@bjoernrochel/sevro 0.1.0-rc.3 → 0.1.0-rc.4

package/CONTRIBUTING.md

@@ -26,8 +26,9 @@ by applicable law.
 
 ## Set up development
 
-Use Bun 1.3.13, Git, Node 24, and npm. Full suite isolation needs macOS and
-`sandbox-exec`; Linux/Windows acceptance is unverified. From a fresh checkout:
+Use Bun 1.3.13, Git, Node 24, and npm. Full suite isolation uses `sandbox-exec`
+on macOS or `bubblewrap` and `socat` on Ubuntu. Windows acceptance is unverified.
+From a fresh checkout:
 
 ```sh
 bun install --frozen-lockfile
@@ -51,8 +52,10 @@ bun run check:typescript
 It performs frozen installation, schema freshness, formatting, lint, typing,
 documentation and guide dry-run checks, tutorial examples, the real Bun suite,
 coverage integrity and thresholds, and installed-package validation. Statements
-and branches must each reach at least 95% using raw exact counts over the complete
-authored production inventory, including unimported files. The five explicitly
+and branches must each reach at least 95% using raw exact counts over the
+platform-reachable authored production inventory, including unimported files.
+The macOS and Ubuntu gates each measure their reachable host modules; the exact
+module and branch-outcome exclusions are recorded in coverage artifacts. The five explicitly
 inventoried generated AJV validators are excluded from coverage because this
 target measures authored runner behavior; their syntax, schema freshness, typed
 boundaries and runtime tests remain checked. Tests and fixtures remain linted and
@@ -70,7 +73,7 @@ Documentation checks supplement #1 rather than replacing its contract.
 
 ## Tests, fixtures, and schemas
 
-Preserve real Bun filesystem/process integration tests and macOS isolation.
+Preserve real Bun filesystem/process integration tests and native isolation.
 Use deterministic fixtures under `tests/fixtures/`; keep evaluator-only inputs
 outside candidate workspaces. Keep credentials and raw trial evidence out of Git.
 Add meaningful regression coverage for reproducible bugs. Fixtures should
@@ -104,5 +107,8 @@ native trials or remote CI results.
 
 Follow [releases](docs/releases.md): choose a new version, prepare and inspect
 the exact tarball, verify its license/provenance, and validate that artifact.
+After changing `package.json.version`, run `bun run docs:sync` to refresh the
+[current release](docs/installing.md#current-release). `check:docs`, release
+preparation, and package-install validation reject stale release documentation.
 Publication, tags, registry changes, and alternative licensing are separate
 maintainer actions; preparing a contribution does not authorize them.

package/README.md

@@ -16,15 +16,15 @@ account is required.
 ## Status and environments
 
 Sevro is under active development. The npm package is `@bjoernrochel/sevro`;
-its command is `sevro`. Release candidate `0.1.0-rc.3` includes runtime
+its command is `sevro`. The [current release](docs/installing.md#current-release) includes runtime
 configuration, native goals, selected plugin hooks, and the current licensing terms.
 Earlier `rc.1` and `rc.2` packages retain their original BSL grants.
 See [installation and release differences](docs/installing.md).
 
-Use Bun 1.3.13. The full deterministic suite and native isolation target macOS;
-bundled Codex/Claude routes and isolated shell checks need `sandbox-exec`.
+Use Bun 1.3.13. The development checkout runs native isolation on macOS with
+`sandbox-exec` and on Ubuntu with `bubblewrap` and `socat`.
 Contributor package/release checks also need Node 24 and npm.
-Linux and Windows support is unverified. The basic example uses an injected
+Windows support is unverified. The basic example uses an injected
 deterministic adapter and needs no native model credentials.
 
 ## Install and get a first result
@@ -33,9 +33,9 @@ deterministic adapter and needs no native model credentials.
 mkdir sevro-demo
 cd sevro-demo
 bun init -y
-bun add --exact @bjoernrochel/sevro@0.1.0-rc.3
 ```
 
+Install the [current release](docs/installing.md#current-release) in that directory.
 Continue with [your first evaluation](docs/getting-started.md): the exact command,
 expected `passed` result, and retained evidence. Read [installation](docs/installing.md)
 for updates, removal, and source checkouts.
@@ -72,7 +72,7 @@ environment.
 
 ## License and acknowledgements
 
-Release candidate `0.1.0-rc.3` uses the [Sevro Source Available License 1.0](LICENSE).
+The [current release](docs/installing.md#current-release) uses the [Sevro Source Available License 1.0](LICENSE).
 Use is free in every context, including commercial work and paid education.
 Selling copies, rebranded versions, or hosted access to Sevro's functionality
 requires a separate license. Modification and free redistribution remain allowed.

package/docs/builtin-graders-v1.md

@@ -38,7 +38,7 @@ The shell-check process runner accepts a bounded evaluator-owned `run` string,
 optional `expectedExitCode` and `timeoutMs`, plus `expectExact`, `expectRegex`,
 `notRegex`, and regex `flags` for stdout. Exact matching removes one final
 newline; regex matching always uses multiline mode. The runner executes with
-`sh -e`. On macOS it runs through the outer sandbox with network access denied,
+`sh -e`. On macOS and Linux it runs through the outer sandbox with network access denied,
 a credential-free environment, and caller-declared protected roots. Without a
 stdout assertion, process output is discarded. With one, the runner captures
 at most 1 MiB in memory and retains only its digest and byte length. Oversized
@@ -87,3 +87,11 @@ grading an error. Checks are grouped by source, so response and document checks
 remain independent in the same trial. Artifact outcomes retain the resolved
 path and content digest. The semantic host uses an empty workspace and receives
 the document as untrusted data.
+
+When [native transcripts are enabled](runtime-v1.md#native-transcript-access),
+shell checks and semantic hosts can read retained candidate native files through
+`SEVRO_CANDIDATE_TRANSCRIPTS`. The view has `index.json` plus a `codex/` or
+`claude/` native tree. It is read-only and separate from the grading host's own
+live native tree. Native transcripts are untrusted candidate evidence; a grader
+must not follow instructions inside them. Missing or partial capture remains
+explicit in the index and does not establish required complete evidence.

package/docs/codex-host.md

@@ -130,16 +130,16 @@ available through the engine's injected host interface and the development
 CLI's explicit `--host codex` route. Its protocol and evidence host ID is
 `sevro.host.codex`; `codex` remains the CLI route selector.
 
-`prepareMacSandboxCommand` provides the macOS shell-grading boundary. Callers
+`prepareMacSandboxCommand` and `prepareLinuxSandboxCommand` provide the shell-grading boundary. Callers
 provide absolute protected roots and a private state root; the primitive
 canonicalizes them, refuses overlap with the fixture workspace, and creates a
-temporary `sandbox-exec` profile that denies reads and writes. It fails if
-macOS isolation is unavailable. The caller releases the profile after the
+temporary native sandbox that denies reads and writes. It fails if
+isolation is unavailable. The caller releases the sandbox resources after the
 process exits. The runner assembles the same protected-root set for Codex
 candidate commands and shell grading.
 
 Codex cannot start its native sandbox inside an outer `sandbox-exec` process
-on this host. Its runner-generated permission profile therefore sets an
+on macOS. Its runner-generated permission profile therefore sets an
 explicit workspace rule, denies all other filesystem roots except minimal
 runtime files and the selected executable's install directories, and
 specifically denies protected roots and the private Codex home. An executable

package/docs/development-cli.md

@@ -107,7 +107,7 @@ The same worktree protection applies to other declared source and private roots;
 a package without Git metadata remains usable. Result and active-run storage
 stay independent through `--results-root` and `--run-state-root`.
 
-A bundled Claude Code candidate route is available on macOS:
+A bundled Claude Code candidate route is available on macOS and Linux:
 
 ```sh
 sevro run --json \
@@ -133,7 +133,7 @@ values are excluded from retained evidence and configuration digests. Pass
 `--claude-credential-file` with an absolute path to select a separate saved login.
 It accepts declared Claude
 plugin directories and explicit skill invocations from extension preparation.
-It runs candidate tools under Claude Code's native macOS sandbox with private,
+It runs candidate tools under Claude Code's native sandbox with private,
 source, and result paths denied. The route disables hooks by default and does not expose
 the Write tool. It currently supports passive candidate turns only. Use
 `--protected-root` to exclude additional private paths from the candidate's
@@ -317,8 +317,8 @@ For shell checks, add
 `--shell-isolation` and repeat `--protected-root /absolute/path` for every
 additional source worktree or private root. The engine always protects the
 selected project, results, runner source, user home, configured host homes,
-and active peer fixtures. Shell checks require macOS `sandbox-exec` in this
-development slice.
+and active peer fixtures. Shell checks require macOS `sandbox-exec` or Linux
+`bubblewrap`.
 Injected host adapters may return namespaced observations and bounded evidence
 artifacts. A case can list their IDs in `requiredEvidence`; missing or partial
 host evidence produces unavailable grading rather than a passing task. The

package/docs/documentation-quality.md

@@ -15,6 +15,17 @@ marked tutorial commands in fresh consumer/contributor directories, including
 expected verdicts and saved evidence. Candidate and released-package runs are
 reported separately. These commands create and clean temporary directories.
 
+`package.json.version` is the authoritative current version. `bun run docs:sync`
+updates only the marked [Current release](installing.md#current-release) section
+with its exact installation command. Keep its markers and heading in place;
+the command refuses missing, duplicate, or reversed markers and invalid versions.
+The rest of the page stays ordinary Markdown. `check:docs` compares this section
+without writing; release preparation and package-install validation also reject
+stale output. Run synchronization after a version bump and include the resulting
+documentation change. Link installation and update instructions to this section.
+Keep historical versions, licensing transitions, and minimum supported versions
+fixed and explain their purpose beside each reference.
+
 ## External links
 
 Run `bun run check:docs:external` separately. Transient failures are retried

package/docs/getting-started.md

@@ -7,17 +7,17 @@ This teaches the runner lifecycle, not the quality of an actual model.
 
 ## From an installed package
 
-Install the release candidate in a new directory:
+Prepare a new directory:
 
 ```sh
 mkdir sevro-demo
 cd sevro-demo
 bun init -y
-bun add --exact @bjoernrochel/sevro@0.1.0-rc.3
 ```
 
-Version `rc.3` includes the current docs and source-available license; earlier
-`rc.2` packages retain their original BSL terms. Read [version differences](installing.md#published-package-and-checkout).
+Install the [current release](installing.md#current-release) there, then return
+here to run the example. Read [version differences](installing.md#published-package-and-checkout)
+for the current docs, source-available license, and earlier BSL releases.
 
 Make the local installation available on `PATH` for this shell, then call
 `sevro` directly. Bun must also be on `PATH`.

package/docs/identity-v1.md

@@ -69,3 +69,8 @@ Selected [runtime configuration](runtime-v1.md) is retained under
 It includes declared non-secret environment values, canonical read roots,
 private seed digests, and hook authority. Per-role output paths are resolved
 only during execution; runtime placeholders remain symbolic in identity.
+Runtime roots also retain lexical aliases, metadata discovery sources,
+and skipped optional directories. Moving or
+changing the effective host grants changes identity, even when the portable
+configuration file is unchanged. External installation contents remain outside
+this digest unless explicitly captured as private seed inputs.

package/docs/installing.md

@@ -10,13 +10,26 @@ Linux and Windows are unverified.
 mkdir sevro-demo
 cd sevro-demo
 bun init -y
-bun add --exact @bjoernrochel/sevro@0.1.0-rc.3
 ```
 
+Then install the [current release](#current-release) in that directory.
+
 Run the [packaged deterministic example](getting-started.md#from-an-installed-package)
 to verify installation. It needs neither model credentials nor Darrow.
 Local installation records the selected version in the project lockfile.
 
+<!-- sevro-current-release:start -->
+
+## Current release
+
+The current release is `0.1.0-rc.4`. Install this exact version:
+
+```sh
+bun add --exact @bjoernrochel/sevro@0.1.0-rc.4
+```
+
+<!-- sevro-current-release:end -->
+
 ## Make the command available
 
 The examples call `sevro` from `PATH`. For a local installation, run this from
@@ -33,10 +46,11 @@ no adjustment is needed. Bun must also be on `PATH`: the executable uses
 
 ## Published package and checkout
 
-The commands above pin release candidate `0.1.0-rc.3`, which includes runtime
+The [current release](#current-release) includes runtime
 configuration, native goals, selected plugin hooks, current onboarding, and
 [source-available licensing terms](licensing.md). Earlier `rc.1` and `rc.2`
-packages retain BUSL-1.1. Source checkouts can include changes beyond their
+packages retain BUSL-1.1. The license transition began with `0.1.0-rc.3`.
+Source checkouts can include changes beyond their
 package version; compare the exact release tag when establishing provenance.
 
 The candidate npm package contains sources, schemas, examples, documentation,
@@ -57,14 +71,10 @@ directories; it does not publish. [Contributing](../CONTRIBUTING.md) lists check
 
 ## Update
 
-Review a release's license and compatibility, then install its exact version:
-
-```sh
-bun add --exact @bjoernrochel/sevro@0.1.0-rc.3
-```
-
-This selects `rc.3` explicitly. For later updates, substitute the intended
-published version, then rerun the example.
+Review a release's license and compatibility, then use the exact installation
+command for the [current release](#current-release) from your existing project.
+To select a different published version, substitute that exact version in the
+command, then rerun the [packaged example](getting-started.md#from-an-installed-package).
 Rollback uses the prior exact version and another verification run.
 [Releases](releases.md) explains artifact provenance.
 

package/docs/native-hosts.md

@@ -1,7 +1,8 @@
 # Run native model hosts
 
 The basic tutorial needs none of this setup. Bundled model routes and isolated
-shell checks require macOS `sandbox-exec`, a supported native CLI, and model
+shell checks require macOS `sandbox-exec` or Linux `bubblewrap` (and `socat` for
+Claude Code), a supported native CLI, and model
 authentication. Complete commands/rules live in the [CLI reference](development-cli.md)
 and [Codex host reference](codex-host.md).
 

package/docs/releases.md

@@ -7,7 +7,7 @@ exact semantic version; development versions containing `-dev` are not release
 candidates. Darrow pins the published version in development dependencies and
 its lockfile. Marketplace plugins do not depend on Sevro.
 
-Release candidate `0.1.0-rc.3` uses the current [licensing terms](licensing.md).
+The [current release](installing.md#current-release) uses the current [licensing terms](licensing.md).
 Published `rc.1` and `rc.2` retain their original BSL grants. Always select a new
 version for publication; a local development tarball does not replace an
 already published artifact.
@@ -38,11 +38,18 @@ metadata in the installed package.
 ## Maintainer workflow
 
 1. Select the license, update `package.json` to the intended release version,
-   and commit those changes. Preserve the existing public schemas and document
+   run `bun run docs:sync`, and commit those changes. Preserve the existing public schemas and document
    behavior changes. Set `publishConfig.tag` to `latest` for the recommended
    default or `next` for an opt-in preview. A prerelease does not establish full
    Darrow migration completion.
-2. Run frozen installation, typecheck, formatting, and the full test suite.
+2. On macOS with Bun 1.3.13, Node 24, npm, and `sandbox-exec`, run frozen
+   installation and the full quality gate:
+
+   ```sh
+   bun install --frozen-lockfile
+   bun run check:typescript
+   ```
+
 3. Prepare and test the exact candidate:
 
    ```sh
@@ -64,29 +71,21 @@ metadata in the installed package.
    version's evidence for updates. Roll back through a new dependency/lockfile
    commit and rerun the installed gate; never relabel failed-version evidence.
 
-## Manual release workflow
-
-`.github/workflows/release.yml` runs only through explicit dispatch against a
-release tag. Its default prepares and checks the artifact. `publish: true`
-additionally publishes that verified artifact using npm trusted publishing.
-No push or pull-request event publishes a package.
+## Local macOS publication
 
-Before the first publication, an npm owner must establish the package and its
-publishing authorization. The initial reviewed tarball can be published
-manually with an authenticated npm account:
+There is no GitHub release job. The maintainer prepares, verifies, and publishes
+the reviewed tarball from macOS with an authenticated npm account. Check its
+retained checksum immediately before publication:
 
 ```sh
-npm publish /absolute/reviewed/bjoernrochel-sevro-0.1.0-rc.1.tgz --ignore-scripts --access public --tag latest
+cd /absolute/reviewed
+shasum -a 256 -c SHA256SUMS
+npm publish ./bjoernrochel-sevro-0.1.0-rc.1.tgz --ignore-scripts --access public --tag latest
 ```
 
-After the package exists, configure its trusted publisher for GitHub owner
-`BjRo`, repository `sevro`, and workflow filename `release.yml`. The workflow
-uses a GitHub-hosted runner, Node 24, npm 11.20.0, and job-scoped `id-token: write`.
-The package repository URL must match this public repository. See npm's
-[trusted publishing documentation](https://docs.npmjs.com/trusted-publishers/).
-The workflow checks the downloaded artifact's SHA-256 before publishing and
-retains its release record. Configuring an owner or workflow does not itself
-authorize this coding session to publish or push.
+Replace the example version and distribution tag with the reviewed candidate's
+values. The package repository URL must match this public repository. Preparing
+a tarball or opening a pull request does not authorize publication.
 
 An existing published candidate can become the default without republishing:
 
@@ -99,7 +98,7 @@ Promotion changes the registry tag; it does not update the published tarball.
 
 The first published candidate was `0.1.0-rc.1`, using the owner-selected
 `BUSL-1.1` license. Its `LICENSE` preserves Darrow's terms and parameters,
-changing only the Licensed Work name and description to Sevro. Neither local
-checks nor a workflow file claim a remote CI run or publication. Darrow's exact
+changing only the Licensed Work name and description to Sevro. Local checks do
+not claim a remote CI run or publication. Darrow's exact
 registry pin, default caller switch, remaining workflow migrations, focused live validation, and
 generic runner removal remain separate extraction gates.

package/docs/results-v1.md

@@ -116,3 +116,46 @@ reports `failed` / `not_requested` / `not_assessed` with exit code `2`. A final
 message that happens to match a check cannot turn that failure into a pass.
 Claude retains its bounded event stream and, when present, up to 64 KiB of
 stderr as private host artifacts. Failure bodies do not appear in CLI diagnostics.
+
+## Native transcript bundles
+
+With [runtime transcript opt-in](runtime-v1.md#native-transcript-access), each
+bundled host captures full native files before removing its private state.
+Candidate artifact `sevro.native-transcripts.bundle` has format
+`sevro.native-transcripts.v1`. It contains `host` (`codex` or `claude`), `role`,
+native `rootSessionId` (or `null`), `completeness`, `issues`, and `files`.
+Each file records its native relative `path`, SHA-256 `sha256`, and exact bytes
+as `bytesBase64`. Decode the bytes without rewriting native records. Native
+session paths, root/child records and sidecar metadata preserve associations;
+the bundle does not normalize model, effort, timing, token, or cost statistics.
+Existing unknown metrics remain unknown.
+
+`sevro.host.native-transcripts` records the same capture state and file hashes
+without raw bytes. Semantic and advisory bundles retain their role in the
+bundle and use the existing `sevro.semantic[.<source digest>].` and
+`sevro.advisory.` artifact ID prefixes. Run/trial artifact references supply
+stable private file URLs and whole-bundle hashes after native home cleanup.
+Extensions receive these references through the existing `evaluate` protocol;
+benchmarks can use the same references and decode the native files.
+
+Capture includes native transcript-tree sidecars and refuses descendant links,
+special files and escaping paths. It is bounded to 4,096 directory entries,
+5 MiB of native file bytes and 7 MiB of encoded file metadata/content. The
+bundle remains inside the existing 8 MiB item and 32 MiB host artifact budgets;
+it groups sessions instead of spending an artifact per child. Limits produce
+`byte_limit`, `entry_limit`, or `bundle_limit` issues. Unreadable, unsafe or
+changing entries, malformed/empty native records, malformed JSON sidecars,
+an unknown/missing original session, or incomplete host
+execution produce explicit partial/unavailable capture. `complete` means the
+identified root's tree was captured within those bounds after completed host
+execution and generic syntax/basic record validation. JSONL must contain
+nonempty JSON object records with a nonempty string `type`; JSON sidecars must
+parse as JSON. UTF-8 decoding is strict. One trailing newline and CRLF are
+accepted; blank interior records, invalid encoding and truncated JSON are
+malformed. Unknown native fields and record types remain valid. Issues
+`empty_transcript`, `malformed_transcript` and `malformed_sidecar` downgrade
+capture without rewriting or discarding retained bytes. This validates basic
+structure, not native semantic correctness.
+An empty/missing native JSONL tree is `unavailable`. Failure, cancellation and
+timeout retain available native bytes with incomplete capture state. Raw
+bundles and views are private evidence and must stay out of Git.

package/docs/runtime-v1.md

@@ -53,12 +53,27 @@ shell startup overrides, subprocess injection flags, and `UV_OFFLINE` are refuse
 An inherited or explicit `PATH` must contain nonempty absolute entries. Missing
 entries are inert. Sevro grants read-only access to existing directories,
 resolved symlinked tools, and bounded installation prefixes above `bin`.
+An inaccessible individual symlink target is inert; an unreadable PATH directory
+still fails configuration. Explicitly declared read roots must remain readable.
 It does not widen a `bin` grant to the whole home, `/usr`, `/usr/local`, or
 `/opt/homebrew`. Direct versioned mise paths can reuse their existing Node or
 Python installations. A mise shim may also need explicitly declared mise data
 and configuration; inheriting `PATH` does not change the shim's own discovery
 rules. Fixture binaries keep precedence over declared host tools.
 
+When `PATH` is declared, Sevro also queries available installation metadata
+before execution. Homebrew's `--prefix` and `--cellar` identify its existing
+`Cellar`, `opt`, and `etc` support trees on macOS and Linux. The whole Homebrew
+prefix is not granted. On macOS, selected Apple tool shims (including Git,
+Python, and compiler tools) use `xcode-select --print-path` to locate their
+developer support tree. A declared `DEVELOPER_DIR` participates in that query;
+an unrelated ambient override does not. Installation locations are not assumed.
+Each query has a three-second deadline and an 8 KiB combined output limit.
+Absent providers and the known no-active-Apple-installation result add no roots.
+Other query failures, invalid metadata, or a missing declared developer override
+fail before execution. Diagnostics identify the provider and operation without
+retaining arbitrary command output.
+
 Declare supporting directories outside `PATH` with `filesystem.readOnlyRoots`:
 
 ```json
@@ -77,6 +92,43 @@ the real home are allowed only through bounded runtime grants. Source and
 configuration worktrees, evaluator inputs, credentials, results, run ownership
 state, and peer fixtures remain protected. A conflicting or broad grant fails.
 
+Use `filesystem.optionalReadOnlyRoots` for supporting directories that may not
+be installed on every host, with the same path rules as `readOnlyRoots`:
+
+```json
+{
+  "format": "sevro.runtime.v1",
+  "filesystem": {
+    "optionalReadOnlyRoots": [
+      "../public-python-installations",
+      "../public-tool-cache"
+    ]
+  }
+}
+```
+
+With `sevro.json` at the repository root, these paths name sibling support
+directories outside the protected repository. Keep them bounded to public tool
+data; directories inside the repository remain protected even when absent.
+
+Only absent directories are skipped. Invalid variables or paths, unreadable
+directories, regular files, and protected overlaps remain errors. Required roots
+still fail when absent. Effective roots retain both lexical directory paths and
+canonical targets, and both are checked against protected inputs. Native aliases
+inside granted support trees (for example, `opt/package` pointing into `Cellar`)
+remain usable. Codex may canonicalize a standalone symlink-root permission under
+protected home, denying its lexical lookup; declare the intended bounded parent
+support tree and its target rather than relying on that standalone alias.
+
+On Linux, Codex starts candidate commands from an empty filesystem with bounded
+read mounts. Sevro keeps a normal home ancestor denied by that empty-root policy
+rather than adding a native deny mount that would hide its read-only descendants.
+Protected source and credential descendants remain explicitly denied, and no
+home ancestor receives content access. If the operator's home lies inside a
+minimal system read tree such as `/usr` or `/etc`, Sevro retains its explicit deny;
+the native preflight may refuse that overlapping setup rather than expose home
+contents.
+
 ## Private writable state
 
 `runtime.seedDirectories` copies prepared public dependencies into a private
@@ -113,7 +165,7 @@ the policy does not itself prove that a goal was created or completed.
 
 `hooks.plugins` authorizes all command hooks from the named prepared plugins.
 Sevro copies immutable mounts, filters unselected hooks, and wraps selected
-handlers in a credential-free macOS sandbox. It covers default hook files,
+handlers in a credential-free macOS or Linux sandbox. It covers default hook files,
 manifest path/inline declarations in both host formats, and Markdown skill or
 agent frontmatter. Unsupported handler types and exec-form arguments fail
 instead of being skipped. The wrapper denies network access and protected
@@ -129,6 +181,61 @@ cases on their explicit project-settings route with hooks disabled. Unrelated
 user settings and hooks are not imported. Sevro does not use Claude's `--bare`
 mode, which would change authentication and behavior.
 
+## Native transcript access
+
+Set top-level `"nativeTranscripts": true` to enable live, read-only access to
+the current role's full native root and subagent transcript tree. Absent or
+`false` leaves this access and capture disabled. The selection is snapshotted
+with the runtime policy and enters configuration identity; temporary native
+homes and transcript views do not enter that identity. Codex `exec` persists
+sessions when enabled, including runs without continuation.
+
+Commands discover their own tree through `SEVRO_NATIVE_TRANSCRIPT_ROOT`.
+Codex commands also receive runner-owned `CODEX_HOME`; native
+`CODEX_THREAD_ID` selects `sessions/**/rollout-*-<thread>.jsonl`. Read the latest
+native `turn_context` for that session's `model` and `effort`. Claude shell
+commands receive a credential-free `CLAUDE_CONFIG_DIR` view whose `projects/`
+tree contains `projects/*/<CLAUDE_CODE_SESSION_ID>.jsonl` and subagent files.
+The latest native assistant `message.model` records the observed model.
+Claude supplies `CLAUDE_CODE_SESSION_ID` and `CLAUDE_EFFORT` itself; Sevro does
+not replace these with the root's requested route. Requested CLI effort is
+configuration, and is not proof of an effective child effort. Missing native
+route evidence stays unknown.
+
+Observed with Claude Code 2.1.284: a native Agent's Bash may receive the parent's
+`CLAUDE_CODE_SESSION_ID` and no `CLAUDE_EFFORT`. In that situation the environment
+pair selects the parent transcript. Analyze the child's native JSONL and
+`.meta.json` sidecar to establish its own model/session association; the
+parent's model is not the child's observed model, and missing effort remains
+unknown. Sevro preserves these native values without synthesizing a child
+context or copying the root's requested effort into the child.
+
+Native hosts keep their credential-bearing homes. Claude's host writes through
+a runner-created, canonical-bound `projects` link into the isolated source;
+runner-owned Bash and zsh startup files supply the shell compatibility view.
+These sources and startup files sit outside candidate-writable state. Commands
+cannot modify transcripts or read credential/settings siblings, evaluator
+inputs, or peer role/trial state. A fixed private namespace is protected before
+commands start, including peers created later. Pre-existing namespaces must be
+owned private directories; links and unsafe permissions fail. Ordinary
+filesystem declarations cannot authorize access to this namespace.
+Namespace read roots and seed sources, including declaration symlinks into it,
+are refused before private trees are hashed or copied.
+On Linux, Codex keeps this namespace hidden through its empty-root policy and
+mounts only runner-owned session/helper trees and retained views. It avoids an
+ancestor deny mount that would mask these narrower read-only grants. Ordinary
+declarations cannot select this exception; parent content, credentials, and
+present or future peer state receive no grants.
+
+After candidate execution, isolated shell checks and semantic/advisory hosts
+receive `SEVRO_CANDIDATE_TRANSCRIPTS`, a separate read-only retained view with
+`index.json` and `codex/` or `claude/` native relative file paths. This does not
+replace a grading host's own native home or live tree. Trusted injected adapters
+receive the same view through request `candidateTranscriptRoot`. The temporary
+view is removed after grading; stable retained artifact references remain in
+run evidence. Extensions and external benchmarks consume the
+[native transcript bundles](results-v1.md#native-transcript-bundles).
+
 ## Evidence and compatibility
 
 `configuration.redacted.runtimePolicy` retains the selected environment,
@@ -139,6 +246,12 @@ execution uses per-role paths. This binds declared setup and seed contents;
 it does not claim that every external installation file or OS dependency is
 immutable.
 
+The retained policy also records metadata providers, their selected executables
+and effective support roots, plus skipped optional paths. These values and the
+actual effective roots enter identity; private execution paths and external tool
+file contents do not. The same discovery and skip evidence reaches
+`sevro.host.runtime` observations.
+
 Bundled hosts supply `sevro.host.runtime` with the applied policy digest, role,
 environment names, read roots, and seed slots. `sevro.host.hooks` records source
 and effective plugin digests plus observed executions and their exit codes.
@@ -158,3 +271,5 @@ Programmatic consumers can import `RuntimeConfiguration`, `RuntimePolicy`, and
 `loadRuntimeConfiguration` from `src/engine.ts`, then pass the resolved policy
 to `runEvaluation` or a bundled host request. They must provide the same
 protected-source declarations required by their execution route.
+`loadRuntimeConfiguration` accepts those canonical protected roots as its third
+argument, so provider queries themselves cannot run from protected source trees.