serve keeps daemon data in S3 and can require API keys
A serve daemon can now keep its data directory in an S3 bucket or any S3-compatible store with conditional writes:
./revenue-analyst start --store s3://bucket/prefixA daemon started elsewhere with the same store waits out a killed holder’s lease, restores the data and carries on.
serve apps can also require a credential on agent routes: static API keys from
code, serve.toml or SERVE_API_KEYS, OIDC, or OAuth 2.0 introspection. The
agent card stays public. At boot, serve resumes sessions active in the last
seven days and re-runs an unfinished tool call only when that is safe.
See Keep the data in a bucket, Authentication and #4515, #4518, #4485.