Session guard protocol

Source candidate for S18a Session-bound worker credentials and S18b fan-out guards (maia.session-guard/v1). The Node enforces both; this scope declares the roles, the limits, their typed errors and the Project guard operations.

Operations

preview shows the current guard and the proposed four limits at the exact expectedRevision (0 for a Project that never set them) and issues a one-time proof bound to the inputDigest of that exact change for 30 seconds. confirm repeats the change with both and replaces the limits; a retry with the same command and input replays the first receipt. Only a person changes guards: neither operation has an MCP tool or a Session role.

Limits

A Session an operator creates has depth 1; a child has its parent's depth plus one. With the default maxDepth of 1 no Session creates children.

Approval grants

The guard also records what a coordinator may do with the pending approvals of the Project's Sessions (D-199). A person sets it with the limits, in the same preview and confirm; a change that names no grant leaves it as it is. The preview shows the grant the confirmation would leave, and the inputDigest binds it. A guard receipt written before the grant existed replays as none.

answer allows answering questions; decide also approves and denies. The default is the behaviour before the grant existed. An orchestrator has no grant: it stays at D-186. The grant is read in one place, the Node's approval.respond for the coordinator principal, at the commit of the answer.

Session credentials and roles

An executor Session gets its own 32-byte credential at launch, in MAIA_SESSION_CREDENTIAL (base64url), with the Node's loopback origin in MAIA_NODE_ORIGIN. It authenticates as Authorization: Maia-Session <credential>, never with the operator's bearer. SESSION_ROLE_OPERATIONS lists what each role reaches:

• worker: node.status, context.show, its own port.lease.*, session.list for its Project and its own mailbox (session.message.send, session.inbox.check, session.inbox.ack);
• orchestrator: the worker operations, project.guard.show for its own Project, session.create of children in its own Workspace, and session.show, session.start, session.stop, turn.send and turn.show for its own child Sessions.

Any other operation fails with role_denied. session.create takes an optional role (default worker), and context.show reports the role of a Session credential.