# E2E Spec: AgentTeam Exec Transport

## Overview

Validate the hidden `agentteam exec` transport used by agent runtimes. The runtime
executes the local `agentteam exec` command with daemon-injected environment. The
command reads the current bearer generation from a daemon-private token file and
calls the literal daemon-owned Exec route.

## Test Cases

- A daemon-launched runtime inherits the canonical Exec base URL and
  OS-account-private token-file path, but not a raw bearer token. Unix uses an
  owner-only `0700/0600` directory/file; Windows uses a protected
  current-user/SYSTEM DACL. Direct `agentteam exec` execution reads
  that file once per invocation and executes through the literal Exec-owned
  route registry.
- A daemon launched from inside an authorized runtime clears all inherited Exec
  variables before starting helpers. Runtime probes and new runtime launches
  also strip daemon ambient, shell-captured, and mixed-case Exec overrides; only
  the new runtime's canonical base URL/token-file pair is appended.
- A logical Exec surface remains bound to one runtime process while the daemon
  atomically rotates short-lived bearer generations before their default
  12-hour expiry. A process keeps using Exec without an `agent:start` command or
  runtime restart.
- A predecessor generation remains valid only until its original expiry.
  Generation issuance or file-publication failure preserves the current
  credential file and still-valid generation.
- If a token file is declared, missing, unreadable, empty, or invalid file
  content fails closed without falling back to the legacy raw-token environment
  variable. The raw-token variable remains accepted only when no file is
  declared, for runtimes launched by older daemons.
- Runtime exit or replacement, launch abort, and daemon shutdown stop renewal,
  remove the private file, revoke all generations of the logical surface, and
  drain in-flight requests. Revocation precedes cleanup; transient file-removal
  failures are retried as discoverable cleanup debt. A strong local shutdown
  waits for cleanup, while bounded/crash residue is removed after the next
  daemon acquires its singleton lock.
- Expired, revoked/inactive-lifecycle, and wrong-scope credentials produce the
  same bounded public `403` envelope while rate-limited daemon diagnostics
  preserve the distinct failure classification without bearer material.
- After authorization, an incomplete/slow action body is bounded by the local
  five-second absolute read deadline. Revoking the logical surface cancels the
  handler context and prevents a body or result that loses the revoke fence
  from being dispatched/published; shutdown drain cannot be held forever by a
  detached slow sender.
- Revoked-but-undrained surfaces continue to consume logical admission
  capacity. Per-surface (32) and global (1024) acquired-request bounds reject
  excess authenticated concurrency with a bounded conflict response before
  reading another body. Runtime-lease admission also bounds active leases,
  concurrent pre-publication activations, and retrying credential-cleanup debt
  together at 512; cleanup retries use capped exponential backoff.
- The token-file permissions protect against other OS accounts, not against a
  different Agent/runtime process running as the same login user.
- Workspace, chat, file, profile, role operations, task collaboration, review,
  project, scheduled-message, and workflow actions map to the expected Exec
  domain/name pairs and JSON arguments.
- Success and error responses are serialized only through the bounded Exec
  result envelope and remain valid JSON within the configured byte limit.