chore: bump version to 1.0.2

* fix: improve web_fetch reliability — strip scripts, dynamic truncation, more tokens

- strip_html() now removes <script>, <style>, <template>, <noscript>
  element content instead of just their tags
- Truncation budget scales with context window (75% in chars, 50k floor)
  and takes from the beginning only instead of head+tail splice
- max_tokens bumped from 2000 to 8192 so thinking models don't starve
  the visible extraction answer
- reasoning_effort="low" on summarization call to avoid wasting tokens
- Empty responses and empty extractions now report as tool errors

* refactor: extract _utility_completion to fix reasoning_effort duplication

Callers previously had to pass reasoning_effort both as a direct keyword
(for commercial providers) and via _provider_extra_params (for local
model servers).  This duplication was easy to get wrong — web_fetch was
already missing the direct keyword.

_utility_completion threads it through both paths from a single call,
used by title generation, compaction, and web_fetch extraction.

* fix: disable thinking when max_tokens too small, cap extraction at 500k

_reasoning_params now returns empty dict when max_tokens can't fit a
thinking budget (e.g. title gen with max_tokens=200).  Previously
produced budget_tokens >= max_tokens which is an API error on
manual-thinking Anthropic models.

Also caps web_fetch content truncation at 500k chars — the dynamic
context-window calc was producing 3M chars on 1M-context models.

* fix: clamp utility max_tokens to model output limit, add strip_html tests

_utility_completion now clamps max_tokens to the model's advertised
max_output_tokens so small/local models don't reject 8192-token
requests.

Adds 8 tests for invisible element stripping (script, style, template,
noscript) including multiline, case-insensitive, and attribute cases.

* fix: mock get_capabilities in title retry tests for _utility_completion

_utility_completion calls _get_capabilities to clamp max_tokens.  The
existing title tests mocked _provider as a bare MagicMock, so
caps.max_output_tokens was a truthy MagicMock instead of an int.  Set
get_capabilities to return a real ModelCapabilities instance.

.env.example

@@ -1,29 +1,49 @@
 # =============================================================================
 # Turnstone Environment Variables
-# Copy to .env and adjust values for your deployment
+# Copy to .env and adjust values for your deployment.
+#
+# Usage:
+# Single node: docker compose --profile production up
+# 10-node cluster: docker compose --profile cluster up
 # =============================================================================
 
 # -- LLM Backend --------------------------------------------------------------
 LLM_BASE_URL=http://host.docker.internal:8000/v1
-OPENAI_API_KEY=sk-...
-# ANTHROPIC_API_KEY=sk-ant-...  # Set instead for Anthropic provider
-# TAVILY_API_KEY=tvly-...       # For web search fallback (local models only)
+OPENAI_API_KEY=dummy
+# ANTHROPIC_API_KEY=sk-ant-...# Set instead of OPENAI_API_KEY for Anthropic
+# TAVILY_API_KEY=tvly-... # Web search fallback (local models only)
+# MODEL=# Override default model alias
 
-# -- Database (production profile) --------------------------------------------
+# -- Authentication (required) ------------------------------------------------
+# Generate with: python -c "import secrets; print(secrets.token_hex(32))"
+TURNSTONE_JWT_SECRET=changeme-to-32-bytes-of-hex
+
+# -- Database ------------------------------------------------------------------
+# Single-node default is SQLite (zero config). Set these for PostgreSQL:
 # DB_BACKEND=postgresql
 # POSTGRES_USER=turnstone
 # POSTGRES_PASSWORD=changeme
 # DATABASE_URL=postgresql+psycopg://turnstone:changeme@postgres:5432/turnstone
 
-# -- Redis ---------------------------------------------------------------------
-# REDIS_PASSWORD=
-# REDIS_PORT=6379
-
-# -- Authentication ------------------------------------------------------------
-# TURNSTONE_AUTH_ENABLED=true
-# TURNSTONE_AUTH_TOKEN=your-secret-token
-# TURNSTONE_JWT_SECRET=python -c "import secrets; print(secrets.token_hex(32))"
-
 # -- Ports ---------------------------------------------------------------------
 # SERVER_PORT=8080
 # CONSOLE_PORT=8090
+
+# -- Workspace -----------------------------------------------------------------
+# Bind-mount a host directory into the container at /workspace.
+# The model can read/write files here. Default: empty Docker volume.
+# WORKSPACE_MOUNT=/path/to/your/project
+
+# -- Agent behavior ------------------------------------------------------------
+# SKIP_PERMISSIONS=true # Auto-approve all tool calls (dev only)
+# MCP_CONFIG=/workspace/mcp.json# MCP server configuration file
+
+# -- Discord channel gateway ---------------------------------------------------
+# TURNSTONE_DISCORD_TOKEN=
+# TURNSTONE_DISCORD_GUILD=0
+
+# -- Cluster (profile: cluster) -----------------------------------------------
+# These are set per-node in compose.yaml; only override for custom topologies.
+# TURNSTONE_NODE_ID=node-1
+# TURNSTONE_ADVERTISE_URL=http://server-1:8080
+

.github/renovate.json

@@ -83,7 +83,7 @@
     {
       "description": "Infrastructure dependencies",
       "groupName": "Infrastructure",
-      "matchPackageNames": ["structlog", "redis", "croniter", "discord.py"],
+      "matchPackageNames": ["structlog", "croniter", "discord.py"],
       "schedule": ["before 9am on the first day of the month"],
       "automerge": true,
       "matchUpdateTypes": ["patch"]
@@ -101,7 +101,6 @@
       "matchPackageNames": [
         "ruff",
         "mypy",
-        "types-redis",
         "pytest",
         "pytest-cov",
         "pre-commit"

.github/workflows/ci.yml

@@ -2,9 +2,10 @@ name: CI
 
 on:
   push:
-    branches: [main]
+    branches: [main, "stable/*"]
+    tags: ["v*"]
   pull_request:
-    branches: [main]
+    branches: [main, "stable/*"]
 
 jobs:
   lint:
@@ -25,8 +26,8 @@ jobs:
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: "3.14"
-      - run: pip install mypy types-redis
-      - run: pip install -e ".[mq]"
+      - run: pip install mypy
+      - run: pip install -e ".[all]"
       - run: mypy turnstone/
 
   test:
@@ -39,7 +40,7 @@ jobs:
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: ${{ matrix.python-version }}
-      - run: pip install -e ".[test,mq]"
+      - run: pip install -e ".[test]"
       - run: pytest tests/ -m "not live" --cov=turnstone --cov-report=term-missing --cov-report=xml -q
       - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
@@ -68,11 +69,58 @@ jobs:
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: "3.14"
-      - run: pip install -e ".[test,mq,postgres]"
+      - run: pip install -e ".[test,postgres]"
       - run: pytest tests/ -m "not live" --storage-backend=postgresql -q
         env:
           TURNSTONE_TEST_PG_URL: postgresql+psycopg://postgres:postgres@localhost:5432/turnstone_test
 
+  wheel-completeness:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        with:
+          python-version: "3.14"
+      - run: pip install build
+      - run: python -m build --wheel
+      - name: Check all data files are in wheel
+        run: |
+          SOURCE=$(find turnstone -type f \
+            ! -name '*.py' ! -name '*.pyc' ! -path '*__pycache__*' \
+            | sort)
+          WHEEL=$(python -m zipfile -l dist/*.whl \
+            | awk '{print $1}' \
+            | grep -v '\.py$' | grep -v '\.dist-info' | grep -v '\.pyc' | grep -v '^File$' \
+            | sort)
+
+          # Files intentionally excluded from the wheel (one per line)
+          ALLOW="
+          turnstone/core/storage/migrations/script.py.mako
+          "
+
+          MISSING=$(comm -23 <(echo "$SOURCE") <(echo "$WHEEL") \
+            | grep -vFxf <(echo "$ALLOW" | sed '/^[[:space:]]*$/d; s/^[[:space:]]*//' ) || true)
+
+          if [ -n "$MISSING" ]; then
+            echo "::error::Data files in source tree but missing from wheel:"
+            echo "$MISSING"
+            echo ""
+            echo "Add them to [tool.hatch.build.targets.wheel] in pyproject.toml"
+            echo "or to the ALLOW list in this job if intentionally excluded."
+            exit 1
+          fi
+          echo "All source data files present in wheel"
+      - name: Smoke-test entry points from installed wheel
+        run: |
+          python -m venv /tmp/smoke
+          /tmp/smoke/bin/pip install dist/*.whl
+          /tmp/smoke/bin/turnstone --help
+          /tmp/smoke/bin/turnstone-server --help
+          /tmp/smoke/bin/turnstone-console --help
+          /tmp/smoke/bin/turnstone-admin --help
+          /tmp/smoke/bin/turnstone-channel --help
+          /tmp/smoke/bin/turnstone-bootstrap --help
+
   lock-check:
     runs-on: ubuntu-latest
     steps:

.github/workflows/docker-publish.yml

@@ -0,0 +1,79 @@
+name: Publish Docker Image
+
+on:
+  workflow_run:
+    workflows: ["CI"]
+    types: [completed]
+
+concurrency:
+  group: docker-${{ github.event.workflow_run.head_sha }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  packages: write
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  docker:
+    if: github.event.workflow_run.conclusion == 'success'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          ref: ${{ github.event.workflow_run.head_sha }}
+          fetch-depth: 0
+
+      - name: Resolve release tag
+        id: tag
+        run: |
+          TAG=$(git tag --points-at HEAD | grep '^v' | head -1)
+          if [ -z "$TAG" ]; then
+            echo "No v* tag at HEAD — skipping publish"
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
+            echo "skip=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Log in to GHCR
+        if: steps.tag.outputs.skip == 'false'
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Compute Docker tags
+        if: steps.tag.outputs.skip == 'false'
+        id: tags
+        env:
+          REF: ${{ steps.tag.outputs.tag }}
+        run: |
+          VERSION="${REF#v}"
+          FULL="${REGISTRY}/${IMAGE_NAME}"
+          FULL="${FULL,,}"
+
+          if echo "$VERSION" | grep -qE '(a|b|rc)[0-9]+$'; then
+            TAGS="${FULL}:${VERSION},${FULL}:experimental"
+          else
+            MINOR="${VERSION%.*}"
+            TAGS="${FULL}:${VERSION},${FULL}:${MINOR},${FULL}:stable,${FULL}:latest"
+          fi
+          echo "tags=${TAGS}" >> "$GITHUB_OUTPUT"
+
+      - uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3
+        if: steps.tag.outputs.skip == 'false'
+
+      - name: Build and push
+        if: steps.tag.outputs.skip == 'false'
+        uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 # v6
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.tags.outputs.tags }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.github/workflows/docker-scan.yml

@@ -2,7 +2,7 @@ name: Docker Security Scan
 
 on:
   push:
-    branches: [main]
+    branches: [main, "stable/*"]
   schedule:
     - cron: "0 6 * * 1"  # Weekly Monday 06:00 UTC
 

.github/workflows/publish.yml

@@ -1,8 +1,13 @@
 name: Publish to PyPI
 
 on:
-  push:
-    tags: ["v*"]
+  workflow_run:
+    workflows: ["CI"]
+    types: [completed]
+
+concurrency:
+  group: publish-${{ github.event.workflow_run.head_sha }}
+  cancel-in-progress: true
 
 permissions:
   contents: write
@@ -10,20 +15,43 @@ permissions:
 
 jobs:
   publish:
+    if: github.event.workflow_run.conclusion == 'success'
     runs-on: ubuntu-latest
     environment: pypi
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          ref: ${{ github.event.workflow_run.head_sha }}
+          fetch-depth: 0
+
+      - name: Resolve release tag
+        id: tag
+        run: |
+          TAG=$(git tag --points-at HEAD | grep '^v' | head -1)
+          if [ -z "$TAG" ]; then
+            echo "No v* tag at HEAD — skipping publish"
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
+            echo "skip=false" >> "$GITHUB_OUTPUT"
+          fi
+
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        if: steps.tag.outputs.skip == 'false'
         with:
           python-version: "3.14"
       - run: pip install build
+        if: steps.tag.outputs.skip == 'false'
       - run: python -m build
+        if: steps.tag.outputs.skip == 'false'
       - uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1
+        if: steps.tag.outputs.skip == 'false'
 
       - name: Create GitHub Release
+        if: steps.tag.outputs.skip == 'false'
         uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2
         with:
+          tag_name: ${{ steps.tag.outputs.tag }}
           generate_release_notes: true
           draft: false
-          prerelease: ${{ contains(github.ref, '-') }}
+          prerelease: ${{ contains(steps.tag.outputs.tag, 'a') || contains(steps.tag.outputs.tag, 'b') || contains(steps.tag.outputs.tag, 'rc') }}

.trivyignore

@@ -17,3 +17,24 @@ CVE-2026-27135
 # Affects libsystemd0, libudev1
 # https://avd.aquasec.com/nvd/cve-2026-29111
 CVE-2026-29111
+
+# glibc iconv() DoS — fix_deferred, no patched libc in Debian 13 yet
+# Affects libc-bin, libc6
+# https://avd.aquasec.com/nvd/cve-2026-4046
+CVE-2026-4046
+
+# minimatch ReDoS — transitive npm dep (MCP server), no direct exposure
+# https://avd.aquasec.com/nvd/cve-2026-27903
+CVE-2026-27903
+# https://avd.aquasec.com/nvd/cve-2026-27904
+CVE-2026-27904
+
+# picomatch ReDoS — transitive npm dep, no direct exposure
+# https://avd.aquasec.com/nvd/cve-2026-33671
+CVE-2026-33671
+
+# node-tar path traversal — transitive npm dep, not used to extract untrusted archives
+# https://avd.aquasec.com/nvd/cve-2026-29786
+CVE-2026-29786
+# https://avd.aquasec.com/nvd/cve-2026-31802
+CVE-2026-31802

Dockerfile

@@ -8,7 +8,7 @@ FROM python:3.14-slim
 LABEL org.opencontainers.image.title="turnstone" \
       org.opencontainers.image.description="Multi-node AI orchestration platform"
 
-COPY --from=ghcr.io/astral-sh/uv:0.11.2 /uv /usr/local/bin/uv
+COPY --from=ghcr.io/astral-sh/uv:0.11.3 /uv /usr/local/bin/uv
 
 # Remove the slim image's man page exclusion so man-db has actual content
 RUN rm -f /etc/dpkg/dpkg.cfg.d/docker
@@ -18,6 +18,12 @@ RUN apt-get update && apt-get upgrade -y && apt-get install -y --no-install-reco
     libpq5 git curl jq man-db manpages procps file \
     && rm -rf /var/lib/apt/lists/*
 
+# Node.js LTS (for npx-based MCP servers like @modelcontextprotocol/server-github)
+COPY --from=node:24-slim /usr/local/bin/node /usr/local/bin/node
+COPY --from=node:24-slim /usr/local/lib/node_modules /usr/local/lib/node_modules
+RUN ln -s ../lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm \
+    && ln -s ../lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx
+
 # Non-root user
 RUN useradd --create-home --shell /bin/bash turnstone
 
@@ -49,6 +55,9 @@ COPY docker/entrypoint.sh /usr/local/bin/entrypoint.sh
 WORKDIR /data
 RUN chown turnstone:turnstone /data
 
+# Workspace mount point — bind-mount a host directory here
+RUN mkdir -p /workspace && chown turnstone:turnstone /workspace
+
 USER turnstone
 
 ENTRYPOINT ["entrypoint.sh"]

README.md

@@ -7,10 +7,21 @@
 
 Multi-node AI orchestration platform. Deploy tool-using AI agents across a cluster of servers with direct HTTP routing, interactive interfaces, and enterprise governance.
 
-> **Beta — Use at your own risk.** APIs, configuration formats, and database schemas may change between versions without migration paths.
+<p align="center">
+  <img src="docs/assets/hero.png" alt="Turnstone console — multi-workstream AI orchestration with mermaid diagrams" width="960"/>
+</p>
 
 Named after the [Ruddy Turnstone](https://en.wikipedia.org/wiki/Ruddy_turnstone) (*Arenaria interpres*) — a shorebird that flips stones to discover what's hiding underneath.
 
+### Release Tracks
+
+| Track | Install | Docker | Description |
+|-------|---------|--------|-------------|
+| **Stable** | `pip install turnstone` | `ghcr.io/turnstonelabs/turnstone:stable` | Production-grade. Bugfixes only. |
+| **Experimental** | `pip install turnstone --pre` | `ghcr.io/turnstonelabs/turnstone:experimental` | New features. May have rough edges. |
+
+See [docs/releasing.md](docs/releasing.md) for the full release process.
+
 ## What it does
 
 Turnstone gives LLMs tools — shell, files, search, web, planning — and orchestrates multi-turn conversations where the model investigates, acts, and reports.

compose.yaml

@@ -6,7 +6,6 @@
 #   Single node:          docker compose --profile production up
 #   Production (PG):      DB_BACKEND=postgresql docker compose --profile production up
 #   10-node cluster:      docker compose --profile cluster up
-#   Cluster + DDG:        docker compose --profile ddgCluster up
 # =============================================================================
 
 name: turnstone
@@ -17,6 +16,7 @@ networks:
 
 volumes:
   turnstone-data:
+  workspace:
   postgres-data:
 
 services:
@@ -28,7 +28,6 @@ services:
     profiles:
       - production
       - cluster
-      - ddgCluster
     command:
       - postgres
       - -c
@@ -61,9 +60,7 @@ services:
   # turnstone-server — Web UI + chat workstreams + LLM interaction
   # -------------------------------------------------------------------
   server:
-    build:
-      context: .
-      dockerfile: Dockerfile
+    image: turnstone:local
     profiles:
       - production
     command:
@@ -82,15 +79,14 @@ services:
       - "${SERVER_PORT:-8080}:8080"
     volumes:
       - turnstone-data:/data
-      - ./docker/mcp-ddg.json:/etc/turnstone/mcp-ddg.json:ro
+      - ${WORKSPACE_MOUNT:-workspace}:/workspace
     environment:
       - LLM_BASE_URL=${LLM_BASE_URL:-http://host.docker.internal:8000/v1}
       - OPENAI_API_KEY=${OPENAI_API_KEY:-dummy}
       - TAVILY_API_KEY=${TAVILY_API_KEY:-}
       - SKIP_PERMISSIONS=${SKIP_PERMISSIONS:-}
-      - TURNSTONE_AUTH_ENABLED=${TURNSTONE_AUTH_ENABLED:-}
-      - TURNSTONE_AUTH_TOKEN=${TURNSTONE_AUTH_TOKEN:-}
-      - TURNSTONE_JWT_SECRET=${TURNSTONE_JWT_SECRET:-}
+      # Generate with: python -c "import secrets; print(secrets.token_hex(32))"
+      - TURNSTONE_JWT_SECRET=${TURNSTONE_JWT_SECRET:?Set TURNSTONE_JWT_SECRET in .env}
       - MODEL=${MODEL:-}
       - MCP_CONFIG=${MCP_CONFIG:-}
       - TURNSTONE_DB_BACKEND=${DB_BACKEND:-sqlite}
@@ -105,9 +101,6 @@ services:
       postgres:
         condition: service_healthy
         required: false
-      ddg-search:
-        condition: service_healthy
-        required: false
     healthcheck:
       test: ["CMD", "python", "/usr/local/bin/healthcheck.py", "http://127.0.0.1:8080/health"]
       interval: 10s
@@ -120,6 +113,7 @@ services:
   # turnstone-console — Cluster dashboard
   # -------------------------------------------------------------------
   console:
+    image: turnstone:local
     build:
       context: .
       dockerfile: Dockerfile
@@ -130,9 +124,8 @@ services:
     ports:
       - "${CONSOLE_PORT:-8090}:8090"
     environment:
-      - TURNSTONE_AUTH_ENABLED=${TURNSTONE_AUTH_ENABLED:-}
-      - TURNSTONE_AUTH_TOKEN=${TURNSTONE_AUTH_TOKEN:-}
-      - TURNSTONE_JWT_SECRET=${TURNSTONE_JWT_SECRET:-}
+      # Generate with: python -c "import secrets; print(secrets.token_hex(32))"
+      - TURNSTONE_JWT_SECRET=${TURNSTONE_JWT_SECRET:?Set TURNSTONE_JWT_SECRET in .env}
       - TURNSTONE_DB_BACKEND=${DB_BACKEND:-sqlite}
       - TURNSTONE_DB_URL=${DATABASE_URL:-}
       - TURNSTONE_CONSOLE_URL=http://console:8090
@@ -151,13 +144,10 @@ services:
   # Requires TURNSTONE_DISCORD_TOKEN to enable Discord adapter
   # -------------------------------------------------------------------
   channel:
-    build:
-      context: .
-      dockerfile: Dockerfile
+    image: turnstone:local
     profiles:
       - production
       - cluster
-      - ddgCluster
     command:
       - sh
       - -c
@@ -168,8 +158,8 @@ services:
     environment:
       - TURNSTONE_DISCORD_TOKEN=${TURNSTONE_DISCORD_TOKEN:-}
       - TURNSTONE_DISCORD_GUILD=${TURNSTONE_DISCORD_GUILD:-0}
-      - TURNSTONE_AUTH_TOKEN=${TURNSTONE_AUTH_TOKEN:-}
-      - TURNSTONE_JWT_SECRET=${TURNSTONE_JWT_SECRET:-}
+      # Generate with: python -c "import secrets; print(secrets.token_hex(32))"
+      - TURNSTONE_JWT_SECRET=${TURNSTONE_JWT_SECRET:?Set TURNSTONE_JWT_SECRET in .env}
       - TURNSTONE_DB_BACKEND=${DB_BACKEND:-postgresql}
       - TURNSTONE_DB_URL=${DATABASE_URL:-postgresql://${POSTGRES_USER:-turnstone}:${POSTGRES_PASSWORD:-turnstone}@postgres:5432/turnstone}
       - TURNSTONE_CHANNEL_ADVERTISE_URL=http://channel:8091
@@ -181,39 +171,6 @@ services:
         required: false
     restart: unless-stopped
 
-  # -------------------------------------------------------------------
-  # ddg-search — DuckDuckGo Search MCP server (HTTP transport)
-  # Provides web search + content fetch tools to turnstone via MCP.
-  # No API key required.
-  #
-  # Start with: MCP_CONFIG=/etc/turnstone/mcp-ddg.json \
-  #             docker compose --profile ddgCluster up
-  # -------------------------------------------------------------------
-  ddg-search:
-    image: python:3.14-slim
-    profiles:
-      - ddgCluster
-    command:
-      - sh
-      - -c
-      - >-
-        pip install --no-cache-dir duckduckgo-mcp-server &&
-        python -c "from mcp.server.transport_security import TransportSecuritySettings; import duckduckgo_mcp_server.server as s; s.safe_search=s.SafeSearchMode.OFF; s.mcp.settings.host='0.0.0.0'; s.mcp.settings.port=3000; s.mcp.settings.transport_security=TransportSecuritySettings(enable_dns_rebinding_protection=False); s.mcp.run(transport='streamable-http')"
-    networks:
-      - turnstone-net
-    healthcheck:
-      test: ["CMD-SHELL", "python -c \"import socket; s=socket.create_connection(('0.0.0.0',3000),2); s.close()\""]
-      interval: 10s
-      timeout: 5s
-      retries: 3
-      start_period: 30s
-    deploy:
-      resources:
-        limits:
-          memory: 256M
-          cpus: '0.25'
-    restart: unless-stopped
-
   # ===================================================================
   # 10-node cluster (profile: cluster)
   #
@@ -228,7 +185,7 @@ services:
   server-1: &cluster-server
     image: turnstone:local
     build: { context: ., dockerfile: Dockerfile }
-    profiles: [cluster, ddgCluster]
+    profiles: [cluster]
     command:
       - sh
       - -c
@@ -243,15 +200,14 @@ services:
         $${MCP_CONFIG:+--mcp-config $$MCP_CONFIG}
     volumes:
       - turnstone-data:/data
-      - ./docker/mcp-ddg.json:/etc/turnstone/mcp-ddg.json:ro
+      - ${WORKSPACE_MOUNT:-workspace}:/workspace
     environment: &cluster-server-env
       LLM_BASE_URL: ${LLM_BASE_URL:-http://host.docker.internal:8000/v1}
       OPENAI_API_KEY: ${OPENAI_API_KEY:-dummy}
       TAVILY_API_KEY: ${TAVILY_API_KEY:-}
       SKIP_PERMISSIONS: ${SKIP_PERMISSIONS:-}
-      TURNSTONE_AUTH_ENABLED: ${TURNSTONE_AUTH_ENABLED:-}
-      TURNSTONE_AUTH_TOKEN: ${TURNSTONE_AUTH_TOKEN:-}
-      TURNSTONE_JWT_SECRET: ${TURNSTONE_JWT_SECRET:-}
+      # Generate with: python -c "import secrets; print(secrets.token_hex(32))"
+      TURNSTONE_JWT_SECRET: ${TURNSTONE_JWT_SECRET:?Set TURNSTONE_JWT_SECRET in .env}
       MODEL: ${MODEL:-}
       MCP_CONFIG: ${MCP_CONFIG:-}
       TURNSTONE_DB_BACKEND: ${DB_BACKEND:-postgresql}
@@ -262,7 +218,6 @@ services:
     networks: [turnstone-net]
     depends_on:
       postgres: { condition: service_healthy }
-      ddg-search: { condition: service_healthy, required: false }
     healthcheck:
       test: ["CMD", "python", "/usr/local/bin/healthcheck.py", "http://127.0.0.1:8080/health"]
       interval: 10s

deploy/helm/turnstone/templates/deployment-console.yaml

@@ -36,13 +36,13 @@ spec:
             - secretRef:
                 name: {{ include "turnstone.llm.secretName" . }}
                 optional: true
-          {{- if and .Values.auth.enabled .Values.auth.existingSecret }}
+          {{- if or .Values.auth.existingSecret .Values.auth.jwtSecret }}
           env:
-            - name: TURNSTONE_AUTH_TOKEN
+            - name: TURNSTONE_JWT_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: {{ .Values.auth.existingSecret }}
-                  key: TURNSTONE_AUTH_TOKEN
+                  name: {{ include "turnstone.auth.secretName" . }}
+                  key: TURNSTONE_JWT_SECRET
           {{- end }}
           readinessProbe:
             httpGet:

deploy/helm/turnstone/templates/deployment-server.yaml

@@ -41,12 +41,12 @@ spec:
           env:
             - name: TURNSTONE_DB_URL
               value: "postgresql+psycopg://$(TURNSTONE_DB_USER):$(POSTGRES_PASSWORD)@$(TURNSTONE_DB_HOST):$(TURNSTONE_DB_PORT)/$(TURNSTONE_DB_NAME)"
-          {{- if and .Values.auth.enabled .Values.auth.existingSecret }}
-            - name: TURNSTONE_AUTH_TOKEN
+          {{- if or .Values.auth.existingSecret .Values.auth.jwtSecret }}
+            - name: TURNSTONE_JWT_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: {{ .Values.auth.existingSecret }}
-                  key: TURNSTONE_AUTH_TOKEN
+                  name: {{ include "turnstone.auth.secretName" . }}
+                  key: TURNSTONE_JWT_SECRET
           {{- end }}
           readinessProbe:
             httpGet:

deploy/helm/turnstone/templates/secret.yaml

@@ -15,7 +15,7 @@ data:
   {{- else if and (not .Values.postgresql.enabled) .Values.database.external.password }}
   POSTGRES_PASSWORD: {{ .Values.database.external.password | b64enc | quote }}
   {{- end }}
-  {{- if and .Values.auth.enabled .Values.auth.token (not .Values.auth.existingSecret) }}
-  TURNSTONE_AUTH_TOKEN: {{ .Values.auth.token | b64enc | quote }}
+  {{- if and .Values.auth.jwtSecret (not .Values.auth.existingSecret) }}
+  TURNSTONE_JWT_SECRET: {{ .Values.auth.jwtSecret | b64enc | quote }}
   {{- end }}
 {{- end }}

deploy/helm/turnstone/values.yaml

@@ -59,10 +59,9 @@ llm:
   apiKey: ""
   existingSecret: ""
 
-# -- Authentication
+# -- Authentication (always enabled, JWT secret required)
 auth:
-  enabled: false
-  token: ""
+  jwtSecret: ""
   existingSecret: ""
 
 # -- Ingress configuration

deploy/terraform/modules/aws-ecs/iam.tf

@@ -40,8 +40,8 @@ resource "aws_iam_role_policy" "ecs_execution_secrets" {
           [
             aws_secretsmanager_secret.openai_api_key.arn,
             aws_secretsmanager_secret.db_password.arn,
+            aws_secretsmanager_secret.jwt_secret.arn,
           ],
-          var.auth_token != "" ? [aws_secretsmanager_secret.auth_token[0].arn] : [],
         )
       },
     ]

deploy/terraform/modules/aws-ecs/main.tf

@@ -41,20 +41,26 @@ locals {
     },
   ]
 
-  auth_env = var.auth_token != "" ? [
-    { name = "TURNSTONE_AUTH_ENABLED", value = "true" },
-  ] : []
-
-  auth_secrets = var.auth_token != "" ? [
+  auth_secrets = [
     {
-      name      = "TURNSTONE_AUTH_TOKEN"
-      valueFrom = aws_secretsmanager_secret_version.auth_token[0].arn
+      name      = "TURNSTONE_JWT_SECRET"
+      valueFrom = aws_secretsmanager_secret_version.jwt_secret.arn
     },
-  ] : []
+  ]
 }
 
 # ---------- Secrets Manager ----------
 
+resource "aws_secretsmanager_secret" "jwt_secret" {
+  name = "${var.name_prefix}-${var.environment}-jwt-secret"
+  tags = local.common_tags
+}
+
+resource "aws_secretsmanager_secret_version" "jwt_secret" {
+  secret_id     = aws_secretsmanager_secret.jwt_secret.id
+  secret_string = var.jwt_secret
+}
+
 resource "aws_secretsmanager_secret" "openai_api_key" {
   name = "${var.name_prefix}-${var.environment}-openai-api-key"
   tags = local.common_tags
@@ -65,17 +71,7 @@ resource "aws_secretsmanager_secret_version" "openai_api_key" {
   secret_string = var.openai_api_key
 }
 
-resource "aws_secretsmanager_secret" "auth_token" {
-  count = var.auth_token != "" ? 1 : 0
-  name  = "${var.name_prefix}-${var.environment}-auth-token"
-  tags  = local.common_tags
-}
 
-resource "aws_secretsmanager_secret_version" "auth_token" {
-  count         = var.auth_token != "" ? 1 : 0
-  secret_id     = aws_secretsmanager_secret.auth_token[0].id
-  secret_string = var.auth_token
-}
 
 resource "aws_secretsmanager_secret" "db_password" {
   name = "${var.name_prefix}-${var.environment}-db-password"
@@ -140,7 +136,7 @@ resource "aws_ecs_task_definition" "server" {
         { containerPort = 8080, protocol = "tcp" },
       ]
 
-      environment = concat(local.common_env, local.auth_env)
+      environment = local.common_env
       secrets     = concat(local.common_secrets, local.auth_secrets)
 
       logConfiguration = {
@@ -209,7 +205,7 @@ resource "aws_ecs_task_definition" "console" {
         { containerPort = 8090, protocol = "tcp" },
       ]
 
-      environment = concat(local.common_env, local.auth_env)
+      environment = local.common_env
       secrets     = concat(local.common_secrets, local.auth_secrets)
 
       logConfiguration = {

deploy/terraform/modules/aws-ecs/variables.tf

@@ -90,11 +90,10 @@ variable "name_prefix" {
   default     = "turnstone"
 }
 
-variable "auth_token" {
-  description = "Optional authentication token for the Turnstone API. Empty string disables auth."
+variable "jwt_secret" {
+  description = "JWT signing secret for Turnstone auth (required, min 32 characters)."
   type        = string
   sensitive   = true
-  default     = ""
 }
 
 variable "certificate_arn" {

docker/mcp-ddg.json

@@ -1,7 +0,0 @@
-{
-  "mcpServers": {
-    "ddg": {
-      "url": "http://ddg-search:3000/mcp"
-    }
-  }
-}

docs/api-reference.md

@@ -56,7 +56,7 @@ console.log(result.content);
 
 ## Authentication
 
-When auth is enabled (`[auth].enabled = true` or `TURNSTONE_AUTH_ENABLED=1`), all API endpoints except public paths require a valid token.
+Auth is always enabled. All API endpoints except public paths require a valid token.
 
 ### Sending Credentials
 
@@ -65,15 +65,14 @@ Include a token in one of two ways:
 - **Bearer header**: `Authorization: Bearer <token>`
 - **Cookie**: `turnstone_auth=<token>` (set automatically by the login endpoint)
 
-The server accepts three token types:
+The server accepts two token types:
 
 | Type | Format | Example |
 |------|--------|---------|
 | JWT | Base64 segments separated by dots | `eyJhbG...` |
 | API token | `ts_` prefix + 64 hex chars | `ts_a1b2c3d4...` |
-| Config token | Arbitrary string from `config.toml` | `my-secret-token` |
 
-JWTs are the recommended credential for browser sessions. API tokens are suitable for programmatic access and CI/CD. Config tokens are a simple option for single-node deployments.
+JWTs are the recommended credential for browser sessions. API tokens are suitable for programmatic access and CI/CD.
 
 ### `POST /v1/api/auth/login`
 

docs/architecture.md

@@ -1016,13 +1016,10 @@ limits using a token-bucket algorithm. Each IP gets a `TokenBucket` with
 Turnstone supports three authentication mechanisms, unified behind an
 `AuthResult` dataclass that carries `user_id`, `scopes`, and `token_source`:
 
-1. **Config-file tokens** — static secrets in `config.toml` `[[auth.tokens]]`
-   or the `TURNSTONE_AUTH_TOKEN` env var. Validated in-memory via
-   `hmac.compare_digest`. Map to scopes through their role (`read` or `full`).
-2. **API tokens** — database-backed, prefixed `ts_`, stored as SHA-256 hashes
+1. **API tokens** — database-backed, prefixed `ts_`, stored as SHA-256 hashes
    in the `api_tokens` table. Can be exchanged for JWTs via
    `POST /v1/api/auth/login`.
-3. **JWTs** — short-lived HMAC-SHA256 session tokens (default 24h) issued after
+2. **JWTs** — short-lived HMAC-SHA256 session tokens (default 24h) issued after
    successful credential validation. Contain `sub` (user_id), `scopes`, and
    `src` (origin) in claims.
 
@@ -1046,9 +1043,8 @@ Three hierarchical scopes control endpoint access:
 2. **Token extraction** — `Authorization: Bearer <token>` header first, then
    `turnstone_auth` cookie as fallback.
 3. **Token type detection** — dots in the token indicate JWT; `ts_` prefix
-   indicates API token; otherwise config-file token.
-4. **Validation** — JWT signature check, API token hash lookup in storage, or
-   config-token hmac comparison.
+   indicates API token.
+4. **Validation** — JWT signature check or API token hash lookup in storage.
 5. **Scope check** — `required_scope(method, path)` determines the minimum
    scope; the request is rejected with 403 if the token lacks it.
 6. **Context propagation** — on success, `ctx_user_id` is set so structured

docs/assets/hero.png

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:75c1832b6079e8628f4bbf4ce98d37880c4de133636b7555e3869990b046ddc6
+size 567704

docs/channels.md

@@ -193,7 +193,6 @@ Plan review requests are displayed as a blue embed with:
 | `--auto-approve` | — | `false` | Auto-approve ALL tool calls (skips approval buttons entirely) |
 | `--http-host` | — | `127.0.0.1` | HTTP server bind address for notify endpoint |
 | `--http-port` | `TURNSTONE_CHANNEL_PORT` | `8091` | HTTP server port |
-| `--auth-token` | `TURNSTONE_CHANNEL_AUTH_TOKEN` | — | Static auth token for `/v1/api/notify` (alternative to JWT) |
 | `--log-level` | `TURNSTONE_LOG_LEVEL` | `INFO` | Log level |
 | `--log-format` | `TURNSTONE_LOG_FORMAT` | `auto` | Log format (`auto`/`json`/`text`) |
 
@@ -321,11 +320,11 @@ The `services` table schema:
 ### Security
 
 - **Authentication** — the gateway's `POST /v1/api/notify` endpoint
-  requires authentication. Configure either `TURNSTONE_JWT_SECRET`
-  (the server mints JWTs with `aud: turnstone-channel` automatically)
-  or a static token via `--auth-token`. If neither is set, the
-  gateway fails closed and rejects all requests with 401. Server JWTs
-  (`aud: turnstone-server`) are rejected.
+  requires authentication. Configure `TURNSTONE_JWT_SECRET` so the
+  server can mint JWTs with `aud: turnstone-channel` automatically.
+  If the secret is not set, the gateway fails closed and rejects all
+  requests with 401. Server JWTs (`aud: turnstone-server`) are
+  rejected.
 - **Rate limit** — maximum 5 notifications per turn. The counter only
   increments on successful delivery, so failures don't consume the
   budget.

docs/console.md

@@ -628,7 +628,6 @@ CLI flags for `turnstone-console`:
 |------|---------|-------------|
 | `--host` | `0.0.0.0` | Bind host |
 | `--port` | `8090` | HTTP port |
-| `--auth-token` | `$TURNSTONE_AUTH_TOKEN` | Bearer token for server node communication and proxy |
 | `--log-level` | `INFO` | Log level |
 
 Config file (`~/.config/turnstone/config.toml`):
@@ -649,7 +648,7 @@ url = "http://localhost:8090"   # used by CLI /cluster commands
 turnstone-server --port 8080
 
 # Start cluster console (one instance)
-turnstone-console --port 8090 --auth-token "$TURNSTONE_AUTH_TOKEN"
+turnstone-console --port 8090
 ```
 
 Open `http://localhost:8090` for the cluster dashboard. Create workstreams via the "+ new" button. Click any workstream to open the proxied server UI — no direct access to server ports required.

docs/docker.md

@@ -72,11 +72,11 @@ All configuration is via environment variables in `.env` (copy from `.env.exampl
 
 ### Auth
 
+Auth is always enabled. `TURNSTONE_JWT_SECRET` is required.
+
 | Variable | Default | Description |
 |----------|---------|-------------|
-| `TURNSTONE_AUTH_ENABLED` | — | Set to `1` to require authentication |
-| `TURNSTONE_AUTH_TOKEN` | — | Config-file token for server/console (backward compat, works alongside JWT) |
-| `TURNSTONE_JWT_SECRET` | — | Secret key for signing JWTs (required when using user identity / JWT auth) |
+| `TURNSTONE_JWT_SECRET` | — | Secret key for signing JWTs (required) |
 
 ### Database
 

docs/oidc.md

@@ -38,7 +38,7 @@ are set.
 | `TURNSTONE_OIDC_PROVIDER_NAME` | No | `SSO` | Display name for the login button (e.g. "Google", "Okta") |
 | `TURNSTONE_OIDC_ROLE_CLAIM` | No | — | ID token claim containing role/group values (see [Role Mapping](#role-mapping)) |
 | `TURNSTONE_OIDC_ROLE_MAP` | No | — | Mapping from claim values to Turnstone role IDs (see [Role Mapping](#role-mapping)) |
-| `TURNSTONE_OIDC_PASSWORD_ENABLED` | No | `true` | Set to `false` to hide the password form and block all username/password logins (including admin). API tokens and config-file tokens still work. |
+| `TURNSTONE_OIDC_PASSWORD_ENABLED` | No | `true` | Set to `false` to hide the password form and block all username/password logins (including admin). API tokens continue to work. |
 | `TURNSTONE_OIDC_REDIRECT_BASE` | No | — | Externally-reachable origin for the OIDC redirect URI (e.g. `https://app.example.com`). Recommended when running behind a reverse proxy. When unset, derived from the request Host header. |
 
 OIDC is enabled when all three required fields (issuer, client ID, client
@@ -246,10 +246,10 @@ password) before OIDC is enabled. The setup wizard always works
 regardless of this setting because it is only available when zero users
 exist in the database.
 
-API token login (`POST /v1/api/auth/login` with a `ts_` token) and
-config-file tokens (`Authorization: Bearer tok_xxx`) continue to work
-regardless of this setting. OIDC-only mode affects password-based
-authentication only.
+API token login (`POST /v1/api/auth/login` with a `ts_` token)
+continues to work regardless of this setting. JWTs and API tokens are
+the supported authentication methods. OIDC-only mode affects
+password-based authentication only.
 
 ---
 

docs/releasing.md

@@ -0,0 +1,80 @@
+# Release Process
+
+Turnstone uses two parallel release tracks published from a single PyPI package.
+
+## Release Tracks
+
+| Track | Versions | Branch | Docker tags | PyPI install |
+|-------|----------|--------|-------------|--------------|
+| **Stable** | `1.0.0`, `1.0.1` | `stable/1.0` | `:1.0.1`, `:1.0`, `:stable`, `:latest` | `pip install turnstone` |
+| **Experimental** | `1.1.0a1`, `1.1.0a2` | `main` | `:1.1.0a1`, `:experimental` | `pip install turnstone --pre` |
+
+- **Stable** receives bugfixes only. Production-grade.
+- **Experimental** receives new features. May be rough around the edges.
+- When experimental matures, it is promoted to stable. The previous stable branch stops receiving patches.
+
+## Version Scheme
+
+[PEP 440](https://peps.python.org/pep-0440/) pre-release suffixes on a single package:
+
+- `1.0.0` — stable release
+- `1.1.0a1` — alpha (experimental)
+- `1.1.0b1` — beta (experimental, more stable)
+- `1.1.0rc1` — release candidate (experimental, nearly stable)
+- `1.1.0` — promoted to stable
+
+## Releasing an Experimental Version (from main)
+
+```bash
+scripts/release.sh 1.1.0a2 --push
+```
+
+This bumps `pyproject.toml` + `turnstone/__init__.py`, regenerates `uv.lock`, commits, tags `v1.1.0a2`, and pushes. CI runs, then publish + Docker workflows fire automatically.
+
+## Releasing a Stable Patch (from stable/X.Y)
+
+```bash
+git checkout stable/1.0
+git cherry-pick <commit-hash>    # bugfix from main
+scripts/release.sh 1.0.2 --push
+```
+
+## Promoting Experimental to Stable
+
+When `main` is ready for a stable release:
+
+```bash
+# 1. Tag the stable release on main
+scripts/release.sh 1.1.0 --push
+
+# 2. Create the stable maintenance branch from that tag
+git branch stable/1.1 v1.1.0
+git push origin stable/1.1
+
+# 3. Start the next experimental cycle on main
+scripts/release.sh 1.2.0a1 --push
+```
+
+The previous `stable/1.0` branch stops receiving patches at this point.
+
+## CI/CD Pipeline
+
+All releases are gated on CI success:
+
+1. `git push` with `v*` tag triggers **CI** (lint, typecheck, test, test-postgres, lock-check, security audit)
+2. On CI success, **Publish to PyPI** fires via `workflow_run`
+3. On CI success, **Publish Docker Image** fires via `workflow_run`
+
+Pre-release tags (`a`, `b`, `rc` suffixes) produce:
+- PyPI: pre-release version (not installed by default)
+- GitHub Release: marked as pre-release
+- Docker: `:experimental` alias + exact version tag
+
+Stable tags produce:
+- PyPI: stable version (default `pip install`)
+- GitHub Release: full release
+- Docker: `:stable`, `:latest`, `:X.Y`, `:X.Y.Z` tags
+
+## Dependency Updates
+
+Renovate targets `main` (experimental) only. Stable branches receive manual dependency updates via cherry-pick when security-relevant.

docs/sdk.md

@@ -332,6 +332,6 @@ client.login(token="ts_abc123...")
 - `client.logout()` clears the stored JWT from the client.
 - If a request returns 401, the SDK raises `TurnstoneAPIError` — the caller is responsible for re-authenticating.
 
-### Backward Compatibility
+### Token Types
 
-The config-file token (`TURNSTONE_AUTH_TOKEN`) still works as a simple Bearer token for environments that do not use the user/JWT system. When the server receives a non-JWT Bearer token, it falls back to the legacy token check.
+The SDK accepts any Bearer token — JWTs (from `ServiceTokenManager` or login) and API tokens (`ts_` prefix) are both supported. Use `token_factory` for auto-rotating JWTs or a static `token` for API tokens.

docs/security.md

@@ -8,23 +8,6 @@ credentials while individual server nodes validate JWTs locally.
 
 ## Token Types
 
-### Config-file tokens
-
-Static tokens defined in `config.toml` or the `TURNSTONE_AUTH_TOKEN`
-environment variable. Validated in-memory using `hmac.compare_digest`
-(timing-safe). Each token maps to a role that determines its scopes.
-
-```toml
-[[auth.tokens]]
-value = "tok_legacy"
-role = "full"     # full → {read, write, approve}
-```
-
-Role mappings: `"read"` → `{read}`, `"full"` → `{read, write, approve}`.
-
-Config tokens are sent directly as `Authorization: Bearer tok_legacy`
-on every request. No JWT exchange is needed.
-
 ### API tokens
 
 Database-backed tokens prefixed with `ts_`. Created via the admin CLI
@@ -149,15 +132,6 @@ The API token is hashed, looked up in the database, and exchanged for a
 JWT with the token's scopes. This is the recommended flow for SDKs and
 automated clients that need cookie-based sessions.
 
-### Config-file tokens (direct)
-
-Config tokens are validated per-request via `hmac.compare_digest`. No
-login exchange is needed — include the token as a `Bearer` header:
-
-```
-Authorization: Bearer tok_legacy
-```
-
 ### First-time setup
 
 When no users exist in the database:
@@ -276,7 +250,7 @@ Setting `TURNSTONE_OIDC_PASSWORD_ENABLED=false` hides the password
 form on the login page and blocks password-based login at the API
 level. The setup wizard always works regardless of this setting — the
 first admin user is created with a password before OIDC is relevant.
-API tokens and config-file tokens are unaffected by this setting.
+API tokens are unaffected by this setting.
 
 #### Known limitations
 
@@ -297,8 +271,6 @@ and classifies the token:
 
 1. **Contains `.`** → JWT → validate HS256 signature and expiry
 2. **Starts with `ts_`** → API token → SHA-256 hash, database lookup
-3. **Otherwise** → config-file token → `hmac.compare_digest` against
-   each configured token
 
 If a session cookie is present and no `Authorization` header is sent,
 the cookie value is treated as a JWT (step 1).
@@ -332,16 +304,10 @@ deployments.
 | Signing secret | `[auth] jwt_secret` | `TURNSTONE_JWT_SECRET` | Auto-generated ephemeral (warning logged) |
 | Expiry | `[auth] jwt_expiry_hours` | — | 24 hours |
 | Algorithm | — | — | HS256 (not configurable) |
-| Minimum secret length | — | — | 32 characters (warning if shorter) |
+| Minimum secret length | — | — | 32 characters (exits if shorter) |
 
-All service nodes that need to validate JWTs must share the same signing
-secret. If no secret is configured, an ephemeral key is generated at
-startup and a warning is logged — JWTs will not survive restarts or work
-across nodes.
-
-The console **requires** `TURNSTONE_JWT_SECRET` when no `--auth-token`
-is provided. It exits with an error if the secret is missing, since
-ephemeral secrets would silently break inter-service communication.
+All services require `TURNSTONE_JWT_SECRET` and exit at startup if it is
+missing or shorter than 32 characters.
 
 ---
 
@@ -442,16 +408,15 @@ Console (cluster-wide)              Server (per-node)
 ┌──────────────────────┐           ┌──────────────────────┐
 │ User/Token CRUD (DB) │           │ JWT validation only  │
 │ Login: creds → JWT   │           │ (shared signing key) │
-│ Admin API endpoints  │           │ Config tokens: hmac  │
-│ Storage: users,      │           │ No auth DB needed    │
+│ Admin API endpoints  │           │ No auth DB needed    │
+│ Storage: users,      │           │                      │
 │   api_tokens tables  │           │                      │
 └──────────────────────┘           └──────────────────────┘
 ```
 
 The console owns the credential database and handles all user/token
 CRUD.  Individual server nodes only need the JWT signing secret to
-validate session tokens.  Config-file tokens are validated locally
-without any database.
+validate session tokens.
 
 ### Proxy auth forwarding
 
@@ -478,8 +443,7 @@ distinguish proxied requests from direct logins in audit logs.
 
 When no user context is available (auth disabled, or internal requests),
 the proxy falls back to a `ServiceTokenManager` with service identity
-`console-proxy` and full scopes.  If `--auth-token` is provided, that
-static token is used as a final fallback.
+`console-proxy` and full scopes.
 
 ### Service-to-service authentication
 
@@ -518,22 +482,17 @@ channel gateway endpoint, and vice versa.
 
 ```toml
 [auth]
-enabled = true
 jwt_secret = "your-secret-key-here"
 jwt_expiry_hours = 24
-
-[[auth.tokens]]
-value = "tok_legacy"
-role = "full"
 ```
 
 ### Environment variables
 
+Auth is always enabled. `TURNSTONE_JWT_SECRET` is required.
+
 | Variable | Description |
 |----------|-------------|
-| `TURNSTONE_AUTH_ENABLED=1` | Enable authentication |
-| `TURNSTONE_AUTH_TOKEN=tok_xxx` | Register a config-file token with `full` access |
-| `TURNSTONE_JWT_SECRET=xxx` | JWT signing secret (must match across nodes) |
+| `TURNSTONE_JWT_SECRET=xxx` | JWT signing secret (required, must match across nodes) |
 | `TURNSTONE_CORS_ORIGINS=` | CORS allowed origins (comma-separated; empty = same-origin only) |
 
 ---
@@ -571,8 +530,6 @@ and browsers enforce same-origin policy.
 
 ## Security Properties
 
-- **Timing-safe comparison** for config-file tokens via
-  `hmac.compare_digest` — no timing side-channel.
 - **Hash-based lookup** for API tokens — the database stores only
   SHA-256 hashes, eliminating timing attacks on token comparison.
 - **Local JWT validation** — no network call or database query needed

docs/tls.md

@@ -105,7 +105,7 @@ turnstone-admin tls-ca-cert --out ca.pem --console-url http://console:8080
 turnstone-admin tls-issue worker-1.internal --out /certs --console-url http://console:8080
 
 # List issued certs
-turnstone-admin tls-list --console-url http://console:8080 --auth-token $TOKEN
+turnstone-admin tls-list --console-url http://console:8080
 ```
 
 ### Console URL Discovery

docs/tools.md

@@ -593,7 +593,7 @@ current turn and letting it search for them on demand.
 Tool search uses the best available mechanism for each provider:
 
 1. **Anthropic (native)** -- Models that support it receive `defer_loading: true`
-   on deferred tool definitions plus the `tool_search_tool_bm25_20251119` server-side
+   on deferred tool definitions plus the `tool_search_tool_bm25` server-side
    search tool. Anthropic's API handles search and expansion transparently.
 
 2. **OpenAI GPT-5.4+ (native)** -- Models with hosted tool search receive

examples/mcp-cluster-ops/README.md

@@ -1,10 +1,14 @@
 # MCP Cluster Ops
 
-An MCP server that exposes tools for executing commands across a [Turnstone](https://github.com/turnstonelabs/turnstone) cluster. Serves as a reference implementation for both MCP server patterns and Turnstone SDK usage.
+An MCP server that exposes tools for executing commands across a Turnstone cluster. Serves as a reference implementation for both MCP server patterns and Turnstone SDK usage.
 
 ## How it works
 
-This server uses Turnstone's SDK client (`TurnstoneServer`) to dispatch shell commands to specific nodes via HTTP. Remote agents execute the command and the raw bash output is captured directly from the `ToolResultEvent` stream — bypassing the costly "agent reads output → re-generates output as completion tokens" round-trip.
+This server uses the Turnstone console SDK (`TurnstoneConsole`) for node discovery and routing, and `TurnstoneServer` for per-node SSE streaming. The dispatch flow for each command is:
+
+1. **Route** — `TurnstoneConsole.route_create_workstream(target_node=..., auto_approve=True)` creates a workstream pinned to the target node via the console's hash-ring routing proxy, returning `ws_id` and `node_url`.
+2. **Execute** — `TurnstoneServer(node_url, token=...)` connects directly to the node's SSE stream using the same `TURNSTONE_API_TOKEN`. `send_and_wait(prompt, ws_id)` runs the command and the raw bash output is captured from the `ToolResultEvent` — bypassing the costly "agent reads output then re-generates output as completion tokens" round-trip.
+3. **Cleanup** — `TurnstoneConsole.route_close(ws_id)` closes the workstream.
 
 Multi-node dispatches run in parallel via `asyncio.gather`, so total wall time is bounded by the slowest node rather than the sum.
 
@@ -19,7 +23,7 @@ Multi-node dispatches run in parallel via `asyncio.gather`, so total wall time i
 
 ## Prerequisites
 
-- A running Turnstone cluster (at least one `turnstone-server`)
+- A running Turnstone cluster with at least one `turnstone-server` and a `turnstone-console`
 - Python 3.11+
 
 ## Installation
@@ -35,8 +39,8 @@ pip install -e ./examples/mcp-cluster-ops
 
 | Variable | Default | Description |
 |----------|---------|-------------|
-| `TURNSTONE_SERVER_URL` | `http://localhost:8080` | Server URL |
-| `TURNSTONE_API_TOKEN` | _(none)_ | API token for authentication |
+| `TURNSTONE_CONSOLE_URL` | `http://localhost:8090` | Console URL for node discovery and routing |
+| `TURNSTONE_API_TOKEN` | _(none)_ | API token / JWT for authentication |
 | `MCP_CLUSTER_OPS_TIMEOUT` | `120` | Default command timeout (seconds, clamped 5-3600) |
 | `MCP_CLUSTER_OPS_MAX_OUTPUT` | `8192` | Max output bytes per node (0 = unlimited) |
 | `MCP_CLUSTER_OPS_MAX_NODES` | `32` | Max concurrent node dispatches |
@@ -51,7 +55,7 @@ pip install -e ./examples/mcp-cluster-ops
 command = "mcp-cluster-ops"
 
 [mcp.servers.cluster-ops.env]
-TURNSTONE_SERVER_URL = "http://turnstone.example.com:8080"
+TURNSTONE_CONSOLE_URL = "http://console.example.com:8090"
 ```
 
 **JSON** (via `--mcp-config`):
@@ -62,7 +66,7 @@ TURNSTONE_SERVER_URL = "http://turnstone.example.com:8080"
     "cluster-ops": {
       "command": "mcp-cluster-ops",
       "env": {
-        "TURNSTONE_SERVER_URL": "http://turnstone.example.com:8080"
+        "TURNSTONE_CONSOLE_URL": "http://console.example.com:8090"
       }
     }
   }

examples/mcp-cluster-ops/mcp_cluster_ops/server.py

@@ -1,7 +1,8 @@
 """MCP server for Turnstone cluster operations.
 
 Exposes tools to execute commands on specific nodes in a Turnstone cluster.
-Uses the SDK client (``TurnstoneServer``) for direct node targeting via HTTP.
+Uses the SDK console client (``TurnstoneConsole``) for node discovery and
+routing, and ``TurnstoneServer`` for per-node SSE streaming.
 
 Usage::
 
@@ -14,12 +15,12 @@ Configure in ``~/.config/turnstone/config.toml``::
     command = "mcp-cluster-ops"
 
     [mcp.servers.cluster-ops.env]
-    TURNSTONE_SERVER_URL = "http://localhost:8080"
+    TURNSTONE_CONSOLE_URL = "http://localhost:8090"
 
 Environment variables
 ---------------------
-TURNSTONE_SERVER_URL        Server URL (default: http://localhost:8080)
-TURNSTONE_API_TOKEN         API token for authentication (default: none)
+TURNSTONE_CONSOLE_URL       Console URL (default: http://localhost:8090)
+TURNSTONE_API_TOKEN         API token / JWT for authentication (default: none)
 MCP_CLUSTER_OPS_TIMEOUT     Default command timeout in seconds (default: 120)
 MCP_CLUSTER_OPS_MAX_OUTPUT  Max output bytes per node (default: 8192, 0=unlimited)
 
@@ -43,7 +44,7 @@ from contextlib import asynccontextmanager
 from typing import TYPE_CHECKING, Any
 
 from mcp.server.fastmcp import Context, FastMCP
-from turnstone.sdk import TurnResult, TurnstoneServer
+from turnstone.sdk import TurnResult, TurnstoneConsole, TurnstoneServer
 
 if TYPE_CHECKING:
     from collections.abc import AsyncIterator
@@ -66,15 +67,12 @@ _MAX_TIMEOUT = 3600
 # ---------------------------------------------------------------------------
 
 
-def _server_kwargs() -> dict[str, Any]:
-    """Build TurnstoneServer connection kwargs from environment variables."""
-    kwargs: dict[str, Any] = {
-        "base_url": os.environ.get("TURNSTONE_SERVER_URL", "http://localhost:8080"),
+def _console_kwargs() -> dict[str, Any]:
+    """Build TurnstoneConsole connection kwargs from environment variables."""
+    return {
+        "base_url": os.environ.get("TURNSTONE_CONSOLE_URL", "http://localhost:8090"),
+        "token": os.environ.get("TURNSTONE_API_TOKEN", ""),
     }
-    token = os.environ.get("TURNSTONE_API_TOKEN")
-    if token:
-        kwargs["token"] = token
-    return kwargs
 
 
 def _exec_prompt(command: str) -> str:
@@ -141,6 +139,11 @@ def _validate_command(command: str) -> str | None:
     return None
 
 
+def _extract_node_ids(nodes: list[dict[str, Any]]) -> list[str]:
+    """Extract unique, non-empty node IDs from a list of node dicts."""
+    return list(dict.fromkeys(n["node_id"].strip() for n in nodes if n.get("node_id", "").strip()))
+
+
 def _format_node_result(
     node_id: str,
     result: TurnResult,
@@ -165,12 +168,12 @@ def _format_node_result(
 
 
 # ---------------------------------------------------------------------------
-# Core dispatch functions (testable with mocked TurnstoneServer)
+# Core dispatch functions (testable with mocked SDK clients)
 # ---------------------------------------------------------------------------
 
 
 def _exec_on_node_sync(
-    server_kw: dict[str, Any],
+    console_kw: dict[str, Any],
     node_id: str,
     command: str,
     timeout: float,
@@ -178,22 +181,35 @@ def _exec_on_node_sync(
     """Dispatch *command* to *node_id* and block until complete.
 
     Runs inside ``asyncio.to_thread`` so it does not block the event loop.
-    Each call creates its own ``TurnstoneServer`` client to avoid state
-    conflicts between concurrent dispatches.
+
+    Flow:
+      1. Create a workstream on the target node via the console routing proxy
+      2. Connect directly to the node's SSE stream to send + collect output
+      3. Close the workstream via the routing proxy
     """
     prompt = _exec_prompt(command)
-    with TurnstoneServer(**server_kw) as client:
-        result = client.send_and_wait(
-            message=prompt,
-            target_node=node_id,
-            auto_approve=True,
-            timeout=timeout,
-        )
+    ws_id = ""
+    with TurnstoneConsole(**console_kw) as console:
+        try:
+            route_resp = console.route_create_workstream(
+                target_node=node_id,
+                auto_approve=True,
+            )
+            ws_id = route_resp["ws_id"]
+            node_url: str = route_resp["node_url"]
+            with TurnstoneServer(
+                base_url=node_url,
+                token=console_kw["token"],
+            ) as server:
+                result = server.send_and_wait(prompt, ws_id, timeout=timeout)
+        finally:
+            if ws_id:
+                console.route_close(ws_id)
     return node_id, result
 
 
 async def _dispatch_parallel(
-    server_kw: dict[str, Any],
+    console_kw: dict[str, Any],
     node_ids: list[str],
     command: str,
     timeout: float,
@@ -204,7 +220,7 @@ async def _dispatch_parallel(
     Total wall time is bounded by the slowest node.
     """
     tasks = [
-        asyncio.to_thread(_exec_on_node_sync, server_kw, nid, command, timeout) for nid in node_ids
+        asyncio.to_thread(_exec_on_node_sync, console_kw, nid, command, timeout) for nid in node_ids
     ]
     outcomes = await asyncio.gather(*tasks, return_exceptions=True)
 
@@ -220,16 +236,22 @@ async def _dispatch_parallel(
     return results
 
 
-def _list_nodes_sync(server_kw: dict[str, Any]) -> list[dict[str, Any]]:
-    """List active cluster nodes (blocking)."""
-    with TurnstoneServer(**server_kw) as client:
-        nodes: list[dict[str, Any]] = client.list_nodes()
-        return nodes
+def _list_nodes_sync(console_kw: dict[str, Any]) -> list[dict[str, Any]]:
+    """List active cluster nodes (blocking), paginating if needed."""
+    page_size = 100
+    nodes: list[dict[str, Any]] = []
+    with TurnstoneConsole(**console_kw) as console:
+        while True:
+            resp = console.nodes(limit=page_size, offset=len(nodes))
+            nodes.extend(n.model_dump() for n in resp.nodes)
+            if len(nodes) >= resp.total or not resp.nodes:
+                break
+    return nodes
 
 
-async def _list_nodes_impl(server_kw: dict[str, Any]) -> list[dict[str, Any]]:
+async def _list_nodes_impl(console_kw: dict[str, Any]) -> list[dict[str, Any]]:
     """List active cluster nodes."""
-    return await asyncio.to_thread(_list_nodes_sync, server_kw)
+    return await asyncio.to_thread(_list_nodes_sync, console_kw)
 
 
 # ---------------------------------------------------------------------------
@@ -239,9 +261,9 @@ async def _list_nodes_impl(server_kw: dict[str, Any]) -> list[dict[str, Any]]:
 
 @asynccontextmanager
 async def _lifespan(server: FastMCP[dict[str, Any]]) -> AsyncIterator[dict[str, Any]]:
-    """Lifespan context — stores server connection kwargs for tool handlers."""
-    kw = _server_kwargs()
-    yield {"server_kwargs": kw}
+    """Lifespan context — stores console connection kwargs for tool handlers."""
+    kw = _console_kwargs()
+    yield {"console_kwargs": kw}
 
 
 mcp = FastMCP(
@@ -263,8 +285,8 @@ async def list_nodes(ctx: Context[Any, Any, Any]) -> str:
     Call this before dispatching work to discover available node IDs.
     Returns a JSON array of node metadata objects.
     """
-    server_kw: dict[str, Any] = ctx.request_context.lifespan_context["server_kwargs"]
-    nodes = await _list_nodes_impl(server_kw)
+    console_kw: dict[str, Any] = ctx.request_context.lifespan_context["console_kwargs"]
+    nodes = await _list_nodes_impl(console_kw)
     return json.dumps(nodes, indent=2)
 
 
@@ -291,13 +313,16 @@ async def run_on_node(
     if cmd_err:
         return json.dumps({"error": cmd_err})
 
-    server_kw: dict[str, Any] = ctx.request_context.lifespan_context["server_kwargs"]
+    console_kw: dict[str, Any] = ctx.request_context.lifespan_context["console_kwargs"]
     max_output = _DEFAULT_MAX_OUTPUT
 
     log.info("run_on_node node=%s cmd=%r", node_id, command)
-    _, result = await asyncio.to_thread(
-        _exec_on_node_sync, server_kw, node_id, command, _clamp_timeout(timeout)
-    )
+    try:
+        _, result = await asyncio.to_thread(
+            _exec_on_node_sync, console_kw, node_id, command, _clamp_timeout(timeout)
+        )
+    except Exception as exc:
+        return json.dumps({"node": node_id, "ok": False, "error": str(exc)}, indent=2)
     formatted = _format_node_result(node_id, result, max_output)
     return json.dumps(formatted, indent=2)
 
@@ -323,7 +348,7 @@ async def run_on_nodes(
     if cmd_err:
         return json.dumps({"error": cmd_err})
 
-    server_kw: dict[str, Any] = ctx.request_context.lifespan_context["server_kwargs"]
+    console_kw: dict[str, Any] = ctx.request_context.lifespan_context["console_kwargs"]
     max_output = _DEFAULT_MAX_OUTPUT
 
     clean_ids = list(dict.fromkeys(nid.strip() for nid in node_ids if nid.strip()))
@@ -336,7 +361,7 @@ async def run_on_nodes(
 
     log.info("run_on_nodes nodes=%s cmd=%r", clean_ids, command)
     results = await _dispatch_parallel(
-        server_kw, clean_ids, command, _clamp_timeout(timeout), max_output
+        console_kw, clean_ids, command, _clamp_timeout(timeout), max_output
     )
     return json.dumps(results, indent=2)
 
@@ -361,18 +386,14 @@ async def run_on_all_nodes(
     if cmd_err:
         return json.dumps({"error": cmd_err})
 
-    server_kw: dict[str, Any] = ctx.request_context.lifespan_context["server_kwargs"]
+    console_kw: dict[str, Any] = ctx.request_context.lifespan_context["console_kwargs"]
     max_output = _DEFAULT_MAX_OUTPUT
 
-    nodes = await _list_nodes_impl(server_kw)
+    nodes = await _list_nodes_impl(console_kw)
     if not nodes:
         return json.dumps({"error": "No active nodes found in cluster"})
 
-    node_ids = list(
-        dict.fromkeys(
-            nid.strip() for n in nodes if (nid := n.get("node_id") or n.get("id")) and nid.strip()
-        )
-    )
+    node_ids = _extract_node_ids(nodes)
     if not node_ids:
         return json.dumps({"error": "No nodes with identifiable IDs found"})
     if len(node_ids) > _MAX_CONCURRENT_NODES:
@@ -381,7 +402,7 @@ async def run_on_all_nodes(
         )
     log.info("run_on_all_nodes nodes=%s cmd=%r", node_ids, command)
     results = await _dispatch_parallel(
-        server_kw, node_ids, command, _clamp_timeout(timeout), max_output
+        console_kw, node_ids, command, _clamp_timeout(timeout), max_output
     )
     return json.dumps(results, indent=2)
 

examples/mcp-cluster-ops/tests/test_helpers.py

@@ -7,6 +7,7 @@ from turnstone.sdk import TurnResult
 from mcp_cluster_ops.server import (
     _clamp_timeout,
     _exec_prompt,
+    _extract_node_ids,
     _extract_output,
     _format_node_result,
     _truncate,
@@ -190,3 +191,53 @@ class TestClampTimeout:
 
     def test_negative(self):
         assert _clamp_timeout(-1) == 5.0
+
+
+# ---------------------------------------------------------------------------
+# _extract_node_ids
+# ---------------------------------------------------------------------------
+
+
+class TestExtractNodeIds:
+    def test_normal(self):
+        nodes = [
+            {"node_id": "a", "server_url": "http://a:8080"},
+            {"node_id": "b", "server_url": "http://b:8080"},
+        ]
+        assert _extract_node_ids(nodes) == ["a", "b"]
+
+    def test_deduplicates(self):
+        nodes = [
+            {"node_id": "a"},
+            {"node_id": "a"},
+            {"node_id": "b"},
+        ]
+        assert _extract_node_ids(nodes) == ["a", "b"]
+
+    def test_strips_whitespace(self):
+        nodes = [{"node_id": "  a  "}, {"node_id": "b "}]
+        assert _extract_node_ids(nodes) == ["a", "b"]
+
+    def test_skips_empty(self):
+        nodes = [
+            {"node_id": "a"},
+            {"node_id": ""},
+            {"node_id": "  "},
+            {"node_id": "b"},
+        ]
+        assert _extract_node_ids(nodes) == ["a", "b"]
+
+    def test_skips_missing_key(self):
+        nodes = [
+            {"node_id": "a"},
+            {"server_url": "http://orphan:8080"},
+            {"node_id": "b"},
+        ]
+        assert _extract_node_ids(nodes) == ["a", "b"]
+
+    def test_empty_list(self):
+        assert _extract_node_ids([]) == []
+
+    def test_all_empty_ids(self):
+        nodes = [{"node_id": ""}, {"node_id": "  "}]
+        assert _extract_node_ids(nodes) == []

examples/mcp-cluster-ops/tests/test_tools.py

@@ -1,11 +1,13 @@
-"""Tests for MCP tool handlers with mocked TurnstoneServer."""
+"""Tests for MCP tool handlers with mocked SDK clients."""
 
 from __future__ import annotations
 
 import asyncio
+import contextlib
 from typing import Any
 from unittest.mock import MagicMock, patch
 
+import pytest
 from turnstone.sdk import TurnResult
 
 from mcp_cluster_ops.server import (
@@ -14,6 +16,22 @@ from mcp_cluster_ops.server import (
     _list_nodes_impl,
 )
 
+_CONSOLE_KW: dict[str, Any] = {"base_url": "http://localhost:8090", "token": ""}
+_CONSOLE_KW_AUTH: dict[str, Any] = {"base_url": "http://localhost:8090", "token": "tok_test"}
+
+
+def _mock_console_ctx(mock_cls: MagicMock, mock_client: MagicMock) -> None:
+    """Wire up a TurnstoneConsole mock as a context manager."""
+    mock_cls.return_value.__enter__ = MagicMock(return_value=mock_client)
+    mock_cls.return_value.__exit__ = MagicMock(return_value=False)
+
+
+def _mock_server_ctx(mock_cls: MagicMock, mock_server: MagicMock) -> None:
+    """Wire up a TurnstoneServer mock as a context manager."""
+    mock_cls.return_value.__enter__ = MagicMock(return_value=mock_server)
+    mock_cls.return_value.__exit__ = MagicMock(return_value=False)
+
+
 # ---------------------------------------------------------------------------
 # _list_nodes_impl
 # ---------------------------------------------------------------------------
@@ -21,26 +39,71 @@ from mcp_cluster_ops.server import (
 
 class TestListNodesImpl:
     def test_returns_nodes(self):
-        nodes = [{"node_id": "a", "model": "gpt-5"}, {"node_id": "b", "model": "gpt-5"}]
-        with patch("mcp_cluster_ops.server.TurnstoneServer") as mock_cls:
-            mock_client = MagicMock()
-            mock_client.list_nodes.return_value = nodes
-            mock_cls.return_value.__enter__ = MagicMock(return_value=mock_client)
-            mock_cls.return_value.__exit__ = MagicMock(return_value=False)
+        mock_node_a = MagicMock()
+        mock_node_a.model_dump.return_value = {"node_id": "a", "server_url": "http://a:8080"}
+        mock_node_b = MagicMock()
+        mock_node_b.model_dump.return_value = {"node_id": "b", "server_url": "http://b:8080"}
 
-            result = asyncio.run(_list_nodes_impl({"host": "localhost"}))
-            assert result == nodes
+        mock_resp = MagicMock()
+        mock_resp.nodes = [mock_node_a, mock_node_b]
+        mock_resp.total = 2
+
+        with patch("mcp_cluster_ops.server.TurnstoneConsole") as mock_cls:
+            mock_client = MagicMock()
+            mock_client.nodes.return_value = mock_resp
+            _mock_console_ctx(mock_cls, mock_client)
+
+            result = asyncio.run(_list_nodes_impl(_CONSOLE_KW))
+            assert len(result) == 2
+            assert result[0]["node_id"] == "a"
+            assert result[1]["node_id"] == "b"
 
     def test_empty_cluster(self):
-        with patch("mcp_cluster_ops.server.TurnstoneServer") as mock_cls:
-            mock_client = MagicMock()
-            mock_client.list_nodes.return_value = []
-            mock_cls.return_value.__enter__ = MagicMock(return_value=mock_client)
-            mock_cls.return_value.__exit__ = MagicMock(return_value=False)
+        mock_resp = MagicMock()
+        mock_resp.nodes = []
+        mock_resp.total = 0
 
-            result = asyncio.run(_list_nodes_impl({"host": "localhost"}))
+        with patch("mcp_cluster_ops.server.TurnstoneConsole") as mock_cls:
+            mock_client = MagicMock()
+            mock_client.nodes.return_value = mock_resp
+            _mock_console_ctx(mock_cls, mock_client)
+
+            result = asyncio.run(_list_nodes_impl(_CONSOLE_KW))
             assert result == []
 
+    def test_paginates_large_clusters(self):
+        """Clusters with >100 nodes are fetched across multiple pages."""
+
+        def _make_node(nid: str) -> MagicMock:
+            m = MagicMock()
+            m.model_dump.return_value = {"node_id": nid}
+            return m
+
+        page1_nodes = [_make_node(f"n-{i}") for i in range(100)]
+        page2_nodes = [_make_node(f"n-{i}") for i in range(100, 150)]
+
+        page1_resp = MagicMock()
+        page1_resp.nodes = page1_nodes
+        page1_resp.total = 150
+
+        page2_resp = MagicMock()
+        page2_resp.nodes = page2_nodes
+        page2_resp.total = 150
+
+        with patch("mcp_cluster_ops.server.TurnstoneConsole") as mock_cls:
+            mock_client = MagicMock()
+            mock_client.nodes.side_effect = [page1_resp, page2_resp]
+            _mock_console_ctx(mock_cls, mock_client)
+
+            result = asyncio.run(_list_nodes_impl(_CONSOLE_KW))
+            assert len(result) == 150
+            assert result[0]["node_id"] == "n-0"
+            assert result[149]["node_id"] == "n-149"
+            assert mock_client.nodes.call_count == 2
+            # Verify offset was passed correctly
+            mock_client.nodes.assert_any_call(limit=100, offset=0)
+            mock_client.nodes.assert_any_call(limit=100, offset=100)
+
 
 # ---------------------------------------------------------------------------
 # _exec_on_node_sync
@@ -50,35 +113,111 @@ class TestListNodesImpl:
 class TestExecOnNodeSync:
     def test_success(self):
         turn_result = TurnResult(
+            ws_id="ws-123",
             tool_results=[("bash", "hello world")],
         )
-        with patch("mcp_cluster_ops.server.TurnstoneServer") as mock_cls:
-            mock_client = MagicMock()
-            mock_client.send_and_wait.return_value = turn_result
-            mock_cls.return_value.__enter__ = MagicMock(return_value=mock_client)
-            mock_cls.return_value.__exit__ = MagicMock(return_value=False)
+        with (
+            patch("mcp_cluster_ops.server.TurnstoneConsole") as mock_console_cls,
+            patch("mcp_cluster_ops.server.TurnstoneServer") as mock_server_cls,
+        ):
+            mock_console = MagicMock()
+            mock_console.route_create_workstream.return_value = {
+                "ws_id": "ws-123",
+                "node_url": "http://node-1:8080",
+                "node_id": "node-1",
+                "name": "ws-123",
+            }
+            _mock_console_ctx(mock_console_cls, mock_console)
 
-            node_id, result = _exec_on_node_sync(
-                {"host": "localhost"}, "node-1", "echo hello", 60.0
-            )
+            mock_server = MagicMock()
+            mock_server.send_and_wait.return_value = turn_result
+            _mock_server_ctx(mock_server_cls, mock_server)
+
+            node_id, result = _exec_on_node_sync(_CONSOLE_KW_AUTH, "node-1", "echo hello", 60.0)
             assert node_id == "node-1"
             assert result.ok
-            mock_client.send_and_wait.assert_called_once()
-            call_kwargs = mock_client.send_and_wait.call_args
-            assert call_kwargs.kwargs["target_node"] == "node-1"
-            assert call_kwargs.kwargs["auto_approve"] is True
+
+            # Verify console created ws on the right node
+            mock_console.route_create_workstream.assert_called_once_with(
+                target_node="node-1",
+                auto_approve=True,
+            )
+
+            # Verify server connected to the node URL with the token
+            mock_server_cls.assert_called_once_with(
+                base_url="http://node-1:8080",
+                token="tok_test",
+            )
+
+            # Verify send_and_wait got the right ws_id
+            call_kwargs = mock_server.send_and_wait.call_args
+            assert call_kwargs.args[1] == "ws-123"
+
+            # Verify workstream was closed
+            mock_console.route_close.assert_called_once_with("ws-123")
 
     def test_timeout(self):
-        turn_result = TurnResult(timed_out=True)
-        with patch("mcp_cluster_ops.server.TurnstoneServer") as mock_cls:
-            mock_client = MagicMock()
-            mock_client.send_and_wait.return_value = turn_result
-            mock_cls.return_value.__enter__ = MagicMock(return_value=mock_client)
-            mock_cls.return_value.__exit__ = MagicMock(return_value=False)
+        turn_result = TurnResult(ws_id="ws-456", timed_out=True)
+        with (
+            patch("mcp_cluster_ops.server.TurnstoneConsole") as mock_console_cls,
+            patch("mcp_cluster_ops.server.TurnstoneServer") as mock_server_cls,
+        ):
+            mock_console = MagicMock()
+            mock_console.route_create_workstream.return_value = {
+                "ws_id": "ws-456",
+                "node_url": "http://node-1:8080",
+                "node_id": "node-1",
+            }
+            _mock_console_ctx(mock_console_cls, mock_console)
 
-            _, result = _exec_on_node_sync({"host": "localhost"}, "node-1", "sleep 9999", 1.0)
+            mock_server = MagicMock()
+            mock_server.send_and_wait.return_value = turn_result
+            _mock_server_ctx(mock_server_cls, mock_server)
+
+            _, result = _exec_on_node_sync(_CONSOLE_KW, "node-1", "sleep 9999", 1.0)
             assert result.timed_out
             assert not result.ok
+            # Workstream still closed even on timeout
+            mock_console.route_close.assert_called_once_with("ws-456")
+
+    def test_send_failure_still_closes_workstream(self):
+        """Workstream must be closed even if send_and_wait raises."""
+        with (
+            patch("mcp_cluster_ops.server.TurnstoneConsole") as mock_console_cls,
+            patch("mcp_cluster_ops.server.TurnstoneServer") as mock_server_cls,
+        ):
+            mock_console = MagicMock()
+            mock_console.route_create_workstream.return_value = {
+                "ws_id": "ws-789",
+                "node_url": "http://node-1:8080",
+                "node_id": "node-1",
+            }
+            _mock_console_ctx(mock_console_cls, mock_console)
+
+            mock_server = MagicMock()
+            mock_server.send_and_wait.side_effect = ConnectionError("lost connection")
+            _mock_server_ctx(mock_server_cls, mock_server)
+
+            with contextlib.suppress(ConnectionError):
+                _exec_on_node_sync(_CONSOLE_KW, "node-1", "echo hi", 60.0)
+
+            mock_console.route_close.assert_called_once_with("ws-789")
+
+    def test_malformed_route_response_no_leak(self):
+        """If route response is missing ws_id, no route_close is attempted."""
+        with patch("mcp_cluster_ops.server.TurnstoneConsole") as mock_console_cls:
+            mock_console = MagicMock()
+            mock_console.route_create_workstream.return_value = {
+                # Missing "ws_id" and "node_url"
+                "node_id": "node-1",
+            }
+            _mock_console_ctx(mock_console_cls, mock_console)
+
+            with pytest.raises(KeyError):
+                _exec_on_node_sync(_CONSOLE_KW, "node-1", "echo hi", 60.0)
+
+            # route_close must NOT be called — ws_id was never assigned
+            mock_console.route_close.assert_not_called()
 
 
 # ---------------------------------------------------------------------------
@@ -88,40 +227,32 @@ class TestExecOnNodeSync:
 
 class TestDispatchParallel:
     def test_parallel_success(self):
-        def fake_exec(server_kw: Any, node_id: str, command: str, timeout: float) -> Any:
-            return (node_id, TurnResult(tool_results=[("bash", f"output-{node_id}")]))
+        def fake_exec(console_kw: Any, node_id: str, command: str, timeout: float) -> Any:
+            return (
+                node_id,
+                TurnResult(tool_results=[("bash", f"output-{node_id}")]),
+            )
 
         with patch("mcp_cluster_ops.server._exec_on_node_sync", side_effect=fake_exec):
             results = asyncio.run(
-                _dispatch_parallel(
-                    {"host": "localhost"},
-                    ["a", "b", "c"],
-                    "echo hi",
-                    60.0,
-                    8192,
-                )
+                _dispatch_parallel(_CONSOLE_KW, ["a", "b", "c"], "echo hi", 60.0, 8192)
             )
             assert len(results) == 3
             assert all(r["ok"] for r in results)
             outputs = {r["node"]: r["output"] for r in results}
             assert outputs["a"] == "output-a"
             assert outputs["b"] == "output-b"
+            assert outputs["c"] == "output-c"
 
     def test_partial_failure(self):
-        def fake_exec(server_kw: Any, node_id: str, command: str, timeout: float) -> Any:
+        def fake_exec(console_kw: Any, node_id: str, command: str, timeout: float) -> Any:
             if node_id == "bad":
                 raise ConnectionError("connection refused")
             return (node_id, TurnResult(tool_results=[("bash", "ok")]))
 
         with patch("mcp_cluster_ops.server._exec_on_node_sync", side_effect=fake_exec):
             results = asyncio.run(
-                _dispatch_parallel(
-                    {"host": "localhost"},
-                    ["good", "bad"],
-                    "echo hi",
-                    60.0,
-                    8192,
-                )
+                _dispatch_parallel(_CONSOLE_KW, ["good", "bad"], "echo hi", 60.0, 8192)
             )
             assert len(results) == 2
             good = next(r for r in results if r["node"] == "good")
@@ -131,18 +262,12 @@ class TestDispatchParallel:
             assert "connection refused" in bad["error"]
 
     def test_all_fail(self):
-        def fake_exec(server_kw: Any, node_id: str, command: str, timeout: float) -> Any:
+        def fake_exec(console_kw: Any, node_id: str, command: str, timeout: float) -> Any:
             raise RuntimeError(f"fail-{node_id}")
 
         with patch("mcp_cluster_ops.server._exec_on_node_sync", side_effect=fake_exec):
             results = asyncio.run(
-                _dispatch_parallel(
-                    {"host": "localhost"},
-                    ["a", "b"],
-                    "echo hi",
-                    60.0,
-                    8192,
-                )
+                _dispatch_parallel(_CONSOLE_KW, ["a", "b"], "echo hi", 60.0, 8192)
             )
             assert all(not r["ok"] for r in results)
             assert "fail-a" in results[0]["error"]

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "turnstone"
-version = "0.9.9"
+version = "1.0.2"
 description = "Multi-node AI orchestration platform with tool use, agent routing, and cluster simulation."
 readme = "README.md"
 license = "BUSL-1.1"
@@ -12,7 +12,7 @@ requires-python = ">=3.11"
 authors = [{name = "Patrick Buckley", email = "buckleypm@gmail.com"}]
 keywords = ["ai", "chat", "llm", "agent", "tools", "openai"]
 classifiers = [
-    "Development Status :: 4 - Beta",
+    "Development Status :: 5 - Production/Stable",
     "Environment :: Console",
     "Intended Audience :: Developers",
     "Programming Language :: Python :: 3",
@@ -67,6 +67,7 @@ turnstone-bootstrap = "turnstone.bootstrap:main"
 [tool.hatch.build.targets.wheel]
 include = [
   "turnstone/**/*.py",
+  "turnstone/prompts/**/*.md",
   "turnstone/tools/*.json",
   "turnstone/ui/static/*.html",
   "turnstone/ui/static/*.css",
@@ -78,7 +79,7 @@ include = [
   "turnstone/shared_static/*.js",
   "turnstone/shared_static/katex-0.16.44/**/*",
   "turnstone/shared_static/hljs-11.11.1/**/*",
-  "turnstone/shared_static/mermaid-11.13.0/**/*",
+  "turnstone/shared_static/mermaid-11.14.0/**/*",
   "turnstone/sdk/py.typed",
 ]
 

scripts/release.sh

@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+#
+# Bump version, regenerate lockfile, commit, and tag.
+#
+# Usage:
+#   scripts/release.sh 1.0.0          # stable release
+#   scripts/release.sh 1.1.0a1        # experimental pre-release
+#   scripts/release.sh 1.0.1 --push   # bump + push tag to origin
+#
+set -euo pipefail
+
+VERSION="${1:?Usage: scripts/release.sh VERSION [--push]}"
+PUSH="${2:-}"
+
+# Validate PEP 440 version
+if ! echo "$VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+(a[0-9]+|b[0-9]+|rc[0-9]+)?$'; then
+    echo "error: invalid PEP 440 version: $VERSION" >&2
+    echo "  examples: 1.0.0, 1.1.0a1, 1.0.1rc2" >&2
+    exit 1
+fi
+
+TAG="v${VERSION}"
+
+# Check for clean working tree
+if ! git diff --quiet || ! git diff --cached --quiet; then
+    echo "error: working tree is dirty — commit or stash first" >&2
+    exit 1
+fi
+
+# Check tag doesn't already exist
+if git rev-parse "$TAG" >/dev/null 2>&1; then
+    echo "error: tag $TAG already exists" >&2
+    exit 1
+fi
+
+# Detect current version
+CURRENT=$(grep -oP '(?<=^version = ")[^"]+' pyproject.toml)
+echo "Bumping $CURRENT → $VERSION"
+
+# Update version in both files
+sed -i "s/^version = \".*\"/version = \"$VERSION\"/" pyproject.toml
+sed -i "s/^__version__ = \".*\"/__version__ = \"$VERSION\"/" turnstone/__init__.py
+
+# Regenerate lockfile
+echo "Regenerating uv.lock..."
+uv lock
+
+# Commit and tag
+git add pyproject.toml turnstone/__init__.py uv.lock
+git commit -m "chore: bump version to $VERSION"
+git tag "$TAG"
+
+echo ""
+echo "Created commit and tag $TAG"
+
+if [ "$PUSH" = "--push" ]; then
+    BRANCH=$(git rev-parse --abbrev-ref HEAD)
+    echo "Pushing $BRANCH + $TAG to origin..."
+    git push origin "$BRANCH" "$TAG"
+else
+    echo "Run 'git push origin <branch> $TAG' to publish"
+fi

sdk/typescript/src/index.ts

@@ -7,7 +7,7 @@
  *
  * const client = new TurnstoneServer({
  *   baseUrl: "http://localhost:8080",
- *   token: "tok_xxx",
+ *   token: "ts_your_api_token",
  * });
  *
  * const ws = await client.createWorkstream({ name: "demo" });

tests/test_api_versioning.py

@@ -6,6 +6,37 @@ from unittest.mock import MagicMock
 
 import pytest
 
+# Shared test auth — JWT-based
+_TEST_JWT_SECRET = "test-jwt-secret-minimum-32-chars!"
+
+
+def _server_jwt() -> str:
+    from turnstone.core.auth import JWT_AUD_SERVER, create_jwt
+
+    return create_jwt(
+        user_id="test-versioning",
+        scopes=frozenset({"read", "write", "approve", "service"}),
+        source="test",
+        secret=_TEST_JWT_SECRET,
+        audience=JWT_AUD_SERVER,
+    )
+
+
+def _console_jwt() -> str:
+    from turnstone.core.auth import JWT_AUD_CONSOLE, create_jwt
+
+    return create_jwt(
+        user_id="test-versioning",
+        scopes=frozenset({"read", "write", "approve", "service"}),
+        source="test",
+        secret=_TEST_JWT_SECRET,
+        audience=JWT_AUD_CONSOLE,
+    )
+
+
+_SERVER_AUTH_HEADERS = {"Authorization": f"Bearer {_server_jwt()}"}
+_CONSOLE_AUTH_HEADERS = {"Authorization": f"Bearer {_console_jwt()}"}
+
 
 class TestServerVersioning:
     """Test /v1/ routes and OpenAPI endpoints on the server."""
@@ -14,7 +45,6 @@ class TestServerVersioning:
     def client(self):
         from starlette.testclient import TestClient
 
-        from turnstone.core.auth import AuthConfig
         from turnstone.server import create_app
 
         mock_mgr = MagicMock()
@@ -26,19 +56,19 @@ class TestServerVersioning:
             global_listeners=[],
             global_listeners_lock=threading.Lock(),
             skip_permissions=False,
-            auth_config=AuthConfig(),
+            jwt_secret=_TEST_JWT_SECRET,
         )
         client = TestClient(app, raise_server_exceptions=False)
         yield client
         client.close()
 
     def test_v1_workstreams(self, client):
-        resp = client.get("/v1/api/workstreams")
+        resp = client.get("/v1/api/workstreams", headers=_SERVER_AUTH_HEADERS)
         assert resp.status_code == 200
         assert "workstreams" in resp.json()
 
     def test_unversioned_api_404(self, client):
-        resp = client.get("/api/workstreams")
+        resp = client.get("/api/workstreams", headers=_SERVER_AUTH_HEADERS)
         assert resp.status_code == 404
 
     def test_openapi_json(self, client):
@@ -72,7 +102,6 @@ class TestConsoleVersioning:
 
         from turnstone.console.collector import ClusterCollector
         from turnstone.console.server import _load_static, create_app
-        from turnstone.core.auth import AuthConfig
 
         _load_static()
         collector = MagicMock(spec=ClusterCollector)
@@ -84,18 +113,18 @@ class TestConsoleVersioning:
         }
         app = create_app(
             collector=collector,
-            auth_config=AuthConfig(),
+            jwt_secret=_TEST_JWT_SECRET,
         )
         client = TestClient(app, raise_server_exceptions=False)
         yield client
         client.close()
 
     def test_v1_cluster_overview(self, client):
-        resp = client.get("/v1/api/cluster/overview")
+        resp = client.get("/v1/api/cluster/overview", headers=_CONSOLE_AUTH_HEADERS)
         assert resp.status_code == 200
 
     def test_unversioned_api_404(self, client):
-        resp = client.get("/api/cluster/overview")
+        resp = client.get("/api/cluster/overview", headers=_CONSOLE_AUTH_HEADERS)
         assert resp.status_code == 404
 
     def test_openapi_json(self, client):

tests/test_auth.py

@@ -9,12 +9,11 @@ import pytest
 
 from turnstone.core.auth import (
     WRITE_PATHS,
-    AuthConfig,
     _extract_bearer,
     _extract_cookie,
     check_request,
+    create_jwt,
     is_public_path,
-    load_auth_config,
     make_clear_cookie,
     make_set_cookie,
     required_scope,
@@ -199,37 +198,6 @@ class TestRequiredScope:
         assert required_scope("GET", "/api/_internal/mcp-reload") == "read"
 
 
-# ---------------------------------------------------------------------------
-# TestAuthConfig
-# ---------------------------------------------------------------------------
-
-
-class TestAuthConfig:
-    def test_check_valid_full_token(self):
-        cfg = AuthConfig(enabled=True, tokens={"tok_full": "full", "tok_read": "read"})
-        assert cfg.check("tok_full") == "full"
-
-    def test_check_valid_read_token(self):
-        cfg = AuthConfig(enabled=True, tokens={"tok_full": "full", "tok_read": "read"})
-        assert cfg.check("tok_read") == "read"
-
-    def test_check_invalid_token(self):
-        cfg = AuthConfig(enabled=True, tokens={"tok_full": "full"})
-        assert cfg.check("wrong") is None
-
-    def test_check_none_token(self):
-        cfg = AuthConfig(enabled=True, tokens={"tok_full": "full"})
-        assert cfg.check(None) is None
-
-    def test_check_empty_token(self):
-        cfg = AuthConfig(enabled=True, tokens={"tok_full": "full"})
-        assert cfg.check("") is None
-
-    def test_check_no_tokens(self):
-        cfg = AuthConfig(enabled=True, tokens={})
-        assert cfg.check("anything") is None
-
-
 # ---------------------------------------------------------------------------
 # TestExtractBearer
 # ---------------------------------------------------------------------------
@@ -353,167 +321,157 @@ class TestMakeClearCookie:
 class TestCheckRequest:
     """Tests for the main check_request() entry point."""
 
-    @pytest.fixture()
-    def disabled(self):
-        return AuthConfig(enabled=False)
+    _SECRET = "test-jwt-secret-minimum-32-chars!"
 
     @pytest.fixture()
-    def enabled(self):
-        return AuthConfig(
-            enabled=True,
-            tokens={"tok_full": "full", "tok_read": "read"},
-        )
+    def read_jwt(self):
+        return f"Bearer {create_jwt('u1', frozenset({'read'}), 'test', self._SECRET)}"
 
-    def test_disabled_allows_all(self, disabled):
-        allowed, status, msg, _result = check_request(disabled, "POST", "/api/send", None)
+    @pytest.fixture()
+    def full_jwt(self):
+        return f"Bearer {create_jwt('u1', frozenset({'read', 'write', 'approve'}), 'test', self._SECRET)}"
+
+    def test_public_path_no_token_ok(self):
+        allowed, status, msg, _result = check_request("GET", "/health", None)
         assert allowed is True
         assert status == 200
 
-    def test_disabled_allows_no_header(self, disabled):
-        allowed, status, msg, _result = check_request(disabled, "GET", "/api/workstreams", None)
+    def test_public_root_no_token_ok(self):
+        allowed, status, msg, _result = check_request("GET", "/", None)
         assert allowed is True
 
-    def test_public_path_no_token_ok(self, enabled):
-        allowed, status, msg, _result = check_request(enabled, "GET", "/health", None)
-        assert allowed is True
-        assert status == 200
-
-    def test_public_root_no_token_ok(self, enabled):
-        allowed, status, msg, _result = check_request(enabled, "GET", "/", None)
+    def test_public_static_no_token_ok(self):
+        allowed, status, msg, _result = check_request("GET", "/static/style.css", None)
         assert allowed is True
 
-    def test_public_static_no_token_ok(self, enabled):
-        allowed, status, msg, _result = check_request(enabled, "GET", "/static/style.css", None)
-        assert allowed is True
-
-    def test_api_no_token_401(self, enabled):
-        allowed, status, msg, _result = check_request(enabled, "GET", "/api/workstreams", None)
+    def test_api_no_token_401(self):
+        allowed, status, msg, _result = check_request("GET", "/api/workstreams", None)
         assert allowed is False
         assert status == 401
         assert "Unauthorized" in msg
 
-    def test_api_invalid_token_401(self, enabled):
+    def test_api_invalid_token_401(self):
         allowed, status, msg, _result = check_request(
-            enabled, "GET", "/api/workstreams", "Bearer wrong_token"
+            "GET", "/api/workstreams", "Bearer wrong_token"
         )
         assert allowed is False
         assert status == 401
 
-    def test_api_read_token_ok(self, enabled):
+    def test_api_read_token_ok(self, read_jwt):
         allowed, status, msg, _result = check_request(
-            enabled, "GET", "/api/workstreams", "Bearer tok_read"
+            "GET", "/api/workstreams", read_jwt, jwt_secret=self._SECRET
         )
         assert allowed is True
         assert status == 200
 
-    def test_api_full_token_ok(self, enabled):
+    def test_api_full_token_ok(self, full_jwt):
         allowed, status, msg, _result = check_request(
-            enabled, "GET", "/api/workstreams", "Bearer tok_full"
+            "GET", "/api/workstreams", full_jwt, jwt_secret=self._SECRET
         )
         assert allowed is True
 
-    def test_write_read_token_403(self, enabled):
+    def test_write_read_token_403(self, read_jwt):
         allowed, status, msg, _result = check_request(
-            enabled, "POST", "/api/send", "Bearer tok_read"
+            "POST", "/api/send", read_jwt, jwt_secret=self._SECRET
         )
         assert allowed is False
         assert status == 403
         assert "Forbidden" in msg
 
-    def test_write_full_token_ok(self, enabled):
+    def test_write_full_token_ok(self, full_jwt):
         allowed, status, msg, _result = check_request(
-            enabled, "POST", "/api/send", "Bearer tok_full"
+            "POST", "/api/send", full_jwt, jwt_secret=self._SECRET
         )
         assert allowed is True
         assert status == 200
 
-    def test_approve_read_token_403(self, enabled):
+    def test_approve_read_token_403(self, read_jwt):
         allowed, status, msg, _result = check_request(
-            enabled, "POST", "/api/approve", "Bearer tok_read"
+            "POST", "/api/approve", read_jwt, jwt_secret=self._SECRET
         )
         assert allowed is False
         assert status == 403
 
-    def test_proxy_write_read_token_403(self, enabled):
+    def test_proxy_write_read_token_403(self, read_jwt):
         """Read tokens cannot escalate to write ops via proxy routes."""
         allowed, status, msg, _result = check_request(
-            enabled, "POST", "/node/node-a/api/send", "Bearer tok_read"
+            "POST", "/node/node-a/api/send", read_jwt, jwt_secret=self._SECRET
         )
         assert allowed is False
         assert status == 403
 
-    def test_proxy_write_trailing_slash_read_token_403(self, enabled):
+    def test_proxy_write_trailing_slash_read_token_403(self, read_jwt):
         """Trailing slash must not bypass write-role check on proxy routes."""
         allowed, status, msg, _result = check_request(
-            enabled, "POST", "/node/node-a/api/send/", "Bearer tok_read"
+            "POST", "/node/node-a/api/send/", read_jwt, jwt_secret=self._SECRET
         )
         assert allowed is False
         assert status == 403
 
-    def test_direct_write_trailing_slash_read_token_403(self, enabled):
+    def test_direct_write_trailing_slash_read_token_403(self, read_jwt):
         """Trailing slash must not bypass write-role check on direct routes."""
         allowed, status, msg, _result = check_request(
-            enabled, "POST", "/api/send/", "Bearer tok_read"
+            "POST", "/api/send/", read_jwt, jwt_secret=self._SECRET
         )
         assert allowed is False
         assert status == 403
 
-    def test_proxy_write_full_token_ok(self, enabled):
+    def test_proxy_write_full_token_ok(self, full_jwt):
         """Full tokens pass through proxy write routes."""
         allowed, status, msg, _result = check_request(
-            enabled, "POST", "/node/node-a/api/send", "Bearer tok_full"
+            "POST", "/node/node-a/api/send", full_jwt, jwt_secret=self._SECRET
         )
         assert allowed is True
 
-    def test_proxy_v1_write_read_token_403(self, enabled):
+    def test_proxy_v1_write_read_token_403(self, read_jwt):
         """Read tokens cannot escalate to write ops via v1 proxy routes."""
         allowed, status, msg, _result = check_request(
-            enabled, "POST", "/node/node-a/v1/api/send", "Bearer tok_read"
+            "POST", "/node/node-a/v1/api/send", read_jwt, jwt_secret=self._SECRET
         )
         assert allowed is False
         assert status == 403
 
-    def test_proxy_v1_write_full_token_ok(self, enabled):
+    def test_proxy_v1_write_full_token_ok(self, full_jwt):
         """Full tokens pass through v1 proxy write routes."""
         allowed, status, msg, _result = check_request(
-            enabled, "POST", "/node/node-a/v1/api/send", "Bearer tok_full"
+            "POST", "/node/node-a/v1/api/send", full_jwt, jwt_secret=self._SECRET
         )
         assert allowed is True
 
-    def test_proxy_v1_cluster_ws_new_read_403(self, enabled):
+    def test_proxy_v1_cluster_ws_new_read_403(self, read_jwt):
         """Read tokens cannot create workstreams via v1 proxy."""
         allowed, status, msg, _result = check_request(
-            enabled,
             "POST",
             "/node/node-a/v1/api/cluster/workstreams/new",
-            "Bearer tok_read",
+            read_jwt,
+            jwt_secret=self._SECRET,
         )
         assert allowed is False
         assert status == 403
 
-    def test_proxy_read_endpoint_read_token_ok(self, enabled):
+    def test_proxy_read_endpoint_read_token_ok(self, read_jwt):
         """Read tokens can access proxy read endpoints."""
         allowed, status, msg, _result = check_request(
-            enabled, "GET", "/node/node-a/api/workstreams", "Bearer tok_read"
+            "GET", "/node/node-a/api/workstreams", read_jwt, jwt_secret=self._SECRET
         )
         assert allowed is True
 
-    def test_console_create_ws_read_token_403(self, enabled):
+    def test_console_create_ws_read_token_403(self, read_jwt):
         """Read tokens cannot create workstreams."""
         allowed, status, msg, _result = check_request(
-            enabled, "POST", "/api/cluster/workstreams/new", "Bearer tok_read"
+            "POST", "/api/cluster/workstreams/new", read_jwt, jwt_secret=self._SECRET
         )
         assert allowed is False
         assert status == 403
 
-    def test_approve_full_token_ok(self, enabled):
+    def test_approve_full_token_ok(self, full_jwt):
         allowed, status, msg, _result = check_request(
-            enabled, "POST", "/api/approve", "Bearer tok_full"
+            "POST", "/api/approve", full_jwt, jwt_secret=self._SECRET
         )
         assert allowed is True
 
-    def test_no_auth_header_string(self, enabled):
-        allowed, status, msg, _result = check_request(enabled, "GET", "/api/dashboard", "")
+    def test_no_auth_header_string(self):
+        allowed, status, msg, _result = check_request("GET", "/api/dashboard", "")
         assert allowed is False
         assert status == 401
 
@@ -526,70 +484,71 @@ class TestCheckRequest:
 class TestCheckRequestWithCookie:
     """Tests for cookie-based auth fallback in check_request."""
 
-    @pytest.fixture()
-    def enabled(self):
-        return AuthConfig(
-            enabled=True,
-            tokens={"tok_full": "full", "tok_read": "read"},
-        )
+    _SECRET = "test-jwt-secret-minimum-32-chars!"
 
-    def test_cookie_fallback_when_no_bearer(self, enabled):
+    @pytest.fixture()
+    def read_jwt(self):
+        return create_jwt("u1", frozenset({"read"}), "test", self._SECRET)
+
+    @pytest.fixture()
+    def full_jwt(self):
+        return create_jwt("u1", frozenset({"read", "write", "approve"}), "test", self._SECRET)
+
+    def test_cookie_fallback_when_no_bearer(self, read_jwt):
         allowed, status, _, _r = check_request(
-            enabled,
             "GET",
             "/api/workstreams",
             None,
-            cookie_header="turnstone_auth=tok_read",
+            cookie_header=f"turnstone_auth={read_jwt}",
+            jwt_secret=self._SECRET,
         )
         assert allowed is True
         assert status == 200
 
-    def test_bearer_takes_precedence_over_cookie(self, enabled):
-        # Bearer is full, cookie is read — Bearer should win
+    def test_bearer_takes_precedence_over_cookie(self, read_jwt, full_jwt):
         allowed, status, _, _r = check_request(
-            enabled,
             "POST",
             "/api/send",
-            "Bearer tok_full",
-            cookie_header="turnstone_auth=tok_read",
+            f"Bearer {full_jwt}",
+            cookie_header=f"turnstone_auth={read_jwt}",
+            jwt_secret=self._SECRET,
         )
         assert allowed is True
 
-    def test_invalid_cookie_401(self, enabled):
+    def test_invalid_cookie_401(self):
         allowed, status, _, _r = check_request(
-            enabled,
             "GET",
             "/api/workstreams",
             None,
             cookie_header="turnstone_auth=wrong_token",
+            jwt_secret=self._SECRET,
         )
         assert allowed is False
         assert status == 401
 
-    def test_cookie_read_on_write_403(self, enabled):
+    def test_cookie_read_on_write_403(self, read_jwt):
         allowed, status, _, _r = check_request(
-            enabled,
             "POST",
             "/api/send",
             None,
-            cookie_header="turnstone_auth=tok_read",
+            cookie_header=f"turnstone_auth={read_jwt}",
+            jwt_secret=self._SECRET,
         )
         assert allowed is False
         assert status == 403
 
-    def test_cookie_full_on_write_ok(self, enabled):
+    def test_cookie_full_on_write_ok(self, full_jwt):
         allowed, status, _, _r = check_request(
-            enabled,
             "POST",
             "/api/send",
             None,
-            cookie_header="turnstone_auth=tok_full",
+            cookie_header=f"turnstone_auth={full_jwt}",
+            jwt_secret=self._SECRET,
         )
         assert allowed is True
 
-    def test_no_cookie_no_bearer_401(self, enabled):
+    def test_no_cookie_no_bearer_401(self):
         allowed, status, _, _r = check_request(
-            enabled,
             "GET",
             "/api/workstreams",
             None,
@@ -598,18 +557,16 @@ class TestCheckRequestWithCookie:
         assert allowed is False
         assert status == 401
 
-    def test_login_path_public(self, enabled):
+    def test_login_path_public(self):
         allowed, status, _, _r = check_request(
-            enabled,
             "POST",
             "/api/auth/login",
             None,
         )
         assert allowed is True
 
-    def test_logout_path_public(self, enabled):
+    def test_logout_path_public(self):
         allowed, status, _, _r = check_request(
-            enabled,
             "POST",
             "/api/auth/logout",
             None,
@@ -617,139 +574,6 @@ class TestCheckRequestWithCookie:
         assert allowed is True
 
 
-# ---------------------------------------------------------------------------
-# TestLoadAuthConfig
-# ---------------------------------------------------------------------------
-
-
-class TestLoadAuthConfig:
-    """Tests for load_auth_config with mocked config + env vars."""
-
-    def test_default_enabled(self):
-        with patch("turnstone.core.config.load_config", return_value={}):
-            cfg = load_auth_config()
-        assert cfg.enabled is True
-        assert cfg.tokens == {}
-
-    def test_explicit_disable(self):
-        with (
-            patch("turnstone.core.config.load_config", return_value={"enabled": False}),
-            patch.dict(os.environ, {}, clear=True),
-        ):
-            cfg = load_auth_config()
-        assert cfg.enabled is False
-
-    def test_env_disable(self):
-        with (
-            patch("turnstone.core.config.load_config", return_value={}),
-            patch.dict(os.environ, {"TURNSTONE_AUTH_ENABLED": "0"}, clear=True),
-        ):
-            cfg = load_auth_config()
-        assert cfg.enabled is False
-
-    def test_config_file_tokens(self):
-        mock_cfg = {
-            "enabled": True,
-            "tokens": [
-                {"value": "tok_a", "role": "full"},
-                {"value": "tok_b", "role": "read"},
-            ],
-        }
-        with (
-            patch("turnstone.core.config.load_config", return_value=mock_cfg),
-            patch.dict(os.environ, {}, clear=True),
-        ):
-            cfg = load_auth_config()
-        assert cfg.enabled is True
-        assert cfg.tokens == {"tok_a": "full", "tok_b": "read"}
-
-    def test_env_var_enabled(self):
-        with (
-            patch("turnstone.core.config.load_config", return_value={}),
-            patch.dict(os.environ, {"TURNSTONE_AUTH_ENABLED": "1"}, clear=False),
-        ):
-            cfg = load_auth_config()
-        assert cfg.enabled is True
-
-    def test_env_var_token(self):
-        with (
-            patch("turnstone.core.config.load_config", return_value={}),
-            patch.dict(os.environ, {"TURNSTONE_AUTH_TOKEN": "tok_env"}, clear=False),
-        ):
-            cfg = load_auth_config()
-        assert "tok_env" in cfg.tokens
-        assert cfg.tokens["tok_env"] == "full"
-
-    def test_config_plus_env_merge(self):
-        mock_cfg = {
-            "enabled": True,
-            "tokens": [{"value": "tok_cfg", "role": "read"}],
-        }
-        with (
-            patch("turnstone.core.config.load_config", return_value=mock_cfg),
-            patch.dict(os.environ, {"TURNSTONE_AUTH_TOKEN": "tok_env"}, clear=False),
-        ):
-            cfg = load_auth_config()
-        assert cfg.tokens["tok_cfg"] == "read"
-        assert cfg.tokens["tok_env"] == "full"
-
-    def test_invalid_role_skipped(self):
-        mock_cfg = {
-            "enabled": True,
-            "tokens": [
-                {"value": "tok_ok", "role": "full"},
-                {"value": "tok_bad", "role": "admin"},
-            ],
-        }
-        with (
-            patch("turnstone.core.config.load_config", return_value=mock_cfg),
-            patch.dict(os.environ, {}, clear=True),
-        ):
-            cfg = load_auth_config()
-        assert "tok_ok" in cfg.tokens
-        assert "tok_bad" not in cfg.tokens
-
-    def test_empty_value_skipped(self):
-        mock_cfg = {
-            "enabled": True,
-            "tokens": [{"value": "", "role": "full"}],
-        }
-        with (
-            patch("turnstone.core.config.load_config", return_value=mock_cfg),
-            patch.dict(os.environ, {}, clear=True),
-        ):
-            cfg = load_auth_config()
-        assert len(cfg.tokens) == 0
-
-    def test_non_dict_token_entry_skipped(self):
-        mock_cfg = {
-            "enabled": True,
-            "tokens": ["not_a_dict", {"value": "tok_ok", "role": "full"}],
-        }
-        with (
-            patch("turnstone.core.config.load_config", return_value=mock_cfg),
-            patch.dict(os.environ, {}, clear=True),
-        ):
-            cfg = load_auth_config()
-        assert cfg.tokens == {"tok_ok": "full"}
-
-    def test_env_enabled_true(self):
-        with (
-            patch("turnstone.core.config.load_config", return_value={}),
-            patch.dict(os.environ, {"TURNSTONE_AUTH_ENABLED": "true"}, clear=False),
-        ):
-            cfg = load_auth_config()
-        assert cfg.enabled is True
-
-    def test_env_enabled_yes(self):
-        with (
-            patch("turnstone.core.config.load_config", return_value={}),
-            patch.dict(os.environ, {"TURNSTONE_AUTH_ENABLED": "yes"}, clear=False),
-        ):
-            cfg = load_auth_config()
-        assert cfg.enabled is True
-
-
 # ---------------------------------------------------------------------------
 # Integration tests — actual HTTP server with auth enabled
 # ---------------------------------------------------------------------------
@@ -785,16 +609,22 @@ class TestServerAuth:
         mock_mgr.list_all.return_value = [mock_ws]
         mock_mgr.max_workstreams = 10
 
+        from turnstone.core.auth import JWT_AUD_SERVER
+
+        cls._jwt_secret = "test-jwt-secret-minimum-32-chars!"
+        cls._read_hdr = {
+            "Authorization": f"Bearer {create_jwt('u1', frozenset({'read'}), 'test', cls._jwt_secret, audience=JWT_AUD_SERVER)}"
+        }
+        cls._full_hdr = {
+            "Authorization": f"Bearer {create_jwt('u1', frozenset({'read', 'write', 'approve'}), 'test', cls._jwt_secret, audience=JWT_AUD_SERVER)}"
+        }
         app = srv_mod.create_app(
             workstreams=mock_mgr,
             global_queue=queue.Queue(),
             global_listeners=[],
             global_listeners_lock=threading.Lock(),
             skip_permissions=False,
-            auth_config=AuthConfig(
-                enabled=True,
-                tokens={"tok_full": "full", "tok_read": "read"},
-            ),
+            jwt_secret=cls._jwt_secret,
             cors_origins=["*"],
         )
         cls.client = TestClient(app, raise_server_exceptions=False)
@@ -809,7 +639,6 @@ class TestServerAuth:
 
     def test_metrics_no_token_passes_auth(self):
         resp = self.client.get("/metrics")
-        # Public path — should never be 401/403
         assert resp.status_code not in (401, 403)
 
     def test_root_no_token_200(self):
@@ -826,23 +655,17 @@ class TestServerAuth:
         assert "Unauthorized" in resp.json().get("error", "")
 
     def test_api_workstreams_read_token_200(self):
-        resp = self.client.get(
-            "/v1/api/workstreams",
-            headers={"Authorization": "Bearer tok_read"},
-        )
+        resp = self.client.get("/v1/api/workstreams", headers=self._read_hdr)
         assert resp.status_code == 200
 
     def test_api_workstreams_full_token_200(self):
-        resp = self.client.get(
-            "/v1/api/workstreams",
-            headers={"Authorization": "Bearer tok_full"},
-        )
+        resp = self.client.get("/v1/api/workstreams", headers=self._full_hdr)
         assert resp.status_code == 200
 
     def test_api_send_read_token_403(self):
         resp = self.client.post(
             "/v1/api/send",
-            headers={"Authorization": "Bearer tok_read"},
+            headers=self._read_hdr,
             json={"message": "hello", "ws_id": "x"},
         )
         assert resp.status_code == 403
@@ -851,10 +674,9 @@ class TestServerAuth:
     def test_api_send_full_token_passes_auth(self):
         resp = self.client.post(
             "/v1/api/send",
-            headers={"Authorization": "Bearer tok_full"},
+            headers=self._full_hdr,
             json={"message": "hello", "ws_id": "nonexistent"},
         )
-        # Should get 404 (unknown workstream), not 401/403
         assert resp.status_code not in (401, 403)
 
     def test_api_send_no_token_401(self):
@@ -921,12 +743,18 @@ class TestConsoleAuth:
             "aggregate": {"total_tokens": 100},
         }
 
+        from turnstone.core.auth import JWT_AUD_CONSOLE
+
+        cls._jwt_secret = "test-jwt-secret-minimum-32-chars!"
+        cls._read_hdr = {
+            "Authorization": f"Bearer {create_jwt('u1', frozenset({'read'}), 'test', cls._jwt_secret, audience=JWT_AUD_CONSOLE)}"
+        }
+        cls._full_hdr = {
+            "Authorization": f"Bearer {create_jwt('u1', frozenset({'read', 'write', 'approve'}), 'test', cls._jwt_secret, audience=JWT_AUD_CONSOLE)}"
+        }
         app = create_app(
             collector=mock_collector,
-            auth_config=AuthConfig(
-                enabled=True,
-                tokens={"tok_full": "full", "tok_read": "read"},
-            ),
+            jwt_secret=cls._jwt_secret,
         )
         cls.test_client = TestClient(app, raise_server_exceptions=False)
 
@@ -947,17 +775,11 @@ class TestConsoleAuth:
         assert resp.status_code == 401
 
     def test_api_overview_read_token_200(self):
-        resp = self.test_client.get(
-            "/v1/api/cluster/overview",
-            headers={"Authorization": "Bearer tok_read"},
-        )
+        resp = self.test_client.get("/v1/api/cluster/overview", headers=self._read_hdr)
         assert resp.status_code == 200
 
     def test_api_overview_full_token_200(self):
-        resp = self.test_client.get(
-            "/v1/api/cluster/overview",
-            headers={"Authorization": "Bearer tok_full"},
-        )
+        resp = self.test_client.get("/v1/api/cluster/overview", headers=self._full_hdr)
         assert resp.status_code == 200
 
     def test_invalid_token_401(self):
@@ -1003,16 +825,33 @@ class TestServerLogin:
         mock_mgr.list_all.return_value = [mock_ws]
         mock_mgr.max_workstreams = 10
 
+        # Mock storage with a test user for password login
+        from turnstone.core.auth import hash_password
+
+        mock_storage = MagicMock()
+        mock_storage.get_user_by_username.side_effect = lambda u: (
+            {
+                "user_id": "uid_test",
+                "username": "testuser",
+                "password_hash": hash_password("testpass"),
+                "display_name": "Test",
+            }
+            if u == "testuser"
+            else None
+        )
+        mock_storage.list_user_roles.return_value = [
+            {"role_id": "builtin-admin", "scopes": "read,write,approve"}
+        ]
+
+        cls._jwt_secret = "test-jwt-secret-minimum-32-chars!"
         app = srv_mod.create_app(
             workstreams=mock_mgr,
             global_queue=queue.Queue(),
             global_listeners=[],
             global_listeners_lock=threading.Lock(),
             skip_permissions=False,
-            auth_config=AuthConfig(
-                enabled=True,
-                tokens={"tok_full": "full", "tok_read": "read"},
-            ),
+            jwt_secret=cls._jwt_secret,
+            auth_storage=mock_storage,
         )
         cls.test_client = TestClient(app, raise_server_exceptions=False)
 
@@ -1020,36 +859,36 @@ class TestServerLogin:
     def teardown_class(cls):
         cls.test_client.close()
 
-    def test_login_valid_token_sets_cookie(self):
+    def test_login_config_token_rejected(self):
+        """Config token exchange is no longer allowed."""
         resp = self.test_client.post(
             "/v1/api/auth/login",
             json={"token": "tok_full"},
         )
-        assert resp.status_code == 200
-        data = resp.json()
-        assert data["role"] == "full"
-        cookie = resp.headers.get("set-cookie", "")
-        assert "turnstone_auth=tok_full" in cookie
-        assert "HttpOnly" in cookie
+        assert resp.status_code == 401
 
-    def test_login_invalid_token_401(self):
+    def test_login_invalid_credentials_401(self):
         resp = self.test_client.post(
             "/v1/api/auth/login",
-            json={"token": "wrong"},
+            json={"username": "testuser", "password": "wrong"},
         )
         assert resp.status_code == 401
 
-    def test_login_no_auth_required(self):
-        # /v1/api/auth/login is public — shouldn't require auth itself
+    def test_login_password_ok(self):
         resp = self.test_client.post(
             "/v1/api/auth/login",
-            json={"token": "tok_read"},
+            json={"username": "testuser", "password": "testpass"},
         )
         assert resp.status_code == 200
+        data = resp.json()
+        assert "jwt" in data
 
     def test_cookie_auth_on_api(self):
         # Login to get cookie (TestClient tracks cookies automatically)
-        login_resp = self.test_client.post("/v1/api/auth/login", json={"token": "tok_read"})
+        login_resp = self.test_client.post(
+            "/v1/api/auth/login",
+            json={"username": "testuser", "password": "testpass"},
+        )
         assert login_resp.status_code == 200
 
         # Use cookie to access API — TestClient forwards cookies
@@ -1057,7 +896,10 @@ class TestServerLogin:
         assert resp.status_code == 200
 
     def test_logout_clears_cookie(self):
-        self.test_client.post("/v1/api/auth/login", json={"token": "tok_read"})
+        self.test_client.post(
+            "/v1/api/auth/login",
+            json={"username": "testuser", "password": "testpass"},
+        )
 
         # Logout
         logout_resp = self.test_client.post("/v1/api/auth/logout")
@@ -1081,6 +923,7 @@ class TestConsoleLogin:
 
         from turnstone.console.collector import ClusterCollector
         from turnstone.console.server import _load_static, create_app
+        from turnstone.core.auth import hash_password
 
         _load_static()
 
@@ -1092,12 +935,26 @@ class TestConsoleLogin:
             "aggregate": {"total_tokens": 100},
         }
 
+        mock_storage = MagicMock()
+        mock_storage.get_user_by_username.side_effect = lambda u: (
+            {
+                "user_id": "uid_test",
+                "username": "testuser",
+                "password_hash": hash_password("testpass"),
+                "display_name": "Test",
+            }
+            if u == "testuser"
+            else None
+        )
+        mock_storage.list_user_roles.return_value = [
+            {"role_id": "builtin-admin", "scopes": "read,write,approve"}
+        ]
+
+        cls._jwt_secret = "test-jwt-secret-minimum-32-chars!"
         app = create_app(
             collector=mock_collector,
-            auth_config=AuthConfig(
-                enabled=True,
-                tokens={"tok_full": "full", "tok_read": "read"},
-            ),
+            jwt_secret=cls._jwt_secret,
+            auth_storage=mock_storage,
         )
         cls.test_client = TestClient(app, raise_server_exceptions=False)
 
@@ -1105,28 +962,34 @@ class TestConsoleLogin:
     def teardown_class(cls):
         cls.test_client.close()
 
-    def test_login_valid_token(self):
+    def test_login_config_token_rejected(self):
         resp = self.test_client.post(
             "/v1/api/auth/login",
             json={"token": "tok_read"},
         )
+        assert resp.status_code == 401
+
+    def test_login_password_ok(self):
+        resp = self.test_client.post(
+            "/v1/api/auth/login",
+            json={"username": "testuser", "password": "testpass"},
+        )
         assert resp.status_code == 200
         assert "turnstone_auth" in resp.headers.get("set-cookie", "")
 
-    def test_login_invalid_token(self):
-        resp = self.test_client.post(
-            "/v1/api/auth/login",
-            json={"token": "wrong"},
-        )
-        assert resp.status_code == 401
-
     def test_cookie_auth_on_api(self):
-        self.test_client.post("/v1/api/auth/login", json={"token": "tok_read"})
+        self.test_client.post(
+            "/v1/api/auth/login",
+            json={"username": "testuser", "password": "testpass"},
+        )
         resp = self.test_client.get("/v1/api/cluster/overview")
         assert resp.status_code == 200
 
     def test_logout_then_api_fails(self):
-        self.test_client.post("/v1/api/auth/login", json={"token": "tok_read"})
+        self.test_client.post(
+            "/v1/api/auth/login",
+            json={"username": "testuser", "password": "testpass"},
+        )
         self.test_client.post("/v1/api/auth/logout")
         resp = self.test_client.get("/v1/api/cluster/overview")
         assert resp.status_code == 401
@@ -1385,25 +1248,29 @@ class TestIsSecureRequest:
 
 
 class TestSecretStrength:
-    def test_short_secret_warns(self, caplog):
-        import logging
+    def test_short_secret_exits(self):
+        import turnstone.core.auth as auth_mod
 
-        from turnstone.core.auth import _MIN_SECRET_LENGTH
+        old = os.environ.get("TURNSTONE_JWT_SECRET", "")
+        os.environ["TURNSTONE_JWT_SECRET"] = "short"
+        try:
+            with pytest.raises(SystemExit):
+                auth_mod.load_jwt_secret()
+        finally:
+            if old:
+                os.environ["TURNSTONE_JWT_SECRET"] = old
+            else:
+                os.environ.pop("TURNSTONE_JWT_SECRET", None)
 
-        with caplog.at_level(logging.WARNING, logger="turnstone.core.auth"):
-            import turnstone.core.auth as auth_mod
+    def test_missing_secret_exits(self):
+        import turnstone.core.auth as auth_mod
 
-            old = os.environ.get("TURNSTONE_JWT_SECRET", "")
-            os.environ["TURNSTONE_JWT_SECRET"] = "short"
-            try:
-                secret = auth_mod.load_jwt_secret()
-                assert secret == "short"
-                assert any(str(_MIN_SECRET_LENGTH) in r.message for r in caplog.records)
-            finally:
-                if old:
-                    os.environ["TURNSTONE_JWT_SECRET"] = old
-                else:
-                    os.environ.pop("TURNSTONE_JWT_SECRET", None)
+        with (
+            patch("turnstone.core.config.load_config", return_value={}),
+            patch.dict(os.environ, {}, clear=True),
+            pytest.raises(SystemExit),
+        ):
+            auth_mod.load_jwt_secret()
 
 
 class TestCorsConfigurable:
@@ -1424,7 +1291,6 @@ class TestCorsConfigurable:
             global_listeners=[],
             global_listeners_lock=threading.Lock(),
             skip_permissions=False,
-            auth_config=AuthConfig(enabled=False),
         )
         client = TestClient(app)
         resp = client.get("/health", headers={"Origin": "http://evil.com"})
@@ -1446,7 +1312,6 @@ class TestCorsConfigurable:
             global_listeners=[],
             global_listeners_lock=threading.Lock(),
             skip_permissions=False,
-            auth_config=AuthConfig(enabled=False),
             cors_origins=["http://example.com"],
         )
         client = TestClient(app)
@@ -1502,3 +1367,69 @@ class TestOIDCPublicPaths:
     def test_oidc_callback_is_public(self):
         assert is_public_path("/api/auth/oidc/callback") is True
         assert is_public_path("/v1/api/auth/oidc/callback") is True
+
+
+# ---------------------------------------------------------------------------
+# TestRequirePermissionServiceScope — service scope bypasses permission checks
+# ---------------------------------------------------------------------------
+
+
+class TestRequirePermissionServiceScope:
+    """Verify require_permission() behaviour with the service scope."""
+
+    def _make_request(self, auth_result):
+        """Build a mock Starlette request with the given AuthResult on state."""
+        request = MagicMock()
+        request.state.auth_result = auth_result
+        return request
+
+    def test_service_scope_bypasses_permission(self):
+        """Service-scoped tokens bypass all permission checks (returns None)."""
+        from turnstone.core.auth import AuthResult, require_permission
+
+        auth = AuthResult(
+            user_id="svc-agent",
+            scopes=frozenset({"service"}),
+            token_source="jwt",
+        )
+        request = self._make_request(auth)
+        result = require_permission(request, "admin.users")
+        assert result is None  # bypass — no 403
+
+    def test_without_service_scope_and_without_permission_returns_403(self):
+        """Non-service tokens without the required permission get 403."""
+        from turnstone.core.auth import AuthResult, require_permission
+
+        auth = AuthResult(
+            user_id="regular-user",
+            scopes=frozenset({"read", "write"}),
+            token_source="jwt",
+        )
+        request = self._make_request(auth)
+        result = require_permission(request, "admin.users")
+        assert result is not None
+        assert result.status_code == 403
+
+    def test_without_service_scope_with_permission_returns_none(self):
+        """Non-service tokens with the required permission pass."""
+        from turnstone.core.auth import AuthResult, require_permission
+
+        auth = AuthResult(
+            user_id="admin-user",
+            scopes=frozenset({"read", "write", "approve"}),
+            token_source="jwt",
+            permissions=frozenset({"admin.users"}),
+        )
+        request = self._make_request(auth)
+        result = require_permission(request, "admin.users")
+        assert result is None  # granted — no 403
+
+    def test_no_auth_result_returns_401(self):
+        """Missing auth_result on request state returns 401."""
+        from turnstone.core.auth import require_permission
+
+        request = MagicMock()
+        del request.state.auth_result  # ensure attribute is absent
+        result = require_permission(request, "admin.users")
+        assert result is not None
+        assert result.status_code == 401

tests/test_auth_identity.py

@@ -7,7 +7,6 @@ import time
 import pytest
 
 from turnstone.core.auth import (
-    AuthConfig,
     AuthResult,
     _authenticate_token,
     check_request,
@@ -203,24 +202,10 @@ class TestRequiredScope:
 
 
 class TestAuthenticateToken:
-    def test_config_token_read(self):
-        cfg = AuthConfig(enabled=True, tokens={"tok_read": "read"})
-        result = _authenticate_token("tok_read", cfg)
-        assert result is not None
-        assert result.scopes == frozenset({"read"})
-        assert result.token_source == "config"
-
-    def test_config_token_full(self):
-        cfg = AuthConfig(enabled=True, tokens={"tok_full": "full"})
-        result = _authenticate_token("tok_full", cfg)
-        assert result is not None
-        assert result.scopes == frozenset({"read", "write", "approve"})
-
     def test_jwt_token(self):
         secret = "test-secret-key-for-jwt-min-32b!"
         jwt_tok = create_jwt("user1", frozenset({"read", "write"}), "db", secret)
-        cfg = AuthConfig(enabled=True)
-        result = _authenticate_token(jwt_tok, cfg, jwt_secret=secret)
+        result = _authenticate_token(jwt_tok, jwt_secret=secret)
         assert result is not None
         assert result.user_id == "user1"
         assert result.token_source == "db"
@@ -243,8 +228,7 @@ class TestAuthenticateToken:
                     }
                 return None
 
-        cfg = AuthConfig(enabled=True)
-        result = _authenticate_token(raw, cfg, storage=MockStorage())
+        result = _authenticate_token(raw, storage=MockStorage())
         assert result is not None
         assert result.user_id == "user1"
         assert result.has_scope("write")
@@ -266,13 +250,11 @@ class TestAuthenticateToken:
                     "expires": "2020-01-02T00:00:00",
                 }
 
-        cfg = AuthConfig(enabled=True)
-        result = _authenticate_token(raw, cfg, storage=MockStorage())
+        result = _authenticate_token(raw, storage=MockStorage())
         assert result is None
 
     def test_unknown_token(self):
-        cfg = AuthConfig(enabled=True, tokens={"tok": "full"})
-        result = _authenticate_token("unknown", cfg)
+        result = _authenticate_token("unknown")
         assert result is None
 
 
@@ -282,76 +264,74 @@ class TestAuthenticateToken:
 
 
 class TestCheckRequestScopes:
-    def test_config_read_on_write_403(self):
-        cfg = AuthConfig(enabled=True, tokens={"tok_read": "read"})
-        allowed, status, msg, _ = check_request(cfg, "POST", "/api/send", "Bearer tok_read")
+    _SECRET = "test-secret-key-for-jwt-min-32b!"
+
+    def test_jwt_read_on_write_403(self):
+        jwt_tok = create_jwt("u1", frozenset({"read"}), "test", self._SECRET)
+        allowed, status, msg, _ = check_request(
+            "POST",
+            "/api/send",
+            f"Bearer {jwt_tok}",
+            jwt_secret=self._SECRET,
+        )
         assert not allowed
         assert status == 403
         assert "write" in msg
 
-    def test_config_read_on_approve_403(self):
-        cfg = AuthConfig(enabled=True, tokens={"tok_read": "read"})
-        allowed, status, msg, _ = check_request(cfg, "POST", "/api/approve", "Bearer tok_read")
+    def test_jwt_read_on_approve_403(self):
+        jwt_tok = create_jwt("u1", frozenset({"read"}), "test", self._SECRET)
+        allowed, status, msg, _ = check_request(
+            "POST",
+            "/api/approve",
+            f"Bearer {jwt_tok}",
+            jwt_secret=self._SECRET,
+        )
         assert not allowed
         assert status == 403
         assert "approve" in msg
 
-    def test_config_full_on_approve_ok(self):
-        cfg = AuthConfig(enabled=True, tokens={"tok_full": "full"})
-        allowed, status, msg, result = check_request(cfg, "POST", "/api/approve", "Bearer tok_full")
+    def test_jwt_full_on_approve_ok(self):
+        jwt_tok = create_jwt("u1", frozenset({"read", "write", "approve"}), "test", self._SECRET)
+        allowed, status, msg, result = check_request(
+            "POST",
+            "/api/approve",
+            f"Bearer {jwt_tok}",
+            jwt_secret=self._SECRET,
+        )
         assert allowed
         assert result is not None
         assert result.has_scope("approve")
 
     def test_jwt_with_scopes(self):
-        secret = "test-secret-key-for-jwt-min-32b!"
-        jwt_tok = create_jwt("u1", frozenset({"read", "write"}), "db", secret)
-        cfg = AuthConfig(enabled=True)
+        jwt_tok = create_jwt("u1", frozenset({"read", "write"}), "db", self._SECRET)
         allowed, status, msg, result = check_request(
-            cfg,
             "POST",
             "/api/send",
             f"Bearer {jwt_tok}",
-            jwt_secret=secret,
+            jwt_secret=self._SECRET,
         )
         assert allowed
         assert result is not None
         assert result.user_id == "u1"
 
     def test_jwt_insufficient_scope(self):
-        secret = "test-secret-key-for-jwt-min-32b!"
-        jwt_tok = create_jwt("u1", frozenset({"read"}), "db", secret)
-        cfg = AuthConfig(enabled=True)
+        jwt_tok = create_jwt("u1", frozenset({"read"}), "db", self._SECRET)
         allowed, status, msg, _ = check_request(
-            cfg,
             "POST",
             "/api/send",
             f"Bearer {jwt_tok}",
-            jwt_secret=secret,
+            jwt_secret=self._SECRET,
         )
         assert not allowed
         assert status == 403
 
     def test_admin_path_requires_approve(self):
-        cfg = AuthConfig(enabled=True, tokens={"tok_read": "read"})
+        jwt_tok = create_jwt("u1", frozenset({"read"}), "test", self._SECRET)
         allowed, status, msg, _ = check_request(
-            cfg,
             "GET",
             "/v1/api/admin/users",
-            "Bearer tok_read",
+            f"Bearer {jwt_tok}",
+            jwt_secret=self._SECRET,
         )
         assert not allowed
         assert status == 403
-
-    def test_backward_compat_role_full(self):
-        """Config tokens with role='full' get all scopes."""
-        cfg = AuthConfig(enabled=True, tokens={"tok_full": "full"})
-        allowed, _, _, result = check_request(
-            cfg,
-            "GET",
-            "/v1/api/admin/users",
-            "Bearer tok_full",
-        )
-        assert allowed
-        assert result is not None
-        assert result.has_scope("approve")

tests/test_console.py

@@ -9,6 +9,24 @@ import pytest
 
 from turnstone.console.collector import ClusterCollector, NodeSnapshot
 
+# Shared test auth — JWT-based
+_TEST_JWT_SECRET = "test-jwt-secret-minimum-32-chars!"
+
+
+def _test_jwt() -> str:
+    from turnstone.core.auth import JWT_AUD_CONSOLE, create_jwt
+
+    return create_jwt(
+        user_id="test-console",
+        scopes=frozenset({"read", "write", "approve", "service"}),
+        source="test",
+        secret=_TEST_JWT_SECRET,
+        audience=JWT_AUD_CONSOLE,
+    )
+
+
+_TEST_AUTH_HEADERS = {"Authorization": f"Bearer {_test_jwt()}"}
+
 # ---------------------------------------------------------------------------
 # Mock storage for collector tests
 # ---------------------------------------------------------------------------
@@ -711,13 +729,11 @@ class TestConsoleHTTPEndpoints:
 
         _load_static()
 
-        from turnstone.core.auth import AuthConfig
-
         app = create_app(
             collector=mock_collector,
-            auth_config=AuthConfig(),
+            jwt_secret=_TEST_JWT_SECRET,
         )
-        client = TestClient(app, raise_server_exceptions=False)
+        client = TestClient(app, raise_server_exceptions=False, headers=_TEST_AUTH_HEADERS)
         yield client
         client.close()
 
@@ -953,12 +969,11 @@ class TestConsoleWorkstreamCreation:
         from starlette.testclient import TestClient
 
         from turnstone.console.server import _load_static, create_app
-        from turnstone.core.auth import AuthConfig
 
         _load_static()
         app = create_app(
             collector=mock_collector,
-            auth_config=AuthConfig(),
+            jwt_secret=_TEST_JWT_SECRET,
         )
 
         # Set up a mock proxy_client (lifespan doesn't run in TestClient)
@@ -974,7 +989,7 @@ class TestConsoleWorkstreamCreation:
         mock_proxy.post = mock_post
         app.state.proxy_client = mock_proxy
 
-        client = TestClient(app, raise_server_exceptions=False)
+        client = TestClient(app, raise_server_exceptions=False, headers=_TEST_AUTH_HEADERS)
         yield client, mock_post
         client.close()
 
@@ -1151,14 +1166,13 @@ class TestConsoleProxy:
         from starlette.testclient import TestClient
 
         from turnstone.console.server import _load_static, create_app
-        from turnstone.core.auth import AuthConfig
 
         _load_static()
         app = create_app(
             collector=mock_collector,
-            auth_config=AuthConfig(),
+            jwt_secret=_TEST_JWT_SECRET,
         )
-        client = TestClient(app, raise_server_exceptions=False)
+        client = TestClient(app, raise_server_exceptions=False, headers=_TEST_AUTH_HEADERS)
         yield client
         client.close()
 
@@ -1322,14 +1336,13 @@ class TestConsoleVersionEndpoints:
         from starlette.testclient import TestClient
 
         from turnstone.console.server import _load_static, create_app
-        from turnstone.core.auth import AuthConfig
 
         _load_static()
         app = create_app(
             collector=mock_collector,
-            auth_config=AuthConfig(),
+            jwt_secret=_TEST_JWT_SECRET,
         )
-        client = TestClient(app, raise_server_exceptions=False)
+        client = TestClient(app, raise_server_exceptions=False, headers=_TEST_AUTH_HEADERS)
         yield client
         client.close()
 
@@ -1364,7 +1377,6 @@ class TestSharedStatic:
         from starlette.testclient import TestClient
 
         from turnstone.console.server import _load_static, create_app
-        from turnstone.core.auth import AuthConfig
 
         _load_static()
         collector = MagicMock(spec=ClusterCollector)
@@ -1376,9 +1388,9 @@ class TestSharedStatic:
         }
         app = create_app(
             collector=collector,
-            auth_config=AuthConfig(),
+            jwt_secret=_TEST_JWT_SECRET,
         )
-        client = TestClient(app, raise_server_exceptions=False)
+        client = TestClient(app, raise_server_exceptions=False, headers=_TEST_AUTH_HEADERS)
         yield client
         client.close()
 
@@ -1481,7 +1493,6 @@ class TestProxySharedStatic:
         from starlette.testclient import TestClient
 
         from turnstone.console.server import _load_static, create_app
-        from turnstone.core.auth import AuthConfig
 
         _load_static()
         collector = MagicMock(spec=ClusterCollector)
@@ -1494,9 +1505,9 @@ class TestProxySharedStatic:
         collector.get_node_detail.return_value = None
         app = create_app(
             collector=collector,
-            auth_config=AuthConfig(),
+            jwt_secret=_TEST_JWT_SECRET,
         )
-        client = TestClient(app, raise_server_exceptions=False)
+        client = TestClient(app, raise_server_exceptions=False, headers=_TEST_AUTH_HEADERS)
         resp = client.get("/node/unknown/shared/base.css")
         assert resp.status_code == 404
         client.close()
@@ -1815,14 +1826,14 @@ class TestProxyAuthHeaders:
         # Should use ServiceTokenManager, not mint a user JWT
         assert headers["Authorization"] == f"Bearer {mgr.token}"
 
-    def test_fallback_static_token(self):
-        """No auth_result, no ServiceTokenManager → uses static proxy_auth_token."""
+    def test_no_mgr_no_user_returns_empty(self):
+        """No auth_result, no ServiceTokenManager → empty headers."""
         from turnstone.console.server import _proxy_auth_headers
 
-        req = self._make_request(proxy_auth_token="static-tok-123")
+        req = self._make_request()
         headers = _proxy_auth_headers(req)
 
-        assert headers == {"Authorization": "Bearer static-tok-123"}
+        assert headers == {}
 
 
 # ---------------------------------------------------------------------------

tests/test_console_routing_proxy.py

@@ -13,6 +13,24 @@ from turnstone.console.collector import ClusterCollector
 from turnstone.console.router import ConsoleRouter, NodeRef
 from turnstone.core.hash_ring import NoAvailableNodeError
 
+# Shared test auth — JWT-based
+_TEST_JWT_SECRET = "test-jwt-secret-minimum-32-chars!"
+
+
+def _test_jwt() -> str:
+    from turnstone.core.auth import JWT_AUD_CONSOLE, create_jwt
+
+    return create_jwt(
+        user_id="test-routing",
+        scopes=frozenset({"read", "write", "approve", "service"}),
+        source="test",
+        secret=_TEST_JWT_SECRET,
+        audience=JWT_AUD_CONSOLE,
+    )
+
+
+_TEST_AUTH_HEADERS: dict[str, str] = {"Authorization": f"Bearer {_test_jwt()}"}
+
 # ---------------------------------------------------------------------------
 # Helpers
 # ---------------------------------------------------------------------------
@@ -42,12 +60,11 @@ def _make_app(
     router: Any = None,
 ) -> Any:
     from turnstone.console.server import _load_static, create_app
-    from turnstone.core.auth import AuthConfig
 
     _load_static()
     return create_app(
         collector=collector or _make_mock_collector(),
-        auth_config=AuthConfig(),
+        jwt_secret=_TEST_JWT_SECRET,
         router=router,
     )
 
@@ -100,6 +117,7 @@ class TestRouteCreate:
         resp = client.post(
             "/v1/api/route/workstreams/new",
             json={"name": "test-ws"},
+            headers=_TEST_AUTH_HEADERS,
         )
         assert resp.status_code == 200
         data = resp.json()
@@ -109,6 +127,7 @@ class TestRouteCreate:
         resp = client.post(
             "/v1/api/route/workstreams/new",
             json={"name": "test-ws"},
+            headers=_TEST_AUTH_HEADERS,
         )
         assert resp.status_code == 200
         data = resp.json()
@@ -126,6 +145,7 @@ class TestRouteCreate:
         resp = client.post(
             "/v1/api/route/workstreams/new",
             json={"resume_ws": "old_ws_id"},
+            headers=_TEST_AUTH_HEADERS,
         )
         assert resp.status_code == 200
         data = resp.json()
@@ -150,6 +170,7 @@ class TestRouteCreate:
         resp = client.post(
             "/v1/api/route/workstreams/new",
             json={"target_node": "node-c"},
+            headers=_TEST_AUTH_HEADERS,
         )
         assert resp.status_code == 200
         data = resp.json()
@@ -203,6 +224,7 @@ class TestRouteCreate503Retry:
         resp = client.post(
             "/v1/api/route/workstreams/new",
             json={"name": "test-ws"},
+            headers=_TEST_AUTH_HEADERS,
         )
         assert resp.status_code == 200
         data = resp.json()
@@ -233,6 +255,7 @@ class TestRouteProxy:
         resp = client.post(
             "/v1/api/route/send",
             json={"ws_id": "abc123", "message": "hello"},
+            headers=_TEST_AUTH_HEADERS,
         )
         assert resp.status_code == 200
         # Verify upstream URL was /v1/api/send (not /v1/api/route/send)
@@ -245,6 +268,7 @@ class TestRouteProxy:
         resp = client.post(
             "/v1/api/route/approve",
             json={"ws_id": "abc123", "approved": True},
+            headers=_TEST_AUTH_HEADERS,
         )
         assert resp.status_code == 200
 
@@ -252,6 +276,7 @@ class TestRouteProxy:
         resp = client.post(
             "/v1/api/route/cancel",
             json={"ws_id": "abc123"},
+            headers=_TEST_AUTH_HEADERS,
         )
         assert resp.status_code == 200
 
@@ -259,6 +284,7 @@ class TestRouteProxy:
         resp = client.post(
             "/v1/api/route/command",
             json={"ws_id": "abc123", "command": "status"},
+            headers=_TEST_AUTH_HEADERS,
         )
         assert resp.status_code == 200
 
@@ -266,6 +292,7 @@ class TestRouteProxy:
         resp = client.post(
             "/v1/api/route/workstreams/close",
             json={"ws_id": "abc123"},
+            headers=_TEST_AUTH_HEADERS,
         )
         assert resp.status_code == 200
 
@@ -288,14 +315,14 @@ class TestRouteLookup:
         client.close()
 
     def test_route_lookup(self, client):
-        resp = client.get("/v1/api/route?ws_id=abc123")
+        resp = client.get("/v1/api/route?ws_id=abc123", headers=_TEST_AUTH_HEADERS)
         assert resp.status_code == 200
         data = resp.json()
         assert data["node_url"] == "http://a:8080"
         assert data["node_id"] == "node-a"
 
     def test_route_lookup_missing_ws_id(self, client):
-        resp = client.get("/v1/api/route")
+        resp = client.get("/v1/api/route", headers=_TEST_AUTH_HEADERS)
         assert resp.status_code == 400
         assert "ws_id" in resp.json()["error"]
 
@@ -329,6 +356,7 @@ class TestRouteNotReady:
         resp = client_no_router.post(
             "/v1/api/route/workstreams/new",
             json={"name": "test"},
+            headers=_TEST_AUTH_HEADERS,
         )
         assert resp.status_code == 503
 
@@ -336,6 +364,7 @@ class TestRouteNotReady:
         resp = client_empty_cache.post(
             "/v1/api/route/workstreams/new",
             json={"name": "test"},
+            headers=_TEST_AUTH_HEADERS,
         )
         assert resp.status_code == 503
 
@@ -343,22 +372,24 @@ class TestRouteNotReady:
         resp = client_no_router.post(
             "/v1/api/route/send",
             json={"ws_id": "abc", "message": "hello"},
+            headers=_TEST_AUTH_HEADERS,
         )
         assert resp.status_code == 503
 
     def test_route_lookup_no_router_503(self, client_no_router):
-        resp = client_no_router.get("/v1/api/route?ws_id=abc")
+        resp = client_no_router.get("/v1/api/route?ws_id=abc", headers=_TEST_AUTH_HEADERS)
         assert resp.status_code == 503
 
     def test_route_proxy_empty_cache_503(self, client_empty_cache):
         resp = client_empty_cache.post(
             "/v1/api/route/send",
             json={"ws_id": "abc", "message": "hello"},
+            headers=_TEST_AUTH_HEADERS,
         )
         assert resp.status_code == 503
 
     def test_route_lookup_empty_cache_503(self, client_empty_cache):
-        resp = client_empty_cache.get("/v1/api/route?ws_id=abc")
+        resp = client_empty_cache.get("/v1/api/route?ws_id=abc", headers=_TEST_AUTH_HEADERS)
         assert resp.status_code == 503
 
 
@@ -384,6 +415,7 @@ class TestRouteNoNode:
         resp = client.post(
             "/v1/api/route/workstreams/new",
             json={"name": "test"},
+            headers=_TEST_AUTH_HEADERS,
         )
         assert resp.status_code == 503
         assert "No available node" in resp.json()["error"]
@@ -392,9 +424,10 @@ class TestRouteNoNode:
         resp = client.post(
             "/v1/api/route/send",
             json={"ws_id": "abc", "message": "hello"},
+            headers=_TEST_AUTH_HEADERS,
         )
         assert resp.status_code == 503
 
     def test_route_lookup_no_node_503(self, client):
-        resp = client.get("/v1/api/route?ws_id=abc")
+        resp = client.get("/v1/api/route?ws_id=abc", headers=_TEST_AUTH_HEADERS)
         assert resp.status_code == 503

tests/test_hash_ring_storage.py

@@ -41,6 +41,21 @@ class TestHashRingBuckets:
         # Empty list returns 0
         assert storage.assign_buckets([], "node-x") == 0
 
+    def test_assign_large_list_exceeds_chunk_size(self, storage):
+        """Regression: lists larger than chunk_size must not hit param limits."""
+        n = 1200  # exceeds SQLite chunk_size (500) and exercises multi-chunk path
+        storage.seed_ring_buckets([(i, "node-a") for i in range(n)])
+        count = storage.assign_buckets(list(range(n)), "node-b")
+        assert count == n
+        rows = storage.list_ring_buckets()
+        assert all(r["node_id"] == "node-b" for r in rows)
+
+    def test_assign_deduplicates_input(self, storage):
+        """Duplicates in the input list should not inflate rowcount."""
+        storage.seed_ring_buckets([(0, "node-a"), (1, "node-a")])
+        count = storage.assign_buckets([0, 1, 0, 1, 0], "node-b")
+        assert count == 2
+
 
 class TestBucketStats:
     def test_increment_creates_row(self, storage):

tests/test_html.py

@@ -37,3 +37,55 @@ class TestStripHtml:
     def test_self_closing_tags(self):
         result = strip_html("hello<br/>world")
         assert result == "helloworld"
+
+    # -- invisible element stripping -----------------------------------------
+
+    def test_strips_script_content(self):
+        html = "<p>before</p><script>var x = 1;</script><p>after</p>"
+        result = strip_html(html)
+        assert "var x" not in result
+        assert "before" in result
+        assert "after" in result
+
+    def test_strips_style_content(self):
+        html = "<style>.foo { color: red; }</style><p>visible</p>"
+        result = strip_html(html)
+        assert "color" not in result
+        assert "visible" in result
+
+    def test_strips_template_content(self):
+        html = "<template><div>hidden</div></template><p>shown</p>"
+        result = strip_html(html)
+        assert "hidden" not in result
+        assert "shown" in result
+
+    def test_strips_noscript_content(self):
+        html = "<noscript>Enable JS</noscript><p>content</p>"
+        result = strip_html(html)
+        assert "Enable JS" not in result
+        assert "content" in result
+
+    def test_strips_multiple_script_blocks(self):
+        html = "<script>a()</script><p>middle</p><script>b()</script>"
+        result = strip_html(html)
+        assert "a()" not in result
+        assert "b()" not in result
+        assert "middle" in result
+
+    def test_strips_multiline_script(self):
+        html = "<script>\nfunction foo() {\n  return 1;\n}\n</script><p>ok</p>"
+        result = strip_html(html)
+        assert "function" not in result
+        assert "ok" in result
+
+    def test_strips_script_case_insensitive(self):
+        html = "<SCRIPT>code()</SCRIPT><p>text</p>"
+        result = strip_html(html)
+        assert "code()" not in result
+        assert "text" in result
+
+    def test_strips_script_with_attributes(self):
+        html = '<script type="text/javascript" src="app.js">init();</script><p>done</p>'
+        result = strip_html(html)
+        assert "init()" not in result
+        assert "done" in result

tests/test_notify_http.py

@@ -8,8 +8,26 @@ import pytest
 from starlette.testclient import TestClient
 
 from turnstone.channels._http import create_channel_app
+from turnstone.core.auth import JWT_AUD_CHANNEL, create_jwt
 from turnstone.core.storage._sqlite import SQLiteBackend
 
+_JWT_SECRET = "a" * 32
+
+
+def _make_jwt() -> str:
+    """Create a valid JWT for channel auth."""
+    return create_jwt(
+        user_id="system",
+        scopes=frozenset({"write"}),
+        source="service",
+        secret=_JWT_SECRET,
+        audience=JWT_AUD_CHANNEL,
+    )
+
+
+def _auth_headers() -> dict[str, str]:
+    return {"Authorization": f"Bearer {_make_jwt()}"}
+
 
 @pytest.fixture
 def storage(tmp_path):
@@ -33,22 +51,22 @@ def no_auth_client(storage, mock_adapter):
 
 @pytest.fixture
 def client(storage, mock_adapter):
-    """Default client with static auth token configured."""
-    app = create_channel_app({"discord": mock_adapter}, storage, auth_token="test-secret-token")
+    """Default client with JWT auth configured."""
+    app = create_channel_app({"discord": mock_adapter}, storage, jwt_secret=_JWT_SECRET)
     return TestClient(app)
 
 
 @pytest.fixture
 def authed_client(storage, mock_adapter):
-    """Alias — same as client, for auth-specific test clarity."""
-    app = create_channel_app({"discord": mock_adapter}, storage, auth_token="test-secret-token")
+    """Alias -- same as client, for auth-specific test clarity."""
+    app = create_channel_app({"discord": mock_adapter}, storage, jwt_secret=_JWT_SECRET)
     return TestClient(app)
 
 
 @pytest.fixture
 def jwt_client(storage, mock_adapter):
     """Client with JWT auth configured."""
-    app = create_channel_app({"discord": mock_adapter}, storage, jwt_secret="a" * 32)
+    app = create_channel_app({"discord": mock_adapter}, storage, jwt_secret=_JWT_SECRET)
     return TestClient(app)
 
 
@@ -58,9 +76,6 @@ class TestNotifyEndpoint:
         assert resp.status_code == 200
         assert resp.json()["status"] == "ok"
 
-    def _headers(self) -> dict[str, str]:
-        return {"Authorization": "Bearer test-secret-token"}
-
     def test_direct_discord_target(self, client, mock_adapter):
         resp = client.post(
             "/v1/api/notify",
@@ -68,7 +83,7 @@ class TestNotifyEndpoint:
                 "target": {"channel_type": "discord", "channel_id": "123456"},
                 "message": "Hello!",
             },
-            headers=self._headers(),
+            headers=_auth_headers(),
         )
         assert resp.status_code == 200
         results = resp.json()["results"]
@@ -85,7 +100,7 @@ class TestNotifyEndpoint:
                 "message": "Hello!",
                 "title": "Alert",
             },
-            headers=self._headers(),
+            headers=_auth_headers(),
         )
         assert resp.status_code == 200
         mock_adapter.send.assert_called_once_with("123456", "**Alert**\nHello!")
@@ -101,7 +116,7 @@ class TestNotifyEndpoint:
                 "target": {"username": "testuser"},
                 "message": "Hello!",
             },
-            headers=self._headers(),
+            headers=_auth_headers(),
         )
         assert resp.status_code == 200
         results = resp.json()["results"]
@@ -116,7 +131,7 @@ class TestNotifyEndpoint:
                 "target": {"username": "nobody"},
                 "message": "Hello!",
             },
-            headers=self._headers(),
+            headers=_auth_headers(),
         )
         assert resp.status_code == 404
         error = resp.json()["error"]
@@ -132,10 +147,10 @@ class TestNotifyEndpoint:
                 "target": {"username": "testuser"},
                 "message": "Hello!",
             },
-            headers={"Authorization": "Bearer test-secret-token"},
+            headers=_auth_headers(),
         )
         assert resp.status_code == 404
-        # Generic message — must not differentiate "not found" vs "no channels"
+        # Generic message -- must not differentiate "not found" vs "no channels"
         error = resp.json()["error"]
         assert "testuser" not in error
         assert "not found or has no linked channels" in error
@@ -144,7 +159,7 @@ class TestNotifyEndpoint:
         resp = client.post(
             "/v1/api/notify",
             json={"target": {"username": "x"}},
-            headers=self._headers(),
+            headers=_auth_headers(),
         )
         assert resp.status_code == 400
 
@@ -152,7 +167,7 @@ class TestNotifyEndpoint:
         resp = client.post(
             "/v1/api/notify",
             json={"message": "Hello!"},
-            headers=self._headers(),
+            headers=_auth_headers(),
         )
         assert resp.status_code == 400
 
@@ -163,7 +178,7 @@ class TestNotifyEndpoint:
                 "target": {"invalid": "field"},
                 "message": "Hello!",
             },
-            headers=self._headers(),
+            headers=_auth_headers(),
         )
         assert resp.status_code == 400
 
@@ -175,7 +190,7 @@ class TestNotifyEndpoint:
                 "target": {"channel_type": "email", "channel_id": "test@example.com"},
                 "message": "Hello!",
             },
-            headers=self._headers(),
+            headers=_auth_headers(),
         )
         assert resp.status_code == 200
         results = resp.json()["results"]
@@ -189,7 +204,7 @@ class TestNotifyEndpoint:
                 "target": {"channel_type": "discord", "channel_id": "123456"},
                 "message": "Hello!",
             },
-            headers=self._headers(),
+            headers=_auth_headers(),
         )
         assert resp.status_code == 200
         results = resp.json()["results"]
@@ -201,7 +216,7 @@ class TestNotifyEndpoint:
             content=b"not json",
             headers={
                 "content-type": "application/json",
-                "Authorization": "Bearer test-secret-token",
+                "Authorization": f"Bearer {_make_jwt()}",
             },
         )
         assert resp.status_code == 400
@@ -214,7 +229,7 @@ class TestNotifyEndpoint:
                 "target": {"channel_type": "discord", "channel_id": "123"},
                 "message": "   ",
             },
-            headers=self._headers(),
+            headers=_auth_headers(),
         )
         assert resp.status_code == 400
 
@@ -256,30 +271,9 @@ class TestNotifyAuth:
         )
         assert resp.status_code == 401
 
-    def test_accept_valid_static_token(self, authed_client, mock_adapter):
-        """Requests with correct static token are accepted."""
-        resp = authed_client.post(
-            "/v1/api/notify",
-            json={
-                "target": {"channel_type": "discord", "channel_id": "123"},
-                "message": "Hello!",
-            },
-            headers={"Authorization": "Bearer test-secret-token"},
-        )
-        assert resp.status_code == 200
-        assert resp.json()["results"][0]["status"] == "sent"
-
     def test_accept_valid_jwt(self, jwt_client, mock_adapter):
         """Requests with a valid JWT for the channel audience are accepted."""
-        from turnstone.core.auth import JWT_AUD_CHANNEL, create_jwt
-
-        token = create_jwt(
-            user_id="system",
-            scopes=frozenset({"write"}),
-            source="service",
-            secret="a" * 32,
-            audience=JWT_AUD_CHANNEL,
-        )
+        token = _make_jwt()
         resp = jwt_client.post(
             "/v1/api/notify",
             json={
@@ -292,13 +286,11 @@ class TestNotifyAuth:
 
     def test_reject_jwt_wrong_audience(self, jwt_client):
         """JWTs with wrong audience are rejected."""
-        from turnstone.core.auth import create_jwt
-
         token = create_jwt(
             user_id="system",
             scopes=frozenset({"write"}),
             source="service",
-            secret="a" * 32,
+            secret=_JWT_SECRET,
             audience="turnstone-server",  # wrong audience
         )
         resp = jwt_client.post(
@@ -313,8 +305,6 @@ class TestNotifyAuth:
 
     def test_reject_jwt_wrong_secret(self, jwt_client):
         """JWTs signed with wrong secret are rejected."""
-        from turnstone.core.auth import JWT_AUD_CHANNEL, create_jwt
-
         token = create_jwt(
             user_id="system",
             scopes=frozenset({"write"}),

tests/test_providers.py

@@ -2303,8 +2303,8 @@ class TestAnthropicToolSearch:
         # MCP tool should be deferred
         assert result[1]["defer_loading"] is True
         # Search tool should be appended
-        assert result[-1]["type"] == "tool_search_tool_bm25_20251119"
-        assert result[-1]["name"] == "tool_search"
+        assert result[-1]["type"] == "tool_search_tool_bm25"
+        assert result[-1]["name"] == "tool_search_tool_bm25"
 
     def test_inject_tool_search_no_op_without_deferred(self, provider):
         caps = provider.get_capabilities("claude-opus-4-6-20260101")

tests/test_server_live.py

@@ -580,6 +580,24 @@ class TestSessionConfig:
 # ---------------------------------------------------------------------------
 
 
+_TEST_JWT_SECRET = "test-jwt-secret-minimum-32-chars!"
+
+
+def _server_jwt() -> str:
+    from turnstone.core.auth import JWT_AUD_SERVER, create_jwt
+
+    return create_jwt(
+        user_id="test-server-live",
+        scopes=frozenset({"read", "write", "approve", "service"}),
+        source="test",
+        secret=_TEST_JWT_SECRET,
+        audience=JWT_AUD_SERVER,
+    )
+
+
+_SERVER_AUTH_HEADERS = {"Authorization": f"Bearer {_server_jwt()}"}
+
+
 class TestServerHealthMetrics:
     """Verify /health and /metrics endpoints using a Starlette TestClient.
 
@@ -596,7 +614,6 @@ class TestServerHealthMetrics:
         from starlette.testclient import TestClient
 
         import turnstone.server as srv_mod
-        from turnstone.core.auth import AuthConfig
         from turnstone.core.metrics import MetricsCollector
         from turnstone.core.workstream import WorkstreamState
 
@@ -631,7 +648,7 @@ class TestServerHealthMetrics:
             global_listeners=[],
             global_listeners_lock=threading.Lock(),
             skip_permissions=False,
-            auth_config=AuthConfig(),
+            jwt_secret=_TEST_JWT_SECRET,
         )
         cls.client = TestClient(app, raise_server_exceptions=False)
 
@@ -727,8 +744,8 @@ class TestServerHealthMetrics:
         assert 'le="+Inf"' in body
 
     def test_unknown_endpoint_returns_404(self):
-        status, _, _ = self._get("/does-not-exist")
-        assert status == 404
+        resp = self.client.get("/does-not-exist", headers=_SERVER_AUTH_HEADERS)
+        assert resp.status_code == 404
 
     def test_health_contains_backend_field(self):
         _, _, body = self._get("/health")
@@ -772,7 +789,6 @@ class TestServerRateLimiting:
         from starlette.testclient import TestClient
 
         import turnstone.server as srv_mod
-        from turnstone.core.auth import AuthConfig
         from turnstone.core.metrics import MetricsCollector
         from turnstone.core.ratelimit import RateLimiter
         from turnstone.core.workstream import WorkstreamState
@@ -808,7 +824,7 @@ class TestServerRateLimiting:
             global_listeners=[],
             global_listeners_lock=threading.Lock(),
             skip_permissions=False,
-            auth_config=AuthConfig(),
+            jwt_secret=_TEST_JWT_SECRET,
             rate_limiter=RateLimiter(enabled=True, rate=2.0, burst=3),
         )
         cls.client = TestClient(app, raise_server_exceptions=False)
@@ -830,16 +846,19 @@ class TestServerRateLimiting:
         """After exhausting burst on a non-exempt endpoint, get 429."""
         # Exhaust burst on a non-exempt endpoint
         for _ in range(5):
-            self._get("/v1/api/workstreams")
+            self.client.get("/v1/api/workstreams", headers=_SERVER_AUTH_HEADERS)
         # At least one should be 429
-        statuses = [self._get("/v1/api/workstreams").status_code for _ in range(3)]
+        statuses = [
+            self.client.get("/v1/api/workstreams", headers=_SERVER_AUTH_HEADERS).status_code
+            for _ in range(3)
+        ]
         assert 429 in statuses
 
     def test_429_includes_retry_after(self):
         """429 response includes Retry-After header."""
         # Burn through burst
         for _ in range(10):
-            resp = self._get("/v1/api/workstreams")
+            resp = self.client.get("/v1/api/workstreams", headers=_SERVER_AUTH_HEADERS)
             if resp.status_code == 429:
                 assert "retry-after" in resp.headers
                 data = resp.json()
@@ -851,7 +870,7 @@ class TestServerRateLimiting:
         """Health endpoint is always accessible regardless of rate limit."""
         # Burn through bucket on non-exempt path
         for _ in range(10):
-            self._get("/v1/api/workstreams")
+            self.client.get("/v1/api/workstreams", headers=_SERVER_AUTH_HEADERS)
         # Health should still work
         resp = self._get("/health")
         assert resp.status_code == 200
@@ -859,6 +878,6 @@ class TestServerRateLimiting:
     def test_metrics_exempt_from_ratelimit(self):
         """Metrics endpoint is always accessible regardless of rate limit."""
         for _ in range(10):
-            self._get("/v1/api/workstreams")
+            self.client.get("/v1/api/workstreams", headers=_SERVER_AUTH_HEADERS)
         resp = self._get("/metrics")
         assert resp.status_code == 200

tests/test_session.py

@@ -759,6 +759,8 @@ class TestTitleRetry:
     """_generate_title resets _title_generated on failure."""
 
     def test_title_generated_reset_on_failure(self, tmp_db):
+        from turnstone.core.providers._protocol import ModelCapabilities
+
         session = _make_session()
         session._title_generated = True
         session.messages = [
@@ -767,6 +769,7 @@ class TestTitleRetry:
         ]
         # Mock provider to raise
         session._provider = MagicMock()
+        session._provider.get_capabilities.return_value = ModelCapabilities()
         session._provider.create_completion.side_effect = RuntimeError("API error")
 
         session._generate_title()
@@ -774,6 +777,8 @@ class TestTitleRetry:
         assert session._title_generated is False
 
     def test_title_generated_stays_true_on_success(self, tmp_db):
+        from turnstone.core.providers._protocol import ModelCapabilities
+
         session = _make_session()
         session._title_generated = True
         session.messages = [
@@ -783,6 +788,7 @@ class TestTitleRetry:
         result = MagicMock()
         result.content = "Test Title"
         session._provider = MagicMock()
+        session._provider.get_capabilities.return_value = ModelCapabilities()
         session._provider.create_completion.return_value = result
 
         with patch("turnstone.core.session.update_workstream_title"):
@@ -793,6 +799,8 @@ class TestTitleRetry:
 
     def test_title_skipped_after_resume_changes_ws_id(self, tmp_db):
         """If ws_id changes (via resume) during title generation, discard the result."""
+        from turnstone.core.providers._protocol import ModelCapabilities
+
         session = _make_session()
         session._title_generated = True
         session.messages = [
@@ -803,6 +811,7 @@ class TestTitleRetry:
         result = MagicMock()
         result.content = "Test Title"
         session._provider = MagicMock()
+        session._provider.get_capabilities.return_value = ModelCapabilities()
         session._provider.create_completion.return_value = result
 
         # Simulate resume() changing ws_id while title generation is in flight

tests/test_skill_resource_materialization.py

@@ -0,0 +1,479 @@
+"""Tests for skill resource materialization to disk.
+
+Verifies that skill-bundled resources (scripts, references, assets) stored
+in the ``skill_resources`` table are written to a temp directory when a
+skill is loaded, exposed via ``SKILL_RESOURCES_DIR`` env var and ``PATH``,
+and cleaned up on skill change or session close.
+"""
+
+from __future__ import annotations
+
+import os
+import stat
+from typing import Any
+from unittest.mock import MagicMock
+
+from turnstone.core.session import ChatSession
+from turnstone.core.storage._registry import get_storage
+
+# ---------------------------------------------------------------------------
+# Helpers (mirrors test_skills.py)
+# ---------------------------------------------------------------------------
+
+
+class NullUI:
+    """UI adapter that discards all output."""
+
+    def on_thinking_start(self):
+        pass
+
+    def on_thinking_stop(self):
+        pass
+
+    def on_reasoning_token(self, text):
+        pass
+
+    def on_content_token(self, text):
+        pass
+
+    def on_stream_end(self):
+        pass
+
+    def approve_tools(self, items):
+        return True, None
+
+    def on_tool_result(self, call_id, name, output, **kwargs):
+        pass
+
+    def on_tool_output_chunk(self, call_id, chunk):
+        pass
+
+    def on_status(self, usage, context_window, effort):
+        pass
+
+    def on_plan_review(self, content):
+        return ""
+
+    def on_info(self, message):
+        pass
+
+    def on_error(self, message):
+        pass
+
+    def on_state_change(self, state):
+        pass
+
+    def on_rename(self, name):
+        pass
+
+    def on_output_warning(self, call_id, assessment):
+        pass
+
+
+def _make_session(**kwargs: Any) -> ChatSession:
+    defaults: dict[str, Any] = dict(
+        client=MagicMock(),
+        model="test-model",
+        ui=NullUI(),
+        instructions=None,
+        temperature=0.5,
+        max_tokens=4096,
+        tool_timeout=30,
+    )
+    defaults.update(kwargs)
+    return ChatSession(**defaults)
+
+
+def _create_skill(db: Any, skill_id: str, name: str, content: str, **kw: Any) -> None:
+    db.create_prompt_template(
+        template_id=skill_id,
+        name=name,
+        category=kw.get("category", "general"),
+        content=content,
+        variables=kw.get("variables", "[]"),
+        is_default=kw.get("is_default", False),
+        org_id="",
+        created_by="test",
+        origin="manual",
+        mcp_server="",
+        readonly=False,
+        description="",
+        tags="[]",
+        source_url="",
+        version="1.0.0",
+        author="",
+        activation=kw.get("activation", "named"),
+        token_estimate=0,
+        model="",
+        auto_approve=False,
+        temperature=None,
+        reasoning_effort="",
+        max_tokens=None,
+        token_budget=0,
+        agent_max_turns=None,
+        notify_on_complete="{}",
+        enabled=True,
+        allowed_tools="[]",
+        priority=0,
+    )
+
+
+def _sys_content(session: ChatSession) -> str:
+    msgs = [m for m in session.system_messages if m["role"] == "system"]
+    assert msgs
+    return msgs[0]["content"]
+
+
+# ---------------------------------------------------------------------------
+# Tests
+# ---------------------------------------------------------------------------
+
+
+class TestMaterializeResources:
+    def test_materialize_creates_files(self, tmp_db):
+        db = get_storage()
+        _create_skill(db, "s1", "test-skill", "Use the scripts.")
+        db.create_skill_resource("r1", "s1", "scripts/helper.py", "print('hello')")
+        db.create_skill_resource("r2", "s1", "references/api.md", "# API")
+
+        session = _make_session(skill="test-skill")
+        assert session._skill_resources_dir is not None
+        base = session._skill_resources_dir
+        assert os.path.isdir(base)
+
+        helper = os.path.join(base, "scripts", "helper.py")
+        assert os.path.isfile(helper)
+        with open(helper) as f:
+            assert f.read() == "print('hello')"
+
+        api_md = os.path.join(base, "references", "api.md")
+        assert os.path.isfile(api_md)
+        with open(api_md) as f:
+            assert f.read() == "# API"
+
+        session.close()
+
+    def test_scripts_executable(self, tmp_db):
+        db = get_storage()
+        _create_skill(db, "s1", "exec-skill", "Run scripts/run.sh")
+        db.create_skill_resource("r1", "s1", "scripts/run.sh", "#!/bin/bash\necho hi")
+
+        session = _make_session(skill="exec-skill")
+        base = session._skill_resources_dir
+        run_sh = os.path.join(base, "scripts", "run.sh")
+        mode = os.stat(run_sh).st_mode
+        assert mode & stat.S_IXUSR  # owner execute
+        session.close()
+
+    def test_non_scripts_not_executable(self, tmp_db):
+        db = get_storage()
+        _create_skill(db, "s1", "ref-skill", "Read references/guide.md")
+        db.create_skill_resource("r1", "s1", "references/guide.md", "# Guide")
+
+        session = _make_session(skill="ref-skill")
+        base = session._skill_resources_dir
+        guide = os.path.join(base, "references", "guide.md")
+        mode = os.stat(guide).st_mode
+        assert not (mode & stat.S_IXUSR)  # not executable
+        session.close()
+
+    def test_cleanup_on_close(self, tmp_db):
+        db = get_storage()
+        _create_skill(db, "s1", "cleanup-skill", "content")
+        db.create_skill_resource("r1", "s1", "scripts/a.py", "code")
+
+        session = _make_session(skill="cleanup-skill")
+        base = session._skill_resources_dir
+        assert os.path.isdir(base)
+
+        session.close()
+        assert not os.path.exists(base)
+        assert session._skill_resources_dir is None
+
+    def test_cleanup_on_skill_switch(self, tmp_db):
+        db = get_storage()
+        _create_skill(db, "s1", "skill-a", "Skill A")
+        db.create_skill_resource("r1", "s1", "scripts/a.py", "code_a")
+        _create_skill(db, "s2", "skill-b", "Skill B")
+        db.create_skill_resource("r2", "s2", "scripts/b.py", "code_b")
+
+        session = _make_session(skill="skill-a")
+        dir_a = session._skill_resources_dir
+        assert os.path.isfile(os.path.join(dir_a, "scripts", "a.py"))
+
+        session.set_skill("skill-b")
+        dir_b = session._skill_resources_dir
+        assert dir_b != dir_a
+        assert not os.path.exists(dir_a)
+        assert os.path.isfile(os.path.join(dir_b, "scripts", "b.py"))
+
+        session.close()
+
+    def test_cleanup_on_skill_clear(self, tmp_db):
+        db = get_storage()
+        _create_skill(db, "s1", "clear-skill", "content")
+        db.create_skill_resource("r1", "s1", "scripts/x.py", "code")
+
+        session = _make_session(skill="clear-skill")
+        base = session._skill_resources_dir
+        assert os.path.isdir(base)
+
+        session.set_skill(None)
+        assert not os.path.exists(base)
+        assert session._skill_resources_dir is None
+
+        session.close()
+
+    def test_empty_resources_no_dir(self, tmp_db):
+        db = get_storage()
+        _create_skill(db, "s1", "no-res-skill", "content")
+        # No resources added
+
+        session = _make_session(skill="no-res-skill")
+        assert session._skill_resources_dir is None
+        session.close()
+
+    def test_no_skill_no_dir(self, tmp_db):
+        session = _make_session()
+        assert session._skill_resources_dir is None
+        session.close()
+
+    def test_path_traversal_rejected(self, tmp_db):
+        db = get_storage()
+        _create_skill(db, "s1", "traversal-skill", "content")
+        # Inject a malicious path directly into storage
+        db.create_skill_resource("r1", "s1", "../etc/passwd", "bad content")
+        db.create_skill_resource("r2", "s1", "scripts/good.py", "good content")
+
+        session = _make_session(skill="traversal-skill")
+        base = session._skill_resources_dir
+        # The traversal path must not be written inside the resources dir
+        assert not os.path.exists(os.path.join(base, "etc"))
+        # The good resource should still be materialized
+        assert os.path.isfile(os.path.join(base, "scripts", "good.py"))
+        session.close()
+
+
+class TestSkillResourceEnv:
+    def test_env_with_resources(self, tmp_db):
+        db = get_storage()
+        _create_skill(db, "s1", "env-skill", "content")
+        db.create_skill_resource("r1", "s1", "scripts/tool.py", "code")
+
+        session = _make_session(skill="env-skill")
+        env = session._skill_resource_env()
+        assert env["SKILL_RESOURCES_DIR"] == session._skill_resources_dir
+        assert "PATH" in env
+        scripts_dir = os.path.join(session._skill_resources_dir, "scripts")
+        assert env["PATH"].startswith(scripts_dir + ":")
+        session.close()
+
+    def test_env_without_scripts_dir(self, tmp_db):
+        db = get_storage()
+        _create_skill(db, "s1", "no-scripts-skill", "content")
+        db.create_skill_resource("r1", "s1", "references/doc.md", "# Doc")
+
+        session = _make_session(skill="no-scripts-skill")
+        env = session._skill_resource_env()
+        assert "SKILL_RESOURCES_DIR" in env
+        # No scripts/ subdir so PATH should not be overridden
+        assert "PATH" not in env
+        session.close()
+
+    def test_env_empty_when_no_resources(self, tmp_db):
+        session = _make_session()
+        assert session._skill_resource_env() == {}
+        session.close()
+
+
+class TestSystemMessageHint:
+    def test_hint_present_when_resources_exist(self, tmp_db):
+        db = get_storage()
+        _create_skill(db, "s1", "hint-skill", "Use the bundled scripts.")
+        db.create_skill_resource("r1", "s1", "scripts/run.py", "code")
+
+        session = _make_session(skill="hint-skill")
+        content = _sys_content(session)
+        assert "$SKILL_RESOURCES_DIR" in content
+        assert "scripts/ are on PATH" in content
+        session.close()
+
+    def test_no_hint_when_no_resources(self, tmp_db):
+        db = get_storage()
+        _create_skill(db, "s1", "plain-skill", "No resources here.")
+
+        session = _make_session(skill="plain-skill")
+        content = _sys_content(session)
+        assert "SKILL_RESOURCES_DIR" not in content
+        session.close()
+
+
+class TestMaterializeEdgeCases:
+    def test_all_resources_rejected_no_dir(self, tmp_db):
+        """When every resource fails path validation, no temp dir is left."""
+        db = get_storage()
+        _create_skill(db, "s1", "all-bad", "content")
+        db.create_skill_resource("r1", "s1", "../escape", "bad")
+        db.create_skill_resource("r2", "s1", "/absolute", "bad")
+
+        session = _make_session(skill="all-bad")
+        assert session._skill_resources_dir is None
+        session.close()
+
+    def test_dot_path_rejected(self, tmp_db):
+        """A bare '.' path is rejected rather than crashing."""
+        db = get_storage()
+        _create_skill(db, "s1", "dot-skill", "content")
+        db.create_skill_resource("r1", "s1", ".", "bad")
+        db.create_skill_resource("r2", "s1", "scripts/ok.py", "good")
+
+        session = _make_session(skill="dot-skill")
+        base = session._skill_resources_dir
+        assert os.path.isfile(os.path.join(base, "scripts", "ok.py"))
+        session.close()
+
+    def test_empty_path_rejected(self, tmp_db):
+        """An empty string path is rejected."""
+        db = get_storage()
+        _create_skill(db, "s1", "empty-skill", "content")
+        db.create_skill_resource("r1", "s1", "", "bad")
+        db.create_skill_resource("r2", "s1", "scripts/ok.py", "good")
+
+        session = _make_session(skill="empty-skill")
+        assert session._skill_resources_dir is not None
+        session.close()
+
+    def test_nested_traversal_rejected(self, tmp_db):
+        """Traversal hidden inside a valid prefix is still caught."""
+        db = get_storage()
+        _create_skill(db, "s1", "nested-skill", "content")
+        db.create_skill_resource("r1", "s1", "scripts/../../../etc/passwd", "bad")
+        db.create_skill_resource("r2", "s1", "scripts/ok.py", "good")
+
+        session = _make_session(skill="nested-skill")
+        base = session._skill_resources_dir
+        assert not os.path.exists(os.path.join(base, "etc"))
+        assert os.path.isfile(os.path.join(base, "scripts", "ok.py"))
+        session.close()
+
+    def test_double_close_idempotent(self, tmp_db):
+        """Calling close() twice does not raise."""
+        db = get_storage()
+        _create_skill(db, "s1", "double-skill", "content")
+        db.create_skill_resource("r1", "s1", "scripts/x.py", "code")
+
+        session = _make_session(skill="double-skill")
+        session.close()
+        session.close()  # must not raise
+
+
+class TestPreflightValidation:
+    def test_missing_resource_warns(self, tmp_db):
+        """Skill content references a script not in resources."""
+        db = get_storage()
+        _create_skill(db, "s1", "warn-skill", "Run scripts/missing.py to start.")
+
+        ui = NullUI()
+        ui.on_info = MagicMock()
+        session = _make_session(ui=ui, skill="warn-skill")
+        ui.on_info.assert_called_once()
+        msg = ui.on_info.call_args[0][0]
+        assert "scripts/missing.py" in msg
+        assert "warn-skill" in msg
+        session.close()
+
+    def test_all_resources_present_no_warn(self, tmp_db):
+        """No warning when all referenced paths are bundled."""
+        db = get_storage()
+        _create_skill(db, "s1", "ok-skill", "Run scripts/helper.py for help.")
+        db.create_skill_resource("r1", "s1", "scripts/helper.py", "print('hi')")
+
+        ui = NullUI()
+        ui.on_info = MagicMock()
+        session = _make_session(ui=ui, skill="ok-skill")
+        ui.on_info.assert_not_called()
+        session.close()
+
+    def test_no_references_no_warn(self, tmp_db):
+        """Skill content with no resource paths triggers no validation warning."""
+        db = get_storage()
+        _create_skill(db, "s1", "plain-skill", "Just a plain skill with no paths.")
+
+        ui = NullUI()
+        ui.on_info = MagicMock()
+        session = _make_session(ui=ui, skill="plain-skill")
+        ui.on_info.assert_not_called()
+        session.close()
+
+    def test_multiple_missing_warns_once(self, tmp_db):
+        """Multiple missing resources produce a single warning listing all."""
+        db = get_storage()
+        _create_skill(
+            db,
+            "s1",
+            "multi-skill",
+            "Use scripts/a.py and scripts/b.sh to process references/guide.md",
+        )
+
+        ui = NullUI()
+        ui.on_info = MagicMock()
+        session = _make_session(ui=ui, skill="multi-skill")
+        ui.on_info.assert_called_once()
+        msg = ui.on_info.call_args[0][0]
+        assert "3 resource(s)" in msg
+        assert "scripts/a.py" in msg
+        assert "scripts/b.sh" in msg
+        assert "references/guide.md" in msg
+        session.close()
+
+    def test_validation_skipped_no_skill(self, tmp_db):
+        """No crash or warning when no skill is active."""
+        ui = NullUI()
+        ui.on_info = MagicMock()
+        session = _make_session(ui=ui)
+        ui.on_info.assert_not_called()
+        session.close()
+
+    def test_json_extension_not_truncated(self, tmp_db):
+        """assets/config.json should match as .json, not .js."""
+        db = get_storage()
+        _create_skill(db, "s1", "json-skill", "Load assets/config.json for settings.")
+        db.create_skill_resource("r1", "s1", "assets/config.json", "{}")
+
+        ui = NullUI()
+        ui.on_info = MagicMock()
+        session = _make_session(ui=ui, skill="json-skill")
+        ui.on_info.assert_not_called()
+        session.close()
+
+    def test_compound_prefix_not_matched(self, tmp_db):
+        """'myscripts/tool.py' should not match as 'scripts/tool.py'."""
+        db = get_storage()
+        _create_skill(
+            db,
+            "s1",
+            "compound-skill",
+            "The myscripts/tool.py file is unrelated.",
+        )
+
+        ui = NullUI()
+        ui.on_info = MagicMock()
+        session = _make_session(ui=ui, skill="compound-skill")
+        ui.on_info.assert_not_called()
+        session.close()
+
+    def test_extension_suffix_not_matched(self, tmp_db):
+        """'scripts/tool.python' should not match as 'scripts/tool.py'."""
+        db = get_storage()
+        _create_skill(
+            db,
+            "s1",
+            "suffix-skill",
+            "Run scripts/tool.python to start.",
+        )
+
+        ui = NullUI()
+        ui.on_info = MagicMock()
+        session = _make_session(ui=ui, skill="suffix-skill")
+        ui.on_info.assert_not_called()
+        session.close()

tests/test_storage_registry.py

@@ -1,8 +1,17 @@
 """Tests for the storage backend registry."""
 
-import pytest
+from unittest.mock import patch
 
-from turnstone.core.storage import get_storage, init_storage, reset_storage
+import pytest
+import sqlalchemy as sa
+
+from turnstone.core.storage import (
+    StorageUnavailableError,
+    get_storage,
+    init_storage,
+    reset_storage,
+)
+from turnstone.core.storage._postgresql import PostgreSQLBackend
 from turnstone.core.storage._sqlite import SQLiteBackend
 
 
@@ -52,3 +61,69 @@ class TestResetStorage:
         init_storage("sqlite", path=str(tmp_path / "test2.db"), run_migrations=False)
         s2 = get_storage()
         assert s1 is not s2
+
+
+class TestConnUnavailableLogging:
+    """Test that _conn() deduplicates DB unavailable/restored logging."""
+
+    def _make_backend(self, tmp_path):
+        """Create a minimal SQLite backend for testing _conn()."""
+        from turnstone.core.storage._sqlite import SQLiteBackend
+
+        return SQLiteBackend(str(tmp_path / "test.db"), create_tables=True)
+
+    def test_logs_unavailable_once(self, tmp_path, caplog: pytest.LogCaptureFixture) -> None:
+        backend = self._make_backend(tmp_path)
+        with patch.object(backend, "_engine") as mock_engine:
+            mock_engine.connect.side_effect = sa.exc.OperationalError(
+                "conn", {}, Exception("refused")
+            )
+            for _ in range(3):
+                with pytest.raises(StorageUnavailableError), backend._conn():
+                    pass  # pragma: no cover
+        unavailable_msgs = [r for r in caplog.records if "database.unavailable" in r.message]
+        assert len(unavailable_msgs) == 1
+
+    def test_logs_restored_on_recovery(self, tmp_path, caplog: pytest.LogCaptureFixture) -> None:
+        import logging
+
+        caplog.set_level(logging.INFO)
+        backend = self._make_backend(tmp_path)
+        # Simulate outage
+        with patch.object(backend, "_engine") as mock_engine:
+            mock_engine.connect.side_effect = sa.exc.OperationalError(
+                "conn", {}, Exception("refused")
+            )
+            with pytest.raises(StorageUnavailableError), backend._conn():
+                pass  # pragma: no cover
+        assert backend._db_unavailable is True
+        # Real connection — should log restored
+        caplog.clear()
+        with backend._conn():
+            pass
+        restored_msgs = [r for r in caplog.records if "database.connection_restored" in r.message]
+        assert len(restored_msgs) == 1
+        assert backend._db_unavailable is False
+
+    def test_postgresql_conn_raises_storage_unavailable(self) -> None:
+        import threading
+
+        backend = PostgreSQLBackend.__new__(PostgreSQLBackend)
+        backend._db_unavailable = False
+        backend._db_unavailable_lock = threading.Lock()
+
+        def _raise_op_error():
+            raise sa.exc.OperationalError("conn", {}, Exception("refused"))
+
+        mock_engine = type(
+            "E",
+            (),
+            {
+                "connect": staticmethod(_raise_op_error),
+                "url": sa.engine.make_url("postgresql://user:pass@localhost/db"),
+            },
+        )()
+        backend._engine = mock_engine
+        with pytest.raises(StorageUnavailableError), backend._conn():
+            pass  # pragma: no cover
+        assert backend._db_unavailable is True

tests/test_tls_admin.py

@@ -55,8 +55,8 @@ def _make_app(tls_manager):
     async def _grant_access(request, call_next):  # type: ignore[no-untyped-def]
         request.state.auth_result = AuthResult(
             user_id="",
-            scopes=frozenset({"approve"}),
-            token_source="config",
+            scopes=frozenset({"approve", "service"}),
+            token_source="test",
         )
         return await call_next(request)
 
@@ -124,6 +124,113 @@ def test_delete_cert_not_found(tls_manager):
     assert resp.status_code == 404
 
 
+# ── Auth enforcement ──────────────────────────────────────────────────────────
+
+
+def _make_app_no_auth(tls_manager):
+    """Create app without auth middleware — simulates unauthenticated requests."""
+    from starlette.applications import Starlette
+    from starlette.routing import Route
+
+    from turnstone.console.server import (
+        tls_ca_cert,
+        tls_ca_status,
+        tls_delete_cert,
+        tls_list_certs,
+        tls_renew_cert,
+    )
+
+    app = Starlette(
+        routes=[
+            Route("/ca", tls_ca_status),
+            Route("/ca.pem", tls_ca_cert),
+            Route("/certs", tls_list_certs),
+            Route("/certs/{domain}/renew", tls_renew_cert, methods=["POST"]),
+            Route("/certs/{domain}", tls_delete_cert, methods=["DELETE"]),
+        ],
+    )
+    app.state.tls_manager = tls_manager
+    return app
+
+
+def _make_app_read_only(tls_manager):
+    """Create app with read-only auth — should be rejected by admin endpoints."""
+    from starlette.applications import Starlette
+    from starlette.middleware import Middleware
+    from starlette.middleware.base import BaseHTTPMiddleware
+    from starlette.routing import Route
+
+    from turnstone.console.server import (
+        tls_ca_cert,
+        tls_ca_status,
+        tls_delete_cert,
+        tls_list_certs,
+        tls_renew_cert,
+    )
+    from turnstone.core.auth import AuthResult
+
+    async def _grant_read(request, call_next):  # type: ignore[no-untyped-def]
+        request.state.auth_result = AuthResult(
+            user_id="viewer",
+            scopes=frozenset({"read"}),
+            token_source="jwt",
+        )
+        return await call_next(request)
+
+    app = Starlette(
+        routes=[
+            Route("/ca", tls_ca_status),
+            Route("/ca.pem", tls_ca_cert),
+            Route("/certs", tls_list_certs),
+            Route("/certs/{domain}/renew", tls_renew_cert, methods=["POST"]),
+            Route("/certs/{domain}", tls_delete_cert, methods=["DELETE"]),
+        ],
+        middleware=[Middleware(BaseHTTPMiddleware, dispatch=_grant_read)],
+    )
+    app.state.tls_manager = tls_manager
+    return app
+
+
+def test_unauthenticated_list_certs_401(tls_manager):
+    from starlette.testclient import TestClient
+
+    client = TestClient(_make_app_no_auth(tls_manager))
+    resp = client.get("/certs")
+    assert resp.status_code == 401
+
+
+def test_unauthenticated_renew_401(tls_manager):
+    from starlette.testclient import TestClient
+
+    client = TestClient(_make_app_no_auth(tls_manager))
+    resp = client.post("/certs/test.internal/renew")
+    assert resp.status_code == 401
+
+
+def test_unauthenticated_delete_401(tls_manager):
+    from starlette.testclient import TestClient
+
+    client = TestClient(_make_app_no_auth(tls_manager))
+    resp = client.delete("/certs/test.internal")
+    assert resp.status_code == 401
+
+
+def test_read_only_renew_403(tls_manager):
+    from starlette.testclient import TestClient
+
+    client = TestClient(_make_app_read_only(tls_manager))
+    resp = client.post("/certs/test.internal/renew")
+    assert resp.status_code == 403
+
+
+def test_read_only_delete_403(tls_manager):
+    from starlette.testclient import TestClient
+
+    client = TestClient(_make_app_read_only(tls_manager))
+    resp = client.delete("/certs/test.internal")
+    assert resp.status_code == 403
+
+
 # ── CLI bootstrap ─────────────────────────────────────────────────────────────
 
 

tests/test_tls_manager.py

@@ -145,7 +145,7 @@ async def test_tls_ca_cert_endpoint(tls_manager):
 
     async def _grant_access(request, call_next):  # type: ignore[no-untyped-def]
         request.state.auth_result = AuthResult(
-            user_id="", scopes=frozenset({"approve"}), token_source="config"
+            user_id="", scopes=frozenset({"approve", "service"}), token_source="test"
         )
         return await call_next(request)
 
@@ -190,7 +190,7 @@ async def test_tls_endpoints_disabled():
 
     async def _grant_access(request, call_next):  # type: ignore[no-untyped-def]
         request.state.auth_result = AuthResult(
-            user_id="", scopes=frozenset({"approve"}), token_source="config"
+            user_id="", scopes=frozenset({"approve", "service"}), token_source="test"
         )
         return await call_next(request)
 

tests/test_workstream.py

@@ -713,6 +713,41 @@ class TestWebUI:
         assert ui._plan_result == "approved"
         t.join()
 
+    def test_pending_plan_review_stored_and_replayed(self):
+        """Plan review state is stored for SSE reconnection replay."""
+        from turnstone.server import WebUI
+
+        ui = WebUI(ws_id="test")
+        assert ui._pending_plan_review is None
+
+        # Simulate on_plan_review in a background thread (it blocks)
+        def review():
+            ui.on_plan_review("Here is the plan")
+
+        t = threading.Thread(target=review)
+        t.start()
+        time.sleep(0.1)
+
+        # While blocking, pending state should be set
+        assert ui._pending_plan_review is not None
+        assert ui._pending_plan_review["type"] == "plan_review"
+        assert ui._pending_plan_review["content"] == "Here is the plan"
+
+        # Resolve — pending state should be cleared
+        ui.resolve_plan("looks good")
+        t.join(timeout=2)
+        assert ui._pending_plan_review is None
+        assert ui._plan_result == "looks good"
+
+    def test_pending_plan_review_cleared_on_resolve_before_wait_returns(self):
+        """resolve_plan clears pending state immediately, not just after wait."""
+        from turnstone.server import WebUI
+
+        ui = WebUI(ws_id="test")
+        ui._pending_plan_review = {"type": "plan_review", "content": "test"}
+        ui.resolve_plan("ok")
+        assert ui._pending_plan_review is None
+
 
 # ---------------------------------------------------------------------------
 # WebUI SSE fan-out

turnstone.example.toml

@@ -56,11 +56,9 @@
 # --- Auth (node, console) ---
 
 [auth]
-# enabled = true               # env: TURNSTONE_AUTH_ENABLED
+# Auth is always enabled. JWT secret is required.
 # jwt_secret = ""              # HS256 signing secret (min 32 bytes recommended)
                                # env: TURNSTONE_JWT_SECRET
-# token = ""                   # Static config token for full access
-                               # env: TURNSTONE_AUTH_TOKEN
 
 # --- Logging (turnstone, node, console) ---
 

turnstone/__init__.py

@@ -1,3 +1,3 @@
 """turnstone - Multi-node AI orchestration platform with tool use, agent routing, and cluster simulation."""
 
-__version__ = "0.9.9"
+__version__ = "1.0.2"

turnstone/admin.py

@@ -265,9 +265,19 @@ def _cmd_tls_list(args: argparse.Namespace) -> None:
 
     url = f"{console_url}/v1/api/admin/tls/certs"
     headers = {}
-    token = getattr(args, "auth_token", "") or _get_config_token()
-    if token:
-        headers["Authorization"] = f"Bearer {token}"
+    # Prefer JWT via ServiceTokenManager when JWT secret is available
+    jwt_secret = os.environ.get("TURNSTONE_JWT_SECRET", "").strip()
+    if jwt_secret:
+        from turnstone.core.auth import JWT_AUD_CONSOLE, ServiceTokenManager
+
+        mgr = ServiceTokenManager(
+            user_id="admin-cli",
+            scopes=frozenset({"read", "write", "approve", "service"}),
+            source="cli",
+            secret=jwt_secret,
+            audience=JWT_AUD_CONSOLE,
+        )
+        headers["Authorization"] = f"Bearer {mgr.token}"
     resp = httpx.get(url, headers=headers)
     resp.raise_for_status()
     data = resp.json()
@@ -283,20 +293,6 @@ def _cmd_tls_list(args: argparse.Namespace) -> None:
         print(f"{c['domain']:<30s} {c['issued_at']:<22s} {c['expires_at']:<22s}")
 
 
-def _get_config_token() -> str:
-    """Try to load auth token from config.toml or environment."""
-    token = os.environ.get("TURNSTONE_AUTH_TOKEN", "")
-    if token:
-        return token
-    try:
-        from turnstone.core.config import load_config
-
-        cfg = load_config("auth")
-        return str(cfg.get("token", ""))
-    except Exception:
-        return ""
-
-
 def _discover_console_url() -> str:
     """Discover console URL from the services table."""
     from turnstone.core.storage import get_storage
@@ -381,7 +377,6 @@ def main() -> None:
 
     p_tlslist = sub.add_parser("tls-list", help="List issued certificates")
     p_tlslist.add_argument("--console-url", default="", help="Console URL")
-    p_tlslist.add_argument("--auth-token", default="", help="Auth token for admin API")
 
     args = parser.parse_args()
     if not args.command:

turnstone/bootstrap.py

@@ -82,10 +82,9 @@ For commercial providers (OpenAI, Anthropic-via-proxy), use the real key.
 - `POSTGRES_USER` — PostgreSQL username (default: turnstone)
 - `POSTGRES_PASSWORD` — PostgreSQL password (required for production/cluster)
 
-### Authentication
-- `TURNSTONE_AUTH_ENABLED` — Enable auth (`true`/empty)
-- `TURNSTONE_JWT_SECRET` — JWT signing secret (required if auth enabled)
-- `TURNSTONE_AUTH_TOKEN` — Static bearer token for inter-service auth
+### Authentication (always enabled)
+- `TURNSTONE_JWT_SECRET` — JWT signing secret (required). All services must share the same secret. \
+Generate with: `python -c "import secrets; print(secrets.token_hex(32))"`
 
 ### OIDC SSO (optional)
 - `TURNSTONE_OIDC_ISSUER` — OIDC issuer URL (e.g., https://accounts.google.com). Setting this + CLIENT_ID + CLIENT_SECRET enables SSO.
@@ -162,8 +161,9 @@ Walk the user through setting up their deployment step by step:
 (may differ from this wizard's model). Ask for base URL, API key, model name.
 4. **Database**: SQLite (dev/simple) vs PostgreSQL (production/cluster). \
 PostgreSQL is required for cluster mode.
-5. **Security**: Recommend enabling auth for any non-local deployment. \
-Use `generate_secret` for JWT secret, auth token, and Postgres password. \
+5. **Security**: Auth is always enabled and requires `TURNSTONE_JWT_SECRET`. \
+Use `generate_secret` for JWT secret and Postgres password. \
+Always set `TURNSTONE_JWT_SECRET` in the .env. \
 Ask for initial admin username and password. \
 If the user's deployment will use an external identity provider (Okta, Azure AD, Google, etc.), \
 offer to configure OIDC SSO. Ask for the issuer URL, client ID, and client secret. \

turnstone/channels/_http.py

@@ -37,10 +37,9 @@ async def _handle_health(request: Request) -> JSONResponse:
 
 def _check_auth(request: Request) -> JSONResponse | None:
     """Validate the request's Authorization header.  Returns an error response or None."""
-    auth_token: str = getattr(request.app.state, "auth_token", "")
     jwt_secret: str = getattr(request.app.state, "jwt_secret", "")
 
-    if not auth_token and not jwt_secret:
+    if not jwt_secret:
         log.warning("notify.auth_not_configured")
         return JSONResponse({"error": "authentication not configured"}, status_code=401)
 
@@ -50,15 +49,8 @@ def _check_auth(request: Request) -> JSONResponse | None:
 
     token = header[7:]
 
-    # Static token check
-    if auth_token:
-        import hmac
-
-        if hmac.compare_digest(token, auth_token):
-            return None
-
-    # JWT check
-    if jwt_secret and "." in token:
+    # JWT validation
+    if "." in token:
         from turnstone.core.auth import JWT_AUD_CHANNEL, validate_jwt
 
         result = validate_jwt(token, jwt_secret, audience=JWT_AUD_CHANNEL)
@@ -178,7 +170,6 @@ def create_channel_app(
     adapters: dict[str, ChannelAdapter],
     storage: StorageBackend,
     *,
-    auth_token: str = "",
     jwt_secret: str = "",
 ) -> Starlette:
     """Create the channel gateway HTTP application."""
@@ -195,7 +186,6 @@ def create_channel_app(
     )
     app.state.adapters = adapters
     app.state.storage = storage
-    app.state.auth_token = auth_token
     app.state.jwt_secret = jwt_secret
     return app
 

turnstone/channels/cli.py

@@ -72,13 +72,6 @@ def main() -> None:
     parser.add_argument("--ssl-keyfile", default=None, help="SSL private key file")
     parser.add_argument("--ssl-ca-certs", default=None, help="SSL CA certs for client verification")
 
-    # -- Auth ----------------------------------------------------------------
-    parser.add_argument(
-        "--auth-token",
-        default=os.environ.get("TURNSTONE_CHANNEL_AUTH_TOKEN", ""),
-        help="Static auth token for /v1/api/notify (default: $TURNSTONE_CHANNEL_AUTH_TOKEN)",
-    )
-
     # -- Workstream defaults -------------------------------------------------
     parser.add_argument(
         "--model",
@@ -121,7 +114,6 @@ def main() -> None:
     )
 
     # -- Auth config ---------------------------------------------------------
-    auth_token = os.environ.get("TURNSTONE_AUTH_TOKEN", "") or args.auth_token
     jwt_secret = os.environ.get("TURNSTONE_JWT_SECRET", "").strip()
 
     # Prefer auto-rotating service JWTs when jwt_secret is available.
@@ -132,7 +124,7 @@ def main() -> None:
     if jwt_secret:
         from turnstone.core.auth import JWT_AUD_CONSOLE, JWT_AUD_SERVER, ServiceTokenManager
 
-        _scopes = frozenset({"read", "write", "approve"})
+        _scopes = frozenset({"read", "write", "approve", "service"})
         _console_mgr = ServiceTokenManager(
             user_id="channel-gateway",
             scopes=_scopes,
@@ -151,7 +143,6 @@ def main() -> None:
         )
         _console_token_factory = lambda: _console_mgr.token  # noqa: E731
         _server_token_factory = lambda: _server_mgr.token  # noqa: E731
-        auth_token = ""  # don't also pass static token
 
     server_url: str = args.server_url
     console_url: str = args.console_url
@@ -242,7 +233,6 @@ def main() -> None:
             config,
             server_url,
             storage,
-            api_token=auth_token,
             console_url=console_url,
             console_token_factory=_console_token_factory,
             server_token_factory=_server_token_factory,
@@ -253,7 +243,6 @@ def main() -> None:
         channel_app = create_channel_app(
             adapters,  # type: ignore[arg-type]
             storage,
-            auth_token=auth_token,
             jwt_secret=jwt_secret,
         )
 
@@ -293,10 +282,14 @@ def main() -> None:
 
             async def _heartbeat_loop() -> None:
                 """Periodically update service heartbeat."""
+                from turnstone.core.storage._registry import StorageUnavailableError
+
                 while True:
                     await asyncio.sleep(30)
                     try:
                         await asyncio.to_thread(storage.heartbeat_service, "channel", service_id)
+                    except StorageUnavailableError:
+                        pass  # already logged by storage layer
                     except Exception:
                         log.exception("channel.heartbeat_failed")
 

turnstone/cli.py

@@ -633,7 +633,7 @@ def _handle_ws_command(
 # ─── Cluster commands ─────────────────────────────────────────────────────
 
 
-def _handle_cluster_command(cmd_line: str, console_url: str | None, auth_token: str = "") -> None:
+def _handle_cluster_command(cmd_line: str, console_url: str | None) -> None:
     """Handle /cluster subcommands querying the turnstone-console API."""
     import httpx
 
@@ -642,8 +642,18 @@ def _handle_cluster_command(cmd_line: str, console_url: str | None, auth_token:
         return
 
     headers: dict[str, str] = {}
-    if auth_token:
-        headers["Authorization"] = f"Bearer {auth_token}"
+    jwt_secret = os.environ.get("TURNSTONE_JWT_SECRET", "").strip()
+    if jwt_secret:
+        from turnstone.core.auth import JWT_AUD_CONSOLE, ServiceTokenManager
+
+        _cluster_token_mgr = ServiceTokenManager(
+            user_id="cli",
+            scopes=frozenset({"read", "write", "approve", "service"}),
+            source="cli",
+            secret=jwt_secret,
+            audience=JWT_AUD_CONSOLE,
+        )
+        headers["Authorization"] = f"Bearer {_cluster_token_mgr.token}"
 
     parts = cmd_line.strip().split()
     sub = parts[1] if len(parts) > 1 else "status"
@@ -968,11 +978,6 @@ def main() -> None:
         default=None,
         help="Turnstone console URL for /cluster commands (e.g., http://localhost:8090)",
     )
-    parser.add_argument(
-        "--auth-token",
-        default=os.environ.get("TURNSTONE_AUTH_TOKEN", ""),
-        help="Bearer token for authenticating to turnstone services (default: $TURNSTONE_AUTH_TOKEN)",
-    )
     parser.add_argument(
         "--mcp-config",
         default=None,
@@ -1247,7 +1252,7 @@ def main() -> None:
             continue
 
         if user_input.startswith("/cluster"):
-            _handle_cluster_command(user_input, args.console_url, args.auth_token)
+            _handle_cluster_command(user_input, args.console_url)
             continue
 
         active = manager.get_active()

turnstone/console/collector.py

@@ -59,7 +59,6 @@ class ClusterCollector:
         storage: StorageBackend,
         discovery_interval: float = 60.0,
         http_timeout: float = 30.0,
-        auth_token: str = "",
         token_manager: ServiceTokenManager | None = None,
         tls_verify: Any = True,
         tls_cert: tuple[str, str] | None = None,
@@ -74,10 +73,6 @@ class ClusterCollector:
         self._console_metrics = console_metrics
         self._tls_verify = tls_verify
         self._tls_cert = tls_cert
-        # Static auth header — only used when no token_manager is present.
-        self._static_auth: dict[str, str] | None = None
-        if auth_token and token_manager is None:
-            self._static_auth = {"Authorization": f"Bearer {auth_token}"}
 
         self._lock = threading.Lock()
         self._nodes: dict[str, NodeSnapshot] = {}
@@ -165,7 +160,7 @@ class ClusterCollector:
         """Build auth headers for the current SSE connection."""
         if self._token_manager is not None:
             return {"Authorization": f"Bearer {self._token_manager.token}"}
-        return dict(self._static_auth) if self._static_auth else {}
+        return {}
 
     # -- SSE manager ---------------------------------------------------------
 
@@ -294,9 +289,13 @@ class ClusterCollector:
 
     def _discovery_loop(self) -> None:
         """Periodically scan the service registry for active nodes."""
+        from turnstone.core.storage._registry import StorageUnavailableError
+
         while self._running:
             try:
                 self._discover_nodes()
+            except StorageUnavailableError:
+                pass  # already logged by storage layer
             except Exception:
                 log.exception("Node discovery error")
             time.sleep(self._discovery_interval)

turnstone/console/rebalancer.py

@@ -19,6 +19,7 @@ from typing import TYPE_CHECKING, Any
 import structlog
 
 from turnstone.core.hash_ring import RING_SIZE, RingNode, bucket_of
+from turnstone.core.storage._registry import StorageUnavailableError
 
 if TYPE_CHECKING:
     from turnstone.console.collector import ClusterCollector
@@ -64,6 +65,7 @@ class Rebalancer:
         lock_ttl: int = 120,
         eager_migrate: bool = False,
         api_token: str = "",
+        token_manager: Any = None,
     ) -> None:
         self._storage = storage
         self._router = router
@@ -75,6 +77,7 @@ class Rebalancer:
         self._lock_ttl = lock_ttl
         self._eager_migrate = eager_migrate
         self._api_token = api_token
+        self._token_manager = token_manager
         self._stop_event = threading.Event()
         self._trigger_event = threading.Event()
         self._thread: threading.Thread | None = None
@@ -147,6 +150,8 @@ class Rebalancer:
                 result = self.rebalance_once(trigger=trigger)
                 self._last_result = result
                 self._record_result_metrics(result)
+            except StorageUnavailableError:
+                pass  # already logged by storage layer
             except Exception:
                 log.exception("rebalancer.error")
             finally:
@@ -530,7 +535,9 @@ class Rebalancer:
             return 0
 
         headers: dict[str, str] = {}
-        if self._api_token:
+        if self._token_manager is not None:
+            headers["Authorization"] = f"Bearer {self._token_manager.token}"
+        elif self._api_token:
             headers["Authorization"] = f"Bearer {self._api_token}"
 
         migrated = 0

turnstone/console/scheduler.py

@@ -90,9 +90,13 @@ class TaskScheduler:
 
     def _loop(self) -> None:
         """Main scheduler loop — tick then sleep."""
+        from turnstone.core.storage._registry import StorageUnavailableError
+
         while not self._stop_event.is_set():
             try:
                 self._tick()
+            except StorageUnavailableError:
+                pass  # already logged by storage layer
             except Exception:
                 log.exception("scheduler.tick_error")
             self._stop_event.wait(self._check_interval)

turnstone/console/server.py

@@ -162,19 +162,11 @@ def _proxy_auth_headers(request: Request) -> dict[str, str]:
         )
         return {"Authorization": f"Bearer {token}"}
 
-    # Fallback: service identity (no user context).
-    # When auth is disabled on the console, auth_result is None, so all proxied
-    # requests use the full-privilege service identity.  This is safe only when
-    # the upstream server also has auth disabled.
+    # Fallback: service identity via ServiceTokenManager.
     mgr = getattr(request.app.state, "proxy_token_mgr", None)
     if mgr is not None:
         return dict(mgr.bearer_header)
 
-    # Fall back to static proxy_auth_token (e.g. from --auth-token)
-    static_token = getattr(request.app.state, "proxy_auth_token", "")
-    if static_token:
-        return {"Authorization": f"Bearer {static_token}"}
-
     return {}
 
 
@@ -1175,10 +1167,14 @@ async def _lifespan(app: Starlette) -> AsyncGenerator[None, None]:
             import asyncio
 
             async def _console_heartbeat() -> None:
+                from turnstone.core.storage._registry import StorageUnavailableError
+
                 while True:
                     await asyncio.sleep(30)
                     try:
                         storage.heartbeat_service("console", "console")
+                    except StorageUnavailableError:
+                        pass  # already logged by storage layer
                     except Exception:
                         log.warning("console.heartbeat_failed", exc_info=True)
 
@@ -5924,10 +5920,8 @@ def _seed_config_from_env(config_store: Any, storage: Any) -> None:
 def create_app(
     *,
     collector: ClusterCollector,
-    auth_config: Any,
     jwt_secret: str = "",
     auth_storage: Any = None,
-    proxy_auth_token: str = "",
     proxy_token_mgr: Any = None,
     cors_origins: list[str] | None = None,
     tls_manager: Any = None,
@@ -6265,10 +6259,8 @@ def create_app(
         lifespan=_lifespan,
     )
     app.state.collector = collector
-    app.state.auth_config = auth_config
     app.state.jwt_secret = jwt_secret
     app.state.auth_storage = auth_storage
-    app.state.proxy_auth_token = proxy_auth_token
     app.state.proxy_token_mgr = proxy_token_mgr
     app.state.console_url = console_url
     app.state.tls_manager = tls_manager
@@ -6301,7 +6293,7 @@ def create_app(
         scheduler = TaskScheduler(
             collector=collector,
             storage=auth_storage,
-            api_token=proxy_auth_token,
+            api_token="",
             token_manager=proxy_token_mgr,
         )
         app.state.scheduler = scheduler
@@ -6351,12 +6343,6 @@ def main() -> None:
     from turnstone.core.log import add_log_args
 
     add_log_args(parser)
-    parser.add_argument(
-        "--auth-token",
-        default=os.environ.get("TURNSTONE_AUTH_TOKEN", ""),
-        help="Bearer token for polling turnstone-server nodes (default: $TURNSTONE_AUTH_TOKEN)",
-    )
-
     from turnstone.core.config import add_config_arg, apply_config
 
     add_config_arg(parser)
@@ -6367,10 +6353,9 @@ def main() -> None:
 
     configure_logging_from_args(args, "console")
 
-    from turnstone.core.auth import load_auth_config, load_jwt_secret
+    from turnstone.core.auth import load_jwt_secret
 
-    auth_config = load_auth_config()
-    jwt_secret = load_jwt_secret() if auth_config.enabled else ""
+    jwt_secret = load_jwt_secret()
 
     # Initialize storage early — the collector needs it for service discovery.
     auth_storage = None
@@ -6399,38 +6384,23 @@ def main() -> None:
         )
         raise SystemExit(1)
 
-    # If no explicit auth token is provided, use a ServiceTokenManager
-    # so collector JWTs auto-rotate.  A shared JWT secret is required for
-    # multi-service deployments — ephemeral secrets differ per process.
-    collector_token = args.auth_token
-    collector_token_mgr = None
-    if not collector_token:
-        _jwt_secret = os.environ.get("TURNSTONE_JWT_SECRET", "")
-        if not _jwt_secret:
-            log.error(
-                "TURNSTONE_JWT_SECRET is not set and no --auth-token provided. "
-                "The console cannot authenticate to server nodes. Set TURNSTONE_JWT_SECRET "
-                "to a shared secret (at least 32 characters) or pass --auth-token."
-            )
-            raise SystemExit(1)
-        from turnstone.core.auth import JWT_AUD_SERVER, ServiceTokenManager
+    from turnstone.core.auth import JWT_AUD_SERVER, ServiceTokenManager
 
-        collector_token_mgr = ServiceTokenManager(
-            user_id="console-collector",
-            scopes=frozenset({"read"}),
-            source="console",
-            secret=_jwt_secret,
-            audience=JWT_AUD_SERVER,
-            expiry_hours=1,
-        )
-        log.info("console.collector_token_manager_created")
+    collector_token_mgr = ServiceTokenManager(
+        user_id="console-collector",
+        scopes=frozenset({"read"}),
+        source="console",
+        secret=jwt_secret,
+        audience=JWT_AUD_SERVER,
+        expiry_hours=1,
+    )
+    log.info("console.collector_token_manager_created")
 
     router = ConsoleRouter(storage=auth_storage)
     console_metrics = ConsoleMetrics()
 
     collector = ClusterCollector(
         storage=auth_storage,
-        auth_token=collector_token if collector_token_mgr is None else "",
         token_manager=collector_token_mgr,
         router=router,
         console_metrics=console_metrics,
@@ -6439,22 +6409,15 @@ def main() -> None:
 
     _load_static()
 
-    # If no explicit auth token is provided, use a ServiceTokenManager
-    # so proxy JWTs auto-rotate.
-    proxy_token = args.auth_token
-    proxy_token_mgr = None
-    if not proxy_token and jwt_secret:
-        from turnstone.core.auth import JWT_AUD_SERVER, ServiceTokenManager
-
-        proxy_token_mgr = ServiceTokenManager(
-            user_id="console-proxy",
-            scopes=frozenset({"read", "write", "approve"}),
-            source="console",
-            secret=jwt_secret,
-            audience=JWT_AUD_SERVER,
-            expiry_hours=1,
-        )
-        log.info("console.proxy_token_manager_created")
+    proxy_token_mgr = ServiceTokenManager(
+        user_id="console-proxy",
+        scopes=frozenset({"read", "write", "approve", "service"}),
+        source="console",
+        secret=jwt_secret,
+        audience=JWT_AUD_SERVER,
+        expiry_hours=1,
+    )
+    log.info("console.proxy_token_manager_created")
 
     from turnstone.core.web_helpers import parse_cors_origins
 
@@ -6541,7 +6504,8 @@ def main() -> None:
                     threshold=_rcs.get("rebalancer.threshold", 0.10),
                     vnodes_per_unit=_rcs.get("ring.vnodes_per_unit", 150),
                     eager_migrate=_rcs.get("rebalancer.eager_migrate", False),
-                    api_token=proxy_token if proxy_token_mgr is None else "",
+                    api_token="",
+                    token_manager=proxy_token_mgr,
                 )
                 log.info("rebalancer.configured")
         except Exception:
@@ -6549,10 +6513,8 @@ def main() -> None:
 
     app = create_app(
         collector=collector,
-        auth_config=auth_config,
         jwt_secret=jwt_secret,
         auth_storage=auth_storage,
-        proxy_auth_token=proxy_token if proxy_token_mgr is None else "",
         proxy_token_mgr=proxy_token_mgr,
         cors_origins=cors_origins,
         tls_manager=tls_mgr,
@@ -6563,8 +6525,7 @@ def main() -> None:
     )
 
     log.info("Console starting on %s", console_url)
-    if auth_config.enabled:
-        log.info("Auth: enabled (%d config token(s))", len(auth_config.tokens))
+    log.info("Auth: enabled (JWT)")
     print("Press Ctrl+C to stop.")
 
     import uvicorn

turnstone/console/static/style.css

@@ -912,7 +912,7 @@
 .admin-row {
   display: grid;
   padding: 8px 12px;
-  align-items: center;
+  align-items: start;
   border-radius: var(--radius-sm);
   transition: background 0.1s;
 }
@@ -1868,7 +1868,7 @@ h3.skill-spec-heading { font-size: inherit; margin-block: 0; }
   grid-template-columns: 200px 1fr auto;
   gap: 8px 16px;
   padding: 8px 12px;
-  align-items: center;
+  align-items: start;
   border-bottom: 1px solid var(--border);
 }
 .settings-row:hover { background: var(--row-alt, rgba(255,255,255,0.015)); }
@@ -1913,6 +1913,7 @@ h3.skill-spec-heading { font-size: inherit; margin-block: 0; }
 }
 
 /* Bool toggle */
+.settings-input .settings-toggle { margin-top: 2px; }
 .settings-toggle {
   position: relative;
   display: inline-block;

turnstone/core/auth.py

@@ -1,15 +1,12 @@
 """Bearer token authentication and authorization for turnstone HTTP servers.
 
-Supports three token types:
+Supports two token types:
 
-1. **Config-file tokens** — static tokens in ``config.toml`` or the
-   ``TURNSTONE_AUTH_TOKEN`` env var.  Validated in-memory via
-   ``hmac.compare_digest``.  Map to scopes via their role.
-2. **API tokens** — database-backed, prefixed ``ts_``, stored as SHA-256
+1. **API tokens** — database-backed, prefixed ``ts_``, stored as SHA-256
    hashes.  Exchanged for JWTs via ``/api/auth/login``.
-3. **JWTs** — short-lived session tokens issued after API token validation.
-   Validated locally via shared HMAC-SHA256 secret.  Contain user_id and
-   scopes in claims.
+2. **JWTs** — short-lived session tokens issued after login or by
+   :class:`ServiceTokenManager`.  Validated locally via shared HMAC-SHA256
+   secret.  Contain user_id and scopes in claims.
 
 Public paths (``/``, ``/static/*``, ``/shared/*``, ``/health``, ``/metrics``,
 ``/openapi.json``, ``/docs``, ``/api/auth/login``, ``/api/auth/logout``) are
@@ -19,7 +16,6 @@ always accessible without authentication.
 from __future__ import annotations
 
 import hashlib
-import hmac
 import json
 import os
 import re
@@ -28,7 +24,7 @@ import threading
 import time
 import urllib.parse
 import uuid
-from dataclasses import dataclass, field
+from dataclasses import dataclass
 from typing import TYPE_CHECKING, Any
 
 if TYPE_CHECKING:
@@ -56,7 +52,7 @@ JWT_AUD_CONSOLE = "turnstone-console"
 JWT_AUD_CHANNEL = "turnstone-channel"
 _MIN_SECRET_LENGTH = 32  # 256 bits minimum for HMAC-SHA256
 
-VALID_SCOPES: frozenset[str] = frozenset({"read", "write", "approve"})
+VALID_SCOPES: frozenset[str] = frozenset({"read", "write", "approve", "service"})
 
 _USERNAME_RE = re.compile(r"^[a-zA-Z0-9._-]+$")
 USERNAME_MAX_LEN = 64
@@ -72,16 +68,12 @@ def is_valid_username(username: str) -> bool:
 
 
 # Hierarchical: each scope implies all lower scopes.
+# "service" is a superset that grants full access + bypasses RBAC permission checks.
 SCOPE_HIERARCHY: dict[str, frozenset[str]] = {
     "read": frozenset({"read"}),
     "write": frozenset({"read", "write"}),
     "approve": frozenset({"read", "write", "approve"}),
-}
-
-# Map old role names to scope sets.
-_ROLE_TO_SCOPES: dict[str, frozenset[str]] = {
-    "read": frozenset({"read"}),
-    "full": frozenset({"read", "write", "approve"}),
+    "service": frozenset({"read", "write", "approve", "service"}),
 }
 
 # ---------------------------------------------------------------------------
@@ -106,7 +98,7 @@ def _permissions_to_scopes(permissions: set[str]) -> frozenset[str]:
         scopes.add("read")
         return frozenset(scopes)
     for perm in permissions:
-        if perm in VALID_SCOPES:
+        if perm in VALID_SCOPES and perm != "service":
             scopes.update(SCOPE_HIERARCHY.get(perm, {perm}))
     # Any admin.* permission requires access to admin endpoints → approve scope
     if any(p.startswith("admin.") for p in permissions):
@@ -120,15 +112,14 @@ def require_permission(request: Request, permission: str) -> JSONResponse | None
     """Return a 403 JSONResponse if the user lacks *permission*, else None.
 
     Call from admin handlers after the middleware scope check passes.
-    Config-file tokens (no user_id) are treated as full-access.
+    Service tokens (scope ``service``) bypass permission checks.
     """
     from starlette.responses import JSONResponse
 
     auth_result: AuthResult | None = getattr(getattr(request, "state", None), "auth_result", None)
     if auth_result is None:
         return JSONResponse({"error": "Unauthorized"}, status_code=401)
-    # Config-file tokens (no user_id) are treated as full-access
-    if not auth_result.user_id:
+    if auth_result.has_scope("service"):
         return None
     if auth_result.has_permission(permission):
         return None
@@ -200,9 +191,9 @@ def _strip_version_prefix(path: str) -> str:
 class AuthResult:
     """Result of successful authentication."""
 
-    user_id: str  # empty string for config-file tokens
+    user_id: str
     scopes: frozenset[str]
-    token_source: str  # "config", "jwt", "database"
+    token_source: str  # "jwt", "database", "password", or service origin (e.g. "console", "cli")
     permissions: frozenset[str] = frozenset()
 
     def has_scope(self, scope: str) -> bool:
@@ -214,28 +205,6 @@ class AuthResult:
         return permission in self.permissions
 
 
-# ---------------------------------------------------------------------------
-# AuthConfig (unchanged from before — static config-file tokens)
-# ---------------------------------------------------------------------------
-
-
-@dataclass
-class AuthConfig:
-    """Auth configuration loaded once at startup (not modified after creation)."""
-
-    enabled: bool = False
-    tokens: dict[str, str] = field(default_factory=dict)  # token_value → role
-
-    def check(self, token: str | None) -> str | None:
-        """Return the role for a valid config token, or *None*."""
-        if not token:
-            return None
-        for known_token, role in self.tokens.items():
-            if hmac.compare_digest(token, known_token):
-                return role
-        return None
-
-
 # ---------------------------------------------------------------------------
 # Token generation and hashing
 # ---------------------------------------------------------------------------
@@ -303,7 +272,11 @@ def parse_scopes(scopes_str: str) -> frozenset[str]:
 
 
 def load_jwt_secret() -> str:
-    """Load JWT signing secret from env or config, or auto-generate."""
+    """Load JWT signing secret from env or config.
+
+    Raises :class:`SystemExit` if no secret is configured.  A JWT secret
+    is required for auth, inter-service communication, and session tokens.
+    """
     secret = os.environ.get("TURNSTONE_JWT_SECRET", "").strip()
     if not secret:
         from turnstone.core.config import load_config
@@ -312,18 +285,19 @@ def load_jwt_secret() -> str:
         secret = str(auth_cfg.get("jwt_secret", "")).strip()
 
     if not secret:
-        # Auto-generate an ephemeral secret
-        secret = secrets.token_hex(32)
-        log.warning(
-            "No JWT secret configured — using ephemeral secret (tokens will not survive restart)"
+        log.error(
+            "TURNSTONE_JWT_SECRET is required but not set. "
+            'Generate one with: python -c "import secrets; print(secrets.token_hex(32))"'
         )
-        return secret
+        raise SystemExit(1)
 
     if len(secret) < _MIN_SECRET_LENGTH:
-        log.warning(
-            "JWT secret is shorter than %d characters — consider using a stronger secret",
+        log.error(
+            "JWT secret must be at least %d characters. "
+            'Generate one with: python -c "import secrets; print(secrets.token_hex(32))"',
             _MIN_SECRET_LENGTH,
         )
+        raise SystemExit(1)
     return secret
 
 
@@ -397,62 +371,6 @@ def validate_jwt(token: str, secret: str, audience: str = "") -> AuthResult | No
     )
 
 
-# ---------------------------------------------------------------------------
-# Loading
-# ---------------------------------------------------------------------------
-
-
-def load_auth_config() -> AuthConfig:
-    """Build :class:`AuthConfig` from ``config.toml`` ``[auth]`` + env vars.
-
-    Auth is **enabled by default**.  Set ``[auth] enabled = false`` or
-    ``TURNSTONE_AUTH_ENABLED=0`` to disable.
-
-    Config format::
-
-        [auth]
-        enabled = false   # opt out
-
-        [[auth.tokens]]
-        value = "tok_abc123"
-        role = "full"
-
-    Environment variables:
-
-    - ``TURNSTONE_AUTH_ENABLED=0`` — disables auth
-    - ``TURNSTONE_AUTH_ENABLED=1`` — enables auth (default)
-    - ``TURNSTONE_AUTH_TOKEN=<token>`` — registers a single full-access token
-    """
-    from turnstone.core.config import load_config
-
-    auth_cfg = load_config("auth")
-    enabled = bool(auth_cfg.get("enabled", True))
-    tokens: dict[str, str] = {}
-
-    # Tokens from config file (TOML array-of-tables)
-    for entry in auth_cfg.get("tokens", []):
-        value = entry.get("value", "") if isinstance(entry, dict) else ""
-        role = entry.get("role", "read") if isinstance(entry, dict) else ""
-        if value and role in ("read", "full"):
-            tokens[value] = role
-
-    # Environment variable overrides
-    env_enabled = os.environ.get("TURNSTONE_AUTH_ENABLED", "").strip().lower()
-    if env_enabled in ("1", "true", "yes"):
-        enabled = True
-    elif env_enabled in ("0", "false", "no"):
-        enabled = False
-
-    env_token = os.environ.get("TURNSTONE_AUTH_TOKEN", "").strip()
-    if env_token:
-        tokens[env_token] = "full"
-
-    if enabled and not tokens:
-        log.info("Auth enabled (no config tokens — use /api/auth/setup or turnstone-admin)")
-
-    return AuthConfig(enabled=enabled, tokens=tokens)
-
-
 # ---------------------------------------------------------------------------
 # Path helpers
 # ---------------------------------------------------------------------------
@@ -529,7 +447,6 @@ def _extract_proxied_path(normalized: str) -> str | None:
 
 
 def check_request(
-    auth_config: AuthConfig,
     method: str,
     path: str,
     auth_header: str | None,
@@ -539,20 +456,16 @@ def check_request(
     jwt_audience: str = "",
     storage: Any = None,
 ) -> tuple[bool, int, str, AuthResult | None]:
-    """Validate a request against the auth config.
+    """Validate a request.
 
     Checks ``Authorization: Bearer <token>`` first, then falls back to the
     ``turnstone_auth`` cookie.  Token types are auto-detected:
 
     - Contains ``.`` → JWT (validated with *jwt_secret*)
     - Starts with ``ts_`` → API token (looked up in *storage* by hash)
-    - Otherwise → config-file token (hmac check)
 
     Returns ``(allowed, status_code, message, auth_result)``.
     """
-    if not auth_config.enabled:
-        return True, 200, "", None
-
     if is_public_path(path):
         return True, 200, "", None
 
@@ -566,7 +479,7 @@ def check_request(
 
     # Authenticate
     result = _authenticate_token(
-        raw_token, auth_config, jwt_secret=jwt_secret, jwt_audience=jwt_audience, storage=storage
+        raw_token, jwt_secret=jwt_secret, jwt_audience=jwt_audience, storage=storage
     )
     if result is None:
         return False, 401, "Unauthorized: missing or invalid token", None
@@ -581,7 +494,6 @@ def check_request(
 
 def _authenticate_token(
     token: str,
-    auth_config: AuthConfig,
     *,
     jwt_secret: str = "",
     jwt_audience: str = "",
@@ -601,12 +513,6 @@ def _authenticate_token(
     if token.startswith(TOKEN_PREFIX) and storage is not None:
         return _authenticate_api_token(token, storage)
 
-    # 3. Config-file token (hmac comparison)
-    role = auth_config.check(token)
-    if role is not None:
-        scopes = _ROLE_TO_SCOPES.get(role, frozenset({"read"}))
-        return AuthResult(user_id="", scopes=scopes, token_source="config")
-
     return None
 
 
@@ -852,7 +758,6 @@ class AuthMiddleware:
             await self.app(scope, receive, send)
             return
 
-        auth_config = request.app.state.auth_config
         jwt_secret = getattr(request.app.state, "jwt_secret", "")
         storage = getattr(request.app.state, "auth_storage", None)
         method = request.method
@@ -860,7 +765,6 @@ class AuthMiddleware:
         auth_header = request.headers.get("Authorization")
         cookie_header = request.headers.get("Cookie")
         allowed, status, msg, auth_result = check_request(
-            auth_config,
             method,
             path,
             auth_header,
@@ -904,7 +808,6 @@ async def handle_auth_login(request: Request, audience: str) -> Response:
     except (ValueError, json.JSONDecodeError):
         return JSONResponse({"error": "Invalid JSON body"}, status_code=400)
 
-    auth_config = request.app.state.auth_config
     jwt_secret = getattr(request.app.state, "jwt_secret", "")
     storage = getattr(request.app.state, "auth_storage", None)
     login_limiter: LoginRateLimiter | None = getattr(request.app.state, "login_limiter", None)
@@ -955,7 +858,6 @@ async def handle_auth_login(request: Request, audience: str) -> Response:
     elif body.get("token"):
         result = _authenticate_token(
             body["token"],
-            auth_config,
             jwt_secret=jwt_secret,
             jwt_audience=audience,
             storage=storage,
@@ -1011,7 +913,6 @@ async def handle_auth_status(request: Request) -> Response:
     """Shared ``GET /api/auth/status`` handler — login UI state detection."""
     from starlette.responses import JSONResponse
 
-    auth_config = request.app.state.auth_config
     storage = getattr(request.app.state, "auth_storage", None)
 
     has_users = False
@@ -1027,9 +928,9 @@ async def handle_auth_status(request: Request) -> Response:
     oidc_enabled = bool(oidc_config and oidc_config.enabled)
 
     resp: dict[str, Any] = {
-        "auth_enabled": auth_config.enabled,
+        "auth_enabled": True,
         "has_users": has_users,
-        "setup_required": auth_config.enabled and not has_users,
+        "setup_required": not has_users,
     }
     if oidc_enabled and oidc_config is not None:
         resp["oidc_enabled"] = True

turnstone/core/env.py

@@ -66,7 +66,6 @@ _EXPLICIT_SCRUB: frozenset[str] = frozenset(
         "ANTHROPIC_API_KEY",
         "TAVILY_API_KEY",
         "TURNSTONE_JWT_SECRET",
-        "TURNSTONE_AUTH_TOKEN",
         "TURNSTONE_DISCORD_TOKEN",
         "TURNSTONE_GITHUB_TOKEN",
         "TURNSTONE_OIDC_CLIENT_SECRET",

turnstone/core/providers/_anthropic.py

@@ -69,7 +69,7 @@ def _merge_consecutive(messages: list[dict[str, Any]]) -> list[dict[str, Any]]:
 _WEB_SEARCH_TOOL_TYPE = "web_search_20250305"
 
 # Tool search: server-side BM25 tool discovery for deferred tools
-_TOOL_SEARCH_TOOL_TYPE = "tool_search_tool_bm25_20251119"
+_TOOL_SEARCH_TOOL_TYPE = "tool_search_tool_bm25"
 
 # -- model capabilities -------------------------------------------------------
 
@@ -205,7 +205,7 @@ class AnthropicProvider:
                 result.append({**tool, "defer_loading": True})
             else:
                 result.append(tool)
-        result.append({"type": _TOOL_SEARCH_TOOL_TYPE, "name": "tool_search"})
+        result.append({"type": _TOOL_SEARCH_TOOL_TYPE, "name": _TOOL_SEARCH_TOOL_TYPE})
         return result
 
     # -- shared param logic --------------------------------------------------
@@ -543,9 +543,13 @@ class AnthropicProvider:
         if extra_params and "thinking_budget_tokens" in extra_params:
             budget = extra_params["thinking_budget_tokens"]
         if budget > 0:
-            # Budget must leave room for the response
+            # Budget must be strictly less than max_tokens (API requirement).
+            # If max_tokens is too small to fit even a minimal thinking
+            # budget alongside the response, disable thinking entirely.
             if budget >= max_tokens:
-                budget = max(1024, max_tokens - 1024)
+                budget = max_tokens - 1024
+            if budget < 1:
+                return {}
             return {"thinking": {"type": "enabled", "budget_tokens": budget}}
         return {}
 

turnstone/core/session.py

@@ -19,6 +19,7 @@ import mimetypes
 import os
 import queue
 import re
+import shutil
 import signal
 import subprocess
 import tempfile
@@ -161,6 +162,13 @@ _IMAGE_SIZE_CAP: int = 4 * 1024 * 1024
 # Upper bound on total skill content injected into system messages
 _MAX_SKILL_CONTENT: int = 32768
 
+# Matches resource paths referenced in skill content (scripts/foo.py, etc.)
+_RESOURCE_PATH_RE = re.compile(
+    r"(?<![/\w-])(?:scripts|references|assets)/[\w./-]+\."
+    r"(?:json|yaml|yml|toml|cfg|ini|py|sh|js|ts|md|txt)"
+    r"(?=[\s)\]}'\"`,;:\x60]|$)"
+)
+
 
 _TEMPLATE_VAR_RE = re.compile(r"\{\{(\w+)\}\}")
 
@@ -417,6 +425,7 @@ class ChatSession:
         self._skill_name: str | None = skill
         self._skill_content: str | None = None
         self._skill_resources: dict[str, str] = {}
+        self._skill_resources_dir: str | None = None
         self._load_skills()
         self._init_system_messages()
         self._save_config()
@@ -583,6 +592,8 @@ class ChatSession:
             else:
                 self._skill_content = None
             self._skill_resources = {}
+        self._materialize_skill_resources()
+        self._validate_skill_resources()
 
     def set_skill(self, name: str | None) -> None:
         """Set or clear the active skill."""
@@ -613,6 +624,81 @@ class ChatSession:
             log.warning("skill_resources.load_failed", skill_id=skill_id, exc_info=True)
             return {}
 
+    def _cleanup_skill_resources(self) -> None:
+        """Remove materialized skill resources from disk."""
+        d = self._skill_resources_dir
+        if d is not None:
+            shutil.rmtree(d, ignore_errors=True)
+            self._skill_resources_dir = None
+
+    def _materialize_skill_resources(self) -> None:
+        """Write skill resources to a temp directory for subprocess access."""
+        self._cleanup_skill_resources()
+        if not self._skill_resources:
+            return
+        base = tempfile.mkdtemp(prefix=f"skill-{self._ws_id[:8]}-")
+        written = 0
+        for rel_path, content in self._skill_resources.items():
+            normed = os.path.normpath(rel_path)
+            if not normed or normed == "." or normed.startswith(("..", "/")):
+                log.warning("skill_resources.bad_path", path=rel_path)
+                continue
+            if ".." in normed.split(os.sep):
+                log.warning("skill_resources.bad_path", path=rel_path)
+                continue
+            full = os.path.join(base, normed)
+            if not os.path.realpath(full).startswith(os.path.realpath(base)):
+                log.warning("skill_resources.path_escape", path=rel_path)
+                continue
+            try:
+                os.makedirs(os.path.dirname(full), exist_ok=True)
+                with open(full, "w", encoding="utf-8") as f:
+                    f.write(content)
+                if normed.startswith("scripts/"):
+                    os.chmod(full, 0o755)
+                written += 1
+            except Exception:
+                log.warning("skill_resources.write_failed", path=rel_path, exc_info=True)
+        if written == 0:
+            shutil.rmtree(base, ignore_errors=True)
+            return
+        self._skill_resources_dir = base
+        log.info(
+            "skill_resources.materialized",
+            dir=base,
+            count=written,
+        )
+
+    def _skill_resource_env(self) -> dict[str, str]:
+        """Return extra env vars for bash when skill resources are materialized."""
+        if not self._skill_resources_dir:
+            return {}
+        env: dict[str, str] = {"SKILL_RESOURCES_DIR": self._skill_resources_dir}
+        scripts_dir = os.path.join(self._skill_resources_dir, "scripts")
+        if os.path.isdir(scripts_dir):
+            current_path = os.environ.get("PATH")
+            if current_path:
+                env["PATH"] = scripts_dir + os.pathsep + current_path
+            else:
+                env["PATH"] = scripts_dir
+        return env
+
+    def _validate_skill_resources(self) -> None:
+        """Warn if skill content references resource paths not in skill_resources."""
+        if not self._skill_content or not self._skill_name:
+            return
+        referenced = {os.path.normpath(p) for p in _RESOURCE_PATH_RE.findall(self._skill_content)}
+        if not referenced:
+            return
+        available = {os.path.normpath(p) for p in self._skill_resources}
+        missing = sorted(referenced - available)
+        if missing:
+            log.warning("skill_resources.missing", skill=self._skill_name, paths=missing)
+            self.ui.on_info(
+                f"Skill '{self._skill_name}' references {len(missing)} resource(s) "
+                f"not bundled: {', '.join(missing)}"
+            )
+
     # -- MCP tool refresh ----------------------------------------------------
 
     def _on_mcp_tools_changed(self) -> None:
@@ -747,6 +833,7 @@ class ChatSession:
             self._mcp_prompt_cb = None
         if self._watch_runner:
             self._watch_runner.remove_dispatch_fn(self._ws_id)
+        self._cleanup_skill_resources()
 
     def _handle_mcp_refresh(self, arg: str) -> None:
         """Handle ``/mcp refresh [server]``."""
@@ -837,10 +924,8 @@ class ChatSession:
             if asst_msg:
                 snippet += f"\nAssistant: {asst_msg}"
             snippet += "\n\nTitle:"
-            result = self._provider.create_completion(
-                client=self.client,
-                model=self.model,
-                messages=[
+            result = self._utility_completion(
+                [
                     {
                         "role": "system",
                         "content": (
@@ -855,9 +940,6 @@ class ChatSession:
                     {"role": "user", "content": snippet},
                 ],
                 max_tokens=200,
-                temperature=0.3,
-                reasoning_effort="low",
-                extra_params=self._provider_extra_params(reasoning_effort="low"),
             )
             raw = (result.content or "").strip()
             # Take first line, strip quotes
@@ -893,6 +975,13 @@ class ChatSession:
         self._msg_tokens = [
             max(1, int(self._msg_char_count(m) / self._chars_per_token)) for m in self.messages
         ]
+        log.info(
+            "Resuming ws=%s: %d messages, provider=%s, model=%s",
+            ws_id,
+            len(messages),
+            type(self._provider).__name__,
+            self.model,
+        )
         # Restore persisted config
         config = load_workstream_config(ws_id)
         if config:
@@ -910,11 +999,24 @@ class ChatSession:
                 self.context_window = cfg.context_window
                 if not self._manual_tool_truncation:
                     self.tool_truncation = int(cfg.context_window * self._chars_per_token * 0.5)
+                log.info(
+                    "Resume: resolved alias=%s → provider=%s, model=%s, ctx=%d",
+                    saved_alias,
+                    type(self._provider).__name__,
+                    model_name,
+                    cfg.context_window,
+                )
             elif saved_model and saved_model != self.model:
                 # No alias or alias no longer in registry — at least set the model name
                 self.model = saved_model
                 self._model_alias = None
                 self._cached_capabilities = None
+                log.warning(
+                    "Resume: alias %r not in registry, keeping default provider=%s for model=%s",
+                    saved_alias,
+                    type(self._provider).__name__,
+                    saved_model,
+                )
             if "temperature" in config:
                 self.temperature = float(config["temperature"])
             if "reasoning_effort" in config:
@@ -1091,6 +1193,12 @@ class ChatSession:
                         "Resource content omitted (total exceeds 8KB). "
                         "Resource files are listed above by path and size."
                     )
+                if self._skill_resources_dir:
+                    lines.append(
+                        "\nResource files are materialized on disk. "
+                        "Scripts in scripts/ are on PATH and can be run by name. "
+                        "All files are under $SKILL_RESOURCES_DIR."
+                    )
                 lines.append("</skill-resources>")
                 dev_parts.append("\n".join(lines))
         # Skill catalog: disclose search-activated skills so the model
@@ -1168,6 +1276,33 @@ class ChatSession:
             return {"chat_template_kwargs": kwargs}
         return None
 
+    def _utility_completion(
+        self,
+        messages: list[dict[str, Any]],
+        *,
+        max_tokens: int = 4096,
+        temperature: float = 0.3,
+        reasoning_effort: str = "low",
+    ) -> CompletionResult:
+        """Run a lightweight internal completion (title gen, compaction, extraction).
+
+        Threads ``reasoning_effort`` through both the direct keyword (for
+        commercial providers) and ``extra_params`` (for local model servers)
+        so callers don't need to duplicate it.  ``max_tokens`` is clamped to
+        the model's advertised output limit so small models don't error.
+        """
+        caps = self._get_capabilities()
+        clamped = min(max_tokens, caps.max_output_tokens) if caps.max_output_tokens else max_tokens
+        return self._provider.create_completion(
+            client=self.client,
+            model=self.model,
+            messages=messages,
+            max_tokens=clamped,
+            temperature=temperature,
+            reasoning_effort=reasoning_effort,
+            extra_params=self._provider_extra_params(reasoning_effort=reasoning_effort),
+        )
+
     # -- tool search helpers --------------------------------------------------
 
     def _get_active_tools(self) -> list[dict[str, Any]] | None:
@@ -1275,6 +1410,21 @@ class ChatSession:
     ) -> Iterator[StreamChunk]:
         """Attempt a streaming API call with retries on transient errors."""
         prov = provider or self._provider
+        raw_url = str(getattr(client, "base_url", getattr(client, "_base_url", "?")))
+        safe_url = raw_url.split("?")[0]  # strip query params (may contain keys)
+        msg_count = len(msgs)
+        role_counts: dict[str, int] = {}
+        for m in msgs:
+            r = m.get("role", "?")
+            role_counts[r] = role_counts.get(r, 0) + 1
+        log.debug(
+            "API call: provider=%s model=%s base_url=%s msgs=%d roles=%s",
+            type(prov).__name__,
+            model,
+            safe_url,
+            msg_count,
+            role_counts,
+        )
         last_err: Exception | None = None
         for attempt in range(self._MAX_RETRIES + 1):
             self._check_cancelled()
@@ -1294,6 +1444,29 @@ class ChatSession:
                 )
             except Exception as e:
                 ename = type(e).__name__
+                cause_name = (
+                    type(e.__cause__).__name__
+                    if e.__cause__
+                    else (type(e.__context__).__name__ if e.__context__ else "None")
+                )
+                log.warning(
+                    "API error (attempt %d/%d): %s (cause=%s) "
+                    "provider=%s model=%s base_url=%s msgs=%d",
+                    attempt + 1,
+                    self._MAX_RETRIES + 1,
+                    ename,
+                    cause_name,
+                    type(prov).__name__,
+                    model,
+                    safe_url,
+                    msg_count,
+                )
+                log.debug(
+                    "API error details (attempt %d/%d)",
+                    attempt + 1,
+                    self._MAX_RETRIES + 1,
+                    exc_info=True,
+                )
                 if ename not in prov.retryable_error_names or attempt == self._MAX_RETRIES:
                     raise
                 last_err = e
@@ -2184,7 +2357,8 @@ class ChatSession:
         """Emit status info via the UI."""
         if not self._last_usage:
             return
-        self.ui.on_status(self._last_usage, self.context_window, self.reasoning_effort)
+        usage: dict[str, Any] = {**self._last_usage, "model": self.model}
+        self.ui.on_status(usage, self.context_window, self.reasoning_effort)
 
     # -- Conversation compaction ------------------------------------------------
 
@@ -2330,14 +2504,9 @@ class ChatSession:
             result: CompletionResult | None = None
             for attempt in range(self._MAX_RETRIES + 1):
                 try:
-                    result = self._provider.create_completion(
-                        client=self.client,
-                        model=self.model,
-                        messages=summary_msgs,
+                    result = self._utility_completion(
+                        summary_msgs,
                         max_tokens=summary_max_tokens,
-                        temperature=0.3,
-                        reasoning_effort="low",
-                        extra_params=self._provider_extra_params(reasoning_effort="low"),
                     )
                     break
                 except Exception as e:
@@ -4338,7 +4507,7 @@ class ChatSession:
                     stderr=subprocess.PIPE,
                     text=True,
                     start_new_session=True,
-                    env=scrubbed_env(),
+                    env=scrubbed_env(extra=self._skill_resource_env()),
                 )
                 with self._procs_lock:
                     self._active_procs.add(proc)
@@ -6015,26 +6184,30 @@ class ChatSession:
             return call_id, msg
 
         if not text.strip():
-            return call_id, "(empty response from URL)"
+            msg = "Error: fetch returned empty response"
+            self._report_tool_result(call_id, "web_fetch", msg, is_error=True)
+            return call_id, msg
 
         original_len = len(text)
         self.ui.on_info(f"fetched {original_len} chars, extracting...")
 
-        # Phase 2: truncate for summarization context
-        max_content = 50_000
+        # Phase 2: truncate for summarization context.
+        # Reserve ~25% of the context window for the extraction prompt
+        # overhead (system message, URL, question) and response tokens.
+        # Convert token budget to chars using the calibrated ratio.
+        max_content = int(self.context_window * self._chars_per_token * 0.75)
+        max_content = min(max(max_content, 50_000), 500_000)  # 50k–500k
         if len(text) > max_content:
-            text = (
-                text[: max_content // 2]
-                + f"\n\n... [{len(text) - max_content} chars omitted] ...\n\n"
-                + text[-(max_content // 2) :]
-            )
+            # Prefer the beginning — page content is usually top-heavy.
+            text = text[:max_content] + f"\n\n... [{len(text) - max_content} chars truncated] ...\n"
 
-        # Phase 3: summarization API call
+        # Phase 3: summarization API call.
+        # Use a generous max_tokens so thinking models don't starve the
+        # visible answer, and pass reasoning_effort="low" to avoid wasting
+        # budget on deep reasoning for a simple extraction task.
         try:
-            result = self._provider.create_completion(
-                client=self.client,
-                model=self.model,
-                messages=[
+            result = self._utility_completion(
+                [
                     {
                         "role": "system",
                         "content": (
@@ -6054,11 +6227,12 @@ class ChatSession:
                         ),
                     },
                 ],
-                max_tokens=2000,
+                max_tokens=8192,
                 temperature=0.2,
-                extra_params=self._provider_extra_params(),
             )
-            answer = result.content or "(no answer)"
+            answer = result.content or ""
+            if not answer:
+                answer = "Error: extraction returned no answer"
         except Exception as e:
             answer = f"Extraction failed (page was fetched but summarization errored): {e}"
 
@@ -6066,7 +6240,7 @@ class ChatSession:
             call_id,
             "web_fetch",
             answer,
-            is_error=answer.startswith("Extraction failed"),
+            is_error=answer.startswith(("Error:", "Extraction failed")),
         )
 
         return call_id, answer

turnstone/core/storage/__init__.py

@@ -4,10 +4,16 @@ Supports SQLite (default, zero-config) and PostgreSQL (multi-node, production).
 """
 
 from turnstone.core.storage._protocol import StorageBackend
-from turnstone.core.storage._registry import get_storage, init_storage, reset_storage
+from turnstone.core.storage._registry import (
+    StorageUnavailableError,
+    get_storage,
+    init_storage,
+    reset_storage,
+)
 
 __all__ = [
     "StorageBackend",
+    "StorageUnavailableError",
     "get_storage",
     "init_storage",
     "reset_storage",

turnstone/core/storage/_registry.py

@@ -15,6 +15,14 @@ log = get_logger(__name__)
 _storage: StorageBackend | None = None
 
 
+class StorageUnavailableError(Exception):
+    """Raised when the database is unreachable.
+
+    The storage layer has already logged a clean one-liner — callers
+    should catch this to avoid duplicate tracebacks.
+    """
+
+
 def init_storage(
     backend: str = "sqlite",
     *,

turnstone/core/watch.py

@@ -271,9 +271,13 @@ class WatchRunner:
     # -- Main loop -----------------------------------------------------------
 
     def _run(self) -> None:
+        from turnstone.core.storage._registry import StorageUnavailableError
+
         while not self._stop_event.is_set():
             try:
                 self._tick()
+            except StorageUnavailableError:
+                pass  # already logged by storage layer
             except Exception:
                 log.exception("watch_runner.tick_error")
             self._stop_event.wait(self._check_interval)

turnstone/core/web.py

@@ -6,14 +6,20 @@ import socket
 from html import unescape as _html_unescape
 from urllib.parse import urlparse
 
+_RE_INVISIBLE = re.compile(
+    r"<(script|style|template|noscript)\b[^>]*>.*?</\1\s*>",
+    re.DOTALL | re.IGNORECASE,
+)
 _RE_TAGS = re.compile(r"<[^>]+>")
 _RE_WS = re.compile(r"[ \t]+")
 _RE_BLANKLINES = re.compile(r"\n{3,}")
 
 
 def strip_html(html: str) -> str:
-    """Convert HTML to plain text: strip tags, decode entities, collapse whitespace."""
-    text = _RE_TAGS.sub("", html)
+    """Convert HTML to plain text: strip invisible elements, tags, decode entities."""
+    # Remove elements whose content should never appear as text
+    text = _RE_INVISIBLE.sub("", html)
+    text = _RE_TAGS.sub("", text)
     text = _html_unescape(text)
     text = _RE_WS.sub(" ", text)
     text = _RE_BLANKLINES.sub("\n\n", text)

turnstone/sdk/console.py

@@ -4,7 +4,7 @@ Usage::
 
     from turnstone.sdk import TurnstoneConsole
 
-    with TurnstoneConsole("http://localhost:8081", token="tok_xxx") as client:
+    with TurnstoneConsole("http://localhost:8090", token="ts_your_api_token") as client:
         overview = client.overview()
         print(f"Nodes: {overview.nodes}, Workstreams: {overview.workstreams}")
 """
@@ -73,7 +73,7 @@ class AsyncTurnstoneConsole(_BaseClient):
 
     def __init__(
         self,
-        base_url: str = "http://localhost:8081",
+        base_url: str = "http://localhost:8090",
         token: str = "",
         timeout: float = 30.0,
         httpx_client: httpx.AsyncClient | None = None,
@@ -961,19 +961,20 @@ class TurnstoneConsole:
 
     Usage::
 
-        with TurnstoneConsole("http://localhost:8081", token="tok_xxx") as client:
+        with TurnstoneConsole("http://localhost:8090", token="ts_your_api_token") as client:
             overview = client.overview()
             print(f"Nodes: {overview.nodes}")
     """
 
     def __init__(
         self,
-        base_url: str = "http://localhost:8081",
+        base_url: str = "http://localhost:8090",
         token: str = "",
         timeout: float = 30.0,
         ca_cert: str | None = None,
         client_cert: str | None = None,
         client_key: str | None = None,
+        token_factory: Callable[[], str] | None = None,
     ) -> None:
         self._runner = _SyncRunner()
         self._async = AsyncTurnstoneConsole(
@@ -983,6 +984,7 @@ class TurnstoneConsole:
             ca_cert=ca_cert,
             client_cert=client_cert,
             client_key=client_key,
+            token_factory=token_factory,
         )
 
     # -- cluster overview ----------------------------------------------------

turnstone/sdk/server.py

@@ -4,7 +4,7 @@ Usage::
 
     from turnstone.sdk import TurnstoneServer
 
-    with TurnstoneServer("http://localhost:8080", token="tok_xxx") as client:
+    with TurnstoneServer("http://localhost:8080", token="ts_your_api_token") as client:
         ws = client.create_workstream(name="Analysis")
         result = client.send_and_wait("Hello", ws.ws_id)
         print(result.content)
@@ -432,7 +432,7 @@ class TurnstoneServer:
 
     Usage::
 
-        with TurnstoneServer("http://localhost:8080", token="tok_xxx") as client:
+        with TurnstoneServer("http://localhost:8080", token="ts_your_api_token") as client:
             ws = client.create_workstream(name="Analysis")
             result = client.send_and_wait("Hello", ws.ws_id)
             print(result.content)
@@ -446,6 +446,7 @@ class TurnstoneServer:
         ca_cert: str | None = None,
         client_cert: str | None = None,
         client_key: str | None = None,
+        token_factory: Callable[[], str] | None = None,
     ) -> None:
         self._runner = _SyncRunner()
         self._async = AsyncTurnstoneServer(
@@ -455,6 +456,7 @@ class TurnstoneServer:
             ca_cert=ca_cert,
             client_cert=client_cert,
             client_key=client_key,
+            token_factory=token_factory,
         )
 
     # -- workstream management -----------------------------------------------

turnstone/server.py

@@ -95,6 +95,7 @@ class WebUI:
         self._pending_approval: dict[str, Any] | None = None  # re-sent on SSE reconnect
         self._plan_event = threading.Event()
         self._plan_result: str = ""
+        self._pending_plan_review: dict[str, Any] | None = None  # re-sent on SSE reconnect
         self.auto_approve = False
         self.auto_approve_tools: set[str] = set()
         # Per-workstream metrics accumulators (written by worker thread, read by metrics handler)
@@ -476,10 +477,12 @@ class WebUI:
 
     def on_plan_review(self, content: str) -> str:
         self._plan_event.clear()
-        self._enqueue({"type": "plan_review", "content": content})
+        self._pending_plan_review = {"type": "plan_review", "content": content}
+        self._enqueue(self._pending_plan_review)
         if not self._plan_event.wait(timeout=3600):
             log.warning("Plan review timed out for ws_id=%s", self.ws_id)
             self._plan_result = ""
+        self._pending_plan_review = None
         return self._plan_result
 
     def on_info(self, message: str) -> None:
@@ -621,6 +624,7 @@ class WebUI:
 
     def resolve_plan(self, feedback: str) -> None:
         """Called by the HTTP handler when the user responds to a plan."""
+        self._pending_plan_review = None
         self._plan_result = feedback
         self._plan_event.set()
 
@@ -900,9 +904,11 @@ async def events_sse(request: Request) -> Response:
         history = _build_history(session, has_pending_approval=ui._pending_approval is not None)
         if history:
             yield {"data": json.dumps({"type": "history", "messages": history})}
-        # Re-inject pending approval
+        # Re-inject pending approval or plan review
         if ui._pending_approval is not None:
             yield {"data": json.dumps(ui._pending_approval)}
+        if ui._pending_plan_review is not None:
+            yield {"data": json.dumps(ui._pending_plan_review)}
 
         _metrics.record_sse_connect()
         try:
@@ -2101,7 +2107,12 @@ def internal_mcp_reload(request: Request) -> JSONResponse:
 
         mcp_mgr = MCPClientManager({})
         mcp_mgr.start()
+        mcp_mgr.set_storage(storage)
         request.app.state.mcp_client = mcp_mgr
+        # Update shared ref so session_factory sees the new client
+        mcp_ref = getattr(request.app.state, "mcp_ref", None)
+        if mcp_ref is not None:
+            mcp_ref[0] = mcp_mgr
 
     result = mcp_mgr.reconcile_sync(storage)
     return JSONResponse({"status": "ok", **result})
@@ -2378,10 +2389,14 @@ async def _lifespan(app: Starlette) -> AsyncGenerator[None, None]:
 
         async def _heartbeat_loop() -> None:
             """Periodically update service heartbeat."""
+            from turnstone.core.storage._registry import StorageUnavailableError
+
             while True:
                 await asyncio.sleep(30)
                 try:
                     await asyncio.to_thread(_svc_storage.heartbeat_service, "server", _svc_node_id)
+                except StorageUnavailableError:
+                    pass  # already logged by storage layer
                 except Exception:
                     log.exception("server.heartbeat_failed")
 
@@ -2444,12 +2459,12 @@ def create_app(
     global_listeners: list[queue.Queue[dict[str, Any]]],
     global_listeners_lock: threading.Lock,
     skip_permissions: bool,
-    auth_config: Any,
     jwt_secret: str = "",
     auth_storage: Any = None,
     health_monitor: Any = None,
     rate_limiter: Any = None,
     mcp_client: Any = None,
+    mcp_ref: list[Any] | None = None,
     registry: Any = None,
     idle_timeout: int = 0,
     node_id: str = "",
@@ -2524,12 +2539,12 @@ def create_app(
     app.state.global_listeners = global_listeners
     app.state.global_listeners_lock = global_listeners_lock
     app.state.skip_permissions = skip_permissions
-    app.state.auth_config = auth_config
     app.state.jwt_secret = jwt_secret
     app.state.auth_storage = auth_storage
     app.state.health_monitor = health_monitor
     app.state.rate_limiter = rate_limiter
     app.state.mcp_client = mcp_client
+    app.state.mcp_ref = mcp_ref
     app.state.registry = registry
     app.state.idle_timeout = idle_timeout
     app.state.node_id = node_id
@@ -2756,6 +2771,9 @@ def main() -> None:
         refresh_interval=config_store.get("mcp.refresh_interval"),
         storage=_get_storage(),
     )
+    # Mutable ref so session_factory always sees the latest MCP client,
+    # including ones created by internal_mcp_reload after startup.
+    _mcp_ref: list[Any] = [mcp_client]
 
     # Backend health monitor with circuit breaker
     from turnstone.core.healthcheck import BackendHealthMonitor
@@ -2866,6 +2884,9 @@ def main() -> None:
     ) -> ChatSession:
         assert ui is not None
         r_client, r_model, r_cfg = registry.resolve(model_alias)
+        # Read MCP client from shared ref — may have been replaced after startup
+        # by internal_mcp_reload (Sync to Nodes) when no --mcp-config was passed.
+        live_mcp_client = _mcp_ref[0]
         uid = getattr(ui, "_user_id", "") or ""
 
         # Resolve username from user_id for system message context
@@ -2900,7 +2921,7 @@ def main() -> None:
             auto_compact_pct=config_store.get("session.auto_compact_pct"),
             agent_max_turns=config_store.get("tools.agent_max_turns"),
             tool_truncation=config_store.get("tools.truncation"),
-            mcp_client=mcp_client,
+            mcp_client=live_mcp_client,
             registry=registry,
             model_alias=model_alias or registry.default,
             health_monitor=health_monitor,
@@ -2994,13 +3015,11 @@ def main() -> None:
     _metrics.set_judge_enabled(judge_config.enabled if judge_config else False)
 
     # Auth config
-    from turnstone.core.auth import load_auth_config, load_jwt_secret
+    from turnstone.core.auth import load_jwt_secret
     from turnstone.core.storage import get_storage
 
-    auth_config = load_auth_config()
-    jwt_secret = load_jwt_secret() if auth_config.enabled else ""
-    if auth_config.enabled:
-        log.info("Auth: enabled (%d config token(s))", len(auth_config.tokens))
+    jwt_secret = load_jwt_secret()
+    log.info("Auth: enabled (JWT)")
 
     # Build the ASGI app
     from turnstone.core.web_helpers import parse_cors_origins
@@ -3025,12 +3044,12 @@ def main() -> None:
         global_listeners=global_listeners,
         global_listeners_lock=global_listeners_lock,
         skip_permissions=_skip_perms,
-        auth_config=auth_config,
         jwt_secret=jwt_secret,
         auth_storage=get_storage(),
         health_monitor=health_monitor,
         rate_limiter=rate_limiter,
         mcp_client=mcp_client,
+        mcp_ref=_mcp_ref,
         registry=registry,
         idle_timeout=config_store.get("server.workstream_idle_timeout"),
         node_id=_node_id,

turnstone/ui/static/renderer.js

@@ -730,7 +730,7 @@ function _loadMermaid(callback) {
   if (_mermaidState === "loading") return;
   _mermaidState = "loading";
   var script = document.createElement("script");
-  script.src = "/shared/mermaid-11.13.0/mermaid.min.js";
+  script.src = "/shared/mermaid-11.14.0/mermaid.min.js";
   script.onload = function () {
     _initMermaid();
     _mermaidState = "ready";

uv.lock

@@ -17,7 +17,7 @@ wheels = [
 
 [[package]]
 name = "aiohttp"
-version = "3.13.4"
+version = "3.13.5"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "aiohappyeyeballs" },
@@ -28,93 +28,93 @@ dependencies = [
     { name = "propcache" },
     { name = "yarl" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/45/4a/064321452809dae953c1ed6e017504e72551a26b6f5708a5a80e4bf556ff/aiohttp-3.13.4.tar.gz", hash = "sha256:d97a6d09c66087890c2ab5d49069e1e570583f7ac0314ecf98294c1b6aaebd38", size = 7859748, upload-time = "2026-03-28T17:19:40.6Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/77/9a/152096d4808df8e4268befa55fba462f440f14beab85e8ad9bf990516918/aiohttp-3.13.5.tar.gz", hash = "sha256:9d98cc980ecc96be6eb4c1994ce35d28d8b1f5e5208a23b421187d1209dbb7d1", size = 7858271, upload-time = "2026-03-31T22:01:03.343Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/d4/7e/cb94129302d78c46662b47f9897d642fd0b33bdfef4b73b20c6ced35aa4c/aiohttp-3.13.4-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:8ea0c64d1bcbf201b285c2246c51a0c035ba3bbd306640007bc5844a3b4658c1", size = 760027, upload-time = "2026-03-28T17:15:33.022Z" },
-    { url = "https://files.pythonhosted.org/packages/5e/cd/2db3c9397c3bd24216b203dd739945b04f8b87bb036c640da7ddb63c75ef/aiohttp-3.13.4-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:6f742e1fa45c0ed522b00ede565e18f97e4cf8d1883a712ac42d0339dfb0cce7", size = 508325, upload-time = "2026-03-28T17:15:34.714Z" },
-    { url = "https://files.pythonhosted.org/packages/36/a3/d28b2722ec13107f2e37a86b8a169897308bab6a3b9e071ecead9d67bd9b/aiohttp-3.13.4-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:6dcfb50ee25b3b7a1222a9123be1f9f89e56e67636b561441f0b304e25aaef8f", size = 502402, upload-time = "2026-03-28T17:15:36.409Z" },
-    { url = "https://files.pythonhosted.org/packages/fa/d6/acd47b5f17c4430e555590990a4746efbcb2079909bb865516892bf85f37/aiohttp-3.13.4-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:3262386c4ff370849863ea93b9ea60fd59c6cf56bf8f93beac625cf4d677c04d", size = 1771224, upload-time = "2026-03-28T17:15:38.223Z" },
-    { url = "https://files.pythonhosted.org/packages/98/af/af6e20113ba6a48fd1cd9e5832c4851e7613ef50c7619acdaee6ec5f1aff/aiohttp-3.13.4-cp311-cp311-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:473bb5aa4218dd254e9ae4834f20e31f5a0083064ac0136a01a62ddbae2eaa42", size = 1731530, upload-time = "2026-03-28T17:15:39.988Z" },
-    { url = "https://files.pythonhosted.org/packages/81/16/78a2f5d9c124ad05d5ce59a9af94214b6466c3491a25fb70760e98e9f762/aiohttp-3.13.4-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:e56423766399b4c77b965f6aaab6c9546617b8994a956821cc507d00b91d978c", size = 1827925, upload-time = "2026-03-28T17:15:41.944Z" },
-    { url = "https://files.pythonhosted.org/packages/2a/1f/79acf0974ced805e0e70027389fccbb7d728e6f30fcac725fb1071e63075/aiohttp-3.13.4-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:8af249343fafd5ad90366a16d230fc265cf1149f26075dc9fe93cfd7c7173942", size = 1923579, upload-time = "2026-03-28T17:15:44.071Z" },
-    { url = "https://files.pythonhosted.org/packages/af/53/29f9e2054ea6900413f3b4c3eb9d8331f60678ec855f13ba8714c47fd48d/aiohttp-3.13.4-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:0bc0a5cf4f10ef5a2c94fdde488734b582a3a7a000b131263e27c9295bd682d9", size = 1767655, upload-time = "2026-03-28T17:15:45.911Z" },
-    { url = "https://files.pythonhosted.org/packages/f3/57/462fe1d3da08109ba4aa8590e7aed57c059af2a7e80ec21f4bac5cfe1094/aiohttp-3.13.4-cp311-cp311-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:5c7ff1028e3c9fc5123a865ce17df1cb6424d180c503b8517afbe89aa566e6be", size = 1630439, upload-time = "2026-03-28T17:15:48.11Z" },
-    { url = "https://files.pythonhosted.org/packages/d7/4b/4813344aacdb8127263e3eec343d24e973421143826364fa9fc847f6283f/aiohttp-3.13.4-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:ba5cf98b5dcb9bddd857da6713a503fa6d341043258ca823f0f5ab7ab4a94ee8", size = 1745557, upload-time = "2026-03-28T17:15:50.13Z" },
-    { url = "https://files.pythonhosted.org/packages/d4/01/1ef1adae1454341ec50a789f03cfafe4c4ac9c003f6a64515ecd32fe4210/aiohttp-3.13.4-cp311-cp311-musllinux_1_2_armv7l.whl", hash = "sha256:d85965d3ba21ee4999e83e992fecb86c4614d6920e40705501c0a1f80a583c12", size = 1741796, upload-time = "2026-03-28T17:15:52.351Z" },
-    { url = "https://files.pythonhosted.org/packages/22/04/8cdd99af988d2aa6922714d957d21383c559835cbd43fbf5a47ddf2e0f05/aiohttp-3.13.4-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:49f0b18a9b05d79f6f37ddd567695943fcefb834ef480f17a4211987302b2dc7", size = 1805312, upload-time = "2026-03-28T17:15:54.407Z" },
-    { url = "https://files.pythonhosted.org/packages/fb/7f/b48d5577338d4b25bbdbae35c75dbfd0493cb8886dc586fbfb2e90862239/aiohttp-3.13.4-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:7f78cb080c86fbf765920e5f1ef35af3f24ec4314d6675d0a21eaf41f6f2679c", size = 1621751, upload-time = "2026-03-28T17:15:56.564Z" },
-    { url = "https://files.pythonhosted.org/packages/bc/89/4eecad8c1858e6d0893c05929e22343e0ebe3aec29a8a399c65c3cc38311/aiohttp-3.13.4-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:67a3ec705534a614b68bbf1c70efa777a21c3da3895d1c44510a41f5a7ae0453", size = 1826073, upload-time = "2026-03-28T17:15:58.489Z" },
-    { url = "https://files.pythonhosted.org/packages/f5/5c/9dc8293ed31b46c39c9c513ac7ca152b3c3d38e0ea111a530ad12001b827/aiohttp-3.13.4-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:d6630ec917e85c5356b2295744c8a97d40f007f96a1c76bf1928dc2e27465393", size = 1760083, upload-time = "2026-03-28T17:16:00.677Z" },
-    { url = "https://files.pythonhosted.org/packages/1e/19/8bbf6a4994205d96831f97b7d21a0feed120136e6267b5b22d229c6dc4dc/aiohttp-3.13.4-cp311-cp311-win32.whl", hash = "sha256:54049021bc626f53a5394c29e8c444f726ee5a14b6e89e0ad118315b1f90f5e3", size = 439690, upload-time = "2026-03-28T17:16:02.902Z" },
-    { url = "https://files.pythonhosted.org/packages/0c/f5/ac409ecd1007528d15c3e8c3a57d34f334c70d76cfb7128a28cffdebd4c1/aiohttp-3.13.4-cp311-cp311-win_amd64.whl", hash = "sha256:c033f2bc964156030772d31cbf7e5defea181238ce1f87b9455b786de7d30145", size = 463824, upload-time = "2026-03-28T17:16:05.058Z" },
-    { url = "https://files.pythonhosted.org/packages/1e/bd/ede278648914cabbabfdf95e436679b5d4156e417896a9b9f4587169e376/aiohttp-3.13.4-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:ee62d4471ce86b108b19c3364db4b91180d13fe3510144872d6bad5401957360", size = 752158, upload-time = "2026-03-28T17:16:06.901Z" },
-    { url = "https://files.pythonhosted.org/packages/90/de/581c053253c07b480b03785196ca5335e3c606a37dc73e95f6527f1591fe/aiohttp-3.13.4-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:c0fd8f41b54b58636402eb493afd512c23580456f022c1ba2db0f810c959ed0d", size = 501037, upload-time = "2026-03-28T17:16:08.82Z" },
-    { url = "https://files.pythonhosted.org/packages/fa/f9/a5ede193c08f13cc42c0a5b50d1e246ecee9115e4cf6e900d8dbd8fd6acb/aiohttp-3.13.4-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:4baa48ce49efd82d6b1a0be12d6a36b35e5594d1dd42f8bfba96ea9f8678b88c", size = 501556, upload-time = "2026-03-28T17:16:10.63Z" },
-    { url = "https://files.pythonhosted.org/packages/d6/10/88ff67cd48a6ec36335b63a640abe86135791544863e0cfe1f065d6cef7a/aiohttp-3.13.4-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:d738ebab9f71ee652d9dbd0211057690022201b11197f9a7324fd4dba128aa97", size = 1757314, upload-time = "2026-03-28T17:16:12.498Z" },
-    { url = "https://files.pythonhosted.org/packages/8b/15/fdb90a5cf5a1f52845c276e76298c75fbbcc0ac2b4a86551906d54529965/aiohttp-3.13.4-cp312-cp312-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:0ce692c3468fa831af7dceed52edf51ac348cebfc8d3feb935927b63bd3e8576", size = 1731819, upload-time = "2026-03-28T17:16:14.558Z" },
-    { url = "https://files.pythonhosted.org/packages/ec/df/28146785a007f7820416be05d4f28cc207493efd1e8c6c1068e9bdc29198/aiohttp-3.13.4-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:8e08abcfe752a454d2cb89ff0c08f2d1ecd057ae3e8cc6d84638de853530ebab", size = 1793279, upload-time = "2026-03-28T17:16:16.594Z" },
-    { url = "https://files.pythonhosted.org/packages/10/47/689c743abf62ea7a77774d5722f220e2c912a77d65d368b884d9779ef41b/aiohttp-3.13.4-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:5977f701b3fff36367a11087f30ea73c212e686d41cd363c50c022d48b011d8d", size = 1891082, upload-time = "2026-03-28T17:16:18.71Z" },
-    { url = "https://files.pythonhosted.org/packages/b0/b6/f7f4f318c7e58c23b761c9b13b9a3c9b394e0f9d5d76fbc6622fa98509f6/aiohttp-3.13.4-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:54203e10405c06f8b6020bd1e076ae0fe6c194adcee12a5a78af3ffa3c57025e", size = 1773938, upload-time = "2026-03-28T17:16:21.125Z" },
-    { url = "https://files.pythonhosted.org/packages/aa/06/f207cb3121852c989586a6fc16ff854c4fcc8651b86c5d3bd1fc83057650/aiohttp-3.13.4-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:358a6af0145bc4dda037f13167bef3cce54b132087acc4c295c739d05d16b1c3", size = 1579548, upload-time = "2026-03-28T17:16:23.588Z" },
-    { url = "https://files.pythonhosted.org/packages/6c/58/e1289661a32161e24c1fe479711d783067210d266842523752869cc1d9c2/aiohttp-3.13.4-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:898ea1850656d7d61832ef06aa9846ab3ddb1621b74f46de78fbc5e1a586ba83", size = 1714669, upload-time = "2026-03-28T17:16:25.713Z" },
-    { url = "https://files.pythonhosted.org/packages/96/0a/3e86d039438a74a86e6a948a9119b22540bae037d6ba317a042ae3c22711/aiohttp-3.13.4-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:7bc30cceb710cf6a44e9617e43eebb6e3e43ad855a34da7b4b6a73537d8a6763", size = 1754175, upload-time = "2026-03-28T17:16:28.18Z" },
-    { url = "https://files.pythonhosted.org/packages/f4/30/e717fc5df83133ba467a560b6d8ef20197037b4bb5d7075b90037de1018e/aiohttp-3.13.4-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:4a31c0c587a8a038f19a4c7e60654a6c899c9de9174593a13e7cc6e15ff271f9", size = 1762049, upload-time = "2026-03-28T17:16:30.941Z" },
-    { url = "https://files.pythonhosted.org/packages/e4/28/8f7a2d4492e336e40005151bdd94baf344880a4707573378579f833a64c1/aiohttp-3.13.4-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:2062f675f3fe6e06d6113eb74a157fb9df58953ffed0cdb4182554b116545758", size = 1570861, upload-time = "2026-03-28T17:16:32.953Z" },
-    { url = "https://files.pythonhosted.org/packages/78/45/12e1a3d0645968b1c38de4b23fdf270b8637735ea057d4f84482ff918ad9/aiohttp-3.13.4-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:3d1ba8afb847ff80626d5e408c1fdc99f942acc877d0702fe137015903a220a9", size = 1790003, upload-time = "2026-03-28T17:16:35.468Z" },
-    { url = "https://files.pythonhosted.org/packages/eb/0f/60374e18d590de16dcb39d6ff62f39c096c1b958e6f37727b5870026ea30/aiohttp-3.13.4-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:b08149419994cdd4d5eecf7fd4bc5986b5a9380285bcd01ab4c0d6bfca47b79d", size = 1737289, upload-time = "2026-03-28T17:16:38.187Z" },
-    { url = "https://files.pythonhosted.org/packages/02/bf/535e58d886cfbc40a8b0013c974afad24ef7632d645bca0b678b70033a60/aiohttp-3.13.4-cp312-cp312-win32.whl", hash = "sha256:fc432f6a2c4f720180959bc19aa37259651c1a4ed8af8afc84dd41c60f15f791", size = 434185, upload-time = "2026-03-28T17:16:40.735Z" },
-    { url = "https://files.pythonhosted.org/packages/1e/1a/d92e3325134ebfff6f4069f270d3aac770d63320bd1fcd0eca023e74d9a8/aiohttp-3.13.4-cp312-cp312-win_amd64.whl", hash = "sha256:6148c9ae97a3e8bff9a1fc9c757fa164116f86c100468339730e717590a3fb77", size = 461285, upload-time = "2026-03-28T17:16:42.713Z" },
-    { url = "https://files.pythonhosted.org/packages/e3/ac/892f4162df9b115b4758d615f32ec63d00f3084c705ff5526630887b9b42/aiohttp-3.13.4-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:63dd5e5b1e43b8fb1e91b79b7ceba1feba588b317d1edff385084fcc7a0a4538", size = 745744, upload-time = "2026-03-28T17:16:44.67Z" },
-    { url = "https://files.pythonhosted.org/packages/97/a9/c5b87e4443a2f0ea88cb3000c93a8fdad1ee63bffc9ded8d8c8e0d66efc6/aiohttp-3.13.4-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:746ac3cc00b5baea424dacddea3ec2c2702f9590de27d837aa67004db1eebc6e", size = 498178, upload-time = "2026-03-28T17:16:46.766Z" },
-    { url = "https://files.pythonhosted.org/packages/94/42/07e1b543a61250783650df13da8ddcdc0d0a5538b2bd15cef6e042aefc61/aiohttp-3.13.4-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:bda8f16ea99d6a6705e5946732e48487a448be874e54a4f73d514660ff7c05d3", size = 498331, upload-time = "2026-03-28T17:16:48.9Z" },
-    { url = "https://files.pythonhosted.org/packages/20/d6/492f46bf0328534124772d0cf58570acae5b286ea25006900650f69dae0e/aiohttp-3.13.4-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:4b061e7b5f840391e3f64d0ddf672973e45c4cfff7a0feea425ea24e51530fc2", size = 1744414, upload-time = "2026-03-28T17:16:50.968Z" },
-    { url = "https://files.pythonhosted.org/packages/e2/4d/e02627b2683f68051246215d2d62b2d2f249ff7a285e7a858dc47d6b6a14/aiohttp-3.13.4-cp313-cp313-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:b252e8d5cd66184b570d0d010de742736e8a4fab22c58299772b0c5a466d4b21", size = 1719226, upload-time = "2026-03-28T17:16:53.173Z" },
-    { url = "https://files.pythonhosted.org/packages/7b/6c/5d0a3394dd2b9f9aeba6e1b6065d0439e4b75d41f1fb09a3ec010b43552b/aiohttp-3.13.4-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:20af8aad61d1803ff11152a26146d8d81c266aa8c5aa9b4504432abb965c36a0", size = 1782110, upload-time = "2026-03-28T17:16:55.362Z" },
-    { url = "https://files.pythonhosted.org/packages/0d/2d/c20791e3437700a7441a7edfb59731150322424f5aadf635602d1d326101/aiohttp-3.13.4-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:13a5cc924b59859ad2adb1478e31f410a7ed46e92a2a619d6d1dd1a63c1a855e", size = 1884809, upload-time = "2026-03-28T17:16:57.734Z" },
-    { url = "https://files.pythonhosted.org/packages/c8/94/d99dbfbd1924a87ef643833932eb2a3d9e5eee87656efea7d78058539eff/aiohttp-3.13.4-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:534913dfb0a644d537aebb4123e7d466d94e3be5549205e6a31f72368980a81a", size = 1764938, upload-time = "2026-03-28T17:17:00.221Z" },
-    { url = "https://files.pythonhosted.org/packages/49/61/3ce326a1538781deb89f6cf5e094e2029cd308ed1e21b2ba2278b08426f6/aiohttp-3.13.4-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:320e40192a2dcc1cf4b5576936e9652981ab596bf81eb309535db7e2f5b5672f", size = 1570697, upload-time = "2026-03-28T17:17:02.985Z" },
-    { url = "https://files.pythonhosted.org/packages/b6/77/4ab5a546857bb3028fbaf34d6eea180267bdab022ee8b1168b1fcde4bfdd/aiohttp-3.13.4-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:9e587fcfce2bcf06526a43cb705bdee21ac089096f2e271d75de9c339db3100c", size = 1702258, upload-time = "2026-03-28T17:17:05.28Z" },
-    { url = "https://files.pythonhosted.org/packages/79/63/d8f29021e39bc5af8e5d5e9da1b07976fb9846487a784e11e4f4eeda4666/aiohttp-3.13.4-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:9eb9c2eea7278206b5c6c1441fdd9dc420c278ead3f3b2cc87f9b693698cc500", size = 1740287, upload-time = "2026-03-28T17:17:07.712Z" },
-    { url = "https://files.pythonhosted.org/packages/55/3a/cbc6b3b124859a11bc8055d3682c26999b393531ef926754a3445b99dfef/aiohttp-3.13.4-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:29be00c51972b04bf9d5c8f2d7f7314f48f96070ca40a873a53056e652e805f7", size = 1753011, upload-time = "2026-03-28T17:17:10.053Z" },
-    { url = "https://files.pythonhosted.org/packages/e0/30/836278675205d58c1368b21520eab9572457cf19afd23759216c04483048/aiohttp-3.13.4-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:90c06228a6c3a7c9f776fe4fc0b7ff647fffd3bed93779a6913c804ae00c1073", size = 1566359, upload-time = "2026-03-28T17:17:12.433Z" },
-    { url = "https://files.pythonhosted.org/packages/50/b4/8032cc9b82d17e4277704ba30509eaccb39329dc18d6a35f05e424439e32/aiohttp-3.13.4-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:a533ec132f05fd9a1d959e7f34184cd7d5e8511584848dab85faefbaac573069", size = 1785537, upload-time = "2026-03-28T17:17:14.721Z" },
-    { url = "https://files.pythonhosted.org/packages/17/7d/5873e98230bde59f493bf1f7c3e327486a4b5653fa401144704df5d00211/aiohttp-3.13.4-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:1c946f10f413836f82ea4cfb90200d2a59578c549f00857e03111cf45ad01ca5", size = 1740752, upload-time = "2026-03-28T17:17:17.387Z" },
-    { url = "https://files.pythonhosted.org/packages/7b/f2/13e46e0df051494d7d3c68b7f72d071f48c384c12716fc294f75d5b1a064/aiohttp-3.13.4-cp313-cp313-win32.whl", hash = "sha256:48708e2706106da6967eff5908c78ca3943f005ed6bcb75da2a7e4da94ef8c70", size = 433187, upload-time = "2026-03-28T17:17:19.523Z" },
-    { url = "https://files.pythonhosted.org/packages/ea/c0/649856ee655a843c8f8664592cfccb73ac80ede6a8c8db33a25d810c12db/aiohttp-3.13.4-cp313-cp313-win_amd64.whl", hash = "sha256:74a2eb058da44fa3a877a49e2095b591d4913308bb424c418b77beb160c55ce3", size = 459778, upload-time = "2026-03-28T17:17:21.964Z" },
-    { url = "https://files.pythonhosted.org/packages/6d/29/6657cc37ae04cacc2dbf53fb730a06b6091cc4cbe745028e047c53e6d840/aiohttp-3.13.4-cp314-cp314-macosx_10_13_universal2.whl", hash = "sha256:e0a2c961fc92abeff61d6444f2ce6ad35bb982db9fc8ff8a47455beacf454a57", size = 749363, upload-time = "2026-03-28T17:17:24.044Z" },
-    { url = "https://files.pythonhosted.org/packages/90/7f/30ccdf67ca3d24b610067dc63d64dcb91e5d88e27667811640644aa4a85d/aiohttp-3.13.4-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:153274535985a0ff2bff1fb6c104ed547cec898a09213d21b0f791a44b14d933", size = 499317, upload-time = "2026-03-28T17:17:26.199Z" },
-    { url = "https://files.pythonhosted.org/packages/93/13/e372dd4e68ad04ee25dafb050c7f98b0d91ea643f7352757e87231102555/aiohttp-3.13.4-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:351f3171e2458da3d731ce83f9e6b9619e325c45cbd534c7759750cabf453ad7", size = 500477, upload-time = "2026-03-28T17:17:28.279Z" },
-    { url = "https://files.pythonhosted.org/packages/e5/fe/ee6298e8e586096fb6f5eddd31393d8544f33ae0792c71ecbb4c2bef98ac/aiohttp-3.13.4-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f989ac8bc5595ff761a5ccd32bdb0768a117f36dd1504b1c2c074ed5d3f4df9c", size = 1737227, upload-time = "2026-03-28T17:17:30.587Z" },
-    { url = "https://files.pythonhosted.org/packages/b0/b9/a7a0463a09e1a3fe35100f74324f23644bfc3383ac5fd5effe0722a5f0b7/aiohttp-3.13.4-cp314-cp314-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:d36fc1709110ec1e87a229b201dd3ddc32aa01e98e7868083a794609b081c349", size = 1694036, upload-time = "2026-03-28T17:17:33.29Z" },
-    { url = "https://files.pythonhosted.org/packages/57/7c/8972ae3fb7be00a91aee6b644b2a6a909aedb2c425269a3bfd90115e6f8f/aiohttp-3.13.4-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:42adaeea83cbdf069ab94f5103ce0787c21fb1a0153270da76b59d5578302329", size = 1786814, upload-time = "2026-03-28T17:17:36.035Z" },
-    { url = "https://files.pythonhosted.org/packages/93/01/c81e97e85c774decbaf0d577de7d848934e8166a3a14ad9f8aa5be329d28/aiohttp-3.13.4-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:92deb95469928cc41fd4b42a95d8012fa6df93f6b1c0a83af0ffbc4a5e218cde", size = 1866676, upload-time = "2026-03-28T17:17:38.441Z" },
-    { url = "https://files.pythonhosted.org/packages/5a/5f/5b46fe8694a639ddea2cd035bf5729e4677ea882cb251396637e2ef1590d/aiohttp-3.13.4-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:0c0c7c07c4257ef3a1df355f840bc62d133bcdef5c1c5ba75add3c08553e2eed", size = 1740842, upload-time = "2026-03-28T17:17:40.783Z" },
-    { url = "https://files.pythonhosted.org/packages/20/a2/0d4b03d011cca6b6b0acba8433193c1e484efa8d705ea58295590fe24203/aiohttp-3.13.4-cp314-cp314-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:f062c45de8a1098cb137a1898819796a2491aec4e637a06b03f149315dff4d8f", size = 1566508, upload-time = "2026-03-28T17:17:43.235Z" },
-    { url = "https://files.pythonhosted.org/packages/98/17/e689fd500da52488ec5f889effd6404dece6a59de301e380f3c64f167beb/aiohttp-3.13.4-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:76093107c531517001114f0ebdb4f46858ce818590363e3e99a4a2280334454a", size = 1700569, upload-time = "2026-03-28T17:17:46.165Z" },
-    { url = "https://files.pythonhosted.org/packages/d8/0d/66402894dbcf470ef7db99449e436105ea862c24f7ea4c95c683e635af35/aiohttp-3.13.4-cp314-cp314-musllinux_1_2_armv7l.whl", hash = "sha256:6f6ec32162d293b82f8b63a16edc80769662fbd5ae6fbd4936d3206a2c2cc63b", size = 1707407, upload-time = "2026-03-28T17:17:48.825Z" },
-    { url = "https://files.pythonhosted.org/packages/2f/eb/af0ab1a3650092cbd8e14ef29e4ab0209e1460e1c299996c3f8288b3f1ff/aiohttp-3.13.4-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:5903e2db3d202a00ad9f0ec35a122c005e85d90c9836ab4cda628f01edf425e2", size = 1752214, upload-time = "2026-03-28T17:17:51.206Z" },
-    { url = "https://files.pythonhosted.org/packages/5a/bf/72326f8a98e4c666f292f03c385545963cc65e358835d2a7375037a97b57/aiohttp-3.13.4-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:2d5bea57be7aca98dbbac8da046d99b5557c5cf4e28538c4c786313078aca09e", size = 1562162, upload-time = "2026-03-28T17:17:53.634Z" },
-    { url = "https://files.pythonhosted.org/packages/67/9f/13b72435f99151dd9a5469c96b3b5f86aa29b7e785ca7f35cf5e538f74c0/aiohttp-3.13.4-cp314-cp314-musllinux_1_2_s390x.whl", hash = "sha256:bcf0c9902085976edc0232b75006ef38f89686901249ce14226b6877f88464fb", size = 1768904, upload-time = "2026-03-28T17:17:55.991Z" },
-    { url = "https://files.pythonhosted.org/packages/18/bc/28d4970e7d5452ac7776cdb5431a1164a0d9cf8bd2fffd67b4fb463aa56d/aiohttp-3.13.4-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:c3295f98bfeed2e867cab588f2a146a9db37a85e3ae9062abf46ba062bd29165", size = 1723378, upload-time = "2026-03-28T17:17:58.348Z" },
-    { url = "https://files.pythonhosted.org/packages/53/74/b32458ca1a7f34d65bdee7aef2036adbe0438123d3d53e2b083c453c24dd/aiohttp-3.13.4-cp314-cp314-win32.whl", hash = "sha256:a598a5c5767e1369d8f5b08695cab1d8160040f796c4416af76fd773d229b3c9", size = 438711, upload-time = "2026-03-28T17:18:00.728Z" },
-    { url = "https://files.pythonhosted.org/packages/40/b2/54b487316c2df3e03a8f3435e9636f8a81a42a69d942164830d193beb56a/aiohttp-3.13.4-cp314-cp314-win_amd64.whl", hash = "sha256:c555db4bc7a264bead5a7d63d92d41a1122fcd39cc62a4db815f45ad46f9c2c8", size = 464977, upload-time = "2026-03-28T17:18:03.367Z" },
-    { url = "https://files.pythonhosted.org/packages/47/fb/e41b63c6ce71b07a59243bb8f3b457ee0c3402a619acb9d2c0d21ef0e647/aiohttp-3.13.4-cp314-cp314t-macosx_10_13_universal2.whl", hash = "sha256:45abbbf09a129825d13c18c7d3182fecd46d9da3cfc383756145394013604ac1", size = 781549, upload-time = "2026-03-28T17:18:05.779Z" },
-    { url = "https://files.pythonhosted.org/packages/97/53/532b8d28df1e17e44c4d9a9368b78dcb6bf0b51037522136eced13afa9e8/aiohttp-3.13.4-cp314-cp314t-macosx_10_13_x86_64.whl", hash = "sha256:74c80b2bc2c2adb7b3d1941b2b60701ee2af8296fc8aad8b8bc48bc25767266c", size = 514383, upload-time = "2026-03-28T17:18:08.096Z" },
-    { url = "https://files.pythonhosted.org/packages/1b/1f/62e5d400603e8468cd635812d99cb81cfdc08127a3dc474c647615f31339/aiohttp-3.13.4-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:c97989ae40a9746650fa196894f317dafc12227c808c774929dda0ff873a5954", size = 518304, upload-time = "2026-03-28T17:18:10.642Z" },
-    { url = "https://files.pythonhosted.org/packages/90/57/2326b37b10896447e3c6e0cbef4fe2486d30913639a5cfd1332b5d870f82/aiohttp-3.13.4-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:dae86be9811493f9990ef44fff1685f5c1a3192e9061a71a109d527944eed551", size = 1893433, upload-time = "2026-03-28T17:18:13.121Z" },
-    { url = "https://files.pythonhosted.org/packages/d2/b4/a24d82112c304afdb650167ef2fe190957d81cbddac7460bedd245f765aa/aiohttp-3.13.4-cp314-cp314t-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:1db491abe852ca2fa6cc48a3341985b0174b3741838e1341b82ac82c8bd9e871", size = 1755901, upload-time = "2026-03-28T17:18:16.21Z" },
-    { url = "https://files.pythonhosted.org/packages/9e/2d/0883ef9d878d7846287f036c162a951968f22aabeef3ac97b0bea6f76d5d/aiohttp-3.13.4-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:0e5d701c0aad02a7dce72eef6b93226cf3734330f1a31d69ebbf69f33b86666e", size = 1876093, upload-time = "2026-03-28T17:18:18.703Z" },
-    { url = "https://files.pythonhosted.org/packages/ad/52/9204bb59c014869b71971addad6778f005daa72a96eed652c496789d7468/aiohttp-3.13.4-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:8ac32a189081ae0a10ba18993f10f338ec94341f0d5df8fff348043962f3c6f8", size = 1970815, upload-time = "2026-03-28T17:18:21.858Z" },
-    { url = "https://files.pythonhosted.org/packages/d6/b5/e4eb20275a866dde0f570f411b36c6b48f7b53edfe4f4071aa1b0728098a/aiohttp-3.13.4-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:98e968cdaba43e45c73c3f306fca418c8009a957733bac85937c9f9cf3f4de27", size = 1816223, upload-time = "2026-03-28T17:18:24.729Z" },
-    { url = "https://files.pythonhosted.org/packages/d8/23/e98075c5bb146aa61a1239ee1ac7714c85e814838d6cebbe37d3fe19214a/aiohttp-3.13.4-cp314-cp314t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:ca114790c9144c335d538852612d3e43ea0f075288f4849cf4b05d6cd2238ce7", size = 1649145, upload-time = "2026-03-28T17:18:27.269Z" },
-    { url = "https://files.pythonhosted.org/packages/d6/c1/7bad8be33bb06c2bb224b6468874346026092762cbec388c3bdb65a368ee/aiohttp-3.13.4-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:ea2e071661ba9cfe11eabbc81ac5376eaeb3061f6e72ec4cc86d7cdd1ffbdbbb", size = 1816562, upload-time = "2026-03-28T17:18:29.847Z" },
-    { url = "https://files.pythonhosted.org/packages/5c/10/c00323348695e9a5e316825969c88463dcc24c7e9d443244b8a2c9cf2eae/aiohttp-3.13.4-cp314-cp314t-musllinux_1_2_armv7l.whl", hash = "sha256:34e89912b6c20e0fd80e07fa401fd218a410aa1ce9f1c2f1dad6db1bd0ce0927", size = 1800333, upload-time = "2026-03-28T17:18:32.269Z" },
-    { url = "https://files.pythonhosted.org/packages/84/43/9b2147a1df3559f49bd723e22905b46a46c068a53adb54abdca32c4de180/aiohttp-3.13.4-cp314-cp314t-musllinux_1_2_ppc64le.whl", hash = "sha256:0e217cf9f6a42908c52b46e42c568bd57adc39c9286ced31aaace614b6087965", size = 1820617, upload-time = "2026-03-28T17:18:35.238Z" },
-    { url = "https://files.pythonhosted.org/packages/a9/7f/b3481a81e7a586d02e99387b18c6dafff41285f6efd3daa2124c01f87eae/aiohttp-3.13.4-cp314-cp314t-musllinux_1_2_riscv64.whl", hash = "sha256:0c296f1221e21ba979f5ac1964c3b78cfde15c5c5f855ffd2caab337e9cd9182", size = 1643417, upload-time = "2026-03-28T17:18:37.949Z" },
-    { url = "https://files.pythonhosted.org/packages/8f/72/07181226bc99ce1124e0f89280f5221a82d3ae6a6d9d1973ce429d48e52b/aiohttp-3.13.4-cp314-cp314t-musllinux_1_2_s390x.whl", hash = "sha256:d99a9d168ebaffb74f36d011750e490085ac418f4db926cce3989c8fe6cb6b1b", size = 1849286, upload-time = "2026-03-28T17:18:40.534Z" },
-    { url = "https://files.pythonhosted.org/packages/1a/e6/1b3566e103eca6da5be4ae6713e112a053725c584e96574caf117568ffef/aiohttp-3.13.4-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:cb19177205d93b881f3f89e6081593676043a6828f59c78c17a0fd6c1fbed2ba", size = 1782635, upload-time = "2026-03-28T17:18:43.073Z" },
-    { url = "https://files.pythonhosted.org/packages/37/58/1b11c71904b8d079eb0c39fe664180dd1e14bebe5608e235d8bfbadc8929/aiohttp-3.13.4-cp314-cp314t-win32.whl", hash = "sha256:c606aa5656dab6552e52ca368e43869c916338346bfaf6304e15c58fb113ea30", size = 472537, upload-time = "2026-03-28T17:18:46.286Z" },
-    { url = "https://files.pythonhosted.org/packages/bc/8f/87c56a1a1977d7dddea5b31e12189665a140fdb48a71e9038ff90bb564ec/aiohttp-3.13.4-cp314-cp314t-win_amd64.whl", hash = "sha256:014dcc10ec8ab8db681f0d68e939d1e9286a5aa2b993cbbdb0db130853e02144", size = 506381, upload-time = "2026-03-28T17:18:48.74Z" },
+    { url = "https://files.pythonhosted.org/packages/d6/f5/a20c4ac64aeaef1679e25c9983573618ff765d7aa829fa2b84ae7573169e/aiohttp-3.13.5-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:7ab7229b6f9b5c1ba4910d6c41a9eb11f543eadb3f384df1b4c293f4e73d44d6", size = 757513, upload-time = "2026-03-31T21:57:02.146Z" },
+    { url = "https://files.pythonhosted.org/packages/75/0a/39fa6c6b179b53fcb3e4b3d2b6d6cad0180854eda17060c7218540102bef/aiohttp-3.13.5-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:8f14c50708bb156b3a3ca7230b3d820199d56a48e3af76fa21c2d6087190fe3d", size = 506748, upload-time = "2026-03-31T21:57:04.275Z" },
+    { url = "https://files.pythonhosted.org/packages/87/ec/e38ce072e724fd7add6243613f8d1810da084f54175353d25ccf9f9c7e5a/aiohttp-3.13.5-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:e7d2f8616f0ff60bd332022279011776c3ac0faa0f1b463f7bb12326fbc97a1c", size = 501673, upload-time = "2026-03-31T21:57:06.208Z" },
+    { url = "https://files.pythonhosted.org/packages/ba/ba/3bc7525d7e2beaa11b309a70d48b0d3cfc3c2089ec6a7d0820d59c657053/aiohttp-3.13.5-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:a2567b72e1ffc3ab25510db43f355b29eeada56c0a622e58dcdb19530eb0a3cb", size = 1763757, upload-time = "2026-03-31T21:57:07.882Z" },
+    { url = "https://files.pythonhosted.org/packages/5e/ab/e87744cf18f1bd78263aba24924d4953b41086bd3a31d22452378e9028a0/aiohttp-3.13.5-cp311-cp311-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:fb0540c854ac9c0c5ad495908fdfd3e332d553ec731698c0e29b1877ba0d2ec6", size = 1720152, upload-time = "2026-03-31T21:57:09.946Z" },
+    { url = "https://files.pythonhosted.org/packages/6b/f3/ed17a6f2d742af17b50bae2d152315ed1b164b07a5fd5cc1754d99e4dfa5/aiohttp-3.13.5-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:c9883051c6972f58bfc4ebb2116345ee2aa151178e99c3f2b2bbe2af712abd13", size = 1818010, upload-time = "2026-03-31T21:57:12.157Z" },
+    { url = "https://files.pythonhosted.org/packages/53/06/ecbc63dc937192e2a5cb46df4d3edb21deb8225535818802f210a6ea5816/aiohttp-3.13.5-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:2294172ce08a82fb7c7273485895de1fa1186cc8294cfeb6aef4af42ad261174", size = 1907251, upload-time = "2026-03-31T21:57:14.023Z" },
+    { url = "https://files.pythonhosted.org/packages/7e/a5/0521aa32c1ddf3aa1e71dcc466be0b7db2771907a13f18cddaa45967d97b/aiohttp-3.13.5-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:3a807cabd5115fb55af198b98178997a5e0e57dead43eb74a93d9c07d6d4a7dc", size = 1759969, upload-time = "2026-03-31T21:57:16.146Z" },
+    { url = "https://files.pythonhosted.org/packages/f6/78/a38f8c9105199dd3b9706745865a8a59d0041b6be0ca0cc4b2ccf1bab374/aiohttp-3.13.5-cp311-cp311-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:aa6d0d932e0f39c02b80744273cd5c388a2d9bc07760a03164f229c8e02662f6", size = 1616871, upload-time = "2026-03-31T21:57:17.856Z" },
+    { url = "https://files.pythonhosted.org/packages/6f/41/27392a61ead8ab38072105c71aa44ff891e71653fe53d576a7067da2b4e8/aiohttp-3.13.5-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:60869c7ac4aaabe7110f26499f3e6e5696eae98144735b12a9c3d9eae2b51a49", size = 1739844, upload-time = "2026-03-31T21:57:19.679Z" },
+    { url = "https://files.pythonhosted.org/packages/6e/55/5564e7ae26d94f3214250009a0b1c65a0c6af4bf88924ccb6fdab901de28/aiohttp-3.13.5-cp311-cp311-musllinux_1_2_armv7l.whl", hash = "sha256:26d2f8546f1dfa75efa50c3488215a903c0168d253b75fba4210f57ab77a0fb8", size = 1731969, upload-time = "2026-03-31T21:57:22.006Z" },
+    { url = "https://files.pythonhosted.org/packages/6d/c5/705a3929149865fc941bcbdd1047b238e4a72bcb215a9b16b9d7a2e8d992/aiohttp-3.13.5-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:f1162a1492032c82f14271e831c8f4b49f2b6078f4f5fc74de2c912fa225d51d", size = 1795193, upload-time = "2026-03-31T21:57:24.256Z" },
+    { url = "https://files.pythonhosted.org/packages/a6/19/edabed62f718d02cff7231ca0db4ef1c72504235bc467f7b67adb1679f48/aiohttp-3.13.5-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:8b14eb3262fad0dc2f89c1a43b13727e709504972186ff6a99a3ecaa77102b6c", size = 1606477, upload-time = "2026-03-31T21:57:26.364Z" },
+    { url = "https://files.pythonhosted.org/packages/de/fc/76f80ef008675637d88d0b21584596dc27410a990b0918cb1e5776545b5b/aiohttp-3.13.5-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:ca9ac61ac6db4eb6c2a0cd1d0f7e1357647b638ccc92f7e9d8d133e71ed3c6ac", size = 1813198, upload-time = "2026-03-31T21:57:28.316Z" },
+    { url = "https://files.pythonhosted.org/packages/e5/67/5b3ac26b80adb20ea541c487f73730dc8fa107d632c998f25bbbab98fcda/aiohttp-3.13.5-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:7996023b2ed59489ae4762256c8516df9820f751cf2c5da8ed2fb20ee50abab3", size = 1752321, upload-time = "2026-03-31T21:57:30.549Z" },
+    { url = "https://files.pythonhosted.org/packages/88/06/e4a2e49255ea23fa4feeb5ab092d90240d927c15e47b5b5c48dff5a9ce29/aiohttp-3.13.5-cp311-cp311-win32.whl", hash = "sha256:77dfa48c9f8013271011e51c00f8ada19851f013cde2c48fca1ba5e0caf5bb06", size = 439069, upload-time = "2026-03-31T21:57:32.388Z" },
+    { url = "https://files.pythonhosted.org/packages/c0/43/8c7163a596dab4f8be12c190cf467a1e07e4734cf90eebb39f7f5d53fc6a/aiohttp-3.13.5-cp311-cp311-win_amd64.whl", hash = "sha256:d3a4834f221061624b8887090637db9ad4f61752001eae37d56c52fddade2dc8", size = 462859, upload-time = "2026-03-31T21:57:34.455Z" },
+    { url = "https://files.pythonhosted.org/packages/be/6f/353954c29e7dcce7cf00280a02c75f30e133c00793c7a2ed3776d7b2f426/aiohttp-3.13.5-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:023ecba036ddd840b0b19bf195bfae970083fd7024ce1ac22e9bba90464620e9", size = 748876, upload-time = "2026-03-31T21:57:36.319Z" },
+    { url = "https://files.pythonhosted.org/packages/f5/1b/428a7c64687b3b2e9cd293186695affc0e1e54a445d0361743b231f11066/aiohttp-3.13.5-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:15c933ad7920b7d9a20de151efcd05a6e38302cbf0e10c9b2acb9a42210a2416", size = 499557, upload-time = "2026-03-31T21:57:38.236Z" },
+    { url = "https://files.pythonhosted.org/packages/29/47/7be41556bfbb6917069d6a6634bb7dd5e163ba445b783a90d40f5ac7e3a7/aiohttp-3.13.5-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:ab2899f9fa2f9f741896ebb6fa07c4c883bfa5c7f2ddd8cf2aafa86fa981b2d2", size = 500258, upload-time = "2026-03-31T21:57:39.923Z" },
+    { url = "https://files.pythonhosted.org/packages/67/84/c9ecc5828cb0b3695856c07c0a6817a99d51e2473400f705275a2b3d9239/aiohttp-3.13.5-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:a60eaa2d440cd4707696b52e40ed3e2b0f73f65be07fd0ef23b6b539c9c0b0b4", size = 1749199, upload-time = "2026-03-31T21:57:41.938Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/d3/3c6d610e66b495657622edb6ae7c7fd31b2e9086b4ec50b47897ad6042a9/aiohttp-3.13.5-cp312-cp312-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:55b3bdd3292283295774ab585160c4004f4f2f203946997f49aac032c84649e9", size = 1721013, upload-time = "2026-03-31T21:57:43.904Z" },
+    { url = "https://files.pythonhosted.org/packages/49/a0/24409c12217456df0bae7babe3b014e460b0b38a8e60753d6cb339f6556d/aiohttp-3.13.5-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:c2b2355dc094e5f7d45a7bb262fe7207aa0460b37a0d87027dcf21b5d890e7d5", size = 1781501, upload-time = "2026-03-31T21:57:46.285Z" },
+    { url = "https://files.pythonhosted.org/packages/98/9d/b65ec649adc5bccc008b0957a9a9c691070aeac4e41cea18559fef49958b/aiohttp-3.13.5-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:b38765950832f7d728297689ad78f5f2cf79ff82487131c4d26fe6ceecdc5f8e", size = 1878981, upload-time = "2026-03-31T21:57:48.734Z" },
+    { url = "https://files.pythonhosted.org/packages/57/d8/8d44036d7eb7b6a8ec4c5494ea0c8c8b94fbc0ed3991c1a7adf230df03bf/aiohttp-3.13.5-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:b18f31b80d5a33661e08c89e202edabf1986e9b49c42b4504371daeaa11b47c1", size = 1767934, upload-time = "2026-03-31T21:57:51.171Z" },
+    { url = "https://files.pythonhosted.org/packages/31/04/d3f8211f273356f158e3464e9e45484d3fb8c4ce5eb2f6fe9405c3273983/aiohttp-3.13.5-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:33add2463dde55c4f2d9635c6ab33ce154e5ecf322bd26d09af95c5f81cfa286", size = 1566671, upload-time = "2026-03-31T21:57:53.326Z" },
+    { url = "https://files.pythonhosted.org/packages/41/db/073e4ebe00b78e2dfcacff734291651729a62953b48933d765dc513bf798/aiohttp-3.13.5-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:327cc432fdf1356fb4fbc6fe833ad4e9f6aacb71a8acaa5f1855e4b25910e4a9", size = 1705219, upload-time = "2026-03-31T21:57:55.385Z" },
+    { url = "https://files.pythonhosted.org/packages/48/45/7dfba71a2f9fd97b15c95c06819de7eb38113d2cdb6319669195a7d64270/aiohttp-3.13.5-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:7c35b0bf0b48a70b4cb4fc5d7bed9b932532728e124874355de1a0af8ec4bc88", size = 1743049, upload-time = "2026-03-31T21:57:57.341Z" },
+    { url = "https://files.pythonhosted.org/packages/18/71/901db0061e0f717d226386a7f471bb59b19566f2cae5f0d93874b017271f/aiohttp-3.13.5-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:df23d57718f24badef8656c49743e11a89fd6f5358fa8a7b96e728fda2abf7d3", size = 1749557, upload-time = "2026-03-31T21:57:59.626Z" },
+    { url = "https://files.pythonhosted.org/packages/08/d5/41eebd16066e59cd43728fe74bce953d7402f2b4ddfdfef2c0e9f17ca274/aiohttp-3.13.5-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:02e048037a6501a5ec1f6fc9736135aec6eb8a004ce48838cb951c515f32c80b", size = 1558931, upload-time = "2026-03-31T21:58:01.972Z" },
+    { url = "https://files.pythonhosted.org/packages/30/e6/4a799798bf05740e66c3a1161079bda7a3dd8e22ca392481d7a7f9af82a6/aiohttp-3.13.5-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:31cebae8b26f8a615d2b546fee45d5ffb76852ae6450e2a03f42c9102260d6fe", size = 1774125, upload-time = "2026-03-31T21:58:04.007Z" },
+    { url = "https://files.pythonhosted.org/packages/84/63/7749337c90f92bc2cb18f9560d67aa6258c7060d1397d21529b8004fcf6f/aiohttp-3.13.5-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:888e78eb5ca55a615d285c3c09a7a91b42e9dd6fc699b166ebd5dee87c9ccf14", size = 1732427, upload-time = "2026-03-31T21:58:06.337Z" },
+    { url = "https://files.pythonhosted.org/packages/98/de/cf2f44ff98d307e72fb97d5f5bbae3bfcb442f0ea9790c0bf5c5c2331404/aiohttp-3.13.5-cp312-cp312-win32.whl", hash = "sha256:8bd3ec6376e68a41f9f95f5ed170e2fcf22d4eb27a1f8cb361d0508f6e0557f3", size = 433534, upload-time = "2026-03-31T21:58:08.712Z" },
+    { url = "https://files.pythonhosted.org/packages/aa/ca/eadf6f9c8fa5e31d40993e3db153fb5ed0b11008ad5d9de98a95045bed84/aiohttp-3.13.5-cp312-cp312-win_amd64.whl", hash = "sha256:110e448e02c729bcebb18c60b9214a87ba33bac4a9fa5e9a5f139938b56c6cb1", size = 460446, upload-time = "2026-03-31T21:58:10.945Z" },
+    { url = "https://files.pythonhosted.org/packages/78/e9/d76bf503005709e390122d34e15256b88f7008e246c4bdbe915cd4f1adce/aiohttp-3.13.5-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:a5029cc80718bbd545123cd8fe5d15025eccaaaace5d0eeec6bd556ad6163d61", size = 742930, upload-time = "2026-03-31T21:58:13.155Z" },
+    { url = "https://files.pythonhosted.org/packages/57/00/4b7b70223deaebd9bb85984d01a764b0d7bd6526fcdc73cca83bcbe7243e/aiohttp-3.13.5-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:4bb6bf5811620003614076bdc807ef3b5e38244f9d25ca5fe888eaccea2a9832", size = 496927, upload-time = "2026-03-31T21:58:15.073Z" },
+    { url = "https://files.pythonhosted.org/packages/9c/f5/0fb20fb49f8efdcdce6cd8127604ad2c503e754a8f139f5e02b01626523f/aiohttp-3.13.5-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:a84792f8631bf5a94e52d9cc881c0b824ab42717165a5579c760b830d9392ac9", size = 497141, upload-time = "2026-03-31T21:58:17.009Z" },
+    { url = "https://files.pythonhosted.org/packages/3b/86/b7c870053e36a94e8951b803cb5b909bfbc9b90ca941527f5fcafbf6b0fa/aiohttp-3.13.5-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:57653eac22c6a4c13eb22ecf4d673d64a12f266e72785ab1c8b8e5940d0e8090", size = 1732476, upload-time = "2026-03-31T21:58:18.925Z" },
+    { url = "https://files.pythonhosted.org/packages/b5/e5/4e161f84f98d80c03a238671b4136e6530453d65262867d989bbe78244d0/aiohttp-3.13.5-cp313-cp313-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:e5e5f7debc7a57af53fdf5c5009f9391d9f4c12867049d509bf7bb164a6e295b", size = 1706507, upload-time = "2026-03-31T21:58:21.094Z" },
+    { url = "https://files.pythonhosted.org/packages/d4/56/ea11a9f01518bd5a2a2fcee869d248c4b8a0cfa0bb13401574fa31adf4d4/aiohttp-3.13.5-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:c719f65bebcdf6716f10e9eff80d27567f7892d8988c06de12bbbd39307c6e3a", size = 1773465, upload-time = "2026-03-31T21:58:23.159Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/40/333ca27fb74b0383f17c90570c748f7582501507307350a79d9f9f3c6eb1/aiohttp-3.13.5-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:d97f93fdae594d886c5a866636397e2bcab146fd7a132fd6bb9ce182224452f8", size = 1873523, upload-time = "2026-03-31T21:58:25.59Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/d2/e2f77eef1acb7111405433c707dc735e63f67a56e176e72e9e7a2cd3f493/aiohttp-3.13.5-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:3df334e39d4c2f899a914f1dba283c1aadc311790733f705182998c6f7cae665", size = 1754113, upload-time = "2026-03-31T21:58:27.624Z" },
+    { url = "https://files.pythonhosted.org/packages/fb/56/3f653d7f53c89669301ec9e42c95233e2a0c0a6dd051269e6e678db4fdb0/aiohttp-3.13.5-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:fe6970addfea9e5e081401bcbadf865d2b6da045472f58af08427e108d618540", size = 1562351, upload-time = "2026-03-31T21:58:29.918Z" },
+    { url = "https://files.pythonhosted.org/packages/ec/a6/9b3e91eb8ae791cce4ee736da02211c85c6f835f1bdfac0594a8a3b7018c/aiohttp-3.13.5-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:7becdf835feff2f4f335d7477f121af787e3504b48b449ff737afb35869ba7bb", size = 1693205, upload-time = "2026-03-31T21:58:32.214Z" },
+    { url = "https://files.pythonhosted.org/packages/98/fc/bfb437a99a2fcebd6b6eaec609571954de2ed424f01c352f4b5504371dd3/aiohttp-3.13.5-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:676e5651705ad5d8a70aeb8eb6936c436d8ebbd56e63436cb7dd9bb36d2a9a46", size = 1730618, upload-time = "2026-03-31T21:58:34.728Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/b6/c8534862126191a034f68153194c389addc285a0f1347d85096d349bbc15/aiohttp-3.13.5-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:9b16c653d38eb1a611cc898c41e76859ca27f119d25b53c12875fd0474ae31a8", size = 1745185, upload-time = "2026-03-31T21:58:36.909Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/93/4ca8ee2ef5236e2707e0fd5fecb10ce214aee1ff4ab307af9c558bda3b37/aiohttp-3.13.5-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:999802d5fa0389f58decd24b537c54aa63c01c3219ce17d1214cbda3c2b22d2d", size = 1557311, upload-time = "2026-03-31T21:58:39.38Z" },
+    { url = "https://files.pythonhosted.org/packages/57/ae/76177b15f18c5f5d094f19901d284025db28eccc5ae374d1d254181d33f4/aiohttp-3.13.5-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:ec707059ee75732b1ba130ed5f9580fe10ff75180c812bc267ded039db5128c6", size = 1773147, upload-time = "2026-03-31T21:58:41.476Z" },
+    { url = "https://files.pythonhosted.org/packages/01/a4/62f05a0a98d88af59d93b7fcac564e5f18f513cb7471696ac286db970d6a/aiohttp-3.13.5-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:2d6d44a5b48132053c2f6cd5c8cb14bc67e99a63594e336b0f2af81e94d5530c", size = 1730356, upload-time = "2026-03-31T21:58:44.049Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/85/fc8601f59dfa8c9523808281f2da571f8b4699685f9809a228adcc90838d/aiohttp-3.13.5-cp313-cp313-win32.whl", hash = "sha256:329f292ed14d38a6c4c435e465f48bebb47479fd676a0411936cc371643225cc", size = 432637, upload-time = "2026-03-31T21:58:46.167Z" },
+    { url = "https://files.pythonhosted.org/packages/c0/1b/ac685a8882896acf0f6b31d689e3792199cfe7aba37969fa91da63a7fa27/aiohttp-3.13.5-cp313-cp313-win_amd64.whl", hash = "sha256:69f571de7500e0557801c0b51f4780482c0ec5fe2ac851af5a92cfce1af1cb83", size = 458896, upload-time = "2026-03-31T21:58:48.119Z" },
+    { url = "https://files.pythonhosted.org/packages/5d/ce/46572759afc859e867a5bc8ec3487315869013f59281ce61764f76d879de/aiohttp-3.13.5-cp314-cp314-macosx_10_13_universal2.whl", hash = "sha256:eb4639f32fd4a9904ab8fb45bf3383ba71137f3d9d4ba25b3b3f3109977c5b8c", size = 745721, upload-time = "2026-03-31T21:58:50.229Z" },
+    { url = "https://files.pythonhosted.org/packages/13/fe/8a2efd7626dbe6049b2ef8ace18ffda8a4dfcbe1bcff3ac30c0c7575c20b/aiohttp-3.13.5-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:7e5dc4311bd5ac493886c63cbf76ab579dbe4641268e7c74e48e774c74b6f2be", size = 497663, upload-time = "2026-03-31T21:58:52.232Z" },
+    { url = "https://files.pythonhosted.org/packages/9b/91/cc8cc78a111826c54743d88651e1687008133c37e5ee615fee9b57990fac/aiohttp-3.13.5-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:756c3c304d394977519824449600adaf2be0ccee76d206ee339c5e76b70ded25", size = 499094, upload-time = "2026-03-31T21:58:54.566Z" },
+    { url = "https://files.pythonhosted.org/packages/0a/33/a8362cb15cf16a3af7e86ed11962d5cd7d59b449202dc576cdc731310bde/aiohttp-3.13.5-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:ecc26751323224cf8186efcf7fbcbc30f4e1d8c7970659daf25ad995e4032a56", size = 1726701, upload-time = "2026-03-31T21:58:56.864Z" },
+    { url = "https://files.pythonhosted.org/packages/45/0c/c091ac5c3a17114bd76cbf85d674650969ddf93387876cf67f754204bd77/aiohttp-3.13.5-cp314-cp314-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:10a75acfcf794edf9d8db50e5a7ec5fc818b2a8d3f591ce93bc7b1210df016d2", size = 1683360, upload-time = "2026-03-31T21:58:59.072Z" },
+    { url = "https://files.pythonhosted.org/packages/23/73/bcee1c2b79bc275e964d1446c55c54441a461938e70267c86afaae6fba27/aiohttp-3.13.5-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:0f7a18f258d124cd678c5fe072fe4432a4d5232b0657fca7c1847f599233c83a", size = 1773023, upload-time = "2026-03-31T21:59:01.776Z" },
+    { url = "https://files.pythonhosted.org/packages/c7/ef/720e639df03004fee2d869f771799d8c23046dec47d5b81e396c7cda583a/aiohttp-3.13.5-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:df6104c009713d3a89621096f3e3e88cc323fd269dbd7c20afe18535094320be", size = 1853795, upload-time = "2026-03-31T21:59:04.568Z" },
+    { url = "https://files.pythonhosted.org/packages/bd/c9/989f4034fb46841208de7aeeac2c6d8300745ab4f28c42f629ba77c2d916/aiohttp-3.13.5-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:241a94f7de7c0c3b616627aaad530fe2cb620084a8b144d3be7b6ecfe95bae3b", size = 1730405, upload-time = "2026-03-31T21:59:07.221Z" },
+    { url = "https://files.pythonhosted.org/packages/ce/75/ee1fd286ca7dc599d824b5651dad7b3be7ff8d9a7e7b3fe9820d9180f7db/aiohttp-3.13.5-cp314-cp314-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:c974fb66180e58709b6fc402846f13791240d180b74de81d23913abe48e96d94", size = 1558082, upload-time = "2026-03-31T21:59:09.484Z" },
+    { url = "https://files.pythonhosted.org/packages/c3/20/1e9e6650dfc436340116b7aa89ff8cb2bbdf0abc11dfaceaad8f74273a10/aiohttp-3.13.5-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:6e27ea05d184afac78aabbac667450c75e54e35f62238d44463131bd3f96753d", size = 1692346, upload-time = "2026-03-31T21:59:12.068Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/40/8ebc6658d48ea630ac7903912fe0dd4e262f0e16825aa4c833c56c9f1f56/aiohttp-3.13.5-cp314-cp314-musllinux_1_2_armv7l.whl", hash = "sha256:a79a6d399cef33a11b6f004c67bb07741d91f2be01b8d712d52c75711b1e07c7", size = 1698891, upload-time = "2026-03-31T21:59:14.552Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/78/ea0ae5ec8ba7a5c10bdd6e318f1ba5e76fcde17db8275188772afc7917a4/aiohttp-3.13.5-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:c632ce9c0b534fbe25b52c974515ed674937c5b99f549a92127c85f771a78772", size = 1742113, upload-time = "2026-03-31T21:59:17.068Z" },
+    { url = "https://files.pythonhosted.org/packages/8a/66/9d308ed71e3f2491be1acb8769d96c6f0c47d92099f3bc9119cada27b357/aiohttp-3.13.5-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:fceedde51fbd67ee2bcc8c0b33d0126cc8b51ef3bbde2f86662bd6d5a6f10ec5", size = 1553088, upload-time = "2026-03-31T21:59:19.541Z" },
+    { url = "https://files.pythonhosted.org/packages/da/a6/6cc25ed8dfc6e00c90f5c6d126a98e2cf28957ad06fa1036bd34b6f24a2c/aiohttp-3.13.5-cp314-cp314-musllinux_1_2_s390x.whl", hash = "sha256:f92995dfec9420bb69ae629abf422e516923ba79ba4403bc750d94fb4a6c68c1", size = 1757976, upload-time = "2026-03-31T21:59:22.311Z" },
+    { url = "https://files.pythonhosted.org/packages/c1/2b/cce5b0ffe0de99c83e5e36d8f828e4161e415660a9f3e58339d07cce3006/aiohttp-3.13.5-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:20ae0ff08b1f2c8788d6fb85afcb798654ae6ba0b747575f8562de738078457b", size = 1712444, upload-time = "2026-03-31T21:59:24.635Z" },
+    { url = "https://files.pythonhosted.org/packages/6c/cf/9e1795b4160c58d29421eafd1a69c6ce351e2f7c8d3c6b7e4ca44aea1a5b/aiohttp-3.13.5-cp314-cp314-win32.whl", hash = "sha256:b20df693de16f42b2472a9c485e1c948ee55524786a0a34345511afdd22246f3", size = 438128, upload-time = "2026-03-31T21:59:27.291Z" },
+    { url = "https://files.pythonhosted.org/packages/22/4d/eaedff67fc805aeba4ba746aec891b4b24cebb1a7d078084b6300f79d063/aiohttp-3.13.5-cp314-cp314-win_amd64.whl", hash = "sha256:f85c6f327bf0b8c29da7d93b1cabb6363fb5e4e160a32fa241ed2dce21b73162", size = 464029, upload-time = "2026-03-31T21:59:29.429Z" },
+    { url = "https://files.pythonhosted.org/packages/79/11/c27d9332ee20d68dd164dc12a6ecdef2e2e35ecc97ed6cf0d2442844624b/aiohttp-3.13.5-cp314-cp314t-macosx_10_13_universal2.whl", hash = "sha256:1efb06900858bb618ff5cee184ae2de5828896c448403d51fb633f09e109be0a", size = 778758, upload-time = "2026-03-31T21:59:31.547Z" },
+    { url = "https://files.pythonhosted.org/packages/04/fb/377aead2e0a3ba5f09b7624f702a964bdf4f08b5b6728a9799830c80041e/aiohttp-3.13.5-cp314-cp314t-macosx_10_13_x86_64.whl", hash = "sha256:fee86b7c4bd29bdaf0d53d14739b08a106fdda809ca5fe032a15f52fae5fe254", size = 512883, upload-time = "2026-03-31T21:59:34.098Z" },
+    { url = "https://files.pythonhosted.org/packages/bb/a6/aa109a33671f7a5d3bd78b46da9d852797c5e665bfda7d6b373f56bff2ec/aiohttp-3.13.5-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:20058e23909b9e65f9da62b396b77dfa95965cbe840f8def6e572538b1d32e36", size = 516668, upload-time = "2026-03-31T21:59:36.497Z" },
+    { url = "https://files.pythonhosted.org/packages/79/b3/ca078f9f2fa9563c36fb8ef89053ea2bb146d6f792c5104574d49d8acb63/aiohttp-3.13.5-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:8cf20a8d6868cb15a73cab329ffc07291ba8c22b1b88176026106ae39aa6df0f", size = 1883461, upload-time = "2026-03-31T21:59:38.723Z" },
+    { url = "https://files.pythonhosted.org/packages/b7/e3/a7ad633ca1ca497b852233a3cce6906a56c3225fb6d9217b5e5e60b7419d/aiohttp-3.13.5-cp314-cp314t-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:330f5da04c987f1d5bdb8ae189137c77139f36bd1cb23779ca1a354a4b027800", size = 1747661, upload-time = "2026-03-31T21:59:41.187Z" },
+    { url = "https://files.pythonhosted.org/packages/33/b9/cd6fe579bed34a906d3d783fe60f2fa297ef55b27bb4538438ee49d4dc41/aiohttp-3.13.5-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:6f1cbf0c7926d315c3c26c2da41fd2b5d2fe01ac0e157b78caefc51a782196cf", size = 1863800, upload-time = "2026-03-31T21:59:43.84Z" },
+    { url = "https://files.pythonhosted.org/packages/c0/3f/2c1e2f5144cefa889c8afd5cf431994c32f3b29da9961698ff4e3811b79a/aiohttp-3.13.5-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:53fc049ed6390d05423ba33103ded7281fe897cf97878f369a527070bd95795b", size = 1958382, upload-time = "2026-03-31T21:59:46.187Z" },
+    { url = "https://files.pythonhosted.org/packages/66/1d/f31ec3f1013723b3babe3609e7f119c2c2fb6ef33da90061a705ef3e1bc8/aiohttp-3.13.5-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:898703aa2667e3c5ca4c54ca36cd73f58b7a38ef87a5606414799ebce4d3fd3a", size = 1803724, upload-time = "2026-03-31T21:59:48.656Z" },
+    { url = "https://files.pythonhosted.org/packages/0e/b4/57712dfc6f1542f067daa81eb61da282fab3e6f1966fca25db06c4fc62d5/aiohttp-3.13.5-cp314-cp314t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:0494a01ca9584eea1e5fbd6d748e61ecff218c51b576ee1999c23db7066417d8", size = 1640027, upload-time = "2026-03-31T21:59:51.284Z" },
+    { url = "https://files.pythonhosted.org/packages/25/3c/734c878fb43ec083d8e31bf029daae1beafeae582d1b35da234739e82ee7/aiohttp-3.13.5-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:6cf81fe010b8c17b09495cbd15c1d35afbc8fb405c0c9cf4738e5ae3af1d65be", size = 1806644, upload-time = "2026-03-31T21:59:53.753Z" },
+    { url = "https://files.pythonhosted.org/packages/20/a5/f671e5cbec1c21d044ff3078223f949748f3a7f86b14e34a365d74a5d21f/aiohttp-3.13.5-cp314-cp314t-musllinux_1_2_armv7l.whl", hash = "sha256:c564dd5f09ddc9d8f2c2d0a301cd30a79a2cc1b46dd1a73bef8f0038863d016b", size = 1791630, upload-time = "2026-03-31T21:59:56.239Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/63/fb8d0ad63a0b8a99be97deac8c04dacf0785721c158bdf23d679a87aa99e/aiohttp-3.13.5-cp314-cp314t-musllinux_1_2_ppc64le.whl", hash = "sha256:2994be9f6e51046c4f864598fd9abeb4fba6e88f0b2152422c9666dcd4aea9c6", size = 1809403, upload-time = "2026-03-31T21:59:59.103Z" },
+    { url = "https://files.pythonhosted.org/packages/59/0c/bfed7f30662fcf12206481c2aac57dedee43fe1c49275e85b3a1e1742294/aiohttp-3.13.5-cp314-cp314t-musllinux_1_2_riscv64.whl", hash = "sha256:157826e2fa245d2ef46c83ea8a5faf77ca19355d278d425c29fda0beb3318037", size = 1634924, upload-time = "2026-03-31T22:00:02.116Z" },
+    { url = "https://files.pythonhosted.org/packages/17/d6/fd518d668a09fd5a3319ae5e984d4d80b9a4b3df4e21c52f02251ef5a32e/aiohttp-3.13.5-cp314-cp314t-musllinux_1_2_s390x.whl", hash = "sha256:a8aca50daa9493e9e13c0f566201a9006f080e7c50e5e90d0b06f53146a54500", size = 1836119, upload-time = "2026-03-31T22:00:04.756Z" },
+    { url = "https://files.pythonhosted.org/packages/78/b7/15fb7a9d52e112a25b621c67b69c167805cb1f2ab8f1708a5c490d1b52fe/aiohttp-3.13.5-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:3b13560160d07e047a93f23aaa30718606493036253d5430887514715b67c9d9", size = 1772072, upload-time = "2026-03-31T22:00:07.494Z" },
+    { url = "https://files.pythonhosted.org/packages/7e/df/57ba7f0c4a553fc2bd8b6321df236870ec6fd64a2a473a8a13d4f733214e/aiohttp-3.13.5-cp314-cp314t-win32.whl", hash = "sha256:9a0f4474b6ea6818b41f82172d799e4b3d29e22c2c520ce4357856fced9af2f8", size = 471819, upload-time = "2026-03-31T22:00:10.277Z" },
+    { url = "https://files.pythonhosted.org/packages/62/29/2f8418269e46454a26171bfdd6a055d74febf32234e474930f2f60a17145/aiohttp-3.13.5-cp314-cp314t-win_amd64.whl", hash = "sha256:18a2f6c1182c51baa1d28d68fea51513cb2a76612f038853c0ad3c145423d3d9", size = 505441, upload-time = "2026-03-31T22:00:12.791Z" },
 ]
 
 [[package]]
@@ -155,7 +155,7 @@ wheels = [
 
 [[package]]
 name = "anthropic"
-version = "0.86.0"
+version = "0.88.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "anyio" },
@@ -167,9 +167,9 @@ dependencies = [
     { name = "sniffio" },
     { name = "typing-extensions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/37/7a/8b390dc47945d3169875d342847431e5f7d5fa716b2e37494d57cfc1db10/anthropic-0.86.0.tar.gz", hash = "sha256:60023a7e879aa4fbb1fed99d487fe407b2ebf6569603e5047cfe304cebdaa0e5", size = 583820, upload-time = "2026-03-18T18:43:08.017Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/86/68/565f13059c0a6a6fd5f96f306f2a0fb478a0e1174ec18a4df16b5fac9379/anthropic-0.88.0.tar.gz", hash = "sha256:f4c7f6863d08c869913516f08d658fe53caaf8bcc4fbea3218df343d2a876c58", size = 596654, upload-time = "2026-04-01T19:59:05.287Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/63/5f/67db29c6e5d16c8c9c4652d3efb934d89cb750cad201539141781d8eae14/anthropic-0.86.0-py3-none-any.whl", hash = "sha256:9d2bbd339446acce98858c5627d33056efe01f70435b22b63546fe7edae0cd57", size = 469400, upload-time = "2026-03-18T18:43:06.526Z" },
+    { url = "https://files.pythonhosted.org/packages/ad/ac/68f646998160c9f2e6f9353a31dd87292ef02b915b455aaf70a52a059a75/anthropic-0.88.0-py3-none-any.whl", hash = "sha256:71898b32332bc75d9739bc10095288d40a29605da6d00da2fe832b1aa036552f", size = 478338, upload-time = "2026-04-01T19:59:03.832Z" },
 ]
 
 [[package]]
@@ -1400,7 +1400,7 @@ wheels = [
 
 [[package]]
 name = "mypy"
-version = "1.19.1"
+version = "1.20.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "librt", marker = "platform_python_implementation != 'PyPy'" },
@@ -1408,33 +1408,44 @@ dependencies = [
     { name = "pathspec" },
     { name = "typing-extensions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/f5/db/4efed9504bc01309ab9c2da7e352cc223569f05478012b5d9ece38fd44d2/mypy-1.19.1.tar.gz", hash = "sha256:19d88bb05303fe63f71dd2c6270daca27cb9401c4ca8255fe50d1d920e0eb9ba", size = 3582404, upload-time = "2025-12-15T05:03:48.42Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/f8/5c/b0089fe7fef0a994ae5ee07029ced0526082c6cfaaa4c10d40a10e33b097/mypy-1.20.0.tar.gz", hash = "sha256:eb96c84efcc33f0b5e0e04beacf00129dd963b67226b01c00b9dfc8affb464c3", size = 3815028, upload-time = "2026-03-31T16:55:14.959Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/ef/47/6b3ebabd5474d9cdc170d1342fbf9dddc1b0ec13ec90bf9004ee6f391c31/mypy-1.19.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:d8dfc6ab58ca7dda47d9237349157500468e404b17213d44fc1cb77bce532288", size = 13028539, upload-time = "2025-12-15T05:03:44.129Z" },
-    { url = "https://files.pythonhosted.org/packages/5c/a6/ac7c7a88a3c9c54334f53a941b765e6ec6c4ebd65d3fe8cdcfbe0d0fd7db/mypy-1.19.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:e3f276d8493c3c97930e354b2595a44a21348b320d859fb4a2b9f66da9ed27ab", size = 12083163, upload-time = "2025-12-15T05:03:37.679Z" },
-    { url = "https://files.pythonhosted.org/packages/67/af/3afa9cf880aa4a2c803798ac24f1d11ef72a0c8079689fac5cfd815e2830/mypy-1.19.1-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:2abb24cf3f17864770d18d673c85235ba52456b36a06b6afc1e07c1fdcd3d0e6", size = 12687629, upload-time = "2025-12-15T05:02:31.526Z" },
-    { url = "https://files.pythonhosted.org/packages/2d/46/20f8a7114a56484ab268b0ab372461cb3a8f7deed31ea96b83a4e4cfcfca/mypy-1.19.1-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:a009ffa5a621762d0c926a078c2d639104becab69e79538a494bcccb62cc0331", size = 13436933, upload-time = "2025-12-15T05:03:15.606Z" },
-    { url = "https://files.pythonhosted.org/packages/5b/f8/33b291ea85050a21f15da910002460f1f445f8007adb29230f0adea279cb/mypy-1.19.1-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:f7cee03c9a2e2ee26ec07479f38ea9c884e301d42c6d43a19d20fb014e3ba925", size = 13661754, upload-time = "2025-12-15T05:02:26.731Z" },
-    { url = "https://files.pythonhosted.org/packages/fd/a3/47cbd4e85bec4335a9cd80cf67dbc02be21b5d4c9c23ad6b95d6c5196bac/mypy-1.19.1-cp311-cp311-win_amd64.whl", hash = "sha256:4b84a7a18f41e167f7995200a1d07a4a6810e89d29859df936f1c3923d263042", size = 10055772, upload-time = "2025-12-15T05:03:26.179Z" },
-    { url = "https://files.pythonhosted.org/packages/06/8a/19bfae96f6615aa8a0604915512e0289b1fad33d5909bf7244f02935d33a/mypy-1.19.1-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:a8174a03289288c1f6c46d55cef02379b478bfbc8e358e02047487cad44c6ca1", size = 13206053, upload-time = "2025-12-15T05:03:46.622Z" },
-    { url = "https://files.pythonhosted.org/packages/a5/34/3e63879ab041602154ba2a9f99817bb0c85c4df19a23a1443c8986e4d565/mypy-1.19.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:ffcebe56eb09ff0c0885e750036a095e23793ba6c2e894e7e63f6d89ad51f22e", size = 12219134, upload-time = "2025-12-15T05:03:24.367Z" },
-    { url = "https://files.pythonhosted.org/packages/89/cc/2db6f0e95366b630364e09845672dbee0cbf0bbe753a204b29a944967cd9/mypy-1.19.1-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:b64d987153888790bcdb03a6473d321820597ab8dd9243b27a92153c4fa50fd2", size = 12731616, upload-time = "2025-12-15T05:02:44.725Z" },
-    { url = "https://files.pythonhosted.org/packages/00/be/dd56c1fd4807bc1eba1cf18b2a850d0de7bacb55e158755eb79f77c41f8e/mypy-1.19.1-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:c35d298c2c4bba75feb2195655dfea8124d855dfd7343bf8b8c055421eaf0cf8", size = 13620847, upload-time = "2025-12-15T05:03:39.633Z" },
-    { url = "https://files.pythonhosted.org/packages/6d/42/332951aae42b79329f743bf1da088cd75d8d4d9acc18fbcbd84f26c1af4e/mypy-1.19.1-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:34c81968774648ab5ac09c29a375fdede03ba253f8f8287847bd480782f73a6a", size = 13834976, upload-time = "2025-12-15T05:03:08.786Z" },
-    { url = "https://files.pythonhosted.org/packages/6f/63/e7493e5f90e1e085c562bb06e2eb32cae27c5057b9653348d38b47daaecc/mypy-1.19.1-cp312-cp312-win_amd64.whl", hash = "sha256:b10e7c2cd7870ba4ad9b2d8a6102eb5ffc1f16ca35e3de6bfa390c1113029d13", size = 10118104, upload-time = "2025-12-15T05:03:10.834Z" },
-    { url = "https://files.pythonhosted.org/packages/de/9f/a6abae693f7a0c697dbb435aac52e958dc8da44e92e08ba88d2e42326176/mypy-1.19.1-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:e3157c7594ff2ef1634ee058aafc56a82db665c9438fd41b390f3bde1ab12250", size = 13201927, upload-time = "2025-12-15T05:02:29.138Z" },
-    { url = "https://files.pythonhosted.org/packages/9a/a4/45c35ccf6e1c65afc23a069f50e2c66f46bd3798cbe0d680c12d12935caa/mypy-1.19.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:bdb12f69bcc02700c2b47e070238f42cb87f18c0bc1fc4cdb4fb2bc5fd7a3b8b", size = 12206730, upload-time = "2025-12-15T05:03:01.325Z" },
-    { url = "https://files.pythonhosted.org/packages/05/bb/cdcf89678e26b187650512620eec8368fded4cfd99cfcb431e4cdfd19dec/mypy-1.19.1-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f859fb09d9583a985be9a493d5cfc5515b56b08f7447759a0c5deaf68d80506e", size = 12724581, upload-time = "2025-12-15T05:03:20.087Z" },
-    { url = "https://files.pythonhosted.org/packages/d1/32/dd260d52babf67bad8e6770f8e1102021877ce0edea106e72df5626bb0ec/mypy-1.19.1-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:c9a6538e0415310aad77cb94004ca6482330fece18036b5f360b62c45814c4ef", size = 13616252, upload-time = "2025-12-15T05:02:49.036Z" },
-    { url = "https://files.pythonhosted.org/packages/71/d0/5e60a9d2e3bd48432ae2b454b7ef2b62a960ab51292b1eda2a95edd78198/mypy-1.19.1-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:da4869fc5e7f62a88f3fe0b5c919d1d9f7ea3cef92d3689de2823fd27e40aa75", size = 13840848, upload-time = "2025-12-15T05:02:55.95Z" },
-    { url = "https://files.pythonhosted.org/packages/98/76/d32051fa65ecf6cc8c6610956473abdc9b4c43301107476ac03559507843/mypy-1.19.1-cp313-cp313-win_amd64.whl", hash = "sha256:016f2246209095e8eda7538944daa1d60e1e8134d98983b9fc1e92c1fc0cb8dd", size = 10135510, upload-time = "2025-12-15T05:02:58.438Z" },
-    { url = "https://files.pythonhosted.org/packages/de/eb/b83e75f4c820c4247a58580ef86fcd35165028f191e7e1ba57128c52782d/mypy-1.19.1-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:06e6170bd5836770e8104c8fdd58e5e725cfeb309f0a6c681a811f557e97eac1", size = 13199744, upload-time = "2025-12-15T05:03:30.823Z" },
-    { url = "https://files.pythonhosted.org/packages/94/28/52785ab7bfa165f87fcbb61547a93f98bb20e7f82f90f165a1f69bce7b3d/mypy-1.19.1-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:804bd67b8054a85447c8954215a906d6eff9cabeabe493fb6334b24f4bfff718", size = 12215815, upload-time = "2025-12-15T05:02:42.323Z" },
-    { url = "https://files.pythonhosted.org/packages/0a/c6/bdd60774a0dbfb05122e3e925f2e9e846c009e479dcec4821dad881f5b52/mypy-1.19.1-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:21761006a7f497cb0d4de3d8ef4ca70532256688b0523eee02baf9eec895e27b", size = 12740047, upload-time = "2025-12-15T05:03:33.168Z" },
-    { url = "https://files.pythonhosted.org/packages/32/2a/66ba933fe6c76bd40d1fe916a83f04fed253152f451a877520b3c4a5e41e/mypy-1.19.1-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:28902ee51f12e0f19e1e16fbe2f8f06b6637f482c459dd393efddd0ec7f82045", size = 13601998, upload-time = "2025-12-15T05:03:13.056Z" },
-    { url = "https://files.pythonhosted.org/packages/e3/da/5055c63e377c5c2418760411fd6a63ee2b96cf95397259038756c042574f/mypy-1.19.1-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:481daf36a4c443332e2ae9c137dfee878fcea781a2e3f895d54bd3002a900957", size = 13807476, upload-time = "2025-12-15T05:03:17.977Z" },
-    { url = "https://files.pythonhosted.org/packages/cd/09/4ebd873390a063176f06b0dbf1f7783dd87bd120eae7727fa4ae4179b685/mypy-1.19.1-cp314-cp314-win_amd64.whl", hash = "sha256:8bb5c6f6d043655e055be9b542aa5f3bdd30e4f3589163e85f93f3640060509f", size = 10281872, upload-time = "2025-12-15T05:03:05.549Z" },
-    { url = "https://files.pythonhosted.org/packages/8d/f4/4ce9a05ce5ded1de3ec1c1d96cf9f9504a04e54ce0ed55cfa38619a32b8d/mypy-1.19.1-py3-none-any.whl", hash = "sha256:f1235f5ea01b7db5468d53ece6aaddf1ad0b88d9e7462b86ef96fe04995d7247", size = 2471239, upload-time = "2025-12-15T05:03:07.248Z" },
+    { url = "https://files.pythonhosted.org/packages/6e/1c/74cb1d9993236910286865679d1c616b136b2eae468493aa939431eda410/mypy-1.20.0-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:4525e7010b1b38334516181c5b81e16180b8e149e6684cee5a727c78186b4e3b", size = 14343972, upload-time = "2026-03-31T16:49:04.887Z" },
+    { url = "https://files.pythonhosted.org/packages/d5/0d/01399515eca280386e308cf57901e68d3a52af18691941b773b3380c1df8/mypy-1.20.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:a17c5d0bdcca61ce24a35beb828a2d0d323d3fcf387d7512206888c900193367", size = 13225007, upload-time = "2026-03-31T16:50:08.151Z" },
+    { url = "https://files.pythonhosted.org/packages/56/ac/b4ba5094fb2d7fe9d2037cd8d18bbe02bcf68fd22ab9ff013f55e57ba095/mypy-1.20.0-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f75ff57defcd0f1d6e006d721ccdec6c88d4f6a7816eb92f1c4890d979d9ee62", size = 13663752, upload-time = "2026-03-31T16:49:26.064Z" },
+    { url = "https://files.pythonhosted.org/packages/db/a7/460678d3cf7da252d2288dad0c602294b6ec22a91932ec368cc11e44bb6e/mypy-1.20.0-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:b503ab55a836136b619b5fc21c8803d810c5b87551af8600b72eecafb0059cb0", size = 14532265, upload-time = "2026-03-31T16:53:55.077Z" },
+    { url = "https://files.pythonhosted.org/packages/a3/3e/051cca8166cf0438ae3ea80e0e7c030d7a8ab98dffc93f80a1aa3f23c1a2/mypy-1.20.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:1973868d2adbb4584a3835780b27436f06d1dc606af5be09f187aaa25be1070f", size = 14768476, upload-time = "2026-03-31T16:50:34.587Z" },
+    { url = "https://files.pythonhosted.org/packages/be/66/8e02ec184f852ed5c4abb805583305db475930854e09964b55e107cdcbc4/mypy-1.20.0-cp311-cp311-win_amd64.whl", hash = "sha256:2fcedb16d456106e545b2bfd7ef9d24e70b38ec252d2a629823a4d07ebcdb69e", size = 10818226, upload-time = "2026-03-31T16:53:15.624Z" },
+    { url = "https://files.pythonhosted.org/packages/13/4b/383ad1924b28f41e4879a74151e7a5451123330d45652da359f9183bcd45/mypy-1.20.0-cp311-cp311-win_arm64.whl", hash = "sha256:379edf079ce44ac8d2805bcf9b3dd7340d4f97aad3a5e0ebabbf9d125b84b442", size = 9750091, upload-time = "2026-03-31T16:54:12.162Z" },
+    { url = "https://files.pythonhosted.org/packages/be/dd/3afa29b58c2e57c79116ed55d700721c3c3b15955e2b6251dd165d377c0e/mypy-1.20.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:002b613ae19f4ac7d18b7e168ffe1cb9013b37c57f7411984abbd3b817b0a214", size = 14509525, upload-time = "2026-03-31T16:55:01.824Z" },
+    { url = "https://files.pythonhosted.org/packages/54/eb/227b516ab8cad9f2a13c5e7a98d28cd6aa75e9c83e82776ae6c1c4c046c7/mypy-1.20.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:a9336b5e6712f4adaf5afc3203a99a40b379049104349d747eb3e5a3aa23ac2e", size = 13326469, upload-time = "2026-03-31T16:51:41.23Z" },
+    { url = "https://files.pythonhosted.org/packages/57/d4/1ddb799860c1b5ac6117ec307b965f65deeb47044395ff01ab793248a591/mypy-1.20.0-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f13b3e41bce9d257eded794c0f12878af3129d80aacd8a3ee0dee51f3a978651", size = 13705953, upload-time = "2026-03-31T16:48:55.69Z" },
+    { url = "https://files.pythonhosted.org/packages/c5/b7/54a720f565a87b893182a2a393370289ae7149e4715859e10e1c05e49154/mypy-1.20.0-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:9804c3ad27f78e54e58b32e7cb532d128b43dbfb9f3f9f06262b821a0f6bd3f5", size = 14710363, upload-time = "2026-03-31T16:53:26.948Z" },
+    { url = "https://files.pythonhosted.org/packages/b2/2a/74810274848d061f8a8ea4ac23aaad43bd3d8c1882457999c2e568341c57/mypy-1.20.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:697f102c5c1d526bdd761a69f17c6070f9892eebcb94b1a5963d679288c09e78", size = 14947005, upload-time = "2026-03-31T16:50:17.591Z" },
+    { url = "https://files.pythonhosted.org/packages/77/91/21b8ba75f958bcda75690951ce6fa6b7138b03471618959529d74b8544e2/mypy-1.20.0-cp312-cp312-win_amd64.whl", hash = "sha256:0ecd63f75fdd30327e4ad8b5704bd6d91fc6c1b2e029f8ee14705e1207212489", size = 10880616, upload-time = "2026-03-31T16:52:19.986Z" },
+    { url = "https://files.pythonhosted.org/packages/8a/15/3d8198ef97c1ca03aea010cce4f1d4f3bc5d9849e8c0140111ca2ead9fdd/mypy-1.20.0-cp312-cp312-win_arm64.whl", hash = "sha256:f194db59657c58593a3c47c6dfd7bad4ef4ac12dbc94d01b3a95521f78177e33", size = 9813091, upload-time = "2026-03-31T16:53:44.385Z" },
+    { url = "https://files.pythonhosted.org/packages/d6/a7/f64ea7bd592fa431cb597418b6dec4a47f7d0c36325fec7ac67bc8402b94/mypy-1.20.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:b20c8b0fd5877abdf402e79a3af987053de07e6fb208c18df6659f708b535134", size = 14485344, upload-time = "2026-03-31T16:49:16.78Z" },
+    { url = "https://files.pythonhosted.org/packages/bb/72/8927d84cfc90c6abea6e96663576e2e417589347eb538749a464c4c218a0/mypy-1.20.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:367e5c993ba34d5054d11937d0485ad6dfc60ba760fa326c01090fc256adf15c", size = 13327400, upload-time = "2026-03-31T16:53:08.02Z" },
+    { url = "https://files.pythonhosted.org/packages/ab/4a/11ab99f9afa41aa350178d24a7d2da17043228ea10f6456523f64b5a6cf6/mypy-1.20.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f799d9db89fc00446f03281f84a221e50018fc40113a3ba9864b132895619ebe", size = 13706384, upload-time = "2026-03-31T16:52:28.577Z" },
+    { url = "https://files.pythonhosted.org/packages/42/79/694ca73979cfb3535ebfe78733844cd5aff2e63304f59bf90585110d975a/mypy-1.20.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:555658c611099455b2da507582ea20d2043dfdfe7f5ad0add472b1c6238b433f", size = 14700378, upload-time = "2026-03-31T16:48:45.527Z" },
+    { url = "https://files.pythonhosted.org/packages/84/24/a022ccab3a46e3d2cdf2e0e260648633640eb396c7e75d5a42818a8d3971/mypy-1.20.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:efe8d70949c3023698c3fca1e94527e7e790a361ab8116f90d11221421cd8726", size = 14932170, upload-time = "2026-03-31T16:49:36.038Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/9b/549228d88f574d04117e736f55958bd4908f980f9f5700a07aeb85df005b/mypy-1.20.0-cp313-cp313-win_amd64.whl", hash = "sha256:f49590891d2c2f8a9de15614e32e459a794bcba84693c2394291a2038bbaaa69", size = 10888526, upload-time = "2026-03-31T16:50:59.827Z" },
+    { url = "https://files.pythonhosted.org/packages/91/17/15095c0e54a8bc04d22d4ff06b2139d5f142c2e87520b4e39010c4862771/mypy-1.20.0-cp313-cp313-win_arm64.whl", hash = "sha256:76a70bf840495729be47510856b978f1b0ec7d08f257ca38c9d932720bf6b43e", size = 9816456, upload-time = "2026-03-31T16:49:59.537Z" },
+    { url = "https://files.pythonhosted.org/packages/4e/0e/6ca4a84cbed9e62384bc0b2974c90395ece5ed672393e553996501625fc5/mypy-1.20.0-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:0f42dfaab7ec1baff3b383ad7af562ab0de573c5f6edb44b2dab016082b89948", size = 14483331, upload-time = "2026-03-31T16:52:57.999Z" },
+    { url = "https://files.pythonhosted.org/packages/7d/c5/5fe9d8a729dd9605064691816243ae6c49fde0bd28f6e5e17f6a24203c43/mypy-1.20.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:31b5dbb55293c1bd27c0fc813a0d2bb5ceef9d65ac5afa2e58f829dab7921fd5", size = 13342047, upload-time = "2026-03-31T16:54:21.555Z" },
+    { url = "https://files.pythonhosted.org/packages/4c/33/e18bcfa338ca4e6b2771c85d4c5203e627d0c69d9de5c1a2cf2ba13320ba/mypy-1.20.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:49d11c6f573a5a08f77fad13faff2139f6d0730ebed2cfa9b3d2702671dd7188", size = 13719585, upload-time = "2026-03-31T16:51:53.89Z" },
+    { url = "https://files.pythonhosted.org/packages/6b/8d/93491ff7b79419edc7eabf95cb3b3f7490e2e574b2855c7c7e7394ff933f/mypy-1.20.0-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:7d3243c406773185144527f83be0e0aefc7bf4601b0b2b956665608bf7c98a83", size = 14685075, upload-time = "2026-03-31T16:54:04.464Z" },
+    { url = "https://files.pythonhosted.org/packages/b5/9d/d924b38a4923f8d164bf2b4ec98bf13beaf6e10a5348b4b137eadae40a6e/mypy-1.20.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:a79c1eba7ac4209f2d850f0edd0a2f8bba88cbfdfefe6fb76a19e9d4fe5e71a2", size = 14919141, upload-time = "2026-03-31T16:54:51.785Z" },
+    { url = "https://files.pythonhosted.org/packages/59/98/1da9977016678c0b99d43afe52ed00bb3c1a0c4c995d3e6acca1a6ebb9b4/mypy-1.20.0-cp314-cp314-win_amd64.whl", hash = "sha256:00e047c74d3ec6e71a2eb88e9ea551a2edb90c21f993aefa9e0d2a898e0bb732", size = 11050925, upload-time = "2026-03-31T16:51:30.758Z" },
+    { url = "https://files.pythonhosted.org/packages/5e/e3/ba0b7a3143e49a9c4f5967dde6ea4bf8e0b10ecbbcca69af84027160ee89/mypy-1.20.0-cp314-cp314-win_arm64.whl", hash = "sha256:931a7630bba591593dcf6e97224a21ff80fb357e7982628d25e3c618e7f598ef", size = 10001089, upload-time = "2026-03-31T16:49:43.632Z" },
+    { url = "https://files.pythonhosted.org/packages/12/28/e617e67b3be9d213cda7277913269c874eb26472489f95d09d89765ce2d8/mypy-1.20.0-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:26c8b52627b6552f47ff11adb4e1509605f094e29815323e487fc0053ebe93d1", size = 15534710, upload-time = "2026-03-31T16:52:12.506Z" },
+    { url = "https://files.pythonhosted.org/packages/6e/0c/3b5f2d3e45dc7169b811adce8451679d9430399d03b168f9b0489f43adaa/mypy-1.20.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:39362cdb4ba5f916e7976fccecaab1ba3a83e35f60fa68b64e9a70e221bb2436", size = 14393013, upload-time = "2026-03-31T16:54:41.186Z" },
+    { url = "https://files.pythonhosted.org/packages/a3/49/edc8b0aa145cc09c1c74f7ce2858eead9329931dcbbb26e2ad40906daa4e/mypy-1.20.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:34506397dbf40c15dc567635d18a21d33827e9ab29014fb83d292a8f4f8953b6", size = 15047240, upload-time = "2026-03-31T16:54:31.955Z" },
+    { url = "https://files.pythonhosted.org/packages/42/37/a946bb416e37a57fa752b3100fd5ede0e28df94f92366d1716555d47c454/mypy-1.20.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:555493c44a4f5a1b58d611a43333e71a9981c6dbe26270377b6f8174126a0526", size = 15858565, upload-time = "2026-03-31T16:53:36.997Z" },
+    { url = "https://files.pythonhosted.org/packages/2f/99/7690b5b5b552db1bd4ff362e4c0eb3107b98d680835e65823fbe888c8b78/mypy-1.20.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:2721f0ce49cb74a38f00c50da67cb7d36317b5eda38877a49614dc018e91c787", size = 16087874, upload-time = "2026-03-31T16:52:48.313Z" },
+    { url = "https://files.pythonhosted.org/packages/aa/76/53e893a498138066acd28192b77495c9357e5a58cc4be753182846b43315/mypy-1.20.0-cp314-cp314t-win_amd64.whl", hash = "sha256:47781555a7aa5fedcc2d16bcd72e0dc83eb272c10dd657f9fb3f9cc08e2e6abb", size = 12572380, upload-time = "2026-03-31T16:49:52.454Z" },
+    { url = "https://files.pythonhosted.org/packages/76/9c/6dbdae21f01b7aacddc2c0bbf3c5557aa547827fdf271770fe1e521e7093/mypy-1.20.0-cp314-cp314t-win_arm64.whl", hash = "sha256:c70380fe5d64010f79fb863b9081c7004dd65225d2277333c219d93a10dad4dd", size = 10381174, upload-time = "2026-03-31T16:51:20.179Z" },
+    { url = "https://files.pythonhosted.org/packages/21/66/4d734961ce167f0fd8380769b3b7c06dbdd6ff54c2190f3f2ecd22528158/mypy-1.20.0-py3-none-any.whl", hash = "sha256:a6e0641147cbfa7e4e94efdb95c2dab1aff8cfc159ded13e07f308ddccc8c48e", size = 2636365, upload-time = "2026-03-31T16:51:44.911Z" },
 ]
 
 [[package]]
@@ -2485,7 +2496,7 @@ wheels = [
 
 [[package]]
 name = "turnstone"
-version = "0.9.9"
+version = "1.0.2"
 source = { editable = "." }
 dependencies = [
     { name = "alembic" },