@catalyst-cloud/cli 0.16.4 → 0.16.6

package/dist/onboard-runner.js

@@ -8,22 +8,24 @@ import { runnerAdmission, issueRunnerOrgKey, verifyRunnerRoutes } from "./onboar
 import { verifyOnboardRoutes } from "./onboard-capabilities.js";
 import { liveTeamKey, onboardTeamAdmission } from "./onboard-capacity.js";
 import { runnerVmCapabilities } from "./onboard-runner-probes.js";
+import { installDarwinThoughtsCustody } from "./onboard-runner-custody.js";
+import { canonicalDarwinThoughtsJson, parseDarwinThoughtsAuthority } from "../vendor/self-host/darwin-thoughts-custody/verifier.mjs";
 import { readExistingOnboardJson, readOnboardTeamInventory, selectedOnboardTeam, } from "./onboard-existing.js";
 import { onboardStateRoot, } from "./onboard.js";
 // "Run Catalyst's work on this machine": the self-hosted host from catalyst-cloud's deploy/self-host
 // (a supervisor and a deadline watchdog under Compose), enrolled with the person's own owner or
-// admin login. Never the operator token. Missing host images are pulled anonymously with an empty
-// disposable Docker config. Customer delivery uses public GHCR pins, without registry credentials.
+// admin login. Never the operator token. Native Linux pulls missing images anonymously with an
+// empty disposable Docker config; Darwin custody receives only already-cached pinned images.
 /** The Compose project name the vendored file declares. */
 export const RUNNER_PROJECT = "catalyst-host";
 export const RUNNER_SESSION_NETWORK = "catalyst-session-v1";
-/** Public multi-architecture images: host images from main 0b5495e144 (run 36999325814),
- * runner from main 48b5876e56 (run 37057503445). Explicit environment image values override
+/** Public multi-architecture images from main 3d657787e8: host run 38043266620,
+ * runner run 38042751509. Explicit environment image values override
  * these pins; the runner also preserves a saved image before choosing its default. */
 export const RUNNER_HOST_IMAGES = {
-    supervisor: "ghcr.io/coalesce-labs/catalyst-supervisor@sha256:fff1582e3ef763eae6728f195a8e3834383955ee03d39bcfe567f4a7361a8982",
-    watchdog: "ghcr.io/coalesce-labs/catalyst-deadline-watchdog@sha256:b64e38f9ee34240d1e3d256e954eb8de20e2d3e51ed873019d350aa60be639c1",
-    runner: "ghcr.io/coalesce-labs/catalyst-runner@sha256:50eeb256b4693fc42c81458bdfc887137a0df757260601f2a869738578d00782",
+    supervisor: "ghcr.io/coalesce-labs/catalyst-supervisor@sha256:a0a8f383b5869eddc8346b7d07fd98d92fe1cd4cfc57956cbbe9dc42d79a4727",
+    watchdog: "ghcr.io/coalesce-labs/catalyst-deadline-watchdog@sha256:a5999dbf229ac432b83c2ed3fe43fa251366baceb73af2f57590890a6a758f0d",
+    runner: "ghcr.io/coalesce-labs/catalyst-runner@sha256:88c6143f6c95f92fca9ca385f3c5145389e6d6d0532398c52d225d0edfcf2ea8",
 };
 const IMAGE_REF = /^[a-z0-9][a-z0-9._:/-]{0,255}@sha256:[0-9a-f]{64}$/;
 const HOST_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,62}$/;
@@ -33,6 +35,31 @@ const JOIN_TOKENS = "/api/v1/hosts/join-tokens";
 const CAPACITY = "/api/v1/me/runner-capacity";
 const RUNNER_UID = "10001:10001";
 const DIRS = ["slots", "thoughts", "locks"];
+const CUSTODY_KEYS = [
+    "CATALYST_THOUGHTS_CUSTODY_AUTHORITY",
+    "CATALYST_THOUGHTS_CUSTODY_REQUESTS_DIR",
+    "CATALYST_THOUGHTS_CUSTODY_RESPONSES_DIR",
+];
+/** A persisted authority selects bindings, never substitutes for a fresh native proof. */
+function persistedCustody(dir, values) {
+    const present = CUSTODY_KEYS.map(key => values?.[key] ?? "");
+    if (present.every(value => !value))
+        return "absent";
+    if (present.some(value => !value))
+        return "invalid";
+    try {
+        const authority = parseDarwinThoughtsAuthority(JSON.parse(present[0]));
+        return canonicalDarwinThoughtsJson(authority) === present[0] &&
+            authority.thoughtsRoot === join(dir, "thoughts") && authority.locksRoot === join(dir, "locks") &&
+            authority.requestsRoot === present[1] && authority.responsesRoot === present[2] &&
+            authority.requestsRoot === join(dir, "..", "darwin-thoughts-requests") &&
+            authority.responsesRoot === join(dir, "..", "darwin-thoughts-responses")
+            ? "installed" : "invalid";
+    }
+    catch {
+        return "invalid";
+    }
+}
 const DISK_POLICY_KEYS = [
     "CATALYST_SLOTS",
     "CATALYST_SLOT_DISK_MODE", "CATALYST_SLOT_DISK_BUDGET_GIB", "CATALYST_DISK_BUDGET_GIB",
@@ -76,27 +103,38 @@ export function dockerRunnerEngine(deps = {}) {
             return { code: 1, stdout: "" };
         }
     };
-    const compose = (dir) => [
-        "compose",
-        "--project-name",
-        RUNNER_PROJECT,
-        "--file",
-        join(dir, "compose.yaml"),
-        "--env-file",
-        join(dir, ".env"),
-    ];
-    const supervisorShell = (dir, script) => [
-        ...compose(dir),
-        "run",
-        "--rm",
-        "-T",
-        "--no-deps",
-        "--entrypoint",
-        "sh",
-        "supervisor",
-        "-c",
-        script,
-    ];
+    const compose = (dir) => {
+        const custody = persistedCustody(dir, readEnvFile(join(dir, ".env")));
+        if (custody === "invalid")
+            return null;
+        return [
+            "compose",
+            "--project-name",
+            RUNNER_PROJECT,
+            "--file",
+            join(dir, "compose.yaml"),
+            ...(custody === "installed" ? ["--file", join(dir, "compose.darwin-thoughts.yaml")] : []),
+            "--env-file",
+            join(dir, ".env"),
+        ];
+    };
+    const supervisorShell = (dir, script) => {
+        const files = compose(dir);
+        if (!files)
+            return null;
+        return [
+            ...files,
+            "run",
+            "--rm",
+            "-T",
+            "--no-deps",
+            "--entrypoint",
+            "sh",
+            "supervisor",
+            "-c",
+            script,
+        ];
+    };
     let nativeLocal = false;
     const endpoint = async (signal) => {
         // Reject conflicting selectors rather than infer precedence across Docker/Compose versions.
@@ -163,17 +201,37 @@ export function dockerRunnerEngine(deps = {}) {
                 const labels = config?.Labels;
                 const dir = labels?.["com.docker.compose.project.working_dir"];
                 if (config?.Image !== supervisorImage || labels?.["com.docker.compose.project"] !== RUNNER_PROJECT ||
-                    labels?.["com.docker.compose.service"] !== "supervisor" || typeof dir !== "string" || !isAbsolute(dir) ||
-                    labels?.["com.docker.compose.project.config_files"] !== join(dir, "compose.yaml"))
+                    labels?.["com.docker.compose.service"] !== "supervisor" || typeof dir !== "string" || !isAbsolute(dir))
                     return "unverified";
                 const inHome = relative(realpathSync(home), realpathSync(dir));
                 if (inHome === ".." || inHome.startsWith("../") || isAbsolute(inHome) || !lstatSync(dir).isDirectory())
                     return "unverified";
+                const saved = readEnvFile(join(dir, ".env"));
+                const custody = persistedCustody(dir, saved);
+                if (custody === "invalid")
+                    return "unverified";
+                const files = [join(dir, "compose.yaml"), ...(custody === "installed" ? [join(dir, "compose.darwin-thoughts.yaml")] : [])];
+                if (labels?.["com.docker.compose.project.config_files"] !== files.join(","))
+                    return "unverified";
                 for (const path of [join(dir, "compose.yaml"), join(dir, ".env")]) {
                     const stat = lstatSync(path);
                     if (!stat.isFile() || stat.uid !== process.getuid?.() || (stat.mode & 0o022) !== 0)
                         return "unverified";
                 }
+                if (custody === "installed") {
+                    for (const path of [join(dir, ".env"), join(dir, "compose.darwin-thoughts.yaml")]) {
+                        const stat = lstatSync(path);
+                        if (!stat.isFile() || stat.nlink !== 1 || stat.uid !== process.getuid?.() ||
+                            (stat.mode & 0o7777) !== 0o600)
+                            return "unverified";
+                    }
+                    for (const key of CUSTODY_KEYS.slice(1)) {
+                        const stat = lstatSync(saved[key]);
+                        if (!stat.isDirectory() || stat.uid !== process.getuid?.() ||
+                            (stat.mode & 0o7777) !== 0o700)
+                            return "unverified";
+                    }
+                }
                 if (!Array.isArray(config.Env) || !config.Env.every((entry) => typeof entry === "string"))
                     return "unverified";
                 const names = config.Env.filter((entry) => entry.startsWith("CATALYST_HOST_NAME="));
@@ -261,6 +319,9 @@ export function dockerRunnerEngine(deps = {}) {
             return runnerVmCapabilities({ paths: DIRS.map(sub => join(dir, sub)), image, baseUrl,
                 exec: docker, env, signal });
         },
+        async nativeThoughtsCustody(input, signal) {
+            return installDarwinThoughtsCustody({ ...input, deadlineMs: Date.now() + 30_000 }, signal);
+        },
         async socketGid() {
             if (!nativeLocal)
                 return null;
@@ -272,8 +333,11 @@ export function dockerRunnerEngine(deps = {}) {
             }
         },
         async claimDirs(dir, paths, signal) {
+            const files = compose(dir);
+            if (!files)
+                return false;
             const args = [
-                ...compose(dir),
+                ...files,
                 "run",
                 "--rm",
                 "-T",
@@ -293,13 +357,19 @@ export function dockerRunnerEngine(deps = {}) {
                 0);
         },
         async hasVolumeFile(dir, variable, signal) {
-            return ((await docker(supervisorShell(dir, `test -s "$${variable}"`), {
+            const args = supervisorShell(dir, `test -s "$${variable}"`);
+            if (!args)
+                return false;
+            return ((await docker(args, {
                 cwd: dir,
                 signal,
                 timeoutMs: 120_000,
             })).code === 0);
         },
         async enrollment(dir, signal) {
+            const files = compose(dir);
+            if (!files)
+                return null;
             const script = `(() => { const {readFileSync}=require("node:fs");
         try { const state=JSON.parse(readFileSync(process.env.CATALYST_HOST_CREDENTIAL_FILE,"utf8"));
           if (state.version!==1 || typeof state.secret!=="string" || !/^[A-Za-z0-9_-]{32,256}$/.test(state.secret)) process.exit(1);
@@ -313,7 +383,7 @@ export function dockerRunnerEngine(deps = {}) {
           if (!e) process.exit(1);
           process.stdout.write(JSON.stringify({hostId:e.hostId,tenant:e.tenant,team:e.team,enrollmentKind:e.enrollmentKind}));
         } catch { process.exit(1); } })();`;
-            const read = await docker([...compose(dir), "run", "--rm", "-T", "--no-deps", "--entrypoint", "bun", "supervisor", "-e", script], { cwd: dir, signal, timeoutMs: 120_000 });
+            const read = await docker([...files, "run", "--rm", "-T", "--no-deps", "--entrypoint", "bun", "supervisor", "-e", script], { cwd: dir, signal, timeoutMs: 120_000 });
             if (read.code !== 0)
                 return null;
             try {
@@ -330,6 +400,9 @@ export function dockerRunnerEngine(deps = {}) {
             }
         },
         async orgKeyStatus(dir, account, baseUrl, candidate, signal) {
+            const files = compose(dir);
+            if (!files)
+                return "unavailable";
             // Only a status leaves the container. No stored key or provider response is printed.
             const script = `(async () => {
         const {readFileSync,lstatSync}=require("node:fs");
@@ -358,7 +431,7 @@ export function dockerRunnerEngine(deps = {}) {
           return status(proposed && proposed!==stored ? "different" : "valid");
         } catch { return status("unavailable"); }
       })().catch(()=>process.stdout.write("unavailable"));`;
-            const read = await docker([...compose(dir), "run", "--rm", "-T", "--no-deps", "--entrypoint", "bun", "supervisor", "-e", script, baseUrl, account], { cwd: dir, input: candidate ? `${candidate}\n` : undefined, signal, timeoutMs: 120_000 });
+            const read = await docker([...files, "run", "--rm", "-T", "--no-deps", "--entrypoint", "bun", "supervisor", "-e", script, baseUrl, account], { cwd: dir, input: candidate ? `${candidate}\n` : undefined, signal, timeoutMs: 120_000 });
             const status = read.stdout.trim();
             return read.code === 0 && ["valid", "different", "missing", "invalid", "unavailable"].includes(status)
                 ? status : "unavailable";
@@ -367,7 +440,10 @@ export function dockerRunnerEngine(deps = {}) {
             if (variable !== "CATALYST_ORG_KEY_FILE")
                 return false;
             const script = `umask 077 && tmp=$(mktemp "$${variable}.onboard.XXXXXX") && trap 'rm -f "$tmp"' EXIT && cat > "$tmp" && test -s "$tmp" && chmod 600 "$tmp" && mv -f "$tmp" "$${variable}"`;
-            return ((await docker(supervisorShell(dir, script), {
+            const args = supervisorShell(dir, script);
+            if (!args)
+                return false;
+            return ((await docker(args, {
                 cwd: dir,
                 input: `${value}\n`,
                 signal,
@@ -375,11 +451,17 @@ export function dockerRunnerEngine(deps = {}) {
             })).code === 0);
         },
         async composeUp(dir, signal) {
-            return ((await docker([...compose(dir), "up", "--detach"], { cwd: dir, signal, timeoutMs: 600_000 }))
+            const files = compose(dir);
+            if (!files)
+                return false;
+            return ((await docker([...files, "up", "--detach"], { cwd: dir, signal, timeoutMs: 600_000 }))
                 .code === 0);
         },
         async composeRunning(dir, signal) {
-            const read = await docker([...compose(dir), "ps", "--status", "running", "--services"], { cwd: dir, signal });
+            const files = compose(dir);
+            if (!files)
+                return false;
+            const read = await docker([...files, "ps", "--status", "running", "--services"], { cwd: dir, signal });
             return (read.code === 0 &&
                 read.stdout.split("\n").some((line) => line.trim() === "supervisor"));
         },
@@ -479,6 +561,7 @@ export function onboardRunnerAdapter(input = {}) {
     let mayAct = false;
     let acted = false;
     let chosenName;
+    let receivedCustody;
     const selected = { selected: true };
     async function decide(journal) {
         if (decided !== undefined)
@@ -600,6 +683,11 @@ export function onboardRunnerAdapter(input = {}) {
             CATALYST_SLOTS_DIR: join(p.dir, "slots"),
             CATALYST_THOUGHTS_DIR: join(p.dir, "thoughts"),
             CATALYST_POOL_LOCK_DIR: join(p.dir, "locks"),
+            ...(p.info.vm && receivedCustody?.dir === p.dir ? {
+                CATALYST_THOUGHTS_CUSTODY_AUTHORITY: receivedCustody.result.envAuthority,
+                CATALYST_THOUGHTS_CUSTODY_REQUESTS_DIR: receivedCustody.result.requestsRoot,
+                CATALYST_THOUGHTS_CUSTODY_RESPONSES_DIR: receivedCustody.result.responsesRoot,
+            } : {}),
             CATALYST_SESSION_EGRESS_DIR: p.info.vm ? join(p.dir, "session-egress") : NATIVE_EGRESS_DIR,
             // Saved policy stays in merged(). An explicit value in this run overrides it.
             ...Object.fromEntries(DISK_POLICY_KEYS.flatMap(key => ctx.env[key] === undefined ? [] : [[key, ctx.env[key]]])),
@@ -677,6 +765,8 @@ export function onboardRunnerAdapter(input = {}) {
             if (!want)
                 return waiting("runner_docker_socket_unreadable", selected);
             const name = want.CATALYST_HOST_NAME;
+            if (p.info.vm && persistedCustody(p.dir, saved) !== "installed")
+                return mayAct && !afterAct ? { state: "pending" } : waiting(mayAct ? "runner_thoughts_custody_unavailable" : "runner_needs_runner_flag", { ...selected, hostName: name });
             let enrolled = null;
             const live = (hosts) => hosts?.find((host) => host.hostId === enrolled?.hostId && host.team === p.teamKey && !host.revoked);
             let hosts = await listHosts(ctx, p, signal);
@@ -699,6 +789,8 @@ export function onboardRunnerAdapter(input = {}) {
             let composeMatches = false;
             try {
                 composeMatches = readFileSync(join(p.dir, "compose.yaml")).equals(readFileSync(join(packageRoot(), "vendor", "self-host", "compose.yaml")));
+                if (p.info.vm)
+                    composeMatches = composeMatches && readFileSync(join(p.dir, "compose.darwin-thoughts.yaml")).equals(readFileSync(join(packageRoot(), "vendor", "self-host", "compose.darwin-thoughts.yaml")));
             }
             catch {
                 /* A missing or unreadable compose needs an explicitly authorized repair. */
@@ -778,11 +870,13 @@ export function onboardRunnerAdapter(input = {}) {
                 mkdirSync(p.dir, { recursive: true, mode: 0o700 });
                 if (lstatSync(p.dir).isSymbolicLink())
                     throw new Error("runner_directory_unsafe");
-                chmodSync(p.dir, 0o700);
+                if (!p.info.vm)
+                    chmodSync(p.dir, 0o700);
                 for (const sub of DIRS) {
                     mkdirSync(join(p.dir, sub), { recursive: true, mode: 0o700 });
                     // On native Linux the runner uid owns these after the first run; leave them alone.
-                    if (statSync(join(p.dir, sub)).uid === process.getuid?.())
+                    // The native Darwin installer must receive existing thoughts custody without adoption.
+                    if ((!p.info.vm || sub === "slots") && statSync(join(p.dir, sub)).uid === process.getuid?.())
                         chmodSync(join(p.dir, sub), 0o700);
                 }
                 // Mounted read-only into the supervisor (uid 10001), which reads the egress attestation.
@@ -833,7 +927,7 @@ export function onboardRunnerAdapter(input = {}) {
             if (!writeEnv(want))
                 return { state: "failed", reason: "runner_directory_unavailable", evidence: selected };
             for (const ref of Object.values(p.images)) {
-                if (!(await engine.imageArch(ref, signal))) {
+                if (!(await engine.imageArch(ref, signal)) && !p.info.vm) {
                     await engine.pull(ref, signal);
                 }
                 const arch = await engine.imageArch(ref, signal);
@@ -846,6 +940,30 @@ export function onboardRunnerAdapter(input = {}) {
                 const capability = await engine.vmCapabilities(p.dir, p.images.supervisor, p.baseUrl, signal);
                 if (capability !== "ready")
                     return waiting(capability, selected);
+                try {
+                    if (!engine.nativeThoughtsCustody)
+                        return waiting("runner_thoughts_custody_unavailable", selected);
+                    const result = await engine.nativeThoughtsCustody({ dir: p.dir,
+                        supervisorImage: p.images.supervisor, runnerImage: p.images.runner }, signal);
+                    if (signal?.aborted)
+                        return waiting("interrupted", selected);
+                    const values = {
+                        CATALYST_THOUGHTS_CUSTODY_AUTHORITY: result.envAuthority,
+                        CATALYST_THOUGHTS_CUSTODY_REQUESTS_DIR: result.requestsRoot,
+                        CATALYST_THOUGHTS_CUSTODY_RESPONSES_DIR: result.responsesRoot,
+                    };
+                    if (persistedCustody(p.dir, values) !== "installed" ||
+                        canonicalDarwinThoughtsJson(result.authority) !== result.envAuthority)
+                        return waiting("runner_thoughts_custody_unavailable", selected);
+                    writePrivate(join(p.dir, "compose.darwin-thoughts.yaml"), readFileSync(join(packageRoot(), "vendor", "self-host", "compose.darwin-thoughts.yaml"), "utf8"));
+                    receivedCustody = { dir: p.dir, result };
+                    want = (await desiredEnv(p, ctx));
+                    if (!writeEnv(want))
+                        return { state: "failed", reason: "runner_directory_unavailable", evidence: selected };
+                }
+                catch {
+                    return waiting(signal?.aborted ? "interrupted" : "runner_thoughts_custody_unavailable", selected);
+                }
             }
             const network = await engine.network(RUNNER_SESSION_NETWORK, signal);
             if (network === "misshaped")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@catalyst-cloud/cli",
-  "version": "0.16.4",
+  "version": "0.16.6",
   "description": "Set up Catalyst Cloud, check your tickets and manage your account from the command line.",
   "license": "MIT",
   "type": "module",
@@ -53,16 +53,16 @@
     "prepublishOnly": "node scripts/release-train-check.mjs --publish cli"
   },
   "dependencies": {
-    "@catalyst-cloud/sdk": "0.16.1",
+    "@catalyst-cloud/sdk": "0.16.3",
     "@clack/prompts": "1.8.1",
     "fast-string-width": "3.0.2",
     "fast-wrap-ansi": "0.2.2",
     "smol-toml": "^1.7.1",
     "yaml": "^2.9.0",
-    "@catalyst-cloud/sdk-replica-node": "0.16.1"
+    "@catalyst-cloud/sdk-replica-node": "0.16.3"
   },
   "devDependencies": {
-    "@catalyst-cloud/schema": "0.16.0",
+    "@catalyst-cloud/schema": "0.16.2",
     "@types/node": "^26.3.0",
     "@vitest/coverage-v8": "^4.1.11",
     "typescript": "^7.0.2",

package/skills/catalyst-github/SKILL.md

@@ -4,7 +4,7 @@ description: >-
   Catalyst's GitHub: show a ticket's pull request with its checks, reviews and review threads, say whether it is mergeable under this repository's policy, and explain what a PR accumulates as the ticket moves (the branch, the draft, the rewrite, the force-pushes, the labels, the queue). Use when someone asks "show me the PR", "what are the checks saying", "why hasn't it merged", "what does the queue need", "what does that label mean", or wants the branch and merge conventions Catalyst follows.
 allowed-tools: Bash(catalyst:*) Bash(npx -p @catalyst-cloud/cli catalyst:*)
 ---
-<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.4 — written in this repository for customer accounts -->
+<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.6 — written in this repository for customer accounts -->
 
 # Catalyst's GitHub
 

package/skills/catalyst-linear/SKILL.md

@@ -4,7 +4,7 @@ description: >-
   Catalyst's view of Linear on the customer's own cloud account. Reads a ticket with its comments, relations, labels, linked pull requests and agent sessions inline, from the cloud API by default, with local replica reads available as an explicit opt-in, always naming the source; searches tickets, PRs, projects and initiatives; writes comments, card moves, labels and new tickets through the account's agent proxy as the app actor, with every route, stage id, label id and marker read from the account's contract. Knows what a ticket accumulates as Catalyst works it (phase-outcome comments, the document per phase, the agent session, the labels, the single blocks relation, the bookkeeping marker, the eyes acknowledgement). Use when a person says "show me the ticket", "what did Catalyst write on it", "comment on it", "move it", "label it" or "file a ticket". Not for raising a decision for a human (what-needs-me) and not for pull requests (catalyst-github).
 allowed-tools: Bash(catalyst:*) Bash(npx -p @catalyst-cloud/cli catalyst:*)
 ---
-<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.4 — written in this repository for customer accounts -->
+<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.6 — written in this repository for customer accounts -->
 
 # Catalyst Linear
 

package/skills/catalyst-onboard/SKILL.md

@@ -4,7 +4,7 @@ description: >-
   Set up Catalyst Cloud and say whether setup is working. Walks a person from nothing to their first ticket running, one step at a time: the coding account, the project, the integrations and connected accounts, each repository's settings file, then one real ticket moving. Also logs this machine in, reads the readiness verdict with who can fix each failure, and checks the optional local replica. Use when someone says "set me up", "onboard me", "I just signed up", "get me started", "what do I do first", "log me in", "which account is this machine on", "am I set up", "what is missing", "why does nothing happen" or "is the replica running", when a login expired, or when a skill script exits 2 saying this machine is not connected. Does every step a key can do through the catalyst CLI, hands over the exact page for the steps only a browser can do, and never claims a step it did not watch succeed.
 allowed-tools: Bash(catalyst:*) Bash(npx -p @catalyst-cloud/cli catalyst:*)
 ---
-<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.4 — written in this repository for customer accounts -->
+<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.6 — written in this repository for customer accounts -->
 
 # Onboard me
 
@@ -55,6 +55,7 @@ Scripts are run, never read; each prints `--help`.
 | logging in, a refused or expired login, which account this is, the Linear identity | `references/connecting-this-machine.md` |
 | anything reports not ready, a check id, or who fixes something | `references/reading-ready.md` |
 | the coding account or the `host` part, or before saying work can run | `references/what-a-phase-needs.md`; a credential to replace, `references/replacing-a-credential.md` |
+| preserving an existing paused Darwin runner during owner-managed replacement | `references/preserving-runner-replacement.md` |
 | which steps a command does and which need a browser, or confirming a page that said it worked | `references/what-the-browser-owns.md` |
 | the repository's `.catalyst/catalyst.toml` and its approval; its AGENTS.md block and agent layout | `references/declaring-a-repository.md`; `references/repository-agent-setup.md` |
 | the replica or event cache | `references/local-sync.md` |

package/skills/catalyst-onboard/references/preserving-runner-replacement.md

@@ -0,0 +1,26 @@
+# Preserving a paused Darwin runner during replacement
+
+An installation owner can replace a known paused supervisor through the existing `catalyst onboard --runner` path while retaining the installation directory and named volumes. This is an owner-managed recovery for the standard Darwin state layout. The CLI does not automatically upgrade an existing container whose image differs from its desired image.
+
+Before changing the container, the installation owner must independently receive its full container ID, selected local daemon, paused state, Compose project/service labels, working directory and exact configuration-file list. Receive the owned Compose and private `.env` files without printing their contents. Match the retained host identity and team to the existing enrollment. Verify the named `catalyst-host_host-credential` and `catalyst-host_supervisor-state` volumes and their actual mounts. Keep the original files privately for operator recovery.
+
+The working directory must be the actual operator's `~/.local/state/catalyst/runner`. Keep the same OS operator, home, Docker selector, directory, Compose project, host name, team and volumes. Any saved machine-path mapping or state-directory environment selector must still resolve to that same standard directory. Do not relocate state or replace the login. Custom state layouts and an existing native producer configured for another supervisor pin require a separate repair; the producer refuses a changed pin instead of rekeying or adopting it.
+
+The new supervisor, watchdog and runner images must first be qualified and cached on that same daemon. Supply all three exact digest pins explicitly, including the runner pin: ordinary setup preserves a saved runner image. A runner must carry the Darwin thoughts custody capability required by the native installer. Qualification and cached bytes are prerequisites, not consequences of removing the old container.
+
+Once those prerequisites are received, the installation owner removes only the independently verified paused supervisor by its full container ID. Keep the directory, `.env`, Compose files, native thoughts and locks, credential volume and supervisor-state volume. Do not run Compose down, remove volumes, change ownership or broaden permissions.
+
+Resume the existing onboarding context with the same team and repository inputs and an explicit `--runner` in this invocation:
+
+```sh
+CATALYST_SUPERVISOR_IMAGE="$QUALIFIED_SUPERVISOR_IMAGE" \
+CATALYST_WATCHDOG_IMAGE="$QUALIFIED_WATCHDOG_IMAGE" \
+CATALYST_RUNNER_IMAGE="$QUALIFIED_RUNNER_IMAGE" \
+catalyst onboard --runner --only runner
+```
+
+The CLI's actual installation port now observes no supervisor container. It selects the same standard state directory and keeps the saved host name, join token and tuning. Cached target receiving and a successful fresh native custody exchange precede the credential and admission steps and supervisor activation. The retained enrolled credential identifies the existing host; this recovery does not require a new enrollment or org key. Native thoughts and lock ownership and modes remain unchanged.
+
+A cache miss or native custody refusal leaves the retained credentials and enrollment intact and does not activate the supervisor. Setup may already have refreshed Compose and `.env` with the selected target configuration. Keep the operator's original-file receipt until the replacement is accepted. A refusal must be repaired by its owner; do not substitute an old image, create a new producer key or erase the retained state.
+
+Accept the recovery only after the installation owner receives the exact new supervisor image, original credential and volume identities, loaded native producer, fresh custody exchange, preserved native modes, and a real successful work attempt with publication. Source tests alone do not prove a native installation.

package/skills/run-this-project/SKILL.md

@@ -4,7 +4,7 @@ description: >-
   Own one Catalyst Cloud project end to end until it closes. Use when the person says "run this project for me", "own this until it ships", "keep this moving", or hands you a project id or a set of tickets to drive. Subscribes to the account's event stream for the scope through the catalyst CLI, reacts to each change in the same turn, makes tickets ready and moves them to dispatch, parks what should stop, chases stalls, escalates inward, and keeps one status summary current. Writes to Linear as the app actor; never polls.
 allowed-tools: Bash(catalyst:*) Bash(npx -p @catalyst-cloud/cli catalyst:*)
 ---
-<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.4 — written in this repository for customer accounts -->
+<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.6 — written in this repository for customer accounts -->
 
 # Run this project
 

package/skills/unstick/SKILL.md

@@ -4,7 +4,7 @@ description: >-
   Get a stuck Catalyst Cloud ticket moving again. Use when the person asks "why is this parked and can you release it?", "unpark this", "get things flowing again", "the outage is over, retry what failed", or hands you a ticket that is not moving. Reads why nothing runs and what holds the ticket through the catalyst CLI, decides whether the recorded cause is fixed, previews the release, releases every governor holding the ticket the right way (or one failure class across a team), and raises an ask only for what a person has to do. Never releases a cause it cannot show changed without saying so.
 allowed-tools: Bash(catalyst:*) Bash(npx -p @catalyst-cloud/cli catalyst:*)
 ---
-<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.4 — written in this repository for customer accounts -->
+<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.6 — written in this repository for customer accounts -->
 
 # Unstick
 

package/skills/what-needs-me/SKILL.md

@@ -4,7 +4,7 @@ description: >-
   The human's decision inbox on Catalyst Cloud, and the one way an agent raises a decision on their behalf. Use when the person asks "what needs me?", "what am I blocking?", or when active work is gated on a choice only they can make. Lists open asks ranked by how much open work each one holds, files an ask through the cloud's ask route with the account's own template, and records the answer so the held work releases. Never answers as the human, never duplicates an open ask.
 allowed-tools: Bash(catalyst:*) Bash(npx -p @catalyst-cloud/cli catalyst:*)
 ---
-<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.4 — written in this repository for customer accounts -->
+<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.6 — written in this repository for customer accounts -->
 
 # What needs me
 

package/skills/what-this-repo-needs/SKILL.md

@@ -4,7 +4,7 @@ description: >-
   What environment variable names does this repository need, and where does each one come from? Scans the repository offline (no login, no network) and lists the names in three groups (build/test, deploy-only, bindings), each with where it was found, what uses it, and where a local value would come from. Never reads a value or prints one. Also checks the environment variable table in `.catalyst/catalyst.toml` offline. Use when someone asks "what does catalyst.env.json mean", "what env vars does this repo need", "why does the container need this", or before reviewing or writing the declaration.
 allowed-tools: Bash(catalyst:*) Bash(npx -p @catalyst-cloud/cli catalyst:*)
 ---
-<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.4 — written in this repository for customer accounts -->
+<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.6 — written in this repository for customer accounts -->
 
 # What this repository needs
 

package/skills/whats-happening/SKILL.md

@@ -4,7 +4,7 @@ description: >-
   Use for "what's happening?", "what machines do we have?", "how much capacity do we have?", "where are we?", "why is that stuck?", "what closed?", "what's next?", "how does this work?", "why did it do that?", "how does it prioritise?" and "what does this setting do, where is it set?" in Catalyst Cloud, or asks for something to be done rather than known. Reads the contract via catalyst CLI. Read-only: route work/decisions, never answer as the human.
 allowed-tools: Bash(catalyst:*) Bash(npx -p @catalyst-cloud/cli catalyst:*)
 ---
-<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.4 — written in this repository for customer accounts -->
+<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.6 — written in this repository for customer accounts -->
 
 # What's happening
 

package/vendor/self-host/compose.darwin-thoughts.yaml

@@ -0,0 +1,18 @@
+# Installed Darwin custody channels. Include with compose.yaml only after native producer setup.
+# The signing key and producer configuration remain on the native host, outside every mount.
+services:
+  supervisor:
+    environment:
+      CATALYST_THOUGHTS_CUSTODY_AUTHORITY: ${CATALYST_THOUGHTS_CUSTODY_AUTHORITY:?set installed Darwin authority}
+    volumes:
+      - type: bind
+        source: ${CATALYST_THOUGHTS_CUSTODY_REQUESTS_DIR:?set installed Darwin requests root}
+        target: ${CATALYST_THOUGHTS_CUSTODY_REQUESTS_DIR:?set installed Darwin requests root}
+        bind:
+          create_host_path: false
+      - type: bind
+        source: ${CATALYST_THOUGHTS_CUSTODY_RESPONSES_DIR:?set installed Darwin responses root}
+        target: ${CATALYST_THOUGHTS_CUSTODY_RESPONSES_DIR:?set installed Darwin responses root}
+        read_only: true
+        bind:
+          create_host_path: false

package/vendor/self-host/compose.yaml

@@ -70,9 +70,9 @@ services:
       # engine resolves a bind source on the HOST. A path that exists only inside this container
       # mounts an empty directory into the phase.
       - ${CATALYST_SLOTS_DIR:-/srv/catalyst/slots}:${CATALYST_SLOTS_DIR:-/srv/catalyst/slots}
-      # Thoughts stay as today (CTC-3493): a tenant's thoughts checkout and its pool lock directory
-      # are SHARED and read-write across that tenant's session containers, and every thoughts sync
-      # runs under thoughts.lock. The supervisor keeps one subdirectory per tenant under each root,
+      # Shared tenant thoughts and pool locks. Native Linux sessions use a read-write checkout.
+      # Darwin custody sessions expose a read-only model alias and a protected root publisher alias.
+      # Every thoughts sync runs under thoughts.lock. The supervisor keeps one subdirectory per tenant under each root,
       # so two projects on one engine never share a checkout or a lock. Same path on both sides for
       # the same reason as the slots: the supervisor binds these into session containers, and the
       # engine resolves bind sources on the host. Never mounted into a setup container.
@@ -100,6 +100,7 @@ services:
       CATALYST_HOST_FREE_FLOOR_GIB: ${CATALYST_HOST_FREE_FLOOR_GIB:-25}
       CATALYST_HOST_DISK_SAMPLE_FILE: ${CATALYST_HOST_DISK_SAMPLE_FILE:-}
       CATALYST_THOUGHTS_DIR: ${CATALYST_THOUGHTS_DIR:-/srv/catalyst/thoughts}
+      CATALYST_THOUGHTS_CUSTODY_AUTHORITY: ${CATALYST_THOUGHTS_CUSTODY_AUTHORITY:-}
       CATALYST_POOL_LOCK_DIR: ${CATALYST_POOL_LOCK_DIR:-/srv/catalyst/locks}
       CATALYST_ORG_KEY_FILE: ${CATALYST_ORG_KEY_FILE:-/var/lib/catalyst/host-credential/org-key}
       # `attempt`: sessions use their grant's own credential and the host holds no org key (CTC-4921).

package/vendor/self-host/darwin-thoughts-custody/manifest.json

@@ -0,0 +1,18 @@
+{
+  "version": 1,
+  "generator": "bun",
+  "inputs": {
+    "packages/host-isolation/src/darwin-thoughts-producer.ts": "038fb63d8121fb1665ec31869f45604aedd96dd7d9b15a415d578fea9a0ad507",
+    "packages/protocol/src/darwin-thoughts-custody.ts": "3515efc22b0a3cfb512ff1acaf649c6eafb978b894c724fabb01c325aea51075",
+    "packages/host-isolation/src/darwin-thoughts-custody.ts": "5d65d59d71205e2ce5551e99b4ad33364d53cbdd29993cf2f164fc214b83baf8",
+    "deploy/self-host/darwin-thoughts-custody/producer-entry.ts": "27c8ff591c8dc4d1a4c65dd154157df5191ead1fb0af673bfd7099d5226d37bc",
+    "deploy/self-host/darwin-thoughts-custody/verifier-entry.ts": "80bc1e72943e43bc33d76ba205bd79751f58ca34d622e35f7e50e3b661f65464",
+    "deploy/self-host/darwin-thoughts-custody/generate.ts": "bfe1bef175fa8243be0558e1ddee6ddbcfbd622922e3a5df850e8621f18e7b26",
+    "deploy/self-host/darwin-thoughts-custody/watchdog.mjs": "6b5c7204aacd296c85a216d4f1b3adbe2084024fe37200ec1d24dfc2dec2e12d",
+    "deploy/self-host/darwin-thoughts-custody/watchdog-deadline.mjs": "a642e6d8968f56f635056d3b258e5c4ad186c638a273c26b4528e85b7d2a6346",
+    "deploy/self-host/darwin-thoughts-custody/service.plist.in": "66e9a2c175d2500b1f7130e7c04a5ed07f22bc7425661777f514fa3f2a816496"
+  },
+  "artifactSha256": "0e0f1bbdac23813e8ee57b6eb4ae3dfd24c3f1c51ebe0c3d119a1448734ea05e",
+  "verifierSha256": "2d8c9b5c35e38a25a45098b7606a216109557fb0466113098f503e9d6c8f6b4c",
+  "verifierDeclarationsSha256": "624428ced2eb18b045b761b49e20b7f52c0fc6c3132689571103ece7b4a1083f"
+}