Acknowledge Donmai's durable privileged-verification claim
Runtime-JWT-only, receiver-bound CAS for `rensei.verify.run`. The strict JSON body is limited to 4096 bytes. This is the only transition from reservation (`delivered`) to durable local claim (`claimed`); replays return retained duplicate receipt bytes and changed authority conflicts.
workerJwtAuthorizationBearer <JWT>Short-lived worker runtime JWT minted by the platform. Claims bind the worker, project, organization, registration, and scopes.
application/json- body
schemaVersion*"rensei.verify.claim-acknowledgement.v1""rensei.verify.claim-acknowledgement.v1"invocationId*stringuuidclaimId*stringuuidclaimNowMs*integer0 <= valueworkareaLeaseClaim*Exact canonical donmai.terminal-workarea-lease-claim.v1 authority.
Canonical first or duplicate claim receipt. Digest is returned in X-Rensei-Claim-Acknowledgement-Receipt-Sha256.
curl -X POST 'https://app.rensei.ai/api/daemon/plugin-verbs/claim-acknowledgement' \ -H 'Content-Type: application/json' \ -d '{ "schemaVersion": "rensei.verify.claim-acknowledgement.v1", "invocationId": "e9725468-0858-4dbb-af72-1e49c8254d68", "claimId": "88057929-7728-4a26-8396-f965dcc8b947", "claimNowMs": 0, "workareaLeaseClaim": {}}'Fetch the bridge-adapter keyset, a current freshness statement, and the binary policy table.
Daemon trust bundle for declarative local-bridge adapters (ADR-2026-09-23 D7). The keyset and its freshness statement always travel together. 503 `adapter_trust_unavailable` is retryable. `consents` (D8) lists the calling host's unrevoked binary consents: {binaryName, subcommandSet, subcommandSetSha256, versionConstraint, hostParams, consentedAt}. Only a runtime-JWT worker whose host resolves gets rows, and only its own host's; every other caller gets []. Consents are authenticated, not signed: the daemon applies them as a policy change (permit what is listed, drop what is not) intersected with its host floor.
Poll for a pending plugin verb invocation
The daemon polls this endpoint to pick up plugin verb invocations queued by workflow engine steps. Returns the oldest pending invocation for the daemon's org/project scope, atomically marking it as in-flight. Returns `{ invocationId: null }` when the queue is empty or the daemon lost a race. Auth: `Bearer rsk_*` via `getCliOrSessionAuth` OR runtime JWT (`authenticateDaemon`).