Submesh 0.5 - header carry + shared submesh freq + op_count + Scan UI + exo-structure docs

PAPER.md

@@ -340,3 +340,72 @@ assignment as the natural next evolution.
 ---
 
 *Submitted for review. Benchmark code and implementation: https://github.com/Ig0tU/SignalMesh*
+
+
+---
+
+## Addendum: Runtime Without The Runtime
+
+### Exo-Structure
+
+The Submesh Protocol wraps any origin — a URL, a hosted web app, later a local
+binary or repo — from the OUTSIDE. Nothing is embedded, hosted, or shipped. The
+target service is untouched; only its outside gets a handle. The mesh points
+AT the runtime, wearing it like a glove.
+
+We call this pattern **exo-structure**: an external skeleton around software.
+It gives you coord-addressable handles into a service's behavior without
+containing the service itself. Docker, K8s, Lambda, and WASM all EMBED runtime —
+you host, ship, permission, and update the thing. Submesh does the opposite:
+it points AT the thing from outside, at zero cost to the target. GitHub
+doesn't know it's wrapped. Hyperagent won't either.
+
+### State plane, Execution plane, Auth plane — all exo
+
+SignalMesh already inverted STATE — context without a context server,
+broadcast/tune without a message broker, coordinates without a service
+registry. That was exo-structure for state.
+
+The Submesh extends the inversion to EXECUTION. A runtime's behavior is
+available without ever running it: `POST /api/submesh/wrap` reads the target's
+`/openapi.json` (or accepts a user-provided manifest) and emits one coord per
+operation. `POST /api/submesh/call` piggybacks that coord to invoke the real
+service and streams the result envelope back onto the mesh — where any tuned
+agent receives it without polling.
+
+Auth is exo too. `POST /api/submesh/session` attaches cookies AND/OR headers
+scoped to an origin. On `/call`, the mesh injects them into the outbound
+request — same trust boundary as an autofilled Submit Payment: user-triggered,
+local-side, and the credential the target already accepted IS the credential.
+Values live in memory only; only 8-char hashes are retained for provenance.
+
+### Fractal
+
+Every wrapped origin is itself reachable through the mesh, and can in turn
+host its own submesh, which can be wrapped, ad infinitum. The self-wrap demo
+in Phase 0 proved this: the SignalMesh Space wrapped itself, generated 54
+coord-handles into its own routes, and called back into itself through those
+coords. Exo on exo. No new infrastructure at any layer.
+
+### Contract
+
+- Discovery: `POST /api/submesh/wrap { origin, cookies?, headers?, manifest? }` returns coord list.
+- Session attach: `POST /api/submesh/session { origin, cookies?, headers? }` scopes credentials to origin.
+- Invoke: `POST /api/submesh/call { coord, input, cookies?, headers? }` executes a real HTTP round-trip and broadcasts the result envelope.
+- Ambient reception: `GET /api/submesh/stream` (SSE) or `POST /api/tune_in { keywords: ["submesh"] }`.
+- Introspection: `GET /api/submesh/nodes`, `GET /api/submesh/health`.
+- Scan UI: `GET /api/submesh/ui` — paste-based session sync page.
+
+All under the existing `X-SignalMesh-Key` gate. Free tier: `smesh-free-demo`
+(200 calls / 24h). Paid: personal key, unlimited.
+
+### What this unlocks
+
+- Any hosted service becomes agent-callable through the SAME code path as any
+  other — no per-service adapter written by hand.
+- A user's authenticated browsing surface becomes an agent's callable surface:
+  same threads, same repos, same private views, no re-auth ritual.
+- Fleet-scale ambient sharing of every call result: one agent calls, all tuned
+  agents hear the envelope, no polling.
+- The service-integration long tail collapses to a Scan click and a POST.
+

core/submesh.py

@@ -1,15 +1,42 @@
 """
-SignalMesh — Submesh Protocol (Phase 0)
-
-Wraps any origin (URL / web-app; later: local binary / repo via nicoli) into
-coordinate-addressable tools on the mesh. Browser-session cookies for the
-origin are stored scoped to that origin and passed through as request headers
-on `/api/submesh/call` — same trust model as an autofilled Submit Payment.
+SignalMesh — Submesh Protocol
+Exo-structure: a runtime's behavior without ever running it.
+
+The Submesh wraps any origin (URL / web-app; later: local binary / repo via
+nicoli) into coordinate-addressable tools on the mesh. Nothing is embedded,
+hosted, or shipped — the target service is untouched; only its outside gets
+a handle. The mesh points AT the runtime from outside, wearing it like a
+glove.
+
+Auth carry (cookies + headers) is how the exo-structure inherits the user's
+reach — its skin is the browser's skin. Same trust model as an autofilled
+Submit Payment: user-triggered, local-side, and the credential the target
+already accepted IS the credential.
+
+SignalMesh already inverted STATE (context without a context server,
+broadcast/tune without a message broker, coordinates without a service
+registry). The Submesh extends the same inversion to EXECUTION — you get
+a runtime's behavior without ever running it. State plane exo, execution
+plane exo, auth plane exo. Full skeleton, no viscera.
+
+Contrast: Docker / K8s / Lambda / WASM all EMBED runtime — you host, ship,
+permission, and update the thing. Submesh points AT the thing from outside,
+at zero cost to the target. GitHub doesn't know it's wrapped. Hyperagent
+won't either.
 
 Additive only: no changes to existing broadcast/ingest/manifest handlers.
 Mounted from signalmesh_api.py via `include_router(make_router(...))`.
 
-Author: Ig0tU (SignalMesh) — Submesh Protocol Phase 0
+Endpoints:
+  GET  /api/submesh/health      — liveness + counts
+  GET  /api/submesh/ui          — paste-based Scan UI (attach session)
+  POST /api/submesh/wrap        — wrap an origin, emit coord list
+  GET  /api/submesh/nodes       — list wrapped nodes
+  POST /api/submesh/session     — attach cookies AND/OR headers to an origin
+  POST /api/submesh/call        — invoke a coord with session carry
+  GET  /api/submesh/stream      — SSE stream of events
+
+Author: Ig0tU (SignalMesh) — Submesh Protocol
 """
 from __future__ import annotations
 
@@ -23,13 +50,16 @@ from urllib.parse import urlparse
 
 import httpx
 from fastapi import APIRouter, Header, HTTPException
-from fastapi.responses import StreamingResponse
+from fastapi.responses import HTMLResponse, StreamingResponse
 from pydantic import BaseModel
 
+# ── Shared broadcast frequency for keyword tune-in ────────────────────────────
+_SUBMESH_FREQ = "submesh"
+
 # ── In-memory Phase-0 stores (SQLite promotion planned for Phase 1) ──────────
 _NODES:    Dict[str, dict] = {}   # origin_slug -> node record
 _COORDS:   Dict[str, dict] = {}   # coord       -> {origin_slug, op}
-_SESSIONS: Dict[str, dict] = {}   # origin_slug -> {cookies, expires, hashes}
+_SESSIONS: Dict[str, dict] = {}   # origin_slug -> {cookies, headers, expires, ...}
 _LOG:      List[dict]      = []   # rolling event log for /stream
 _LOG_MAX   = 500
 
@@ -39,6 +69,7 @@ class WrapReq(BaseModel):
     origin: str
     kind: str = "url"                 # "url" | "manifest" | "nicoli" (Phase 0.5)
     cookies: Any = None               # list[dict] | dict | JSON str | Netscape text
+    headers: Any = None               # dict | list[{name,value}] | JSON str | "H: v" lines
     manifest: Optional[dict] = None
     scan_openapi: bool = True         # try /openapi.json when kind=url
 
@@ -47,11 +78,13 @@ class CallReq(BaseModel):
     coord: str
     input: dict = {}
     cookies: Any = None               # per-call override; else pulls from session store
+    headers: Any = None               # per-call override; else pulls from session store
 
 
 class SessionReq(BaseModel):
     origin: str
-    cookies: Any
+    cookies: Any = None
+    headers: Any = None
     ttl_ms: int = 24 * 3600 * 1000    # default 24h
 
 # ── Helpers ───────────────────────────────────────────────────────────────────
@@ -100,10 +133,43 @@ def _normalize_cookies(raw: Any) -> List[dict]:
     return []
 
 
-def _cookie_hashes(cookies: List[dict]) -> List[str]:
-    """Provenance only — cookie VALUES never leave memory / never logged."""
-    return [hashlib.sha256(f"{c.get('name','')}:{c.get('value','')}".encode()).hexdigest()[:8]
-            for c in cookies]
+def _normalize_headers(raw: Any) -> List[dict]:
+    """Accept dict | list[{name,value}] | JSON str | 'H: v' lines. Return normalized list."""
+    if raw is None:
+        return []
+    if isinstance(raw, dict):
+        return [{"name": str(k), "value": str(v)} for k, v in raw.items()]
+    if isinstance(raw, list):
+        out: List[dict] = []
+        for h in raw:
+            if isinstance(h, dict) and "name" in h and "value" in h:
+                out.append({"name": str(h["name"]), "value": str(h["value"])})
+        return out
+    if isinstance(raw, str):
+        s = raw.strip()
+        if s.startswith("{") or s.startswith("["):
+            try:
+                return _normalize_headers(json.loads(s))
+            except Exception:
+                pass
+        out: List[dict] = []
+        for line in s.splitlines():
+            line = line.strip()
+            if not line or line.startswith("#"):
+                continue
+            if ":" in line:
+                name, _, value = line.partition(":")
+                name, value = name.strip(), value.strip()
+                if name and value:
+                    out.append({"name": name, "value": value})
+        return out
+    return []
+
+
+def _pair_hashes(pairs: List[dict]) -> List[str]:
+    """Provenance only — cookie/header VALUES never leave memory / never logged."""
+    return [hashlib.sha256(f"{p.get('name','')}:{p.get('value','')}".encode()).hexdigest()[:8]
+            for p in pairs]
 
 
 async def _fetch_openapi(base: str) -> Optional[dict]:
@@ -175,6 +241,252 @@ def _default_url_ops(slug: str, base: str) -> List[dict]:
         "requires_body": False,
     }]
 
+
+def _broadcast_dual(signal_registry, per_slug_freq: str, source_type: str,
+                    data: dict, metadata: dict) -> None:
+    """
+    Emit each event twice: once on the per-origin frequency (submesh.node.<slug>
+    or submesh.call.<slug>) for scoped tuning, once on the shared _SUBMESH_FREQ
+    ("submesh") for global keyword tune-in. Best-effort; failures swallowed.
+    """
+    for freq in (per_slug_freq, _SUBMESH_FREQ):
+        try:
+            signal_registry.broadcast(
+                name=freq, source_type=source_type,
+                data=data, metadata=metadata,
+            )
+        except Exception:
+            pass
+
+
+def _build_session_record(cookies: List[dict], headers: List[dict], ttl_s: float) -> dict:
+    return {
+        "cookies":        cookies,
+        "headers":        headers,
+        "expires":        time.time() + ttl_s,
+        "cookie_hashes":  _pair_hashes(cookies),
+        "header_hashes":  _pair_hashes(headers),
+    }
+
+# ── Scan UI (paste-based session sync page) ──────────────────────────────────
+# Neutral chrome / restrained palette — no generic AI gradient look.
+
+_SCAN_UI = """<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<title>SignalMesh · Submesh Scan</title>
+<style>
+* { margin:0; padding:0; box-sizing:border-box }
+:root {
+  --bg:#0c0e11; --panel:#14181d; --panel2:#1a1f26; --panel3:#22282f;
+  --line:#242b33; --line2:#2f3742;
+  --text:#e7e5df; --muted:#8b929c; --dim:#5b626c;
+  --accent:#46d39a; --accent-dim:#2f8865;
+  --warn:#e0a848; --error:#d15656;
+  --mono:ui-monospace,SFMono-Regular,Menlo,monospace;
+  --font:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif;
+}
+html, body { height:100% }
+body {
+  background:var(--bg); color:var(--text); font-family:var(--font);
+  min-height:100vh; padding:32px 24px;
+}
+.wrap { max-width:820px; margin:0 auto }
+header { border-bottom:1px solid var(--line); padding-bottom:20px; margin-bottom:28px }
+h1 { font-size:1.6rem; font-weight:600; letter-spacing:.2px; margin-bottom:6px }
+h1 .a { color:var(--accent) }
+.sub { color:var(--muted); font-size:.9rem; line-height:1.55; max-width:640px }
+h2 { font-size:1rem; font-weight:600; margin:24px 0 10px; letter-spacing:.3px }
+.card {
+  background:var(--panel); border:1px solid var(--line); border-radius:8px;
+  padding:20px; margin-bottom:16px;
+}
+label { display:block; font-size:.72rem; color:var(--muted); margin-bottom:6px;
+        letter-spacing:.4px; text-transform:uppercase }
+input[type=text], input[type=password], textarea, select {
+  width:100%; background:var(--panel2); border:1px solid var(--line2); color:var(--text);
+  padding:10px 12px; border-radius:6px; font-family:var(--mono); font-size:.85rem;
+  outline:none; transition:border .15s;
+}
+input:focus, textarea:focus, select:focus { border-color:var(--accent) }
+textarea { resize:vertical; min-height:110px; line-height:1.5 }
+.hint { color:var(--dim); font-size:.75rem; margin-top:6px; line-height:1.5 }
+.row { margin-bottom:16px }
+.btn-row { display:flex; gap:10px; align-items:center; margin-top:6px; flex-wrap:wrap }
+button {
+  background:var(--accent); color:#0c0e11; border:0; padding:10px 22px; border-radius:6px;
+  font-weight:600; font-size:.9rem; cursor:pointer; transition:background .15s;
+  font-family:var(--font);
+}
+button:hover:not(:disabled) { background:var(--accent-dim); color:var(--text) }
+button:disabled { opacity:.45; cursor:not-allowed }
+button.ghost { background:transparent; color:var(--muted); border:1px solid var(--line2) }
+button.ghost:hover:not(:disabled) { background:var(--panel2); color:var(--text) }
+#out {
+  background:var(--panel3); border:1px solid var(--line2); border-radius:6px;
+  padding:14px; font-family:var(--mono); font-size:.78rem; color:var(--muted);
+  white-space:pre-wrap; word-break:break-word; max-height:400px; overflow:auto;
+  margin-top:16px; display:none;
+}
+#out.ok { border-color:var(--accent-dim); color:var(--text) }
+#out.err { border-color:var(--error); color:var(--warn) }
+.wordmark { font-family:var(--mono); font-size:.72rem; color:var(--dim); letter-spacing:.5px }
+a { color:var(--accent); text-decoration:none }
+a:hover { text-decoration:underline }
+kbd {
+  font-family:var(--mono); font-size:.72rem; background:var(--panel3);
+  padding:2px 6px; border-radius:3px; border:1px solid var(--line2);
+}
+.meta { color:var(--dim); font-size:.75rem; margin-top:8px; font-family:var(--mono) }
+</style>
+</head>
+<body>
+<div class="wrap">
+
+<header>
+  <div class="wordmark">SIGNALMESH · SUBMESH</div>
+  <h1>Scan <span class="a">&rarr;</span> attach your session to an origin</h1>
+  <p class="sub">
+    Paste cookies (Netscape / JSON) and/or headers (KV pairs or JSON) that your browser
+    already carries for a target origin. The submesh stores them scoped to that origin
+    and pipes them through on every <kbd>POST /api/submesh/call</kbd> to matching coords.
+    Values live in memory only; never logged, only 8-char hashes retained for provenance.
+    Same trust boundary as an autofilled <em>Submit Payment</em>: user-triggered, local-side,
+    and the credential the target already accepted IS the credential.
+  </p>
+</header>
+
+<div class="card">
+  <h2>1. Auth key</h2>
+  <div class="row">
+    <label for="key">X-SignalMesh-Key</label>
+    <input type="password" id="key" placeholder="smesh-free-demo" value="smesh-free-demo"/>
+    <div class="hint">Your submesh API key. Defaults to the free demo tier.</div>
+  </div>
+</div>
+
+<div class="card">
+  <h2>2. Target origin</h2>
+  <div class="row">
+    <label for="origin">Origin URL</label>
+    <input type="text" id="origin" placeholder="https://github.com"/>
+    <div class="hint">The service you want the mesh to reach AS YOU. Include scheme.</div>
+  </div>
+</div>
+
+<div class="card">
+  <h2>3. Session material (cookies + / OR headers)</h2>
+  <div class="row">
+    <label for="cookies">Cookies</label>
+    <textarea id="cookies" placeholder='JSON: [{"name":"user_session","value":"..."},{"name":"logged_in","value":"yes"}]
+Or Netscape cookies.txt: .github.com  TRUE  /  TRUE  0  user_session  abc123...
+Or object: {"user_session":"abc123","logged_in":"yes"}'></textarea>
+    <div class="hint">
+      Fastest capture in Chrome/Brave DevTools: <kbd>Application &rarr; Storage &rarr; Cookies &rarr;</kbd>
+      your origin, copy the rows you need. Values are never logged.
+    </div>
+  </div>
+  <div class="row">
+    <label for="headers">Headers</label>
+    <textarea id="headers" placeholder='JSON: {"Authorization":"Bearer ghp_...","X-GitHub-Api-Version":"2022-11-28"}
+Or lines: Authorization: Bearer ghp_...
+X-API-Key: your_key'></textarea>
+    <div class="hint">
+      For header-based auth (GitHub Bearer, HF X-SignalMesh-Key, etc.). Same in-memory scoping.
+    </div>
+  </div>
+  <div class="row">
+    <label for="ttl">TTL (hours)</label>
+    <input type="text" id="ttl" placeholder="24" value="24"/>
+    <div class="hint">Session drops from memory after this window.</div>
+  </div>
+</div>
+
+<div class="btn-row">
+  <button id="attach">Attach session</button>
+  <button id="wrap" class="ghost">Wrap + attach</button>
+  <button id="clear" class="ghost">Clear</button>
+</div>
+<div class="meta" id="meta"></div>
+
+<pre id="out"></pre>
+
+</div>
+
+<script>
+const $ = (id) => document.getElementById(id);
+const out = $('out');
+
+function show(res, ok) {
+  out.style.display = 'block';
+  out.className = ok ? 'ok' : 'err';
+  try { out.textContent = JSON.stringify(res, null, 2); }
+  catch { out.textContent = String(res); }
+}
+
+function parseMaybeJSON(s) {
+  s = (s || '').trim();
+  if (!s) return null;
+  if (s.startsWith('{') || s.startsWith('[')) {
+    try { return JSON.parse(s); } catch { return s; }
+  }
+  return s;
+}
+
+async function post(path, body) {
+  const key = $('key').value.trim() || 'smesh-free-demo';
+  const r = await fetch(path, {
+    method: 'POST',
+    headers: {'Content-Type': 'application/json', 'X-SignalMesh-Key': key},
+    body: JSON.stringify(body),
+  });
+  const data = await r.json().catch(() => ({error: 'non-JSON response', status: r.status}));
+  return {status: r.status, body: data};
+}
+
+$('attach').addEventListener('click', async () => {
+  const origin = $('origin').value.trim();
+  if (!origin) { show({error: 'origin required'}, false); return; }
+  const ttl_ms = (parseFloat($('ttl').value) || 24) * 3600 * 1000;
+  const cookies = parseMaybeJSON($('cookies').value);
+  const headers = parseMaybeJSON($('headers').value);
+  if (!cookies && !headers) { show({error: 'paste cookies or headers'}, false); return; }
+  const {status, body} = await post('/api/submesh/session', {origin, cookies, headers, ttl_ms});
+  show(body, status < 400);
+});
+
+$('wrap').addEventListener('click', async () => {
+  const origin = $('origin').value.trim();
+  if (!origin) { show({error: 'origin required'}, false); return; }
+  const cookies = parseMaybeJSON($('cookies').value);
+  const headers = parseMaybeJSON($('headers').value);
+  const {status, body} = await post('/api/submesh/wrap', {origin, kind: 'url', cookies, headers});
+  show(body, status < 400);
+});
+
+$('clear').addEventListener('click', () => {
+  $('cookies').value = ''; $('headers').value = '';
+  out.style.display = 'none';
+});
+
+(async () => {
+  try {
+    const r = await fetch('/api/submesh/nodes',
+                          {headers: {'X-SignalMesh-Key': 'smesh-free-demo'}});
+    if (r.ok) {
+      const d = await r.json();
+      $('meta').textContent = `mesh has ${d.count || 0} wrapped node(s) right now`;
+    }
+  } catch {}
+})();
+</script>
+
+</body>
+</html>
+"""
+
 # ── Router factory ────────────────────────────────────────────────────────────
 
 def make_router(*, check_key, signal_registry, sec_omega) -> APIRouter:
@@ -196,6 +508,11 @@ def make_router(*, check_key, signal_registry, sec_omega) -> APIRouter:
             "events":   len(_LOG),
         }
 
+    @router.get("/ui", response_class=HTMLResponse, include_in_schema=False)
+    def scan_ui():
+        """Paste-based Scan UI. Public HTML; POSTs from JS supply the key."""
+        return HTMLResponse(_SCAN_UI)
+
     @router.post("/wrap", summary="Wrap an origin into coordinate-addressable tools")
     async def wrap(req: WrapReq, x_signalmesh_key: Optional[str] = Header(default=None)):
         check_key(x_signalmesh_key)
@@ -230,48 +547,51 @@ def make_router(*, check_key, signal_registry, sec_omega) -> APIRouter:
             ops = _default_url_ops(slug, base)
             source = "default"
 
-        # Wrap-time cookies (optional; can also be sent later via /session)
+        # Wrap-time session material (optional; can also be sent later via /session)
         cookies = _normalize_cookies(req.cookies)
-        if cookies:
-            _SESSIONS[slug] = {
-                "cookies": cookies,
-                "expires": time.time() + 86400,
-                "hashes":  _cookie_hashes(cookies),
-            }
+        headers = _normalize_headers(req.headers)
+        if cookies or headers:
+            _SESSIONS[slug] = _build_session_record(cookies, headers, 86400.0)
 
         _NODES[slug] = {
             "origin":     origin,
             "base":       base,
             "slug":       slug,
             "ops":        ops,
+            "op_count":   len(ops),
             "source":     source,
-            "authed":     bool(cookies),
+            "authed":     bool(cookies or headers),
             "wrapped_at": time.time(),
         }
         for op in ops:
             _COORDS[op["coord"]] = {"origin_slug": slug, "op": op}
 
-        # Broadcast node registration onto the mesh — tuned agents pick it up
-        try:
-            signal_registry.broadcast(
-                name=f"submesh.node.{slug}",
-                source_type="submesh_wrap",
-                data={"origin": origin, "coords": [o["coord"] for o in ops], "authed": bool(cookies)},
-                metadata={"source": source, "op_count": len(ops)},
-            )
-        except Exception:
-            pass
+        # Broadcast node registration: per-slug + shared "submesh"
+        _broadcast_dual(
+            signal_registry,
+            per_slug_freq=f"submesh.node.{slug}",
+            source_type="submesh_wrap",
+            data={
+                "origin":   origin,
+                "coords":   [o["coord"] for o in ops],
+                "authed":   bool(cookies or headers),
+                "op_count": len(ops),
+                "source":   source,
+            },
+            metadata={"source": source, "op_count": len(ops), "slug": slug},
+        )
 
         _log({"event": "wrap", "slug": slug, "source": source,
-              "op_count": len(ops), "authed": bool(cookies)})
+              "op_count": len(ops), "authed": bool(cookies or headers)})
 
         return {
             "wrapped":       True,
             "origin":        origin,
             "slug":          slug,
             "source":        source,
-            "authed":        bool(cookies),
-            "cookie_hashes": _cookie_hashes(cookies) if cookies else [],
+            "authed":        bool(cookies or headers),
+            "cookie_hashes": _pair_hashes(cookies) if cookies else [],
+            "header_hashes": _pair_hashes(headers) if headers else [],
             "coords":        [o["coord"] for o in ops],
             "op_count":      len(ops),
         }
@@ -281,29 +601,31 @@ def make_router(*, check_key, signal_registry, sec_omega) -> APIRouter:
         check_key(x_signalmesh_key)
         return {"nodes": list(_NODES.values()), "count": len(_NODES)}
 
-    @router.post("/session", summary="Attach browser-session cookies to an origin")
+    @router.post("/session",
+                 summary="Attach browser-session cookies AND/OR auth headers to an origin")
     def session(req: SessionReq, x_signalmesh_key: Optional[str] = Header(default=None)):
         check_key(x_signalmesh_key)
         cookies = _normalize_cookies(req.cookies)
-        if not cookies:
-            raise HTTPException(400, "no valid cookies parsed from payload")
+        headers = _normalize_headers(req.headers)
+        if not cookies and not headers:
+            raise HTTPException(400, "provide at least one of cookies or headers")
         slug = _slug(req.origin)
-        _SESSIONS[slug] = {
-            "cookies": cookies,
-            "expires": time.time() + req.ttl_ms / 1000.0,
-            "hashes":  _cookie_hashes(cookies),
-        }
+        _SESSIONS[slug] = _build_session_record(cookies, headers, req.ttl_ms / 1000.0)
         if slug in _NODES:
             _NODES[slug]["authed"] = True
-        _log({"event": "session_attached", "slug": slug, "cookie_count": len(cookies)})
+        _log({"event": "session_attached", "slug": slug,
+              "cookie_count": len(cookies), "header_count": len(headers)})
         return {
             "attached":      True,
             "slug":          slug,
             "cookie_count":  len(cookies),
-            "cookie_hashes": _cookie_hashes(cookies),
+            "header_count":  len(headers),
+            "cookie_hashes": _pair_hashes(cookies),
+            "header_hashes": _pair_hashes(headers),
+            "expires_in_s":  req.ttl_ms / 1000.0,
         }
 
-    @router.post("/call", summary="Invoke a submesh coord with optional cookie carry")
+    @router.post("/call", summary="Invoke a submesh coord with cookie + header carry")
     async def call(req: CallReq, x_signalmesh_key: Optional[str] = Header(default=None)):
         check_key(x_signalmesh_key)
         entry = _COORDS.get(req.coord)
@@ -325,12 +647,15 @@ def make_router(*, check_key, signal_registry, sec_omega) -> APIRouter:
         if not safe:
             raise HTTPException(400, f"SEC-Ω blocked: {reason}")
 
-        # Resolve cookies: per-call override > stored session > none
+        # Resolve cookies + headers: per-call override > stored session > none
         cookies = _normalize_cookies(req.cookies) if req.cookies else []
-        if not cookies:
-            sess = _SESSIONS.get(slug)
-            if sess and sess["expires"] > time.time():
-                cookies = sess["cookies"]
+        headers = _normalize_headers(req.headers) if req.headers else []
+        sess = _SESSIONS.get(slug)
+        if sess and sess["expires"] > time.time():
+            if not cookies:
+                cookies = sess.get("cookies", [])
+            if not headers:
+                headers = sess.get("headers", [])
 
         method = op["method"]
         url    = op["url"]
@@ -354,10 +679,17 @@ def make_router(*, check_key, signal_registry, sec_omega) -> APIRouter:
             except Exception:
                 continue
 
+        hdrs = {"User-Agent": "SignalMesh-Submesh/0"}
+        for h in headers:
+            try:
+                hdrs[str(h["name"])] = str(h["value"])
+            except Exception:
+                continue
+
         started = time.time()
         try:
-            async with httpx.AsyncClient(follow_redirects=True, timeout=20.0, cookies=jar,
-                                         headers={"User-Agent": "SignalMesh-Submesh/0"}) as client:
+            async with httpx.AsyncClient(follow_redirects=True, timeout=20.0,
+                                         cookies=jar, headers=hdrs) as client:
                 r = await client.request(method, url, params=params, json=body)
                 ct = r.headers.get("content-type", "")
                 if "application/json" in ct:
@@ -368,8 +700,9 @@ def make_router(*, check_key, signal_registry, sec_omega) -> APIRouter:
                     "coord":         req.coord,
                     "origin_slug":   slug,
                     "status":        r.status_code,
-                    "authed":        bool(cookies),
-                    "cookie_hashes": _cookie_hashes(cookies),
+                    "authed":        bool(cookies or headers),
+                    "cookie_hashes": _pair_hashes(cookies),
+                    "header_hashes": _pair_hashes(headers),
                     "payload_type":  payload_type,
                     "payload":       payload,
                     "elapsed_ms":    int((time.time() - started) * 1000),
@@ -381,23 +714,23 @@ def make_router(*, check_key, signal_registry, sec_omega) -> APIRouter:
                 "origin_slug": slug,
                 "status":      0,
                 "error":       str(e),
-                "authed":      bool(cookies),
+                "authed":      bool(cookies or headers),
                 "elapsed_ms":  int((time.time() - started) * 1000),
             }
 
-        # Broadcast the result envelope — tuned agents receive without polling
-        try:
-            signal_registry.broadcast(
-                name=f"submesh.call.{slug}",
-                source_type="submesh_call",
-                data=envelope,
-                metadata={"coord": req.coord, "authed": bool(cookies)},
-            )
-        except Exception:
-            pass
+        # Broadcast result: per-slug + shared "submesh" frequency
+        _broadcast_dual(
+            signal_registry,
+            per_slug_freq=f"submesh.call.{slug}",
+            source_type="submesh_call",
+            data=envelope,
+            metadata={"coord": req.coord, "status": envelope.get("status"),
+                      "authed": bool(cookies or headers), "slug": slug},
+        )
 
         _log({"event": "call", "coord": req.coord,
-              "status": envelope.get("status"), "authed": bool(cookies)})
+              "status": envelope.get("status"),
+              "authed": bool(cookies or headers)})
 
         return envelope