# Protected request execution

Protected SQL, RCON, and management-program work uses the job channel for its
lease and a separate one-time input route for its approved text:

- capabilities: `remote.run.protected.sql`, `remote.run.protected.rcon`, and
  `remote.run.program.command`;
- input route: `POST /api/v1/run/jobs/protected-request-input`;
- assignment input ref: `input://protected-request/<job-id>`;
- adapter kinds: `protected-sql`, `protected-rcon`, and `protected-program`.

The signed input request contains the Run endpoint/session, job ID, lease,
attempt, and fencing token. Platform returns only the matching job/server/Run
identity, fencing token, explicit authorization, approved/unexpired state,
claimed queue state, protected request kind,
logical transport/target keys, and bounded request text. Neither direction may
carry a DSN, database path, password, socket, host path, shell, or raw
connection.

Run validates all assignment and response bindings again immediately before
dispatch. A protected request must have exactly one attempt, a non-zero fencing
token, explicit authorization, an `approved` state, a `claimed` queue state, a
future expiry, a capability-kind match, and exact transport/target identity
matches. The request text is never written to the job journal or terminal
result.

Transport implementations are registered locally by `(kind, transportKey)` and
resolve any private connection configuration inside Run. A management-program
handler is an application protocol handler, not a host process or OS shell.
Unknown transport operations, request formats, or fields return the terminal
safe result `protected_request_unknown`; other transport failures use bounded
diagnostics without forwarding handler errors or response bodies. These errors
affect only the current request.

Management-program stdout and stderr are bounded, redacted, and sent to the
durable log channel with source `management-program` and streams
`management-program.stdout` / `management-program.stderr`. They are not file
execution logs and are never embedded in job result content.