import type { CreatedToken } from "./api";
+
+export async function focusRevealedToken(input: {
+  token: CreatedToken;
+  currentToken: () => CreatedToken | null;
+  field: () => HTMLInputElement | undefined;
+  isCurrentLifetime: () => boolean;
+}) {
+  await tick();
+  if (!input.isCurrentLifetime() || input.currentToken() !== input.token) return;
+
+  const field = input.field();
+  if (field === undefined) return;
+  field.focus();
+  field.select();
+}
diff --git a/web/src/routes/+layout.svelte b/web/src/routes/+layout.svelte
new file mode 100644
index 000000000..67f0edfec
--- /dev/null
+++ b/web/src/routes/+layout.svelte
@@ -0,0 +1,82 @@
+<script lang="ts">
+  import "../styles.css";
+  import { goto } from "$app/navigation";
+  import { page } from "$app/state";
+  import favicon from "$lib/assets/favicon.svg";
+  import { createAuthState, provideAuthState } from "$lib/auth.svelte";
+  import ErrorNotice from "$lib/ErrorNotice.svelte";
+  import { isProtectedPath, routeDestination } from "$lib/navigation";
+  import { onMount, type Snippet } from "svelte";
+
+  let { children }: { children: Snippet } = $props();
+
+  const auth = createAuthState();
+  provideAuthState(auth);
+
+  let pathname = $derived(page.url.pathname);
+  let protectedPage = $derived(isProtectedPath(pathname));
+  let authorizedPath = $state<string | null>(null);
+  let canRender = $derived(
+    !protectedPage || (auth.phase === "ready" && auth.authenticated) || authorizedPath === pathname,
+  );
+
+  onMount(() => {
+    const controller = new AbortController();
+    void auth.refresh(controller.signal);
+
+    return () => {
+      controller.abort();
+      auth.dispose();
+    };
+  });
+
+  $effect(() => {
+    if (auth.phase !== "ready") return;
+
+    if (!protectedPage) {
+      authorizedPath = null;
+    } else if (auth.authenticated) {
+      authorizedPath = pathname;
+    }
+
+    const destination = routeDestination({
+      pathname: page.url.pathname,
+      search: page.url.search,
+      hash: page.url.hash,
+      origin: page.url.origin,
+      setupRequired: auth.setupRequired,
+      authenticated: auth.authenticated,
+    });
+    if (destination !== null) void goto(destination, { replaceState: true });
+  });
+</script>
+
+<svelte:head>
+  <title>Executor</title>
+  <link rel="icon" href={favicon} />
+  <meta
+    name="description"
+    content="A local gateway for MCP servers, OpenAPI services, and GraphQL endpoints."
+  />
+</svelte:head>
+
+{#if auth.phase === "error" && auth.error !== null}
+  <main class="centered-page" aria-live="polite">
+    <section class="auth-card compact">
+      <span class="brand-mark" aria-hidden="true">EX</span>
+      <div>
+        <ErrorNotice error={auth.error} />
+        <button type="button" onclick={() => auth.refresh()}>Try again</button>
+      </div>
+    </section>
+  </main>
+{:else if canRender}
+  {@render children()}
+{:else}
+  <main class="centered-page" aria-live="polite">
+    <section class="auth-card compact">
+      <span class="brand-mark" aria-hidden="true">EX</span>
+      <p>Checking your Executor session...</p>
+    </section>
+  </main>
+{/if}
diff --git a/web/src/routes/+layout.ts b/web/src/routes/+layout.ts
new file mode 100644
index 000000000..a3d15781a
--- /dev/null
+++ b/web/src/routes/+layout.ts
@@ -0,0 +1 @@
+export const ssr = false;
diff --git a/web/src/routes/+page.svelte b/web/src/routes/+page.svelte
new file mode 100644
index 000000000..09e479b91
--- /dev/null
+++ b/web/src/routes/+page.svelte
@@ -0,0 +1,9 @@
+<main class="centered-page" aria-live="polite">
+  <section class="auth-card compact">
+    <span class="brand-mark" aria-hidden="true">EX</span>
+    <div>
+      <p class="eyebrow">Executor</p>
+      <p>Opening your local gateway...</p>
+    </div>
+  </section>
+</main>
diff --git a/web/src/routes/approvals/+page.svelte b/web/src/routes/approvals/+page.svelte
new file mode 100644
index 000000000..3782ef272
--- /dev/null
+++ b/web/src/routes/approvals/+page.svelte
@@ -0,0 +1,807 @@
+<script lang="ts">
+  import { goto } from "$app/navigation";
+  import { page } from "$app/state";
+  import { onMount, tick, untrack } from "svelte";
+  import DashboardShell from "$lib/DashboardShell.svelte";
+  import { useAuthState } from "$lib/auth.svelte";
+  import {
+    decideApproval,
+    getApproval,
+    listApprovals,
+    type ApiError,
+    type ApprovalDecision,
+    type ApprovalDetail,
+    type ApprovalPage,
+  } from "$lib/api";
+  import {
+    approvalCountdown,
+    approvalDecisionCopy,
+    approvalStatuses,
+    approvalStatusLabel,
+    canDecideApproval,
+    createApprovalPoller,
+    decisionResultScope,
+    focusTargetAfterDecision,
+  } from "$lib/approval-state";
+  import {
+    approvalsListKey,
+    approvalsUrl,
+    parseApprovalsUrl,
+    type ApprovalStatusFilter,
+  } from "$lib/approval-url";
+  import {
+    beginIdentityResourceLoad,
+    createLatestRequest,
+    emptyResource,
+    settleResourceLoad,
+    unexpectedRequestError,
+  } from "$lib/catalog-state";
+
+  type RefreshIntent = {
+    readonly generation: number;
+    readonly announce: boolean;
+  };
+
+  type ApprovalNavigation = {
+    readonly url: URL;
+    readonly goto: (destination: string) => void | Promise<void>;
+  };
+
+  type ApprovalPollEnvironment = {
+    readonly schedule: (callback: () => void, delay: number) => number;
+    readonly cancel: (handle: number) => void;
+    readonly isVisible: () => boolean;
+  };
+
+  let {
+    approvalNavigation,
+    approvalPollEnvironment,
+  }: {
+    approvalNavigation?: ApprovalNavigation;
+    approvalPollEnvironment?: ApprovalPollEnvironment;
+  } = $props();
+
+  const auth = useAuthState();
+  const listRequest = createLatestRequest();
+  const detailRequest = createLatestRequest();
+  let searchKey = $derived((approvalNavigation?.url ?? page.url).search);
+  let urlState = $derived(parseApprovalsUrl(new URLSearchParams(searchKey)));
+  let listKey = $derived(approvalsListKey(urlState));
+  let resource = $state(emptyResource<ApprovalPage>());
+  let resourceIdentity = $state<string | null>(null);
+  let detail = $state(emptyResource<ApprovalDetail>());
+  let detailIdentity = $state<string | null>(null);
+  let listRefresh = $state<RefreshIntent>({ generation: 0, announce: false });
+  let detailRefresh = $state<RefreshIntent>({ generation: 0, announce: false });
+  let announceListLoading = $state(false);
+  let announceDetailLoading = $state(false);
+  let announceListError = $state(false);
+  let announceDetailError = $state(false);
+  let detailReturnId = $state<string | null>(null);
+  let now = $state(Date.now());
+  let confirming = $state<ApprovalDecision | null>(null);
+  let decisionById = $state<Record<string, ApprovalDecision | undefined>>({});
+  let decisionFenceById = $state<Record<string, number | undefined>>({});
+  let decisionError = $state<ApiError | null>(null);
+  let announcement = $state("");
+  let disposed = false;
+  let decisionUnavailable = $derived.by(() => {
+    const approval = detail.data;
+    if (
+      !auth.authenticated ||
+      approval === null ||
+      detail.loading ||
+      detail.stale ||
+      detailIdentity !== urlState.approval ||
+      approval.id !== urlState.approval ||
+      !canDecideApproval(approval, now)
+    ) {
+      return true;
+    }
+    const fencedRevision = decisionFenceById[approval.id];
+    return fencedRevision !== undefined && approval.revision <= fencedRevision;
+  });
+  let decisionReadOnly = $derived(
+    decisionUnavailable || (detail.data !== null && decisionById[detail.data.id] !== undefined),
+  );
+
+  onMount(() => {
+    return () => {
+      disposed = true;
+    };
+  });
+
+  $effect(() => {
+    const interval = window.setInterval(() => {
+      now = Date.now();
+      if (confirming !== null && detail.data !== null && !canDecideApproval(detail.data, now)) {
+        confirming = null;
+        announcement = "The approval deadline passed. Refresh to see the recorded outcome.";
+        void tick().then(() => document.getElementById("approval-detail-panel")?.focus());
+      }
+    }, 1_000);
+    return () => window.clearInterval(interval);
+  });
+
+  $effect(() => {
+    const environment = approvalPollEnvironment;
+    return createApprovalPoller({
+      schedule: environment?.schedule ?? ((callback, delay) => window.setTimeout(callback, delay)),
+      cancel: environment?.cancel ?? ((handle) => window.clearTimeout(handle)),
+      isVisible: environment?.isVisible ?? (() => document.visibilityState === "visible"),
+      isListLoading: () => resource.loading,
+      hasDetail: () => urlState.approval !== null,
+      isDetailLoading: () => detail.loading,
+      refreshList: () => requestListRefresh(false),
+      refreshDetail: () => requestDetailRefresh(false),
+    });
+  });
+
+  $effect(() => {
+    const key = listKey;
+    const refresh = listRefresh;
+    const requestKey = `${key}\u0000${refresh.generation}`;
+    const status = urlState.status === "all" ? null : urlState.status;
+    const cursor = urlState.cursor;
+    const identityChanged = untrack(() => resourceIdentity) !== key;
+    const previousResource = untrack(() => resource);
+    const preservePassiveError =
+      !identityChanged && !refresh.announce && previousResource.error !== null;
+    const announceFailure = identityChanged || refresh.announce || previousResource.error === null;
+    const started = beginIdentityResourceLoad(
+      previousResource,
+      untrack(() => resourceIdentity),
+      key,
+    );
+    resourceIdentity = started.identity;
+    resource = preservePassiveError
+      ? { ...started.state, error: previousResource.error }
+      : started.state;
+    announceListLoading = identityChanged || refresh.announce;
+    return listRequest.start(
+      async (signal) => ({
+        requestKey,
+        result: await listApprovals({ status, cursor, limit: 50 }, undefined, signal),
+      }),
+      ({ requestKey: completedKey, result }) => {
+        if (completedKey !== `${listKey}\u0000${listRefresh.generation}`) return;
+        if (!result.ok && auth.recoverFromApiError(result.error)) return;
+        const settled = settleResourceLoad(resource, result);
+        resource =
+          !result.ok && preservePassiveError && previousResource.error !== null
+            ? { ...settled, error: previousResource.error }
+            : settled;
+        announceListError = !result.ok && (announceFailure || announceListError);
+        announceListLoading = false;
+      },
+      () => {
+        const settled = settleResourceLoad(resource, {
+          ok: false,
+          error: unexpectedRequestError(),
+        });
+        resource =
+          preservePassiveError && previousResource.error !== null
+            ? { ...settled, error: previousResource.error }
+            : settled;
+        announceListError = announceFailure || announceListError;
+        announceListLoading = false;
+      },
+    );
+  });
+
+  $effect(() => {
+    const approvalId = urlState.approval;
+    const returnId = untrack(() => detailReturnId);
+    void tick().then(() => {
+      if (approvalId !== null) {
+        document.getElementById("approval-detail-panel")?.focus();
+      } else if (returnId !== null) {
+        (
+          document.getElementById(`inspect-approval-${returnId}`) ??
+          document.getElementById("approvals-heading")
+        )?.focus();
+        detailReturnId = null;
+      }
+    });
+  });
+
+  $effect(() => {
+    const approvalId = urlState.approval;
+    const refresh = detailRefresh;
+    const requestKey = `${approvalId ?? ""}\u0000${refresh.generation}`;
+    if (approvalId === null) {
+      confirming = null;
+      decisionError = null;
+      detail = { data: null, loading: false, error: null, stale: false };
+      detailIdentity = null;
+      announceDetailLoading = false;
+      announceDetailError = false;
+      return;
+    }
+    const identityChanged = untrack(() => detailIdentity) !== approvalId;
+    if (identityChanged) {
+      confirming = null;
+      decisionError = null;
+    }
+    const previousDetailResource = untrack(() => detail);
+    const preservePassiveError =
+      !identityChanged && !refresh.announce && previousDetailResource.error !== null;
+    const announceFailure =
+      identityChanged || refresh.announce || previousDetailResource.error === null;
+    const started = beginIdentityResourceLoad(
+      previousDetailResource,
+      untrack(() => detailIdentity),
+      approvalId,
+    );
+    detailIdentity = started.identity;
+    detail = preservePassiveError
+      ? { ...started.state, error: previousDetailResource.error }
+      : started.state;
+    announceDetailLoading = identityChanged || refresh.announce;
+    return detailRequest.start(
+      async (signal) => ({
+        requestKey,
+        result: await getApproval(approvalId, undefined, signal),
+      }),
+      ({ requestKey: completedKey, result }) => {
+        if (completedKey !== `${urlState.approval ?? ""}\u0000${detailRefresh.generation}`) return;
+        if (!result.ok && auth.recoverFromApiError(result.error)) return;
+        const decisionHadFocus =
+          document.getElementById("approval-decision-region")?.contains(document.activeElement) ??
+          false;
+        const previousDetail = detail.data;
+        if (result.ok) {
+          decisionError = null;
+          if (
+            previousDetail !== null &&
+            (previousDetail.revision !== result.value.revision ||
+              previousDetail.status !== result.value.status)
+          ) {
+            confirming = null;
+          }
+          const fencedRevision = decisionFenceById[result.value.id];
+          if (
+            fencedRevision !== undefined &&
+            (result.value.revision > fencedRevision || result.value.status !== "pending")
+          ) {
+            delete decisionFenceById[result.value.id];
+          }
+        }
+        const settled = settleResourceLoad(detail, result, { retainDataOnError: false });
+        detail =
+          !result.ok && preservePassiveError && previousDetailResource.error !== null
+            ? { ...settled, error: previousDetailResource.error }
+            : settled;
+        announceDetailError = !result.ok && (announceFailure || announceDetailError);
+        announceDetailLoading = false;
+        if (decisionHadFocus && (!result.ok || !canDecideApproval(result.value, Date.now()))) {
+          announcement = result.ok
+            ? `This approval is now ${approvalStatusLabel(result.value.status)}.`
+            : "The latest approval detail could not be loaded.";
+          void tick().then(() => {
+            const target = result.ok
+              ? document.getElementById("approval-detail-panel")
+              : document.getElementById("retry-approval-detail");
+            target?.focus();
+          });
+        }
+      },
+      () => {
+        const settled = settleResourceLoad(
+          detail,
+          { ok: false, error: unexpectedRequestError() },
+          { retainDataOnError: false },
+        );
+        detail =
+          preservePassiveError && previousDetailResource.error !== null
+            ? { ...settled, error: previousDetailResource.error }
+            : settled;
+        announceDetailError = announceFailure || announceDetailError;
+        announceDetailLoading = false;
+      },
+    );
+  });
+
+  function requestListRefresh(announce: boolean) {
+    listRefresh = { generation: listRefresh.generation + 1, announce };
+  }
+
+  function requestDetailRefresh(announce: boolean) {
+    detailRefresh = { generation: detailRefresh.generation + 1, announce };
+  }
+
+  function refreshApprovals() {
+    requestListRefresh(true);
+    if (urlState.approval !== null) requestDetailRefresh(true);
+  }
+
+  async function beginConfirmation(decision: ApprovalDecision) {
+    confirming = decision;
+    await tick();
+    document.getElementById("confirm-approval-decision")?.focus();
+  }
+
+  async function cancelConfirmation() {
+    const decision = confirming;
+    confirming = null;
+    await tick();
+    document.getElementById(decision === "deny" ? "start-deny" : "start-approve")?.focus();
+  }
+
+  function filterChanged(event: Event) {
+    const select = event.currentTarget;
+    if (!(select instanceof HTMLSelectElement)) return;
+    const status = select.value as ApprovalStatusFilter;
+    void navigate(approvalsUrl(urlState, { status, cursor: null, approval: null }));
+  }
+
+  async function submitDecision(approval: ApprovalDetail, decision: ApprovalDecision) {
+    if (
+      decisionReadOnly ||
+      detail.data?.id !== approval.id ||
+      detail.data.revision !== approval.revision ||
+      detail.data.status !== approval.status
+    ) {
+      return;
+    }
+    if (!canDecideApproval(approval, Date.now())) {
+      confirming = null;
+      announcement = "The approval deadline passed. Reloaded it for review.";
+      requestListRefresh(false);
+      requestDetailRefresh(false);
+      await tick();
+      document.getElementById("approval-detail-panel")?.focus();
+      return;
+    }
+    const submittedListKey = listKey;
+    const submittedStatus = urlState.status;
+    const submittedItems = resource.data?.items ?? [];
+    decisionById[approval.id] = decision;
+    decisionError = null;
+    const toolLabel = approval.toolDisplayName ?? approval.path;
+    announcement = `${decision === "approve" ? "Approving" : "Denying"} ${toolLabel}...`;
+    const result = await decideApproval(approval.id, decision, approval.revision);
+    if (disposed) return;
+    delete decisionById[approval.id];
+
+    if (!result.ok) {
+      if (auth.recoverFromApiError(result.error)) return;
+      if (urlState.approval !== approval.id) return;
+      decisionError = result.error;
+      confirming = null;
+      if (result.error.status === 409 || result.error.status === 410) {
+        decisionFenceById[approval.id] = Math.max(
+          decisionFenceById[approval.id] ?? approval.revision,
+          approval.revision,
+        );
+        announcement =
+          result.error.status === 409
+            ? "This approval changed before your decision. Reloaded it for review."
+            : "The approval deadline passed. Reloaded it for review.";
+        requestListRefresh(false);
+        requestDetailRefresh(false);
+        await tick();
+        document.getElementById("approval-detail-panel")?.focus();
+      } else {
+        announcement = `The ${decision} decision was not saved.`;
+        await tick();
+        document.getElementById(decision === "deny" ? "start-deny" : "start-approve")?.focus();
+      }
+      return;
+    }
+
+    const scope = decisionResultScope({
+      submittedApprovalId: approval.id,
+      submittedListKey,
+      currentApprovalId: urlState.approval,
+      currentListKey: listKey,
+    });
+    if (scope.sameList && resource.data !== null) {
+      const items =
+        submittedStatus === "pending"
+          ? resource.data.items.filter((item) => item.id !== approval.id)
+          : resource.data.items.map((item) => (item.id === approval.id ? result.value : item));
+      resource = {
+        data: { ...resource.data, items },
+        loading: false,
+        error: null,
+        stale: false,
+      };
+    }
+    requestListRefresh(false);
+
+    if (!scope.sameDetail) return;
+    announcement = `${toolLabel} was ${decision === "approve" ? "approved" : "denied"}.`;
+    confirming = null;
+    detail = settleResourceLoad(detail, result);
+
+    if (scope.sameList && submittedStatus === "pending") {
+      const target = focusTargetAfterDecision(submittedItems, approval.id);
+      await navigate(approvalsUrl(urlState, { approval: null }));
+      await tick();
+      document.getElementById(target)?.focus();
+    } else {
+      requestDetailRefresh(false);
+    }
+  }
+
+  function formatTime(timestamp: number) {
+    return new Intl.DateTimeFormat(undefined, { dateStyle: "medium", timeStyle: "medium" }).format(
+      timestamp * 1000,
+    );
+  }
+
+  function formatAge(createdAt: number) {
+    const seconds = Math.max(0, Math.floor(now / 1000) - createdAt);
+    if (seconds < 60) return `${seconds}s ago`;
+    if (seconds < 3_600) return `${Math.floor(seconds / 60)}m ago`;
+    return `${Math.floor(seconds / 3_600)}h ago`;
+  }
+
+  function provenanceLabel(provenance: ApprovalDetail["provenance"]) {
+    if (provenance === "tool_override") return "Tool override";
+    if (provenance === "source_override") return "Source default";
+    return "Tool default";
+  }
+
+  function closeDetail() {
+    detailReturnId = detail.data?.id ?? urlState.approval;
+    void navigate(approvalsUrl(urlState, { approval: null }));
+  }
+
+  function navigate(destination: string) {
+    return approvalNavigation?.goto(destination) ?? goto(destination);
+  }
+
+  function handleWindowKeydown(event: KeyboardEvent) {
+    if (event.key !== "Escape" || urlState.approval === null) return;
+    event.preventDefault();
+    closeDetail();
+  }
+</script>
+
+<svelte:window onkeydown={handleWindowKeydown} />
+
+{#snippet approvalError(error: ApiError, announce: boolean)}
+  <div class="notice error" role={announce ? "alert" : undefined}>
+    <strong>{error.displayMessage}</strong>
+    {#if error.requestId !== null}
+      <small>Request reference: <code>{error.requestId}</code></small>
+    {/if}
+  </div>
+{/snippet}
+
+<DashboardShell title="Approvals" description="Review each sensitive tool call before it can run.">
+  <p class="visually-hidden" aria-live="polite">{announcement}</p>
+
+  <section class="surface approval-explainer">
+    <div>
+      <p class="eyebrow">One request at a time</p>
+      <h2>Approval is exact and single-use</h2>
+    </div>
+    <p>
+      Approving permits only this invocation. The argument preview is structural and redacted;
+      hidden original values are what Executor will run. A tool, credential, or policy change makes
+      the request stale instead of silently applying your decision elsewhere.
+    </p>
+  </section>
+
+  <section class="surface approval-filters" aria-labelledby="approvals-heading">
+    <div>
+      <p class="eyebrow">Decision queue</p>
+      <h2 id="approvals-heading" tabindex="-1">Approval requests</h2>
+    </div>
+    <label>
+      Status
+      <select value={urlState.status} onchange={filterChanged}>
+        <option value="pending">Pending</option>
+        <option value="all">All statuses</option>
+        {#each approvalStatuses.filter((status) => status !== "pending") as status}
+          <option value={status}>{approvalStatusLabel(status)}</option>
+        {/each}
+      </select>
+    </label>
+    <div class="button-row">
+      {#if resource.loading}<span
+          class="muted-status"
+          role={announceListLoading && resource.data !== null ? "status" : undefined}
+          >Refreshing...</span
+        >{/if}
+      <button type="button" disabled={resource.loading} onclick={refreshApprovals}>Refresh</button>
+    </div>
+  </section>
+
+  {#if resource.stale && resource.error !== null}
+    <div class="stale-notice" role={announceListError ? "status" : undefined}>
+      Showing the last loaded approval page while Executor reconnects.
+      {@render approvalError(resource.error, false)}
+    </div>
+  {:else if resource.error !== null}
+    <section class="surface table-unavailable">
+      {@render approvalError(resource.error, announceListError)}
+      <button type="button" onclick={refreshApprovals}>Try again</button>
+    </section>
+  {/if}
+
+  <section class="surface table-card" aria-busy={resource.loading}>
+    {#if resource.data === null && resource.loading}
+      <div class="loading-panel" aria-live={announceListLoading ? "polite" : undefined}>
+        Loading approvals...
+      </div>
+    {:else if resource.data !== null && resource.data.items.length === 0}
+      <div class="table-empty">
+        <p>
+          {urlState.status === "pending"
+            ? "No tool calls are waiting for approval."
+            : "No approvals match this status on this page."}
+        </p>
+        {#if urlState.cursor !== null || urlState.status !== "pending"}
+          <a class="button-link empty-recovery" href="/approvals">Return to pending approvals</a>
+        {/if}
+      </div>
+    {:else if resource.data !== null}
+      <div class="approval-list">
+        {#each resource.data.items as approval (approval.id)}
+          <article class="approval-row">
+            <div class="approval-row-main">
+              <div>
+                <span
+                  class:pending={approval.status === "pending"}
+                  class:active={approval.status === "approved" || approval.status === "executing"}
+                  class:success={approval.status === "succeeded"}
+                  class:warning={["denied", "canceled", "expired", "stale"].includes(
+                    approval.status,
+                  )}
+                  class:error={approval.status === "failed" || approval.status === "interrupted"}
+                  class="outcome-pill"
+                >
+                  {approvalStatusLabel(approval.status)}
+                </span>
+                <h3>{approval.toolDisplayName ?? approval.path}</h3>
+                <code>{approval.path}</code>
+              </div>
+              <div class="approval-timing">
+                <strong>{formatAge(approval.createdAt)}</strong>
+                <small>
+                  {approval.status === "pending"
+                    ? approvalCountdown(approval.expiresAt, now)
+                    : `Updated ${formatAge(approval.updatedAt)}`}
+                </small>
+              </div>
+            </div>
+            <dl class="approval-summary">
+              <div>
+                <dt>Source</dt>
+                <dd>{approval.sourceDisplayName ?? "Unavailable source"}</dd>
+              </div>
+              <div>
+                <dt>Caller</dt>
+                <dd>{approval.actorLabel}</dd>
+                <small>{approval.surface}</small>
+              </div>
+              <div>
+                <dt>Ask rule</dt>
+                <dd>{provenanceLabel(approval.provenance)}</dd>
+              </div>
+            </dl>
+            <a
+              id={`inspect-approval-${approval.id}`}
+              class="detail-link"
+              href={approvalsUrl(urlState, { approval: approval.id })}>Review request</a
+            >
+          </article>
+        {/each}
+      </div>
+      <nav class="pagination" aria-label="Approval pages">
+        {#if urlState.cursor !== null}
+          <a href={approvalsUrl(urlState, { cursor: null, approval: null })}>Newest</a>
+        {:else}<span></span>{/if}
+        <span>{resource.data.items.length} approvals on this page</span>
+        {#if resource.data.nextCursor !== null}
+          <a href={approvalsUrl(urlState, { cursor: resource.data.nextCursor, approval: null })}
+            >Older</a
+          >
+        {/if}
+      </nav>
+    {/if}
+  </section>
+
+  {#if urlState.approval !== null}
+    <aside
+      id="approval-detail-panel"
+      class="surface detail-panel approval-detail"
+      aria-labelledby="approval-detail-title"
+      aria-busy={detail.loading}
+      tabindex="-1"
+    >
+      <div class="section-heading">
+        <div>
+          <p class="eyebrow">Approval detail</p>
+          <h2 id="approval-detail-title">
+            {detail.data?.toolDisplayName ?? detail.data?.path ?? "Loading..."}
+          </h2>
+        </div>
+        <a
+          class="button-link"
+          href={approvalsUrl(urlState, { approval: null })}
+          onclick={(event) => {
+            event.preventDefault();
+            closeDetail();
+          }}>Close details</a
+        >
+      </div>
+      {#if detail.error !== null}
+        <div class="detail-body">
+          {@render approvalError(detail.error, announceDetailError)}
+          <button
+            id="retry-approval-detail"
+            type="button"
+            onclick={() => requestDetailRefresh(true)}>Retry details</button
+          >
+        </div>
+      {:else if detail.loading && detail.data === null}
+        <div class="loading-panel" role={announceDetailLoading ? "status" : undefined}>
+          Loading approval detail...
+        </div>
+      {:else if detail.data !== null}
+        <div class="detail-body">
+          {#if detail.loading}<p
+              class="muted-status"
+              role={announceDetailLoading ? "status" : undefined}
+            >
+              Refreshing approval detail...
+            </p>{/if}
+          <div class="approval-detail-heading">
+            <span
+              class:pending={detail.data.status === "pending"}
+              class:active={detail.data.status === "approved" || detail.data.status === "executing"}
+              class:success={detail.data.status === "succeeded"}
+              class:warning={["denied", "canceled", "expired", "stale"].includes(
+                detail.data.status,
+              )}
+              class:error={detail.data.status === "failed" || detail.data.status === "interrupted"}
+              class="outcome-pill"
+            >
+              {approvalStatusLabel(detail.data.status)}
+            </span>
+            <div>
+              <code>{detail.data.path}</code>
+              <p>{detail.data.sourceDisplayName ?? "Unavailable source"}</p>
+            </div>
+          </div>
+          <dl class="detail-list">
+            <div>
+              <dt>Requested</dt>
+              <dd>{formatTime(detail.data.createdAt)}</dd>
+            </div>
+            <div>
+              <dt>Approval deadline</dt>
+              <dd>
+                {detail.data.status === "pending"
+                  ? approvalCountdown(detail.data.expiresAt, now)
+                  : "No longer pending"}
+              </dd>
+              <small>{formatTime(detail.data.expiresAt)}</small>
+            </div>
+            <div>
+              <dt>Caller</dt>
+              <dd>{detail.data.actorLabel}</dd>
+              <small>{detail.data.actorKind.replace("_", " ")}</small>
+            </div>
+            <div>
+              <dt>Actor ID</dt>
+              <dd><code>{detail.data.actorId}</code></dd>
+            </div>
+            {#if detail.data.actorApiTokenId !== null}
+              <div>
+                <dt>API token ID</dt>
+                <dd><code>{detail.data.actorApiTokenId}</code></dd>
+              </div>
+            {/if}
+            <div>
+              <dt>Surface</dt>
+              <dd>{detail.data.surface}</dd>
+            </div>
+            <div>
+              <dt>Effective behavior</dt>
+              <dd>Ask, {provenanceLabel(detail.data.provenance)}</dd>
+            </div>
+            <div>
+              <dt>Revision</dt>
+              <dd>{detail.data.revision}</dd>
+            </div>
+            {#if detail.data.failureCode !== null}
+              <div>
+                <dt>Outcome code</dt>
+                <dd><code>{detail.data.failureCode}</code></dd>
+              </div>
+            {/if}
+          </dl>
+
+          <div class="approval-arguments">
+            <div>
+              <h3>Structural, redacted argument preview</h3>
+              <p>
+                Some original values are hidden. If approved, Executor runs the stored original
+                arguments, not the placeholder text shown here.
+              </p>
+            </div>
+            <pre>{JSON.stringify(detail.data.redactedArguments, null, 2)}</pre>
+          </div>
+
+          {#if canDecideApproval(detail.data, now)}
+            <div id="approval-decision-region" class="approval-decision">
+              {#if decisionUnavailable}
+                <p class="muted-status">
+                  Decisions are paused until the current approval state is ready.
+                </p>
+              {/if}
+              {#if confirming === null}
+                <p>
+                  Review the tool and structural preview. Hidden original values will execute, and
+                  approval may trigger a side effect in
+                  {detail.data.sourceDisplayName ?? "the connected source"}.
+                </p>
+                <div class="button-row">
+                  <button
+                    id="start-approve"
+                    class="primary"
+                    type="button"
+                    disabled={decisionReadOnly}
+                    onclick={() => beginConfirmation("approve")}>Approve once</button
+                  >
+                  <button
+                    id="start-deny"
+                    class="danger-link"
+                    type="button"
+                    disabled={decisionReadOnly}
+                    onclick={() => beginConfirmation("deny")}>Deny</button
+                  >
+                </div>
+              {:else}
+                <div class="approval-confirm" role="group" aria-labelledby="approval-confirm-title">
+                  <h3 id="approval-confirm-title">
+                    {confirming === "approve" ? "Confirm approval" : "Confirm denial"}
+                  </h3>
+                  <p>{approvalDecisionCopy(detail.data, confirming)}</p>
+                  <div class="button-row">
+                    <button
+                      id="confirm-approval-decision"
+                      class:primary={confirming === "approve"}
+                      class:danger-button={confirming === "deny"}
+                      type="button"
+                      disabled={decisionReadOnly}
+                      onclick={() => submitDecision(detail.data!, confirming!)}
+                    >
+                      {decisionById[detail.data.id] !== undefined
+                        ? "Saving decision..."
+                        : confirming === "approve"
+                          ? "Yes, approve once"
+                          : "Yes, deny request"}
+                    </button>
+                    <button
+                      type="button"
+                      disabled={decisionById[detail.data.id] !== undefined}
+                      onclick={cancelConfirmation}>Keep reviewing</button
+                    >
+                  </div>
+                </div>
+              {/if}
+            </div>
+          {:else}
+            <div class="notice">
+              <strong>This request can no longer be decided.</strong>
+              <small>
+                {detail.data.status === "pending"
+                  ? "Its approval deadline has passed. Refresh to see the recorded outcome."
+                  : `Its recorded status is ${approvalStatusLabel(detail.data.status)}.`}
+              </small>
+            </div>
+          {/if}
+
+          {#if decisionError !== null}{@render approvalError(decisionError, true)}{/if}
+        </div>
+      {/if}
+    </aside>
+  {/if}
+</DashboardShell>
diff --git a/web/src/routes/approvals/approvals-page.test-harness.svelte b/web/src/routes/approvals/approvals-page.test-harness.svelte
new file mode 100644
index 000000000..f331568b3
--- /dev/null
+++ b/web/src/routes/approvals/approvals-page.test-harness.svelte
@@ -0,0 +1,27 @@
+<script lang="ts">
+  import ApprovalsPage from "./+page.svelte";
+
+  type PollEnvironment = {
+    readonly schedule: (callback: () => void, delay: number) => number;
+    readonly cancel: (handle: number) => void;
+    readonly isVisible: () => boolean;
+  };
+
+  let {
+    initialUrl,
+    pollEnvironment,
+  }: {
+    initialUrl: string;
+    pollEnvironment?: PollEnvironment;
+  } = $props();
+
+  let navigatedUrl = $state<URL | null>(null);
+  let currentUrl = $derived(navigatedUrl ?? new URL(initialUrl));
+  let approvalNavigation = $derived({ url: currentUrl, goto: navigate });
+
+  function navigate(destination: string) {
+    navigatedUrl = new URL(destination, currentUrl);
+  }
+</script>
+
+<ApprovalsPage {approvalNavigation} approvalPollEnvironment={pollEnvironment} />
diff --git a/web/src/routes/approvals/approvals-page.test.ts b/web/src/routes/approvals/approvals-page.test.ts
new file mode 100644
index 000000000..4c625edb3
--- /dev/null
+++ b/web/src/routes/approvals/approvals-page.test.ts
@@ -0,0 +1,597 @@
+import { afterEach, describe, expect, it, vi } from "@effect/vitest";
+import { cleanup, fireEvent, render, screen, waitFor, within } from "@testing-library/svelte";
+import type { ApprovalDetail, ApprovalPage, ApprovalSummary } from "$lib/api";
+
+const auth = {
+  authenticated: true,
+  username: "admin",
+  recoverFromApiError: vi.fn(() => false),
+  signOut: vi.fn(async () => ({ ok: true as const, value: undefined })),
+};
+const fallbackGoto = vi.fn(async () => {});
+
+vi.doMock("$app/navigation", () => ({ goto: fallbackGoto }));
+vi.doMock("$app/state", () => ({ page: { url: new URL("http://localhost/approvals") } }));
+vi.doMock("$lib/auth.svelte", () => ({ useAuthState: () => auth }));
+
+const { default: ApprovalsPageHarness } = await import("./approvals-page.test-harness.svelte");
+
+function approvalSummary(overrides: Partial<ApprovalSummary> = {}) {
+  const now = Math.floor(Date.now() / 1_000);
+  return {
+    id: "approval-1",
+    status: "pending",
+    revision: 7,
+    sourceId: "source-1",
+    toolId: "tool-1",
+    path: "tools.product_api.create_issue",
+    sourceDisplayName: "Product API",
+    toolDisplayName: "Create issue",
+    actorKind: "api_token",
+    actorId: "actor-1",
+    actorName: "Automation",
+    actorLabel: "Automation token",
+    actorApiTokenId: "token-1",
+    actorTokenName: "Automation",
+    surface: "gateway",
+    mode: "ask",
+    provenance: "intrinsic",
+    executionId: "execution-1",
+    callId: "call-1",
+    createdAt: now - 10,
+    updatedAt: now - 5,
+    expiresAt: now + 3_600,
+    decidedAt: null,
+    startedAt: null,
+    completedAt: null,
+    decision: null,
+    failureCode: null,
+    ...overrides,
+  } satisfies ApprovalSummary;
+}
+
+function approvalDetail(overrides: Partial<ApprovalDetail> = {}) {
+  return {
+    ...approvalSummary(overrides),
+    redactedArguments: { title: "[redacted]" },
+    inputSchema: { type: "object" },
+    ...overrides,
+  } satisfies ApprovalDetail;
+}
+
+function approvalPage(items: readonly ApprovalSummary[] = []) {
+  return Response.json({ items, nextCursor: null } satisfies ApprovalPage);
+}
+
+function errorResponse(status: number, code: string, message: string, requestId = "test-request") {
+  return Response.json({ error: { code, message, requestId } }, { status });
+}
+
+function deferred<Value>() {
+  let resolve = (_value: Value) => {};
+  let reject = (_reason?: unknown) => {};
+  const promise = new Promise<Value>((complete, fail) => {
+    resolve = complete;
+    reject = fail;
+  });
+  return { promise, resolve, reject };
+}
+
+function manualPollEnvironment() {
+  let callback: (() => void) | null = null;
+  let activeHandle = 0;
+  return {
+    environment: {
+      schedule(next: () => void) {
+        callback = next;
+        activeHandle += 1;
+        return activeHandle;
+      },
+      cancel(handle: number) {
+        if (handle === activeHandle) callback = null;
+      },
+      isVisible: () => true,
+    },
+    trigger() {
+      const next = callback;
+      callback = null;
+      next?.();
+    },
+  };
+}
+
+async function approveOnce() {
+  const start = await screen.findByRole<HTMLButtonElement>("button", { name: "Approve once" });
+  await waitFor(() => expect(start.disabled).toBe(false));
+  await fireEvent.click(start);
+  const confirmation = await screen.findByRole("group", { name: "Confirm approval" });
+  await fireEvent.click(within(confirmation).getByRole("button", { name: "Yes, approve once" }));
+}
+
+afterEach(() => {
+  cleanup();
+  auth.authenticated = true;
+  vi.clearAllMocks();
+  vi.unstubAllGlobals();
+});
+
+describe("Approvals page request coordination", () => {
+  it("allows a current pending detail decision while the list request never resolves", async () => {
+    const heldList = deferred<Response>();
+    const decisions: string[] = [];
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input, init) => {
+        const path = String(input);
+        if (path.startsWith("/api/v1/approvals?")) return heldList.promise;
+        if (path === "/api/v1/approvals/approval-1/decision" && init?.method === "POST") {
+          decisions.push(String(init.body));
+          return Promise.resolve(
+            Response.json(
+              approvalDetail({
+                status: "approved",
+                revision: 8,
+                decision: "approve",
+                decidedAt: Math.floor(Date.now() / 1_000),
+              }),
+            ),
+          );
+        }
+        if (path === "/api/v1/approvals/approval-1") {
+          return Promise.resolve(Response.json(approvalDetail()));
+        }
+        return Promise.resolve(errorResponse(500, "unexpected_test_request", path));
+      }),
+    );
+
+    render(ApprovalsPageHarness, {
+      initialUrl: "http://localhost/approvals?approval=approval-1",
+    });
+
+    await approveOnce();
+
+    await waitFor(() => expect(decisions).toHaveLength(1));
+    expect(decisions).toEqual([JSON.stringify({ decision: "approve", expectedRevision: 7 })]);
+  });
+
+  it("keeps decisions available when a silent background list refresh fails", async () => {
+    const poll = manualPollEnvironment();
+    const failedRefresh = deferred<Response>();
+    const backgroundDetail = deferred<Response>();
+    let listCalls = 0;
+    let detailCalls = 0;
+    let decisionCalls = 0;
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input, init) => {
+        const path = String(input);
+        if (path.startsWith("/api/v1/approvals?")) {
+          listCalls += 1;
+          return listCalls === 1
+            ? Promise.resolve(approvalPage([approvalSummary()]))
+            : failedRefresh.promise;
+        }
+        if (path === "/api/v1/approvals/approval-1/decision" && init?.method === "POST") {
+          decisionCalls += 1;
+          return Promise.resolve(
+            Response.json(
+              approvalDetail({
+                status: "approved",
+                revision: 8,
+                decision: "approve",
+                decidedAt: Math.floor(Date.now() / 1_000),
+              }),
+            ),
+          );
+        }
+        if (path === "/api/v1/approvals/approval-1") {
+          detailCalls += 1;
+          if (detailCalls === 1) return Promise.resolve(Response.json(approvalDetail()));
+          if (detailCalls === 2) return backgroundDetail.promise;
+          return Promise.resolve(Response.json(approvalDetail()));
+        }
+        return Promise.resolve(errorResponse(500, "unexpected_test_request", path));
+      }),
+    );
+
+    render(ApprovalsPageHarness, {
+      initialUrl: "http://localhost/approvals?approval=approval-1",
+      pollEnvironment: poll.environment,
+    });
+
+    const approve = await screen.findByRole<HTMLButtonElement>("button", { name: "Approve once" });
+    await waitFor(() => expect(approve.disabled).toBe(false));
+    poll.trigger();
+    await waitFor(() => {
+      expect(listCalls).toBe(2);
+      expect(detailCalls).toBe(2);
+    });
+    expect(screen.getByText("Refreshing...").getAttribute("role")).toBeNull();
+    expect(screen.getByText("Refreshing approval detail...").getAttribute("role")).toBeNull();
+
+    backgroundDetail.resolve(Response.json(approvalDetail()));
+    await waitFor(() => expect(approve.disabled).toBe(false));
+    failedRefresh.reject("offline");
+    const refreshError = await screen.findByText(
+      "Executor could not be reached. Check that the local server is running.",
+    );
+    expect(refreshError.closest(".notice")?.getAttribute("role") ?? null).toBeNull();
+    const staleNotice = refreshError.closest(".stale-notice");
+    expect(staleNotice?.getAttribute("role")).toBe("status");
+    await waitFor(() => expect(approve.disabled).toBe(false));
+
+    poll.trigger();
+    await waitFor(() => {
+      expect(listCalls).toBe(3);
+      expect(detailCalls).toBe(3);
+    });
+    expect(screen.queryByRole("alert")).toBeNull();
+    expect(screen.getByRole("status")).toBe(staleNotice);
+    expect(
+      screen
+        .getByText("Executor could not be reached. Check that the local server is running.")
+        .closest(".stale-notice"),
+    ).toBe(staleNotice);
+
+    await approveOnce();
+    await waitFor(() => expect(decisionCalls).toBe(1));
+  });
+
+  it("keeps an initial list error mounted through passive retries", async () => {
+    const poll = manualPollEnvironment();
+    const initialLoad = deferred<Response>();
+    const firstRetry = deferred<Response>();
+    const secondRetry = deferred<Response>();
+    let listCalls = 0;
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input) => {
+        const path = String(input);
+        if (path.startsWith("/api/v1/approvals?")) {
+          listCalls += 1;
+          if (listCalls === 1) return initialLoad.promise;
+          if (listCalls === 2) return firstRetry.promise;
+          return secondRetry.promise;
+        }
+        return Promise.resolve(errorResponse(500, "unexpected_test_request", path));
+      }),
+    );
+
+    render(ApprovalsPageHarness, {
+      initialUrl: "http://localhost/approvals",
+      pollEnvironment: poll.environment,
+    });
+
+    initialLoad.resolve(errorResponse(503, "initial_failure", "Initial list failure", "list-a"));
+    const errorText = await screen.findByText("Initial list failure");
+    const errorAlert = errorText.closest(".notice");
+    expect(errorAlert?.getAttribute("role")).toBe("alert");
+    expect(screen.getByText("list-a")).toBeDefined();
+
+    poll.trigger();
+    await waitFor(() => expect(listCalls).toBe(2));
+    expect(screen.getByText("Loading approvals...").getAttribute("aria-live")).toBeNull();
+    expect(screen.getByText("Initial list failure").closest(".notice")).toBe(errorAlert);
+    firstRetry.resolve(errorResponse(502, "retry_failure", "Second list failure", "list-b"));
+    await waitFor(() =>
+      expect(screen.getByRole<HTMLButtonElement>("button", { name: "Refresh" }).disabled).toBe(
+        false,
+      ),
+    );
+
+    poll.trigger();
+    await waitFor(() => expect(listCalls).toBe(3));
+    expect(screen.getByText("Loading approvals...").getAttribute("aria-live")).toBeNull();
+    expect(screen.getByRole("alert")).toBe(errorAlert);
+    expect(screen.getByText("Initial list failure")).toBeDefined();
+    expect(screen.getByText("list-a")).toBeDefined();
+    expect(screen.queryByText("Second list failure")).toBeNull();
+    expect(screen.queryByText("list-b")).toBeNull();
+    secondRetry.resolve(errorResponse(500, "retry_failure", "Third list failure", "list-c"));
+    await waitFor(() =>
+      expect(screen.getByRole<HTMLButtonElement>("button", { name: "Refresh" }).disabled).toBe(
+        false,
+      ),
+    );
+    expect(screen.getByRole("alert")).toBe(errorAlert);
+    expect(screen.getByText("Initial list failure")).toBeDefined();
+    expect(screen.getByText("list-a")).toBeDefined();
+    expect(screen.queryByText("Third list failure")).toBeNull();
+    expect(screen.queryByText("list-c")).toBeNull();
+  });
+
+  it("keeps a passive detail error mounted through its next passive retry", async () => {
+    const poll = manualPollEnvironment();
+    const firstFailure = deferred<Response>();
+    const secondFailure = deferred<Response>();
+    let detailCalls = 0;
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input) => {
+        const path = String(input);
+        if (path.startsWith("/api/v1/approvals?")) {
+          return Promise.resolve(approvalPage([approvalSummary()]));
+        }
+        if (path === "/api/v1/approvals/approval-1") {
+          detailCalls += 1;
+          if (detailCalls === 1) return Promise.resolve(Response.json(approvalDetail()));
+          if (detailCalls === 2) return firstFailure.promise;
+          return secondFailure.promise;
+        }
+        return Promise.resolve(errorResponse(500, "unexpected_test_request", path));
+      }),
+    );
+
+    render(ApprovalsPageHarness, {
+      initialUrl: "http://localhost/approvals?approval=approval-1",
+      pollEnvironment: poll.environment,
+    });
+
+    await screen.findByRole("button", { name: "Approve once" });
+    poll.trigger();
+    await waitFor(() => expect(detailCalls).toBe(2));
+    firstFailure.resolve(
+      errorResponse(503, "initial_failure", "Initial detail failure", "detail-a"),
+    );
+    const errorText = await screen.findByText("Initial detail failure");
+    const errorAlert = errorText.closest(".notice");
+    expect(errorAlert?.getAttribute("role")).toBe("alert");
+    expect(screen.getByText("detail-a")).toBeDefined();
+
+    poll.trigger();
+    await waitFor(() => expect(detailCalls).toBe(3));
+    expect(screen.queryByText("Loading approval detail...")).toBeNull();
+    expect(screen.getByRole("alert")).toBe(errorAlert);
+    expect(screen.getByText("Initial detail failure").closest(".notice")).toBe(errorAlert);
+    secondFailure.resolve(errorResponse(502, "retry_failure", "Second detail failure", "detail-b"));
+    await waitFor(() =>
+      expect(document.getElementById("approval-detail-panel")?.getAttribute("aria-busy")).toBe(
+        "false",
+      ),
+    );
+    expect(screen.getByRole("alert")).toBe(errorAlert);
+    expect(screen.getByText("Initial detail failure")).toBeDefined();
+    expect(screen.getByText("detail-a")).toBeDefined();
+    expect(screen.queryByText("Second detail failure")).toBeNull();
+    expect(screen.queryByText("detail-b")).toBeNull();
+  });
+
+  it("keeps decision controls disabled without an authenticated admin", async () => {
+    auth.authenticated = false;
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input) => {
+        const path = String(input);
+        if (path.startsWith("/api/v1/approvals?")) {
+          return Promise.resolve(approvalPage([approvalSummary()]));
+        }
+        if (path === "/api/v1/approvals/approval-1") {
+          return Promise.resolve(Response.json(approvalDetail()));
+        }
+        return Promise.resolve(errorResponse(500, "unexpected_test_request", path));
+      }),
+    );
+
+    render(ApprovalsPageHarness, {
+      initialUrl: "http://localhost/approvals?approval=approval-1",
+    });
+
+    const approve = await screen.findByRole<HTMLButtonElement>("button", { name: "Approve once" });
+    const deny = screen.getByRole<HTMLButtonElement>("button", { name: "Deny" });
+    expect(approve.disabled).toBe(true);
+    expect(deny.disabled).toBe(true);
+  });
+
+  it("resets list data when a new filter request is held and then rejected", async () => {
+    const deniedPage = deferred<Response>();
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input) => {
+        const path = String(input);
+        if (path.includes("status=pending")) {
+          return Promise.resolve(
+            approvalPage([approvalSummary({ id: "approval-a", toolDisplayName: "Alpha tool" })]),
+          );
+        }
+        if (path.includes("status=denied")) return deniedPage.promise;
+        return Promise.resolve(errorResponse(500, "unexpected_test_request", path));
+      }),
+    );
+
+    render(ApprovalsPageHarness, { initialUrl: "http://localhost/approvals" });
+
+    expect(await screen.findByRole("heading", { name: "Alpha tool" })).toBeDefined();
+    await fireEvent.change(screen.getByLabelText("Status"), { target: { value: "denied" } });
+
+    expect(await screen.findByText("Loading approvals...")).toBeDefined();
+    expect(screen.queryByRole("heading", { name: "Alpha tool" })).toBeNull();
+    deniedPage.reject("offline");
+    expect(
+      await screen.findByText(
+        "Executor could not be reached. Check that the local server is running.",
+      ),
+    ).toBeDefined();
+    expect(screen.queryByRole("heading", { name: "Alpha tool" })).toBeNull();
+  });
+
+  it("ignores an out-of-order list response from the replaced filter identity", async () => {
+    const pendingPage = deferred<Response>();
+    const pendingRequest = { signal: null as AbortSignal | null };
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input, init) => {
+        const path = String(input);
+        if (path.includes("status=pending")) {
+          pendingRequest.signal = init?.signal ?? null;
+          return pendingPage.promise;
+        }
+        if (path.includes("status=denied")) {
+          return Promise.resolve(
+            approvalPage([
+              approvalSummary({
+                id: "approval-b",
+                status: "denied",
+                toolDisplayName: "Beta tool",
+              }),
+            ]),
+          );
+        }
+        return Promise.resolve(errorResponse(500, "unexpected_test_request", path));
+      }),
+    );
+
+    render(ApprovalsPageHarness, { initialUrl: "http://localhost/approvals" });
+    await waitFor(() => expect(pendingRequest.signal).not.toBeNull());
+    await fireEvent.change(screen.getByLabelText("Status"), { target: { value: "denied" } });
+
+    expect(await screen.findByRole("heading", { name: "Beta tool" })).toBeDefined();
+    expect(pendingRequest.signal?.aborted).toBe(true);
+    pendingPage.resolve(
+      approvalPage([approvalSummary({ id: "approval-a", toolDisplayName: "Alpha tool" })]),
+    );
+    await pendingPage.promise;
+    await Promise.resolve();
+    await Promise.resolve();
+
+    expect(screen.getByRole("heading", { name: "Beta tool" })).toBeDefined();
+    expect(screen.queryByRole("heading", { name: "Alpha tool" })).toBeNull();
+  });
+
+  it("closes an existing confirmation when a background detail refresh changes status", async () => {
+    const poll = manualPollEnvironment();
+    let detailCalls = 0;
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input) => {
+        const path = String(input);
+        if (path.startsWith("/api/v1/approvals?")) {
+          return Promise.resolve(approvalPage([approvalSummary()]));
+        }
+        if (path === "/api/v1/approvals/approval-1") {
+          detailCalls += 1;
+          return Promise.resolve(
+            Response.json(
+              detailCalls === 1
+                ? approvalDetail()
+                : approvalDetail({ status: "denied", revision: 8, decision: "deny" }),
+            ),
+          );
+        }
+        return Promise.resolve(errorResponse(500, "unexpected_test_request", path));
+      }),
+    );
+
+    render(ApprovalsPageHarness, {
+      initialUrl: "http://localhost/approvals?approval=approval-1",
+      pollEnvironment: poll.environment,
+    });
+
+    const approve = await screen.findByRole<HTMLButtonElement>("button", { name: "Approve once" });
+    await waitFor(() => expect(approve.disabled).toBe(false));
+    await fireEvent.click(approve);
+    expect(await screen.findByRole("group", { name: "Confirm approval" })).toBeDefined();
+
+    poll.trigger();
+
+    expect(await screen.findByText("This request can no longer be decided.")).toBeDefined();
+    expect(screen.queryByRole("group", { name: "Confirm approval" })).toBeNull();
+    expect(screen.queryByRole("button", { name: "Approve once" })).toBeNull();
+  });
+
+  it("fences a conflicting decision until a newer detail revision loads", async () => {
+    const rollbackDetail = deferred<Response>();
+    const newerDetail = deferred<Response>();
+    let detailCalls = 0;
+    const decisionBodies: string[] = [];
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input, init) => {
+        const path = String(input);
+        if (path.startsWith("/api/v1/approvals?")) {
+          return Promise.resolve(approvalPage([approvalSummary()]));
+        }
+        if (path === "/api/v1/approvals/approval-1") {
+          detailCalls += 1;
+          if (detailCalls === 1) return Promise.resolve(Response.json(approvalDetail()));
+          if (detailCalls === 2) return rollbackDetail.promise;
+          return newerDetail.promise;
+        }
+        if (path === "/api/v1/approvals/approval-1/decision" && init?.method === "POST") {
+          decisionBodies.push(String(init.body));
+          return Promise.resolve(errorResponse(409, "approval_conflict", "The approval changed."));
+        }
+        return Promise.resolve(errorResponse(500, "unexpected_test_request", path));
+      }),
+    );
+
+    render(ApprovalsPageHarness, {
+      initialUrl: "http://localhost/approvals?approval=approval-1",
+    });
+
+    await approveOnce();
+    await waitFor(() => expect(detailCalls).toBe(2));
+    const approve = await screen.findByRole<HTMLButtonElement>("button", { name: "Approve once" });
+    expect(approve.disabled).toBe(true);
+    await fireEvent.click(approve);
+    expect(decisionBodies).toEqual([JSON.stringify({ decision: "approve", expectedRevision: 7 })]);
+
+    rollbackDetail.resolve(Response.json(approvalDetail({ revision: 6 })));
+    await waitFor(() =>
+      expect(screen.getByRole<HTMLButtonElement>("button", { name: "Approve once" }).disabled).toBe(
+        true,
+      ),
+    );
+    await fireEvent.click(screen.getByRole("button", { name: "Refresh" }));
+    await waitFor(() => expect(detailCalls).toBe(3));
+    newerDetail.resolve(Response.json(approvalDetail({ revision: 8 })));
+    await waitFor(() =>
+      expect(screen.getByRole<HTMLButtonElement>("button", { name: "Approve once" }).disabled).toBe(
+        false,
+      ),
+    );
+    expect(screen.queryByText("The approval changed.")).toBeNull();
+  });
+
+  it("aborts list and detail loads on unmount and ignores their late responses", async () => {
+    const list = deferred<Response>();
+    const detail = deferred<Response>();
+    const requests = {
+      listSignal: null as AbortSignal | null,
+      detailSignal: null as AbortSignal | null,
+    };
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input, init) => {
+        const path = String(input);
+        if (path.startsWith("/api/v1/approvals?")) {
+          requests.listSignal = init?.signal ?? null;
+          return list.promise;
+        }
+        if (path === "/api/v1/approvals/approval-1") {
+          requests.detailSignal = init?.signal ?? null;
+          return detail.promise;
+        }
+        return Promise.resolve(errorResponse(500, "unexpected_test_request", path));
+      }),
+    );
+
+    const rendered = render(ApprovalsPageHarness, {
+      initialUrl: "http://localhost/approvals?approval=approval-1",
+    });
+    await waitFor(() => {
+      expect(requests.listSignal).not.toBeNull();
+      expect(requests.detailSignal).not.toBeNull();
+    });
+
+    rendered.unmount();
+    expect(requests.listSignal?.aborted).toBe(true);
+    expect(requests.detailSignal?.aborted).toBe(true);
+    list.resolve(approvalPage([approvalSummary()]));
+    detail.resolve(Response.json(approvalDetail()));
+    await Promise.all([list.promise, detail.promise]);
+    await Promise.resolve();
+    await Promise.resolve();
+
+    expect(rendered.container.innerHTML).toBe("");
+  });
+});
diff --git a/web/src/routes/login/+page.svelte b/web/src/routes/login/+page.svelte
new file mode 100644
index 000000000..260c401fb
--- /dev/null
+++ b/web/src/routes/login/+page.svelte
@@ -0,0 +1,73 @@
+<script lang="ts">
+  import { goto } from "$app/navigation";
+  import { page } from "$app/state";
+  import ErrorNotice from "$lib/ErrorNotice.svelte";
+  import { useAuthState } from "$lib/auth.svelte";
+  import type { ApiError } from "$lib/api";
+  import { safeReturnTo } from "$lib/navigation";
+
+  const auth = useAuthState();
+  let username = $state("admin");
+  let password = $state("");
+  let busy = $state(false);
+  let error = $state<ApiError | null>(null);
+  let returnTo = $derived(
+    safeReturnTo(page.url.searchParams.get("returnTo"), page.url.origin) ?? "/sources",
+  );
+  let canSubmit = $derived(username.trim() !== "" && password !== "" && !busy);
+
+  async function submit(event: SubmitEvent) {
+    event.preventDefault();
+    if (!canSubmit) return;
+
+    busy = true;
+    error = null;
+    const result = await auth.signIn({ username: username.trim(), password });
+    if (!result.ok) {
+      error = result.error;
+    } else if (auth.authenticated) {
+      password = "";
+      void goto(returnTo, { replaceState: true });
+    }
+    busy = false;
+  }
+</script>
+
+<svelte:head>
+  <title>Sign in | Executor</title>
+</svelte:head>
+
+<main class="centered-page">
+  <section class="auth-card">
+    <div class="auth-heading">
+      <span class="brand-mark" aria-hidden="true">EX</span>
+      <div>
+        <p class="eyebrow">Administrator</p>
+        <h1>Open your gateway.</h1>
+      </div>
+    </div>
+    <p class="lede">The dashboard session controls configuration. API tokens only reach tools.</p>
+
+    {#if auth.notice !== null}
+      <div class="notice warning" role="status">
+        {auth.notice}
+        <button class="text-button" type="button" onclick={auth.clearNotice}>Dismiss</button>
+      </div>
+    {/if}
+
+    <form onsubmit={submit}>
+      <label>
+        Username
+        <input bind:value={username} autocomplete="username" required />
+      </label>
+      <label>
+        Password
+        <input bind:value={password} type="password" autocomplete="current-password" required />
+      </label>
+      {#if error !== null}<ErrorNotice {error} />{/if}
+      <button class="primary" type="submit" disabled={!canSubmit}>
+        {busy ? "Signing in..." : "Sign in"}
+      </button>
+    </form>
+  </section>
+</main>
diff --git a/web/src/routes/logs/+page.svelte b/web/src/routes/logs/+page.svelte
new file mode 100644
index 000000000..d6f1f1be4
--- /dev/null
+++ b/web/src/routes/logs/+page.svelte
@@ -0,0 +1,300 @@
+<script lang="ts">
+  import { page } from "$app/state";
+  import { tick, untrack } from "svelte";
+  import DashboardShell from "$lib/DashboardShell.svelte";
+  import ErrorNotice from "$lib/ErrorNotice.svelte";
+  import { useAuthState } from "$lib/auth.svelte";
+  import { getRequestLog, listRequestLogs, type RequestLog, type RequestLogPage } from "$lib/api";
+  import {
+    beginIdentityResourceLoad,
+    createLatestRequest,
+    emptyResource,
+    settleResourceLoad,
+    unexpectedRequestError,
+  } from "$lib/catalog-state";
+  import { logsListKey, logsUrl, parseLogsUrl } from "$lib/catalog-url";
+
+  let { search }: { search?: string } = $props();
+
+  const auth = useAuthState();
+  const listRequest = createLatestRequest();
+  const detailRequest = createLatestRequest();
+  let searchKey = $derived(search ?? page.url.search);
+  let urlState = $derived(parseLogsUrl(new URLSearchParams(searchKey)));
+  let listKey = $derived(logsListKey(urlState));
+  let listResource = $state(emptyResource<RequestLogPage>());
+  let listIdentity = $state<string | null>(null);
+  let resource = $derived(
+    listIdentity === listKey ? listResource : emptyResource<RequestLogPage>(),
+  );
+  let detail = $state(emptyResource<RequestLog>());
+  let detailIdentity = $state<string | null>(null);
+  let refreshKey = $state(0);
+  let detailRefreshKey = $state(0);
+  let detailReturnId = $state<string | null>(null);
+
+  $effect(() => {
+    const key = listKey;
+    const requestKey = `${key}\u0000${refreshKey}`;
+    const cursor = key || null;
+    const started = beginIdentityResourceLoad(
+      untrack(() => listResource),
+      untrack(() => listIdentity),
+      key,
+    );
+    listIdentity = started.identity;
+    listResource = started.state;
+    return listRequest.start(
+      async (signal) => ({ requestKey, result: await listRequestLogs(cursor, undefined, signal) }),
+      ({ requestKey: completedKey, result }) => {
+        if (completedKey !== `${listKey}\u0000${refreshKey}` || listIdentity !== key) return;
+        if (!result.ok && auth.recoverFromApiError(result.error)) return;
+        listResource = settleResourceLoad(listResource, result);
+      },
+      () => {
+        if (requestKey !== `${listKey}\u0000${refreshKey}` || listIdentity !== key) return;
+        listResource = settleResourceLoad(listResource, {
+          ok: false,
+          error: unexpectedRequestError(),
+        });
+      },
+    );
+  });
+
+  $effect(() => {
+    const requestId = urlState.request;
+    const returnId = untrack(() => detailReturnId);
+    void tick().then(() => {
+      if (requestId !== null) {
+        document.getElementById("request-detail-panel")?.focus();
+      } else if (returnId !== null) {
+        document.getElementById(`inspect-request-${returnId}`)?.focus();
+        detailReturnId = null;
+      }
+    });
+  });
+
+  $effect(() => {
+    const requestId = urlState.request;
+    const requestKey = `${requestId ?? ""}\u0000${detailRefreshKey}`;
+    if (requestId === null) {
+      detail = { data: null, loading: false, error: null, stale: false };
+      detailIdentity = null;
+      return;
+    }
+    const started = beginIdentityResourceLoad(
+      untrack(() => detail),
+      untrack(() => detailIdentity),
+      requestId,
+    );
+    detailIdentity = started.identity;
+    detail = started.state;
+    return detailRequest.start(
+      async (signal) => ({ requestKey, result: await getRequestLog(requestId, undefined, signal) }),
+      ({ requestKey: completedKey, result }) => {
+        if (completedKey !== `${urlState.request ?? ""}\u0000${detailRefreshKey}`) return;
+        if (!result.ok && auth.recoverFromApiError(result.error)) return;
+        detail = settleResourceLoad(detail, result, { retainDataOnError: false });
+      },
+      () => {
+        detail = settleResourceLoad(
+          detail,
+          { ok: false, error: unexpectedRequestError() },
+          { retainDataOnError: false },
+        );
+      },
+    );
+  });
+
+  function refreshLogs() {
+    refreshKey += 1;
+    if (urlState.request !== null) detailRefreshKey += 1;
+  }
+
+  function formatTime(timestamp: number) {
+    return new Intl.DateTimeFormat(undefined, { dateStyle: "medium", timeStyle: "medium" }).format(
+      timestamp * 1000,
+    );
+  }
+
+  function outcomeLabel(outcome: RequestLog["outcome"]) {
+    if (outcome === "pending_approval") return "Pending approval";
+    return `${outcome[0].toUpperCase()}${outcome.slice(1)}`;
+  }
+</script>
+
+<DashboardShell
+  title="Request logs"
+  description="Understand what called what, without exposing secrets."
+>
+  <section class="surface privacy-note">
+    <div>
+      <p class="eyebrow">Metadata only</p>
+      <h2>Safe operational history</h2>
+    </div>
+    <p>
+      Arguments, response bodies, headers, credentials, and tokens are never included in this view.
+    </p>
+  </section>
+
+  {#if resource.stale && resource.error !== null}
+    <div class="stale-notice" role="status">
+      Showing the last loaded request page while Executor reconnects.
+      <ErrorNotice error={resource.error} />
+    </div>
+  {:else if resource.error !== null}
+    <section class="surface table-unavailable">
+      <ErrorNotice error={resource.error} />
+      <button type="button" onclick={refreshLogs}>Try again</button>
+    </section>
+  {/if}
+
+  <section class="surface table-card" aria-busy={resource.loading}>
+    <div class="section-heading">
+      <div>
+        <p class="eyebrow">Newest first</p>
+        <h2>Gateway activity</h2>
+      </div>
+      <div class="button-row">
+        {#if resource.loading}<span class="muted-status" role="status">Refreshing...</span>{/if}
+        <button type="button" disabled={resource.loading} onclick={refreshLogs}>Refresh</button>
+      </div>
+    </div>
+    {#if resource.data === null && resource.loading}
+      <div class="loading-panel" aria-live="polite">Loading request logs...</div>
+    {:else if resource.data !== null && resource.data.items.length === 0}
+      <div class="table-empty">
+        <p>No requests have been recorded on this page.</p>
+        {#if urlState.cursor !== null}<a class="button-link" href="/logs"
+            >Return to newest requests</a
+          >{/if}
+      </div>
+    {:else if resource.data !== null}
+      <div class="table-scroll">
+        <table>
+          <caption>Request metadata, newest first.</caption>
+          <thead
+            ><tr
+              ><th scope="col">Request</th><th scope="col">Route</th><th scope="col">Outcome</th><th
+                scope="col">Timing</th
+              ><th scope="col">Details</th></tr
+            ></thead
+          >
+          <tbody>
+            {#each resource.data.items as log (log.requestId)}
+              <tr>
+                <td data-label="Request"
+                  ><code>{log.requestId}</code><small
+                    >{formatTime(log.createdAt)} · {log.surface}</small
+                  ></td
+                >
+                <td data-label="Route"
+                  ><code>{log.pathSnapshot ?? "Unknown path"}</code><small
+                    >{log.sourceId ?? "Source unavailable"}</small
+                  ></td
+                >
+                <td data-label="Outcome"
+                  ><span
+                    class:error={log.outcome === "failed" || log.outcome === "denied"}
+                    class:pending={log.outcome === "pending_approval"}
+                    class="outcome-pill">{outcomeLabel(log.outcome)}</span
+                  >{#if log.errorCode !== null}<small><code>{log.errorCode}</code></small>{/if}</td
+                >
+                <td data-label="Timing">{log.durationMs} ms</td>
+                <td data-label="Details"
+                  ><a
+                    id={`inspect-request-${log.requestId}`}
+                    class="detail-link"
+                    href={logsUrl(urlState, { request: log.requestId })}
+                    onclick={() => (detailReturnId = log.requestId)}>Inspect</a
+                  ></td
+                >
+              </tr>
+            {/each}
+          </tbody>
+        </table>
+      </div>
+      <nav class="pagination" aria-label="Request log pages">
+        {#if urlState.cursor !== null}<a href="/logs">Newest</a>{:else}<span></span>{/if}
+        <span>{resource.data.items.length} requests on this page</span>
+        {#if resource.data.nextCursor !== null}
+          <a href={logsUrl({ cursor: resource.data.nextCursor, request: null })}>Older</a>
+        {/if}
+      </nav>
+    {/if}
+  </section>
+
+  {#if urlState.request !== null}
+    <aside
+      id="request-detail-panel"
+      class="surface detail-panel"
+      aria-labelledby="request-detail-title"
+      aria-busy={detail.loading}
+      tabindex="-1"
+    >
+      <div class="section-heading">
+        <div>
+          <p class="eyebrow">Request detail</p>
+          <h2 id="request-detail-title">{detail.data?.requestId ?? "Loading..."}</h2>
+        </div>
+        <a class="button-link" href={logsUrl(urlState, { request: null })}>Close details</a>
+      </div>
+      {#if detail.error !== null}<div class="detail-body">
+          <ErrorNotice error={detail.error} />
+          <button type="button" onclick={() => (detailRefreshKey += 1)}>Retry details</button>
+        </div>
+      {:else if detail.loading && detail.data === null}<div class="loading-panel" role="status">
+          Loading request detail...
+        </div>
+      {:else if detail.data !== null}
+        <div class="detail-body">
+          {#if detail.loading}<p class="muted-status" role="status">
+              Refreshing request detail...
+            </p>{/if}
+          <dl class="detail-list">
+            <div>
+              <dt>Surface</dt>
+              <dd>{detail.data.surface}</dd>
+            </div>
+            <div>
+              <dt>Path</dt>
+              <dd><code>{detail.data.pathSnapshot ?? "Unavailable"}</code></dd>
+            </div>
+            <div>
+              <dt>Outcome</dt>
+              <dd>{outcomeLabel(detail.data.outcome)}</dd>
+            </div>
+            <div>
+              <dt>Duration</dt>
+              <dd>{detail.data.durationMs} ms</dd>
+            </div>
+            <div>
+              <dt>Created</dt>
+              <dd>{formatTime(detail.data.createdAt)}</dd>
+            </div>
+            <div>
+              <dt>Source ID</dt>
+              <dd><code>{detail.data.sourceId ?? "Unavailable"}</code></dd>
+            </div>
+            <div>
+              <dt>Tool ID</dt>
+              <dd><code>{detail.data.toolId ?? "Unavailable"}</code></dd>
+            </div>
+            <div>
+              <dt>API token ID</dt>
+              <dd><code>{detail.data.actorApiTokenId ?? "Unavailable"}</code></dd>
+            </div>
+            <div>
+              <dt>Error code</dt>
+              <dd><code>{detail.data.errorCode ?? "None"}</code></dd>
+            </div>
+            <div>
+              <dt>Approval ID</dt>
+              <dd><code>{detail.data.approvalId ?? "None"}</code></dd>
+            </div>
+          </dl>
+        </div>
+      {/if}
+    </aside>
+  {/if}
+</DashboardShell>
diff --git a/web/src/routes/logs/logs-page.test-harness.svelte b/web/src/routes/logs/logs-page.test-harness.svelte
new file mode 100644
index 000000000..780161c44
--- /dev/null
+++ b/web/src/routes/logs/logs-page.test-harness.svelte
@@ -0,0 +1,10 @@
+<script lang="ts">
+  import { createAuthState, provideAuthState } from "$lib/auth.svelte";
+  import LogsPage from "./+page.svelte";
+
+  let { search = "" }: { search?: string } = $props();
+
+  provideAuthState(createAuthState());
+</script>
+
+<LogsPage {search} />
diff --git a/web/src/routes/logs/logs-page.test.ts b/web/src/routes/logs/logs-page.test.ts
new file mode 100644
index 000000000..ef430840b
--- /dev/null
+++ b/web/src/routes/logs/logs-page.test.ts
@@ -0,0 +1,166 @@
+import { afterEach, describe, expect, it, vi } from "@effect/vitest";
+import { cleanup, render, screen, waitFor } from "@testing-library/svelte";
+import type { RequestLog, RequestLogPage } from "$lib/api";
+import LogsPageHarness from "./logs-page.test-harness.svelte";
+
+function requestLog(requestId: string) {
+  return {
+    requestId,
+    actorApiTokenId: null,
+    surface: "gateway",
+    sourceId: "source-1",
+    toolId: "tool-1",
+    pathSnapshot: `tools.source_1.${requestId}`,
+    outcome: "succeeded",
+    errorCode: null,
+    durationMs: 12,
+    approvalId: null,
+    createdAt: 100,
+  } satisfies RequestLog;
+}
+
+function logPage(requestId: string, nextCursor: string | null = null) {
+  return Response.json({ items: [requestLog(requestId)], nextCursor } satisfies RequestLogPage);
+}
+
+function deferred<Value>() {
+  let resolve = (_value: Value) => {};
+  let reject = (_error: unknown) => {};
+  const promise = new Promise<Value>((complete, fail) => {
+    resolve = complete;
+    reject = fail;
+  });
+  return { promise, resolve, reject };
+}
+
+function errorResponse(code: string, message: string, status = 503) {
+  return Response.json({ error: { code, message, requestId: `${code}-request` } }, { status });
+}
+
+afterEach(() => {
+  cleanup();
+  vi.unstubAllGlobals();
+});
+
+describe("Request logs list identity", () => {
+  it("does not present cursor A as cursor B while B is held or after B is rejected", async () => {
+    const pageB = deferred<Response>();
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input) => {
+        const path = String(input);
+        if (path === "/api/v1/request-logs?limit=50&cursor=cursor-a") {
+          return Promise.resolve(logPage("request-a"));
+        }
+        if (path === "/api/v1/request-logs?limit=50&cursor=cursor-b") return pageB.promise;
+        return Promise.resolve(errorResponse("unexpected_test_request", path, 500));
+      }),
+    );
+    const mounted = render(LogsPageHarness, { search: "?cursor=cursor-a" });
+
+    expect(await screen.findByText("request-a")).toBeDefined();
+    await mounted.rerender({ search: "?cursor=cursor-b" });
+
+    expect(screen.queryByText("request-a")).toBeNull();
+    expect(screen.getByText("Loading request logs...")).toBeDefined();
+
+    pageB.reject({ _tag: "CursorBNetworkFailure" });
+
+    expect(
+      await screen.findByText(
+        "Executor could not be reached. Check that the local server is running.",
+      ),
+    ).toBeDefined();
+    expect(screen.queryByText("request-a")).toBeNull();
+    expect(
+      screen.queryByText("Showing the last loaded request page while Executor reconnects."),
+    ).toBeNull();
+  });
+
+  it("keeps cursor B after an out-of-order cursor A completion", async () => {
+    const pageA = deferred<Response>();
+    const pageB = deferred<Response>();
+    const signals = new Map<string, AbortSignal>();
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input, init) => {
+        const path = String(input);
+        const signal = init?.signal;
+        if (signal !== undefined && signal !== null) signals.set(path, signal);
+        if (path === "/api/v1/request-logs?limit=50&cursor=cursor-a") return pageA.promise;
+        if (path === "/api/v1/request-logs?limit=50&cursor=cursor-b") return pageB.promise;
+        return Promise.resolve(errorResponse("unexpected_test_request", path, 500));
+      }),
+    );
+    const mounted = render(LogsPageHarness, { search: "?cursor=cursor-a" });
+
+    await waitFor(() => expect(signals.size).toBe(1));
+    await mounted.rerender({ search: "?cursor=cursor-b" });
+    await waitFor(() => expect(signals.size).toBe(2));
+    expect(signals.get("/api/v1/request-logs?limit=50&cursor=cursor-a")?.aborted).toBe(true);
+
+    pageB.resolve(logPage("request-b"));
+    expect(await screen.findByText("request-b")).toBeDefined();
+    pageA.resolve(logPage("request-a"));
+    await pageA.promise;
+    await Promise.resolve();
+    await Promise.resolve();
+
+    expect(screen.getByText("request-b")).toBeDefined();
+    expect(screen.queryByText("request-a")).toBeNull();
+  });
+
+  it("preserves the honestly labeled list across detail-only query changes", async () => {
+    let listCalls = 0;
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input) => {
+        const path = String(input);
+        if (path === "/api/v1/request-logs?limit=50&cursor=cursor-b") {
+          listCalls += 1;
+          return Promise.resolve(logPage("request-b"));
+        }
+        if (path === "/api/v1/request-logs/request-b") {
+          return Promise.resolve(Response.json(requestLog("request-b")));
+        }
+        return Promise.resolve(errorResponse("unexpected_test_request", path, 500));
+      }),
+    );
+    const mounted = render(LogsPageHarness, { search: "?cursor=cursor-b" });
+
+    expect(await screen.findByText("request-b")).toBeDefined();
+    await mounted.rerender({ search: "?cursor=cursor-b&request=request-b" });
+
+    expect(await screen.findByRole("heading", { name: "request-b" })).toBeDefined();
+    expect(screen.getAllByText("request-b").length).toBeGreaterThan(1);
+    expect(listCalls).toBe(1);
+  });
+
+  it("aborts its active page request and ignores completion after unmount", async () => {
+    const pending = deferred<Response>();
+    const request = { signal: null as AbortSignal | null };
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input, init) => {
+        const path = String(input);
+        if (path === "/api/v1/request-logs?limit=50&cursor=cursor-a") {
+          request.signal = init?.signal ?? null;
+          return pending.promise;
+        }
+        return Promise.resolve(errorResponse("unexpected_test_request", path, 500));
+      }),
+    );
+    const mounted = render(LogsPageHarness, { search: "?cursor=cursor-a" });
+
+    await waitFor(() => expect(request.signal).not.toBeNull());
+    mounted.unmount();
+    expect(request.signal?.aborted).toBe(true);
+
+    pending.resolve(logPage("request-after-unmount"));
+    await pending.promise;
+    await Promise.resolve();
+    await Promise.resolve();
+
+    expect(screen.queryByText("request-after-unmount")).toBeNull();
+  });
+});
diff --git a/web/src/routes/setup/+page.svelte b/web/src/routes/setup/+page.svelte
new file mode 100644
index 000000000..afac011fc
--- /dev/null
+++ b/web/src/routes/setup/+page.svelte
@@ -0,0 +1,122 @@
+<script lang="ts">
+  import { goto } from "$app/navigation";
+  import ErrorNotice from "$lib/ErrorNotice.svelte";
+  import { useAuthState } from "$lib/auth.svelte";
+  import type { ApiError } from "$lib/api";
+  import { consumeSetupToken } from "$lib/navigation";
+  import { onMount } from "svelte";
+
+  const auth = useAuthState();
+  let setupToken = $state<string | null>(null);
+  let fragmentRead = $state(false);
+  let username = $state("admin");
+  let password = $state("");
+  let passwordConfirmation = $state("");
+  let busy = $state(false);
+  let error = $state<ApiError | null>(null);
+  let passwordsMatch = $derived(password === passwordConfirmation);
+  let canSubmit = $derived(
+    setupToken !== null &&
+      username.trim() !== "" &&
+      password.length >= 12 &&
+      passwordsMatch &&
+      !busy,
+  );
+
+  onMount(() => {
+    setupToken = consumeSetupToken(new URL(window.location.href), (nextUrl) => {
+      history.replaceState(history.state, "", nextUrl);
+    });
+    fragmentRead = true;
+  });
+
+  async function submit(event: SubmitEvent) {
+    event.preventDefault();
+    if (!canSubmit || setupToken === null) return;
+
+    busy = true;
+    error = null;
+    const result = await auth.completeSetup({
+      setupToken,
+      username: username.trim(),
+      password,
+    });
+    if (!result.ok) {
+      error = result.error;
+    } else if (auth.authenticated) {
+      password = "";
+      passwordConfirmation = "";
+      void goto("/sources", { replaceState: true });
+    }
+    busy = false;
+  }
+</script>
+
+<svelte:head>
+  <title>Set up Executor</title>
+</svelte:head>
+
+<main class="centered-page setup-page">
+  <section class="auth-card">
+    <div class="auth-heading">
+      <span class="brand-mark" aria-hidden="true">EX</span>
+      <div>
+        <p class="eyebrow">First boot</p>
+        <h1>Make this instance yours.</h1>
+      </div>
+    </div>
+    <p class="lede">
+      Create the only administrator account. The one-time setup secret is removed from browser
+      history as soon as this page opens.
+    </p>
+
+    {#if fragmentRead && setupToken === null}
+      <div class="notice warning" role="alert">
+        Open the exact setup link printed by <code>executor server</code>. Restarting an
+        unconfigured instance prints a fresh one-time link.
+      </div>
+    {/if}
+
+    <form onsubmit={submit}>
+      <label>
+        Administrator username
+        <input bind:value={username} autocomplete="username" required maxlength="64" />
+      </label>
+      <label>
+        Password
+        <input
+          bind:value={password}
+          type="password"
+          autocomplete="new-password"
+          minlength="12"
+          required
+          aria-describedby="password-help"
+        />
+        <small id="password-help">Use at least 12 characters.</small>
+      </label>
+      <label>
+        Confirm password
+        <input
+          bind:value={passwordConfirmation}
+          type="password"
+          autocomplete="new-password"
+          minlength="12"
+          required
+          aria-invalid={passwordConfirmation !== "" && !passwordsMatch}
+          aria-describedby={passwordConfirmation !== "" && !passwordsMatch
+            ? "password-mismatch"
+            : undefined}
+        />
+      </label>
+      {#if passwordConfirmation !== "" && !passwordsMatch}
+        <p id="password-mismatch" class="field-error" role="alert" aria-live="polite">
+          The passwords do not match.
+        </p>
+      {/if}
+      {#if error !== null}<ErrorNotice {error} />{/if}
+      <button class="primary" type="submit" disabled={!canSubmit}>
+        {busy ? "Creating administrator..." : "Create administrator"}
+      </button>
+    </form>
+  </section>
+</main>
diff --git a/web/src/routes/setup/page.test.ts b/web/src/routes/setup/page.test.ts
new file mode 100644
index 000000000..ee564c132
--- /dev/null
+++ b/web/src/routes/setup/page.test.ts
@@ -0,0 +1,12 @@
+import { expect, it } from "@effect/vitest";
+import { render, screen, waitFor } from "@testing-library/svelte";
+import Page from "./+page.svelte";
+
+it("removes the first-boot token from browser history without rendering it", async () => {
+  history.replaceState({}, "", "/setup#token=set_test_secret");
+  render(Page);
+
+  await waitFor(() => expect(window.location.hash).toBe(""));
+  expect(screen.getByRole("heading", { name: "Make this instance yours." })).toBeDefined();
+  expect(document.body.textContent).not.toContain("set_test_secret");
+});
diff --git a/web/src/routes/sources/+page.svelte b/web/src/routes/sources/+page.svelte
new file mode 100644
index 000000000..2a30d8da0
--- /dev/null
+++ b/web/src/routes/sources/+page.svelte
@@ -0,0 +1,1765 @@
+<script lang="ts">
+  import { beforeNavigate, replaceState } from "$app/navigation";
+  import { page } from "$app/state";
+  import { tick, untrack } from "svelte";
+  import DashboardShell from "$lib/DashboardShell.svelte";
+  import ErrorNotice from "$lib/ErrorNotice.svelte";
+  import GraphqlCredentialEditor from "$lib/GraphqlCredentialEditor.svelte";
+  import GraphqlSourceForm from "$lib/GraphqlSourceForm.svelte";
+  import McpCredentialEditor from "$lib/McpCredentialEditor.svelte";
+  import McpHttpSourceForm from "$lib/McpHttpSourceForm.svelte";
+  import McpStdioSourceForm from "$lib/McpStdioSourceForm.svelte";
+  import OAuthSourceConnections from "$lib/OAuthSourceConnections.svelte";
+  import {
+    authorizeOAuthConnection,
+    createGraphqlSource,
+    createMcpHttpSource,
+    createMcpStdioSource,
+    createOpenApiSource,
+    deleteOAuthConnection,
+    deleteOpenApiCredentials,
+    deleteSource,
+    disconnectOAuthConnection,
+    getOpenApiCredentials,
+    getSourceCreationResolution,
+    getSourceCredentials,
+    listSources,
+    listOAuthConnections,
+    previewOpenApiSource,
+    putOpenApiCredentials,
+    putOAuthConnection,
+    putGraphqlCredentials,
+    refreshSourceCatalog,
+    sealMissingSourceCreation,
+    setSourceMode,
+    type ApiError,
+    type OpenApiPreview,
+    type OpenApiSpecInput,
+    type SourceList,
+    type ToolMode,
+  } from "$lib/api";
+  import {
+    beginResourceLoad,
+    createLatestRequest,
+    emptyResource,
+    modeLabel,
+    settleResourceLoad,
+    toolModes,
+    unexpectedRequestError,
+  } from "$lib/catalog-state";
+  import { useAuthState } from "$lib/auth.svelte";
+  import { previewToolKey, requiresBroadConfirmation, sourceModeImpact } from "$lib/catalog-ux";
+  import {
+    buildCredentialMap,
+    duplicateCredentialNames,
+    isSupportedCredentialType,
+    type CredentialDraft,
+    type SupportedCredentialType,
+  } from "$lib/openapi-credentials";
+  import { safeGraphqlSourceDetails } from "$lib/graphql-source-state";
+  import { safeMcpSourceDetails } from "$lib/mcp-source-state";
+  import {
+    oauthCallbackOutcomeNotice,
+    oauthCallbackNoticeWithoutEligibleSources,
+    oauthCallbackRefreshKey,
+    type OAuthConnectionOperations,
+    withoutOAuthCallbackParameters,
+  } from "$lib/oauth-connection-state";
+  import {
+    browserSourceCreateEnvironment,
+    createSourceCreateCoordinator,
+    emptySourceCreateState,
+    type SourceCreateEnvironment,
+    type SourceCreateInput,
+  } from "$lib/source-create-lifecycle";
+
+  type OAuthNavigationOverride = {
+    readonly url: URL;
+    readonly state: App.PageState;
+    readonly replaceState: (url: URL, state: App.PageState) => void;
+  };
+
+  let {
+    oauthNavigation,
+    sourceCreateEnvironment = browserSourceCreateEnvironment(),
+  }: {
+    oauthNavigation?: OAuthNavigationOverride;
+    sourceCreateEnvironment?: SourceCreateEnvironment;
+  } = $props();
+
+  const auth = useAuthState();
+  const credentialRequest = createLatestRequest();
+  let resource = $state(emptyResource<SourceList>());
+  let refreshKey = $state(0);
+  let connectSourceOpen = $state(false);
+  let connectSourceOpenOwnedByUser = $state(false);
+  let pending = $state<string[]>([]);
+  let mutationErrors = $state<Record<string, ApiError>>({});
+  let conflictNotice = $state<string | null>(null);
+  let confirmingDelete = $state<string | null>(null);
+  let sourceModeDrafts = $state<Record<string, ToolMode | null>>({});
+  let confirmingSourceMode = $state<string | null>(null);
+  let locatorType = $state<"url" | "inline">("url");
+  let specUrl = $state("");
+  let specContent = $state("");
+  let allowPrivateNetwork = $state(false);
+  let displayName = $state("");
+  let displayNameEdited = $state(false);
+  let preferredSlug = $state("");
+  let sourceDescription = $state("");
+  let sourceType = $state<"openapi" | "graphql" | "mcp_http" | "mcp_stdio">("openapi");
+  let sourceFormGeneration = $state(0);
+  let importCredentialRows = $state<CredentialDraft[]>([]);
+  let credentialEditorSource = $state<string | null>(null);
+  let confirmingCredentialClear = $state<string | null>(null);
+  let credentialRevision = $state<number | null>(null);
+  let credentialRows = $state<CredentialDraft[]>([]);
+  let credentialBusySource = $state<string | null>(null);
+  let credentialMutation = $state<{
+    sourceId: string;
+    kind: "save" | "clear";
+  } | null>(null);
+  let graphqlCredentialBusySourceIds = $state<string[]>([]);
+  let graphqlCredentialMutationSourceIds = $state<string[]>([]);
+  let mcpCredentialBusySourceIds = $state<string[]>([]);
+  let mcpCredentialMutationSourceIds = $state<string[]>([]);
+  let oauthBusySourceIds = $state<string[]>([]);
+  let oauthMutationSourceIds = $state<string[]>([]);
+  let oauthCallbackCheck = $state<{
+    identity: string;
+    checkedSourceIds: string[];
+  } | null>(null);
+  let handledUnmatchedCallbackIdentity: string | null = null;
+  let credentialFailure = $state<{ sourceId: string; error: ApiError } | null>(null);
+  let credentialCleanup: (() => void) | null = null;
+  let credentialCounter = 0;
+  let currentDuplicateCredentialNames = $derived(duplicateCredentialNames(credentialRows));
+  let preview = $state<OpenApiPreview | null>(null);
+  let previewFingerprint = $state<string | null>(null);
+  let importError = $state<ApiError | null>(null);
+  let importNotice = $state<string | null>(null);
+  let previewBusy = $state(false);
+  let createBusy = $state(false);
+  let sourceCreateState = $state(emptySourceCreateState());
+  let navigationNotice = $state<string | null>(null);
+  let sourceListGeneration = 0;
+  let activeSourceListRequest: {
+    cancel: () => void;
+    generation: number;
+    refreshKey: number;
+  } | null = null;
+  let lifetime = 0;
+  let oauthUrl = $derived(oauthNavigation?.url ?? page.url);
+  let oauthCallbackKey = $derived(oauthCallbackRefreshKey(oauthUrl.searchParams));
+  let eligibleOAuthSourceIds = $derived(
+    resource.data?.sources
+      .filter(
+        (source) =>
+          source.kind === "openapi" || source.kind === "graphql" || source.kind === "mcp_http",
+      )
+      .map((source) => source.id)
+      .sort() ?? [],
+  );
+  let eligibleOAuthSourceIdentity = $derived(
+    `${resource.data?.catalogRevision ?? "loading"}:${
+      resource.data?.sources
+        .filter((source) => eligibleOAuthSourceIds.includes(source.id))
+        .map((source) => `${source.id}:${source.revision}:${source.catalogRevision}`)
+        .sort()
+        .join("\u0000") ?? ""
+    }`,
+  );
+  let sourceCreateDispatching = $derived(sourceCreateState.phase === "dispatching");
+  let sourceCreateLocked = $derived(sourceCreateState.phase !== "idle");
+  let sourceWritePending = $derived(
+    sourceCreateDispatching ||
+      pending.some(
+        (id) => id.startsWith("mode:") || id.startsWith("refresh:") || id.startsWith("delete:"),
+      ) ||
+      credentialMutation !== null ||
+      graphqlCredentialMutationSourceIds.length > 0 ||
+      mcpCredentialMutationSourceIds.length > 0 ||
+      oauthMutationSourceIds.length > 0,
+  );
+  let previewCurrent = $derived(
+    preview !== null && previewFingerprint === currentSpecFingerprint(),
+  );
+  const mutationControllers = new Map<string, AbortController>();
+  const oauthOperations: OAuthConnectionOperations = {
+    load: (sourceId, signal) => listOAuthConnections(sourceId, undefined, signal),
+    save: (sourceId, credentialKey, input, signal) =>
+      putOAuthConnection(sourceId, credentialKey, input, undefined, signal),
+    authorize: (sourceId, credentialKey, input, signal) =>
+      authorizeOAuthConnection(sourceId, credentialKey, input, undefined, signal),
+    disconnect: (sourceId, credentialKey, input, signal) =>
+      disconnectOAuthConnection(sourceId, credentialKey, input, undefined, signal),
+    remove: (sourceId, credentialKey, input, signal) =>
+      deleteOAuthConnection(sourceId, credentialKey, input, undefined, signal),
+  };
+  const sourceCreateCoordinator = createSourceCreateCoordinator({
+    environment: {
+      getStorage: () => sourceCreateEnvironment.getStorage(),
+      fillRandom: (bytes) => sourceCreateEnvironment.fillRandom(bytes),
+      wait: (milliseconds, signal) => sourceCreateEnvironment.wait(milliseconds, signal),
+    },
+    create: dispatchSourceCreate,
+    lookup: (key, signal) => getSourceCreationResolution(key, undefined, signal),
+    seal: (key, signal) => sealMissingSourceCreation(key, undefined, signal),
+    refresh: refreshSourcesAfterCreate,
+    onstatechange: (state) => {
+      sourceCreateState = state;
+      if (state.error !== null) {
+        auth.recoverFromApiError(state.error);
+        void focusSourceCreateStatus();
+      }
+    },
+    oncompleted: connectedSource,
+  });
+
+  beforeNavigate(({ cancel }) => {
+    if (allowSourceExit()) return;
+    cancel();
+  });
+
+  $effect(() => {
+    const currentRefreshKey = refreshKey;
+    const request = untrack(() => startSourceListLoad(currentRefreshKey));
+    return request.cancel;
+  });
+
+  $effect(() => {
+    const sources = resource.data?.sources;
+    if (sources === undefined || connectSourceOpenOwnedByUser) return;
+    connectSourceOpen = sources.length === 0;
+  });
+
+  $effect(() => {
+    const callbackKey = oauthCallbackKey;
+    const sourceData = resource.data;
+    const sourceLoading = resource.loading;
+    const sourceError = resource.error;
+    if (callbackKey === null || sourceData === null || sourceLoading || sourceError !== null)
+      return;
+    const notice = oauthCallbackNoticeWithoutEligibleSources(
+      callbackKey,
+      sourceData.sources.map((source) => source.kind),
+      sourceLoading,
+    );
+    if (notice === null) return;
+    void showUnmatchedOAuthCallback(callbackKey, eligibleOAuthSourceIdentity, notice.message);
+  });
+
+  $effect(() => {
+    if (!sourceWritePending) navigationNotice = null;
+  });
+
+  $effect(() => {
+    void sourceCreateCoordinator.recoverStored();
+  });
+
+  $effect(() => {
+    lifetime += 1;
+    return () => {
+      lifetime += 1;
+      activeSourceListRequest?.cancel();
+      for (const controller of mutationControllers.values()) controller.abort();
+      credentialCleanup?.();
+      sourceCreateCoordinator.dispose();
+    };
+  });
+
+  async function persistSourceMode(sourceId: string, mode: ToolMode | null, revision: number) {
+    const mutationId = sourceMutationId("mode", sourceId);
+    clearSourceMutationError(sourceId);
+    const controller = beginMutation(mutationId);
+    conflictNotice = null;
+    const result = await setSourceMode(sourceId, mode, revision, undefined, controller.signal);
+    if (!finishMutation(mutationId, controller)) return;
+    if (!result.ok) {
+      if (auth.recoverFromApiError(result.error)) return;
+      if (result.error.status === 409) {
+        conflictNotice =
+          "Source defaults changed elsewhere. The latest settings are shown for review.";
+        const { [sourceId]: _removed, ...remainingDrafts } = sourceModeDrafts;
+        sourceModeDrafts = remainingDrafts;
+        confirmingSourceMode = null;
+        refreshKey += 1;
+        await tick();
+        document.getElementById("source-conflict")?.focus();
+      } else {
+        mutationErrors = { ...mutationErrors, [sourceId]: result.error };
+      }
+      return;
+    }
+
+    const { [sourceId]: _removed, ...remainingDrafts } = sourceModeDrafts;
+    sourceModeDrafts = remainingDrafts;
+    confirmingSourceMode = null;
+    importNotice =
+      mode === null
+        ? "Source default changed to Tool defaults."
+        : `Source default changed to ${modeLabel(mode)}.`;
+
+    const current = resource.data;
+    if (current !== null) {
+      resource = {
+        ...resource,
+        data: {
+          ...current,
+          sources: current.sources.map((source) =>
+            source.id === sourceId ? result.value : source,
+          ),
+        },
+      };
+    }
+    focusSourceStatus();
+  }
+
+  async function removeSource(sourceId: string, displayName: string) {
+    const mutationId = sourceMutationId("delete", sourceId);
+    clearSourceMutationError(sourceId);
+    const controller = beginMutation(mutationId);
+    const result = await deleteSource(sourceId, undefined, controller.signal);
+    if (!finishMutation(mutationId, controller)) return;
+    if (!result.ok) {
+      if (auth.recoverFromApiError(result.error)) return;
+      mutationErrors = { ...mutationErrors, [sourceId]: result.error };
+      return;
+    }
+    if (credentialEditorSource === sourceId) clearCredentialEditor(false);
+    confirmingDelete = null;
+    importNotice = `${displayName} was deleted.`;
+    refreshKey += 1;
+    await tick();
+    document.getElementById("source-status")?.focus();
+  }
+
+  async function previewSource(event: SubmitEvent) {
+    event.preventDefault();
+    const spec = currentSpec();
+    const fingerprint = currentSpecFingerprint();
+    const controller = beginMutation("openapi-preview");
+    previewBusy = true;
+    importError = null;
+    importNotice = null;
+    const result = await previewOpenApiSource(
+      spec,
+      allowPrivateNetwork,
+      undefined,
+      controller.signal,
+    );
+    if (!finishMutation("openapi-preview", controller)) return;
+    previewBusy = false;
+    if (fingerprint !== currentSpecFingerprint()) return;
+    if (!result.ok) {
+      if (auth.recoverFromApiError(result.error)) return;
+      importError = result.error;
+      return;
+    }
+    preview = result.value;
+    previewFingerprint = fingerprint;
+    importCredentialRows = result.value.securitySchemes.flatMap((scheme) => {
+      const type = credentialDraftType(scheme.credentialType);
+      return scheme.supported && type !== null ? [credentialRow(scheme.name, type, false)] : [];
+    });
+    if (!displayNameEdited) displayName = result.value.title;
+  }
+
+  async function createSource() {
+    if (!previewCurrent || sourceCreateLocked || displayName.trim() === "") return;
+    const credentials = buildCredentialMap(importCredentialRows);
+    if (credentials === null) return;
+    const owner = lifetime;
+    createBusy = true;
+    importError = null;
+    const input = {
+      kind: "openapi",
+      displayName: displayName.trim(),
+      ...(preferredSlug.trim() ? { preferredSlug: preferredSlug.trim() } : {}),
+      ...(sourceDescription.trim() ? { description: sourceDescription.trim() } : {}),
+      spec: currentSpec(),
+      allowPrivateNetwork,
+      ...(Object.keys(credentials).length === 0 ? {} : { credential: { schemes: credentials } }),
+    } satisfies SourceCreateInput;
+    importCredentialRows = importCredentialRows.map((row) => ({ ...row, value: "" }));
+    const result = await sourceCreateCoordinator.start(input);
+    if (owner !== lifetime) return;
+    createBusy = false;
+    if (!result.ok) {
+      if (auth.recoverFromApiError(result.error)) return;
+      importError = result.error;
+      await focusImportError();
+      return;
+    }
+    clearImportForm();
+  }
+
+  async function refreshSource(sourceId: string) {
+    const mutationId = sourceMutationId("refresh", sourceId);
+    clearSourceMutationError(sourceId);
+    const controller = beginMutation(mutationId);
+    const result = await refreshSourceCatalog(sourceId, undefined, controller.signal);
+    if (!finishMutation(mutationId, controller)) return;
+    if (!result.ok) {
+      if (auth.recoverFromApiError(result.error)) return;
+      mutationErrors = { ...mutationErrors, [sourceId]: result.error };
+      return;
+    }
+    importNotice = `Source refreshed: ${result.value.activeToolCount} active tools, ${result.value.tombstonedToolCount} removed.`;
+    refreshKey += 1;
+  }
+
+  function openCredentialEditor(sourceId: string) {
+    if (credentialBusySource !== null) return;
+    if (credentialEditorSource === sourceId) {
+      clearCredentialEditor();
+      return;
+    }
+    runCredentialOperation(
+      sourceId,
+      "load",
+      (signal) => getOpenApiCredentials(sourceId, undefined, signal),
+      (result) => {
+        if (!result.ok) {
+          if (auth.recoverFromApiError(result.error)) return;
+          credentialFailure = { sourceId, error: result.error };
+          return;
+        }
+        credentialEditorSource = sourceId;
+        confirmingCredentialClear = null;
+        credentialRevision = result.value.revision;
+        credentialRows = result.value.configuredSchemes.flatMap((scheme) => {
+          const type = credentialDraftType(scheme.credentialType);
+          return type === null ? [] : [credentialRow(scheme.name, type, true)];
+        });
+        void tick().then(() => document.getElementById(`credential-editor-${sourceId}`)?.focus());
+      },
+    );
+  }
+
+  function saveCredentials(sourceId: string) {
+    if (credentialBusySource !== null || credentialRevision === null || credentialRows.length === 0)
+      return;
+    const credentials = buildCredentialMap(credentialRows);
+    if (credentials === null) return;
+    const expectedRevision = credentialRevision;
+    runCredentialOperation(
+      sourceId,
+      "save",
+      (signal) => putOpenApiCredentials(sourceId, expectedRevision, credentials, undefined, signal),
+      (result) => {
+        if (!result.ok) {
+          if (auth.recoverFromApiError(result.error)) return;
+          if (result.error.status === 409) {
+            conflictNotice =
+              "Credentials changed elsewhere. Reopen the editor and enter them again.";
+            clearCredentialEditor(false);
+            void tick().then(() => document.getElementById("source-conflict")?.focus());
+          } else {
+            credentialFailure = { sourceId, error: result.error };
+          }
+          return;
+        }
+        importNotice = "Credentials were replaced. Secret values remain hidden.";
+        clearCredentialEditor(false);
+        focusSourceStatus();
+      },
+    );
+  }
+
+  function clearCredentials(sourceId: string) {
+    if (credentialBusySource !== null || credentialRevision === null) return;
+    const expectedRevision = credentialRevision;
+    runCredentialOperation(
+      sourceId,
+      "clear",
+      (signal) => deleteOpenApiCredentials(sourceId, expectedRevision, undefined, signal),
+      (result) => {
+        if (!result.ok) {
+          if (auth.recoverFromApiError(result.error)) return;
+          if (result.error.status === 409) {
+            conflictNotice =
+              "Credentials changed elsewhere. Reopen the editor before clearing them.";
+            clearCredentialEditor(false);
+            void tick().then(() => document.getElementById("source-conflict")?.focus());
+          } else {
+            credentialFailure = { sourceId, error: result.error };
+          }
+          return;
+        }
+        importNotice = "All credentials for this source were cleared.";
+        clearCredentialEditor(false);
+        focusSourceStatus();
+      },
+    );
+  }
+
+  function runCredentialOperation<Value>(
+    sourceId: string,
+    kind: "load" | "save" | "clear",
+    task: (signal: AbortSignal) => Promise<Value>,
+    commit: (value: Value) => void,
+  ) {
+    credentialFailure = null;
+    conflictNotice = null;
+    importNotice = null;
+    credentialBusySource = sourceId;
+    credentialMutation = kind === "load" ? null : { sourceId, kind };
+    credentialCleanup = credentialRequest.start(
+      task,
+      (value) => {
+        credentialBusySource = null;
+        credentialMutation = null;
+        credentialCleanup = null;
+        credentialFailure = null;
+        commit(value);
+      },
+      () => {
+        credentialBusySource = null;
+        credentialMutation = null;
+        credentialCleanup = null;
+        credentialFailure = { sourceId, error: unexpectedRequestError() };
+      },
+    );
+  }
+
+  function clearCredentialEditor(restoreFocus = true) {
+    const sourceId = credentialEditorSource;
+    credentialCleanup?.();
+    credentialCleanup = null;
+    credentialBusySource = null;
+    credentialMutation = null;
+    credentialEditorSource = null;
+    confirmingCredentialClear = null;
+    credentialFailure = null;
+    credentialRows = [];
+    credentialRevision = null;
+    if (restoreFocus && sourceId !== null) {
+      void tick().then(() => document.getElementById(`manage-credentials-${sourceId}`)?.focus());
+    }
+  }
+
+  function focusSourceStatus() {
+    void tick().then(() => document.getElementById("source-status")?.focus());
+  }
+
+  async function focusImportError() {
+    await tick();
+    document.getElementById("source-import-error")?.focus();
+  }
+
+  async function beginDelete(sourceId: string) {
+    confirmingDelete = sourceId;
+    await tick();
+    document.getElementById(`cancel-delete-${sourceId}`)?.focus();
+  }
+
+  async function cancelDelete(sourceId: string) {
+    confirmingDelete = null;
+    await tick();
+    document.getElementById(`delete-source-${sourceId}`)?.focus();
+  }
+
+  function currentSpec(): OpenApiSpecInput {
+    return locatorType === "url"
+      ? { type: "url", url: specUrl.trim() }
+      : { type: "inline", content: specContent };
+  }
+
+  function currentSpecFingerprint() {
+    const spec = currentSpec();
+    return `${allowPrivateNetwork ? "private" : "public"}:${spec.type}:${spec.type === "url" ? spec.url : spec.content}`;
+  }
+
+  function credentialRow(
+    name: string,
+    credentialType: SupportedCredentialType,
+    enabled: boolean,
+  ): CredentialDraft {
+    credentialCounter += 1;
+    return {
+      key: `credential-${credentialCounter}`,
+      name,
+      credentialType,
+      enabled,
+      value: "",
+      username: "",
+    };
+  }
+
+  function addCredentialRow() {
+    if (credentialBusySource !== null) return;
+    credentialRows = [...credentialRows, credentialRow("", "api_key", true)];
+  }
+
+  async function removeCredentialRow(key: string, sourceId: string) {
+    if (credentialBusySource !== null) return;
+    const index = credentialRows.findIndex((row) => row.key === key);
+    const remaining = credentialRows.filter((row) => row.key !== key);
+    credentialRows = remaining;
+    await tick();
+    const target = remaining[Math.min(index, remaining.length - 1)];
+    if (target !== undefined) {
+      document.getElementById(`credential-name-${target.key}`)?.focus();
+    } else {
+      document.getElementById(`add-credential-${sourceId}`)?.focus();
+    }
+  }
+
+  async function beginCredentialClear(sourceId: string) {
+    if (credentialBusySource !== null) return;
+    confirmingCredentialClear = sourceId;
+    await tick();
+    document.getElementById(`cancel-clear-credentials-${sourceId}`)?.focus();
+  }
+
+  async function cancelCredentialClear(sourceId: string) {
+    if (credentialBusySource !== null) return;
+    confirmingCredentialClear = null;
+    await tick();
+    document.getElementById(`clear-credentials-${sourceId}`)?.focus();
+  }
+
+  function credentialTypeLabel(type: string) {
+    if (type === "api_key") return "API key";
+    if (type === "bearer") return "Bearer token";
+    if (type === "basic") return "Basic auth";
+    if (type === "oauth_access_token" || type === "manual_oauth_access_token") {
+      return "OAuth access token (manual, advanced)";
+    }
+    return type;
+  }
+
+  function credentialDraftType(type: string): SupportedCredentialType | null {
+    if (type === "manual_oauth_access_token") return "oauth_access_token";
+    return isSupportedCredentialType(type) ? type : null;
+  }
+
+  function clearImportForm() {
+    if (sourceCreateLocked || createBusy) return;
+    cancelMutation("openapi-preview");
+    previewBusy = false;
+    locatorType = "url";
+    specUrl = "";
+    specContent = "";
+    allowPrivateNetwork = false;
+    displayName = "";
+    displayNameEdited = false;
+    preferredSlug = "";
+    sourceDescription = "";
+    importCredentialRows = [];
+    preview = null;
+    previewFingerprint = null;
+    importError = null;
+  }
+
+  function switchSourceType(next: "openapi" | "graphql" | "mcp_http" | "mcp_stdio") {
+    if (sourceCreateLocked || next === sourceType) return;
+    if (sourceType === "openapi") clearImportForm();
+    sourceType = next;
+  }
+
+  function connectedSource(source: SourceList["sources"][number]) {
+    importNotice = `${source.displayName} connected with ${source.toolCount} tools.`;
+    if (sourceType === "openapi") clearImportForm();
+    else sourceFormGeneration += 1;
+    focusSourceStatus();
+  }
+
+  function connectGraphqlSource(
+    input: Parameters<typeof createGraphqlSource>[0],
+    _signal: AbortSignal,
+  ) {
+    return sourceCreateCoordinator.start(input);
+  }
+
+  function connectMcpHttpSource(
+    input: Parameters<typeof createMcpHttpSource>[0],
+    _signal: AbortSignal,
+  ) {
+    return sourceCreateCoordinator.start(input);
+  }
+
+  function connectMcpStdioSource(
+    input: Parameters<typeof createMcpStdioSource>[0],
+    _signal: AbortSignal,
+  ) {
+    return sourceCreateCoordinator.start(input);
+  }
+
+  function dispatchSourceCreate(input: SourceCreateInput, key: string, signal: AbortSignal) {
+    if (input.kind === "openapi") return createOpenApiSource(input, key, undefined, signal);
+    if (input.kind === "graphql") return createGraphqlSource(input, key, undefined, signal);
+    if (input.kind === "mcp_http") return createMcpHttpSource(input, key, undefined, signal);
+    return createMcpStdioSource(input, key, undefined, signal);
+  }
+
+  function loadGraphqlCredentials(sourceId: string, signal: AbortSignal) {
+    return getSourceCredentials(sourceId, undefined, signal);
+  }
+
+  function saveGraphqlCredentials(
+    sourceId: string,
+    expectedRevision: number,
+    credential: Parameters<typeof putGraphqlCredentials>[2],
+    signal: AbortSignal,
+  ) {
+    return putGraphqlCredentials(sourceId, expectedRevision, credential, undefined, signal);
+  }
+
+  function authenticatedPreviewWithoutCredentials() {
+    if (preview === null || !preview.securitySchemes.some((scheme) => scheme.supported)) {
+      return false;
+    }
+    return importCredentialRows.every((row) => !row.enabled);
+  }
+
+  function beginMutation(id: string) {
+    mutationControllers.get(id)?.abort();
+    const controller = new AbortController();
+    mutationControllers.set(id, controller);
+    pending = [...new Set([...pending, id])];
+    const { [id]: _removed, ...rest } = mutationErrors;
+    mutationErrors = rest;
+    return controller;
+  }
+
+  function sourceMutationId(operation: "mode" | "refresh" | "delete", sourceId: string) {
+    return `${operation}:${sourceId}`;
+  }
+
+  function sourceOperationPending(sourceId: string) {
+    return (
+      resource.loading ||
+      sourceMutationPending(sourceId) ||
+      credentialBusySource === sourceId ||
+      graphqlCredentialBusySourceIds.includes(sourceId) ||
+      mcpCredentialBusySourceIds.includes(sourceId) ||
+      oauthBusySourceIds.includes(sourceId)
+    );
+  }
+
+  function sourceMutationPending(sourceId: string) {
+    return (["mode", "refresh", "delete"] as const).some((operation) =>
+      pending.includes(sourceMutationId(operation, sourceId)),
+    );
+  }
+
+  function setGraphqlCredentialBusy(sourceId: string, busy: boolean) {
+    graphqlCredentialBusySourceIds = busy
+      ? [...new Set([...graphqlCredentialBusySourceIds, sourceId])]
+      : graphqlCredentialBusySourceIds.filter((candidate) => candidate !== sourceId);
+  }
+
+  function setGraphqlCredentialMutation(sourceId: string, busy: boolean) {
+    graphqlCredentialMutationSourceIds = busy
+      ? [...new Set([...graphqlCredentialMutationSourceIds, sourceId])]
+      : graphqlCredentialMutationSourceIds.filter((candidate) => candidate !== sourceId);
+  }
+
+  function setOAuthBusy(sourceId: string, busy: boolean) {
+    oauthBusySourceIds = busy
+      ? [...new Set([...oauthBusySourceIds, sourceId])]
+      : oauthBusySourceIds.filter((candidate) => candidate !== sourceId);
+  }
+
+  function setOAuthMutation(sourceId: string, busy: boolean) {
+    oauthMutationSourceIds = busy
+      ? [...new Set([...oauthMutationSourceIds, sourceId])]
+      : oauthMutationSourceIds.filter((candidate) => candidate !== sourceId);
+  }
+
+  function setMcpCredentialBusy(sourceId: string, busy: boolean) {
+    mcpCredentialBusySourceIds = busy
+      ? [...new Set([...mcpCredentialBusySourceIds, sourceId])]
+      : mcpCredentialBusySourceIds.filter((candidate) => candidate !== sourceId);
+  }
+
+  function setMcpCredentialMutation(sourceId: string, busy: boolean) {
+    mcpCredentialMutationSourceIds = busy
+      ? [...new Set([...mcpCredentialMutationSourceIds, sourceId])]
+      : mcpCredentialMutationSourceIds.filter((candidate) => candidate !== sourceId);
+  }
+
+  function startSourceListLoad(requestRefreshKey: number, parentSignal?: AbortSignal) {
+    activeSourceListRequest?.cancel();
+    const controller = new AbortController();
+    const generation = ++sourceListGeneration;
+    const abortFromParent = () => controller.abort();
+    let cancelled = false;
+    if (parentSignal?.aborted) controller.abort();
+    else parentSignal?.addEventListener("abort", abortFromParent, { once: true });
+    resource = beginResourceLoad(resource);
+
+    function cancel() {
+      if (cancelled) return;
+      cancelled = true;
+      parentSignal?.removeEventListener("abort", abortFromParent);
+      controller.abort();
+      if (generation === sourceListGeneration) sourceListGeneration += 1;
+      if (activeSourceListRequest?.generation === generation) activeSourceListRequest = null;
+    }
+
+    const result = listSources(undefined, controller.signal)
+      .then(
+        (response) => response,
+        () => ({ ok: false, error: unexpectedRequestError() }) as const,
+      )
+      .then((response) => {
+        parentSignal?.removeEventListener("abort", abortFromParent);
+        if (
+          controller.signal.aborted ||
+          generation !== sourceListGeneration ||
+          activeSourceListRequest?.generation !== generation ||
+          activeSourceListRequest.refreshKey !== requestRefreshKey
+        ) {
+          if (activeSourceListRequest?.generation === generation) activeSourceListRequest = null;
+          return null;
+        }
+        activeSourceListRequest = null;
+        if (!response.ok && auth.recoverFromApiError(response.error)) return null;
+        resource = settleResourceLoad(resource, response);
+        return response;
+      });
+    activeSourceListRequest = { cancel, generation, refreshKey: requestRefreshKey };
+    return { cancel, result };
+  }
+
+  function refreshSourcesAfterCreate(signal: AbortSignal) {
+    return startSourceListLoad(refreshKey, signal).result;
+  }
+
+  function allowSourceExit() {
+    if (!sourceWritePending) return true;
+    navigationNotice = sourceCreateDispatching
+      ? "A source connection is still being submitted. Wait for it to finish before leaving this page."
+      : "A source or credential change is still being saved. Wait for it to finish before leaving this page.";
+    void focusNavigationNotice();
+    return false;
+  }
+
+  function beforeSourceSignOut() {
+    if (!allowSourceExit()) return false;
+    return sourceCreateCoordinator.suspendForSignOut();
+  }
+
+  function sourceSignOutFailed() {
+    sourceCreateCoordinator.signOutFailed();
+    void focusSourceCreateStatus();
+  }
+
+  async function focusNavigationNotice() {
+    const message = navigationNotice;
+    await tick();
+    if (!sourceWritePending || navigationNotice !== message) return;
+    document.getElementById("source-navigation-status")?.focus();
+  }
+
+  async function focusSourceCreateStatus() {
+    await tick();
+    document.getElementById("source-create-status")?.focus();
+  }
+
+  async function resumeSourceCreate() {
+    const result = await sourceCreateCoordinator.resume();
+    if (result !== null && !result.ok) auth.recoverFromApiError(result.error);
+  }
+
+  function guardBeforeUnload(event: BeforeUnloadEvent) {
+    if (!sourceWritePending) return;
+    event.preventDefault();
+    event.returnValue = "";
+  }
+
+  function consumeOAuthCallback(expectedKey: string, expectedSourceIdentity: string) {
+    if (
+      oauthCallbackKey !== expectedKey ||
+      eligibleOAuthSourceIdentity !== expectedSourceIdentity
+    ) {
+      return;
+    }
+    const nextUrl = withoutOAuthCallbackParameters(oauthUrl);
+    const currentState = oauthNavigation?.state ?? page.state;
+    if (oauthNavigation !== undefined) oauthNavigation.replaceState(nextUrl, currentState);
+    else replaceState(nextUrl, currentState);
+  }
+
+  async function showUnmatchedOAuthCallback(
+    callbackKey: string,
+    sourceIdentity: string,
+    message: string,
+  ) {
+    const completionIdentity = `${callbackKey}:${sourceIdentity}`;
+    if (
+      oauthCallbackKey !== callbackKey ||
+      eligibleOAuthSourceIdentity !== sourceIdentity ||
+      handledUnmatchedCallbackIdentity === completionIdentity
+    ) {
+      return;
+    }
+    handledUnmatchedCallbackIdentity = completionIdentity;
+    const owner = lifetime;
+    importNotice = message;
+    await tick();
+    if (
+      owner !== lifetime ||
+      oauthCallbackKey !== callbackKey ||
+      eligibleOAuthSourceIdentity !== sourceIdentity
+    ) {
+      if (handledUnmatchedCallbackIdentity === completionIdentity) {
+        handledUnmatchedCallbackIdentity = null;
+      }
+      return;
+    }
+    document.getElementById("source-status")?.focus();
+    consumeOAuthCallback(callbackKey, sourceIdentity);
+  }
+
+  function completeOAuthCallbackCheck(
+    sourceId: string,
+    matched: boolean,
+    callbackKey: string | null,
+    sourceIdentity: string,
+  ) {
+    if (
+      callbackKey === null ||
+      oauthCallbackKey !== callbackKey ||
+      eligibleOAuthSourceIdentity !== sourceIdentity ||
+      resource.loading ||
+      resource.error !== null ||
+      !eligibleOAuthSourceIds.includes(sourceId)
+    ) {
+      return;
+    }
+    if (matched) {
+      consumeOAuthCallback(callbackKey, sourceIdentity);
+      return;
+    }
+    const checkIdentity = `${callbackKey}:${sourceIdentity}`;
+    const currentCheckedIds =
+      oauthCallbackCheck?.identity === checkIdentity
+        ? oauthCallbackCheck.checkedSourceIds.filter((id) => eligibleOAuthSourceIds.includes(id))
+        : [];
+    const checkedSourceIds = [...new Set([...currentCheckedIds, sourceId])];
+    oauthCallbackCheck = { identity: checkIdentity, checkedSourceIds };
+    if (
+      eligibleOAuthSourceIds.length > 0 &&
+      eligibleOAuthSourceIds.every((id) => checkedSourceIds.includes(id))
+    ) {
+      const notice = oauthCallbackOutcomeNotice(callbackKey, false);
+      void showUnmatchedOAuthCallback(callbackKey, sourceIdentity, notice.message);
+    }
+  }
+
+  function clearSourceMutationError(sourceId: string) {
+    const { [sourceId]: _removed, ...remaining } = mutationErrors;
+    mutationErrors = remaining;
+  }
+
+  function stagedSourceMode(sourceId: string, current: ToolMode | null) {
+    return sourceId in sourceModeDrafts ? sourceModeDrafts[sourceId] : current;
+  }
+
+  function stageSourceMode(sourceId: string, mode: ToolMode | null) {
+    sourceModeDrafts = { ...sourceModeDrafts, [sourceId]: mode };
+    if (confirmingSourceMode === sourceId) confirmingSourceMode = null;
+  }
+
+  function applySourceMode(
+    sourceId: string,
+    current: ToolMode | null,
+    revision: number,
+    confirmed = false,
+  ) {
+    const mode = stagedSourceMode(sourceId, current);
+    if (mode === current) return;
+    if (!confirmed && requiresBroadConfirmation(mode)) {
+      confirmingSourceMode = sourceId;
+      void tick().then(() => document.getElementById(`cancel-source-mode-${sourceId}`)?.focus());
+      return;
+    }
+    void persistSourceMode(sourceId, mode, revision);
+  }
+
+  async function cancelSourceModeConfirmation(sourceId: string) {
+    confirmingSourceMode = null;
+    await tick();
+    document.getElementById(`apply-source-mode-${sourceId}`)?.focus();
+  }
+
+  function mutationIsCurrent(id: string, controller: AbortController) {
+    return mutationControllers.get(id) === controller && !controller.signal.aborted;
+  }
+
+  function finishMutation(id: string, controller: AbortController) {
+    if (mutationControllers.get(id) !== controller) return false;
+    mutationControllers.delete(id);
+    pending = pending.filter((candidate) => candidate !== id);
+    return !controller.signal.aborted;
+  }
+
+  function cancelMutation(id: string) {
+    mutationControllers.get(id)?.abort();
+    mutationControllers.delete(id);
+    pending = pending.filter((candidate) => candidate !== id);
+  }
+
+  function formatTime(timestamp: number | null) {
+    return timestamp === null
+      ? "Not refreshed yet"
+      : new Intl.DateTimeFormat(undefined, { dateStyle: "medium", timeStyle: "short" }).format(
+          timestamp * 1000,
+        );
+  }
+
+  function kindLabel(kind: "openapi" | "graphql" | "mcp_http" | "mcp_stdio") {
+    if (kind === "openapi") return "OpenAPI";
+    if (kind === "graphql") return "GraphQL";
+    if (kind === "mcp_http") return "MCP HTTP";
+    return "MCP stdio";
+  }
+</script>
+
+<svelte:window onbeforeunload={guardBeforeUnload} />
+
+<DashboardShell
+  title="Sources"
+  description="Connect MCP servers and OpenAPI services to one global tool catalog."
+  beforeSignOut={beforeSourceSignOut}
+  onSignOutFailed={sourceSignOutFailed}
+>
+  {#if navigationNotice !== null}
+    <div id="source-navigation-status" class="notice warning" role="status" tabindex="-1">
+      {navigationNotice}
+    </div>
+  {/if}
+  {#if sourceCreateState.phase !== "idle" && sourceCreateState.notice !== null}
+    <div class="notice warning" role="status">{sourceCreateState.notice}</div>
+  {/if}
+  {#if sourceCreateState.error !== null || (sourceCreateState.phase === "paused" && sourceCreateState.retry !== null)}
+    <div id="source-create-status" tabindex="-1">
+      {#if sourceCreateState.error !== null}<ErrorNotice error={sourceCreateState.error} />{/if}
+      {#if sourceCreateState.phase === "blocked"}
+        <button type="button" onclick={resumeSourceCreate}>
+          {sourceCreateState.retry === "dispatch" ? "Retry exact request" : "Check again"}
+        </button>
+      {:else if sourceCreateState.phase === "paused" && sourceCreateState.retry !== null}
+        <button type="button" onclick={resumeSourceCreate}>Resume source recovery</button>
+      {/if}
+    </div>
+  {/if}
+  {#if conflictNotice !== null}
+    <div id="source-conflict" class="notice warning" role="status" tabindex="-1">
+      {conflictNotice}
+    </div>
+  {/if}
+  {#if importNotice !== null}<div id="source-status" class="notice" role="status" tabindex="-1">
+      {importNotice}
+    </div>{/if}
+
+  <details class="surface import-panel" bind:open={connectSourceOpen}>
+    <summary onclick={() => (connectSourceOpenOwnedByUser = true)}>Connect a source</summary>
+    <fieldset class="mode-control source-type-picker" disabled={sourceCreateLocked}>
+      <legend>Source type</legend>
+      <label>
+        <input
+          type="radio"
+          name="source-type"
+          checked={sourceType === "openapi"}
+          onchange={() => switchSourceType("openapi")}
+        />
+        OpenAPI service
+      </label>
+      <label>
+        <input
+          type="radio"
+          name="source-type"
+          checked={sourceType === "graphql"}
+          onchange={() => switchSourceType("graphql")}
+        />
+        GraphQL API
+      </label>
+      <label>
+        <input
+          type="radio"
+          name="source-type"
+          checked={sourceType === "mcp_http"}
+          onchange={() => switchSourceType("mcp_http")}
+        />
+        MCP over HTTP
+      </label>
+      <label>
+        <input
+          type="radio"
+          name="source-type"
+          checked={sourceType === "mcp_stdio"}
+          onchange={() => switchSourceType("mcp_stdio")}
+        />
+        Trusted local MCP template
+      </label>
+      <p class="mode-impact">
+        OpenAPI compiles an API specification. GraphQL imports an introspected schema. MCP connects
+        using Streamable HTTP or a locally configured process template.
+      </p>
+    </fieldset>
+    {#if sourceType === "openapi"}
+      <form class="import-form" onsubmit={previewSource}>
+        <fieldset class="mode-control" disabled={sourceCreateLocked || createBusy}>
+          <legend>Specification location</legend>
+          <label
+            ><input type="radio" name="locator" value="url" bind:group={locatorType} />URL</label
+          >
+          <label
+            ><input type="radio" name="locator" value="inline" bind:group={locatorType} />Paste
+            document</label
+          >
+        </fieldset>
+        {#if locatorType === "url"}
+          <label
+            >OpenAPI URL<input
+              type="url"
+              required
+              disabled={sourceCreateLocked || createBusy}
+              bind:value={specUrl}
+              placeholder="https://api.example.com/openapi.json"
+            /></label
+          >
+        {:else}
+          <label
+            >OpenAPI JSON or YAML<textarea
+              required
+              disabled={sourceCreateLocked || createBusy}
+              rows="10"
+              bind:value={specContent}
+              placeholder="openapi: 3.1.0"></textarea></label
+          >
+        {/if}
+        <label class="checkbox-label private-network-choice">
+          <input
+            type="checkbox"
+            disabled={sourceCreateLocked || createBusy}
+            bind:checked={allowPrivateNetwork}
+            aria-describedby="private-network-help"
+          />
+          Allow private network addresses for this source
+        </label>
+        <p class="field-help" id="private-network-help">
+          Keep this off unless the specification or API intentionally runs on your local network.
+        </p>
+        <button type="submit" disabled={previewBusy || sourceCreateLocked}
+          >{previewBusy ? "Inspecting..." : "Preview tools"}</button
+        >
+        <button type="button" disabled={previewBusy || sourceCreateLocked} onclick={clearImportForm}
+          >Reset importer</button
+        >
+      </form>
+
+      {#if importError !== null}<div id="source-import-error" tabindex="-1">
+          <ErrorNotice error={importError} />
+        </div>{/if}
+      {#if preview !== null}
+        <form
+          class="preview-panel"
+          aria-live="polite"
+          onsubmit={(event) => {
+            event.preventDefault();
+            void createSource();
+          }}
+        >
+          <div>
+            <p class="eyebrow">Preview</p>
+            <h2>{preview.title}</h2>
+            <p>{preview.description ?? "No API description provided."}</p>
+          </div>
+          <strong>{preview.toolCount} tools found</strong>
+          {#if !previewCurrent}<p class="notice warning">
+              The specification changed. Preview it again before importing.
+            </p>{/if}
+          <div class="preview-tools">
+            {#each preview.tools.slice(0, 8) as tool, index (previewToolKey(tool.preferredName, index))}
+              <span
+                ><strong>{tool.displayName}</strong><small>{modeLabel(tool.intrinsicMode)}</small
+                ></span
+              >
+            {/each}
+            {#if preview.tools.length > 8}<span>+ {preview.tools.length - 8} more</span>{/if}
+          </div>
+          <div class="import-fields">
+            <label
+              >Source name<input
+                required
+                disabled={sourceCreateLocked || createBusy}
+                value={displayName}
+                oninput={(event) => {
+                  displayName = event.currentTarget.value;
+                  displayNameEdited = true;
+                }}
+              /></label
+            >
+            <label
+              >Slug (optional)<input
+                disabled={sourceCreateLocked || createBusy}
+                bind:value={preferredSlug}
+                placeholder="generated from name"
+              /></label
+            >
+            <label class="wide-field"
+              >Description (optional)<input
+                disabled={sourceCreateLocked || createBusy}
+                bind:value={sourceDescription}
+              /></label
+            >
+            {#if preview.securitySchemes.length > 0}
+              <fieldset class="credential-schemes wide-field">
+                <legend>Authentication schemes</legend>
+                <p class="field-help">
+                  Select every credential you want to configure. Tool requirements use OR between
+                  groups and AND within a group.
+                </p>
+                {#each preview.securitySchemes as scheme (scheme.name)}
+                  {@const row = importCredentialRows.find(
+                    (candidate) => candidate.name === scheme.name,
+                  )}
+                  <div class="credential-row">
+                    <label class="checkbox-label">
+                      <input
+                        type="checkbox"
+                        disabled={sourceCreateLocked || createBusy || row === undefined}
+                        checked={row?.enabled ?? false}
+                        onchange={(event) => {
+                          if (row !== undefined) row.enabled = event.currentTarget.checked;
+                        }}
+                      />
+                      <span
+                        ><strong>{scheme.name}</strong><small
+                          >{credentialTypeLabel(scheme.credentialType)}{scheme.placement
+                            ? ` · ${scheme.placement}`
+                            : ""}{scheme.supported ? "" : " · unsupported"}</small
+                        ></span
+                      >
+                    </label>
+                    {#if row?.enabled}
+                      {#if row.credentialType === "basic"}<label
+                          >Username<input
+                            required
+                            disabled={sourceCreateLocked || createBusy}
+                            bind:value={row.username}
+                            autocomplete="off"
+                          /></label
+                        >{/if}
+                      <label
+                        >{credentialTypeLabel(row.credentialType)}<input
+                          required
+                          type="password"
+                          disabled={sourceCreateLocked || createBusy}
+                          bind:value={row.value}
+                          autocomplete="off"
+                        /></label
+                      >
+                    {/if}
+                    {#if row?.enabled && row.credentialType === "oauth_access_token"}
+                      <p class="field-help wide-field">
+                        Advanced: supply an access token manually. Managed OAuth becomes available
+                        after import when this security scheme supports it.
+                      </p>
+                    {/if}
+                  </div>
+                {/each}
+              </fieldset>
+            {/if}
+          </div>
+          <button
+            type="submit"
+            class="primary"
+            disabled={!previewCurrent ||
+              previewBusy ||
+              sourceCreateLocked ||
+              displayName.trim() === "" ||
+              buildCredentialMap(importCredentialRows) === null}
+          >
+            {createBusy ? "Importing..." : "Import source"}
+          </button>
+          {#if authenticatedPreviewWithoutCredentials()}
+            <p class="notice warning">
+              This specification declares authentication, but no credentials are selected. Protected
+              tools will fail until credentials are configured.
+            </p>
+          {/if}
+          <p class="field-help">Credentials are encrypted locally and are never shown again.</p>
+        </form>
+      {/if}
+    {:else if sourceType === "graphql"}
+      {#key sourceFormGeneration}
+        <GraphqlSourceForm create={connectGraphqlSource} disabled={sourceCreateLocked} />
+      {/key}
+    {:else if sourceType === "mcp_http"}
+      {#key sourceFormGeneration}
+        <McpHttpSourceForm create={connectMcpHttpSource} disabled={sourceCreateLocked} />
+      {/key}
+    {:else}
+      {#key sourceFormGeneration}
+        <McpStdioSourceForm create={connectMcpStdioSource} disabled={sourceCreateLocked} />
+      {/key}
+    {/if}
+  </details>
+
+  {#if resource.stale && resource.error !== null}
+    <div class="stale-notice" role="status">
+      Showing the last loaded sources while Executor reconnects.
+      <ErrorNotice error={resource.error} />
+    </div>
+  {:else if resource.error !== null}
+    <section class="surface table-unavailable">
+      <ErrorNotice error={resource.error} />
+      <button type="button" onclick={() => (refreshKey += 1)}>Try again</button>
+    </section>
+  {/if}
+
+  {#if resource.data === null && resource.loading}
+    <section class="surface loading-panel" aria-live="polite">Loading sources...</section>
+  {:else if resource.data !== null && resource.data.sources.length === 0}
+    <section class="surface empty-state">
+      <span class="number-chip">01</span>
+      <h2>No sources connected</h2>
+      <p>
+        This instance has no source data yet. Use the source connector above to add an OpenAPI,
+        GraphQL, or MCP source.
+      </p>
+    </section>
+  {:else if resource.data !== null}
+    <div class="source-grid" aria-busy={resource.loading}>
+      {#each resource.data.sources as source (source.id)}
+        <article class="surface source-card" aria-labelledby={`source-heading-${source.id}`}>
+          <header class="source-card-heading">
+            <div>
+              <p class="eyebrow">{kindLabel(source.kind)} · {source.slug}</p>
+              <h2 id={`source-heading-${source.id}`}>{source.displayName}</h2>
+              {#if source.description !== null}<p>{source.description}</p>{/if}
+            </div>
+            <span
+              class:healthy={source.healthStatus === "healthy"}
+              class:error={source.healthStatus === "error"}
+              class="health-pill"
+            >
+              {source.healthStatus}
+            </span>
+          </header>
+
+          <dl class="source-stats">
+            <div>
+              <dt>Active tools</dt>
+              <dd>{source.toolCount}</dd>
+            </div>
+            <div>
+              <dt>Removed tools</dt>
+              <dd>{source.tombstonedToolCount}</dd>
+            </div>
+            <div>
+              <dt>Last refresh</dt>
+              <dd>{formatTime(source.lastRefreshedAt)}</dd>
+            </div>
+          </dl>
+
+          {#if source.healthErrorCode !== null}
+            <p class="source-error">Refresh error: <code>{source.healthErrorCode}</code></p>
+          {/if}
+
+          {#if source.kind === "graphql"}
+            {@const details = safeGraphqlSourceDetails(source.configuration)}
+            <dl class="detail-list">
+              {#if details.endpoint !== null}
+                <div>
+                  <dt>Endpoint</dt>
+                  <dd>{details.endpoint}</dd>
+                </div>
+              {/if}
+              <div>
+                <dt>Private network</dt>
+                <dd>{details.allowPrivateNetwork ? "Allowed" : "Blocked"}</dd>
+              </div>
+              <div>
+                <dt>Schema discovery</dt>
+                <dd>GraphQL introspection</dd>
+              </div>
+            </dl>
+          {/if}
+
+          {#if source.kind === "mcp_http" || source.kind === "mcp_stdio"}
+            {@const details = safeMcpSourceDetails(source.kind, source.configuration)}
+            <dl class="detail-list">
+              <div>
+                <dt>Transport</dt>
+                <dd>{source.kind === "mcp_http" ? "Streamable HTTP" : "Trusted local template"}</dd>
+              </div>
+              {#if details.endpointLabel !== null}
+                <div>
+                  <dt>Endpoint</dt>
+                  <dd>{details.endpointLabel}</dd>
+                </div>
+              {/if}
+              {#if details.templateName !== null}
+                <div>
+                  <dt>Template</dt>
+                  <dd>{details.templateName}</dd>
+                </div>
+              {/if}
+              {#if source.kind === "mcp_http"}
+                <div>
+                  <dt>Private network</dt>
+                  <dd>{details.allowPrivateNetwork ? "Allowed" : "Blocked"}</dd>
+                </div>
+                <div>
+                  <dt>Upstream sessions</dt>
+                  <dd>Memory only</dd>
+                </div>
+              {/if}
+              {#if details.negotiatedProtocolVersion !== null}
+                <div>
+                  <dt>MCP version</dt>
+                  <dd>{details.negotiatedProtocolVersion}</dd>
+                </div>
+              {/if}
+            </dl>
+          {/if}
+
+          <fieldset
+            class="mode-control source-mode-control"
+            disabled={sourceOperationPending(source.id)}
+          >
+            <legend>Default tool behavior</legend>
+            <label>
+              <input
+                type="radio"
+                name={`source-${source.id}`}
+                checked={stagedSourceMode(source.id, source.modeOverride) === null}
+                onchange={() => stageSourceMode(source.id, null)}
+              />
+              Tool defaults
+            </label>
+            {#each toolModes as mode}
+              <label>
+                <input
+                  type="radio"
+                  name={`source-${source.id}`}
+                  checked={stagedSourceMode(source.id, source.modeOverride) === mode}
+                  onchange={() => stageSourceMode(source.id, mode)}
+                />
+                {modeLabel(mode)}
+              </label>
+            {/each}
+            <p class="mode-impact">{sourceModeImpact(source.toolCount)}</p>
+            <button
+              id={`apply-source-mode-${source.id}`}
+              type="button"
+              disabled={stagedSourceMode(source.id, source.modeOverride) === source.modeOverride}
+              onclick={() => applySourceMode(source.id, source.modeOverride, source.revision)}
+            >
+              {pending.includes(sourceMutationId("mode", source.id))
+                ? "Applying..."
+                : "Apply source default"}
+            </button>
+          </fieldset>
+
+          {#if confirmingSourceMode === source.id}
+            <div
+              class="inline-confirm"
+              role="group"
+              aria-label={`Confirm default for ${source.displayName}`}
+            >
+              <strong
+                >Confirm {modeLabel(stagedSourceMode(source.id, source.modeOverride) ?? "ask")} as the
+                source default?</strong
+              >
+              <span>{sourceModeImpact(source.toolCount)}</span>
+              <button
+                id={`cancel-source-mode-${source.id}`}
+                type="button"
+                disabled={pending.includes(sourceMutationId("mode", source.id))}
+                onkeydown={(event) => {
+                  if (event.key === "Escape") void cancelSourceModeConfirmation(source.id);
+                }}
+                onclick={() => cancelSourceModeConfirmation(source.id)}>Cancel</button
+              >
+              <button
+                type="button"
+                class:primary={stagedSourceMode(source.id, source.modeOverride) === "enabled"}
+                class:danger-button={stagedSourceMode(source.id, source.modeOverride) ===
+                  "disabled"}
+                disabled={sourceOperationPending(source.id)}
+                onkeydown={(event) => {
+                  if (event.key === "Escape") void cancelSourceModeConfirmation(source.id);
+                }}
+                onclick={() =>
+                  applySourceMode(source.id, source.modeOverride, source.revision, true)}
+                >Confirm broad change</button
+              >
+            </div>
+          {/if}
+
+          {#if mutationErrors[source.id] !== undefined}
+            <ErrorNotice error={mutationErrors[source.id]} />
+          {/if}
+          {#if credentialFailure?.sourceId === source.id}
+            <ErrorNotice error={credentialFailure.error} />
+          {/if}
+
+          <footer class="source-actions">
+            <a class="button-link" href={`/tools?source=${encodeURIComponent(source.id)}`}>
+              View tools
+            </a>
+            {#if source.kind === "openapi" || source.kind === "graphql" || source.kind === "mcp_http" || source.kind === "mcp_stdio"}
+              <button
+                type="button"
+                disabled={sourceOperationPending(source.id) || credentialBusySource === source.id}
+                onclick={() => refreshSource(source.id)}
+              >
+                {pending.includes(sourceMutationId("refresh", source.id))
+                  ? "Refreshing..."
+                  : source.kind === "openapi"
+                    ? "Refresh"
+                    : source.kind === "graphql"
+                      ? "Refresh schema and tools"
+                      : "Reconnect and refresh tools"}
+              </button>
+            {/if}
+            {#if source.kind === "openapi"}
+              <button
+                id={`manage-credentials-${source.id}`}
+                type="button"
+                disabled={credentialBusySource !== null || sourceOperationPending(source.id)}
+                aria-expanded={credentialEditorSource === source.id}
+                aria-controls={`credential-editor-${source.id}`}
+                onclick={() => openCredentialEditor(source.id)}
+              >
+                {credentialBusySource === source.id
+                  ? "Loading credentials..."
+                  : credentialEditorSource === source.id
+                    ? "Close credentials"
+                    : "Manage credentials"}
+              </button>
+            {/if}
+            {#if source.kind === "mcp_http" || source.kind === "mcp_stdio"}
+              <McpCredentialEditor
+                {source}
+                disabled={sourceMutationPending(source.id) ||
+                  oauthBusySourceIds.includes(source.id) ||
+                  graphqlCredentialBusySourceIds.includes(source.id)}
+                onbusychange={(busy) => setMcpCredentialBusy(source.id, busy)}
+                onmutationchange={(busy) => setMcpCredentialMutation(source.id, busy)}
+              />
+            {/if}
+            {#if source.kind === "graphql"}
+              <GraphqlCredentialEditor
+                {source}
+                load={loadGraphqlCredentials}
+                save={saveGraphqlCredentials}
+                disabled={sourceMutationPending(source.id) ||
+                  oauthBusySourceIds.includes(source.id) ||
+                  mcpCredentialBusySourceIds.includes(source.id)}
+                onbusychange={(busy) => setGraphqlCredentialBusy(source.id, busy)}
+                onmutationchange={(busy) => setGraphqlCredentialMutation(source.id, busy)}
+              />
+            {/if}
+            {#if source.kind === "openapi" || source.kind === "graphql" || source.kind === "mcp_http"}
+              {@const oauthCheckContext = {
+                callbackKey: oauthCallbackKey,
+                sourceIdentity: eligibleOAuthSourceIdentity,
+              }}
+              {#key `${source.id}:${source.revision}:${source.catalogRevision}`}
+                <OAuthSourceConnections
+                  {source}
+                  sourceIdentity={source.id}
+                  operations={oauthOperations}
+                  callbackRefreshKey={oauthCheckContext.callbackKey}
+                  disabled={sourceMutationPending(source.id) ||
+                    graphqlCredentialBusySourceIds.includes(source.id) ||
+                    mcpCredentialBusySourceIds.includes(source.id) ||
+                    credentialBusySource === source.id}
+                  onbusychange={(busy) => setOAuthBusy(source.id, busy)}
+                  onmutationchange={(busy) => setOAuthMutation(source.id, busy)}
+                  oncallbackchecked={(matched) =>
+                    completeOAuthCallbackCheck(
+                      source.id,
+                      matched,
+                      oauthCheckContext.callbackKey,
+                      oauthCheckContext.sourceIdentity,
+                    )}
+                />
+              {/key}
+            {/if}
+            {#if confirmingDelete === source.id}
+              <div class="inline-confirm" role="group" aria-label={`Delete ${source.displayName}`}>
+                <strong>Delete source, compiled tools, and encrypted credentials?</strong>
+                <span>Request-log metadata is retained without secret values.</span>
+                <button
+                  id={`cancel-delete-${source.id}`}
+                  type="button"
+                  disabled={pending.includes(sourceMutationId("delete", source.id))}
+                  onkeydown={(event) => {
+                    if (event.key === "Escape") void cancelDelete(source.id);
+                  }}
+                  onclick={() => cancelDelete(source.id)}>Cancel</button
+                >
+                <button
+                  type="button"
+                  class="danger-button"
+                  disabled={sourceOperationPending(source.id) || credentialBusySource === source.id}
+                  onkeydown={(event) => {
+                    if (event.key === "Escape") void cancelDelete(source.id);
+                  }}
+                  onclick={() => removeSource(source.id, source.displayName)}
+                >
+                  {pending.includes(sourceMutationId("delete", source.id))
+                    ? "Deleting..."
+                    : "Delete permanently"}
+                </button>
+              </div>
+            {:else}
+              <button
+                type="button"
+                id={`delete-source-${source.id}`}
+                class="danger-link"
+                disabled={sourceOperationPending(source.id) || credentialBusySource === source.id}
+                onclick={() => beginDelete(source.id)}>Delete</button
+              >
+            {/if}
+          </footer>
+
+          {#if credentialEditorSource === source.id}
+            <form
+              id={`credential-editor-${source.id}`}
+              class="credential-editor"
+              tabindex="-1"
+              aria-label={`Credentials for ${source.displayName}`}
+              aria-live="polite"
+              onsubmit={(event) => {
+                event.preventDefault();
+                void saveCredentials(source.id);
+              }}
+            >
+              <div>
+                <h3>Replace credentials</h3>
+                <p>Existing values are hidden. Re-enter every credential you want to keep.</p>
+              </div>
+              {#each credentialRows as row (row.key)}
+                <fieldset class="credential-row" disabled={credentialBusySource === source.id}>
+                  <legend>Credential</legend>
+                  <label
+                    >Security scheme name<input
+                      id={`credential-name-${row.key}`}
+                      required
+                      bind:value={row.name}
+                      aria-invalid={duplicateCredentialNames(credentialRows).includes(
+                        row.name.trim(),
+                      )}
+                      aria-describedby={duplicateCredentialNames(credentialRows).includes(
+                        row.name.trim(),
+                      )
+                        ? `credential-errors-${source.id}`
+                        : undefined}
+                      autocomplete="off"
+                    /></label
+                  >
+                  <label
+                    >Type<select bind:value={row.credentialType}
+                      ><option value="api_key">API key</option><option value="bearer"
+                        >Bearer token</option
+                      ><option value="basic">Basic auth</option><option value="oauth_access_token"
+                        >OAuth access token (manual, advanced)</option
+                      ></select
+                    ></label
+                  >
+                  {#if row.credentialType === "basic"}<label
+                      >Username<input
+                        required
+                        bind:value={row.username}
+                        autocomplete="off"
+                      /></label
+                    >{/if}
+                  <label
+                    >{credentialTypeLabel(row.credentialType)}<input
+                      required
+                      type="password"
+                      bind:value={row.value}
+                      autocomplete="off"
+                    /></label
+                  >
+                  {#if row.credentialType === "oauth_access_token"}
+                    <p class="field-help wide-field">
+                      Advanced: supply an access token manually. Managed OAuth is available above
+                      when this security scheme supports it.
+                    </p>
+                  {/if}
+                  <button
+                    type="button"
+                    class="danger-link"
+                    onclick={() => removeCredentialRow(row.key, source.id)}>Remove row</button
+                  >
+                </fieldset>
+              {/each}
+              {#if credentialRows.length === 0}<p class="field-help">
+                  No credentials are currently configured.
+                </p>{/if}
+              <div class="button-row">
+                <button
+                  id={`add-credential-${source.id}`}
+                  type="button"
+                  disabled={credentialBusySource !== null}
+                  onclick={addCredentialRow}>Add credential</button
+                >
+                <button
+                  type="submit"
+                  disabled={credentialRows.length === 0 ||
+                    credentialBusySource !== null ||
+                    currentDuplicateCredentialNames.length > 0}
+                  aria-describedby={currentDuplicateCredentialNames.length > 0
+                    ? `credential-errors-${source.id}`
+                    : undefined}
+                  >{credentialMutation?.sourceId === source.id && credentialMutation.kind === "save"
+                    ? "Saving..."
+                    : "Save replacement"}</button
+                >
+                {#if currentDuplicateCredentialNames.length > 0}<p
+                    id={`credential-errors-${source.id}`}
+                    class="field-error"
+                  >
+                    Each security scheme name must be unique. Duplicates: {currentDuplicateCredentialNames.join(
+                      ", ",
+                    )}.
+                  </p>{/if}
+                {#if confirmingCredentialClear === source.id}
+                  <button
+                    id={`cancel-clear-credentials-${source.id}`}
+                    type="button"
+                    disabled={credentialBusySource !== null}
+                    onkeydown={(event) => {
+                      if (event.key === "Escape") void cancelCredentialClear(source.id);
+                    }}
+                    onclick={() => cancelCredentialClear(source.id)}>Cancel clear</button
+                  >
+                  <button
+                    type="button"
+                    class="danger-button"
+                    disabled={credentialBusySource !== null}
+                    onkeydown={(event) => {
+                      if (event.key === "Escape") void cancelCredentialClear(source.id);
+                    }}
+                    onclick={() => clearCredentials(source.id)}>Confirm clear all</button
+                  >
+                {:else}
+                  <button
+                    id={`clear-credentials-${source.id}`}
+                    type="button"
+                    class="danger-link"
+                    disabled={credentialBusySource !== null}
+                    onclick={() => beginCredentialClear(source.id)}>Clear all credentials</button
+                  >
+                {/if}
+              </div>
+            </form>
+          {/if}
+        </article>
+      {/each}
+    </div>
+  {/if}
+</DashboardShell>
diff --git a/web/src/routes/sources/sources-page.test-harness.svelte b/web/src/routes/sources/sources-page.test-harness.svelte
new file mode 100644
index 000000000..dc1e4a47e
--- /dev/null
+++ b/web/src/routes/sources/sources-page.test-harness.svelte
@@ -0,0 +1,39 @@
+<script lang="ts">
+  import { createAuthState, provideAuthState } from "$lib/auth.svelte";
+  import type { SourceCreateEnvironment } from "$lib/source-create-lifecycle";
+  import SourcesPage from "./+page.svelte";
+
+  let {
+    initialOAuthUrl = null,
+    initialOAuthState = {},
+    onOAuthReplace,
+    sourceCreateEnvironment,
+  }: {
+    initialOAuthUrl?: string | null;
+    initialOAuthState?: App.PageState;
+    onOAuthReplace?: (url: URL, state: App.PageState) => void;
+    sourceCreateEnvironment?: SourceCreateEnvironment;
+  } = $props();
+
+  provideAuthState(createAuthState());
+
+  let replacedOAuthUrl = $state<URL | null>(null);
+  let replacedOAuthState = $state<App.PageState | null>(null);
+  let oauthUrl = $derived(
+    replacedOAuthUrl ?? (initialOAuthUrl === null ? null : new URL(initialOAuthUrl)),
+  );
+  let oauthState = $derived(replacedOAuthState ?? initialOAuthState);
+  let oauthNavigation = $derived(
+    oauthUrl === null
+      ? undefined
+      : { url: oauthUrl, state: oauthState, replaceState: replaceOAuthState },
+  );
+
+  function replaceOAuthState(url: URL, state: App.PageState) {
+    replacedOAuthUrl = new URL(url);
+    replacedOAuthState = state;
+    onOAuthReplace?.(url, state);
+  }
+</script>
+
+<SourcesPage {oauthNavigation} {sourceCreateEnvironment} />
diff --git a/web/src/routes/sources/sources-page.test.ts b/web/src/routes/sources/sources-page.test.ts
new file mode 100644
index 000000000..1cf63da07
--- /dev/null
+++ b/web/src/routes/sources/sources-page.test.ts
@@ -0,0 +1,1949 @@
+import { afterEach, describe, expect, it, vi } from "@effect/vitest";
+import { cleanup, fireEvent, render, screen, waitFor, within } from "@testing-library/svelte";
+import { Effect, Schema } from "effect";
+import {
+  SOURCE_CREATE_STORAGE_KEY,
+  type SourceCreateEnvironment,
+} from "$lib/source-create-lifecycle";
+import SourcesPageHarness from "./sources-page.test-harness.svelte";
+
+const decodeJson = Schema.decodeUnknownSync(Schema.fromJsonString(Schema.Unknown));
+
+function sourceFixture(id = "graphql-source", displayName = "Product API") {
+  return {
+    id,
+    kind: "graphql",
+    slug: id,
+    displayName,
+    description: null,
+    configuration: { endpoint: "https://api.example.test/", allowPrivateNetwork: false },
+    modeOverride: null,
+    healthStatus: "healthy",
+    healthErrorCode: null,
+    revision: 1,
+    catalogRevision: 1,
+    createdAt: 100,
+    updatedAt: 100,
+    lastRefreshedAt: 100,
+    toolCount: 4,
+    tombstonedToolCount: 0,
+  };
+}
+
+function openApiSourceFixture(id = "openapi-source", displayName = "Weather API") {
+  return {
+    ...sourceFixture(id, displayName),
+    kind: "openapi",
+    configuration: {},
+  };
+}
+
+function mcpHttpSourceFixture(id = "mcp-http-source", displayName = "Issue tracker") {
+  return {
+    ...sourceFixture(id, displayName),
+    kind: "mcp_http",
+    configuration: { endpoint: "https://mcp.example.test", allowPrivateNetwork: false },
+  };
+}
+
+function mcpStdioSourceFixture(id = "mcp-stdio-source", displayName = "Local tools") {
+  return {
+    ...sourceFixture(id, displayName),
+    kind: "mcp_stdio",
+    configuration: { templateName: "local" },
+  };
+}
+
+function deferred<Value>() {
+  let resolve = (_value: Value) => {};
+  const promise = new Promise<Value>((complete) => {
+    resolve = complete;
+  });
+  return { promise, resolve };
+}
+
+function emptyOAuthConnections() {
+  return Response.json({ connections: [], availableCredentials: [] });
+}
+
+function noStoreJson(value: unknown, init: ResponseInit = {}) {
+  const headers = new Headers(init.headers);
+  headers.set("cache-control", "no-store");
+  return Response.json(value, { ...init, headers });
+}
+
+function requestIdempotencyKey(init: RequestInit | undefined) {
+  return new Headers(init?.headers).get("idempotency-key");
+}
+
+function fixedSourceCreateEnvironment(
+  options: { readonly wait?: SourceCreateEnvironment["wait"] } = {},
+): SourceCreateEnvironment {
+  return {
+    getStorage: () => window.sessionStorage,
+    fillRandom: (bytes) => bytes.fill(0x7c),
+    wait: options.wait ?? (() => Promise.resolve(true)),
+  };
+}
+
+function oauthConnectionFixture(id: string) {
+  return {
+    id,
+    credentialKey: "default",
+    revision: 1,
+    status: "connected",
+    issuer: "https://identity.example.test/",
+    clientId: "executor-client",
+    clientAuthMethod: "none",
+    callbackUrl: `https://executor.example.test/api/v1/oauth/callback/${id}`,
+    requestedScopes: [],
+    grantedScopes: [],
+    hasClientSecret: false,
+    hasRefreshToken: true,
+    accessExpiresAt: null,
+    authorizedAt: 100,
+    lastRefreshedAt: 100,
+    errorCode: null,
+    managedOAuthEligible: true,
+  };
+}
+
+function expectPreservedOAuthCleanup(url: URL | null) {
+  expect(url).not.toBeNull();
+  expect(url?.pathname).toBe("/sources");
+  expect(url?.searchParams.get("keep")).toBe("present");
+  expect(url?.searchParams.has("oauth")).toBe(false);
+  expect(url?.searchParams.has("result")).toBe(false);
+  expect(url?.hash).toBe("#details");
+}
+
+async function expectPendingWriteFence(logoutCalls: () => number) {
+  const unload = new Event("beforeunload", { cancelable: true });
+  window.dispatchEvent(unload);
+  expect(unload.defaultPrevented).toBe(true);
+
+  await fireEvent.click(screen.getByRole("button", { name: "Sign out" }));
+  expect(
+    await screen.findByText(/source or credential change is still being saved/i),
+  ).toBeDefined();
+  await waitFor(() =>
+    expect(document.activeElement).toBe(document.getElementById("source-navigation-status")),
+  );
+  expect(logoutCalls()).toBe(0);
+}
+
+afterEach(() => {
+  cleanup();
+  window.sessionStorage.clear();
+  vi.unstubAllGlobals();
+});
+
+describe("Sources page coordination", () => {
+  it("keeps a user-opened connector visible while switching every source type", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input) => {
+        const path = String(input);
+        if (path === "/api/v1/sources") {
+          return Promise.resolve(Response.json({ sources: [sourceFixture()], catalogRevision: 1 }));
+        }
+        if (path === "/api/v1/sources/graphql-source/oauth") {
+          return Promise.resolve(emptyOAuthConnections());
+        }
+        if (path === "/api/v1/mcp/stdio/templates") {
+          return Promise.resolve(
+            Response.json({ templates: [{ name: "local", secretFields: [] }] }),
+          );
+        }
+        return Promise.resolve(Response.json({}, { status: 500 }));
+      }),
+    );
+    render(SourcesPageHarness);
+
+    await screen.findByRole("article", { name: /^Product API$/ });
+    const summary = screen.getByText("Connect a source", { exact: true });
+    const panel = summary.closest<HTMLDetailsElement>("details");
+    expect(panel?.open).toBe(false);
+    await fireEvent.click(summary);
+    expect(panel?.open).toBe(true);
+
+    for (const sourceType of [
+      "GraphQL API",
+      "MCP over HTTP",
+      "Trusted local MCP template",
+      "OpenAPI service",
+    ]) {
+      await fireEvent.click(screen.getByLabelText(sourceType));
+      await waitFor(() => expect(panel?.open).toBe(true));
+    }
+  });
+
+  it("does not close a user-opened connector when the first source list arrives late", async () => {
+    const sourceList = deferred<Response>();
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input) => {
+        const path = String(input);
+        if (path === "/api/v1/sources") return sourceList.promise;
+        if (path === "/api/v1/sources/graphql-source/oauth") {
+          return Promise.resolve(emptyOAuthConnections());
+        }
+        return Promise.resolve(Response.json({}, { status: 500 }));
+      }),
+    );
+    render(SourcesPageHarness);
+
+    const summary = screen.getByText("Connect a source", { exact: true });
+    const panel = summary.closest<HTMLDetailsElement>("details");
+    await fireEvent.click(summary);
+    expect(panel?.open).toBe(true);
+
+    sourceList.resolve(Response.json({ sources: [sourceFixture()], catalogRevision: 1 }));
+    await screen.findByRole("article", { name: /^Product API$/ });
+    expect(panel?.open).toBe(true);
+  });
+
+  it("guards dispatch and retries the exact OpenAPI payload with one retained key", async () => {
+    const firstCreation = deferred<Response>();
+    let listCalls = 0;
+    const creates: Array<{ key: string | null; body: string }> = [];
+    const statusRequest = {
+      value: null as null | {
+        method: string | undefined;
+        body: BodyInit | null | undefined;
+        cache: RequestCache | undefined;
+        key: string | null;
+      },
+    };
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input, init) => {
+        const path = String(input);
+        if (path === "/api/v1/sources/openapi/preview" && init?.method === "POST") {
+          return Promise.resolve(
+            Response.json({
+              title: "Weather API",
+              description: null,
+              toolCount: 1,
+              tools: [
+                {
+                  preferredName: "forecast",
+                  displayName: "Forecast",
+                  description: null,
+                  intrinsicMode: "enabled",
+                  security: [["bearerAuth"]],
+                },
+              ],
+              securitySchemes: [
+                {
+                  name: "bearerAuth",
+                  credentialType: "bearer",
+                  placement: "header",
+                  supported: true,
+                  oauthFlows: null,
+                },
+              ],
+            }),
+          );
+        }
+        if (path === "/api/v1/sources/idempotency") {
+          statusRequest.value = {
+            method: init?.method,
+            body: init?.body,
+            cache: init?.cache,
+            key: requestIdempotencyKey(init),
+          };
+          return Promise.resolve(noStoreJson({ status: "missing" }));
+        }
+        if (path === "/api/v1/sources" && init?.method === "POST") {
+          creates.push({
+            key: requestIdempotencyKey(init),
+            body: String(init?.body),
+          });
+          return creates.length === 1
+            ? firstCreation.promise
+            : creates.length === 2
+              ? Promise.resolve(new Response("gateway timeout", { status: 504 }))
+              : Promise.resolve(
+                  noStoreJson(openApiSourceFixture(), {
+                    status: 201,
+                  }),
+                );
+        }
+        if (path === "/api/v1/sources") {
+          listCalls += 1;
+          return Promise.resolve(
+            Response.json({
+              sources: listCalls === 1 ? [] : [openApiSourceFixture()],
+              catalogRevision: listCalls,
+            }),
+          );
+        }
+        if (path === "/api/v1/sources/openapi-source/oauth") {
+          return Promise.resolve(emptyOAuthConnections());
+        }
+        return Promise.resolve(
+          Response.json(
+            {
+              error: {
+                code: "unexpected_test_request",
+                message: `Unexpected request: ${path}`,
+                requestId: "test-request",
+              },
+            },
+            { status: 500 },
+          ),
+        );
+      }),
+    );
+    render(SourcesPageHarness, {
+      sourceCreateEnvironment: fixedSourceCreateEnvironment(),
+    });
+
+    await screen.findByText("No sources connected");
+    await fireEvent.input(screen.getByLabelText("OpenAPI URL"), {
+      target: { value: "https://api.example.test/openapi.json" },
+    });
+    await fireEvent.click(screen.getByRole("button", { name: "Preview tools" }));
+    await screen.findByRole("heading", { name: "Weather API" });
+    await fireEvent.click(screen.getByRole("checkbox", { name: /bearerAuth/ }));
+    await fireEvent.input(screen.getByLabelText("Bearer token"), {
+      target: { value: "never-store-this-secret" },
+    });
+    await fireEvent.click(screen.getByRole("button", { name: "Import source" }));
+
+    const sourceTypePicker = screen.getByRole<HTMLFieldSetElement>("group", {
+      name: "Source type",
+    });
+    const resetImporter = screen.getByRole<HTMLButtonElement>("button", {
+      name: "Reset importer",
+    });
+    await waitFor(() => expect(sourceTypePicker.disabled).toBe(true));
+    expect(resetImporter.disabled).toBe(true);
+    await fireEvent.click(screen.getByRole("button", { name: "Sign out" }));
+    expect(await screen.findByText(/source connection is still being submitted/i)).toBeDefined();
+    expect(document.activeElement).toBe(document.getElementById("source-navigation-status"));
+    const unload = new Event("beforeunload", { cancelable: true });
+    window.dispatchEvent(unload);
+    expect(unload.defaultPrevented).toBe(true);
+    const storedKey = window.sessionStorage.getItem(SOURCE_CREATE_STORAGE_KEY);
+    expect(storedKey).toMatch(/^[0-9a-f]{32}$/);
+    expect(storedKey).toBe(creates[0]?.key);
+    expect(JSON.stringify([...Object.entries(window.sessionStorage)])).not.toContain(
+      "never-store-this-secret",
+    );
+    await fireEvent.click(screen.getByLabelText("GraphQL API"));
+    await fireEvent.click(resetImporter);
+    expect(screen.queryByRole("group", { name: "GraphQL API" })).toBeNull();
+
+    firstCreation.resolve(new Response("gateway timeout", { status: 504 }));
+    await waitFor(() => expect(creates).toHaveLength(2));
+    const retryExact = await screen.findByRole("button", { name: "Retry exact request" });
+    expect(window.sessionStorage.getItem(SOURCE_CREATE_STORAGE_KEY)).toBe(storedKey);
+    await fireEvent.click(retryExact);
+    await waitFor(() => expect(creates).toHaveLength(3));
+    await waitFor(() => expect(listCalls).toBe(2));
+    await waitFor(() =>
+      expect(screen.getAllByRole("heading", { name: "Weather API" })).toHaveLength(1),
+    );
+    expect(creates[1]?.key).toBe(creates[0]?.key);
+    expect(creates[1]?.body).toBe(creates[0]?.body);
+    expect(creates[2]?.key).toBe(creates[0]?.key);
+    expect(creates[2]?.body).toBe(creates[0]?.body);
+    expect(creates[0]?.body).toContain("never-store-this-secret");
+    expect(statusRequest.value).toEqual({
+      method: "GET",
+      body: undefined,
+      cache: "no-store",
+      key: creates[0]?.key,
+    });
+    await waitFor(() =>
+      expect(window.sessionStorage.getItem(SOURCE_CREATE_STORAGE_KEY)).toBeNull(),
+    );
+    await waitFor(() => expect(sourceTypePicker.disabled).toBe(false));
+  });
+
+  it("allows sign-out and unload during recovery polling while retaining the key", async () => {
+    const key = "1".repeat(32);
+    window.sessionStorage.setItem(SOURCE_CREATE_STORAGE_KEY, key);
+    const polling = deferred<boolean>();
+    const enteredPolling = deferred<void>();
+    const poll = { signal: null as AbortSignal | null };
+    const statusKeys: Array<string | null> = [];
+    let logoutCalls = 0;
+    let sourceCreateCalls = 0;
+    let sealCalls = 0;
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input, init) => {
+        const path = String(input);
+        if (path === "/api/v1/sources/idempotency") {
+          statusKeys.push(requestIdempotencyKey(init));
+          return Promise.resolve(noStoreJson({ status: "in_progress" }));
+        }
+        if (path === "/api/v1/sources/idempotency/seal") {
+          sealCalls += 1;
+          return Promise.resolve(noStoreJson({ status: "abandoned" }));
+        }
+        if (path === "/api/v1/sources" && init?.method === "POST") {
+          sourceCreateCalls += 1;
+          return Promise.resolve(noStoreJson(sourceFixture(), { status: 201 }));
+        }
+        if (path === "/api/v1/sources") {
+          return Promise.resolve(Response.json({ sources: [], catalogRevision: 1 }));
+        }
+        if (path === "/api/v1/session" && init?.method === "DELETE") {
+          logoutCalls += 1;
+          return Promise.resolve(
+            Response.json(
+              {
+                error: {
+                  code: "logout_unavailable",
+                  message: "Logout is unavailable in this test.",
+                  requestId: "logout-test",
+                },
+              },
+              { status: 503 },
+            ),
+          );
+        }
+        return Promise.resolve(Response.json({}, { status: 500 }));
+      }),
+    );
+    const mounted = render(SourcesPageHarness, {
+      sourceCreateEnvironment: fixedSourceCreateEnvironment({
+        wait: (_milliseconds, signal) => {
+          poll.signal = signal;
+          enteredPolling.resolve();
+          return polling.promise;
+        },
+      }),
+    });
+
+    await enteredPolling.promise;
+    expect(statusKeys).toEqual([key]);
+    expect(screen.getByText(/still finishing this source connection/i)).toBeDefined();
+    expect(screen.getByRole<HTMLFieldSetElement>("group", { name: "Source type" }).disabled).toBe(
+      true,
+    );
+    const unload = new Event("beforeunload", { cancelable: true });
+    window.dispatchEvent(unload);
+    expect(unload.defaultPrevented).toBe(false);
+    await fireEvent.click(screen.getByRole("button", { name: "Sign out" }));
+    await waitFor(() => expect(logoutCalls).toBe(1));
+    expect(screen.queryByText(/source connection is still being submitted/i)).toBeNull();
+
+    mounted.unmount();
+    expect(poll.signal?.aborted).toBe(true);
+    expect(window.sessionStorage.getItem(SOURCE_CREATE_STORAGE_KEY)).toBe(key);
+    polling.resolve(false);
+    await polling.promise;
+    await Promise.resolve();
+    await Promise.resolve();
+    expect(statusKeys).toEqual([key]);
+    expect(sourceCreateCalls).toBe(0);
+    expect(sealCalls).toBe(0);
+    expect(window.sessionStorage.getItem(SOURCE_CREATE_STORAGE_KEY)).toBe(key);
+  });
+
+  it("suspends a gated live recovery before sign-out starts session deletion", async () => {
+    const lookupResponse = deferred<Response>();
+    const lookupStarted = deferred<void>();
+    const deleteResponse = deferred<Response>();
+    const deleteStarted = deferred<void>();
+    const lookupRequest = { signal: null as AbortSignal | null };
+    let sourceCreateCalls = 0;
+    let sealCalls = 0;
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input, init) => {
+        const path = String(input);
+        if (path === "/api/v1/sources/idempotency") {
+          lookupRequest.signal = init?.signal ?? null;
+          lookupStarted.resolve();
+          return lookupResponse.promise;
+        }
+        if (path === "/api/v1/sources/idempotency/seal") {
+          sealCalls += 1;
+          return Promise.resolve(noStoreJson({ status: "abandoned" }));
+        }
+        if (path === "/api/v1/sources" && init?.method === "POST") {
+          sourceCreateCalls += 1;
+          return Promise.resolve(new Response("gateway timeout", { status: 504 }));
+        }
+        if (path === "/api/v1/sources") {
+          return Promise.resolve(Response.json({ sources: [], catalogRevision: 1 }));
+        }
+        if (path === "/api/v1/session" && init?.method === "DELETE") {
+          deleteStarted.resolve();
+          return deleteResponse.promise;
+        }
+        return Promise.resolve(Response.json({}, { status: 500 }));
+      }),
+    );
+    render(SourcesPageHarness, {
+      sourceCreateEnvironment: fixedSourceCreateEnvironment(),
+    });
+
+    await screen.findByText("No sources connected");
+    await fireEvent.click(screen.getByLabelText("GraphQL API"));
+    await fireEvent.input(screen.getByLabelText("Endpoint"), {
+      target: { value: "https://api.example.test/graphql" },
+    });
+    await fireEvent.input(screen.getByLabelText("Source name"), {
+      target: { value: "Product API" },
+    });
+    await fireEvent.click(screen.getByRole("button", { name: "Connect source" }));
+    await lookupStarted.promise;
+    const key = window.sessionStorage.getItem(SOURCE_CREATE_STORAGE_KEY);
+    expect(key).toMatch(/^[0-9a-f]{32}$/);
+
+    await fireEvent.click(screen.getByRole("button", { name: "Sign out" }));
+    await deleteStarted.promise;
+    expect(lookupRequest.signal?.aborted).toBe(true);
+    expect(screen.getByText("Source recovery paused for sign-out.")).toBeDefined();
+
+    lookupResponse.resolve(noStoreJson({ status: "missing" }));
+    await lookupResponse.promise;
+    await Promise.resolve();
+    await Promise.resolve();
+    expect(sourceCreateCalls).toBe(1);
+    expect(sealCalls).toBe(0);
+    expect(window.sessionStorage.getItem(SOURCE_CREATE_STORAGE_KEY)).toBe(key);
+
+    deleteResponse.resolve(
+      Response.json(
+        {
+          error: {
+            code: "logout_unavailable",
+            message: "Logout is unavailable in this test.",
+            requestId: "logout-test",
+          },
+        },
+        { status: 503 },
+      ),
+    );
+    expect(
+      await screen.findByText(
+        "Source recovery is paused because sign-out failed. Resume source recovery or reload this page.",
+      ),
+    ).toBeDefined();
+    expect(screen.getByRole("button", { name: "Resume source recovery" })).toBeDefined();
+    expect(sourceCreateCalls).toBe(1);
+    expect(sealCalls).toBe(0);
+    expect(window.sessionStorage.getItem(SOURCE_CREATE_STORAGE_KEY)).toBe(key);
+  });
+
+  it("routes GraphQL creation through the page coordinator", async () => {
+    let listCalls = 0;
+    const creates: Array<{ key: string | null; body: string }> = [];
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input, init) => {
+        const path = String(input);
+        if (path === "/api/v1/sources" && init?.method === "POST") {
+          creates.push({ key: requestIdempotencyKey(init), body: String(init.body) });
+          return Promise.resolve(noStoreJson(sourceFixture(), { status: 201 }));
+        }
+        if (path === "/api/v1/sources") {
+          listCalls += 1;
+          return Promise.resolve(
+            Response.json({
+              sources: listCalls === 1 ? [] : [sourceFixture()],
+              catalogRevision: listCalls,
+            }),
+          );
+        }
+        if (path === "/api/v1/sources/graphql-source/oauth") {
+          return Promise.resolve(emptyOAuthConnections());
+        }
+        return Promise.resolve(Response.json({}, { status: 500 }));
+      }),
+    );
+    render(SourcesPageHarness, {
+      sourceCreateEnvironment: fixedSourceCreateEnvironment(),
+    });
+
+    await screen.findByText("No sources connected");
+    await fireEvent.click(screen.getByLabelText("GraphQL API"));
+    await fireEvent.input(screen.getByLabelText("Endpoint"), {
+      target: { value: "https://api.example.test/graphql" },
+    });
+    await fireEvent.input(screen.getByLabelText("Source name"), {
+      target: { value: "Product API" },
+    });
+    await fireEvent.click(screen.getByRole("button", { name: "Connect source" }));
+
+    expect(await screen.findByRole("heading", { name: "Product API" })).toBeDefined();
+    expect(listCalls).toBe(2);
+    expect(creates).toHaveLength(1);
+    expect(creates[0]?.key).toMatch(/^[0-9a-f]{32}$/);
+    expect(decodeJson(creates[0]?.body ?? "{}")).toMatchObject({ kind: "graphql" });
+    expect(window.sessionStorage.getItem(SOURCE_CREATE_STORAGE_KEY)).toBeNull();
+  });
+
+  it("routes MCP HTTP creation through the page coordinator", async () => {
+    let listCalls = 0;
+    const keys: Array<string | null> = [];
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input, init) => {
+        const path = String(input);
+        if (path === "/api/v1/sources" && init?.method === "POST") {
+          keys.push(requestIdempotencyKey(init));
+          return Promise.resolve(
+            noStoreJson(mcpHttpSourceFixture(), {
+              status: 201,
+            }),
+          );
+        }
+        if (path === "/api/v1/sources") {
+          listCalls += 1;
+          return Promise.resolve(
+            Response.json({
+              sources: listCalls === 1 ? [] : [mcpHttpSourceFixture()],
+              catalogRevision: listCalls,
+            }),
+          );
+        }
+        return Promise.resolve(Response.json({}, { status: 500 }));
+      }),
+    );
+    render(SourcesPageHarness, {
+      sourceCreateEnvironment: fixedSourceCreateEnvironment(),
+    });
+
+    await screen.findByText("No sources connected");
+    await fireEvent.click(screen.getByLabelText("MCP over HTTP"));
+    await fireEvent.input(screen.getByLabelText("Endpoint"), {
+      target: { value: "https://mcp.example.test/mcp" },
+    });
+    await fireEvent.input(screen.getByLabelText("Source name"), {
+      target: { value: "Issue tracker" },
+    });
+    await fireEvent.click(screen.getByRole("button", { name: "Connect source" }));
+
+    expect(await screen.findByRole("heading", { name: "Issue tracker" })).toBeDefined();
+    expect(keys).toHaveLength(1);
+    expect(keys[0]).toMatch(/^[0-9a-f]{32}$/);
+    expect(window.sessionStorage.getItem(SOURCE_CREATE_STORAGE_KEY)).toBeNull();
+  });
+
+  it("routes MCP stdio creation through the page coordinator", async () => {
+    let listCalls = 0;
+    const keys: Array<string | null> = [];
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input, init) => {
+        const path = String(input);
+        if (path === "/api/v1/mcp/stdio/templates") {
+          return Promise.resolve(
+            Response.json({ templates: [{ name: "local", secretFields: [] }] }),
+          );
+        }
+        if (path === "/api/v1/sources" && init?.method === "POST") {
+          keys.push(requestIdempotencyKey(init));
+          return Promise.resolve(noStoreJson(mcpStdioSourceFixture(), { status: 201 }));
+        }
+        if (path === "/api/v1/sources") {
+          listCalls += 1;
+          return Promise.resolve(
+            Response.json({
+              sources: listCalls === 1 ? [] : [mcpStdioSourceFixture()],
+              catalogRevision: listCalls,
+            }),
+          );
+        }
+        return Promise.resolve(Response.json({}, { status: 500 }));
+      }),
+    );
+    render(SourcesPageHarness, {
+      sourceCreateEnvironment: fixedSourceCreateEnvironment(),
+    });
+
+    await screen.findByText("No sources connected");
+    await fireEvent.click(screen.getByLabelText("Trusted local MCP template"));
+    await screen.findByRole("option", { name: "local" });
+    await fireEvent.input(screen.getByLabelText("Source name"), {
+      target: { value: "Local tools" },
+    });
+    await fireEvent.click(screen.getByRole("button", { name: "Connect source" }));
+
+    expect(await screen.findByRole("heading", { name: "Local tools" })).toBeDefined();
+    expect(keys).toHaveLength(1);
+    expect(keys[0]).toMatch(/^[0-9a-f]{32}$/);
+    expect(window.sessionStorage.getItem(SOURCE_CREATE_STORAGE_KEY)).toBeNull();
+  });
+
+  it("refreshes the authoritative list before clearing a completed reload key", async () => {
+    const key = "2".repeat(32);
+    window.sessionStorage.setItem(SOURCE_CREATE_STORAGE_KEY, key);
+    const status = deferred<Response>();
+    const refreshedList = deferred<Response>();
+    let listCalls = 0;
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input) => {
+        const path = String(input);
+        if (path === "/api/v1/sources/idempotency") return status.promise;
+        if (path === "/api/v1/sources") {
+          listCalls += 1;
+          return listCalls === 1
+            ? Promise.resolve(Response.json({ sources: [], catalogRevision: 1 }))
+            : refreshedList.promise;
+        }
+        if (path === "/api/v1/sources/graphql-source/oauth") {
+          return Promise.resolve(emptyOAuthConnections());
+        }
+        return Promise.resolve(Response.json({}, { status: 500 }));
+      }),
+    );
+    render(SourcesPageHarness, {
+      sourceCreateEnvironment: fixedSourceCreateEnvironment(),
+    });
+
+    await screen.findByText("No sources connected");
+    status.resolve(
+      Response.json(sourceFixture(), {
+        status: 201,
+        headers: {
+          "cache-control": "no-store",
+          "idempotency-replayed": "true",
+        },
+      }),
+    );
+    await waitFor(() => expect(listCalls).toBe(2));
+    expect(window.sessionStorage.getItem(SOURCE_CREATE_STORAGE_KEY)).toBe(key);
+
+    refreshedList.resolve(Response.json({ sources: [sourceFixture()], catalogRevision: 2 }));
+    expect(await screen.findByRole("heading", { name: "Product API" })).toBeDefined();
+    await waitFor(() =>
+      expect(window.sessionStorage.getItem(SOURCE_CREATE_STORAGE_KEY)).toBeNull(),
+    );
+  });
+
+  it("reports a definitive failed replay and safely clears its key", async () => {
+    const key = "3".repeat(32);
+    window.sessionStorage.setItem(SOURCE_CREATE_STORAGE_KEY, key);
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input) => {
+        const path = String(input);
+        if (path === "/api/v1/sources/idempotency") {
+          return Promise.resolve(
+            Response.json(
+              {
+                error: {
+                  code: "invalid_source",
+                  message: "The source document is invalid.",
+                  requestId: "failed-source",
+                },
+              },
+              {
+                status: 422,
+                headers: {
+                  "cache-control": "no-store",
+                  "idempotency-replayed": "true",
+                },
+              },
+            ),
+          );
+        }
+        if (path === "/api/v1/sources") {
+          return Promise.resolve(Response.json({ sources: [], catalogRevision: 1 }));
+        }
+        return Promise.resolve(Response.json({}, { status: 500 }));
+      }),
+    );
+    render(SourcesPageHarness, {
+      sourceCreateEnvironment: fixedSourceCreateEnvironment(),
+    });
+
+    expect(await screen.findByText("The source document is invalid.")).toBeDefined();
+    expect(window.sessionStorage.getItem(SOURCE_CREATE_STORAGE_KEY)).toBeNull();
+    expect(screen.getByRole<HTMLFieldSetElement>("group", { name: "Source type" }).disabled).toBe(
+      false,
+    );
+    expect(document.activeElement).toBe(document.getElementById("source-create-status"));
+  });
+
+  it("seals a missing reload key before unlocking the source forms", async () => {
+    const key = "4".repeat(32);
+    window.sessionStorage.setItem(SOURCE_CREATE_STORAGE_KEY, key);
+    let sealCalls = 0;
+    const sealRequest = {
+      value: null as null | {
+        method: string | undefined;
+        body: BodyInit | null | undefined;
+        key: string | null;
+      },
+    };
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input, init) => {
+        const path = String(input);
+        if (path === "/api/v1/sources/idempotency") {
+          return Promise.resolve(noStoreJson({ status: "missing" }));
+        }
+        if (path === "/api/v1/sources/idempotency/seal") {
+          sealCalls += 1;
+          sealRequest.value = {
+            method: init?.method,
+            body: init?.body,
+            key: requestIdempotencyKey(init),
+          };
+          return Promise.resolve(noStoreJson({ status: "abandoned" }));
+        }
+        if (path === "/api/v1/sources") {
+          return Promise.resolve(Response.json({ sources: [], catalogRevision: 1 }));
+        }
+        return Promise.resolve(Response.json({}, { status: 500 }));
+      }),
+    );
+    render(SourcesPageHarness, {
+      sourceCreateEnvironment: fixedSourceCreateEnvironment(),
+    });
+
+    expect(await screen.findByText(/unused source connection key was sealed/i)).toBeDefined();
+    expect(sealCalls).toBe(1);
+    expect(sealRequest.value).toEqual({ method: "POST", body: undefined, key });
+    expect(window.sessionStorage.getItem(SOURCE_CREATE_STORAGE_KEY)).toBeNull();
+    expect(screen.getByRole<HTMLFieldSetElement>("group", { name: "Source type" }).disabled).toBe(
+      false,
+    );
+  });
+
+  it("retains the key and lock when a recovery status is malformed", async () => {
+    const key = "5".repeat(32);
+    window.sessionStorage.setItem(SOURCE_CREATE_STORAGE_KEY, key);
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input) => {
+        const path = String(input);
+        if (path === "/api/v1/sources/idempotency") {
+          return Promise.resolve(Response.json({ status: "missing" }));
+        }
+        if (path === "/api/v1/sources") {
+          return Promise.resolve(Response.json({ sources: [], catalogRevision: 1 }));
+        }
+        return Promise.resolve(Response.json({}, { status: 500 }));
+      }),
+    );
+    render(SourcesPageHarness, {
+      sourceCreateEnvironment: fixedSourceCreateEnvironment(),
+    });
+
+    expect(
+      await screen.findByText(/idempotency status the dashboard could not understand/i),
+    ).toBeDefined();
+    expect(screen.getByRole("button", { name: "Check again" })).toBeDefined();
+    expect(window.sessionStorage.getItem(SOURCE_CREATE_STORAGE_KEY)).toBe(key);
+    expect(screen.getByRole<HTMLFieldSetElement>("group", { name: "Source type" }).disabled).toBe(
+      true,
+    );
+  });
+
+  it("fails closed before dispatch when secure randomness is unavailable", async () => {
+    let createCalls = 0;
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input, init) => {
+        if (String(input) === "/api/v1/sources" && init?.method === "POST") createCalls += 1;
+        return Promise.resolve(Response.json({ sources: [], catalogRevision: 1 }));
+      }),
+    );
+    render(SourcesPageHarness, {
+      sourceCreateEnvironment: {
+        getStorage: () => window.sessionStorage,
+        fillRandom: () => Effect.runSync(Effect.fail("randomness unavailable")),
+        wait: () => Promise.resolve(true),
+      },
+    });
+
+    await screen.findByText("No sources connected");
+    await fireEvent.click(screen.getByLabelText("GraphQL API"));
+    await fireEvent.input(screen.getByLabelText("Endpoint"), {
+      target: { value: "https://api.example.test/graphql" },
+    });
+    await fireEvent.input(screen.getByLabelText("Source name"), {
+      target: { value: "Product API" },
+    });
+    await fireEvent.click(screen.getByRole("button", { name: "Connect source" }));
+
+    await waitFor(() =>
+      expect(screen.getAllByText(/secure browser randomness is unavailable/i)).toHaveLength(2),
+    );
+    expect(createCalls).toBe(0);
+    expect(window.sessionStorage.getItem(SOURCE_CREATE_STORAGE_KEY)).toBeNull();
+  });
+
+  it("locks recovery when tab storage cannot be read safely", async () => {
+    let createCalls = 0;
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input, init) => {
+        if (String(input) === "/api/v1/sources" && init?.method === "POST") createCalls += 1;
+        return Promise.resolve(Response.json({ sources: [], catalogRevision: 1 }));
+      }),
+    );
+    render(SourcesPageHarness, {
+      sourceCreateEnvironment: {
+        getStorage: () => Effect.runSync(Effect.fail("storage unavailable")),
+        fillRandom: (bytes) => bytes.fill(1),
+        wait: () => Promise.resolve(true),
+      },
+    });
+
+    expect(await screen.findByText(/secure tab storage is unavailable/i)).toBeDefined();
+    expect(createCalls).toBe(0);
+    expect(screen.getByRole<HTMLFieldSetElement>("group", { name: "Source type" }).disabled).toBe(
+      true,
+    );
+    expect(screen.getByRole("button", { name: "Check again" })).toBeDefined();
+  });
+
+  it("keeps stored operation B when operation A completes late", async () => {
+    const keyB = "b".repeat(32);
+    const refreshedList = deferred<Response>();
+    let listCalls = 0;
+    const statusKeys: Array<string | null> = [];
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input, init) => {
+        const path = String(input);
+        if (path === "/api/v1/sources/idempotency") {
+          statusKeys.push(requestIdempotencyKey(init));
+          return Effect.runPromise(Effect.fail("offline"));
+        }
+        if (path === "/api/v1/sources" && init?.method === "POST") {
+          return Promise.resolve(noStoreJson(sourceFixture(), { status: 201 }));
+        }
+        if (path === "/api/v1/sources") {
+          listCalls += 1;
+          return listCalls === 1
+            ? Promise.resolve(Response.json({ sources: [], catalogRevision: 1 }))
+            : refreshedList.promise;
+        }
+        return Promise.resolve(Response.json({}, { status: 500 }));
+      }),
+    );
+    render(SourcesPageHarness, {
+      sourceCreateEnvironment: fixedSourceCreateEnvironment(),
+    });
+
+    await screen.findByText("No sources connected");
+    await fireEvent.click(screen.getByLabelText("GraphQL API"));
+    await fireEvent.input(screen.getByLabelText("Endpoint"), {
+      target: { value: "https://api.example.test/graphql" },
+    });
+    await fireEvent.input(screen.getByLabelText("Source name"), {
+      target: { value: "Product API" },
+    });
+    await fireEvent.click(screen.getByRole("button", { name: "Connect source" }));
+    await waitFor(() => expect(listCalls).toBe(2));
+    window.sessionStorage.setItem(SOURCE_CREATE_STORAGE_KEY, keyB);
+    refreshedList.resolve(Response.json({ sources: [sourceFixture()], catalogRevision: 2 }));
+
+    expect(await screen.findByText(/Executor could not be reached/i)).toBeDefined();
+    expect(statusKeys).toEqual([keyB]);
+    expect(window.sessionStorage.getItem(SOURCE_CREATE_STORAGE_KEY)).toBe(keyB);
+    expect(screen.queryByText(/connected with 4 tools/i)).toBeNull();
+    expect(screen.getByRole<HTMLFieldSetElement>("group", { name: "Source type" }).disabled).toBe(
+      true,
+    );
+  });
+
+  it("cleans a matched OAuth callback while preserving unrelated URL and history state", async () => {
+    const initialState = { preserved: "history-state" };
+    const replacement = {
+      url: null as URL | null,
+      state: null as App.PageState | null,
+    };
+    const onOAuthReplace = vi.fn((url: URL, state: App.PageState) => {
+      replacement.url = url;
+      replacement.state = state;
+    });
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input) => {
+        const path = String(input);
+        if (path === "/api/v1/sources") {
+          return Promise.resolve(Response.json({ sources: [sourceFixture()], catalogRevision: 1 }));
+        }
+        if (path === "/api/v1/sources/graphql-source/oauth") {
+          return Promise.resolve(
+            Response.json({
+              connections: [oauthConnectionFixture("matched-connection")],
+              availableCredentials: [],
+            }),
+          );
+        }
+        return Promise.resolve(Response.json({}, { status: 500 }));
+      }),
+    );
+    render(SourcesPageHarness, {
+      initialOAuthUrl:
+        "https://executor.example.test/sources?keep=present&oauth=matched-connection&result=success#details",
+      initialOAuthState: initialState,
+      onOAuthReplace,
+    });
+
+    expect(
+      await screen.findByText(
+        "OAuth authorization completed and the connection status was refreshed.",
+      ),
+    ).toBeDefined();
+    await waitFor(() => expect(onOAuthReplace).toHaveBeenCalledOnce());
+    expectPreservedOAuthCleanup(replacement.url);
+    expect(replacement.state).toBe(initialState);
+  });
+
+  it("focuses an unmatched OAuth notice before cleaning callback state", async () => {
+    const initialState = { preserved: "unmatched-state" };
+    const replacement = {
+      url: null as URL | null,
+      state: null as App.PageState | null,
+      focusedId: null as string | null,
+    };
+    const onOAuthReplace = vi.fn((url: URL, state: App.PageState) => {
+      replacement.url = url;
+      replacement.state = state;
+      replacement.focusedId = document.activeElement?.id ?? null;
+    });
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input) => {
+        const path = String(input);
+        if (path === "/api/v1/sources") {
+          return Promise.resolve(Response.json({ sources: [sourceFixture()], catalogRevision: 2 }));
+        }
+        if (path === "/api/v1/sources/graphql-source/oauth") {
+          return Promise.resolve(emptyOAuthConnections());
+        }
+        return Promise.resolve(Response.json({}, { status: 500 }));
+      }),
+    );
+    render(SourcesPageHarness, {
+      initialOAuthUrl:
+        "https://executor.example.test/sources?keep=present&oauth=missing-connection&result=success#details",
+      initialOAuthState: initialState,
+      onOAuthReplace,
+    });
+
+    expect(
+      await screen.findByText("OAuth returned, but no matching managed connection is available."),
+    ).toBeDefined();
+    await waitFor(() => expect(onOAuthReplace).toHaveBeenCalledOnce());
+    expect(replacement.focusedId).toBe("source-status");
+    expectPreservedOAuthCleanup(replacement.url);
+    expect(replacement.state).toBe(initialState);
+  });
+
+  it("focuses a safe OAuth notice when the current source set has no eligible connection", async () => {
+    const replacement = {
+      url: null as URL | null,
+      focusedId: null as string | null,
+    };
+    const onOAuthReplace = vi.fn((url: URL) => {
+      replacement.url = url;
+      replacement.focusedId = document.activeElement?.id ?? null;
+    });
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input) => {
+        if (String(input) === "/api/v1/sources") {
+          return Promise.resolve(Response.json({ sources: [], catalogRevision: 3 }));
+        }
+        return Promise.resolve(Response.json({}, { status: 500 }));
+      }),
+    );
+    render(SourcesPageHarness, {
+      initialOAuthUrl:
+        "https://executor.example.test/sources?keep=present&oauth=missing-connection&result=failed#details",
+      onOAuthReplace,
+    });
+
+    expect(
+      await screen.findByText(
+        "OAuth authorization did not complete. Review the connection status and try again.",
+      ),
+    ).toBeDefined();
+    await waitFor(() => expect(onOAuthReplace).toHaveBeenCalledOnce());
+    expect(replacement.focusedId).toBe("source-status");
+    expectPreservedOAuthCleanup(replacement.url);
+  });
+
+  it("ignores an out-of-order OAuth check from a replaced eligible source set", async () => {
+    const staleOAuth = deferred<Response>();
+    let listCalls = 0;
+    const onOAuthReplace = vi.fn();
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input, init) => {
+        const path = String(input);
+        if (path === "/api/v1/sources") {
+          if (init?.method === "POST") {
+            return Promise.resolve(
+              noStoreJson(openApiSourceFixture("replacement", "Replacement source"), {
+                status: 201,
+              }),
+            );
+          }
+          listCalls += 1;
+          return Promise.resolve(
+            Response.json({
+              sources:
+                listCalls === 1
+                  ? [sourceFixture("source-a", "Source A"), sourceFixture("source-b", "Source B")]
+                  : [openApiSourceFixture("replacement", "Replacement source")],
+              catalogRevision: listCalls,
+            }),
+          );
+        }
+        if (path === "/api/v1/sources/openapi/preview" && init?.method === "POST") {
+          return Promise.resolve(
+            Response.json({
+              title: "Replacement source",
+              description: null,
+              toolCount: 1,
+              tools: [],
+              securitySchemes: [],
+            }),
+          );
+        }
+        if (path === "/api/v1/sources/source-a/oauth") {
+          return Promise.resolve(emptyOAuthConnections());
+        }
+        if (path === "/api/v1/sources/source-b/oauth") return staleOAuth.promise;
+        if (path === "/api/v1/sources/replacement/oauth") {
+          return Promise.resolve(emptyOAuthConnections());
+        }
+        return Promise.resolve(Response.json({}, { status: 500 }));
+      }),
+    );
+    render(SourcesPageHarness, {
+      initialOAuthUrl:
+        "https://executor.example.test/sources?keep=present&oauth=late-match&result=success#details",
+      onOAuthReplace,
+    });
+
+    await screen.findByRole("heading", { name: "Source A" });
+    await screen.findByRole("heading", { name: "Source B" });
+    await fireEvent.click(screen.getByText("Connect a source"));
+    await fireEvent.input(screen.getByLabelText("OpenAPI URL"), {
+      target: { value: "https://api.example.test/openapi.json" },
+    });
+    await fireEvent.click(screen.getByRole("button", { name: "Preview tools" }));
+    await screen.findByRole("heading", { name: "Replacement source" });
+    await fireEvent.click(screen.getByRole("button", { name: "Import source" }));
+
+    await waitFor(() =>
+      expect(screen.getAllByRole("heading", { name: "Replacement source" })).toHaveLength(1),
+    );
+    await waitFor(() => expect(onOAuthReplace).toHaveBeenCalledOnce());
+    staleOAuth.resolve(
+      Response.json({
+        connections: [oauthConnectionFixture("late-match")],
+        availableCredentials: [],
+      }),
+    );
+    await staleOAuth.promise;
+    await Promise.resolve();
+    await Promise.resolve();
+
+    expect(onOAuthReplace).toHaveBeenCalledOnce();
+    expect(
+      screen.queryByText("OAuth authorization completed and the connection status was refreshed."),
+    ).toBeNull();
+  });
+
+  it("includes OpenAPI credential loading in the shared source lock", async () => {
+    const credentials = deferred<Response>();
+    let logoutCalls = 0;
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input, init) => {
+        const path = String(input);
+        if (path === "/api/v1/sources") {
+          return Promise.resolve(
+            Response.json({ sources: [openApiSourceFixture()], catalogRevision: 1 }),
+          );
+        }
+        if (path === "/api/v1/sources/openapi-source/oauth") {
+          return Promise.resolve(emptyOAuthConnections());
+        }
+        if (path === "/api/v1/sources/openapi-source/credentials") {
+          return credentials.promise;
+        }
+        if (path === "/api/v1/session" && init?.method === "DELETE") {
+          logoutCalls += 1;
+          return Promise.resolve(
+            Response.json(
+              {
+                error: {
+                  code: "logout_unavailable",
+                  message: "Logout is unavailable in this test.",
+                  requestId: "logout-test",
+                },
+              },
+              { status: 503 },
+            ),
+          );
+        }
+        return Promise.resolve(
+          Response.json(
+            {
+              error: {
+                code: "unexpected_test_request",
+                message: `Unexpected request: ${path}`,
+                requestId: "test-request",
+              },
+            },
+            { status: 500 },
+          ),
+        );
+      }),
+    );
+    render(SourcesPageHarness);
+
+    const manageCredentials = await screen.findByRole<HTMLButtonElement>("button", {
+      name: "Manage credentials",
+    });
+    await waitFor(() => expect(manageCredentials.disabled).toBe(false));
+    await fireEvent.click(manageCredentials);
+
+    await waitFor(() =>
+      expect(
+        screen.getByRole<HTMLFieldSetElement>("group", { name: "Default tool behavior" }).disabled,
+      ).toBe(true),
+    );
+    expect(screen.getByRole<HTMLButtonElement>("button", { name: "Refresh" }).disabled).toBe(true);
+    expect(screen.getByRole<HTMLButtonElement>("button", { name: "Delete" }).disabled).toBe(true);
+    const unload = new Event("beforeunload", { cancelable: true });
+    window.dispatchEvent(unload);
+    expect(unload.defaultPrevented).toBe(false);
+    await fireEvent.click(screen.getByRole("button", { name: "Sign out" }));
+    await waitFor(() => expect(logoutCalls).toBe(1));
+
+    credentials.resolve(
+      Response.json({
+        revision: 1,
+        configuredSchemes: [{ name: "default", credentialType: "bearer" }],
+      }),
+    );
+    await credentials.promise;
+    await screen.findByRole("form", { name: "Credentials for Weather API" });
+  });
+
+  it("releases the OpenAPI credential lock after a rejected metadata request", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input) => {
+        const path = String(input);
+        if (path === "/api/v1/sources") {
+          return Promise.resolve(
+            Response.json({ sources: [openApiSourceFixture()], catalogRevision: 1 }),
+          );
+        }
+        if (path === "/api/v1/sources/openapi-source/oauth") {
+          return Promise.resolve(emptyOAuthConnections());
+        }
+        if (path === "/api/v1/sources/openapi-source/credentials") {
+          return Effect.runPromise(Effect.fail("offline"));
+        }
+        return Promise.resolve(Response.json({}, { status: 500 }));
+      }),
+    );
+    render(SourcesPageHarness);
+
+    const manageCredentials = await screen.findByRole<HTMLButtonElement>("button", {
+      name: "Manage credentials",
+    });
+    await waitFor(() => expect(manageCredentials.disabled).toBe(false));
+    await fireEvent.click(manageCredentials);
+
+    expect(
+      await screen.findByText(
+        "Executor could not be reached. Check that the local server is running.",
+      ),
+    ).toBeDefined();
+    await waitFor(() => expect(manageCredentials.disabled).toBe(false));
+    expect(
+      screen.getByRole<HTMLFieldSetElement>("group", { name: "Default tool behavior" }).disabled,
+    ).toBe(false);
+    expect(manageCredentials.getAttribute("aria-expanded")).toBe("false");
+  });
+
+  it("disables sibling source controls while managed OAuth saves", async () => {
+    const replacement = deferred<Response>();
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input, init) => {
+        const path = String(input);
+        if (path === "/api/v1/sources") {
+          return Promise.resolve(Response.json({ sources: [sourceFixture()], catalogRevision: 1 }));
+        }
+        if (path === "/api/v1/sources/graphql-source/oauth/default" && init?.method === "PUT") {
+          return replacement.promise;
+        }
+        if (path === "/api/v1/sources/graphql-source/oauth") {
+          return Promise.resolve(
+            Response.json({
+              connections: [],
+              availableCredentials: [
+                {
+                  credentialKey: "default",
+                  protocol: "graphql",
+                  requestedScopes: [],
+                  managedOAuthEligible: true,
+                },
+              ],
+            }),
+          );
+        }
+        return Promise.resolve(
+          Response.json(
+            {
+              error: {
+                code: "unexpected_test_request",
+                message: `Unexpected request: ${path}`,
+                requestId: "test-request",
+              },
+            },
+            { status: 500 },
+          ),
+        );
+      }),
+    );
+    render(SourcesPageHarness);
+
+    const manageCredentials = await screen.findByRole<HTMLButtonElement>("button", {
+      name: "Manage credentials",
+    });
+    await waitFor(() => expect(manageCredentials.disabled).toBe(false));
+    await fireEvent.input(screen.getByLabelText("Issuer URL"), {
+      target: { value: "https://identity.example.test" },
+    });
+    await fireEvent.input(screen.getByLabelText("Client ID"), {
+      target: { value: "executor-client" },
+    });
+    const saveConfiguration = screen.getByRole<HTMLButtonElement>("button", {
+      name: "Save configuration",
+    });
+    await waitFor(() => expect(saveConfiguration.disabled).toBe(false));
+    await fireEvent.click(saveConfiguration);
+
+    await waitFor(() => expect(manageCredentials.disabled).toBe(true));
+    expect(
+      screen.getByRole<HTMLButtonElement>("button", { name: "Refresh schema and tools" }).disabled,
+    ).toBe(true);
+    expect(screen.getByRole<HTMLButtonElement>("button", { name: "Delete" }).disabled).toBe(true);
+
+    replacement.resolve(
+      Response.json({
+        id: "connection-1",
+        credentialKey: "default",
+        revision: 1,
+        status: "ready_to_connect",
+        issuer: "https://identity.example.test/",
+        clientId: "executor-client",
+        clientAuthMethod: "none",
+        callbackUrl: "https://executor.example.test/api/v1/oauth/callback/connection-1",
+        requestedScopes: [],
+        grantedScopes: [],
+        hasClientSecret: false,
+        hasRefreshToken: false,
+        accessExpiresAt: null,
+        authorizedAt: null,
+        lastRefreshedAt: null,
+        errorCode: null,
+        managedOAuthEligible: true,
+      }),
+    );
+    await replacement.promise;
+  });
+
+  it("disables an open mode confirmation and sibling actions while credentials save", async () => {
+    const replacement = deferred<Response>();
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input, init) => {
+        const path = String(input);
+        if (path === "/api/v1/sources") {
+          return Promise.resolve(Response.json({ sources: [sourceFixture()], catalogRevision: 1 }));
+        }
+        if (path.endsWith("/credentials") && init?.method === "PUT") {
+          return replacement.promise;
+        }
+        if (path.endsWith("/credentials")) {
+          return Promise.resolve(
+            Response.json({
+              revision: 4,
+              configuredSchemes: [{ name: "default", credentialType: "bearer" }],
+            }),
+          );
+        }
+        if (path.endsWith("/oauth") && init?.method === undefined) {
+          return Promise.resolve(emptyOAuthConnections());
+        }
+        return Promise.resolve(
+          Response.json(
+            {
+              error: {
+                code: "unexpected_test_request",
+                message: `Unexpected request: ${path}`,
+                requestId: "test-request",
+              },
+            },
+            { status: 500 },
+          ),
+        );
+      }),
+    );
+    render(SourcesPageHarness);
+
+    await screen.findByRole("heading", { name: "Product API" });
+    const manageCredentials = screen.getByRole<HTMLButtonElement>("button", {
+      name: "Manage credentials",
+    });
+    await waitFor(() => expect(manageCredentials.disabled).toBe(false));
+    await fireEvent.click(screen.getByLabelText("Enabled"));
+    await fireEvent.click(screen.getByRole("button", { name: "Apply source default" }));
+    const confirmMode = screen.getByRole<HTMLButtonElement>("button", {
+      name: "Confirm broad change",
+    });
+    expect(confirmMode.disabled).toBe(false);
+
+    await fireEvent.click(manageCredentials);
+    const token = await screen.findByLabelText("Bearer token");
+    await fireEvent.input(token, { target: { value: "credential-secret" } });
+    const saveReplacement = screen.getByRole<HTMLButtonElement>("button", {
+      name: "Save replacement",
+    });
+    await waitFor(() => expect(saveReplacement.disabled).toBe(false));
+    await fireEvent.click(saveReplacement);
+
+    await waitFor(() => expect(confirmMode.disabled).toBe(true));
+    expect(
+      screen.getByRole<HTMLButtonElement>("button", { name: "Refresh schema and tools" }).disabled,
+    ).toBe(true);
+    expect(screen.getByRole<HTMLButtonElement>("button", { name: "Delete" }).disabled).toBe(true);
+
+    replacement.resolve(
+      Response.json({
+        revision: 5,
+        configuredSchemes: [{ name: "default", credentialType: "bearer" }],
+      }),
+    );
+    await replacement.promise;
+  });
+
+  it("does not abort a source save while a different source refreshes the list", async () => {
+    const replacement = deferred<Response>();
+    const saveRequest = { signal: null as AbortSignal | null };
+    let listCalls = 0;
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input, init) => {
+        const path = String(input);
+        if (path === "/api/v1/sources") {
+          listCalls += 1;
+          return Promise.resolve(
+            Response.json({
+              sources: [
+                sourceFixture("source-a", "Source A"),
+                sourceFixture("source-b", "Source B"),
+              ],
+              catalogRevision: listCalls,
+            }),
+          );
+        }
+        if (path === "/api/v1/sources/source-a/credentials" && init?.method === "PUT") {
+          saveRequest.signal = init.signal ?? null;
+          return replacement.promise;
+        }
+        if (path === "/api/v1/sources/source-a/credentials") {
+          return Promise.resolve(
+            Response.json({
+              revision: 4,
+              configuredSchemes: [{ name: "default", credentialType: "bearer" }],
+            }),
+          );
+        }
+        if (path === "/api/v1/sources/source-b/refresh" && init?.method === "POST") {
+          return Promise.resolve(
+            Response.json({
+              sourceId: "source-b",
+              sourceRevision: 2,
+              catalogRevision: 2,
+              globalRevision: 2,
+              activeToolCount: 4,
+              tombstonedToolCount: 0,
+            }),
+          );
+        }
+        if (path.endsWith("/oauth") && init?.method === undefined) {
+          return Promise.resolve(emptyOAuthConnections());
+        }
+        return Promise.resolve(
+          Response.json(
+            {
+              error: {
+                code: "unexpected_test_request",
+                message: `Unexpected request: ${path}`,
+                requestId: "test-request",
+              },
+            },
+            { status: 500 },
+          ),
+        );
+      }),
+    );
+    render(SourcesPageHarness);
+
+    const sourceAHeading = await screen.findByRole("heading", { name: "Source A" });
+    const sourceBHeading = screen.getByRole("heading", { name: "Source B" });
+    const sourceA = within(sourceAHeading.closest("article") ?? document.body);
+    const sourceB = within(sourceBHeading.closest("article") ?? document.body);
+    const manageCredentials = sourceA.getByRole<HTMLButtonElement>("button", {
+      name: "Manage credentials",
+    });
+    await waitFor(() => expect(manageCredentials.disabled).toBe(false));
+    await fireEvent.click(manageCredentials);
+    const token = await sourceA.findByLabelText("Bearer token");
+    await fireEvent.input(token, { target: { value: "source-a-secret" } });
+    const saveReplacement = sourceA.getByRole<HTMLButtonElement>("button", {
+      name: "Save replacement",
+    });
+    await waitFor(() => expect(saveReplacement.disabled).toBe(false));
+    await fireEvent.click(saveReplacement);
+    await waitFor(() => expect(saveRequest.signal).not.toBeNull());
+
+    const refreshSourceB = sourceB.getByRole<HTMLButtonElement>("button", {
+      name: "Refresh schema and tools",
+    });
+    await waitFor(() => expect(refreshSourceB.disabled).toBe(false));
+    await fireEvent.click(refreshSourceB);
+    await waitFor(() => expect(listCalls).toBe(2));
+    expect(saveRequest.signal?.aborted).toBe(false);
+
+    replacement.resolve(
+      Response.json({
+        revision: 5,
+        configuredSchemes: [{ name: "default", credentialType: "bearer" }],
+      }),
+    );
+    await replacement.promise;
+    expect(await sourceA.findByText(/Credentials replaced/)).toBeDefined();
+  });
+
+  it("fences source writes through settlement and aborts a forced unmount", async () => {
+    const firstRefresh = deferred<Response>();
+    const secondRefresh = deferred<Response>();
+    const refreshSignals: AbortSignal[] = [];
+    let refreshCalls = 0;
+    let listCalls = 0;
+    let logoutCalls = 0;
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input, init) => {
+        const path = String(input);
+        if (path === "/api/v1/sources") {
+          listCalls += 1;
+          return Promise.resolve(
+            Response.json({ sources: [openApiSourceFixture()], catalogRevision: listCalls }),
+          );
+        }
+        if (path === "/api/v1/sources/openapi-source/oauth") {
+          return Promise.resolve(emptyOAuthConnections());
+        }
+        if (path === "/api/v1/sources/openapi-source/refresh" && init?.method === "POST") {
+          if (init.signal instanceof AbortSignal) refreshSignals.push(init.signal);
+          refreshCalls += 1;
+          return refreshCalls === 1 ? firstRefresh.promise : secondRefresh.promise;
+        }
+        if (path === "/api/v1/session" && init?.method === "DELETE") {
+          logoutCalls += 1;
+        }
+        return Promise.resolve(Response.json({}, { status: 500 }));
+      }),
+    );
+    const mounted = render(SourcesPageHarness);
+
+    const refresh = await screen.findByRole<HTMLButtonElement>("button", { name: "Refresh" });
+    await waitFor(() => expect(refresh.disabled).toBe(false));
+    await fireEvent.click(refresh);
+    await waitFor(() => expect(refreshCalls).toBe(1));
+    await expectPendingWriteFence(() => logoutCalls);
+    expect(refreshSignals[0]?.aborted).toBe(false);
+
+    firstRefresh.resolve(
+      Response.json({
+        sourceId: "openapi-source",
+        sourceRevision: 2,
+        catalogRevision: 2,
+        globalRevision: 2,
+        activeToolCount: 4,
+        tombstonedToolCount: 0,
+      }),
+    );
+    await waitFor(() => expect(listCalls).toBe(2));
+    await waitFor(() => expect(refresh.disabled).toBe(false));
+    const settledUnload = new Event("beforeunload", { cancelable: true });
+    window.dispatchEvent(settledUnload);
+    expect(settledUnload.defaultPrevented).toBe(false);
+
+    await fireEvent.click(refresh);
+    await waitFor(() => expect(refreshCalls).toBe(2));
+    mounted.unmount();
+    expect(refreshSignals[1]?.aborted).toBe(true);
+    secondRefresh.resolve(
+      Response.json({
+        sourceId: "openapi-source",
+        sourceRevision: 3,
+        catalogRevision: 3,
+        globalRevision: 3,
+        activeToolCount: 4,
+        tombstonedToolCount: 0,
+      }),
+    );
+    await secondRefresh.promise;
+  });
+
+  it("freezes the complete OpenAPI credential draft and fences each deferred save", async () => {
+    const firstSave = deferred<Response>();
+    const secondSave = deferred<Response>();
+    const saveSignals: AbortSignal[] = [];
+    let saveCalls = 0;
+    let logoutCalls = 0;
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input, init) => {
+        const path = String(input);
+        if (path === "/api/v1/sources") {
+          return Promise.resolve(
+            Response.json({ sources: [openApiSourceFixture()], catalogRevision: 1 }),
+          );
+        }
+        if (path === "/api/v1/sources/openapi-source/oauth") {
+          return Promise.resolve(emptyOAuthConnections());
+        }
+        if (path === "/api/v1/sources/openapi-source/credentials" && init?.method === "PUT") {
+          if (init.signal instanceof AbortSignal) saveSignals.push(init.signal);
+          saveCalls += 1;
+          return saveCalls === 1 ? firstSave.promise : secondSave.promise;
+        }
+        if (path === "/api/v1/sources/openapi-source/credentials") {
+          return Promise.resolve(
+            Response.json({
+              revision: saveCalls + 4,
+              configuredSchemes: [{ name: "default", credentialType: "bearer" }],
+            }),
+          );
+        }
+        if (path === "/api/v1/session" && init?.method === "DELETE") {
+          logoutCalls += 1;
+        }
+        return Promise.resolve(Response.json({}, { status: 500 }));
+      }),
+    );
+    const mounted = render(SourcesPageHarness);
+
+    const manage = await screen.findByRole<HTMLButtonElement>("button", {
+      name: "Manage credentials",
+    });
+    await waitFor(() => expect(manage.disabled).toBe(false));
+    await fireEvent.click(manage);
+    const name = await screen.findByLabelText<HTMLInputElement>("Security scheme name");
+    const type = screen.getByLabelText<HTMLSelectElement>("Type");
+    const token = screen.getByLabelText<HTMLInputElement>("Bearer token");
+    await fireEvent.input(token, { target: { value: "visible-only-in-disabled-input" } });
+    await fireEvent.click(screen.getByRole("button", { name: "Save replacement" }));
+
+    const row = screen.getByRole<HTMLFieldSetElement>("group", { name: "Credential" });
+    await waitFor(() => expect(row.disabled).toBe(true));
+    expect(name.value).toBe("default");
+    expect(type.value).toBe("bearer");
+    expect(token.value).toBe("visible-only-in-disabled-input");
+    expect(screen.getByRole("button", { name: "Saving..." })).toBeDefined();
+    expect(screen.getByRole<HTMLButtonElement>("button", { name: "Add credential" }).disabled).toBe(
+      true,
+    );
+    expect(
+      screen.getByRole<HTMLButtonElement>("button", { name: "Clear all credentials" }).disabled,
+    ).toBe(true);
+    await expectPendingWriteFence(() => logoutCalls);
+    expect(saveSignals[0]?.aborted).toBe(false);
+
+    firstSave.resolve(
+      Response.json({
+        revision: 5,
+        configuredSchemes: [{ name: "default", credentialType: "bearer" }],
+      }),
+    );
+    expect(await screen.findByText(/Credentials were replaced/)).toBeDefined();
+    await waitFor(() => expect(manage.disabled).toBe(false));
+
+    await fireEvent.click(manage);
+    const nextToken = await screen.findByLabelText<HTMLInputElement>("Bearer token");
+    await fireEvent.input(nextToken, { target: { value: "second-save" } });
+    await fireEvent.click(screen.getByRole("button", { name: "Save replacement" }));
+    await waitFor(() => expect(saveCalls).toBe(2));
+    mounted.unmount();
+    expect(saveSignals[1]?.aborted).toBe(true);
+    secondSave.resolve(
+      Response.json({
+        revision: 6,
+        configuredSchemes: [{ name: "default", credentialType: "bearer" }],
+      }),
+    );
+    await secondSave.promise;
+  });
+
+  it("fences a deferred GraphQL credential write without trapping its metadata load", async () => {
+    const replacement = deferred<Response>();
+    const request = { signal: null as AbortSignal | null };
+    let logoutCalls = 0;
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input, init) => {
+        const path = String(input);
+        if (path === "/api/v1/sources") {
+          return Promise.resolve(Response.json({ sources: [sourceFixture()], catalogRevision: 1 }));
+        }
+        if (path === "/api/v1/sources/graphql-source/oauth") {
+          return Promise.resolve(emptyOAuthConnections());
+        }
+        if (path === "/api/v1/sources/graphql-source/credentials" && init?.method === "PUT") {
+          request.signal = init.signal ?? null;
+          return replacement.promise;
+        }
+        if (path === "/api/v1/sources/graphql-source/credentials") {
+          return Promise.resolve(
+            Response.json({
+              revision: 4,
+              configuredSchemes: [{ name: "default", credentialType: "bearer" }],
+            }),
+          );
+        }
+        if (path === "/api/v1/session" && init?.method === "DELETE") logoutCalls += 1;
+        return Promise.resolve(Response.json({}, { status: 500 }));
+      }),
+    );
+    render(SourcesPageHarness);
+
+    await screen.findByRole("region", { name: "Managed OAuth for Product API" });
+    const manage = await screen.findByRole<HTMLButtonElement>("button", {
+      name: "Manage credentials",
+    });
+    await waitFor(() => expect(manage.disabled).toBe(false));
+    await fireEvent.click(manage);
+    const token = await screen.findByLabelText("Bearer token");
+    const loadUnload = new Event("beforeunload", { cancelable: true });
+    window.dispatchEvent(loadUnload);
+    expect(loadUnload.defaultPrevented).toBe(false);
+    await fireEvent.input(token, { target: { value: "graphql-secret" } });
+    const saveReplacement = screen.getByRole<HTMLButtonElement>("button", {
+      name: "Save replacement",
+    });
+    await waitFor(() => expect(saveReplacement.disabled).toBe(false));
+    await fireEvent.click(saveReplacement);
+    await waitFor(() => expect(request.signal).not.toBeNull());
+    await expectPendingWriteFence(() => logoutCalls);
+    expect(request.signal?.aborted).toBe(false);
+
+    replacement.resolve(
+      Response.json({
+        revision: 5,
+        configuredSchemes: [{ name: "default", credentialType: "bearer" }],
+      }),
+    );
+    expect(await screen.findByText(/Credentials replaced/)).toBeDefined();
+  });
+
+  it("fences a deferred MCP credential write without trapping its metadata load", async () => {
+    const replacement = deferred<Response>();
+    const request = { signal: null as AbortSignal | null };
+    let logoutCalls = 0;
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input, init) => {
+        const path = String(input);
+        if (path === "/api/v1/sources") {
+          return Promise.resolve(
+            Response.json({ sources: [mcpHttpSourceFixture()], catalogRevision: 1 }),
+          );
+        }
+        if (path === "/api/v1/sources/mcp-http-source/oauth") {
+          return Promise.resolve(emptyOAuthConnections());
+        }
+        if (path === "/api/v1/sources/mcp-http-source/credentials" && init?.method === "PUT") {
+          request.signal = init.signal ?? null;
+          return replacement.promise;
+        }
+        if (path === "/api/v1/sources/mcp-http-source/credentials") {
+          return Promise.resolve(
+            Response.json({
+              revision: 4,
+              configuredSchemes: [{ name: "authorization", credentialType: "bearer" }],
+            }),
+          );
+        }
+        if (path === "/api/v1/session" && init?.method === "DELETE") logoutCalls += 1;
+        return Promise.resolve(Response.json({}, { status: 500 }));
+      }),
+    );
+    render(SourcesPageHarness);
+
+    await screen.findByRole("region", { name: "Managed OAuth for Issue tracker" });
+    const manage = await screen.findByRole<HTMLButtonElement>("button", {
+      name: "Manage credentials",
+    });
+    await waitFor(() => expect(manage.disabled).toBe(false));
+    await fireEvent.click(manage);
+    const token = await screen.findByLabelText("Bearer token");
+    const loadUnload = new Event("beforeunload", { cancelable: true });
+    window.dispatchEvent(loadUnload);
+    expect(loadUnload.defaultPrevented).toBe(false);
+    await fireEvent.input(token, { target: { value: "mcp-secret" } });
+    const saveReplacement = screen.getByRole<HTMLButtonElement>("button", {
+      name: "Save replacement",
+    });
+    await waitFor(() => expect(saveReplacement.disabled).toBe(false));
+    await fireEvent.click(saveReplacement);
+    await waitFor(() => expect(request.signal).not.toBeNull());
+    await expectPendingWriteFence(() => logoutCalls);
+    expect(request.signal?.aborted).toBe(false);
+
+    replacement.resolve(
+      Response.json({
+        revision: 5,
+        configuredSchemes: [{ name: "authorization", credentialType: "bearer" }],
+      }),
+    );
+    expect(await screen.findByText(/Credentials replaced/)).toBeDefined();
+  });
+
+  it("keeps source A OAuth drafts and writes stable while source B refreshes", async () => {
+    const saveResponse = deferred<Response>();
+    const deleteResponse = deferred<Response>();
+    const saveRequest = { signal: null as AbortSignal | null };
+    const deleteRequest = { signal: null as AbortSignal | null };
+    let listCalls = 0;
+    let sourceAOAuthLoads = 0;
+    let sourceBRefreshes = 0;
+    let logoutCalls = 0;
+    const sourceAConnection = {
+      ...oauthConnectionFixture("source-a-connection"),
+      credentialKey: "default",
+      requestedScopes: ["read"],
+    };
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input, init) => {
+        const path = String(input);
+        if (path === "/api/v1/sources") {
+          listCalls += 1;
+          return Promise.resolve(
+            Response.json({
+              sources: [
+                sourceFixture("source-a", "Source A"),
+                sourceFixture("source-b", "Source B"),
+              ],
+              catalogRevision: listCalls,
+            }),
+          );
+        }
+        if (path === "/api/v1/sources/source-a/oauth/default" && init?.method === "PUT") {
+          saveRequest.signal = init.signal ?? null;
+          return saveResponse.promise;
+        }
+        if (
+          path.startsWith("/api/v1/sources/source-a/oauth/default") &&
+          init?.method === "DELETE"
+        ) {
+          deleteRequest.signal = init.signal ?? null;
+          return deleteResponse.promise;
+        }
+        if (path === "/api/v1/sources/source-a/oauth") {
+          sourceAOAuthLoads += 1;
+          return Promise.resolve(
+            Response.json({
+              connections: [sourceAConnection],
+              availableCredentials: [],
+            }),
+          );
+        }
+        if (path === "/api/v1/sources/source-b/oauth") {
+          return Promise.resolve(emptyOAuthConnections());
+        }
+        if (path === "/api/v1/sources/source-b/refresh" && init?.method === "POST") {
+          sourceBRefreshes += 1;
+          return Promise.resolve(
+            Response.json({
+              sourceId: "source-b",
+              sourceRevision: sourceBRefreshes + 1,
+              catalogRevision: sourceBRefreshes + 1,
+              globalRevision: sourceBRefreshes + 1,
+              activeToolCount: 4,
+              tombstonedToolCount: 0,
+            }),
+          );
+        }
+        if (path === "/api/v1/session" && init?.method === "DELETE") logoutCalls += 1;
+        return Promise.resolve(Response.json({}, { status: 500 }));
+      }),
+    );
+    render(SourcesPageHarness);
+
+    const sourceAHeading = await screen.findByRole("heading", { name: "Source A" });
+    const sourceBHeading = screen.getByRole("heading", { name: "Source B" });
+    const sourceA = within(sourceAHeading.closest("article") ?? document.body);
+    const sourceB = within(sourceBHeading.closest("article") ?? document.body);
+    const scopes = await sourceA.findByLabelText<HTMLInputElement>(/Requested scopes/);
+    const initialOAuthLoads = sourceAOAuthLoads;
+    await fireEvent.input(scopes, { target: { value: "read profile" } });
+    await fireEvent.click(sourceA.getByRole("button", { name: "Save configuration" }));
+    await waitFor(() => expect(saveRequest.signal).not.toBeNull());
+
+    const refreshSourceB = sourceB.getByRole<HTMLButtonElement>("button", {
+      name: "Refresh schema and tools",
+    });
+    await waitFor(() => expect(refreshSourceB.disabled).toBe(false));
+    await fireEvent.click(refreshSourceB);
+    await waitFor(() => expect(listCalls).toBe(2));
+    await new Promise((resolve) => setTimeout(resolve, 0));
+    expect(saveRequest.signal?.aborted).toBe(false);
+    expect(scopes.value).toBe("read profile");
+    expect(sourceAOAuthLoads).toBe(initialOAuthLoads);
+    expect(sourceA.getByRole("button", { name: "Saving..." })).toBeDefined();
+    await expectPendingWriteFence(() => logoutCalls);
+
+    saveResponse.resolve(
+      Response.json({
+        ...sourceAConnection,
+        revision: 2,
+        requestedScopes: ["read", "profile"],
+      }),
+    );
+    expect(await sourceA.findByText(/OAuth configuration saved/)).toBeDefined();
+    await waitFor(() =>
+      expect(screen.queryByText(/source or credential change is still being saved/i)).toBeNull(),
+    );
+
+    await fireEvent.click(sourceA.getByRole("button", { name: "Delete configuration" }));
+    const deleteDialog = sourceA.getByRole("dialog", {
+      name: "Delete this OAuth configuration?",
+    });
+    await fireEvent.click(within(deleteDialog).getByRole("button", { name: "Delete" }));
+    await waitFor(() => expect(deleteRequest.signal).not.toBeNull());
+    await fireEvent.click(refreshSourceB);
+    await waitFor(() => expect(listCalls).toBe(3));
+    expect(deleteRequest.signal?.aborted).toBe(false);
+    expect(sourceAOAuthLoads).toBe(initialOAuthLoads);
+    await expectPendingWriteFence(() => logoutCalls);
+
+    deleteResponse.resolve(new Response(null, { status: 204 }));
+    expect(await sourceA.findByText("OAuth configuration deleted.")).toBeDefined();
+  });
+});
diff --git a/web/src/routes/tokens/+page.svelte b/web/src/routes/tokens/+page.svelte
new file mode 100644
index 000000000..8ade1efea
--- /dev/null
+++ b/web/src/routes/tokens/+page.svelte
@@ -0,0 +1,456 @@
+<script lang="ts">
+  import { beforeNavigate, goto } from "$app/navigation";
+  import { onMount } from "svelte";
+  import DashboardShell from "$lib/DashboardShell.svelte";
+  import ErrorNotice from "$lib/ErrorNotice.svelte";
+  import { useAuthState } from "$lib/auth.svelte";
+  import {
+    createToken,
+    listTokens,
+    revokeToken,
+    type ApiError,
+    type CreatedToken,
+    type TokenMetadata,
+  } from "$lib/api";
+  import { copyText } from "$lib/clipboard";
+  import {
+    canCreateToken,
+    isTokenRecoveryAuthNavigation,
+    shouldBlockTokenExit,
+    tokenExitBlockReason,
+    tokenListView,
+  } from "$lib/token-page-state";
+  import {
+    browserTokenCreateEnvironment,
+    createTokenCreateCoordinator,
+    emptyTokenCreateState,
+    type TokenCreateEnvironment,
+  } from "$lib/token-create-lifecycle";
+  import { focusRevealedToken } from "$lib/token-reveal-focus";
+
+  let {
+    tokenCreateEnvironment = browserTokenCreateEnvironment(),
+  }: { tokenCreateEnvironment?: TokenCreateEnvironment } = $props();
+
+  const auth = useAuthState();
+  const activeControllers = new Set<AbortController>();
+  let name = $state("");
+  let tokens = $state<TokenMetadata[]>([]);
+  let revealed = $state.raw<CreatedToken | null>(null);
+  let tokenField = $state<HTMLInputElement>();
+  let pendingRevoke = $state<TokenMetadata | null>(null);
+  let revokeDialog = $state<HTMLDialogElement>();
+  let loading = $state(true);
+  let hasLoaded = $state(false);
+  let revoking = $state(false);
+  let tokenCreateState = $state(emptyTokenCreateState());
+  let listError = $state<ApiError | null>(null);
+  let mutationError = $state<ApiError | null>(null);
+  let revokeError = $state<ApiError | null>(null);
+  let copyStatus = $state<"idle" | "copied" | "failed">("idle");
+  let exitBlocked = $state(false);
+  let listGeneration = 0;
+  let lifetime = 0;
+  let creating = $derived(tokenCreateState.phase === "dispatching");
+  let hasPendingCreate = $derived(tokenCreateState.phase !== "idle");
+  let hasUnsavedToken = $derived(revealed !== null);
+  let canCreate = $derived(canCreateToken({ name, creating, hasPendingCreate, hasUnsavedToken }));
+  let exitBlockReason = $derived(
+    tokenExitBlockReason({ creating, hasPendingCreate, hasUnsavedToken }),
+  );
+  let listView = $derived(
+    tokenListView({
+      loading,
+      hasLoaded,
+      hasError: listError !== null,
+      tokenCount: tokens.length,
+    }),
+  );
+  let copyMessage = $derived(
+    copyStatus === "copied"
+      ? "Token copied to the clipboard."
+      : copyStatus === "failed"
+        ? "Automatic copy failed. Select the token and copy it manually."
+        : "The token is ready to copy.",
+  );
+  const tokenCreateCoordinator = createTokenCreateCoordinator({
+    environment: {
+      getStorage: () => tokenCreateEnvironment.getStorage(),
+      fillRandom: (bytes) => tokenCreateEnvironment.fillRandom(bytes),
+    },
+    create: (tokenName, key, signal) => createToken(tokenName, key, undefined, signal),
+    onstatechange: (next) => {
+      tokenCreateState = next;
+    },
+    onrevealed: revealCreatedToken,
+  });
+
+  beforeNavigate(({ cancel, to }) => {
+    if (exitBlockReason === null) return;
+    if (
+      isTokenRecoveryAuthNavigation({
+        authenticated: auth.authenticated,
+        destinationPath: to?.url.pathname ?? null,
+      })
+    ) {
+      return;
+    }
+    exitBlocked = true;
+    cancel();
+  });
+
+  onMount(() => {
+    lifetime += 1;
+    void refresh();
+    void recoverPendingToken();
+    return () => {
+      lifetime += 1;
+      listGeneration += 1;
+      tokenCreateCoordinator.dispose();
+      for (const controller of activeControllers) controller.abort();
+      activeControllers.clear();
+    };
+  });
+
+  $effect(() => {
+    const dialog = revokeDialog;
+    const shouldOpen = pendingRevoke !== null;
+    if (dialog === undefined) return;
+
+    if (shouldOpen && !dialog.open) dialog.showModal();
+    if (!shouldOpen && dialog.open) dialog.close();
+
+    return () => {
+      if (dialog.open) dialog.close();
+    };
+  });
+
+  async function refresh() {
+    const mine = ++listGeneration;
+    const owner = lifetime;
+    const controller = startRequest();
+    loading = true;
+    listError = null;
+    const result = await listTokens(undefined, controller.signal);
+    activeControllers.delete(controller);
+    if (mine !== listGeneration || owner !== lifetime) return;
+
+    if (result.ok) {
+      tokens = [...result.value];
+      hasLoaded = true;
+    } else if (!auth.recoverFromApiError(result.error)) {
+      listError = result.error;
+    }
+    loading = false;
+  }
+
+  async function create(event: SubmitEvent) {
+    event.preventDefault();
+    if (!canCreate) return;
+
+    const owner = lifetime;
+    mutationError = null;
+    copyStatus = "idle";
+    exitBlocked = false;
+    const result = await tokenCreateCoordinator.start(name);
+    if (owner !== lifetime) return;
+
+    handleCreateFailure(result);
+  }
+
+  async function recoverPendingToken() {
+    const owner = lifetime;
+    const result = await tokenCreateCoordinator.recoverStored();
+    if (owner !== lifetime || result === null) return;
+    handleCreateFailure(result);
+  }
+
+  async function retryPendingToken() {
+    const owner = lifetime;
+    mutationError = null;
+    const result = await tokenCreateCoordinator.retry();
+    if (owner !== lifetime || result === null) return;
+    handleCreateFailure(result);
+  }
+
+  function handleCreateFailure(result: Awaited<ReturnType<typeof tokenCreateCoordinator.start>>) {
+    if (result.ok) return;
+    if (auth.recoverFromApiError(result.error)) {
+      mutationError = null;
+      return;
+    }
+    mutationError = result.error;
+  }
+
+  function revealCreatedToken(createdToken: CreatedToken) {
+    const owner = lifetime;
+    if (owner === 0) return;
+    revealed = createdToken;
+    name = "";
+    mutationError = null;
+    copyStatus = "idle";
+    void focusRevealedToken({
+      token: createdToken,
+      currentToken: () => revealed,
+      field: () => tokenField,
+      isCurrentLifetime: () => owner === lifetime,
+    });
+  }
+
+  async function copyRevealed() {
+    const current = revealed;
+    const field = tokenField;
+    const owner = lifetime;
+    if (current === null || field === undefined) return;
+
+    const copied = await copyText(current.token, field);
+    if (owner !== lifetime || current !== revealed) return;
+    copyStatus = copied ? "copied" : "failed";
+  }
+
+  async function confirmRevoke() {
+    const token = pendingRevoke;
+    if (token === null) return;
+
+    const owner = lifetime;
+    const controller = startRequest();
+    revoking = true;
+    revokeError = null;
+    const result = await revokeToken(token.id, undefined, controller.signal);
+    activeControllers.delete(controller);
+    if (owner !== lifetime || token !== pendingRevoke) return;
+
+    if (result.ok) {
+      pendingRevoke = null;
+      revoking = false;
+      void refresh();
+      return;
+    }
+    if (!auth.recoverFromApiError(result.error)) revokeError = result.error;
+    revoking = false;
+  }
+
+  function askToRevoke(token: TokenMetadata) {
+    revokeError = null;
+    pendingRevoke = token;
+  }
+
+  function dismissReveal() {
+    const acknowledged = tokenCreateCoordinator.acknowledge();
+    if (!acknowledged.ok) {
+      mutationError = acknowledged.error;
+      return;
+    }
+    revealed = null;
+    copyStatus = "idle";
+    exitBlocked = false;
+    if (!auth.authenticated) {
+      void goto("/login", { replaceState: true });
+      return;
+    }
+    void refresh();
+  }
+
+  function guardBeforeUnload(event: BeforeUnloadEvent) {
+    if (!shouldBlockTokenExit({ creating, hasPendingCreate, hasUnsavedToken })) return;
+    event.preventDefault();
+    event.returnValue = "";
+  }
+
+  function beforeSignOut() {
+    if (exitBlockReason === null) return true;
+    exitBlocked = true;
+    return false;
+  }
+
+  function startRequest() {
+    const controller = new AbortController();
+    activeControllers.add(controller);
+    return controller;
+  }
+
+  function displayDate(timestamp: number | null) {
+    return timestamp === null ? "Never" : new Date(timestamp * 1000).toLocaleString();
+  }
+</script>
+
+<svelte:window onbeforeunload={guardBeforeUnload} />
+
+<DashboardShell
+  title="API tokens"
+  description="Issue gateway credentials without giving agents dashboard access."
+  {beforeSignOut}
+>
+  {#if exitBlocked && exitBlockReason !== null}
+    <p class="notice warning" role="status">
+      {exitBlockReason === "creating"
+        ? "Wait for token creation to finish before leaving this page or signing out."
+        : exitBlockReason === "unsaved-token"
+          ? "Save the token and choose “I saved it” before leaving this page or signing out."
+          : "Recover the pending token request before leaving this page or signing out."}
+    </p>
+  {/if}
+
+  <div class="token-layout">
+    <section class="surface token-form">
+      <p class="eyebrow">New credential</p>
+      <h2>Create an API token</h2>
+      <p>
+        Name it for the device or agent that will use it. All tokens share the enabled tool set.
+      </p>
+      <form onsubmit={create}>
+        <label for="token-name">Token name</label>
+        <input
+          id="token-name"
+          bind:value={name}
+          placeholder="Laptop coding agent"
+          autocomplete="off"
+          required
+          maxlength="80"
+          disabled={creating || hasPendingCreate || hasUnsavedToken}
+          aria-describedby={hasPendingCreate || hasUnsavedToken ? "token-create-help" : undefined}
+        />
+        {#if hasUnsavedToken}
+          <small id="token-create-help">Save the revealed token before creating another.</small>
+        {:else if hasPendingCreate}
+          <small id="token-create-help">Finish recovering the pending token request first.</small>
+        {/if}
+        {#if mutationError !== null}<ErrorNotice error={mutationError} />{/if}
+        {#if tokenCreateState.phase === "blocked" && tokenCreateState.canRetry}
+          <button type="button" onclick={retryPendingToken}>Retry pending token request</button>
+        {/if}
+        <button class="primary" type="submit" disabled={!canCreate}>
+          {creating ? "Creating token..." : "Create token"}
+        </button>
+      </form>
+    </section>
+
+    {#if revealed !== null}
+      <section class="surface reveal-card">
+        <p class="eyebrow">Shown once</p>
+        <h2>Copy this token now.</h2>
+        <label for="revealed-token">API token</label>
+        <input
+          id="revealed-token"
+          class="token-secret"
+          bind:this={tokenField}
+          value={revealed.token}
+          readonly
+          autocomplete="off"
+          spellcheck="false"
+          aria-describedby="token-secret-help copy-status"
+          onfocus={(event) => event.currentTarget.select()}
+        />
+        <p id="token-secret-help">
+          Executor stores only keyed digests. This tab can recover the same secret until you choose
+          “I saved it”.
+        </p>
+        <div class="button-row">
+          <button class="primary" type="button" onclick={copyRevealed}>Copy token</button>
+          <button type="button" onclick={dismissReveal}>I saved it</button>
+        </div>
+        <p id="copy-status" class="copy-status" role="status" aria-live="polite">
+          {copyMessage}
+        </p>
+      </section>
+    {/if}
+  </div>
+
+  {#if listView === "stale" && listError !== null}
+    <div class="stale-notice" role="status">
+      <strong>Showing the last successfully loaded token list.</strong>
+      <ErrorNotice error={listError} />
+    </div>
+  {/if}
+
+  <section class="surface table-card" aria-busy={loading}>
+    <div class="section-heading">
+      <div>
+        <p class="eyebrow">Gateway access</p>
+        <h2>Issued tokens</h2>
+      </div>
+      <button type="button" onclick={refresh} disabled={loading}>
+        {loading && hasLoaded ? "Refreshing..." : "Refresh"}
+      </button>
+    </div>
+
+    {#if listView === "loading"}
+      <p class="table-empty" aria-live="polite">Loading tokens...</p>
+    {:else if listView === "unavailable" && listError !== null}
+      <div class="table-unavailable">
+        <strong>Token list unavailable</strong>
+        <p>We could not load your API tokens. Try again to see which tokens have been issued.</p>
+        <ErrorNotice error={listError} />
+      </div>
+    {:else if listView === "empty"}
+      <p class="table-empty">No API tokens have been issued.</p>
+    {:else if listView === "stale" && tokens.length === 0}
+      <p class="table-empty">The last successful load contained no API tokens.</p>
+    {:else}
+      <div class="table-scroll">
+        <table>
+          <caption>API tokens issued by this Executor instance</caption>
+          <thead>
+            <tr>
+              <th scope="col">Name</th>
+              <th scope="col">Token</th>
+              <th scope="col">Last used</th>
+              <th scope="col">Status</th>
+              <th scope="col">Action</th>
+            </tr>
+          </thead>
+          <tbody>
+            {#each tokens as token (token.id)}
+              <tr>
+                <td data-label="Name">
+                  <strong>{token.name}</strong><small>Created {displayDate(token.createdAt)}</small>
+                </td>
+                <td data-label="Token"><code>{token.maskedToken}</code></td>
+                <td data-label="Last used">{displayDate(token.lastUsedAt)}</td>
+                <td data-label="Status">
+                  <span class:revoked={token.revokedAt !== null} class="status-pill">
+                    {token.revokedAt === null ? "Active" : "Revoked"}
+                  </span>
+                </td>
+                <td data-label="Action">
+                  <button
+                    class="danger-link"
+                    type="button"
+                    disabled={token.revokedAt !== null}
+                    aria-label={`Revoke ${token.name}`}
+                    onclick={() => askToRevoke(token)}>Revoke</button
+                  >
+                </td>
+              </tr>
+            {/each}
+          </tbody>
+        </table>
+      </div>
+    {/if}
+  </section>
+
+  <dialog
+    class="confirm-dialog"
+    bind:this={revokeDialog}
+    aria-labelledby="revoke-title"
+    oncancel={(event) => {
+      if (revoking) event.preventDefault();
+    }}
+    onclose={() => {
+      if (!revoking) pendingRevoke = null;
+    }}
+  >
+    <p class="eyebrow">Revoke credential</p>
+    <h2 id="revoke-title">Stop using {pendingRevoke?.name ?? "this token"}?</h2>
+    <p>Calls using this token will fail immediately. This action cannot be undone.</p>
+    {#if revokeError !== null}<ErrorNotice error={revokeError} />{/if}
+    <div class="button-row dialog-actions">
+      <button type="button" disabled={revoking} onclick={() => (pendingRevoke = null)}>
+        Cancel
+      </button>
+      <button class="danger-button" type="button" disabled={revoking} onclick={confirmRevoke}>
+        {revoking ? "Revoking..." : "Revoke token"}
+      </button>
+    </div>
+  </dialog>
+</DashboardShell>
diff --git a/web/src/routes/tokens/tokens-page.test-harness.svelte b/web/src/routes/tokens/tokens-page.test-harness.svelte
new file mode 100644
index 000000000..7d26bfcf5
--- /dev/null
+++ b/web/src/routes/tokens/tokens-page.test-harness.svelte
@@ -0,0 +1,13 @@
+<script lang="ts">
+  import { createAuthState, provideAuthState } from "$lib/auth.svelte";
+  import type { TokenCreateEnvironment } from "$lib/token-create-lifecycle";
+  import TokensPage from "./+page.svelte";
+
+  let { tokenCreateEnvironment }: { tokenCreateEnvironment?: TokenCreateEnvironment } = $props();
+
+  const auth = createAuthState();
+  Object.defineProperty(auth, "authenticated", { get: () => true });
+  provideAuthState(auth);
+</script>
+
+<TokensPage {tokenCreateEnvironment} />
diff --git a/web/src/routes/tokens/tokens-page.test.ts b/web/src/routes/tokens/tokens-page.test.ts
new file mode 100644
index 000000000..2fe3a5640
--- /dev/null
+++ b/web/src/routes/tokens/tokens-page.test.ts
@@ -0,0 +1,333 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "@effect/vitest";
+import { cleanup, fireEvent, render, screen, waitFor, within } from "@testing-library/svelte";
+import { Effect, Schema } from "effect";
+import { TOKEN_CREATE_STORAGE_KEY, type TokenCreateEnvironment } from "$lib/token-create-lifecycle";
+import TokensPageHarness from "./tokens-page.test-harness.svelte";
+
+const PendingRecordSchema = Schema.Struct({
+  version: Schema.Literal(1),
+  key: Schema.String,
+  name: Schema.String,
+});
+const decodePendingRecord = Schema.decodeUnknownSync(Schema.fromJsonString(PendingRecordSchema));
+const oneTimeSecret = `exr_${"A".repeat(43)}`;
+
+function tokenMetadata(revokedAt: number | null = null) {
+  return {
+    id: "token-1",
+    name: "Laptop agent",
+    maskedToken: "exr_••••••••1234",
+    createdAt: 100,
+    lastUsedAt: null,
+    revokedAt,
+  };
+}
+
+function createdToken(name = "Laptop agent") {
+  return {
+    id: "token-1",
+    name,
+    token: oneTimeSecret,
+    createdAt: 100,
+  };
+}
+
+function noStoreJson(value: unknown, init: ResponseInit = {}) {
+  const headers = new Headers(init.headers);
+  headers.set("cache-control", "no-store");
+  return Response.json(value, { ...init, headers });
+}
+
+function fixedEnvironment(): TokenCreateEnvironment {
+  return {
+    getStorage: () => window.sessionStorage,
+    fillRandom: (bytes) => bytes.fill(0x5a),
+  };
+}
+
+function deferred<Value>() {
+  let resolve = (_value: Value) => {};
+  const promise = new Promise<Value>((complete) => {
+    resolve = complete;
+  });
+  return { promise, resolve };
+}
+
+beforeEach(() => {
+  Object.defineProperty(HTMLDialogElement.prototype, "showModal", {
+    configurable: true,
+    value(this: HTMLDialogElement) {
+      this.open = true;
+    },
+  });
+  Object.defineProperty(HTMLDialogElement.prototype, "close", {
+    configurable: true,
+    value(this: HTMLDialogElement) {
+      this.open = false;
+    },
+  });
+});
+
+afterEach(() => {
+  cleanup();
+  window.sessionStorage.clear();
+  vi.unstubAllGlobals();
+});
+
+describe("API token page delivery safety", () => {
+  it("replays a lost first response with the exact persisted request and never stores the secret", async () => {
+    let listCalls = 0;
+    const creates: Array<{ key: string | null; body: string; keyHeaderCount: number }> = [];
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input, init) => {
+        const path = String(input);
+        if (path === "/api/v1/tokens" && init?.method === "POST") {
+          const headers = new Headers(init.headers);
+          creates.push({
+            key: headers.get("idempotency-key"),
+            body: String(init.body),
+            keyHeaderCount: [...headers.keys()].filter((name) => name === "idempotency-key").length,
+          });
+          if (creates.length === 1) return Effect.runPromise(Effect.fail("response lost"));
+          return Promise.resolve(
+            noStoreJson(createdToken(), {
+              status: 201,
+              headers: { "idempotency-replayed": "true" },
+            }),
+          );
+        }
+        if (path === "/api/v1/tokens") {
+          listCalls += 1;
+          return Promise.resolve(
+            Response.json({ tokens: listCalls === 1 ? [] : [tokenMetadata()] }),
+          );
+        }
+        return Promise.resolve(Response.json({}, { status: 500 }));
+      }),
+    );
+    render(TokensPageHarness, { tokenCreateEnvironment: fixedEnvironment() });
+
+    await screen.findByText("No API tokens have been issued.");
+    await fireEvent.input(screen.getByLabelText("Token name"), {
+      target: { value: "Laptop agent" },
+    });
+    await fireEvent.click(screen.getByRole("button", { name: "Create token" }));
+
+    const secretField = await screen.findByDisplayValue(oneTimeSecret);
+    const stored = window.sessionStorage.getItem(TOKEN_CREATE_STORAGE_KEY);
+    expect(stored).not.toBeNull();
+    expect(stored === null ? null : decodePendingRecord(stored)).toEqual({
+      version: 1,
+      key: "5a".repeat(32),
+      name: "Laptop agent",
+    });
+    expect(stored).not.toContain(oneTimeSecret);
+    expect(creates).toHaveLength(2);
+    expect(creates[0]).toEqual(creates[1]);
+    expect(creates[0]?.key).toMatch(/^[0-9a-f]{64}$/);
+    expect(creates[0]?.keyHeaderCount).toBe(1);
+    expect(screen.getByText(/this tab can recover the same secret/i)).toBeDefined();
+    await waitFor(() => expect(secretField).toBe(document.activeElement));
+
+    await fireEvent.click(screen.getByRole("button", { name: "I saved it" }));
+    await waitFor(() => expect(window.sessionStorage.getItem(TOKEN_CREATE_STORAGE_KEY)).toBeNull());
+    await waitFor(() => expect(listCalls).toBe(2));
+    expect(screen.queryByDisplayValue(oneTimeSecret)).toBeNull();
+  });
+
+  it("automatically recovers a pending record after reload", async () => {
+    const pending = {
+      version: 1,
+      key: "6".repeat(64),
+      name: "Reloaded agent",
+    } as const;
+    window.sessionStorage.setItem(TOKEN_CREATE_STORAGE_KEY, JSON.stringify(pending));
+    const creates: Array<{ key: string | null; body: string }> = [];
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input, init) => {
+        const path = String(input);
+        if (path === "/api/v1/tokens" && init?.method === "POST") {
+          creates.push({
+            key: new Headers(init.headers).get("idempotency-key"),
+            body: String(init.body),
+          });
+          return Promise.resolve(
+            noStoreJson(createdToken(pending.name), {
+              status: 201,
+              headers: { "idempotency-replayed": "true" },
+            }),
+          );
+        }
+        if (path === "/api/v1/tokens") {
+          return Promise.resolve(Response.json({ tokens: [tokenMetadata()] }));
+        }
+        return Promise.resolve(Response.json({}, { status: 500 }));
+      }),
+    );
+
+    render(TokensPageHarness, { tokenCreateEnvironment: fixedEnvironment() });
+
+    expect(await screen.findByDisplayValue(oneTimeSecret)).toBeDefined();
+    expect(creates).toEqual([
+      {
+        key: pending.key,
+        body: JSON.stringify({ name: pending.name }),
+      },
+    ]);
+    expect(window.sessionStorage.getItem(TOKEN_CREATE_STORAGE_KEY)).toBe(JSON.stringify(pending));
+  });
+
+  it("guards unload and sign-out while a pending request is blocked", async () => {
+    let createCalls = 0;
+    let logoutCalls = 0;
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input, init) => {
+        const path = String(input);
+        if (path === "/api/v1/tokens" && init?.method === "POST") {
+          createCalls += 1;
+          return Effect.runPromise(Effect.fail("response lost"));
+        }
+        if (path === "/api/v1/tokens") {
+          return Promise.resolve(Response.json({ tokens: [] }));
+        }
+        if (path === "/api/v1/session" && init?.method === "DELETE") {
+          logoutCalls += 1;
+          return Promise.resolve(new Response(null, { status: 204 }));
+        }
+        return Promise.resolve(Response.json({}, { status: 500 }));
+      }),
+    );
+    render(TokensPageHarness, { tokenCreateEnvironment: fixedEnvironment() });
+
+    await screen.findByText("No API tokens have been issued.");
+    await fireEvent.input(screen.getByLabelText("Token name"), {
+      target: { value: "Blocked agent" },
+    });
+    await fireEvent.click(screen.getByRole("button", { name: "Create token" }));
+    expect(
+      await screen.findByRole("button", { name: "Retry pending token request" }),
+    ).toBeDefined();
+    expect(createCalls).toBe(2);
+    expect(window.sessionStorage.getItem(TOKEN_CREATE_STORAGE_KEY)).not.toBeNull();
+
+    const unload = new Event("beforeunload", { cancelable: true });
+    window.dispatchEvent(unload);
+    expect(unload.defaultPrevented).toBe(true);
+    await fireEvent.click(screen.getByRole("button", { name: "Sign out" }));
+    expect(
+      await screen.findByText(
+        "Recover the pending token request before leaving this page or signing out.",
+      ),
+    ).toBeDefined();
+    expect(logoutCalls).toBe(0);
+    expect(window.sessionStorage.getItem(TOKEN_CREATE_STORAGE_KEY)).not.toBeNull();
+  });
+
+  it("fails closed around an unreadable retained record", async () => {
+    window.sessionStorage.setItem(
+      TOKEN_CREATE_STORAGE_KEY,
+      JSON.stringify({ version: 1, key: "invalid", name: "Unknown agent" }),
+    );
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input) => {
+        if (String(input) === "/api/v1/tokens") {
+          return Promise.resolve(Response.json({ tokens: [] }));
+        }
+        return Promise.resolve(Response.json({}, { status: 500 }));
+      }),
+    );
+    render(TokensPageHarness, { tokenCreateEnvironment: fixedEnvironment() });
+
+    expect(await screen.findByText(/stored token request is invalid/i)).toBeDefined();
+    expect(screen.getByLabelText<HTMLInputElement>("Token name").disabled).toBe(true);
+    expect(screen.getByRole<HTMLButtonElement>("button", { name: "Create token" }).disabled).toBe(
+      true,
+    );
+    const unload = new Event("beforeunload", { cancelable: true });
+    window.dispatchEvent(unload);
+    expect(unload.defaultPrevented).toBe(true);
+    expect(window.sessionStorage.getItem(TOKEN_CREATE_STORAGE_KEY)).not.toBeNull();
+  });
+
+  it("aborts recovery on unmount, ignores the late secret, and retains the pending record", async () => {
+    const pending = {
+      version: 1,
+      key: "8".repeat(64),
+      name: "Unmounted agent",
+    } as const;
+    window.sessionStorage.setItem(TOKEN_CREATE_STORAGE_KEY, JSON.stringify(pending));
+    const response = deferred<Response>();
+    const request = { signal: null as AbortSignal | null };
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input, init) => {
+        const path = String(input);
+        if (path === "/api/v1/tokens" && init?.method === "POST") {
+          request.signal = init.signal ?? null;
+          return response.promise;
+        }
+        if (path === "/api/v1/tokens") {
+          return Promise.resolve(Response.json({ tokens: [] }));
+        }
+        return Promise.resolve(Response.json({}, { status: 500 }));
+      }),
+    );
+    const mounted = render(TokensPageHarness, {
+      tokenCreateEnvironment: fixedEnvironment(),
+    });
+
+    await waitFor(() => expect(request.signal).not.toBeNull());
+    mounted.unmount();
+    expect(request.signal?.aborted).toBe(true);
+    response.resolve(
+      noStoreJson(createdToken(pending.name), {
+        status: 201,
+        headers: { "idempotency-replayed": "true" },
+      }),
+    );
+    await response.promise;
+    await Promise.resolve();
+    await Promise.resolve();
+
+    expect(screen.queryByDisplayValue(oneTimeSecret)).toBeNull();
+    expect(window.sessionStorage.getItem(TOKEN_CREATE_STORAGE_KEY)).toBe(JSON.stringify(pending));
+  });
+
+  it("retries one ambiguous revoke and refreshes the revoked row", async () => {
+    let listCalls = 0;
+    let revokeCalls = 0;
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input, init) => {
+        const path = String(input);
+        if (path === "/api/v1/tokens") {
+          listCalls += 1;
+          return Promise.resolve(
+            Response.json({ tokens: [tokenMetadata(listCalls === 1 ? null : 200)] }),
+          );
+        }
+        if (path === "/api/v1/tokens/token-1" && init?.method === "DELETE") {
+          revokeCalls += 1;
+          return revokeCalls === 1
+            ? Effect.runPromise(Effect.fail("response lost"))
+            : Promise.resolve(new Response(null, { status: 204 }));
+        }
+        return Promise.resolve(Response.json({}, { status: 500 }));
+      }),
+    );
+    render(TokensPageHarness, { tokenCreateEnvironment: fixedEnvironment() });
+
+    const revoke = await screen.findByRole("button", { name: "Revoke Laptop agent" });
+    await fireEvent.click(revoke);
+    const dialog = await screen.findByRole("dialog", { name: "Stop using Laptop agent?" });
+    await fireEvent.click(within(dialog).getByRole("button", { name: "Revoke token" }));
+
+    await waitFor(() => expect(revokeCalls).toBe(2));
+    await waitFor(() => expect(listCalls).toBe(2));
+    expect(await screen.findByText("Revoked")).toBeDefined();
+  });
+});
diff --git a/web/src/routes/tools/+page.svelte b/web/src/routes/tools/+page.svelte
new file mode 100644
index 000000000..75902d07e
--- /dev/null
+++ b/web/src/routes/tools/+page.svelte
@@ -0,0 +1,855 @@
+<script lang="ts">
+  import { goto } from "$app/navigation";
+  import { page } from "$app/state";
+  import { tick, untrack } from "svelte";
+  import DashboardShell from "$lib/DashboardShell.svelte";
+  import ErrorNotice from "$lib/ErrorNotice.svelte";
+  import { useAuthState } from "$lib/auth.svelte";
+  import {
+    bulkSetToolModes,
+    getTool,
+    listSources,
+    listTools,
+    setToolMode,
+    type ApiError,
+    type SourceList,
+    type ToolMode,
+    type ToolPage,
+    type ToolRecord,
+  } from "$lib/api";
+  import {
+    beginIdentityResourceLoad,
+    beginResourceLoad,
+    createLatestRequest,
+    emptyResource,
+    modeLabel,
+    provenanceLabel,
+    settleResourceLoad,
+    toolModes,
+    unexpectedRequestError,
+  } from "$lib/catalog-state";
+  import { parseToolsUrl, toolsListKey, toolsUrl } from "$lib/catalog-url";
+  import {
+    broadConfirmationText,
+    bulkActionLabel,
+    inheritLabel,
+    modeName,
+    requiresBroadConfirmation,
+  } from "$lib/catalog-ux";
+
+  const auth = useAuthState();
+  const pageRequest = createLatestRequest();
+  const sourceRequest = createLatestRequest();
+  const detailRequest = createLatestRequest();
+  let searchKey = $derived(page.url.search);
+  let urlState = $derived(parseToolsUrl(new URLSearchParams(searchKey)));
+  let listSearch = $derived(toolsUrl(urlState, { tool: null }));
+  let listKey = $derived(toolsListKey(urlState));
+  let resource = $state(emptyResource<ToolPage>());
+  let listIdentity = $state<string | null>(null);
+  let sources = $state(emptyResource<SourceList>());
+  let detail = $state(emptyResource<ToolRecord>());
+  let detailIdentity = $state<string | null>(null);
+  let refreshKey = $state(0);
+  let detailRefreshKey = $state(0);
+  let selected = $state<string[]>([]);
+  let pending = $state<string[]>([]);
+  let mutationErrors = $state<Record<string, ApiError>>({});
+  let conflictNotice = $state<string | null>(null);
+  let bulkNotice = $state<string | null>(null);
+  let bulkMode = $state<ToolMode>("ask");
+  let confirmingBulk = $state<{
+    mode: ToolMode | null;
+    ids: string[];
+    catalogRevision: number;
+    enabledByInheritanceIds: string[];
+  } | null>(null);
+  let displayedSelection = $derived(confirmingBulk?.ids ?? selected);
+  let activeToolIds = $derived(
+    resource.data?.items.filter((tool) => tool.present).map((tool) => tool.id) ?? [],
+  );
+  let selectedActiveCount = $derived(
+    activeToolIds.filter((id) => displayedSelection.includes(id)).length,
+  );
+  let allActiveToolsSelected = $derived(
+    activeToolIds.length > 0 && selectedActiveCount === activeToolIds.length,
+  );
+  let selectionLocked = $derived(
+    resource.loading || pending.includes("bulk") || confirmingBulk !== null,
+  );
+  let viewportWidth = $state(641);
+  let mobileToolsLayout = $derived(viewportWidth <= 640);
+  let searchInput = $state<HTMLInputElement>();
+  let searchForm = $state<HTMLFormElement>();
+  let selectAllInput = $state<HTMLInputElement>();
+  let bulkBar = $state<HTMLElement>();
+  let bulkConfirmationOpener = $state<HTMLButtonElement>();
+  let detailReturnId = $state<string | null>(null);
+  const mutationControllers = new Map<string, AbortController>();
+
+  $effect(() => {
+    const identity = listKey;
+    const search = listSearch;
+    const requestKey = `${identity}\u0000${refreshKey}`;
+    const parameters = new URL(search, "http://executor.local").searchParams;
+    const filters = parseToolsUrl(parameters);
+    const started = beginIdentityResourceLoad(
+      untrack(() => resource),
+      untrack(() => listIdentity),
+      identity,
+    );
+    if (untrack(() => listIdentity) !== identity) {
+      selected = [];
+      confirmingBulk = null;
+      bulkConfirmationOpener = undefined;
+    }
+    listIdentity = started.identity;
+    resource = started.state;
+    return pageRequest.start(
+      async (signal) => ({
+        requestKey,
+        result: await listTools(
+          {
+            query: filters.q,
+            sourceId: filters.source ?? undefined,
+            mode: filters.mode ?? undefined,
+            includeTombstoned: filters.removed,
+            limit: 50,
+            offset: filters.offset,
+          },
+          undefined,
+          signal,
+        ),
+      }),
+      ({ requestKey: completedKey, result }) => {
+        if (completedKey !== `${listKey}\u0000${refreshKey}`) return;
+        if (!result.ok && auth.recoverFromApiError(result.error)) return;
+        resource = settleResourceLoad(resource, result);
+        if (result.ok) {
+          const visible = new Set(
+            result.value.items.filter((tool) => tool.present).map((tool) => tool.id),
+          );
+          selected = selected.filter((id) => visible.has(id));
+        }
+      },
+      () => {
+        resource = settleResourceLoad(resource, {
+          ok: false,
+          error: unexpectedRequestError(),
+        });
+      },
+    );
+  });
+
+  $effect(() => {
+    const toolId = urlState.tool;
+    const returnId = untrack(() => detailReturnId);
+    void tick().then(() => {
+      if (toolId !== null) {
+        document.getElementById("tool-detail-panel")?.focus();
+      } else if (returnId !== null) {
+        document.getElementById(`inspect-tool-${returnId}`)?.focus();
+        detailReturnId = null;
+      }
+    });
+  });
+
+  $effect(() => {
+    const requestKey = String(refreshKey);
+    sources = beginResourceLoad(untrack(() => sources));
+    return sourceRequest.start(
+      async (signal) => ({ requestKey, result: await listSources(undefined, signal) }),
+      ({ requestKey: completedKey, result }) => {
+        if (completedKey !== String(refreshKey)) return;
+        if (!result.ok && auth.recoverFromApiError(result.error)) return;
+        sources = settleResourceLoad(sources, result);
+      },
+      () => {
+        sources = settleResourceLoad(sources, {
+          ok: false,
+          error: unexpectedRequestError(),
+        });
+      },
+    );
+  });
+
+  $effect(() => {
+    const toolId = urlState.tool;
+    const requestKey = `${toolId ?? ""}\u0000${refreshKey}\u0000${detailRefreshKey}`;
+    if (toolId === null) {
+      detail = { ...emptyResource<ToolRecord>(), loading: false };
+      detailIdentity = null;
+      return;
+    }
+    const started = beginIdentityResourceLoad(
+      untrack(() => detail),
+      untrack(() => detailIdentity),
+      toolId,
+    );
+    detailIdentity = started.identity;
+    detail = started.state;
+    return detailRequest.start(
+      async (signal) => ({ requestKey, result: await getTool(toolId, undefined, signal) }),
+      ({ requestKey: completedKey, result }) => {
+        if (completedKey !== `${urlState.tool ?? ""}\u0000${refreshKey}\u0000${detailRefreshKey}`)
+          return;
+        if (!result.ok && auth.recoverFromApiError(result.error)) return;
+        detail = settleResourceLoad(detail, result, { retainDataOnError: false });
+      },
+      () => {
+        detail = settleResourceLoad(
+          detail,
+          { ok: false, error: unexpectedRequestError() },
+          { retainDataOnError: false },
+        );
+      },
+    );
+  });
+
+  $effect(() => () => {
+    for (const controller of mutationControllers.values()) controller.abort();
+  });
+
+  $effect(() => {
+    const input = selectAllInput;
+    if (input !== undefined)
+      input.indeterminate = selectedActiveCount > 0 && selectedActiveCount < activeToolIds.length;
+  });
+
+  async function changeToolMode(
+    tool: ToolRecord | ToolPage["items"][number],
+    mode: ToolMode | null,
+  ) {
+    if (confirmingBulk !== null || pending.includes("bulk") || resource.loading) return;
+    const controller = beginMutation(tool.id);
+    conflictNotice = null;
+    const result = await setToolMode(tool.id, mode, tool.revision, undefined, controller.signal);
+    if (!finishMutation(tool.id, controller)) return;
+    if (!result.ok) {
+      handleMutationError(tool.id, result.error);
+      return;
+    }
+    refreshKey += 1;
+  }
+
+  async function applyBulkMode(
+    mode: ToolMode | null,
+    ids: string[],
+    expectedCatalogRevision: number,
+  ) {
+    if (ids.length === 0 || resource.data === null || resource.loading || pending.includes("bulk"))
+      return;
+    const controller = beginMutation("bulk");
+    conflictNotice = null;
+    bulkNotice = null;
+    const result = await bulkSetToolModes(
+      ids.slice(0, 200),
+      mode,
+      expectedCatalogRevision,
+      undefined,
+      controller.signal,
+    );
+    if (!finishMutation("bulk", controller)) return;
+    if (!result.ok) {
+      handleMutationError("bulk", result.error);
+      return;
+    }
+    confirmingBulk = null;
+    bulkConfirmationOpener = undefined;
+    bulkNotice = `${mode === null ? "Inherit" : modeName(mode)} applied to ${ids.length} selected ${ids.length === 1 ? "tool" : "tools"}.`;
+    selected = [];
+    refreshKey += 1;
+    await tick();
+    document.getElementById("bulk-status")?.focus();
+  }
+
+  function requestBulkMode(mode: ToolMode | null, opener: HTMLButtonElement) {
+    if (
+      confirmingBulk !== null ||
+      selected.length === 0 ||
+      resource.data === null ||
+      resource.loading ||
+      pending.length > 0 ||
+      (mode === null && inheritModeUnavailable(selected))
+    )
+      return;
+    const snapshot = {
+      mode,
+      ids: selected.slice(0, 200),
+      catalogRevision: resource.data.catalogRevision,
+    };
+    const enabledByInheritanceIds = mode === null ? inheritedEnablingIds(snapshot.ids) : [];
+    if ((mode !== null && requiresBroadConfirmation(mode)) || enabledByInheritanceIds.length > 0) {
+      confirmingBulk = { ...snapshot, enabledByInheritanceIds };
+      bulkConfirmationOpener = opener;
+      void tick().then(() => document.getElementById("cancel-bulk-mode")?.focus());
+      return;
+    }
+    void applyBulkMode(mode, snapshot.ids, snapshot.catalogRevision);
+  }
+
+  function confirmBulkMode() {
+    const confirmation = confirmingBulk;
+    if (confirmation === null) return;
+    void applyBulkMode(confirmation.mode, confirmation.ids, confirmation.catalogRevision);
+  }
+
+  async function cancelBulkConfirmation() {
+    const opener = bulkConfirmationOpener;
+    confirmingBulk = null;
+    bulkConfirmationOpener = undefined;
+    await tick();
+    if (opener !== undefined && !opener.disabled) {
+      opener.focus();
+    } else {
+      bulkBar?.focus();
+    }
+  }
+
+  function inheritedMode(tool: ToolPage["items"][number]) {
+    if (tool.modeOverride === null) return tool.effectiveMode.mode;
+    if (sources.loading || sources.error !== null || sources.data === null) return null;
+    const source = sources.data.sources.find((candidate) => candidate.id === tool.sourceId);
+    if (source === undefined) return null;
+    return source.modeOverride ?? tool.intrinsicMode;
+  }
+
+  function inheritModeUnavailable(ids: string[]) {
+    return (
+      resource.data?.items.some(
+        (tool) =>
+          ids.includes(tool.id) && tool.modeOverride !== null && inheritedMode(tool) === null,
+      ) ?? false
+    );
+  }
+
+  function inheritedEnablingIds(ids: string[]) {
+    return (
+      resource.data?.items
+        .filter(
+          (tool) =>
+            ids.includes(tool.id) &&
+            tool.effectiveMode.mode !== "enabled" &&
+            inheritedMode(tool) === "enabled",
+        )
+        .map((tool) => tool.id) ?? []
+    );
+  }
+
+  function bulkConfirmationText(confirmation: NonNullable<typeof confirmingBulk>) {
+    if (confirmation.mode !== null) {
+      return broadConfirmationText(confirmation.mode, confirmation.ids.length);
+    }
+    const selectedNoun = confirmation.ids.length === 1 ? "tool" : "tools";
+    const transitionCount = confirmation.enabledByInheritanceIds.length;
+    const transition =
+      transitionCount === 1
+        ? "1 tool will become Enabled under its source default."
+        : `${transitionCount} tools will become Enabled under their source defaults.`;
+    return `Inherit ${confirmation.ids.length} selected ${selectedNoun}? ${transition}`;
+  }
+
+  function bulkConfirmationModeName(mode: ToolMode | null) {
+    return mode === null ? "Inherit" : modeName(mode);
+  }
+
+  function handleMutationError(id: string, error: ApiError) {
+    if (auth.recoverFromApiError(error)) return;
+    if (error.status === 409) {
+      conflictNotice = "Tool settings changed elsewhere. The latest catalog is shown for review.";
+      if (id === "bulk") {
+        confirmingBulk = null;
+        bulkConfirmationOpener = undefined;
+      }
+      refreshKey += 1;
+      void tick().then(() => document.getElementById("tool-conflict")?.focus());
+    } else {
+      mutationErrors = { ...mutationErrors, [id]: error };
+    }
+  }
+
+  function beginMutation(id: string) {
+    mutationControllers.get(id)?.abort();
+    const controller = new AbortController();
+    mutationControllers.set(id, controller);
+    pending = [...new Set([...pending, id])];
+    const { [id]: _removed, ...rest } = mutationErrors;
+    mutationErrors = rest;
+    return controller;
+  }
+
+  function finishMutation(id: string, controller: AbortController) {
+    if (mutationControllers.get(id) !== controller || controller.signal.aborted) return false;
+    mutationControllers.delete(id);
+    pending = pending.filter((candidate) => candidate !== id);
+    return true;
+  }
+
+  function toggleSelected(id: string, checked: boolean) {
+    if (selectionLocked) return;
+    selected = checked
+      ? [...new Set([...selected, id])].slice(0, 200)
+      : selected.filter((candidate) => candidate !== id);
+  }
+
+  function toggleCurrentPage(checked: boolean) {
+    if (selectionLocked) return;
+    const visible =
+      resource.data?.items.filter((tool) => tool.present).map((tool) => tool.id) ?? [];
+    selected = checked ? visible.slice(0, 200) : selected.filter((id) => !visible.includes(id));
+  }
+
+  function submitFilters(event: Event) {
+    const form = event.currentTarget as HTMLFormElement;
+    const data = new FormData(form);
+    const next = {
+      ...urlState,
+      q: String(data.get("q") ?? "").slice(0, 256),
+      source: String(data.get("source") ?? "") || null,
+      mode: (String(data.get("mode") ?? "") || null) as ToolMode | null,
+      removed: data.get("removed") === "1",
+      offset: 0,
+      tool: null,
+    };
+    event.preventDefault();
+    void goto(toolsUrl(next), { keepFocus: true, noScroll: true });
+  }
+
+  function handleShortcut(event: KeyboardEvent) {
+    const target = event.target;
+    const editable =
+      target instanceof HTMLInputElement ||
+      target instanceof HTMLTextAreaElement ||
+      target instanceof HTMLSelectElement ||
+      (target instanceof HTMLElement && target.isContentEditable);
+    if (event.key === "/" && !editable) {
+      event.preventDefault();
+      searchInput?.focus();
+    } else if (
+      event.key === "Escape" &&
+      document.activeElement === searchInput &&
+      searchInput?.value
+    ) {
+      searchInput.value = "";
+      searchForm?.requestSubmit();
+    }
+  }
+
+  function detailUrl(toolId: string | null) {
+    return toolsUrl(urlState, { tool: toolId });
+  }
+</script>
+
+<svelte:window bind:innerWidth={viewportWidth} onkeydown={handleShortcut} />
+
+<DashboardShell title="Tools" description="Find and control the capabilities agents can use.">
+  <form class="surface filter-bar" method="GET" bind:this={searchForm} onsubmit={submitFilters}>
+    <label class="search-field">
+      Search tools
+      <input
+        bind:this={searchInput}
+        name="q"
+        value={urlState.q}
+        placeholder="Name, path, or description"
+      />
+    </label>
+    <label>
+      Source
+      <select
+        name="source"
+        value={urlState.source ?? ""}
+        onchange={() => searchForm?.requestSubmit()}
+      >
+        <option value="">All sources</option>
+        {#each sources.data?.sources ?? [] as source (source.id)}
+          <option value={source.id}>{source.displayName}</option>
+        {/each}
+        {#if urlState.source !== null && !sources.data?.sources.some((source) => source.id === urlState.source)}
+          <option value={urlState.source}>Current source ({urlState.source})</option>
+        {/if}
+      </select>
+    </label>
+    <label>
+      Effective mode
+      <select name="mode" value={urlState.mode ?? ""} onchange={() => searchForm?.requestSubmit()}>
+        <option value="">All modes</option>
+        {#each toolModes as mode}<option value={mode}>{modeLabel(mode)}</option>{/each}
+      </select>
+    </label>
+    <label class="checkbox-label">
+      <input
+        type="checkbox"
+        name="removed"
+        value="1"
+        checked={urlState.removed}
+        onchange={() => searchForm?.requestSubmit()}
+      />
+      Include removed
+    </label>
+    <button type="submit" class="primary">Search</button>
+  </form>
+  {#if sources.error !== null}
+    <div class="notice warning" role="status">
+      Source names could not be loaded. The active source filter is still applied.
+    </div>
+  {/if}
+
+  <section class="surface mode-semantics" aria-labelledby="mode-semantics-title">
+    <div>
+      <p class="eyebrow">Behavior semantics</p>
+      <h2 id="mode-semantics-title">How tool modes work</h2>
+    </div>
+    <dl>
+      <div>
+        <dt>Inherit</dt>
+        <dd>Follow the source default, then the tool's built-in default.</dd>
+      </div>
+      <div>
+        <dt>Enabled</dt>
+        <dd>Available without interactive approval.</dd>
+      </div>
+      <div>
+        <dt>Ask</dt>
+        <dd>Require interactive approval before execution.</dd>
+      </div>
+      <div>
+        <dt>Disabled</dt>
+        <dd>Unavailable to gateway callers.</dd>
+      </div>
+    </dl>
+  </section>
+
+  {#if conflictNotice !== null}<div
+      id="tool-conflict"
+      class="notice warning"
+      role="status"
+      tabindex="-1"
+    >
+      {conflictNotice}
+    </div>{/if}
+  {#if resource.stale && resource.error !== null}
+    <div class="stale-notice" role="status">
+      Showing the last loaded tool page while Executor reconnects.
+      <ErrorNotice error={resource.error} />
+    </div>
+  {:else if resource.error !== null}
+    <section class="surface table-unavailable">
+      <ErrorNotice error={resource.error} />
+      <button type="button" onclick={() => (refreshKey += 1)}>Try again</button>
+    </section>
+  {/if}
+
+  {#if resource.data !== null}
+    <section
+      bind:this={bulkBar}
+      class="surface bulk-bar"
+      aria-label="Bulk tool behavior"
+      tabindex="-1"
+    >
+      <div>
+        <strong>{displayedSelection.length} selected on this page</strong>
+        <small
+          >Bulk changes use catalog revision {confirmingBulk?.catalogRevision ??
+            resource.data.catalogRevision}.</small
+        >
+      </div>
+      <fieldset
+        class="mode-control compact"
+        disabled={resource.loading ||
+          selected.length === 0 ||
+          pending.length > 0 ||
+          confirmingBulk !== null}
+      >
+        <legend>Set selected tools</legend>
+        {#each toolModes as mode}
+          <label
+            ><input type="radio" name="bulk-mode" value={mode} bind:group={bulkMode} />{modeLabel(
+              mode,
+            )}</label
+          >
+        {/each}
+      </fieldset>
+      <div class="button-row">
+        <button
+          id="bulk-apply-mode"
+          type="button"
+          class:primary={bulkMode === "enabled"}
+          class:danger-button={bulkMode === "disabled"}
+          disabled={resource.loading ||
+            selected.length === 0 ||
+            pending.length > 0 ||
+            confirmingBulk !== null}
+          onclick={(event) => requestBulkMode(bulkMode, event.currentTarget)}
+          >{bulkActionLabel(bulkMode, displayedSelection.length)}</button
+        >
+        <button
+          type="button"
+          disabled={resource.loading ||
+            selected.length === 0 ||
+            pending.length > 0 ||
+            inheritModeUnavailable(selected) ||
+            confirmingBulk !== null}
+          onclick={(event) => requestBulkMode(null, event.currentTarget)}
+          >{bulkActionLabel(null, displayedSelection.length)}</button
+        >
+      </div>
+      {#if confirmingBulk !== null}
+        <div
+          class="inline-confirm bulk-confirm"
+          role="group"
+          aria-label="Confirm bulk tool behavior"
+        >
+          <strong>{bulkConfirmationText(confirmingBulk)}</strong>
+          <button
+            id="cancel-bulk-mode"
+            type="button"
+            disabled={pending.includes("bulk")}
+            onkeydown={(event) => {
+              if (event.key === "Escape") void cancelBulkConfirmation();
+            }}
+            onclick={cancelBulkConfirmation}>Cancel</button
+          >
+          <button
+            type="button"
+            class:primary={confirmingBulk.mode === "enabled" || confirmingBulk.mode === null}
+            class:danger-button={confirmingBulk.mode === "disabled"}
+            disabled={pending.includes("bulk")}
+            onkeydown={(event) => {
+              if (event.key === "Escape") void cancelBulkConfirmation();
+            }}
+            onclick={confirmBulkMode}
+            >Confirm {bulkConfirmationModeName(confirmingBulk.mode)}</button
+          >
+        </div>
+      {/if}
+      {#if bulkNotice !== null}<div id="bulk-status" class="notice" role="status" tabindex="-1">
+          {bulkNotice}
+        </div>{/if}
+      {#if mutationErrors.bulk !== undefined}<ErrorNotice error={mutationErrors.bulk} />{/if}
+    </section>
+  {/if}
+
+  <section class="surface table-card" aria-busy={resource.loading}>
+    <div class="section-heading">
+      <div>
+        <p class="eyebrow">Global tool set</p>
+        <h2>{resource.data?.total ?? 0} tools</h2>
+      </div>
+      {#if resource.loading}<span class="muted-status" role="status">Refreshing...</span>{/if}
+    </div>
+    {#if resource.data === null && resource.loading}
+      <div class="loading-panel" aria-live="polite">Loading tools...</div>
+    {:else if resource.data !== null && resource.data.items.length === 0}
+      <div class="table-empty">
+        <p>No tools match this page or filter set.</p>
+        {#if urlState.offset > 0}
+          <div class="button-row empty-recovery">
+            <a
+              class="button-link"
+              href={toolsUrl(urlState, { offset: Math.max(0, urlState.offset - 50), tool: null })}
+              >Previous page</a
+            >
+            <a class="button-link" href={toolsUrl(urlState, { offset: 0, tool: null })}
+              >First page</a
+            >
+          </div>
+        {/if}
+      </div>
+    {:else if resource.data !== null}
+      {#if mobileToolsLayout}
+        <label class="checkbox-label mobile-select-all">
+          <input
+            bind:this={selectAllInput}
+            aria-label="Select all active tools on this page"
+            type="checkbox"
+            disabled={selectionLocked}
+            checked={allActiveToolsSelected}
+            onchange={(event) => toggleCurrentPage(event.currentTarget.checked)}
+          />
+          Select all active tools on this page
+        </label>
+      {/if}
+      <div class="table-scroll">
+        <table>
+          <caption>Only tools on this page are included in bulk changes.</caption>
+          <thead
+            ><tr>
+              <th scope="col">
+                {#if !mobileToolsLayout}
+                  <input
+                    bind:this={selectAllInput}
+                    aria-label="Select all active tools on this page"
+                    type="checkbox"
+                    disabled={selectionLocked}
+                    checked={allActiveToolsSelected}
+                    onchange={(event) => toggleCurrentPage(event.currentTarget.checked)}
+                  />
+                {/if}
+              </th>
+              <th scope="col">Tool</th><th scope="col">Behavior</th><th scope="col">Details</th>
+            </tr></thead
+          >
+          <tbody>
+            {#each resource.data.items as tool (tool.id)}
+              {@const inherited = inheritedMode(tool)}
+              <tr class:removed-row={!tool.present}>
+                <td data-label="Select">
+                  <input
+                    aria-label={`Select ${tool.displayName}`}
+                    type="checkbox"
+                    disabled={selectionLocked || !tool.present}
+                    checked={displayedSelection.includes(tool.id)}
+                    onchange={(event) => toggleSelected(tool.id, event.currentTarget.checked)}
+                  />
+                </td>
+                <td data-label="Tool">
+                  <strong>{tool.displayName}</strong>
+                  <code>{tool.callablePath}</code>
+                  <small>{tool.sourceSlug}{tool.description ? ` · ${tool.description}` : ""}</small>
+                  {#if !tool.present}<span class="status-pill revoked">Removed</span>{/if}
+                </td>
+                <td data-label="Behavior">
+                  <fieldset
+                    class="mode-control row-modes"
+                    disabled={resource.loading ||
+                      !tool.present ||
+                      pending.includes(tool.id) ||
+                      pending.includes("bulk") ||
+                      confirmingBulk !== null}
+                  >
+                    <legend class="visually-hidden">Behavior for {tool.displayName}</legend>
+                    <label
+                      title={inherited === null
+                        ? "Source default is not available yet"
+                        : inheritLabel(inherited)}
+                    >
+                      <input
+                        type="radio"
+                        name={`tool-${tool.id}`}
+                        checked={tool.modeOverride === null}
+                        disabled={inherited === null}
+                        onchange={() => changeToolMode(tool, null)}
+                      />
+                      {inherited === null
+                        ? sources.loading
+                          ? "Inherit (loading source default)"
+                          : "Inherit (source default unavailable)"
+                        : inheritLabel(inherited)}
+                    </label>
+                    {#each toolModes as mode}
+                      <label title={modeLabel(mode)}>
+                        <input
+                          type="radio"
+                          name={`tool-${tool.id}`}
+                          checked={tool.modeOverride === mode}
+                          onchange={() => changeToolMode(tool, mode)}
+                        />
+                        {modeName(mode)}
+                      </label>
+                    {/each}
+                  </fieldset>
+                  <small>{provenanceLabel(tool.effectiveMode.provenance)}</small>
+                  {#if mutationErrors[tool.id] !== undefined}<ErrorNotice
+                      error={mutationErrors[tool.id]}
+                    />{/if}
+                </td>
+                <td data-label="Details"
+                  ><a
+                    id={`inspect-tool-${tool.id}`}
+                    class="detail-link"
+                    href={detailUrl(tool.id)}
+                    onclick={() => (detailReturnId = tool.id)}>Inspect</a
+                  ></td
+                >
+              </tr>
+            {/each}
+          </tbody>
+        </table>
+      </div>
+      <nav class="pagination" aria-label="Tool pages">
+        {#if urlState.offset > 0}
+          <a href={toolsUrl(urlState, { offset: Math.max(0, urlState.offset - 50), tool: null })}
+            >Newer page</a
+          >
+        {:else}<span></span>{/if}
+        <span
+          >{urlState.offset + 1}–{Math.min(
+            urlState.offset + resource.data.items.length,
+            resource.data.total,
+          )} of {resource.data.total}</span
+        >
+        {#if resource.data.hasMore && resource.data.nextOffset !== null}
+          <a href={toolsUrl(urlState, { offset: resource.data.nextOffset, tool: null })}
+            >Older page</a
+          >
+        {/if}
+      </nav>
+    {/if}
+  </section>
+
+  {#if urlState.tool !== null}
+    <aside
+      id="tool-detail-panel"
+      class="surface detail-panel"
+      aria-labelledby="tool-detail-title"
+      aria-busy={detail.loading}
+      tabindex="-1"
+    >
+      <div class="section-heading">
+        <div>
+          <p class="eyebrow">Tool detail</p>
+          <h2 id="tool-detail-title">{detail.data?.displayName ?? "Loading..."}</h2>
+        </div>
+        <a class="button-link" href={detailUrl(null)}>Close details</a>
+      </div>
+      {#if detail.error !== null}<div class="detail-body">
+          <ErrorNotice error={detail.error} />
+          <button type="button" onclick={() => (detailRefreshKey += 1)}>Retry details</button>
+        </div>
+      {:else if detail.loading && detail.data === null}<div class="loading-panel" role="status">
+          Loading tool detail...
+        </div>
+      {:else if detail.data !== null}
+        <div class="detail-body">
+          {#if detail.loading}<p class="muted-status" role="status">
+              Refreshing tool detail...
+            </p>{/if}
+          <dl class="detail-list">
+            <div>
+              <dt>Callable path</dt>
+              <dd><code>{detail.data.callablePath}</code></dd>
+            </div>
+            <div>
+              <dt>Sandbox path</dt>
+              <dd><code>{detail.data.sandboxPath}</code></dd>
+            </div>
+            <div>
+              <dt>Effective behavior</dt>
+              <dd>
+                {modeLabel(detail.data.effectiveMode.mode)} · {provenanceLabel(
+                  detail.data.effectiveMode.provenance,
+                )}
+              </dd>
+            </div>
+          </dl>
+          <h3>Input schema</h3>
+          <pre>{JSON.stringify(detail.data.inputSchema, null, 2)}</pre>
+          {#if detail.data.outputSchema !== null}
+            <h3>Output schema</h3>
+            <pre>{JSON.stringify(detail.data.outputSchema, null, 2)}</pre>
+          {/if}
+        </div>
+      {/if}
+    </aside>
+  {/if}
+</DashboardShell>
+
+<style>
+  .mobile-select-all {
+    margin: 0.85rem 1.2rem 0;
+    border: 1px solid #30394c;
+    border-radius: 10px;
+    padding: 0.7rem 0.8rem;
+    background: #0d131d;
+  }
+</style>
diff --git a/web/src/routes/tools/tools-page.test-harness.svelte b/web/src/routes/tools/tools-page.test-harness.svelte
new file mode 100644
index 000000000..8f1b76655
--- /dev/null
+++ b/web/src/routes/tools/tools-page.test-harness.svelte
@@ -0,0 +1,8 @@
+<script lang="ts">
+  import { createAuthState, provideAuthState } from "$lib/auth.svelte";
+  import ToolsPage from "./+page.svelte";
+
+  provideAuthState(createAuthState());
+</script>
+
+<ToolsPage />
diff --git a/web/src/routes/tools/tools-page.test.ts b/web/src/routes/tools/tools-page.test.ts
new file mode 100644
index 000000000..fac402d6f
--- /dev/null
+++ b/web/src/routes/tools/tools-page.test.ts
@@ -0,0 +1,608 @@
+import { afterEach, describe, expect, it, vi } from "@effect/vitest";
+import { cleanup, fireEvent, render, screen, waitFor, within } from "@testing-library/svelte";
+import type { SourceList, ToolPage, ToolRecord } from "$lib/api";
+import ToolsPageHarness from "./tools-page.test-harness.svelte";
+
+const catalogRevision = 37;
+
+function toolFixture(id: string, displayName: string) {
+  return {
+    id,
+    sourceId: "source-1",
+    sourceSlug: "product-api",
+    stableKey: id,
+    localName: id,
+    callablePath: `tools.product_api.${id}`,
+    sandboxPath: `tools.product_api.${id}`,
+    displayName,
+    description: null,
+    intrinsicMode: "ask",
+    modeOverride: null,
+    effectiveMode: { mode: "ask", provenance: "intrinsic" },
+    present: true,
+    revision: 3,
+    createdAt: 100,
+    updatedAt: 100,
+    lastSeenAt: 100,
+    tombstonedAt: null,
+  } satisfies ToolPage["items"][number];
+}
+
+const alphaTool = toolFixture("tool-a", "Alpha tool");
+const tools = [alphaTool, toolFixture("tool-b", "Beta tool"), toolFixture("tool-c", "Gamma tool")];
+
+function toolRecordFixture(tool: ToolPage["items"][number], mode: ToolRecord["modeOverride"]) {
+  return {
+    ...tool,
+    modeOverride: mode,
+    effectiveMode: {
+      mode: mode ?? tool.intrinsicMode,
+      provenance: mode === null ? "intrinsic" : "tool_override",
+    },
+    inputSchema: { type: "object" },
+    outputSchema: null,
+    inputTypescript: null,
+    outputTypescript: null,
+    typescriptDefinitions: {},
+  } satisfies ToolRecord;
+}
+
+function toolPageResponse(revision = catalogRevision, items: ToolPage["items"] = tools) {
+  return Response.json({
+    items,
+    total: items.length,
+    hasMore: false,
+    nextOffset: null,
+    catalogRevision: revision,
+  });
+}
+
+function sourceFixture() {
+  return {
+    id: "source-1",
+    kind: "graphql",
+    slug: "product-api",
+    displayName: "Product API",
+    description: null,
+    configuration: { endpoint: "https://api.example.test/", allowPrivateNetwork: false },
+    modeOverride: "enabled",
+    healthStatus: "healthy",
+    healthErrorCode: null,
+    revision: 4,
+    catalogRevision,
+    createdAt: 100,
+    updatedAt: 100,
+    lastRefreshedAt: 100,
+    toolCount: 1,
+    tombstonedToolCount: 0,
+  } satisfies SourceList["sources"][number];
+}
+
+function deferred<Value>() {
+  let resolve = (_value: Value) => {};
+  const promise = new Promise<Value>((complete) => {
+    resolve = complete;
+  });
+  return { promise, resolve };
+}
+
+function stubToolsApi() {
+  const bulkRequestBodies: string[] = [];
+  vi.stubGlobal(
+    "fetch",
+    vi.fn<typeof fetch>((input, init) => {
+      const path = String(input);
+      if (path.startsWith("/api/v1/tools?")) {
+        return Promise.resolve(toolPageResponse());
+      }
+      if (path === "/api/v1/sources") {
+        return Promise.resolve(Response.json({ sources: [], catalogRevision }));
+      }
+      if (path === "/api/v1/tools/modes" && init?.method === "PATCH") {
+        bulkRequestBodies.push(String(init.body));
+        return Promise.resolve(
+          Response.json({
+            updatedCount: 2,
+            catalogRevision: catalogRevision + 1,
+            sourceRevisions: { "source-1": 4 },
+          }),
+        );
+      }
+      return Promise.resolve(
+        Response.json(
+          {
+            error: {
+              code: "unexpected_test_request",
+              message: `Unexpected request: ${path}`,
+              requestId: "test-request",
+            },
+          },
+          { status: 500 },
+        ),
+      );
+    }),
+  );
+  return bulkRequestBodies;
+}
+
+async function openDisabledConfirmation() {
+  const alphaSelection = await screen.findByLabelText<HTMLInputElement>("Select Alpha tool");
+  const betaSelection = screen.getByLabelText<HTMLInputElement>("Select Beta tool");
+  const gammaSelection = screen.getByLabelText<HTMLInputElement>("Select Gamma tool");
+  await fireEvent.click(alphaSelection);
+  await fireEvent.click(betaSelection);
+
+  const bulkModes = screen.getByRole<HTMLFieldSetElement>("group", {
+    name: "Set selected tools",
+  });
+  await fireEvent.click(within(bulkModes).getByLabelText("Disabled"));
+  const applyButton = screen.getByRole<HTMLButtonElement>("button", {
+    name: "Apply Disabled to 2 selected",
+  });
+  applyButton.focus();
+  await fireEvent.click(applyButton);
+
+  const confirmation = await screen.findByRole("group", {
+    name: "Confirm bulk tool behavior",
+  });
+  return {
+    alphaSelection,
+    betaSelection,
+    gammaSelection,
+    bulkModes,
+    applyButton,
+    confirmation,
+  };
+}
+
+afterEach(() => {
+  cleanup();
+  vi.unstubAllGlobals();
+});
+
+describe("Tools page bulk confirmation", () => {
+  it("freezes the visible target snapshot and restores controls and opener focus on cancel", async () => {
+    stubToolsApi();
+    render(ToolsPageHarness);
+
+    const { alphaSelection, betaSelection, gammaSelection, bulkModes, applyButton, confirmation } =
+      await openDisabledConfirmation();
+    const selectAll = screen.getByLabelText<HTMLInputElement>(
+      "Select all active tools on this page",
+    );
+    const inheritButton = screen.getByRole<HTMLButtonElement>("button", {
+      name: "Apply Inherit to 2 selected",
+    });
+    const alphaModes = within(
+      alphaSelection.closest("tr") ?? document.body,
+    ).getByRole<HTMLFieldSetElement>("group", { name: "Behavior for Alpha tool" });
+    const betaModes = within(
+      betaSelection.closest("tr") ?? document.body,
+    ).getByRole<HTMLFieldSetElement>("group", { name: "Behavior for Beta tool" });
+    const gammaModes = within(
+      gammaSelection.closest("tr") ?? document.body,
+    ).getByRole<HTMLFieldSetElement>("group", { name: "Behavior for Gamma tool" });
+    const cancelButton = within(confirmation).getByRole<HTMLButtonElement>("button", {
+      name: "Cancel",
+    });
+    const confirmButton = within(confirmation).getByRole<HTMLButtonElement>("button", {
+      name: "Confirm Disabled",
+    });
+
+    await waitFor(() => expect(document.activeElement).toBe(cancelButton));
+    expect(screen.getByText("2 selected on this page")).toBeDefined();
+    expect(screen.getByText(`Bulk changes use catalog revision ${catalogRevision}.`)).toBeDefined();
+    expect(alphaSelection.checked).toBe(true);
+    expect(betaSelection.checked).toBe(true);
+    expect(gammaSelection.checked).toBe(false);
+    expect(selectAll.disabled).toBe(true);
+    expect(alphaSelection.disabled).toBe(true);
+    expect(betaSelection.disabled).toBe(true);
+    expect(gammaSelection.disabled).toBe(true);
+    expect(bulkModes.disabled).toBe(true);
+    expect(applyButton.disabled).toBe(true);
+    expect(inheritButton.disabled).toBe(true);
+    expect(alphaModes.disabled).toBe(true);
+    expect(betaModes.disabled).toBe(true);
+    expect(gammaModes.disabled).toBe(true);
+    expect(cancelButton.disabled).toBe(false);
+    expect(confirmButton.disabled).toBe(false);
+
+    await fireEvent.click(cancelButton);
+
+    await waitFor(() => expect(document.activeElement).toBe(applyButton));
+    expect(screen.queryByRole("group", { name: "Confirm bulk tool behavior" })).toBeNull();
+    expect(selectAll.disabled).toBe(false);
+    expect(alphaSelection.disabled).toBe(false);
+    expect(betaSelection.disabled).toBe(false);
+    expect(gammaSelection.disabled).toBe(false);
+    expect(bulkModes.disabled).toBe(false);
+    expect(applyButton.disabled).toBe(false);
+    expect(inheritButton.disabled).toBe(false);
+    expect(alphaModes.disabled).toBe(false);
+    expect(betaModes.disabled).toBe(false);
+    expect(gammaModes.disabled).toBe(false);
+  });
+
+  it("blocks broad confirmation through a per-tool mutation and its list refresh", async () => {
+    const modeMutation = deferred<Response>();
+    const listRefresh = deferred<Response>();
+    let listCalls = 0;
+    let modeMutationCalls = 0;
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input, init) => {
+        const path = String(input);
+        if (path.startsWith("/api/v1/tools?")) {
+          listCalls += 1;
+          return listCalls === 1 ? Promise.resolve(toolPageResponse()) : listRefresh.promise;
+        }
+        if (path === "/api/v1/sources") {
+          return Promise.resolve(Response.json({ sources: [], catalogRevision }));
+        }
+        if (path === "/api/v1/tools/tool-a/mode" && init?.method === "PATCH") {
+          modeMutationCalls += 1;
+          return modeMutation.promise;
+        }
+        return Promise.resolve(
+          Response.json(
+            {
+              error: {
+                code: "unexpected_test_request",
+                message: `Unexpected request: ${path}`,
+                requestId: "test-request",
+              },
+            },
+            { status: 500 },
+          ),
+        );
+      }),
+    );
+    render(ToolsPageHarness);
+
+    const alphaSelection = await screen.findByLabelText<HTMLInputElement>("Select Alpha tool");
+    const betaSelection = screen.getByLabelText<HTMLInputElement>("Select Beta tool");
+    await fireEvent.click(alphaSelection);
+    await fireEvent.click(betaSelection);
+    const bulkModes = screen.getByRole<HTMLFieldSetElement>("group", {
+      name: "Set selected tools",
+    });
+    await fireEvent.click(within(bulkModes).getByLabelText("Disabled"));
+    const applyButton = screen.getByRole<HTMLButtonElement>("button", {
+      name: "Apply Disabled to 2 selected",
+    });
+    const alphaModes = within(
+      alphaSelection.closest("tr") ?? document.body,
+    ).getByRole<HTMLFieldSetElement>("group", { name: "Behavior for Alpha tool" });
+
+    await fireEvent.click(within(alphaModes).getByLabelText("Enabled"));
+
+    await waitFor(() => expect(modeMutationCalls).toBe(1));
+    expect(screen.queryByText("Refreshing...")).toBeNull();
+    expect(bulkModes.disabled).toBe(true);
+    expect(applyButton.disabled).toBe(true);
+    await fireEvent.click(applyButton);
+    expect(screen.queryByRole("group", { name: "Confirm bulk tool behavior" })).toBeNull();
+
+    modeMutation.resolve(Response.json(toolRecordFixture(alphaTool, "enabled")));
+
+    await waitFor(() => expect(listCalls).toBe(2));
+    expect(await screen.findByText("Refreshing...")).toBeDefined();
+    expect(bulkModes.disabled).toBe(true);
+    expect(applyButton.disabled).toBe(true);
+    await fireEvent.click(applyButton);
+    expect(screen.queryByRole("group", { name: "Confirm bulk tool behavior" })).toBeNull();
+
+    listRefresh.resolve(toolPageResponse(catalogRevision + 1));
+
+    await waitFor(() => expect(applyButton.disabled).toBe(false));
+    expect(screen.queryByText("Refreshing...")).toBeNull();
+    await fireEvent.click(applyButton);
+    expect(await screen.findByRole("group", { name: "Confirm bulk tool behavior" })).toBeDefined();
+  });
+
+  for (const scenario of [
+    { label: "Ask", mode: "ask", buttonName: "Apply Ask to 2 selected" },
+    { label: "Inherit", mode: null, buttonName: "Apply Inherit to 2 selected" },
+  ] as const) {
+    it(`locks every row through a deferred bulk ${scenario.label} mutation`, async () => {
+      const bulkMutation = deferred<Response>();
+      const patchRequests: Array<{ path: string; body: string }> = [];
+      vi.stubGlobal(
+        "fetch",
+        vi.fn<typeof fetch>((input, init) => {
+          const path = String(input);
+          if (path.startsWith("/api/v1/tools?")) {
+            return Promise.resolve(toolPageResponse());
+          }
+          if (path === "/api/v1/sources") {
+            return Promise.resolve(Response.json({ sources: [], catalogRevision }));
+          }
+          if (init?.method === "PATCH") {
+            patchRequests.push({ path, body: String(init.body) });
+            if (path === "/api/v1/tools/modes") return bulkMutation.promise;
+            return Promise.resolve(Response.json(toolRecordFixture(alphaTool, "enabled")));
+          }
+          return Promise.resolve(
+            Response.json(
+              {
+                error: {
+                  code: "unexpected_test_request",
+                  message: `Unexpected request: ${path}`,
+                  requestId: "test-request",
+                },
+              },
+              { status: 500 },
+            ),
+          );
+        }),
+      );
+      render(ToolsPageHarness);
+
+      const alphaSelection = await screen.findByLabelText<HTMLInputElement>("Select Alpha tool");
+      const betaSelection = screen.getByLabelText<HTMLInputElement>("Select Beta tool");
+      const gammaSelection = screen.getByLabelText<HTMLInputElement>("Select Gamma tool");
+      await fireEvent.click(alphaSelection);
+      await fireEvent.click(betaSelection);
+      const bulkModes = screen.getByRole<HTMLFieldSetElement>("group", {
+        name: "Set selected tools",
+      });
+      const applyButton = screen.getByRole<HTMLButtonElement>("button", {
+        name: scenario.buttonName,
+      });
+      const alphaModes = within(
+        alphaSelection.closest("tr") ?? document.body,
+      ).getByRole<HTMLFieldSetElement>("group", { name: "Behavior for Alpha tool" });
+      const betaModes = within(
+        betaSelection.closest("tr") ?? document.body,
+      ).getByRole<HTMLFieldSetElement>("group", { name: "Behavior for Beta tool" });
+      const gammaModes = within(
+        gammaSelection.closest("tr") ?? document.body,
+      ).getByRole<HTMLFieldSetElement>("group", { name: "Behavior for Gamma tool" });
+      applyButton.focus();
+
+      await fireEvent.click(applyButton);
+
+      await waitFor(() => expect(patchRequests).toHaveLength(1));
+      expect(screen.queryByRole("group", { name: "Confirm bulk tool behavior" })).toBeNull();
+      expect(alphaSelection.disabled).toBe(true);
+      expect(betaSelection.disabled).toBe(true);
+      expect(gammaSelection.disabled).toBe(true);
+      expect(bulkModes.disabled).toBe(true);
+      expect(alphaModes.disabled).toBe(true);
+      expect(betaModes.disabled).toBe(true);
+      expect(gammaModes.disabled).toBe(true);
+
+      await fireEvent.change(within(alphaModes).getByLabelText("Enabled"));
+
+      expect(patchRequests).toEqual([
+        {
+          path: "/api/v1/tools/modes",
+          body: JSON.stringify({
+            selection: {
+              type: "tool_ids",
+              toolIds: ["tool-a", "tool-b"],
+              expectedCatalogRevision: catalogRevision,
+            },
+            mode: scenario.mode,
+          }),
+        },
+      ]);
+
+      bulkMutation.resolve(
+        Response.json({
+          updatedCount: 2,
+          catalogRevision: catalogRevision + 1,
+          sourceRevisions: { "source-1": 4 },
+        }),
+      );
+
+      const status = await screen.findByText(`${scenario.label} applied to 2 selected tools.`);
+      await waitFor(() => expect(document.activeElement).toBe(status));
+      await waitFor(() => expect(alphaModes.disabled).toBe(false));
+      expect(patchRequests).toHaveLength(1);
+    });
+  }
+
+  it("confirms a frozen Inherit transition from Disabled to source Enabled", async () => {
+    const disabledTool = {
+      ...alphaTool,
+      modeOverride: "disabled",
+      effectiveMode: { mode: "disabled", provenance: "tool_override" },
+    } satisfies ToolPage["items"][number];
+    const bulkMutation = deferred<Response>();
+    const patchRequests: Array<{ path: string; body: string }> = [];
+    vi.stubGlobal(
+      "fetch",
+      vi.fn<typeof fetch>((input, init) => {
+        const path = String(input);
+        if (path.startsWith("/api/v1/tools?")) {
+          return Promise.resolve(toolPageResponse(catalogRevision, [disabledTool]));
+        }
+        if (path === "/api/v1/sources") {
+          return Promise.resolve(Response.json({ sources: [sourceFixture()], catalogRevision }));
+        }
+        if (init?.method === "PATCH") {
+          patchRequests.push({ path, body: String(init.body) });
+          if (path === "/api/v1/tools/modes") return bulkMutation.promise;
+          return Promise.resolve(Response.json(toolRecordFixture(disabledTool, "ask")));
+        }
+        return Promise.resolve(
+          Response.json(
+            {
+              error: {
+                code: "unexpected_test_request",
+                message: `Unexpected request: ${path}`,
+                requestId: "test-request",
+              },
+            },
+            { status: 500 },
+          ),
+        );
+      }),
+    );
+    render(ToolsPageHarness);
+
+    const selection = await screen.findByLabelText<HTMLInputElement>("Select Alpha tool");
+    const rowModes = within(
+      selection.closest("tr") ?? document.body,
+    ).getByRole<HTMLFieldSetElement>("group", { name: "Behavior for Alpha tool" });
+    await within(rowModes).findByLabelText("Inherit (currently Enabled)");
+    await fireEvent.click(selection);
+    const bulkModes = screen.getByRole<HTMLFieldSetElement>("group", {
+      name: "Set selected tools",
+    });
+    const inheritButton = screen.getByRole<HTMLButtonElement>("button", {
+      name: "Apply Inherit to 1 selected",
+    });
+
+    await fireEvent.click(inheritButton);
+
+    const confirmation = await screen.findByRole("group", {
+      name: "Confirm bulk tool behavior",
+    });
+    expect(
+      within(confirmation).getByText(
+        "Inherit 1 selected tool? 1 tool will become Enabled under its source default.",
+      ),
+    ).toBeDefined();
+    expect(patchRequests).toHaveLength(0);
+    expect(selection.checked).toBe(true);
+    expect(selection.disabled).toBe(true);
+    expect(bulkModes.disabled).toBe(true);
+    expect(rowModes.disabled).toBe(true);
+    const cancelButton = within(confirmation).getByRole<HTMLButtonElement>("button", {
+      name: "Cancel",
+    });
+    const confirmButton = within(confirmation).getByRole<HTMLButtonElement>("button", {
+      name: "Confirm Inherit",
+    });
+    expect(cancelButton.disabled).toBe(false);
+    expect(confirmButton.disabled).toBe(false);
+
+    await fireEvent.click(cancelButton);
+
+    await waitFor(() => expect(document.activeElement).toBe(inheritButton));
+    expect(screen.queryByRole("group", { name: "Confirm bulk tool behavior" })).toBeNull();
+    await fireEvent.click(inheritButton);
+    const applyConfirmation = await screen.findByRole("group", {
+      name: "Confirm bulk tool behavior",
+    });
+    const applyCancelButton = within(applyConfirmation).getByRole<HTMLButtonElement>("button", {
+      name: "Cancel",
+    });
+    const applyConfirmButton = within(applyConfirmation).getByRole<HTMLButtonElement>("button", {
+      name: "Confirm Inherit",
+    });
+
+    await fireEvent.click(applyConfirmButton);
+
+    await waitFor(() => expect(patchRequests).toHaveLength(1));
+    expect(patchRequests[0]).toEqual({
+      path: "/api/v1/tools/modes",
+      body: JSON.stringify({
+        selection: {
+          type: "tool_ids",
+          toolIds: ["tool-a"],
+          expectedCatalogRevision: catalogRevision,
+        },
+        mode: null,
+      }),
+    });
+    expect(selection.disabled).toBe(true);
+    expect(bulkModes.disabled).toBe(true);
+    expect(rowModes.disabled).toBe(true);
+    expect(applyCancelButton.disabled).toBe(true);
+    expect(applyConfirmButton.disabled).toBe(true);
+
+    await fireEvent.change(within(rowModes).getByLabelText("Ask"));
+    expect(patchRequests).toHaveLength(1);
+
+    bulkMutation.resolve(
+      Response.json({
+        updatedCount: 1,
+        catalogRevision: catalogRevision + 1,
+        sourceRevisions: { "source-1": 5 },
+      }),
+    );
+
+    const status = await screen.findByText("Inherit applied to 1 selected tool.");
+    await waitFor(() => expect(document.activeElement).toBe(status));
+  });
+
+  it("uses a visible accessible Select all control at 390px", async () => {
+    vi.stubGlobal("innerWidth", 390);
+    stubToolsApi();
+    render(ToolsPageHarness);
+
+    const alphaSelection = await screen.findByLabelText<HTMLInputElement>("Select Alpha tool");
+    const selectAll = screen.getByLabelText<HTMLInputElement>(
+      "Select all active tools on this page",
+    );
+    expect(selectAll.closest("thead")).toBeNull();
+    expect(selectAll.closest(".mobile-select-all")).not.toBeNull();
+    expect(
+      document.querySelector('thead input[aria-label="Select all active tools on this page"]'),
+    ).toBeNull();
+
+    await fireEvent.click(alphaSelection);
+    await waitFor(() => expect(selectAll.indeterminate).toBe(true));
+    await fireEvent.click(selectAll);
+    await waitFor(() => expect(selectAll.checked).toBe(true));
+    expect(screen.getByText("3 selected on this page")).toBeDefined();
+
+    const bulkModes = screen.getByRole<HTMLFieldSetElement>("group", {
+      name: "Set selected tools",
+    });
+    await fireEvent.click(within(bulkModes).getByLabelText("Disabled"));
+    await fireEvent.click(screen.getByRole("button", { name: "Apply Disabled to 3 selected" }));
+
+    expect(await screen.findByRole("group", { name: "Confirm bulk tool behavior" })).toBeDefined();
+    expect(selectAll.disabled).toBe(true);
+    expect(selectAll.closest("thead")).toBeNull();
+  });
+
+  it("cancels with Escape and restores focus to the apply button", async () => {
+    stubToolsApi();
+    render(ToolsPageHarness);
+
+    const { applyButton, confirmation } = await openDisabledConfirmation();
+    const confirmButton = within(confirmation).getByRole<HTMLButtonElement>("button", {
+      name: "Confirm Disabled",
+    });
+    confirmButton.focus();
+    await fireEvent.keyDown(confirmButton, { key: "Escape" });
+
+    await waitFor(() => expect(document.activeElement).toBe(applyButton));
+    expect(screen.queryByRole("group", { name: "Confirm bulk tool behavior" })).toBeNull();
+    expect(applyButton.disabled).toBe(false);
+  });
+
+  it("submits the displayed snapshot and focuses the success status", async () => {
+    const bulkRequestBodies = stubToolsApi();
+    render(ToolsPageHarness);
+
+    const { alphaSelection, betaSelection, gammaSelection, confirmation } =
+      await openDisabledConfirmation();
+    expect(alphaSelection.checked).toBe(true);
+    expect(betaSelection.checked).toBe(true);
+    expect(gammaSelection.checked).toBe(false);
+    expect(screen.getByText(`Bulk changes use catalog revision ${catalogRevision}.`)).toBeDefined();
+
+    await fireEvent.click(within(confirmation).getByRole("button", { name: "Confirm Disabled" }));
+
+    await waitFor(() => expect(bulkRequestBodies).toHaveLength(1));
+    expect(bulkRequestBodies).toEqual([
+      JSON.stringify({
+        selection: {
+          type: "tool_ids",
+          toolIds: ["tool-a", "tool-b"],
+          expectedCatalogRevision: catalogRevision,
+        },
+        mode: "disabled",
+      }),
+    ]);
+    const status = await screen.findByText("Disabled applied to 2 selected tools.");
+    await waitFor(() => expect(document.activeElement).toBe(status));
+  });
+});
diff --git a/web/src/styles.css b/web/src/styles.css
new file mode 100644
index 000000000..f00b0b773
--- /dev/null
+++ b/web/src/styles.css
@@ -0,0 +1,1640 @@
+:root {
+  font-family:
+    Inter,
+    ui-sans-serif,
+    system-ui,
+    -apple-system,
+    BlinkMacSystemFont,
+    "Segoe UI",
+    sans-serif;
+  color: #e9edf5;
+  background: #080b12;
+  font-synthesis: none;
+  color-scheme: dark;
+}
+
+* {
+  box-sizing: border-box;
+}
+
+body {
+  margin: 0;
+  min-width: 320px;
+  min-height: 100vh;
+  background:
+    radial-gradient(circle at 80% -20%, rgba(88, 101, 242, 0.2), transparent 35%), #080b12;
+}
+
+button,
+input,
+select,
+textarea {
+  font: inherit;
+}
+
+button,
+a {
+  -webkit-tap-highlight-color: transparent;
+}
+
+a {
+  color: inherit;
+}
+
+button {
+  min-height: 2.55rem;
+  border: 1px solid #30384a;
+  border-radius: 10px;
+  padding: 0.68rem 0.95rem;
+  color: #dfe5f2;
+  background: #151b28;
+  cursor: pointer;
+}
+
+:where(a, button, input, select, textarea):focus-visible {
+  outline: 3px solid rgba(145, 160, 255, 0.72);
+  outline-offset: 3px;
+}
+
+button:hover:not(:disabled) {
+  border-color: #66728b;
+  background: #1b2333;
+}
+
+button:disabled {
+  cursor: not-allowed;
+  opacity: 0.64;
+}
+
+button.primary {
+  border-color: #7181ff;
+  color: #07101d;
+  background: #91a0ff;
+  font-weight: 750;
+}
+
+button.primary:hover:not(:disabled) {
+  border-color: #aab4ff;
+  background: #aab4ff;
+}
+
+.skip-link {
+  position: fixed;
+  z-index: 100;
+  top: 0.75rem;
+  left: 0.75rem;
+  transform: translateY(-180%);
+  border-radius: 8px;
+  padding: 0.65rem 0.9rem;
+  color: #07101d;
+  background: #c2caff;
+  font-weight: 750;
+  text-decoration: none;
+}
+
+.skip-link:focus-visible {
+  transform: translateY(0);
+}
+
+.app-frame {
+  display: grid;
+  grid-template-columns: 248px minmax(0, 1fr);
+  min-height: 100vh;
+}
+
+.sidebar {
+  position: sticky;
+  top: 0;
+  display: flex;
+  flex-direction: column;
+  height: 100vh;
+  padding: 1.25rem;
+  border-right: 1px solid #202738;
+  background: rgba(10, 14, 22, 0.9);
+  backdrop-filter: blur(18px);
+}
+
+.brand {
+  display: flex;
+  gap: 0.75rem;
+  align-items: center;
+  margin-bottom: 2rem;
+  text-decoration: none;
+}
+
+.brand-mark {
+  display: inline-grid;
+  width: 2.5rem;
+  height: 2.5rem;
+  place-items: center;
+  border: 1px solid #7181ff;
+  border-radius: 11px;
+  color: #b6c0ff;
+  background: #1c2443;
+  box-shadow: inset 0 0 20px rgba(113, 129, 255, 0.15);
+  font-size: 0.75rem;
+  font-weight: 850;
+  letter-spacing: 0.08em;
+}
+
+.brand strong,
+.brand small,
+.instance-card strong,
+.instance-card small,
+td small {
+  display: block;
+}
+
+.brand small,
+.instance-card small,
+td small {
+  margin-top: 0.2rem;
+  color: #9da8bc;
+  font-size: 0.72rem;
+}
+
+nav {
+  display: grid;
+  gap: 0.35rem;
+}
+
+nav a {
+  display: flex;
+  gap: 0.75rem;
+  align-items: center;
+  padding: 0.72rem 0.8rem;
+  border-radius: 9px;
+  color: #b2bccf;
+  text-decoration: none;
+  font-size: 0.9rem;
+}
+
+.nav-marker {
+  color: #929eb4;
+  font-family: ui-monospace, "SFMono-Regular", monospace;
+  font-size: 0.68rem;
+}
+
+.nav-label {
+  min-width: 0;
+}
+
+.nav-count {
+  min-width: 1.65rem;
+  margin-left: auto;
+  padding: 0.14rem 0.35rem;
+  border: 1px solid #343d51;
+  border-radius: 999px;
+  color: #aab5c8;
+  font-family: ui-monospace, "SFMono-Regular", monospace;
+  font-size: 0.62rem;
+  text-align: center;
+}
+
+nav a:hover,
+nav a.active {
+  color: #f1f3f9;
+  background: #161c29;
+}
+
+nav a.active {
+  box-shadow: inset 3px 0 0 #91a0ff;
+  font-weight: 750;
+}
+
+nav a.active .nav-marker {
+  color: #91a0ff;
+}
+
+.instance-card {
+  display: flex;
+  gap: 0.65rem;
+  align-items: center;
+  margin-top: auto;
+  padding: 0.85rem;
+  border: 1px solid #242c3d;
+  border-radius: 12px;
+  background: #10151f;
+  font-size: 0.8rem;
+}
+
+.status-dot {
+  width: 0.5rem;
+  height: 0.5rem;
+  border-radius: 50%;
+  background: #55d6a5;
+  box-shadow: 0 0 10px rgba(85, 214, 165, 0.6);
+}
+
+main {
+  min-width: 0;
+}
+
+.page-header {
+  display: flex;
+  justify-content: space-between;
+  gap: 2rem;
+  align-items: flex-start;
+  padding: 2.4rem clamp(1.25rem, 4vw, 4rem) 1.8rem;
+  border-bottom: 1px solid #202738;
+}
+
+.page-header h1,
+.auth-card h1 {
+  margin: 0.15rem 0 0.55rem;
+  color: #f7f8fb;
+  font-size: clamp(1.7rem, 3vw, 2.5rem);
+  line-height: 1.05;
+  letter-spacing: -0.04em;
+}
+
+.page-header > div > p:last-child,
+.lede,
+.surface > p {
+  max-width: 650px;
+  margin: 0;
+  color: #a8b2c4;
+  line-height: 1.65;
+}
+
+.eyebrow {
+  margin: 0;
+  color: #a6b1ff;
+  font-family: ui-monospace, "SFMono-Regular", monospace;
+  font-size: 0.68rem;
+  font-weight: 700;
+  letter-spacing: 0.13em;
+  text-transform: uppercase;
+}
+
+.admin-actions {
+  display: flex;
+  gap: 0.75rem;
+  align-items: center;
+  color: #a3aec1;
+  font-size: 0.78rem;
+  white-space: nowrap;
+}
+
+.admin-actions strong {
+  color: #cbd2df;
+  font-weight: 650;
+}
+
+.shell-notice {
+  padding: 0 clamp(1.25rem, 4vw, 4rem);
+}
+
+.page-content {
+  display: grid;
+  gap: 1.25rem;
+  padding: 2rem clamp(1.25rem, 4vw, 4rem) 4rem;
+}
+
+.surface {
+  border: 1px solid #242c3d;
+  border-radius: 16px;
+  background: linear-gradient(145deg, rgba(20, 26, 39, 0.95), rgba(13, 17, 26, 0.95));
+  box-shadow: 0 20px 60px rgba(0, 0, 0, 0.16);
+}
+
+.placeholder-grid,
+.token-layout {
+  display: grid;
+  grid-template-columns: minmax(0, 1.4fr) minmax(260px, 0.6fr);
+  gap: 1.25rem;
+}
+
+.empty-state,
+.scope-card,
+.token-form,
+.reveal-card {
+  padding: clamp(1.35rem, 4vw, 2.2rem);
+}
+
+.empty-state h2,
+.scope-card h3,
+.surface h2 {
+  margin: 1rem 0 0.65rem;
+  color: #eef1f7;
+  letter-spacing: -0.025em;
+}
+
+.number-chip {
+  display: inline-block;
+  padding: 0.25rem 0.4rem;
+  border: 1px solid #3b4560;
+  border-radius: 6px;
+  color: #9dabff;
+  font-family: ui-monospace, "SFMono-Regular", monospace;
+  font-size: 0.7rem;
+}
+
+.availability {
+  display: inline-block;
+  margin-top: 1.4rem !important;
+  border: 1px solid #4a556d;
+  border-radius: 999px;
+  padding: 0.35rem 0.65rem;
+  color: #c1cada !important;
+  background: #171e2b;
+  font-size: 0.76rem;
+  font-weight: 700;
+}
+
+.centered-page {
+  display: grid;
+  min-height: 100vh;
+  padding: 2rem 1.25rem;
+  place-items: center;
+}
+
+.auth-card {
+  width: min(100%, 510px);
+  padding: clamp(1.4rem, 5vw, 2.6rem);
+  border: 1px solid #273044;
+  border-radius: 20px;
+  background: rgba(14, 19, 29, 0.94);
+  box-shadow: 0 30px 90px rgba(0, 0, 0, 0.35);
+}
+
+.auth-card.compact {
+  display: flex;
+  gap: 1rem;
+  align-items: center;
+  max-width: 430px;
+}
+
+.auth-heading {
+  display: flex;
+  gap: 1rem;
+  align-items: center;
+}
+
+.auth-card form,
+.token-form form {
+  display: grid;
+  gap: 1rem;
+  margin-top: 1.6rem;
+}
+
+label {
+  display: grid;
+  gap: 0.45rem;
+  color: #cbd2df;
+  font-size: 0.82rem;
+  font-weight: 650;
+}
+
+label small {
+  color: #9ba6ba;
+  font-weight: 400;
+}
+
+input,
+textarea {
+  width: 100%;
+  border: 1px solid #66728b;
+  border-radius: 10px;
+  outline: none;
+  padding: 0.78rem 0.85rem;
+  color: #edf0f6;
+  background: #0b1019;
+}
+
+input:focus {
+  border-color: #7181ff;
+  box-shadow: 0 0 0 3px rgba(113, 129, 255, 0.13);
+}
+
+textarea:focus {
+  border-color: #7181ff;
+  box-shadow: 0 0 0 3px rgba(113, 129, 255, 0.13);
+}
+
+textarea {
+  resize: vertical;
+}
+
+input:disabled {
+  color: #a4aec0;
+  background: #141923;
+}
+
+input[readonly] {
+  cursor: text;
+}
+
+select {
+  width: 100%;
+  min-height: 2.75rem;
+  border: 1px solid #66728b;
+  border-radius: 10px;
+  padding: 0.68rem 2rem 0.68rem 0.8rem;
+  color: #edf0f6;
+  background: #0b1019;
+}
+
+.notice {
+  margin-top: 1rem;
+  padding: 0.8rem 0.9rem;
+  border: 1px solid #3a4356;
+  border-radius: 10px;
+  color: #cbd2df;
+  background: #161c28;
+  font-size: 0.82rem;
+  line-height: 1.5;
+}
+
+.notice.warning {
+  border-color: #635739;
+  color: #e5d7ad;
+  background: #211d14;
+}
+
+.notice.error {
+  border-color: #6a3c48;
+  color: #f4bdc8;
+  background: #24141a;
+}
+
+.notice strong,
+.notice small {
+  display: block;
+}
+
+.notice small {
+  margin-top: 0.4rem;
+  color: inherit;
+  opacity: 0.8;
+}
+
+.text-button {
+  min-height: auto;
+  margin: 0.55rem 0 0;
+  border: 0;
+  padding: 0;
+  color: inherit;
+  background: transparent;
+  text-decoration: underline;
+  text-underline-offset: 0.2rem;
+}
+
+.field-error {
+  margin: -0.45rem 0 0;
+  color: #f4bdc8;
+  font-size: 0.78rem;
+}
+
+code {
+  font-family: ui-monospace, "SFMono-Regular", Menlo, monospace;
+}
+
+.reveal-card {
+  border-color: #5a5794;
+  background: linear-gradient(145deg, #202344, #14182b);
+}
+
+.reveal-card code {
+  display: block;
+  overflow-wrap: anywhere;
+  margin: 1rem 0;
+  padding: 0.8rem;
+  border-radius: 8px;
+  color: #d9deff;
+  background: #0d1020;
+  font-size: 0.76rem;
+}
+
+.token-secret {
+  margin-top: 0.45rem;
+  font-family: ui-monospace, "SFMono-Regular", Menlo, monospace;
+  font-size: 0.78rem;
+}
+
+.copy-status {
+  min-height: 1.35rem;
+  margin-top: 0.8rem !important;
+  color: #c4ccda !important;
+  font-size: 0.78rem;
+}
+
+.reveal-card button {
+  margin-top: 1rem;
+}
+
+.button-row {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.7rem;
+  align-items: center;
+}
+
+.button-row button {
+  margin-top: 0;
+}
+
+.table-card {
+  overflow: hidden;
+}
+
+.stale-notice {
+  border: 1px solid #75683f;
+  border-radius: 14px;
+  padding: 1rem;
+  color: #f0e2b7;
+  background: #252015;
+}
+
+.stale-notice > .notice {
+  margin-top: 0.75rem;
+}
+
+.table-unavailable {
+  display: grid;
+  gap: 0.65rem;
+  padding: 1.4rem;
+  color: #c5cddc;
+}
+
+.table-unavailable p {
+  margin: 0;
+  color: #a6b0c2;
+}
+
+.section-heading {
+  display: flex;
+  justify-content: space-between;
+  align-items: center;
+  padding: 1.4rem;
+  border-bottom: 1px solid #252d3e;
+}
+
+.section-heading h2 {
+  margin: 0.25rem 0 0;
+}
+
+.table-scroll {
+  overflow-x: auto;
+}
+
+table {
+  width: 100%;
+  border-collapse: collapse;
+  font-size: 0.8rem;
+}
+
+caption {
+  padding: 0.85rem 1.2rem;
+  color: #a8b3c7;
+  text-align: left;
+  font-size: 0.76rem;
+}
+
+th,
+td {
+  padding: 0.95rem 1.2rem;
+  border-bottom: 1px solid #202738;
+  text-align: left;
+  white-space: nowrap;
+}
+
+th {
+  color: #9da9bd;
+  font-size: 0.67rem;
+  letter-spacing: 0.08em;
+  text-transform: uppercase;
+}
+
+td {
+  color: #c1c9d8;
+}
+
+.table-empty {
+  margin: 0;
+  padding: 2rem;
+  color: #a2aec2;
+  text-align: center;
+}
+
+.status-pill {
+  display: inline-block;
+  padding: 0.25rem 0.5rem;
+  border: 1px solid #315b50;
+  border-radius: 999px;
+  color: #75d5b3;
+  background: #11231f;
+  font-size: 0.68rem;
+}
+
+.status-pill.revoked {
+  border-color: #493f48;
+  color: #b8adb7;
+  background: #1c181d;
+}
+
+.danger-link {
+  min-height: 2rem;
+  border-color: #583945;
+  padding: 0.3rem 0.55rem;
+  color: #e29aaa;
+  background: #21151a;
+}
+
+.danger-button {
+  border-color: #875061;
+  color: #ffe5eb;
+  background: #6a3041;
+}
+
+.confirm-dialog {
+  width: min(calc(100% - 2rem), 480px);
+  border: 1px solid #364056;
+  border-radius: 18px;
+  padding: 1.5rem;
+  color: #e9edf5;
+  background: #121824;
+  box-shadow: 0 30px 100px rgba(0, 0, 0, 0.58);
+}
+
+.confirm-dialog::backdrop {
+  background: rgba(2, 5, 10, 0.76);
+  backdrop-filter: blur(4px);
+}
+
+.confirm-dialog h2 {
+  margin: 0.65rem 0;
+  color: #f2f4f9;
+}
+
+.confirm-dialog > p:not(.eyebrow) {
+  color: #9ba5b9;
+  line-height: 1.6;
+}
+
+.dialog-actions {
+  justify-content: flex-end;
+  margin-top: 1.4rem;
+}
+
+.visually-hidden {
+  position: absolute;
+  width: 1px;
+  height: 1px;
+  overflow: hidden;
+  clip: rect(0 0 0 0);
+  clip-path: inset(50%);
+  white-space: nowrap;
+}
+
+.loading-panel {
+  padding: 2rem;
+  color: #aeb8ca;
+}
+
+.import-panel {
+  overflow: hidden;
+}
+
+.import-panel > summary {
+  padding: 1.1rem 1.35rem;
+  color: #e4e8f1;
+  cursor: pointer;
+  font-weight: 750;
+}
+
+.import-panel[open] > summary {
+  border-bottom: 1px solid #293145;
+}
+
+.import-form,
+.preview-panel {
+  display: grid;
+  gap: 1rem;
+  padding: 1.3rem;
+}
+
+.import-form {
+  grid-template-columns: minmax(0, 1fr) auto;
+  align-items: end;
+}
+
+.import-form > :not(button) {
+  grid-column: 1 / -1;
+}
+
+.private-network-choice {
+  margin-top: 0.25rem;
+}
+
+.field-help {
+  margin: 0;
+  color: #9da8bb;
+  font-size: 0.74rem;
+  line-height: 1.5;
+}
+
+.preview-panel {
+  border-top: 1px solid #293145;
+  background: rgba(12, 17, 27, 0.65);
+}
+
+.preview-panel > div:first-child p:last-child {
+  margin: 0;
+  color: #a8b2c4;
+}
+
+.preview-tools {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.55rem;
+}
+
+.preview-tools span {
+  display: grid;
+  gap: 0.2rem;
+  border: 1px solid #30394c;
+  border-radius: 9px;
+  padding: 0.55rem 0.7rem;
+  color: #d5dbe7;
+  background: #111722;
+  font-size: 0.75rem;
+}
+
+.preview-tools small {
+  color: #909caf;
+}
+
+.import-fields {
+  display: grid;
+  grid-template-columns: repeat(2, minmax(0, 1fr));
+  gap: 0.85rem;
+}
+
+.credential-schemes,
+.credential-editor {
+  display: grid;
+  gap: 0.85rem;
+}
+
+.credential-schemes {
+  margin: 0;
+  border: 1px solid #30394c;
+  border-radius: 11px;
+  padding: 1rem;
+}
+
+.credential-schemes > legend,
+.credential-row > legend {
+  padding: 0 0.35rem;
+  color: #aeb8ca;
+  font-size: 0.72rem;
+  font-weight: 750;
+}
+
+.credential-row {
+  display: grid;
+  grid-template-columns: repeat(2, minmax(0, 1fr));
+  gap: 0.75rem;
+  min-width: 0;
+  border: 1px solid #293247;
+  border-radius: 10px;
+  padding: 0.85rem;
+  background: #0d131d;
+}
+
+.credential-row > .checkbox-label,
+.credential-row > .danger-link {
+  grid-column: 1 / -1;
+  justify-self: start;
+}
+
+.credential-row .checkbox-label span,
+.credential-row .checkbox-label small {
+  display: block;
+}
+
+.credential-row .checkbox-label small {
+  margin-top: 0.2rem;
+  color: #939fb3;
+}
+
+.credential-editor {
+  border-top: 1px solid #293247;
+  padding-top: 1rem;
+}
+
+.credential-editor h3,
+.credential-editor p {
+  margin: 0;
+}
+
+.credential-editor p {
+  margin-top: 0.3rem;
+  color: #9da8bb;
+  font-size: 0.78rem;
+}
+
+.wide-field {
+  grid-column: 1 / -1;
+}
+
+.source-grid {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(min(100%, 390px), 1fr));
+  gap: 1.25rem;
+}
+
+.source-card {
+  display: grid;
+  gap: 1.25rem;
+  padding: 1.45rem;
+}
+
+.source-card-heading {
+  display: flex;
+  justify-content: space-between;
+  gap: 1rem;
+  align-items: flex-start;
+}
+
+.source-card-heading h2,
+.privacy-note h2 {
+  margin: 0.35rem 0 0.45rem;
+}
+
+.source-card-heading p:last-child {
+  margin: 0;
+  color: #a8b2c4;
+  line-height: 1.55;
+}
+
+.health-pill,
+.outcome-pill {
+  display: inline-block;
+  border: 1px solid #4a556d;
+  border-radius: 999px;
+  padding: 0.28rem 0.55rem;
+  color: #c1cada;
+  background: #171e2b;
+  font-size: 0.68rem;
+  font-weight: 750;
+  text-transform: capitalize;
+}
+
+.health-pill.healthy,
+.outcome-pill.success {
+  border-color: #315b50;
+  color: #75d5b3;
+  background: #11231f;
+}
+
+.health-pill.error,
+.outcome-pill.error {
+  border-color: #6a3c48;
+  color: #f4bdc8;
+  background: #24141a;
+}
+
+.outcome-pill.pending {
+  border-color: #75683f;
+  color: #f0e2b7;
+  background: #252015;
+}
+
+.outcome-pill.active {
+  border-color: #485b96;
+  color: #b8c4ff;
+  background: #171d36;
+}
+
+.outcome-pill.warning {
+  border-color: #675b3e;
+  color: #dccb9a;
+  background: #211d14;
+}
+
+.source-stats,
+.detail-list {
+  display: grid;
+  grid-template-columns: repeat(3, minmax(0, 1fr));
+  gap: 0.75rem;
+  margin: 0;
+}
+
+.source-stats div,
+.detail-list div {
+  min-width: 0;
+  border: 1px solid #283146;
+  border-radius: 10px;
+  padding: 0.8rem;
+  background: #0d131d;
+}
+
+.source-stats dt,
+.detail-list dt {
+  color: #8f9bb1;
+  font-size: 0.65rem;
+  font-weight: 750;
+  letter-spacing: 0.06em;
+  text-transform: uppercase;
+}
+
+.source-stats dd,
+.detail-list dd {
+  margin: 0.35rem 0 0;
+  overflow-wrap: anywhere;
+  color: #d7dde8;
+  font-size: 0.82rem;
+}
+
+.source-error {
+  margin: 0;
+  color: #f0c1cb;
+  font-size: 0.78rem;
+}
+
+.mode-control {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.55rem 1rem;
+  min-width: 0;
+  margin: 0;
+  border: 1px solid #30394c;
+  border-radius: 11px;
+  padding: 0.85rem;
+}
+
+.mode-control legend {
+  padding: 0 0.35rem;
+  color: #aeb8ca;
+  font-size: 0.72rem;
+  font-weight: 750;
+}
+
+.mode-control label,
+.checkbox-label {
+  display: flex;
+  gap: 0.4rem;
+  align-items: center;
+  color: #c7cfdd;
+  font-size: 0.76rem;
+  font-weight: 600;
+}
+
+.source-mode-control .mode-impact,
+.source-mode-control > button {
+  flex-basis: 100%;
+}
+
+.mode-impact {
+  margin: 0;
+  color: #9da8bb;
+  font-size: 0.74rem;
+  line-height: 1.45;
+}
+
+.mode-control input,
+.checkbox-label input,
+th input,
+td input {
+  min-width: 1.5rem;
+  min-height: 1.5rem;
+  width: auto;
+  margin: 0;
+  accent-color: #91a0ff;
+}
+
+.source-actions,
+.inline-confirm {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.65rem;
+  align-items: center;
+}
+
+.source-actions {
+  justify-content: space-between;
+}
+
+.inline-confirm {
+  justify-content: flex-end;
+  width: 100%;
+  color: #f1c2cc;
+  font-size: 0.78rem;
+}
+
+.button-link,
+.detail-link,
+.pagination a {
+  display: inline-flex;
+  min-height: 2.55rem;
+  align-items: center;
+  border: 1px solid #30384a;
+  border-radius: 10px;
+  padding: 0.68rem 0.95rem;
+  color: #dfe5f2;
+  background: #151b28;
+  font-size: 0.8rem;
+  font-weight: 700;
+  text-decoration: none;
+}
+
+.button-link:hover,
+.detail-link:hover,
+.pagination a:hover {
+  border-color: #66728b;
+  background: #1b2333;
+}
+
+.filter-bar {
+  display: grid;
+  grid-template-columns: minmax(220px, 1.5fr) repeat(2, minmax(150px, 0.65fr)) auto auto;
+  gap: 0.8rem;
+  align-items: end;
+  padding: 1rem;
+}
+
+.filter-bar .checkbox-label {
+  min-height: 2.75rem;
+  white-space: nowrap;
+}
+
+.bulk-bar {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 1rem;
+  align-items: center;
+  padding: 1rem 1.2rem;
+}
+
+.bulk-confirm {
+  flex-basis: 100%;
+}
+
+.bulk-bar > div:first-child {
+  display: grid;
+  gap: 0.25rem;
+  margin-right: auto;
+}
+
+.bulk-bar small,
+.muted-status {
+  color: #9ca7ba;
+  font-size: 0.72rem;
+}
+
+.mode-control.compact {
+  padding: 0.6rem 0.75rem;
+}
+
+.row-modes {
+  flex-wrap: wrap;
+  border: 0;
+  padding: 0;
+}
+
+.mode-semantics {
+  display: grid;
+  grid-template-columns: minmax(180px, 0.45fr) minmax(0, 1.55fr);
+  gap: 1rem;
+  align-items: center;
+  padding: 1rem 1.2rem;
+}
+
+.mode-semantics h2 {
+  margin: 0.3rem 0 0;
+}
+
+.mode-semantics dl {
+  display: grid;
+  grid-template-columns: repeat(4, minmax(0, 1fr));
+  gap: 0.6rem;
+  margin: 0;
+}
+
+.mode-semantics dl div {
+  border-left: 2px solid #36415a;
+  padding-left: 0.65rem;
+}
+
+.mode-semantics dt {
+  color: #dbe1ec;
+  font-size: 0.75rem;
+  font-weight: 750;
+}
+
+.mode-semantics dd {
+  margin: 0.25rem 0 0;
+  color: #96a2b6;
+  font-size: 0.7rem;
+  line-height: 1.45;
+}
+
+.empty-recovery,
+.table-empty .button-link {
+  justify-content: center;
+  margin-top: 0.8rem;
+}
+
+.row-modes label {
+  gap: 0.25rem;
+}
+
+td strong,
+td code {
+  display: block;
+}
+
+.removed-row {
+  opacity: 0.68;
+}
+
+.detail-link {
+  min-height: 2rem;
+  padding: 0.35rem 0.6rem;
+}
+
+.pagination {
+  display: grid;
+  grid-template-columns: 1fr auto 1fr;
+  gap: 1rem;
+  align-items: center;
+  padding: 1rem 1.2rem;
+  color: #9da8bc;
+  font-size: 0.74rem;
+}
+
+.pagination a:last-child {
+  justify-self: end;
+}
+
+.detail-panel {
+  overflow: hidden;
+}
+
+.detail-body {
+  display: grid;
+  gap: 1rem;
+  padding: 1.3rem;
+}
+
+.detail-list {
+  grid-template-columns: repeat(auto-fit, minmax(190px, 1fr));
+}
+
+.detail-body h3 {
+  margin: 0.6rem 0 0;
+  color: #dce2ed;
+  font-size: 0.85rem;
+}
+
+.detail-body pre {
+  overflow: auto;
+  max-height: 420px;
+  margin: 0;
+  border: 1px solid #293247;
+  border-radius: 10px;
+  padding: 1rem;
+  color: #cbd4e4;
+  background: #090e16;
+  font-size: 0.72rem;
+}
+
+.privacy-note {
+  display: flex;
+  justify-content: space-between;
+  gap: 2rem;
+  align-items: center;
+  padding: 1.2rem 1.4rem;
+}
+
+.privacy-note p:last-child {
+  max-width: 560px;
+  margin: 0;
+  color: #aab4c5;
+  line-height: 1.55;
+}
+
+.approval-explainer,
+.approval-filters {
+  display: flex;
+  justify-content: space-between;
+  gap: 2rem;
+  align-items: center;
+  padding: 1.2rem 1.4rem;
+}
+
+.approval-explainer h2,
+.approval-filters h2 {
+  margin: 0.3rem 0 0;
+}
+
+.approval-explainer > p {
+  max-width: 650px;
+  margin: 0;
+  color: #aab4c5;
+  line-height: 1.55;
+}
+
+.approval-filters label {
+  min-width: 180px;
+  margin-left: auto;
+}
+
+.approval-list {
+  display: grid;
+}
+
+.approval-row {
+  display: grid;
+  grid-template-columns: minmax(0, 1.2fr) minmax(320px, 0.8fr) auto;
+  gap: 1.2rem;
+  align-items: center;
+  padding: 1.2rem 1.4rem;
+  border-bottom: 1px solid #202738;
+}
+
+.approval-row-main {
+  display: flex;
+  justify-content: space-between;
+  gap: 1rem;
+  align-items: flex-start;
+  min-width: 0;
+}
+
+.approval-row-main h3 {
+  margin: 0.55rem 0 0.25rem;
+  color: #eef1f7;
+  font-size: 0.95rem;
+}
+
+.approval-row-main code {
+  overflow-wrap: anywhere;
+  color: #9da8bb;
+  font-size: 0.72rem;
+}
+
+.approval-timing {
+  display: grid;
+  flex: 0 0 auto;
+  gap: 0.2rem;
+  color: #d4dbe7;
+  font-size: 0.75rem;
+  text-align: right;
+}
+
+.approval-timing small {
+  color: #a8b3c7;
+}
+
+.approval-summary {
+  display: grid;
+  grid-template-columns: repeat(3, minmax(0, 1fr));
+  gap: 0.6rem;
+  margin: 0;
+}
+
+.approval-summary div {
+  min-width: 0;
+  border-left: 2px solid #303a51;
+  padding-left: 0.65rem;
+}
+
+.approval-summary dt {
+  color: #8f9bb1;
+  font-size: 0.62rem;
+  font-weight: 750;
+  letter-spacing: 0.06em;
+  text-transform: uppercase;
+}
+
+.approval-summary dd {
+  overflow-wrap: anywhere;
+  margin: 0.25rem 0 0;
+  color: #d7dde8;
+  font-size: 0.75rem;
+}
+
+.approval-summary small {
+  display: block;
+  margin-top: 0.2rem;
+  color: #929eb2;
+  font-size: 0.66rem;
+}
+
+.approval-detail-heading {
+  display: flex;
+  gap: 0.8rem;
+  align-items: center;
+}
+
+.approval-detail-heading code {
+  overflow-wrap: anywhere;
+  color: #d5dbe8;
+}
+
+.approval-detail-heading p {
+  margin: 0.25rem 0 0;
+  color: #9ca7ba;
+  font-size: 0.76rem;
+}
+
+.approval-arguments,
+.approval-decision {
+  display: grid;
+  gap: 0.8rem;
+  border: 1px solid #293247;
+  border-radius: 12px;
+  padding: 1rem;
+  background: #0d131d;
+}
+
+.approval-arguments h3,
+.approval-confirm h3 {
+  margin: 0;
+}
+
+.approval-arguments p,
+.approval-decision p,
+.approval-confirm p {
+  margin: 0;
+  color: #a2adbf;
+  font-size: 0.78rem;
+  line-height: 1.55;
+}
+
+.approval-arguments pre {
+  max-height: 360px;
+}
+
+.approval-decision {
+  border-color: #465174;
+  background: #111728;
+}
+
+.approval-confirm {
+  display: grid;
+  gap: 0.8rem;
+}
+
+@media (max-width: 820px) {
+  .app-frame {
+    display: block;
+  }
+
+  .sidebar {
+    position: static;
+    display: block;
+    height: auto;
+    border-right: 0;
+    border-bottom: 1px solid #202738;
+  }
+
+  .brand,
+  .instance-card {
+    display: none;
+  }
+
+  nav {
+    display: flex;
+    overflow-x: auto;
+  }
+
+  nav a {
+    flex: 0 0 auto;
+  }
+
+  .nav-count {
+    margin-left: 0;
+  }
+
+  .placeholder-grid,
+  .token-layout,
+  .filter-bar {
+    grid-template-columns: 1fr;
+  }
+
+  .filter-bar .checkbox-label {
+    min-height: auto;
+  }
+
+  .privacy-note {
+    align-items: flex-start;
+    flex-direction: column;
+  }
+
+  .approval-explainer,
+  .approval-filters {
+    align-items: flex-start;
+    flex-direction: column;
+  }
+
+  .approval-filters label {
+    width: 100%;
+    margin-left: 0;
+  }
+
+  .approval-row {
+    grid-template-columns: 1fr;
+  }
+
+  .approval-summary {
+    grid-template-columns: repeat(3, minmax(0, 1fr));
+  }
+
+  .mode-semantics {
+    grid-template-columns: 1fr;
+  }
+
+  .mode-semantics dl {
+    grid-template-columns: repeat(2, minmax(0, 1fr));
+  }
+
+  .import-form,
+  .import-fields,
+  .credential-row {
+    grid-template-columns: 1fr;
+  }
+
+  .wide-field {
+    grid-column: auto;
+  }
+}
+
+@media (max-width: 640px) {
+  .section-heading {
+    align-items: flex-start;
+    flex-wrap: wrap;
+    gap: 0.85rem;
+  }
+
+  .table-scroll {
+    overflow: visible;
+  }
+
+  table,
+  tbody,
+  tr,
+  td {
+    display: block;
+    width: 100%;
+  }
+
+  thead {
+    position: absolute;
+    width: 1px;
+    height: 1px;
+    overflow: hidden;
+    clip: rect(0 0 0 0);
+    clip-path: inset(50%);
+    white-space: nowrap;
+  }
+
+  tbody {
+    padding: 0.65rem;
+  }
+
+  tr {
+    margin-bottom: 0.65rem;
+    border: 1px solid #2c3548;
+    border-radius: 12px;
+    padding: 0.55rem 0;
+    background: #101620;
+  }
+
+  td {
+    display: flex;
+    justify-content: space-between;
+    gap: 1rem;
+    align-items: flex-start;
+    border: 0;
+    padding: 0.48rem 0.75rem;
+    white-space: normal;
+    overflow-wrap: anywhere;
+    text-align: right;
+  }
+
+  td::before {
+    flex: 0 0 5.5rem;
+    color: #9da9bd;
+    content: attr(data-label);
+    font-size: 0.67rem;
+    font-weight: 750;
+    letter-spacing: 0.06em;
+    text-align: left;
+    text-transform: uppercase;
+  }
+
+  td code {
+    min-width: 0;
+    overflow-wrap: anywhere;
+  }
+
+  td[data-label="Behavior"] {
+    align-items: stretch;
+    flex-direction: column;
+    text-align: left;
+  }
+
+  td[data-label="Behavior"]::before {
+    flex-basis: auto;
+  }
+
+  .row-modes {
+    flex-wrap: wrap;
+  }
+}
+
+@media (max-width: 520px) {
+  .sidebar {
+    padding: 0.75rem;
+  }
+
+  nav {
+    display: grid;
+    grid-template-columns: repeat(2, minmax(0, 1fr));
+    overflow: visible;
+  }
+
+  nav a {
+    min-width: 0;
+    gap: 0.45rem;
+    padding: 0.65rem;
+  }
+
+  nav a:last-child {
+    grid-column: 1 / -1;
+  }
+
+  .nav-marker {
+    display: none;
+  }
+
+  .nav-label {
+    overflow-wrap: anywhere;
+  }
+
+  .nav-count {
+    min-width: 1.45rem;
+  }
+
+  .page-header {
+    display: block;
+    padding-inline: 0.85rem;
+  }
+
+  .admin-actions {
+    align-items: flex-start;
+    flex-direction: column;
+    margin-top: 1rem;
+    white-space: normal;
+  }
+
+  .auth-heading {
+    align-items: flex-start;
+  }
+
+  .page-content {
+    padding-inline: 0.75rem;
+  }
+
+  .centered-page {
+    padding-inline: 0.75rem;
+  }
+
+  .empty-state,
+  .scope-card,
+  .token-form,
+  .reveal-card {
+    padding: 1.1rem;
+  }
+
+  .source-card-heading,
+  .source-actions {
+    align-items: flex-start;
+    flex-direction: column;
+  }
+
+  .source-stats {
+    grid-template-columns: 1fr;
+  }
+
+  .approval-summary {
+    grid-template-columns: 1fr;
+  }
+
+  .pagination {
+    grid-template-columns: 1fr;
+  }
+
+  .pagination a,
+  .pagination a:last-child {
+    justify-self: stretch;
+    justify-content: center;
+  }
+
+  .mode-semantics dl {
+    grid-template-columns: 1fr;
+  }
+}
diff --git a/web/static/robots.txt b/web/static/robots.txt
new file mode 100644
index 000000000..b6dd6670c
--- /dev/null
+++ b/web/static/robots.txt
@@ -0,0 +1,3 @@
+# allow crawling everything by default
+User-agent: *
+Disallow:
diff --git a/web/svelte.config.js b/web/svelte.config.js
new file mode 100644
index 000000000..850d095d6
--- /dev/null
+++ b/web/svelte.config.js
@@ -0,0 +1,11 @@
+import adapter from "@sveltejs/adapter-static";
+import { vitePreprocess } from "@sveltejs/vite-plugin-svelte";
+
+const config = {
+  preprocess: vitePreprocess(),
+  kit: {
+    adapter: adapter({ fallback: "index.html", strict: true }),
+  },
+};
+
+export default config;
diff --git a/web/tsconfig.json b/web/tsconfig.json
new file mode 100644
index 000000000..43447105a
--- /dev/null
+++ b/web/tsconfig.json
@@ -0,0 +1,14 @@
+{
+  "extends": "./.svelte-kit/tsconfig.json",
+  "compilerOptions": {
+    "allowJs": true,
+    "checkJs": true,
+    "esModuleInterop": true,
+    "forceConsistentCasingInFileNames": true,
+    "resolveJsonModule": true,
+    "skipLibCheck": true,
+    "sourceMap": true,
+    "strict": true,
+    "moduleResolution": "bundler"
+  }
+}
diff --git a/web/vite.config.ts b/web/vite.config.ts
new file mode 100644
index 000000000..5737c41dd
--- /dev/null
+++ b/web/vite.config.ts
@@ -0,0 +1,16 @@
+import { sveltekit } from "@sveltejs/kit/vite";
+import { svelteTesting } from "@testing-library/svelte/vite";
+import { defineConfig } from "vitest/config";
+
+export default defineConfig({
+  plugins: [sveltekit(), svelteTesting()],
+  build: {
+    license: {
+      fileName: "THIRD_PARTY_JAVASCRIPT_LICENSES.json",
+    },
+  },
+  test: {
+    environment: "jsdom",
+    include: ["src/**/*.test.ts"],
+  },
+});