Graduated from D#16720 (body v12 @ 2026-08-08T19:52:47Z). Concept 5 / Option D — the linked SUCCESSOR to shipped #14574 / PR #15287, never a lineage-erasing duplicate. Re-parented per the Fleet-side STEP_BACK (parent-authority ✗: #14560 excludes Lane D credentials/onboarding).
Context
FleetTenantService.connectTenant is itself a Fleet wire verb — it cannot bootstrap the connection required to call it (the cycle-1 circularity catch). The cockpit's own connection profile + credential custody are CLIENT-owned; the tenant seam remains the CONNECTED service's downstream mechanism. #14574/PR #15287 shipped the current remote-tenant contract this succeeds.
Acceptance Criteria
Client-owned connection profiles + credential custody across the THREE custodian shapes: Electron main (packaged), session-only (browser dev), env-indirection client file (headless — production-proven).
The Body receives a session capability, NEVER the credential; no credential enters Body-readable state (the Option-D falsifier).
Own stable profile identity + versioned endpoint-normalization contract (the client twin of S4's principal discipline); display labels, mutable logins, checkout paths are forbidden keys.
Custody-migration state transition, explicit: read old descriptor/credential state → establish the client-owned profile → verify the new connection → retire the old bootstrap role — with rollback, generation, and stale-profile behavior defined; revocation/rotation truth never lost.
Migration census over the shipped consumers:apps/agentos/app.mjs, apps/agentos/fleet/installFleetBridge.mjs, ai/services/fleet/FleetTenantService.mjs, ai/services/fleet/FleetControlBridge.mjs — each dispositioned.
Lineage: names #14574 / PR #15287 as the shipped producer; supersession documented, never erased.
Leg Structure (added 2026-08-15, PR #17176 review round)
Review-driven truthful narrowing (PRR_kwDODSospM8AAAABJq_n0A): the contract + one executable custodian land first; this umbrella stays open until all three custodian shapes have production producers.
Leg 1 — #17181 (PR #17176): profile identity contract (normalization twin, closed credential-free record schema, migration machine, bearer-pattern consolidation) + session-only custody EXECUTABLE with verified, CAS-safe ingress retire and second-SharedWorker-start preservation. Covers the session-only third of AC-1, and ACs 2/3/4-for-session-only, census, lineage.
Leg 2 — OPEN: Electron-main profile/custody binding. Identity + endpoint are main-owned; the worker deliberately publishes profileId: null until main produces the profile on its side of the boundary (a worker-derived id would assert knowledge the worker does not have).
Leg 3 — OPEN: env-indirection production producer for the headless client file (the Node-side consuming seam + the realm question: twin vs. shared-contract), turning today's schema/guard vocabulary (bearerEnvVar) into a bound profile.
Contract Ledger (leg-1 surfaces)
surface
producer
consumers
normalizeFleetEndpoint
apps/agentos/fleet/connectionProfiles.mjs
deriveFleetProfileId, rehydrateProfile; parity-bound to normalizeSecureMcpEndpoint (ai/services/fleet/mcpWireParsing.mjs) by the spec matrix
deriveFleetProfileId
connectionProfiles
createFleetProfile, assertStorableProfileRecord (id self-consistency), establishFleetSessionCustody
createFleetProfile
connectionProfiles
per-custodian producers: session-only = establishFleetSessionCustody (EXECUTABLE, leg 1); electron-main = leg 2 OPEN; env-indirection = leg 3 OPEN
assertStorableProfileRecord
connectionProfiles
createFleetProfile + rehydrateProfile (the single guard path); the Option-D falsifier as code
isStaleProfile / rehydrateProfile
connectionProfiles
profile persistence when the pane lane lands (#13015)
CUSTODY_MIGRATION_PHASES / createCustodyMigration
connectionProfiles
semantic authority for custody moves; the boot lifecycle executes its phase order
retireBearerIngressSlot (+ expected CAS guard)
connectionProfiles
establishFleetSessionCustody — the SOLE retire caller
FLEET_BEARER_PATTERN
connectionProfiles (the ONE worker-realm home)
installFleetBridge, redeemFleetBearerHandshake, the record-guard value scan
registryBridge.profileId (non-enumerable fact)
installFleetBridge
pane rendering (C3 territory, #13015); bearer-shaped values refused at install
Graduated from D#16720 (body v12 @ 2026-08-08T19:52:47Z). Concept 5 / Option D — the linked SUCCESSOR to shipped #14574 / PR #15287, never a lineage-erasing duplicate. Re-parented per the Fleet-side STEP_BACK (parent-authority ✗: #14560 excludes Lane D credentials/onboarding).
Context
FleetTenantService.connectTenantis itself a Fleet wire verb — it cannot bootstrap the connection required to call it (the cycle-1 circularity catch). The cockpit's own connection profile + credential custody are CLIENT-owned; the tenant seam remains the CONNECTED service's downstream mechanism. #14574/PR #15287 shipped the current remote-tenant contract this succeeds.Acceptance Criteria
apps/agentos/app.mjs,apps/agentos/fleet/installFleetBridge.mjs,ai/services/fleet/FleetTenantService.mjs,ai/services/fleet/FleetControlBridge.mjs— each dispositioned.Leg Structure (added 2026-08-15, PR #17176 review round)
Review-driven truthful narrowing (PRR_kwDODSospM8AAAABJq_n0A): the contract + one executable custodian land first; this umbrella stays open until all three custodian shapes have production producers.
profileId: nulluntil main produces the profile on its side of the boundary (a worker-derived id would assert knowledge the worker does not have).bearerEnvVar) into a bound profile.Contract Ledger (leg-1 surfaces)
normalizeFleetEndpointapps/agentos/fleet/connectionProfiles.mjsderiveFleetProfileId,rehydrateProfile; parity-bound tonormalizeSecureMcpEndpoint(ai/services/fleet/mcpWireParsing.mjs) by the spec matrixderiveFleetProfileIdcreateFleetProfile,assertStorableProfileRecord(id self-consistency),establishFleetSessionCustodycreateFleetProfileestablishFleetSessionCustody(EXECUTABLE, leg 1); electron-main = leg 2 OPEN; env-indirection = leg 3 OPENassertStorableProfileRecordcreateFleetProfile+rehydrateProfile(the single guard path); the Option-D falsifier as codeisStaleProfile/rehydrateProfileCUSTODY_MIGRATION_PHASES/createCustodyMigrationretireBearerIngressSlot(+expectedCAS guard)establishFleetSessionCustody— the SOLE retire callerFLEET_BEARER_PATTERNinstallFleetBridge,redeemFleetBearerHandshake, the record-guard value scanregistryBridge.profileId(non-enumerable fact)installFleetBridgeestablishFleetSessionCustody→{bridge, custodySettled}apps/agentos/app.mjsonStartbrowser branch + late-transport healing; specs awaitcustodySettledSequencing
Successor to #14574. Blocks the remote-only journey AC. Related: S2 (admission), C2 (wire contract).
Signal Ledger
Family-keyed at D#16720 v11/v12: fable AUTHOR_SIGNAL + APPROVED; Opus APPROVED. Full ledger: D#16720 closing comment.
Unresolved Dissent
GPT v9-anchor DEFERRED: repair implemented (v11) — this re-parenting IS the repair; re-stamp pending.
Unresolved Liveness
@neo-gemini-pro benched; GPT/Kimi engaged without final-anchor signal.
Discussion Criteria Mapping
D#16720 criteria (1)–(9): closing comment.
Origin: D#16720 · Retrieval Hint: "client connection broker successor 14574 custodian shapes custody migration census profile identity"